[feat](trx-frontend-http): separate transmit permission

Assisted-By: Codex (GPT-5)
Signed-off-by: Stan Grams <sjg@haxx.space>

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/app.js

@@ -13,7 +13,7 @@ import {
   logout,
   normalizeAuthRoles,
   updateUser
-} from "./chunk-FT2RH7BL.js";
+} from "./chunk-PISLBJGN.js";
 
 // src/webgl-renderer.ts
 (function initTrxWebGl(global) {
@@ -1972,30 +1972,33 @@ function updateAuthUI() {
 }
 function applyAuthRestrictions() {
   if (authRoles.length === 0) return;
-  if (!hasAuthRole2("control")) {
+  if (!hasAuthRole2("transmit")) {
     const pttBtn2 = document.getElementById("ptt-btn");
+    const txLimitInput2 = document.getElementById("tx-limit");
+    const txLimitBtn2 = document.getElementById("tx-limit-btn");
+    const txAudioBtn2 = document.getElementById("tx-audio-btn");
+    const txLimitRow2 = document.getElementById("tx-limit-row");
+    if (pttBtn2) pttBtn2.disabled = true;
+    if (txAudioBtn2) txAudioBtn2.disabled = true;
+    if (txLimitBtn2) txLimitBtn2.disabled = true;
+    if (txLimitInput2) txLimitInput2.disabled = true;
+    if (txLimitRow2) txLimitRow2.style.opacity = "0.5";
+  }
+  if (!hasAuthRole2("control")) {
     const powerBtn2 = document.getElementById("power-btn");
     const lockBtn2 = document.getElementById("lock-btn");
     const freqInput = document.getElementById("freq");
     const centerFreqInput = document.getElementById("center-freq");
     const modeSelect = document.getElementById("mode");
-    const txLimitInput2 = document.getElementById("tx-limit");
-    const txLimitBtn2 = document.getElementById("tx-limit-btn");
-    const txAudioBtn2 = document.getElementById("tx-audio-btn");
-    const txLimitRow2 = document.getElementById("tx-limit-row");
     const jogUp = document.getElementById("jog-up");
     const jogDown = document.getElementById("jog-down");
     const jogButtons = document.querySelectorAll(".jog-step button");
     const vfoButtons = document.querySelectorAll("#vfo-picker button");
-    if (pttBtn2) pttBtn2.disabled = true;
     if (powerBtn2) powerBtn2.disabled = true;
     if (lockBtn2) lockBtn2.disabled = true;
-    if (txAudioBtn2) txAudioBtn2.disabled = true;
-    if (txLimitBtn2) txLimitBtn2.disabled = true;
     if (freqInput) freqInput.disabled = true;
     if (centerFreqInput) centerFreqInput.disabled = true;
     if (modeSelect) modeSelect.disabled = true;
-    if (txLimitInput2) txLimitInput2.disabled = true;
     vfoButtons.forEach((btn) => btn.disabled = true);
     const jogWheel2 = document.getElementById("jog-wheel");
     if (jogUp) jogUp.disabled = true;
@@ -2032,7 +2035,6 @@ function applyAuthRestrictions() {
         btn.disabled = true;
       }
     });
-    if (txLimitRow2) txLimitRow2.style.opacity = "0.5";
   }
 }
 function applyCapabilities(caps) {
@@ -4250,9 +4252,16 @@ function formatSignal(sUnits) {
   return overDb === 0 ? `${sigUnit("S")}9` : `${sigUnit("S")}9+${overDb}${sigUnit("dB")}`;
 }
 function setDisabled(disabled) {
-  [freqEl, centerFreqEl, modeEl, pttBtn, powerBtn, txLimitInput, txLimitBtn, lockBtn].forEach((el) => {
-    if (el) el.disabled = disabled;
+  const controlDisabled = disabled || authEnabled && !hasAuthRole2("control");
+  const transmitDisabled = disabled || authEnabled && !hasAuthRole2("transmit");
+  [freqEl, centerFreqEl, modeEl, powerBtn, lockBtn].forEach((el) => {
+    if (el) el.disabled = controlDisabled;
   });
+  [pttBtn, txLimitInput, txLimitBtn].forEach((el) => {
+    if (el) el.disabled = transmitDisabled;
+  });
+  const transmitAudio = document.getElementById("tx-audio-btn");
+  if (transmitAudio) transmitAudio.disabled = transmitDisabled || !hasWebCodecs;
   syncModePicker();
 }
 var serverVersion = null;
@@ -7329,6 +7338,10 @@ function startTxAudio() {
     void stopTxAudio();
     return;
   }
+  if (authEnabled && !hasAuthRole2("transmit")) {
+    audioStatus.textContent = "Transmit role required";
+    return;
+  }
   if (!hasWebCodecs) {
     audioStatus.textContent = "Audio requires Chrome/Edge";
     return;

