Add composable HTTP access roles

Cargo.lock

@@ -316,6 +316,18 @@ version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.2.17",
+ "password-hash",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -345,6 +357,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bindgen"
 version = "0.66.1"
@@ -395,6 +413,24 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.12.0"
@@ -525,7 +561,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.3.0",
  "rand_core 0.10.1",
 ]
 
@@ -721,6 +757,15 @@ dependencies = [
  "windows",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "cpufeatures"
 version = "0.3.0"
@@ -739,6 +784,16 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.2.1"
@@ -799,15 +854,26 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
 [[package]]
 name = "digest"
 version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
 dependencies = [
- "block-buffer",
+ "block-buffer 0.12.0",
  "const-oid",
- "crypto-common",
+ "crypto-common 0.2.1",
 ]
 
 [[package]]
@@ -1019,6 +1085,16 @@ dependencies = [
  "slab",
 ]
 
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -1890,6 +1966,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "peeking_take_while"
 version = "0.1.2"
@@ -2492,8 +2579,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.3.0",
- "digest",
+ "digest 0.11.2",
 ]
 
 [[package]]
@@ -3215,6 +3302,7 @@ version = "0.1.0"
 dependencies = [
  "actix-web",
  "actix-ws",
+ "argon2",
  "base64",
  "brotli 7.0.0",
  "bytes",

docs/Architecture.md

@@ -1043,7 +1043,7 @@ The `FrontendRuntimeContext` struct in `trx-frontend/src/lib.rs` is decomposed i
 |-----------|---------|------------|
 | `AudioContext` | Audio streaming channels | `rx`, `tx`, `info`, `decode_rx`, `clients` |
 | `DecodeHistoryContext` | Decode history for all types | `ais`, `vdes`, `aprs`, `hf_aprs`, `cw`, `ft8`, `ft4`, `ft2`, `wspr` |
-| `HttpAuthConfig` | HTTP auth settings | `enabled`, `rx_passphrase`, `session_ttl_secs`, `tokens` |
+| `HttpAuthConfig` | HTTP auth settings | `enabled`, `users_file`, bootstrap admin/read accounts, `session_ttl_secs`, `tokens` |
 | `HttpUiConfig` | HTTP UI display config | `show_sdr_gain_control`, `initial_map_zoom`, `spectrum_*` |
 | `RigRoutingContext` | Remote rig state & routing | `active_rig_id`, `remote_rigs`, `rig_states`, `server_connected` |
 | `OwnerInfo` | Station metadata | `callsign`, `website_url`, `ais_vessel_url_base` |

docs/Planned-Features.md

@@ -477,7 +477,7 @@ first wins.
 | `GET` | `/api/logbook/now` | The server's UTC clock, for checking the browser's |
 | `GET` | `/api/logbook/prefill` | The six fields an entry opens with |
 
-Writes require the control role, as the rig endpoints do.
+Writes require the admin role, as the rig endpoints do.
 
 ### Frontend
 
@@ -516,7 +516,7 @@ All five are implemented.
 | Phase | Lands |
 |-------|-------|
 | 1 | `trx-logbook`: `Qso`, the ADI reader and writer, round-trip tests against files from other loggers |
-| 2 | Store, dedupe, and the HTTP API behind the control role |
+| 2 | Store, dedupe, and the HTTP API behind the admin role |
 | 3 | Logbook tab: entry, table, filters, import, export |
 | 4 | Ham layout, pre-filled entry from a decode row or the map, worked-before |
 | 5 | Contest exchange fields and Cabrillo export; QSL and LoTW/eQSL fields; per-band worked/confirmed statistics |
@@ -541,7 +541,7 @@ setting, which is also what LoTW's station locations expect.
 rotate operators through one station callsign, which is why contest loggers record it per QSO.
 It is stored per QSO, defaulted from the configured callsign so a single operator never touches
 it, and changed on the station line at the top of the panel where it sticks for the session.
-It cannot be taken from the session's identity: the auth roles are `control` and `rx`, with no
+It cannot be taken from the session's identity: the auth roles are `admin` and `user`, with no
 notion of who is logged in.
 
 **Server clock, and the log says so.** The server is the machine at the radio; the browser may

docs/UX_Guidelines.md

@@ -121,13 +121,13 @@ The spectrum panel uses `<canvas>` elements (WebGL renderer optional) and offers
 When auth is enabled, an **auth gate** blocks the UI with:
 
 - Title: "Access Required"
-- Subtitle: "Enter passphrase to continue"
+- Subtitle: "Sign in to continue"
-- Password input + Login button (green accent, full-width)
+- Username and password inputs + Login button (green accent, full-width)
-- Optional "Continue as Guest" button (shown when RX passphrase is not set)
 - Error message area (red `#ff6b6b`)
 - Role badge display
 
-Two roles: **Rx** (read-only) and **Control** (full access including TX/PTT).
+Accounts may combine **Read**, **Control**, **Write**, and **Administrator** roles.
+Administrator implies all permissions.
 
 Session cookie: `trx_http_sid`, HttpOnly, configurable Secure and SameSite attributes.
 
@@ -340,21 +340,22 @@ Routes are classified into three tiers:
 
 | Tier | Examples | Requirement |
 |---|---|---|
-| **Public** | `/`, `/index.html`, `/map`, `/auth/*`, static assets | None |
+| **Public** | `/`, `/index.html`, `/map`, login/session endpoints, static assets | None |
-| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Rx or Control role |
+| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Read, Control, or Administrator role |
-| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, all other POST | Control role only |
+| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, radio-control POST routes | Control or Administrator role |
+| **Write** | Logbook access and bookmark mutations | Write or Administrator role |
 
 ### 7.2 Session Management
 
 - Sessions are 128-bit random hex tokens stored in HttpOnly cookies
 - Configurable TTL (default from TOML config)
 - Expired sessions auto-pruned on access
-- Constant-time passphrase comparison to mitigate timing attacks
+- Passwords are verified against salted Argon2id hashes
 
-### 7.3 TX Access Control
+### 7.3 User Management
 
-An additional `tx_access_control_enabled` flag can restrict transmit-related actions even
+Only administrators can list, add, update, or remove accounts. The final
-for Control-role users, providing an extra safety layer.
+administrator cannot be removed or demoted.
 
