[feat](trx-frontend-http): separate transmit permission

Assisted-By: Codex (GPT-5)
Signed-off-by: Stan Grams <sjg@haxx.space>

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/account-management.mjs

@@ -8,7 +8,7 @@ import { startBrowser, startWebFixture } from "./web-fixture.mjs";
 
 /* global document */
 
-const ALL_ROLES = ["read", "control", "write", "administrator"];
+const ALL_ROLES = ["read", "control", "transmit", "write", "administrator"];
 const fixture = await startWebFixture({
   authSession: {
     authenticated: true,

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/auth.test.mjs

@@ -15,13 +15,15 @@ function loadAuth(fetch) {
   return context.AuthApi;
 }
 
-test("role policy centralizes Guest and implied read access", () => {
+test("role policy centralizes Guest and separates Control from Transmit", () => {
   const auth = loadAuth(async () => { throw new Error("unused"); });
-  assert.deepEqual(Array.from(auth.AUTH_ROLES), ["guest", "read", "control", "write", "administrator"]);
+  assert.deepEqual(Array.from(auth.AUTH_ROLES), ["guest", "read", "control", "transmit", "write", "administrator"]);
   assert.equal(auth.hasAuthRole(["guest"], "read"), true);
   assert.equal(auth.hasAccountControls(["guest"]), false);
   assert.equal(auth.hasAccountControls(["read"]), true);
   assert.equal(auth.hasAuthRole(["control"], "read"), true);
+  assert.equal(auth.hasAuthRole(["transmit"], "read"), true);
+  assert.equal(auth.hasAuthRole(["control"], "transmit"), false);
   assert.equal(auth.hasAuthRole(["control"], "write"), false);
   assert.equal(auth.hasAuthRole(["administrator"], "write"), true);
 });

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/bookmarks.test.mjs

@@ -32,7 +32,7 @@ function hostFixture(overrides = {}) {
   const calls = { postPath: [], setRigFrequency: [], armOptimisticFrequency: [], applyLocalTunedFrequency: [], syncBandwidthInput: [], scheduleSpectrumDraw: 0, syncModePicker: 0 };
   const state = {
     authEnabled: false,
-    authRoles: ["read", "control", "write", "administrator"],
+    authRoles: ["read", "control", "transmit", "write", "administrator"],
     lastActiveRigId: null,
     lastRigIds: [],
     lastRigDisplayNames: {},

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/host-fixture.mjs

@@ -19,7 +19,7 @@ export function createHost({ state = {}, core = {}, modules = {} } = {}) {
         serverLat: null,
         serverLon: null,
         authEnabled: false,
-        authRoles: ["read", "control", "write", "administrator"],
+        authRoles: ["read", "control", "transmit", "write", "administrator"],
         lastActiveRigId: null,
         lastRigIds: [],
         lastRigDisplayNames: {},

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/transmit-role.mjs

@@ -0,0 +1,53 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+import { startBrowser, startWebFixture } from "./web-fixture.mjs";
+
+async function controlState(page) {
+  return {
+    frequency: await page.locator("#freq").isDisabled(),
+    ptt: await page.locator("#ptt-btn").isDisabled(),
+    txAudio: await page.locator("#tx-audio-btn").isDisabled(),
+    txLimit: await page.locator("#tx-limit-btn").isDisabled(),
+  };
+}
+
+async function inspectRole(roles) {
+  const fixture = await startWebFixture({
+    tx: true,
+    authSession: {
+      authenticated: true,
+      username: "operator",
+      roles,
+      auth_disabled: false,
+    },
+  });
+  const session = await startBrowser(chromium);
+  try {
+    await session.page.goto(`${fixture.origin}/`, { waitUntil: "domcontentloaded" });
+    await session.page.locator("#content").waitFor({ state: "visible" });
+    await session.page.waitForTimeout(1200);
+    assert.deepEqual(session.runtimeErrors, []);
+    return await controlState(session.page);
+  } finally {
+    await session.browser.close();
+    await fixture.close();
+  }
+}
+
+assert.deepEqual(await inspectRole(["control"]), {
+  frequency: false,
+  ptt: true,
+  txAudio: true,
+  txLimit: true,
+});
+
+assert.deepEqual(await inspectRole(["transmit"]), {
+  frequency: true,
+  ptt: false,
+  txAudio: false,
+  txLimit: false,
+});

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/web-fixture.mjs

@@ -145,7 +145,7 @@ export async function startWebFixture({
   bandplanEnabled = false,
   bandplanUnauthorizedFirst = false,
   satPasses = null,
-  authSession = { authenticated: true, roles: ["read", "control", "write", "administrator"], auth_disabled: true },
+  authSession = { authenticated: true, roles: ["read", "control", "transmit", "write", "administrator"], auth_disabled: true },
   users = [],
 } = {}) {
   const rigItems = ["rig-a", "rig-b"].map((remote) => ({