feat: add subdomain import + fix nuclei progress tracking

- Add subdomain import feature: POST /api/subdomains/import
  with modal UI on Subdomains page. Strips URLs, extracts
  root domain via publicsuffix (eTLD+1), groups by domain,
  batch inserts via existing BatchInsertSubdomains.
- Add ParseSubdomainAndRoot utility using golang.org/x/net/publicsuffix
- Fix nuclei global template scan not showing progress:
  RunScanInProcess now auto-creates phase tracking when
  total_phases is 0, same as executeScan does

Author: h0tak88r

internal/api/api.go

@@ -491,6 +491,7 @@ func SetupAPI() *gin.Engine {
 		apiGroup.POST("/subdomains/cnames/retry", apiRetryCnames)
 		apiGroup.GET("/subdomains/cnames/progress", apiRetryCnamesProgress)
 		apiGroup.POST("/subdomains/nuclei/run", apiRunGlobalNuclei)
+		apiGroup.POST("/subdomains/import", apiImportSubdomains)
 		apiGroup.GET("/scans", apiListScans)
 		apiGroup.GET("/scans/:id/results/summary", apiScanResultsSummary)
 		apiGroup.GET("/scans/:id/results/files", apiScanResultFiles)

internal/api/scan_runner.go

@@ -143,6 +143,22 @@ func RunScanInProcess(scanID, scanType, target string, fn func() error) {
 
 	_ = db.UpdateScanResult(scanID, status, "")
 
+	// Ensure every in-process scan shows progress in the dashboard.
+	// Without this, one-shot scans like global nuclei / subdomain_run
+	// appear with 0 phases and no progress bar.
+	record, _ := db.GetScan(scanID)
+	if record != nil && record.TotalPhases == 0 {
+		scanLabel := scanType
+		phaseFailed := status == "failed"
+		_ = db.AppendScanPhase(scanID, scanLabel+" scan", phaseFailed)
+		_ = db.UpdateScanProgress(scanID, &db.ScanProgress{
+			CurrentPhase:    1,
+			TotalPhases:     1,
+			PhaseName:       scanLabel + " scan",
+			CompletedPhases: []string{scanLabel + " scan"},
+		})
+	}
+
 	ScansMutex.Lock()
 	delete(ActiveScans, scanID)
 	ScansMutex.Unlock()

internal/api/ui/app.js

@@ -821,3 +821,15 @@ async function submitNucleiModal() {
   return callPageMethod('OpsToolsPage', 'submitNucleiModal');
 }
 
+function promptImportSubdomains() {
+  return callPageMethod('OpsToolsPage', 'promptImportSubdomains');
+}
+
+function closeImportSubdomainsModal() {
+  return callPageMethod('OpsToolsPage', 'closeImportSubdomainsModal');
+}
+
+async function submitImportSubdomains() {
+  return callPageMethod('OpsToolsPage', 'submitImportSubdomains');
+}
+

internal/api/ui/index.html

@@ -324,6 +324,9 @@ <h1 class="view-title">Subdomains</h1>
             <button id="copy-all-subs-btn" class="btn btn-ghost" style="font-size:12px;padding:7px 16px;gap:6px;display:flex;align-items:center">
               📋 Copy All Subdomains
             </button>
+            <button id="import-subs-btn" class="btn btn-primary" style="font-size:12px;padding:7px 16px;gap:6px;display:flex;align-items:center" onclick="promptImportSubdomains()">
+              📥 Import Subdomains
+            </button>
           </div>
         </div>
         <div class="filter-bar" id="filter-bar-subdomains" style="display:flex;gap:12px;flex-wrap:wrap">
@@ -710,6 +713,25 @@ <h2 class="auth-title" style="margin-bottom: 8px;">Run Global Nuclei Scan</h2>
   </div>
 </div>
 