 ---
 

docs/User-Manual.md

@@ -66,8 +66,7 @@ both:
 |------------|----------|----------|
 | `[listen.auth].tokens` | `tokens_file` | one token per line |
 | `[[remotes]].auth.token` | `token_file` | the token |
-| `[frontends.http.auth].rx_passphrase` | `rx_passphrase_file` | the passphrase |
+| `[frontends.http.auth].bootstrap_admin_password` | `bootstrap_admin_password_file` | the initial administrator password |
-| `[frontends.http.auth].control_passphrase` | `control_passphrase_file` | the passphrase |
 | `[frontends.http_json.auth].tokens` | `tokens_file` | one token per line |
 
 Blank lines and `#` comments are ignored in the list files. A config that holds
@@ -350,17 +349,20 @@ A name in any of those maps that no remote answers to is a config error.
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `enabled` | bool | `false` | Require a passphrase |
+| `enabled` | bool | `false` | Enable the user/password ACL |
-| `rx_passphrase` | string | — | Passphrase granting receive-only access |
+| `users_file` | string | `"trx-http-users.json"` | Persistent managed user database |
-| `rx_passphrase_file` | string | — | Read it from this file instead |
+| `bootstrap_admin_username` | string | — | First administrator, used only if the database is absent |
-| `control_passphrase` | string | — | Passphrase granting full control |
+| `bootstrap_admin_password` | string | — | First administrator password |
-| `control_passphrase_file` | string | — | Read it from this file instead |
+| `bootstrap_admin_password_file` | string | — | Read the bootstrap password from this file instead |
-| `tx_access_control_enabled` | bool | `true` | Hide TX from unauthenticated users |
+| `bootstrap_read_enabled` | bool | `true` | Create the default read-only account when the database is absent |
+| `bootstrap_read_username` | string | `"guest"` | Initial read-only username |
+| `bootstrap_read_password` | string | `"guest"` | Initial read-only password |
 | `session_ttl_min` | u64 | `480` | Session lifetime |
 | `cookie_secure` | bool | `false` | Set Secure on the session cookie (needs HTTPS) |
 | `cookie_same_site` | string | `"Lax"` | `Strict`, `Lax`, or `None` |
 
-With `enabled = true`, at least one passphrase must be set.
+When enabling ACL for the first time, configure both bootstrap fields. After
+the database exists, remove the bootstrap credentials from configuration.
 
 #### `[frontends.rigctl]`
 
@@ -578,7 +580,7 @@ The link button in the top bar copies the current link to the clipboard. The
 address bar itself is updated as you tune, using `replaceState`, so sweeping
 the dial does not fill the browser's history.
 
-Applying a link changes the radio, so it needs the `control` role; an `rx`
+Applying a link changes the radio, so it needs the `Control` role; a `Read`
 session opens the page and says the link was not applied. Links describe the
 rig's own dial — while a tab is listening to a virtual channel the address is
 left as it was, rather than publishing a frequency the rig is not on.
@@ -587,53 +589,66 @@ left as it was, rather than publishing a frequency the rig is not on.
 
 ## Authentication
 
-The HTTP frontend supports optional passphrase-based authentication with two
+The HTTP frontend supports an optional user/password ACL with multiple independent
-roles:
+roles. One account may have any combination:
 
-- **rx** — read-only access (monitoring, audio, decode streams)
+- **Read** — monitoring, audio, decode streams, and bookmark reads
-- **control** — full access (frequency, mode, PTT, and all settings)
+- **Control** — full radio receive/transmit controls
+- **Write** — logbook access and bookmark changes
+- **Administrator** — user management and all other permissions
 
 ### Configuration
 
 ```toml
 [frontends.http.auth]
 enabled = false
-rx_passphrase = "rx-only-passphrase"
+users_file = "trx-http-users.json"
-control_passphrase = "full-control-passphrase"
+bootstrap_admin_username = "admin"
-tx_access_control_enabled = true
+bootstrap_admin_password = "change-this-password"
+bootstrap_read_enabled = true
+bootstrap_read_username = "guest"
+bootstrap_read_password = "guest"
 session_ttl_min = 480
 cookie_secure = false      # true if served via HTTPS
 cookie_same_site = "Lax"   # Strict|Lax|None
 ```
 
 When `enabled = false` (the default), all auth is bypassed and the UI behaves
-as before. When enabled, at least one passphrase must be set.
+as before. When enabling it for the first time, bootstrap credentials create
+the initial administrator (with every role), the default `guest`/`guest` Read
+account, and the Argon2id-hashed user database. Change or disable the guest
+credentials in configuration before first startup on an exposed deployment.
 
 ### Behaviour
 
 - On login, the server issues an `HttpOnly` session cookie.
 - Sessions are in-memory; a server restart invalidates all sessions.
 - Rate limiting is applied per IP to mitigate brute-force attempts.
-- When `tx_access_control_enabled = true`, TX/PTT controls are hidden and
+- User records persist in `users_file`; passwords are stored as salted Argon2id hashes.
-  rejected for unauthenticated or `rx`-role users.
+- Roles are independent; for example, an account may have Read and Write without Control.
+- Administrators can add/remove users and change roles/passwords in Settings > Users.
+- At least one administrator must always remain and cannot be removed or demoted.
+- Removing an account or changing its password/role revokes its sessions.
 
 ### Routes
 
 | Endpoint | Method | Description |
 |----------|--------|-------------|
-| `/auth/login` | POST | Submit `{ "passphrase": "..." }` |
+| `/auth/login` | POST | Submit `{ "username": "...", "password": "..." }` |
 | `/auth/logout` | POST | Clear session |
-| `/auth/session` | GET | Check current session/role |
+| `/auth/session` | GET | Check current session/roles |
+| `/auth/users` | GET/POST | List or add users (admin only) |
+| `/auth/users/{username}` | PATCH/DELETE | Change password/roles or remove user (administrator only) |
 
-Protected routes require at least `rx` role. Control routes (set frequency,
+Read routes require Read. Radio mutations require Control. Logbook access and
-mode, PTT, etc.) require `control` role.
+bookmark mutations require Write. Administrator grants every permission.
 
 ### Frontend Flow
 
 1. On load, the UI calls `/auth/session`.
 2. If unauthenticated, a login screen is shown.
 3. On successful login, the normal UI loads.
-4. `rx` users see a read-only interface; `control` users get full controls.
+4. The interface enables controls according to the account's roles.
 5. If a session expires mid-use, streams stop and the login screen returns.
 
