[fix](trx-frontend-http): block Guest password changes

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/app.ts

@@ -5173,6 +5173,14 @@ async function refreshUserManagement() {
       }
       const password = document.createElement("input");
       password.type = "password"; password.placeholder = "New password (8+ characters)"; password.autocomplete = "new-password"; password.className = "auth-input"; password.minLength = 8; password.maxLength = 1024;
+      const syncPasswordAccess = () => {
+        const guestActive = guestInput?.checked === true;
+        password.disabled = guestActive;
+        password.title = guestActive ? "Password changes are unavailable while the Guest role is active" : "";
+        if (guestActive) password.value = "";
+      };
+      roleInputs.forEach(({ input }) => input.addEventListener("change", syncPasswordAccess));
+      syncPasswordAccess();
       const save = document.createElement("button"); save.type = "button"; save.textContent = "Save";
       save.addEventListener("click", async () => {
         const changes: { roles?: AuthRole[]; password?: string; enabled?: boolean } = {

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/account-management.mjs

@@ -18,6 +18,7 @@ const fixture = await startWebFixture({
   },
   users: [
     { username: "admin", roles: ALL_ROLES, enabled: true },
+    { username: "guest", roles: ["guest"], enabled: true },
     { username: "listener", roles: ["read"], enabled: false },
   ],
 });
@@ -41,6 +42,7 @@ try {
     const rows = [...document.querySelectorAll("#user-list > .sch-row")];
     const rowFor = (username) => rows.find((row) => row.querySelector("strong")?.textContent.startsWith(username));
     const admin = rowFor("admin");
+    const guest = rowFor("guest");
     const listener = rowFor("listener");
     const role = (row, value) => row?.querySelector(`input[value="${value}"]`);
     return {
@@ -49,6 +51,7 @@ try {
       adminRoleLocked: role(admin, "administrator")?.disabled,
       adminGuestLocked: role(admin, "guest")?.disabled,
       adminRemoveLocked: admin?.querySelector("button.danger")?.disabled,
+      guestPasswordLocked: guest?.querySelector('input[type="password"]')?.disabled,
       listenerEnabled: listener?.querySelector('input[type="checkbox"]')?.checked,
       listenerRead: role(listener, "read")?.checked,
     };
@@ -58,8 +61,16 @@ try {
   assert.equal(state.adminRoleLocked, true);
   assert.equal(state.adminGuestLocked, true);
   assert.equal(state.adminRemoveLocked, true);
+  assert.equal(state.guestPasswordLocked, true);
   assert.equal(state.listenerEnabled, false);
   assert.equal(state.listenerRead, true);
+
+  const listenerRow = page.locator("#user-list > .sch-row").filter({ hasText: "listener" });
+  const listenerPassword = listenerRow.locator('input[type="password"]');
+  await listenerRow.locator('input[value="guest"]').check();
+  assert.equal(await listenerPassword.isDisabled(), true);
+  await listenerRow.locator('input[value="read"]').check();
+  assert.equal(await listenerPassword.isDisabled(), false);
   assert.deepEqual(runtimeErrors, []);
 } finally {
   await browser.close();