Refactor HTTP account system

docs/Architecture.md

@@ -1043,7 +1043,7 @@ The `FrontendRuntimeContext` struct in `trx-frontend/src/lib.rs` is decomposed i
 |-----------|---------|------------|
 | `AudioContext` | Audio streaming channels | `rx`, `tx`, `info`, `decode_rx`, `clients` |
 | `DecodeHistoryContext` | Decode history for all types | `ais`, `vdes`, `aprs`, `hf_aprs`, `cw`, `ft8`, `ft4`, `ft2`, `wspr` |
-| `HttpAuthConfig` | HTTP auth settings | `enabled`, `rx_passphrase`, `session_ttl_secs`, `tokens` |
+| `HttpAuthConfig` | HTTP auth settings | `enabled`, `users_file`, bootstrap admin, `session_ttl_secs`, `tokens` |
 | `HttpUiConfig` | HTTP UI display config | `show_sdr_gain_control`, `initial_map_zoom`, `spectrum_*` |
 | `RigRoutingContext` | Remote rig state & routing | `active_rig_id`, `remote_rigs`, `rig_states`, `server_connected` |
 | `OwnerInfo` | Station metadata | `callsign`, `website_url`, `ais_vessel_url_base` |

docs/Planned-Features.md

@@ -477,7 +477,7 @@ first wins.
 | `GET` | `/api/logbook/now` | The server's UTC clock, for checking the browser's |
 | `GET` | `/api/logbook/prefill` | The six fields an entry opens with |
 
-Writes require the control role, as the rig endpoints do.
+Writes require the admin role, as the rig endpoints do.
 
 ### Frontend
 
@@ -516,7 +516,7 @@ All five are implemented.
 | Phase | Lands |
 |-------|-------|
 | 1 | `trx-logbook`: `Qso`, the ADI reader and writer, round-trip tests against files from other loggers |
-| 2 | Store, dedupe, and the HTTP API behind the control role |
+| 2 | Store, dedupe, and the HTTP API behind the admin role |
 | 3 | Logbook tab: entry, table, filters, import, export |
 | 4 | Ham layout, pre-filled entry from a decode row or the map, worked-before |
 | 5 | Contest exchange fields and Cabrillo export; QSL and LoTW/eQSL fields; per-band worked/confirmed statistics |
@@ -541,7 +541,7 @@ setting, which is also what LoTW's station locations expect.
 rotate operators through one station callsign, which is why contest loggers record it per QSO.
 It is stored per QSO, defaulted from the configured callsign so a single operator never touches
 it, and changed on the station line at the top of the panel where it sticks for the session.
-It cannot be taken from the session's identity: the auth roles are `control` and `rx`, with no
+It cannot be taken from the session's identity: the auth roles are `admin` and `user`, with no
 notion of who is logged in.
 
 **Server clock, and the log says so.** The server is the machine at the radio; the browser may

docs/UX_Guidelines.md

@@ -121,13 +121,12 @@ The spectrum panel uses `<canvas>` elements (WebGL renderer optional) and offers
 When auth is enabled, an **auth gate** blocks the UI with:
 
 - Title: "Access Required"
-- Subtitle: "Enter passphrase to continue"
-- Password input + Login button (green accent, full-width)
-- Optional "Continue as Guest" button (shown when RX passphrase is not set)
+- Subtitle: "Sign in to continue"
+- Username and password inputs + Login button (green accent, full-width)
 - Error message area (red `#ff6b6b`)
 - Role badge display
 
-Two roles: **Rx** (read-only) and **Control** (full access including TX/PTT).
+Two roles: **User** (read-only) and **Admin** (full access including user management).
 
 Session cookie: `trx_http_sid`, HttpOnly, configurable Secure and SameSite attributes.
 
@@ -340,21 +339,21 @@ Routes are classified into three tiers:
 
 | Tier | Examples | Requirement |
 |---|---|---|
-| **Public** | `/`, `/index.html`, `/map`, `/auth/*`, static assets | None |
-| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Rx or Control role |
-| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, all other POST | Control role only |
+| **Public** | `/`, `/index.html`, `/map`, login/session endpoints, static assets | None |
+| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | User or Admin role |
+| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, all other POST | Admin role only |
 
 ### 7.2 Session Management
 
 - Sessions are 128-bit random hex tokens stored in HttpOnly cookies
 - Configurable TTL (default from TOML config)
 - Expired sessions auto-pruned on access
-- Constant-time passphrase comparison to mitigate timing attacks
+- Passwords are verified against salted Argon2id hashes
 
-### 7.3 TX Access Control
+### 7.3 User Management
 
-An additional `tx_access_control_enabled` flag can restrict transmit-related actions even
-for Control-role users, providing an extra safety layer.
+Only administrators can list, add, update, or remove accounts. The final
+administrator cannot be removed or demoted.
 