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/background-decode.js

@@ -1,6 +1,6 @@
 import {
   hasAuthRole
-} from "./chunk-FT2RH7BL.js";
+} from "./chunk-PISLBJGN.js";
 import {
   hostState
 } from "./chunk-KL66PICH.js";

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/bookmarks.js

@@ -1,6 +1,6 @@
 import {
   hasAuthRole
-} from "./chunk-FT2RH7BL.js";
+} from "./chunk-PISLBJGN.js";
 import {
   hostCore,
   hostState

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/chunk-PISLBJGN.js

@@ -1,10 +1,11 @@
 // src/api/auth.ts
-var AUTH_ROLES = ["guest", "read", "control", "write", "administrator"];
+var AUTH_ROLES = ["guest", "read", "control", "transmit", "write", "administrator"];
 var AUTH_ADMIN_ROLES = AUTH_ROLES.filter((role) => role !== "guest");
 var AUTH_ROLE_LABELS = {
   guest: "Guest",
   read: "Read",
   control: "Control",
+  transmit: "Transmit",
   write: "Write",
   administrator: "Administrator"
 };
@@ -15,7 +16,7 @@ function normalizeAuthRoles(roles) {
   return AUTH_ROLES.filter((role) => roles.includes(role));
 }
 function hasAuthRole(roles, required) {
-  return roles.includes("administrator") || roles.includes(required) || required === "read" && roles.includes("guest") || required === "read" && roles.includes("control");
+  return roles.includes("administrator") || roles.includes(required) || required === "read" && roles.includes("guest") || required === "read" && (roles.includes("control") || roles.includes("transmit"));
 }
 function hasAccountControls(roles) {
   return roles.length > 0 && !roles.includes("guest");

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/logbook.js

@@ -1,6 +1,6 @@
 import {
   hasAuthRole
-} from "./chunk-FT2RH7BL.js";
+} from "./chunk-PISLBJGN.js";
 import {
   hostCore,
   hostState

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/scheduler.js

@@ -1,6 +1,6 @@
 import {
   hasAuthRole
-} from "./chunk-FT2RH7BL.js";
+} from "./chunk-PISLBJGN.js";
 import {
   hostState
 } from "./chunk-KL66PICH.js";

src/trx-client/trx-frontend/trx-frontend-http/frontend/package.json

@@ -12,7 +12,7 @@
     "typecheck": "tsc --project tsconfig.json && tsc --project tsconfig.worker.json",
     "lint": "eslint \"src/**/*.ts\" \"tests/**/*.mjs\" build.mjs --no-error-on-unmatched-pattern",
     "test": "node --test tests/*.test.mjs",
-    "test:browser": "node tests/browser-smoke.mjs && node tests/spectrum-layout.mjs && node tests/decode-flow.mjs && node tests/tune-links.mjs && node tests/mobile-layout.mjs && node tests/satellite-predictions.mjs && node tests/background-decode.mjs && node tests/logbook.mjs && node tests/account-management.mjs",
+    "test:browser": "node tests/browser-smoke.mjs && node tests/spectrum-layout.mjs && node tests/decode-flow.mjs && node tests/tune-links.mjs && node tests/mobile-layout.mjs && node tests/satellite-predictions.mjs && node tests/background-decode.mjs && node tests/logbook.mjs && node tests/account-management.mjs && node tests/transmit-role.mjs",
     "verify-generated": "npm run generate-types && npm run build && git diff --exit-code -- ../assets/web/generated src/api/generated.ts"
   },
   "devDependencies": {