 ### Transport Security

src/trx-client/src/main.rs

@@ -252,11 +252,17 @@ async fn async_init() -> DynResult<AppState> {
 
     // Set HTTP frontend authentication config
     frontend_runtime.http_auth.enabled = cfg.frontends.http.auth.enabled;
-    frontend_runtime.http_auth.rx_passphrase = cfg.frontends.http.auth.rx_passphrase.clone();
+    frontend_runtime.http_auth.users_file = cfg.frontends.http.auth.users_file.clone();
-    frontend_runtime.http_auth.control_passphrase =
+    frontend_runtime.http_auth.bootstrap_admin_username =
-        cfg.frontends.http.auth.control_passphrase.clone();
+        cfg.frontends.http.auth.bootstrap_admin_username.clone();
-    frontend_runtime.http_auth.tx_access_control_enabled =
+    frontend_runtime.http_auth.bootstrap_admin_password =
-        cfg.frontends.http.auth.tx_access_control_enabled;
+        cfg.frontends.http.auth.bootstrap_admin_password.clone();
+    frontend_runtime.http_auth.bootstrap_read_enabled =
+        cfg.frontends.http.auth.bootstrap_read_enabled;
+    frontend_runtime.http_auth.bootstrap_read_username =
+        cfg.frontends.http.auth.bootstrap_read_username.clone();
+    frontend_runtime.http_auth.bootstrap_read_password =
+        cfg.frontends.http.auth.bootstrap_read_password.clone();
     frontend_runtime.http_auth.session_ttl_secs = cfg.frontends.http.auth.session_ttl().as_secs();
     frontend_runtime.http_auth.cookie_secure = cfg.frontends.http.auth.cookie_secure;
     frontend_runtime.http_auth.cookie_same_site = match cfg.frontends.http.auth.cookie_same_site {

src/trx-client/trx-frontend/src/lib.rs

@@ -257,9 +257,12 @@ impl Default for DecodeHistoryContext {
 /// HTTP authentication configuration.
 pub struct HttpAuthConfig {
     pub enabled: bool,
-    pub rx_passphrase: Option<String>,
+    pub users_file: String,
-    pub control_passphrase: Option<String>,
+    pub bootstrap_admin_username: Option<String>,
-    pub tx_access_control_enabled: bool,
+    pub bootstrap_admin_password: Option<String>,
+    pub bootstrap_read_enabled: bool,
+    pub bootstrap_read_username: String,
+    pub bootstrap_read_password: Option<String>,
     pub session_ttl_secs: u64,
     pub cookie_secure: bool,
     pub cookie_same_site: String,
@@ -271,9 +274,12 @@ impl Default for HttpAuthConfig {
     fn default() -> Self {
         Self {
             enabled: false,
-            rx_passphrase: None,
+            users_file: "trx-http-users.json".to_string(),
-            control_passphrase: None,
+            bootstrap_admin_username: None,
-            tx_access_control_enabled: true,
+            bootstrap_admin_password: None,
+            bootstrap_read_enabled: true,
+            bootstrap_read_username: "guest".to_string(),
+            bootstrap_read_password: Some("guest".to_string()),
             session_ttl_secs: 480 * 60,
             cookie_secure: false,
             cookie_same_site: "Lax".to_string(),

src/trx-client/trx-frontend/trx-frontend-http/Cargo.toml

@@ -28,6 +28,7 @@ flate2 = { workspace = true }
 brotli = "7"
 rand = "0.8"
 hex = "0.4"
+argon2 = "0.5"
 pickledb = "0.5"
 dirs = "6"
 uuid = { workspace = true }