 ---
 

docs/User-Manual.md

@@ -66,8 +66,7 @@ both:
 |------------|----------|----------|
 | `[listen.auth].tokens` | `tokens_file` | one token per line |
 | `[[remotes]].auth.token` | `token_file` | the token |
-| `[frontends.http.auth].rx_passphrase` | `rx_passphrase_file` | the passphrase |
-| `[frontends.http.auth].control_passphrase` | `control_passphrase_file` | the passphrase |
+| `[frontends.http.auth].bootstrap_admin_password` | `bootstrap_admin_password_file` | the initial administrator password |
 | `[frontends.http_json.auth].tokens` | `tokens_file` | one token per line |
 
 Blank lines and `#` comments are ignored in the list files. A config that holds
@@ -350,17 +349,17 @@ A name in any of those maps that no remote answers to is a config error.
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `enabled` | bool | `false` | Require a passphrase |
-| `rx_passphrase` | string | — | Passphrase granting receive-only access |
-| `rx_passphrase_file` | string | — | Read it from this file instead |
-| `control_passphrase` | string | — | Passphrase granting full control |
-| `control_passphrase_file` | string | — | Read it from this file instead |
-| `tx_access_control_enabled` | bool | `true` | Hide TX from unauthenticated users |
+| `enabled` | bool | `false` | Enable the user/password ACL |
+| `users_file` | string | `"trx-http-users.json"` | Persistent managed user database |
+| `bootstrap_admin_username` | string | — | First administrator, used only if the database is absent |
+| `bootstrap_admin_password` | string | — | First administrator password |
+| `bootstrap_admin_password_file` | string | — | Read the bootstrap password from this file instead |
 | `session_ttl_min` | u64 | `480` | Session lifetime |
 | `cookie_secure` | bool | `false` | Set Secure on the session cookie (needs HTTPS) |
 | `cookie_same_site` | string | `"Lax"` | `Strict`, `Lax`, or `None` |
 
-With `enabled = true`, at least one passphrase must be set.
+When enabling ACL for the first time, configure both bootstrap fields. After
+the database exists, remove the bootstrap credentials from configuration.
 
 #### `[frontends.rigctl]`
 
@@ -578,7 +577,7 @@ The link button in the top bar copies the current link to the clipboard. The
 address bar itself is updated as you tune, using `replaceState`, so sweeping
 the dial does not fill the browser's history.
 
-Applying a link changes the radio, so it needs the `control` role; an `rx`
+Applying a link changes the radio, so it needs the `admin` role; a `user`
 session opens the page and says the link was not applied. Links describe the
 rig's own dial — while a tab is listening to a virtual channel the address is
 left as it was, rather than publishing a frequency the rig is not on.
@@ -587,53 +586,58 @@ left as it was, rather than publishing a frequency the rig is not on.
 
 ## Authentication
 
-The HTTP frontend supports optional passphrase-based authentication with two
+The HTTP frontend supports an optional user/password ACL with multiple accounts and two
 roles:
 
-- **rx** — read-only access (monitoring, audio, decode streams)
-- **control** — full access (frequency, mode, PTT, and all settings)
+- **user** — read-only access (monitoring, audio, decode streams)
+- **admin** — full radio control, settings, and user management
 
 ### Configuration
 
 ```toml
 [frontends.http.auth]
 enabled = false
-rx_passphrase = "rx-only-passphrase"
-control_passphrase = "full-control-passphrase"
-tx_access_control_enabled = true
+users_file = "trx-http-users.json"
+bootstrap_admin_username = "admin"
+bootstrap_admin_password = "change-this-password"
 session_ttl_min = 480
 cookie_secure = false      # true if served via HTTPS
 cookie_same_site = "Lax"   # Strict|Lax|None
 ```
 
 When `enabled = false` (the default), all auth is bypassed and the UI behaves
-as before. When enabled, at least one passphrase must be set.
+as before. When enabling it for the first time, bootstrap credentials create
+the initial administrator and the Argon2id-hashed user database.
 
 ### Behaviour
 
 - On login, the server issues an `HttpOnly` session cookie.
 - Sessions are in-memory; a server restart invalidates all sessions.
 - Rate limiting is applied per IP to mitigate brute-force attempts.
-- When `tx_access_control_enabled = true`, TX/PTT controls are hidden and
-  rejected for unauthenticated or `rx`-role users.
+- User records persist in `users_file`; passwords are stored as salted Argon2id hashes.
+- `user` sessions cannot call control routes. There is no guest-access mode.
+- Administrators can add/remove users and change roles/passwords in Settings.
+- Removing an account or changing its password/role revokes its sessions.
 
 ### Routes
 
 | Endpoint | Method | Description |
 |----------|--------|-------------|
-| `/auth/login` | POST | Submit `{ "passphrase": "..." }` |
+| `/auth/login` | POST | Submit `{ "username": "...", "password": "..." }` |
 | `/auth/logout` | POST | Clear session |
 | `/auth/session` | GET | Check current session/role |
+| `/auth/users` | GET/POST | List or add users (admin only) |
+| `/auth/users/{username}` | PATCH/DELETE | Change password/role or remove user (admin only) |
 
-Protected routes require at least `rx` role. Control routes (set frequency,
-mode, PTT, etc.) require `control` role.
+Protected routes require at least `user` role. Control routes (set frequency,
+mode, PTT, etc.) require `admin` role.
 
 ### Frontend Flow
 
 1. On load, the UI calls `/auth/session`.
 2. If unauthenticated, a login screen is shown.
 3. On successful login, the normal UI loads.
-4. `rx` users see a read-only interface; `control` users get full controls.
+4. `user` accounts see a read-only interface; admins get full controls.
 5. If a session expires mid-use, streams stop and the login screen returns.
 
 ### Transport Security