[GlobalTechInfo]

A version bump and nothing else, so the tag can point at exactly what has been merged and tested.

What v1.5.0 adds on top of v1.4.0

• MTProto fake TLS. An ee secret carries the same obfuscated2 stream inside TLS records, so someone scanning the Telegram port sees a handshake with a real certificate rather than random bytes. One port serves both kinds — dd and ee — and the kind is chosen per secret from the dashboard. Verified against an independent client implementation in both directions.
• CSRF protection on the admin API. The admin authenticates with HTTP Basic, and browsers attach those credentials to any request for the origin regardless of which page started it. State-changing requests carrying a foreign Origin, or Sec-Fetch-Site: cross-site, are now refused; requests with no Origin are left alone so curl and scripts keep working.
• Tiers on MTProto secrets. The Telegram relay never passes through the SOCKS5 pipeline, which had left every phone on an unmetered, unlimited pipe whatever its account was on the books for. Bandwidth, concurrent sessions and the data allowance are now enforced per secret, from the same Tiers map the SOCKS5 port uses, and the panel shows live usage.

Upgrading

No action needed. Databases migrate in place — the new tier column is added on next start, and secrets that already exist default to unlimited rather than being silently dropped to 1Mbps.

Two things that are deliberately not covered, both stated in the README:

• Expiry does not apply to a Telegram secret. There is no end date on a secret; a cap or a revocation is how such an account is stopped.
• REALITY sessions still bypass tier limits. xray forwards them through the socks outbound with the service's own credentials, so there is no per-UUID identity to meter. Closing that means per-user routing inside the xray config.

Also worth a real device test

The fake TLS handshake is proven against gotd's client implementation, not against the official Telegram apps, which parse more of the synthetic ServerHello than that client does. Worth trying on a real phone before pointing anyone at it.

Verified before tagging: gofmt and go vet clean, full suite green with and without xray, -race clean.

Summary by CodeRabbit

• Updates
  • The reported application version is now 1.5.0.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d0cdf21e-d067-4b70-8283-182a4698b70b

📥 Commits

Reviewing files that changed from the base of the PR and between 62f9f33 and ba0989f.

📒 Files selected for processing: 1

• main.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The application version constant changes from 1.4.0 to 1.5.0. Version reporting that uses this constant now returns the updated value.

Changes: Version Update

Layer / File(s)	Summary
Update reported version main.go	The version constant changes from 1.4.0 to 1.5.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to ba098

The release updates the application version through one shared constant, keeping its CLI, statistics API, and backup metadata aligned. No actionable merge-blocking risk is evident.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies this pull request as the v1.5.0 release and matches the version bump in the changeset.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}