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/app.js

@@ -1323,38 +1323,41 @@ function decodeAuthSession(value) {
   if (typeof session.authenticated !== "boolean") {
     throw new TypeError("The authentication response has no authenticated flag");
   }
-  if (session.role !== void 0 && session.role !== "rx" && session.role !== "control") {
+  if (!Array.isArray(session.roles) || !session.roles.every((role) => role === "read" || role === "control" || role === "write" || role === "administrator")) {
-    throw new TypeError("The authentication response has an invalid role");
+    throw new TypeError("The authentication response has invalid roles");
   }
   if (session.auth_disabled !== void 0 && typeof session.auth_disabled !== "boolean") {
     throw new TypeError("The authentication response has an invalid auth_disabled flag");
   }
-  const decoded = { authenticated: session.authenticated };
+  const decoded = { authenticated: session.authenticated, roles: session.roles };
-  if (session.role !== void 0) decoded.role = session.role;
+  if (session.username !== void 0) {
+    if (typeof session.username !== "string") throw new TypeError("The authentication response has an invalid username");
+    decoded.username = session.username;
+  }
   if (session.auth_disabled !== void 0) decoded.auth_disabled = session.auth_disabled;
   return decoded;
 }
 var authDisabledSession = {
   authenticated: true,
-  role: "control",
+  roles: ["read", "control", "write", "administrator"],
   auth_disabled: true
 };
 async function fetchAuthSession() {
   try {
     const response = await fetch("/auth/session");
     if (response.status === 404) return authDisabledSession;
-    if (!response.ok) return { authenticated: false };
+    if (!response.ok) return { authenticated: false, roles: [] };
     return decodeAuthSession(await response.json());
   } catch (error) {
     console.error("Auth check failed:", error);
-    return { authenticated: false };
+    return { authenticated: false, roles: [] };
   }
 }
-async function login(passphrase) {
+async function login(username, password) {
   const response = await fetch("/auth/login", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ passphrase })
+    body: JSON.stringify({ username, password })
   });
   if (response.status === 404) return authDisabledSession;
   if (!response.ok) {
@@ -1363,6 +1366,34 @@ async function login(passphrase) {
   }
   return decodeAuthSession(await response.json());
 }
+async function userRequest(path, init) {
+  const response = await fetch(path, init);
+  if (!response.ok) {
+    const payload = await response.json().catch(() => ({}));
+    throw new Error(payload.error || `User operation failed (${response.status})`);
+  }
+  return response;
+}
+async function listUsers() {
+  const value = await userRequest("/auth/users").then((response) => response.json());
+  if (!Array.isArray(value) || !value.every((user) => {
+    if (typeof user !== "object" || user === null) return false;
+    const record = user;
+    return typeof record.username === "string" && Array.isArray(record.roles) && record.roles.every((role) => role === "read" || role === "control" || role === "write" || role === "administrator");
+  })) {
+    throw new TypeError("The user list response is malformed");
+  }
+  return value;
+}
+async function createUser(username, password, roles) {
+  await userRequest("/auth/users", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ username, password, roles }) });
+}
+async function updateUser(username, changes) {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "PATCH", headers: { "Content-Type": "application/json" }, body: JSON.stringify(changes) });
+}
+async function deleteUser(username) {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "DELETE" });
+}
 async function logout() {
   const response = await fetch("/auth/logout", { method: "POST" });
   if (response.status !== 404 && !response.ok) throw new Error("Logout failed");
@@ -1863,32 +1894,47 @@ function isVchanRdsEntry(value) {
 }
 void loadDecoderRegistry(refreshOperatorLayoutCapabilities);
 var authRole = null;
+var authRoles = [];
+var authUsername = null;
 var authEnabled = true;
+var ALL_AUTH_ROLES = ["read", "control", "write", "administrator"];
+var AUTH_ROLE_LABELS = {
+  read: "Read",
+  control: "Control",
+  write: "Write",
+  administrator: "Administrator"
+};
+function setAuthRoles(roles) {
+  authRoles = [...new Set(roles)];
+  authRole = ["administrator", "control", "write", "read"].find((role) => authRoles.includes(role)) ?? null;
+}
+function hasAuthRole(role) {
+  return authRoles.includes("administrator") || authRoles.includes(role);
+}
 async function checkAuthStatus() {
   return fetchAuthSession();
 }
-async function authLogin(passphrase) {
+async function authLogin(username, password) {
-  return login(passphrase);
+  return login(username, password);
 }
 async function authLogout() {
   try {
     await logout();
-    authRole = null;
+    setAuthRoles([]);
+    authUsername = null;
     disconnect();
     setDecodeHistoryOverlayVisible(false);
     requiredElement("content").style.display = "none";
     requiredElement("loading").style.display = "none";
-    requiredElement("auth-passphrase").value = "";
+    requiredElement("auth-password").value = "";
     updateAuthUI();
-    const authStatus = await checkAuthStatus();
+    showAuthGate();
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
   } catch (e) {
     console.error("Logout failed:", e);
     showAuthError("Logout failed");
   }
 }
-function showAuthGate(allowGuest = false) {
+function showAuthGate() {
   if (!authEnabled) return;
   setDecodeHistoryOverlayVisible(false);
   requiredElement("loading").style.display = "none";
@@ -1905,10 +1951,6 @@ function showAuthGate(allowGuest = false) {
   document.querySelectorAll(".tab-panel").forEach((panel) => {
     panel.style.display = "none";
   });
-  const guestBtn2 = document.getElementById("auth-guest-btn");
-  if (guestBtn2) {
-    guestBtn2.style.display = allowGuest ? "block" : "none";
-  }
   document.querySelectorAll(".tab-bar .tab").forEach((btn) => {
     btn.classList.toggle("active", btn.dataset.tab === "main");
   });
@@ -1950,9 +1992,9 @@ function updateAuthUI() {
     syncTopBarAccess();
     return;
   }
-  if (authRole) {
+  if (authRoles.length > 0) {
     if (badge) badge.style.display = "block";
-    if (badgeRole) badgeRole.textContent = authRole === "control" ? "Control (full access)" : "RX (read-only)";
+    if (badgeRole) badgeRole.textContent = `${authUsername || "local"} — ${authRoles.map((role) => AUTH_ROLE_LABELS[role]).join(", ")}`;
     if (headerAuthBtn2) {
       headerAuthBtn2.textContent = "Logout";
       headerAuthBtn2.style.display = "block";
@@ -1967,8 +2009,8 @@ function updateAuthUI() {
   syncTopBarAccess();
 }
 function applyAuthRestrictions() {
-  if (!authRole) return;
+  if (authRoles.length === 0) return;
-  if (authRole === "rx") {
+  if (!hasAuthRole("control")) {
     const pttBtn2 = document.getElementById("ptt-btn");
     const powerBtn2 = document.getElementById("power-btn");
     const lockBtn2 = document.getElementById("lock-btn");
@@ -2258,20 +2300,21 @@ window.applyDecodeHistoryRetention = function() {
   }
 };
 function syncTopBarAccess() {
-  const loggedOut = authEnabled && !authRole;
+  const loggedOut = authEnabled && authRoles.length === 0;
   const tabBar = document.getElementById("tab-bar");
   const rigSwitch = document.querySelector(".header-rig-switch");
   if (tabBar) tabBar.style.display = "";
   document.querySelectorAll(".tab-bar .tab").forEach((btn) => {
     const isMain = btn.dataset.tab === "main";
-    btn.style.display = !loggedOut || isMain ? "" : "none";
+    const lacksLogbookAccess = authEnabled && btn.dataset.tab === "logbook" && !hasAuthRole("write");
+    btn.style.display = (!loggedOut || isMain) && !lacksLogbookAccess ? "" : "none";
     btn.disabled = false;
   });
   if (rigSwitch) {
     rigSwitch.style.display = loggedOut ? "none" : "";
   }
   if (headerRigSwitchSelect) {
-    headerRigSwitchSelect.disabled = loggedOut || authRole === "rx" || lastRigIds.length === 0;
+    headerRigSwitchSelect.disabled = loggedOut || !hasAuthRole("control") || lastRigIds.length === 0;
   }
 }
 var overviewDrawPending = false;
@@ -2907,7 +2950,7 @@ function applyRigList(activeRigId, rigIds, displayNames) {
   }
   const nextKey = lastRigIds.join("\0") + "|" + (lastActiveRigId || "");
   const rigListChanged = prevKey !== nextKey;
-  const disableSwitch = lastRigIds.length === 0 || !authRole || authRole === "rx";
+  const disableSwitch = lastRigIds.length === 0 || !hasAuthRole("control");
   populateRigPicker(headerRigSwitchSelect, lastRigIds, lastActiveRigId, disableSwitch);
   updateRigSubtitle(lastActiveRigId);
   window.trxUi?.setActiveRig(lastActiveRigId);
@@ -4510,7 +4553,7 @@ function scheduleTuneLinkSync() {
 async function applyTuneLink(link) {
   const wanted = link.rig || link.mode || link.freqHz != null || link.bandwidthHz != null;
   if (!wanted) return;
-  if (authRole === "rx") {
+  if (!hasAuthRole("control")) {
     showHint("Read-only session — link not applied", 2500);
     return;
   }
@@ -5228,7 +5271,7 @@ async function postPath(path, options = {}) {
   }
   const resp = await fetch(path, { method: "POST" });
   if (authEnabled && resp.status === 401) {
-    authRole = null;
+    setAuthRoles([]);
     if (es) es.close();