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/api/auth.ts

@@ -6,12 +6,13 @@ import type { AuthRole } from "./generated.js";
 
 export type { AuthRole };
 
-export const AUTH_ROLES: readonly AuthRole[] = ["guest", "read", "control", "write", "administrator"];
+export const AUTH_ROLES: readonly AuthRole[] = ["guest", "read", "control", "transmit", "write", "administrator"];
 export const AUTH_ADMIN_ROLES: readonly AuthRole[] = AUTH_ROLES.filter(role => role !== "guest");
 export const AUTH_ROLE_LABELS: Readonly<Record<AuthRole, string>> = {
   guest: "Guest",
   read: "Read",
   control: "Control",
+  transmit: "Transmit",
   write: "Write",
   administrator: "Administrator",
 };
@@ -28,7 +29,7 @@ export function hasAuthRole(roles: readonly AuthRole[], required: AuthRole): boo
   return roles.includes("administrator")
     || roles.includes(required)
     || required === "read" && roles.includes("guest")
-    || required === "read" && roles.includes("control");
+    || required === "read" && (roles.includes("control") || roles.includes("transmit"));
 }
 
 export function hasAccountControls(roles: readonly AuthRole[]): boolean {

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/api/generated.ts

@@ -123,7 +123,7 @@ export type RigListResponse = { active_remote: string | null, rigs: Array<RigLis
 
 export type FrontendMeta = { clients: number, rigctl_clients: number, audio_clients: number, rigctl_addr: string | null, active_remote: string | null, remotes: Array<string>, owner_callsign: string | null, owner_website_url: string | null, owner_website_name: string | null, ais_vessel_url_base: string | null, show_sdr_gain_control: boolean, initial_map_zoom: number, spectrum_coverage_margin_hz: number, spectrum_usable_span_ratio: number, bandplan_enabled: boolean, bandplan_region: string, decode_history_retention_min: bigint, server_connected: boolean, };
 
-export type AuthRole = "guest" | "read" | "control" | "write" | "administrator";
+export type AuthRole = "guest" | "read" | "control" | "transmit" | "write" | "administrator";
 
 export type DecoderActivation = "mode_bound" | "toggle";
 

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/app.ts

@@ -584,35 +584,38 @@ function updateAuthUI() {
 function applyAuthRestrictions() {
   if (authRoles.length === 0) return;
 
-  // Disable TX/PTT/frequency/mode/VFO controls for user role
-  if (!hasAuthRole("control")) {
+  if (!hasAuthRole("transmit")) {
     const pttBtn = document.getElementById("ptt-btn") as HTMLButtonElement | null;
+    const txLimitInput = document.getElementById("tx-limit") as HTMLInputElement | null;
+    const txLimitBtn = document.getElementById("tx-limit-btn") as HTMLButtonElement | null;
+    const txAudioBtn = document.getElementById("tx-audio-btn") as HTMLButtonElement | null;
+    const txLimitRow = document.getElementById("tx-limit-row");
+    if (pttBtn) pttBtn.disabled = true;
+    if (txAudioBtn) txAudioBtn.disabled = true;
+    if (txLimitBtn) txLimitBtn.disabled = true;
+    if (txLimitInput) txLimitInput.disabled = true;
+    if (txLimitRow) txLimitRow.style.opacity = "0.5";
+  }
+
+  // General tuning and receive-side controls require Control.
+  if (!hasAuthRole("control")) {
     const powerBtn = document.getElementById("power-btn") as HTMLButtonElement | null;
     const lockBtn = document.getElementById("lock-btn") as HTMLButtonElement | null;
     const freqInput = document.getElementById("freq") as HTMLInputElement | null;
     const centerFreqInput = document.getElementById("center-freq") as HTMLInputElement | null;
     const modeSelect = document.getElementById("mode") as HTMLSelectElement | null;
-    const txLimitInput = document.getElementById("tx-limit") as HTMLInputElement | null;
-    const txLimitBtn = document.getElementById("tx-limit-btn") as HTMLButtonElement | null;
-    const txAudioBtn = document.getElementById("tx-audio-btn") as HTMLButtonElement | null;
-    const txLimitRow = document.getElementById("tx-limit-row");
     const jogUp = document.getElementById("jog-up") as HTMLButtonElement | null;
     const jogDown = document.getElementById("jog-down") as HTMLButtonElement | null;
     const jogButtons = document.querySelectorAll<HTMLButtonElement>(".jog-step button");
     const vfoButtons = document.querySelectorAll<HTMLButtonElement>("#vfo-picker button");
 