+<!-- Subdomain Import Modal -->
+<div id="subdomain-import-modal" class="auth-gate" style="display:none; z-index: 1000;" aria-modal="true" role="dialog">
+  <div class="auth-card" style="max-width: 600px; width: 90%; max-height: 85vh; display: flex; flex-direction: column;">
+    <h2 class="auth-title" style="margin-bottom: 8px;">Import Subdomains</h2>
+    <p class="auth-sub" style="margin-bottom: 20px;">Paste a list of subdomains or URLs (one per line). Root domains are detected automatically.</p>
+    
+    <div style="display: flex; flex-direction: column; flex: 1; min-height: 0;">
+      <textarea id="subdomain-import-input" class="search-input auth-input" 
+        style="flex: 1; min-height: 250px; overflow-y: auto; font-family: 'JetBrains Mono', monospace; font-size: 13px; line-height: 1.5; padding: 12px; resize: vertical; background: #010409;" 
+        placeholder="admin.target.com&#10;https://dev.target.com/path?q=1&#10;api.staging.target.com:8080&#10;https://another-domain.net&#10;# lines starting with # are ignored"></textarea>
+    </div>
+
+    <div style="display: flex; gap: 12px; justify-content: flex-end; margin-top: 20px; flex-shrink: 0;">
+      <button type="button" class="btn btn-ghost" onclick="closeImportSubdomainsModal()">Cancel</button>
+      <button type="button" class="btn btn-primary" onclick="submitImportSubdomains()" style="background:var(--accent-cyan-dim);color:var(--accent-cyan);border-color:rgba(34,211,238,0.3)">📥 Import</button>
+    </div>
+  </div>
+</div>
+
 <!-- Toast notifications -->
 <div class="toast-container" id="toast-container"></div>
 

internal/api/ui/pages/ops-tools.js

@@ -174,6 +174,37 @@
     }
   }
 
+  function promptImportSubdomains() {
+    document.getElementById('subdomain-import-input').value = '';
+    document.getElementById('subdomain-import-modal').style.display = 'flex';
+  }
+
+  function closeImportSubdomainsModal() {
+    document.getElementById('subdomain-import-modal').style.display = 'none';
+  }
+
+  async function submitImportSubdomains() {
+    const lines = document.getElementById('subdomain-import-input').value.trim();
+    if (!lines) {
+      window.showToast('error', 'Error', 'No subdomains provided');
+      return;
+    }
+    try {
+      const data = await window.apiPost('/api/subdomains/import', { lines });
+      closeImportSubdomainsModal();
+      if (data.imported > 0) {
+        window.showToast('success', 'Imported', `${data.imported} subdomains across ${data.domains} domains` + (data.skipped ? ` (${data.skipped} skipped)` : ''));
+        if (typeof window.loadSubdomains === 'function') {
+          window.loadSubdomains(1, '');
+        }
+      } else {
+        window.showToast('warning', 'Nothing imported', data.message || 'No valid domains found');
+      }
+    } catch (err) {
+      window.showToast('error', 'Error', err.message);
+    }
+  }
+
   window.OpsToolsPage = {
     exportScanResultsCSV,
     generateScanReport,
@@ -182,11 +213,17 @@
     promptRunGlobalNuclei,
     closeNucleiModal,
     submitNucleiModal,
+    promptImportSubdomains,
+    closeImportSubdomainsModal,
+    submitImportSubdomains,
   };
 
   window.promptRetryCnames = promptRetryCnames;
   window.promptRunGlobalNuclei = promptRunGlobalNuclei;
   window.closeNucleiModal = closeNucleiModal;
   window.submitNucleiModal = submitNucleiModal;
+  window.promptImportSubdomains = promptImportSubdomains;
+  window.closeImportSubdomainsModal = closeImportSubdomainsModal;
+  window.submitImportSubdomains = submitImportSubdomains;
   setTimeout(startCnamesProgressPolling, 1000);
 })();