     showAuthGate();
     throw new Error("Authentication required");
@@ -5253,7 +5296,7 @@ async function switchRigFromSelect(selectEl) {
     showHint("No rig selected", 1500);
     return;
   }
-  if (authRole === "rx") {
+  if (!hasAuthRole("control")) {
     showHint("Control role required", 1500);
     return;
   }
@@ -5867,8 +5910,13 @@ function navigateToTab(name, options = {}) {
   window.trxUi?.closeMobileOverlays?.();
   const leavingSatellites = _activeTab === "satellites" && name !== "satellites";
   const { updateHistory = true, replaceHistory = false } = options;
-  if (authEnabled && !authRole && name !== "main") {
+  if (authEnabled && authRoles.length === 0 && name !== "main") {
-    showAuthGate(false);
+    showAuthGate();
+    return;
+  }
+  if (authEnabled && name === "logbook" && !hasAuthRole("write")) {
+    showHint("Write role required for logbook access", 2500);
+    navigateToTab("main", options);
     return;
   }
   const btn = document.querySelector(`.tab-bar .tab[data-tab="${name}"]`);
@@ -5981,11 +6029,11 @@ window.addEventListener("resize", () => {
   scheduleSpectrumLayout();
 });
 async function initializeApp() {
-  showAuthGate(false);
+  showAuthGate();
   const authStatus = await checkAuthStatus();
   authEnabled = !authStatus.auth_disabled;
   if (!authEnabled) {
-    authRole = "control";
+    setAuthRoles(ALL_AUTH_ROLES);
     hideAuthGate();
     updateAuthUI();
     connect();
@@ -5996,7 +6044,8 @@ async function initializeApp() {
     return;
   }
   if (authStatus.authenticated) {
-    authRole = authStatus.role ?? null;
+    setAuthRoles(authStatus.roles);
+    authUsername = authStatus.username ?? null;
     hideAuthGate();
     updateAuthUI();
     applyAuthRestrictions();
@@ -6006,8 +6055,7 @@ async function initializeApp() {
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
   } else {
-    const allowGuest = authStatus.role === "rx";
+    showAuthGate();
-    showAuthGate(allowGuest);
   }
 }
 var settingsUiReady = false;
@@ -6019,19 +6067,129 @@ function initSettingsUI() {
     window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRole);
     window.trx.modules.backgroundDecode.wireEvents();
   }
+  void refreshUserManagement();
 }
+async function refreshUserManagement() {
+  const section = document.getElementById("user-management");
+  const tab = document.getElementById("settings-users-tab");
+  if (!section || !tab) return;
+  const canManageUsers = authEnabled && hasAuthRole("administrator");
+  tab.style.display = canManageUsers ? "" : "none";
+  if (!canManageUsers) {
+    const panel = document.getElementById("subtab-settings-users");
+    if (panel) panel.style.display = "none";
+    if (tab.classList.contains("active")) {
+      document.querySelector('[data-subtab="settings-scheduler"]')?.click();
+    }
+    return;
+  }
+  const list = requiredElement("user-list");
+  try {
+    const users = await listUsers();
+    const adminCount = users.filter((user) => user.roles.includes("administrator")).length;
+    list.replaceChildren(...users.map((user) => {
+      const row = document.createElement("div");
+      row.className = "sch-row";
+      row.style.cssText = "display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;margin:.4rem 0";
+      const name = document.createElement("strong");
+      name.textContent = user.username;
+      name.style.minWidth = "10rem";
+      const roleInputs = ALL_AUTH_ROLES.map((value) => {
+        const label = document.createElement("label");
+        label.className = "auth-role-choice";
+        const input = document.createElement("input");
+        input.type = "checkbox";
+        input.value = value;
+        input.checked = user.roles.includes(value);
+        label.append(input, ` ${AUTH_ROLE_LABELS[value]}`);
+        return { label, input, value };
+      });
+      const roles = document.createElement("span");
+      roles.className = "auth-role-choices";
+      roles.append(...roleInputs.map(({ label }) => label));
+      const isOnlyAdmin = user.roles.includes("administrator") && adminCount === 1;
+      const administratorInput = roleInputs.find((item) => item.value === "administrator")?.input;
+      if (isOnlyAdmin && administratorInput) {
+        administratorInput.disabled = true;
+        administratorInput.title = "The final administrator cannot be demoted";
+      }
+      const password = document.createElement("input");
+      password.type = "password";
+      password.placeholder = "New password (8+ characters)";
+      password.autocomplete = "new-password";
+      password.className = "auth-input";
+      password.minLength = 8;
+      const save = document.createElement("button");
+      save.type = "button";
+      save.textContent = "Save";
+      save.addEventListener("click", async () => {
+        const changes = {
+          roles: roleInputs.filter(({ input }) => input.checked).map(({ value }) => value)
+        };
+        if (password.value) changes.password = password.value;
+        await runUserOperation(() => updateUser(user.username, changes));
+      });
+      const remove = document.createElement("button");
+      remove.type = "button";
+      remove.textContent = "Remove";
+      remove.className = "danger";
+      remove.disabled = user.username === authUsername || isOnlyAdmin;
+      if (isOnlyAdmin) remove.title = "The final administrator cannot be removed";
+      remove.addEventListener("click", async () => {
+        if (await window.trxUi.confirm({ title: "Remove user?", message: `Remove ${user.username} and revoke their sessions?`, confirmLabel: "Remove", danger: true })) {
+          await runUserOperation(() => deleteUser(user.username));
+        }
+      });
+      row.append(name, roles, password, save, remove);
+      return row;
+    }));
+  } catch (error) {
+    showUserManagementError(error);
+  }
+}
+function showUserManagementError(error) {
+  const element = document.getElementById("user-management-error");
+  if (!element) return;
+  element.textContent = error instanceof Error ? error.message : String(error);
+  element.style.display = "block";
+}
+async function runUserOperation(operation) {
+  try {
+    await operation();
+    const error = document.getElementById("user-management-error");
+    if (error) error.style.display = "none";
+    await refreshUserManagement();
+  } catch (reason) {
+    showUserManagementError(reason);
+  }
+}
+document.getElementById("user-create-form")?.addEventListener("submit", (event) => {
+  event.preventDefault();
+  const username = requiredElement("user-create-username");
+  const password = requiredElement("user-create-password");
+  const roles = Array.from(document.querySelectorAll("#user-create-roles input[type=checkbox]"));
+  void runUserOperation(async () => {
+    await createUser(username.value, password.value, roles.filter((input) => input.checked).map((input) => input.value));
+    username.value = "";
+    password.value = "";
+    roles.forEach((input) => {
+      input.checked = input.value === "read";
+    });
+  });
+});
 requiredElement("auth-form").addEventListener("submit", async (e) => {
   e.preventDefault();
-  const passphraseEl = requiredElement("auth-passphrase");
+  const usernameEl = requiredElement("auth-username");
-  const passphrase = passphraseEl.value;
+  const passwordEl = requiredElement("auth-password");
   const btn = requiredElement("auth-form").querySelector("button[type=submit]");
   if (!btn) return;
   btn.disabled = true;
   btn.textContent = "Logging in...";
   try {
-    const result = await authLogin(passphrase);
+    const result = await authLogin(usernameEl.value, passwordEl.value);
-    authRole = result.role ?? null;
+    setAuthRoles(result.roles);
-    passphraseEl.value = "";
+    authUsername = result.username ?? usernameEl.value;
+    passwordEl.value = "";
     hideAuthGate();
     updateAuthUI();
     applyAuthRestrictions();
@@ -6041,37 +6199,22 @@ requiredElement("auth-form").addEventListener("submit", async (e) => {
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
   } catch (err) {
-    showAuthError("Invalid passphrase");
+    showAuthError("Invalid username or password");
     console.error("Login error:", err);
   } finally {
     btn.disabled = false;
     btn.textContent = "Login";
   }
 });
-var guestBtn = document.getElementById("auth-guest-btn");
-if (guestBtn) {
-  guestBtn.addEventListener("click", () => {
-    authRole = "rx";
-    requiredElement("auth-passphrase").value = "";
-    hideAuthGate();
-    updateAuthUI();
-    applyAuthRestrictions();
-    connect();
-    connectDecode();
-    initSettingsUI();
-    resizeHeaderSignalCanvas();
-    startHeaderSignalSampling();
-  });
-}
 var headerAuthBtn = document.getElementById("header-auth-btn");
 if (headerAuthBtn) {
   headerAuthBtn.addEventListener("click", async () => {
-    if (authRole) {
+    if (authRoles.length > 0) {
       if (await window.trxUi.confirm({ title: "Log out?", message: "Audio and control access for this browser session will end.", confirmLabel: "Log out", danger: false })) {
         await authLogout();
       }
     } else {
-      showAuthGate(false);
+      showAuthGate();
     }
   });
 }
@@ -6112,6 +6255,9 @@ Object.defineProperties(trxState, {
   authRole: { get() {
     return authRole;
   } },
+  authRoles: { get() {
+    return authRoles;
+  } },
   decoderRegistry: { get() {
     return decoderRegistry;
   } },