-    // Disable TX buttons
-    if (pttBtn) pttBtn.disabled = true;
     if (powerBtn) powerBtn.disabled = true;
     if (lockBtn) lockBtn.disabled = true;
-    if (txAudioBtn) txAudioBtn.disabled = true;
-    if (txLimitBtn) txLimitBtn.disabled = true;
 
     // Disable frequency/mode inputs
     if (freqInput) freqInput.disabled = true;
     if (centerFreqInput) centerFreqInput.disabled = true;
     if (modeSelect) modeSelect.disabled = true;
-    if (txLimitInput) txLimitInput.disabled = true;
 
     // Disable VFO selector
     vfoButtons.forEach(btn => btn.disabled = true);
@@ -656,9 +659,6 @@ function applyAuthRestrictions() {
         btn.disabled = true;
       }
     });
-
-    // Hide TX-specific UI but keep controls visible (disabled)
-    if (txLimitRow) txLimitRow.style.opacity = "0.5";
   }
 }
 
@@ -3080,9 +3080,16 @@ function formatSignal(sUnits: number) {
 }
 
 function setDisabled(disabled: boolean) {
-  [freqEl, centerFreqEl, modeEl, pttBtn, powerBtn, txLimitInput, txLimitBtn, lockBtn].forEach((el) => {
-    if (el) el.disabled = disabled;
+  const controlDisabled = disabled || (authEnabled && !hasAuthRole("control"));
+  const transmitDisabled = disabled || (authEnabled && !hasAuthRole("transmit"));
+  [freqEl, centerFreqEl, modeEl, powerBtn, lockBtn].forEach((el) => {
+    if (el) el.disabled = controlDisabled;
   });
+  [pttBtn, txLimitInput, txLimitBtn].forEach((el) => {
+    if (el) el.disabled = transmitDisabled;
+  });
+  const transmitAudio = document.getElementById("tx-audio-btn") as HTMLButtonElement | null;
+  if (transmitAudio) transmitAudio.disabled = transmitDisabled || !hasWebCodecs;
   syncModePicker();
 }
 
@@ -6370,6 +6377,10 @@ function stopRxAudio() {
 
 function startTxAudio() {
   if (txActive) { void stopTxAudio(); return; }
+  if (authEnabled && !hasAuthRole("transmit")) {
+    audioStatus.textContent = "Transmit role required";
+    return;
+  }
   if (!hasWebCodecs) {
     audioStatus.textContent = "Audio requires Chrome/Edge";
     return;

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/account-management.mjs

@@ -8,7 +8,7 @@ import { startBrowser, startWebFixture } from "./web-fixture.mjs";
 
 /* global document */
 
-const ALL_ROLES = ["read", "control", "write", "administrator"];
+const ALL_ROLES = ["read", "control", "transmit", "write", "administrator"];
 const fixture = await startWebFixture({
   authSession: {
     authenticated: true,

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/auth.test.mjs

@@ -15,13 +15,15 @@ function loadAuth(fetch) {
   return context.AuthApi;
 }
 
-test("role policy centralizes Guest and implied read access", () => {
+test("role policy centralizes Guest and separates Control from Transmit", () => {
   const auth = loadAuth(async () => { throw new Error("unused"); });
-  assert.deepEqual(Array.from(auth.AUTH_ROLES), ["guest", "read", "control", "write", "administrator"]);
+  assert.deepEqual(Array.from(auth.AUTH_ROLES), ["guest", "read", "control", "transmit", "write", "administrator"]);
   assert.equal(auth.hasAuthRole(["guest"], "read"), true);
   assert.equal(auth.hasAccountControls(["guest"]), false);
   assert.equal(auth.hasAccountControls(["read"]), true);
   assert.equal(auth.hasAuthRole(["control"], "read"), true);
+  assert.equal(auth.hasAuthRole(["transmit"], "read"), true);
+  assert.equal(auth.hasAuthRole(["control"], "transmit"), false);
   assert.equal(auth.hasAuthRole(["control"], "write"), false);
   assert.equal(auth.hasAuthRole(["administrator"], "write"), true);
 });