internal/api/ui_api.go

@@ -630,6 +630,78 @@ func apiRunGlobalNuclei(c *gin.Context) {
 	})
 }
 
+// POST /api/subdomains/import
+func apiImportSubdomains(c *gin.Context) {
+	_ = db.Init()
+	_ = db.EnsureSchema()
+
+	var req struct {
+		Lines string `json:"lines"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(400, gin.H{"error": "invalid payload"})
+		return
+	}
+
+	rawLines := strings.Split(strings.TrimSpace(req.Lines), "\n")
+	if len(rawLines) == 0 || (len(rawLines) == 1 && rawLines[0] == "") {
+		c.JSON(400, gin.H{"error": "no lines provided"})
+		return
+	}
+
+	// Group by root domain
+	byDomain := map[string][]string{}
+	skipped := 0
+	for _, line := range rawLines {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		root, sub, ok := utils.ParseSubdomainAndRoot(line)
+		if !ok {
+			skipped++
+			continue
+		}
+		byDomain[root] = append(byDomain[root], sub)
+	}
+
+	if len(byDomain) == 0 {
+		c.JSON(200, gin.H{"imported": 0, "skipped": skipped, "domains": 0, "message": "No valid domains found in input"})
+		return
+	}
+
+	total := 0
+	for domain, subs := range byDomain {
+		deduped := uniqueStrings(subs)
+		if err := db.BatchInsertSubdomains(domain, deduped, false); err != nil {
+			log.Printf("[subdomains/import] failed to insert %d subs for %s: %v", len(deduped), domain, err)
+			continue
+		}
+		total += len(deduped)
+	}
+
+	c.JSON(200, gin.H{
+		"imported": total,
+		"skipped":  skipped,
+		"domains":  len(byDomain),
+		"message":  fmt.Sprintf("Imported %d subdomains across %d domains", total, len(byDomain)),
+	})
+}
+
+func uniqueStrings(in []string) []string {
+	seen := map[string]bool{}
+	out := make([]string, 0, len(in))
+	for _, s := range in {
+		s = strings.TrimSpace(s)
+		if s == "" || seen[s] {
+			continue
+		}
+		seen[s] = true
+		out = append(out, s)
+	}
+	return out
+}
+
 // DELETE /api/domains/:domain — remove domain row, subdomains, related scans/artifacts, monitor rows, subdomain monitor target; R2 cleanup for those scans.
 func apiDeleteDomain(c *gin.Context) {
 	_ = db.Init()

internal/utils/domain.go

@@ -0,0 +1,49 @@
+package utils
+
+import (
+	"net/url"
+	"strings"
+
+	"golang.org/x/net/publicsuffix"
+)
+
+// ParseSubdomainAndRoot parses a raw input (URL or bare hostname) and returns
+// (rootDomain, subdomain, ok). The root domain is the eTLD+1 (e.g. "example.com").
+// The subdomain is the full hostname (e.g. "admin.staging.example.com").
+// Returns ok=false if the input can't be parsed as a valid domain.
+func ParseSubdomainAndRoot(raw string) (root, sub string, ok bool) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return "", "", false
+	}
+
+	if !strings.HasPrefix(raw, "http://") && !strings.HasPrefix(raw, "https://") {
+		raw = "http://" + raw
+	}
+
+	u, err := url.Parse(raw)
+	if err != nil || u.Host == "" {
+		return "", "", false
+	}
+
+	host := u.Hostname()
+	if host == "" {
+		return "", "", false
+	}
+
+	eTLD, icann := publicsuffix.PublicSuffix(host)
+	if !icann {
+		return "", "", false
+	}
+	if eTLD == host {
+		return "", "", false
+	}
+
+	// Compute eTLD+1 (root domain)
+	withoutTLD := strings.TrimSuffix(host, "."+eTLD)
+	parts := strings.Split(withoutTLD, ".")
+	root = parts[len(parts)-1] + "." + eTLD
+	sub = host
+
+	return root, sub, true
+}