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/background-decode.js

@@ -358,7 +358,7 @@ var bgdWindow = window;
     btn.title = bgdDirty ? "Apply these bookmarks to the background decoder" : "No changes to save";
   }
   function isControlRole() {
-    return backgroundDecodeRole === "control" || hostState.authEnabled === false;
+    return backgroundDecodeRole === "administrator" || backgroundDecodeRole === "control" || hostState.authEnabled === false;
   }
   function showToast(msg, isError) {
     const el = document.getElementById("background-decode-toast");

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/bookmarks.js

@@ -42,7 +42,7 @@ function bmEsc(str) {
   return d.innerHTML;
 }
 function bmCanControl() {
-  return !hostState.authEnabled || hostState.authRole === "control";
+  return !hostState.authEnabled || hostState.authRoles.includes("administrator") || hostState.authRoles.includes("write");
 }
 function bmSyncAccess() {
   const canCtrl = bmCanControl();

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/logbook.js

@@ -47,6 +47,9 @@ var entryRigName = null;
 var entryGrid = null;
 var qsos = [];
 var workedRequest = 0;
+function canWriteLogbook() {
+  return !hostState.authEnabled || hostState.authRoles.includes("administrator") || hostState.authRoles.includes("write");
+}
 function notify(message, kind) {
   if (bridge.trxUi.notify) bridge.trxUi.notify(message, kind ? { kind } : void 0);
   else hostCore.showHint(message, 2e3);
@@ -300,6 +303,11 @@ function renderRows() {
       row.appendChild(cell);
     }
     const actions = document.createElement("td");
+    if (!canWriteLogbook()) {
+      row.appendChild(actions);
+      fragment.appendChild(row);
+      continue;
+    }
     const confirm = document.createElement("button");
     confirm.type = "button";
     confirm.className = "log-row-btn";
@@ -420,14 +428,19 @@ importFile?.addEventListener("change", () => {
   if (file) void importAdif(file);
   importFile.value = "";
 });
-bridge.logContact = (seed) => {
+if (canWriteLogbook()) {
-  bridge.navigateToTab?.("logbook");
+  bridge.logContact = (seed) => {
-  void openEntry(seed).then(() => callInput?.focus());
+    bridge.navigateToTab?.("logbook");
-};
+    void openEntry(seed).then(() => callInput?.focus());
+  };
+} else {
+  if (form) form.style.display = "none";
+  if (importBtn) importBtn.style.display = "none";
+}
 renderStation();
 if (cabrilloCallsign && !cabrilloCallsign.value) {
   cabrilloCallsign.value = stationCallEl?.textContent?.trim() ?? "";
 }
 syncCabrilloLink();
-void openEntry();
+if (canWriteLogbook()) void openEntry();
 void refreshLog();

src/trx-client/trx-frontend/trx-frontend-http/assets/web/generated/scheduler.js

@@ -272,7 +272,7 @@ function schedulerOptionalEl(id) {
     const nextBtn = schedulerEl("scheduler-next-btn");
     if (!prevBtn || !nextBtn) return;
     const state = schedulerInterleaveState(currentConfig);
-    const enabled = schedulerRole === "control" && !!currentRigId && !schedulerStepPending && state.activeEntries.length > 1;
+    const enabled = (schedulerRole === "administrator" || schedulerRole === "control") && !!currentRigId && !schedulerStepPending && state.activeEntries.length > 1;
     prevBtn.disabled = !enabled;
     nextBtn.disabled = !enabled;
     const hint = enabled ? "Select a different active scheduler entry" : "Available only when multiple scheduler entries are active";
@@ -354,7 +354,7 @@ function schedulerOptionalEl(id) {
     const panel = schedulerEl("scheduler-panel");
     if (!panel) return;
     const mode = currentConfig && currentConfig.mode || "disabled";
-    const isControl = schedulerRole === "control";
+    const isControl = schedulerRole === "administrator" || schedulerRole === "control";
     setSelected("scheduler-mode-select", mode);
     const satEnabled = currentConfig && currentConfig.satellites && currentConfig.satellites.enabled;
     const controlRow = document.querySelector(".scheduler-control-row");