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/bookmarks.test.mjs

@@ -32,7 +32,7 @@ function hostFixture(overrides = {}) {
   const calls = { postPath: [], setRigFrequency: [], armOptimisticFrequency: [], applyLocalTunedFrequency: [], syncBandwidthInput: [], scheduleSpectrumDraw: 0, syncModePicker: 0 };
   const state = {
     authEnabled: false,
-    authRoles: ["read", "control", "write", "administrator"],
+    authRoles: ["read", "control", "transmit", "write", "administrator"],
     lastActiveRigId: null,
     lastRigIds: [],
     lastRigDisplayNames: {},

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/host-fixture.mjs

@@ -19,7 +19,7 @@ export function createHost({ state = {}, core = {}, modules = {} } = {}) {
         serverLat: null,
         serverLon: null,
         authEnabled: false,
-        authRoles: ["read", "control", "write", "administrator"],
+        authRoles: ["read", "control", "transmit", "write", "administrator"],
         lastActiveRigId: null,
         lastRigIds: [],
         lastRigDisplayNames: {},

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/transmit-role.mjs

@@ -0,0 +1,53 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+import { startBrowser, startWebFixture } from "./web-fixture.mjs";
+
+async function controlState(page) {
+  return {
+    frequency: await page.locator("#freq").isDisabled(),
+    ptt: await page.locator("#ptt-btn").isDisabled(),
+    txAudio: await page.locator("#tx-audio-btn").isDisabled(),
+    txLimit: await page.locator("#tx-limit-btn").isDisabled(),
+  };
+}
+
+async function inspectRole(roles) {
+  const fixture = await startWebFixture({
+    tx: true,
+    authSession: {
+      authenticated: true,
+      username: "operator",
+      roles,
+      auth_disabled: false,
+    },
+  });
+  const session = await startBrowser(chromium);
+  try {
+    await session.page.goto(`${fixture.origin}/`, { waitUntil: "domcontentloaded" });
+    await session.page.locator("#content").waitFor({ state: "visible" });
+    await session.page.waitForTimeout(1200);
+    assert.deepEqual(session.runtimeErrors, []);
+    return await controlState(session.page);
+  } finally {
+    await session.browser.close();
+    await fixture.close();
+  }
+}
+
+assert.deepEqual(await inspectRole(["control"]), {
+  frequency: false,
+  ptt: true,
+  txAudio: true,
+  txLimit: true,
+});
+
+assert.deepEqual(await inspectRole(["transmit"]), {
+  frequency: true,
+  ptt: false,
+  txAudio: false,
+  txLimit: false,
+});

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/web-fixture.mjs

@@ -145,7 +145,7 @@ export async function startWebFixture({
   bandplanEnabled = false,
   bandplanUnauthorizedFirst = false,
   satPasses = null,
-  authSession = { authenticated: true, roles: ["read", "control", "write", "administrator"], auth_disabled: true },
+  authSession = { authenticated: true, roles: ["read", "control", "transmit", "write", "administrator"], auth_disabled: true },
   users = [],
 } = {}) {
   const rigItems = ["rig-a", "rig-b"].map((remote) => ({

src/trx-client/trx-frontend/trx-frontend-http/src/audio.rs

@@ -737,6 +737,7 @@ pub async fn audio_ws(
     body: web::Payload,
     query: web::Query<AudioQuery>,
     context: web::Data<Arc<FrontendRuntimeContext>>,
+    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
     let Some(tx_sender) = context.audio.tx.as_ref().cloned() else {
         return Ok(HttpResponse::NotFound().body("audio not enabled"));
@@ -746,6 +747,7 @@ pub async fn audio_ws(
     if !req.headers().contains_key("upgrade") {
         return Ok(HttpResponse::NoContent().finish());
     }
+    let tx_session_id = crate::server::auth::extract_session_id(&req);
 
