Add restricted guest role

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/app.js

@@ -1,17 +1,19 @@
 import {
+  AUTH_ADMIN_ROLES,
   AUTH_ROLES,
   AUTH_ROLE_LABELS,
   changeOwnPassword,
   createUser,
   deleteUser,
   fetchAuthSession,
+  hasAccountControls,
   hasAuthRole,
   listUsers,
   login,
   logout,
   normalizeAuthRoles,
   updateUser
-} from "./chunk-BB2X7SND.js";
+} from "./chunk-FT2RH7BL.js";
 
 // src/webgl-renderer.ts
 (function initTrxWebGl(global) {
@@ -1846,6 +1848,19 @@ function buildRoleChoices(selected) {
     element.append(label);
     return { input, value };
   });
+  inputs.forEach(({ input, value }) => {
+    input.addEventListener("change", () => {
+      if (!input.checked) return;
+      if (value === "guest") {
+        inputs.forEach((choice) => {
+          if (choice.value !== "guest") choice.input.checked = false;
+        });
+      } else {
+        const guest = inputs.find((choice) => choice.value === "guest");
+        if (guest) guest.input.checked = false;
+      }
+    });
+  });
   return { element, inputs };
 }
 async function checkAuthStatus() {
@@ -1932,7 +1947,13 @@ function updateAuthUI() {
     return;
   }
   if (authRoles.length > 0) {
-    if (accountTab) accountTab.style.display = "";
+    const canManageAccount = hasAccountControls(authRoles);
+    if (accountTab) accountTab.style.display = canManageAccount ? "" : "none";
+    if (!canManageAccount && accountTab?.classList.contains("active")) {
+      const panel = document.getElementById("subtab-settings-account");
+      if (panel) panel.style.display = "none";
+      document.querySelector('[data-subtab="settings-scheduler"]')?.click();
+    }
     if (badge) badge.style.display = "block";
     if (badgeRole) badgeRole.textContent = `${authUsername || "local"} — ${authRoles.map((role) => AUTH_ROLE_LABELS[role]).join(", ")}`;
     if (headerAuthBtn2) {
@@ -5974,7 +5995,7 @@ async function initializeApp() {
   const authStatus = await checkAuthStatus();
   authEnabled = !authStatus.auth_disabled;
   if (!authEnabled) {
-    setAuthRoles(AUTH_ROLES);
+    setAuthRoles(AUTH_ADMIN_ROLES);
     hideAuthGate();
     updateAuthUI();
     connect();
@@ -6047,10 +6068,15 @@ async function refreshUserManagement() {
       enabledLabel.append(enabled, " Enabled");
       const isOnlyAdmin = user.enabled && hasAuthRole(user.roles, "administrator") && enabledAdminCount === 1;
       const administratorInput = roleInputs.find((item) => item.value === "administrator")?.input;
+      const guestInput = roleInputs.find((item) => item.value === "guest")?.input;
       if (isOnlyAdmin && administratorInput) {
         administratorInput.disabled = true;
         administratorInput.title = "The final administrator cannot be demoted";
       }
+      if (isOnlyAdmin && guestInput) {
+        guestInput.disabled = true;
+        guestInput.title = "The final administrator cannot become a Guest";
+      }
       if (isOnlyAdmin) {
         enabled.disabled = true;
         enabled.title = "The final enabled administrator cannot be disabled";