src/trx-client/trx-frontend/trx-frontend-http/assets/web/index.html

@@ -123,13 +123,13 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <div id="auth-gate" class="auth-gate" style="display:none;">
       <div class="auth-gate-head">
         <div class="auth-gate-title">Access Required</div>
-        <div class="auth-gate-sub">Enter passphrase to continue</div>
+        <div class="auth-gate-sub">Sign in to continue</div>
       </div>
       <form id="auth-form" class="auth-form">
-        <input type="password" id="auth-passphrase" class="auth-input" placeholder="Passphrase" autocomplete="off" />
+        <input type="text" id="auth-username" class="auth-input" placeholder="Username" autocomplete="username" required />
+        <input type="password" id="auth-password" class="auth-input" placeholder="Password" autocomplete="current-password" required />
         <button type="submit" class="auth-submit">Login</button>
       </form>
-      <button id="auth-guest-btn" type="button" class="auth-guest" style="display: none;">Continue as Guest</button>
       <div id="auth-error" class="auth-error" style="display: none;"></div>
       <div id="auth-role" class="auth-role" style="display: none;"></div>
     </div>
@@ -1461,6 +1461,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
         <button class="sub-tab" data-subtab="settings-background-decode">Background Decode</button>
         <button class="sub-tab" data-subtab="settings-bandplan">Bandplan</button>
         <button class="sub-tab" data-subtab="settings-history">History</button>
+        <button id="settings-users-tab" class="sub-tab" data-subtab="settings-users" style="display:none;">Users</button>
       </div>
       <div id="subtab-settings-scheduler" class="sub-tab-panel">
         <div id="scheduler-panel" class="sch-panel">
@@ -1750,6 +1751,25 @@ SPDX-License-Identifier: GPL-2.0-or-later
           </div>
         </div>
       </div>
+      <div id="subtab-settings-users" class="sub-tab-panel" style="display:none;">
+        <div id="user-management">
+        <div class="settings-card">
+          <form id="user-create-form" class="sch-row" style="flex-wrap:wrap; gap:.5rem;">
+            <input id="user-create-username" class="auth-input" placeholder="Username" autocomplete="off" required />
+            <input id="user-create-password" class="auth-input" type="password" placeholder="Password (8+ characters)" autocomplete="new-password" minlength="8" required />
+            <span id="user-create-roles" class="auth-role-choices">
+              <label class="auth-role-choice"><input type="checkbox" value="read" checked /> Read</label>
+              <label class="auth-role-choice"><input type="checkbox" value="control" /> Control</label>
+              <label class="auth-role-choice"><input type="checkbox" value="write" /> Write</label>
+              <label class="auth-role-choice"><input type="checkbox" value="administrator" /> Administrator</label>
+            </span>
+            <button type="submit" class="auth-submit">Add user</button>
+          </form>
+          <div id="user-management-error" class="auth-error" style="display:none;"></div>
+          <div id="user-list" style="margin-top:.75rem;"></div>
+        </div>
+        </div>
+      </div>
     </div>
     <div id="tab-about" class="tab-panel" style="display:none;">
       <h2 class="section-heading">About</h2>

src/trx-client/trx-frontend/trx-frontend-http/assets/web/style.css

@@ -196,8 +196,7 @@ body {
   font-size: var(--fs-base);
   box-sizing: border-box;
 }
-.auth-submit,
+.auth-submit {
-.auth-guest {
   width: 100%;
   padding: 0.65rem 0.75rem;
   border-radius: var(--radius-md);
@@ -213,16 +212,13 @@ body {
   font-weight: 700;
 }
 .auth-submit:hover:not(:disabled) { background: var(--accent-green-hover); }
-.auth-guest {
-  background: var(--btn-bg);
-  color: var(--text);
-  border: 1px solid var(--border-light);
-  font-weight: 600;
-  margin-top: var(--space-4);
-}
-.auth-guest:hover:not(:disabled) { background: var(--btn-hover-bg); }
 .auth-error { color: var(--accent-red); font-size: var(--fs-sm); margin-top: var(--space-4); }
 .auth-role { margin-top: var(--space-4); color: var(--text-muted); font-size: var(--fs-sm); }
+#user-management .auth-input { width: auto; min-width: 9rem; flex: 1 1 10rem; margin-bottom: 0; }
+#user-management .auth-submit { width: auto; }
+#user-management .auth-role-choices { display: flex; align-items: center; gap: .6rem; flex-wrap: wrap; }
+#user-management .auth-role-choice { display: inline-flex; align-items: center; gap: .2rem; white-space: nowrap; }
+#user-management button { padding: 0.55rem 0.75rem; }
 
 .label { color: var(--text-muted); font-size: 0.9rem; margin-bottom: 6px; display: block; }
 #tab-main .label > span {

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/api/auth.ts

@@ -2,11 +2,12 @@
 //
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-export type AuthRole = "rx" | "control";
+export type AuthRole = "read" | "control" | "write" | "administrator";
 
 export interface AuthSession {
   authenticated: boolean;
-  role?: AuthRole;
+  roles: AuthRole[];
+  username?: string;
   auth_disabled?: boolean;
 }
 
@@ -18,21 +19,25 @@ function decodeAuthSession(value: unknown): AuthSession {
   if (typeof session.authenticated !== "boolean") {
     throw new TypeError("The authentication response has no authenticated flag");
   }
-  if (session.role !== undefined && session.role !== "rx" && session.role !== "control") {
+  if (!Array.isArray(session.roles) || !session.roles.every(role =>
-    throw new TypeError("The authentication response has an invalid role");
+    role === "read" || role === "control" || role === "write" || role === "administrator")) {
+    throw new TypeError("The authentication response has invalid roles");
   }
   if (session.auth_disabled !== undefined && typeof session.auth_disabled !== "boolean") {
     throw new TypeError("The authentication response has an invalid auth_disabled flag");
   }
-  const decoded: AuthSession = { authenticated: session.authenticated };
+  const decoded: AuthSession = { authenticated: session.authenticated, roles: session.roles as AuthRole[] };
-  if (session.role !== undefined) decoded.role = session.role;
+  if (session.username !== undefined) {
+    if (typeof session.username !== "string") throw new TypeError("The authentication response has an invalid username");
+    decoded.username = session.username;
+  }
   if (session.auth_disabled !== undefined) decoded.auth_disabled = session.auth_disabled;
   return decoded;
 }
 
 const authDisabledSession: AuthSession = {
   authenticated: true,
-  role: "control",
+  roles: ["read", "control", "write", "administrator"],
   auth_disabled: true,
 };
 