     // If a channel_id is specified, subscribe to the per-channel broadcaster.
     // The entry is created asynchronously when AUDIO_MSG_VCHAN_ALLOCATED arrives
@@ -880,6 +882,16 @@ pub async fn audio_ws(
                 msg = msg_stream.recv() => {
                     match msg {
                         Some(Ok(Message::Binary(data))) => {
+                            let can_transmit = !auth_state.config.enabled
+                                || crate::server::auth::session_id_grants(
+                                    tx_session_id.as_ref(),
+                                    &auth_state,
+                                    crate::server::auth::AuthRole::Transmit,
+                                );
+                            if !can_transmit {
+                                warn!("Audio WS: closing after unauthorized TX frame");
+                                break;
+                            }
                             let _ = tx_sender.send(Bytes::from(data.to_vec())).await;
                         }
                         Some(Ok(Message::Close(_))) => break,

src/trx-client/trx-frontend/trx-frontend-http/src/auth.rs

@@ -38,6 +38,7 @@ pub enum AuthRole {
     Guest,
     Read,
     Control,
+    Transmit,
     Write,
     Administrator,
 }
@@ -48,22 +49,29 @@ impl AuthRole {
             Self::Guest => "guest",
             Self::Read => "read",
             Self::Control => "control",
+            Self::Transmit => "transmit",
             Self::Write => "write",
             Self::Administrator => "administrator",
         }
     }
 
     pub fn full_access() -> BTreeSet<Self> {
-        [Self::Read, Self::Control, Self::Write, Self::Administrator]
-            .into_iter()
-            .collect()
+        [
+            Self::Read,
+            Self::Control,
+            Self::Transmit,
+            Self::Write,
+            Self::Administrator,
+        ]
+        .into_iter()
+        .collect()
     }
 
     fn grants(self, required: Self) -> bool {
         self == Self::Administrator
             || self == required
             || self == Self::Guest && required == Self::Read
-            || self == Self::Control && required == Self::Read
+            || matches!(self, Self::Control | Self::Transmit) && required == Self::Read
     }
 }
 
@@ -776,7 +784,7 @@ pub struct ChangePasswordRequest {
 }
 
 /// Extract session from cookie
-fn extract_session_id(req: &HttpRequest) -> Option<SessionId> {
+pub fn extract_session_id(req: &HttpRequest) -> Option<SessionId> {
     req.cookie("trx_http_sid")
         .map(|cookie| cookie.value().to_string())
 }
@@ -789,7 +797,18 @@ pub fn get_session_roles(req: &HttpRequest, auth_state: &AuthState) -> Option<Au
 }
 
 pub fn session_grants(req: &HttpRequest, auth_state: &AuthState, role: AuthRole) -> bool {
-    get_session_roles(req, auth_state).is_some_and(|roles| roles_grant(&roles, role))
+    let session_id = extract_session_id(req);
+    session_id_grants(session_id.as_ref(), auth_state, role)
+}
+
+pub fn session_id_grants(
+    session_id: Option<&SessionId>,
+    auth_state: &AuthState,
+    role: AuthRole,
+) -> bool {
+    session_id
+        .and_then(|id| auth_state.store.get(id))
+        .is_some_and(|session| roles_grant(&session.roles, role))
 }
 
 fn require_session(
@@ -1113,12 +1132,14 @@ enum RouteAccess {
     Account,
     /// Read-only resources (Guest, Read, Control, or Administrator required)
     Read,
-    /// Bookmarks (Guest, Read, Control, Write, or Administrator required)
+    /// Bookmarks (Guest, Read, Control, Transmit, Write, or Administrator required)
     ReadWrite,
     /// Logbook access (Write or Administrator required)
     Write,
     /// Radio control (Control or Administrator required)
     Control,
+    /// Transmit actions (Transmit or Administrator required)
+    Transmit,
     /// Managed-account administration.
     Administrator,
 }
@@ -1146,6 +1167,9 @@ impl RouteAccess {
         if path == "/auth/users" || path.starts_with("/auth/users/") {
             return Self::Administrator;
         }
+        if path == "/set_ptt" || path == "/set_tx_limit" {
+            return Self::Transmit;
+        }
 
