[feat](trx-frontend-http): add restricted Guest role

Assisted-By: Codex (GPT-5) Signed-off-by: Stan Grams <sjg@haxx.space>
2026-08-11 16:04:51 +02:00
parent 5e9dae02c7
commit 44870bc941
17 changed files with 240 additions and 66 deletions
@@ -926,7 +926,8 @@ main
 ### HTTP Frontend Auth

 - Optional Argon2id-backed managed accounts with HttpOnly session cookies
- Composable Read, Control, Write, and Administrator roles, with policy shared by middleware and handlers
+- An exclusive Guest role plus composable Read, Control, Write, and Administrator roles, with policy shared by middleware and handlers
+- Guest sessions receive read-only station access but no account-control endpoints or panels
 - Atomic JSON persistence with migration from the legacy single-role schema
 - Account enable/disable, administrator CRUD, self-service password changes, and session revocation on security changes
 - A database invariant always preserves at least one enabled administrator