         // Static assets.  The band plan is one of them: it is compiled into the
         // binary and identical for every user, but ".json" is not an asset
@@ -1206,6 +1230,7 @@ impl RouteAccess {
                 .is_some_and(|roles| roles_grant_any(roles, &[AuthRole::Read, AuthRole::Write])),
             Self::Write => roles.is_some_and(|roles| roles_grant(roles, AuthRole::Write)),
             Self::Control => roles.is_some_and(|roles| roles_grant(roles, AuthRole::Control)),
+            Self::Transmit => roles.is_some_and(|roles| roles_grant(roles, AuthRole::Transmit)),
             Self::Administrator => {
                 roles.is_some_and(|roles| roles_grant(roles, AuthRole::Administrator))
             }
@@ -1379,6 +1404,11 @@ mod tests {
             RouteAccess::Control
         );
         assert_eq!(RouteAccess::from_path("/set_mode"), RouteAccess::Control);
+        assert_eq!(RouteAccess::from_path("/set_ptt"), RouteAccess::Transmit);
+        assert_eq!(
+            RouteAccess::from_path("/set_tx_limit"),
+            RouteAccess::Transmit
+        );
     }
 
     #[test]
@@ -1386,6 +1416,7 @@ mod tests {
         let guest = roles(&[AuthRole::Guest]);
         let read = roles(&[AuthRole::Read]);
         let control = roles(&[AuthRole::Control]);
+        let transmit = roles(&[AuthRole::Transmit]);
         let write = roles(&[AuthRole::Write]);
         let administrator = roles(&[AuthRole::Administrator]);
         assert!(RouteAccess::Public.allows(None));
@@ -1399,6 +1430,7 @@ mod tests {
         assert!(RouteAccess::Read.allows(Some(&guest)));
         assert!(RouteAccess::Read.allows(Some(&read)));
         assert!(RouteAccess::Read.allows(Some(&control)));
+        assert!(RouteAccess::Read.allows(Some(&transmit)));
         assert!(!RouteAccess::Read.allows(Some(&write)));
         assert!(RouteAccess::Read.allows(Some(&administrator)));
 
@@ -1413,7 +1445,11 @@ mod tests {
         assert!(!RouteAccess::Control.allows(None));
         assert!(!RouteAccess::Control.allows(Some(&read)));
         assert!(RouteAccess::Control.allows(Some(&control)));
+        assert!(!RouteAccess::Control.allows(Some(&transmit)));
         assert!(RouteAccess::Control.allows(Some(&administrator)));
+        assert!(!RouteAccess::Transmit.allows(Some(&control)));
+        assert!(RouteAccess::Transmit.allows(Some(&transmit)));
+        assert!(RouteAccess::Transmit.allows(Some(&administrator)));
         assert!(!RouteAccess::Administrator.allows(Some(&control)));
         assert!(RouteAccess::Administrator.allows(Some(&administrator)));
     }
@@ -1442,6 +1478,28 @@ mod tests {
         assert!(store.get(&session_id).is_none());
     }
 
+    #[test]
+    fn transmit_grant_tracks_live_session_revocation() {
+        let directory = tempfile::tempdir().unwrap();
+        let state = AuthState::new(test_auth_config(directory.path().join("users.json"))).unwrap();
+        let session_id = state.store.create(
+            "operator".to_string(),
+            roles(&[AuthRole::Transmit]),
+            Duration::from_secs(3600),
+        );
+        assert!(session_id_grants(
+            Some(&session_id),
+            &state,
+            AuthRole::Transmit
+        ));
+        state.store.remove(&session_id);
+        assert!(!session_id_grants(
+            Some(&session_id),
+            &state,
+            AuthRole::Transmit
+        ));
+    }
+
     #[test]
     fn user_store_bootstraps_and_manages_users() {
         let directory = tempfile::tempdir().unwrap();