@@ -40,19 +45,19 @@ export async function fetchAuthSession(): Promise<AuthSession> {
   try {
     const response = await fetch("/auth/session");
     if (response.status === 404) return authDisabledSession;
-    if (!response.ok) return { authenticated: false };
+    if (!response.ok) return { authenticated: false, roles: [] };
     return decodeAuthSession(await response.json());
   } catch (error: unknown) {
     console.error("Auth check failed:", error);
-    return { authenticated: false };
+    return { authenticated: false, roles: [] };
   }
 }
 
-export async function login(passphrase: string): Promise<AuthSession> {
+export async function login(username: string, password: string): Promise<AuthSession> {
   const response = await fetch("/auth/login", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ passphrase }),
+    body: JSON.stringify({ username, password }),
   });
   if (response.status === 404) return authDisabledSession;
   if (!response.ok) {
@@ -62,6 +67,42 @@ export async function login(passphrase: string): Promise<AuthSession> {
   return decodeAuthSession(await response.json());
 }
 
+export interface ManagedUser { username: string; roles: AuthRole[] }
+
+async function userRequest(path: string, init?: RequestInit): Promise<Response> {
+  const response = await fetch(path, init);
+  if (!response.ok) {
+    const payload = await response.json().catch(() => ({})) as { error?: string };
+    throw new Error(payload.error || `User operation failed (${response.status})`);
+  }
+  return response;
+}
+
+export async function listUsers(): Promise<ManagedUser[]> {
+  const value: unknown = await userRequest("/auth/users").then(response => response.json());
+  if (!Array.isArray(value) || !value.every((user: unknown) => {
+    if (typeof user !== "object" || user === null) return false;
+    const record = user as Record<string, unknown>;
+    return typeof record.username === "string" && Array.isArray(record.roles)
+      && record.roles.every(role => role === "read" || role === "control" || role === "write" || role === "administrator");
+  })) {
+    throw new TypeError("The user list response is malformed");
+  }
+  return value as ManagedUser[];
+}
+
+export async function createUser(username: string, password: string, roles: AuthRole[]): Promise<void> {
+  await userRequest("/auth/users", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ username, password, roles }) });
+}
+
+export async function updateUser(username: string, changes: { password?: string; roles?: AuthRole[] }): Promise<void> {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "PATCH", headers: { "Content-Type": "application/json" }, body: JSON.stringify(changes) });
+}
+
+export async function deleteUser(username: string): Promise<void> {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "DELETE" });
+}
+
 export async function logout(): Promise<void> {
   const response = await fetch("/auth/logout", { method: "POST" });
   if (response.status !== 404 && !response.ok) throw new Error("Logout failed");

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/app.ts

@@ -21,6 +21,10 @@ import {
   fetchAuthSession,
   login,
   logout,
+  listUsers,
+  createUser,
+  updateUser,
+  deleteUser,
 } from "./api/auth.js";
 import {
   formatByteSize as recorderFormatSize,
@@ -227,6 +231,7 @@ interface TrxState {
   readonly decodeHistoryRetentionMin: number;
   readonly authEnabled: boolean;
   readonly authRole: AuthRole | null;
+  readonly authRoles: readonly AuthRole[];
   readonly decoderRegistry: typeof decoderRegistry;
   readonly sseSessionId: string | null;
   readonly primaryRds: RdsData | null;
@@ -407,39 +412,57 @@ void loadDecoderRegistry(refreshOperatorLayoutCapabilities);
 
 // --- Authentication ---
 let authRole: AuthRole | null = null;
+let authRoles: AuthRole[] = [];
+let authUsername: string | null = null;
 let authEnabled = true;
 
+const ALL_AUTH_ROLES: readonly AuthRole[] = ["read", "control", "write", "administrator"];
+const AUTH_ROLE_LABELS: Record<AuthRole, string> = {
+  read: "Read",
+  control: "Control",
+  write: "Write",
+  administrator: "Administrator",
+};
+
+function setAuthRoles(roles: readonly AuthRole[]) {
+  authRoles = [...new Set(roles)];
+  authRole = (["administrator", "control", "write", "read"] as AuthRole[])
+    .find(role => authRoles.includes(role)) ?? null;
+}
+
+function hasAuthRole(role: AuthRole) {
+  return authRoles.includes("administrator") || authRoles.includes(role);
+}
+
 async function checkAuthStatus() {
   return fetchAuthSession();
 }
 
-async function authLogin(passphrase: string) {
+async function authLogin(username: string, password: string) {
-  return login(passphrase);
+  return login(username, password);
 }
 
 async function authLogout() {
   try {
     await logout();
-    authRole = null;
+    setAuthRoles([]);
+    authUsername = null;
     // Disconnect and show auth gate without page reload
     disconnect();
     setDecodeHistoryOverlayVisible(false);
     requiredElement("content").style.display = "none";
     requiredElement("loading").style.display = "none";
-    requiredElement<HTMLInputElement>("auth-passphrase").value = "";
+    requiredElement<HTMLInputElement>("auth-password").value = "";
     updateAuthUI();
 
-    // Check if guest mode is available after logout
+    showAuthGate();
-    const authStatus = await checkAuthStatus();
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
   } catch (e) {
     console.error("Logout failed:", e);
     showAuthError("Logout failed");
   }
 }
 
-function showAuthGate(allowGuest = false) {
+function showAuthGate() {
   if (!authEnabled) return;
   setDecodeHistoryOverlayVisible(false);
   requiredElement("loading").style.display = "none";
@@ -459,12 +482,6 @@ function showAuthGate(allowGuest = false) {
     panel.style.display = "none";
   });
 
-  // Show guest button if guest mode is available
-  const guestBtn = document.getElementById("auth-guest-btn");
-  if (guestBtn) {
-    guestBtn.style.display = allowGuest ? "block" : "none";
-  }
-
   document.querySelectorAll<HTMLElement>(".tab-bar .tab").forEach((btn) => {
     btn.classList.toggle("active", btn.dataset.tab === "main");
   });
@@ -514,9 +531,9 @@ function updateAuthUI() {
     return;
   }
 
-  if (authRole) {
+  if (authRoles.length > 0) {
     if (badge) badge.style.display = "block";
-    if (badgeRole) badgeRole.textContent = authRole === "control" ? "Control (full access)" : "RX (read-only)";
+    if (badgeRole) badgeRole.textContent = `${authUsername || "local"} — ${authRoles.map(role => AUTH_ROLE_LABELS[role]).join(", ")}`;
     if (headerAuthBtn) {
       headerAuthBtn.textContent = "Logout";
       headerAuthBtn.style.display = "block";
@@ -532,10 +549,10 @@ function updateAuthUI() {
 }
 
 function applyAuthRestrictions() {
-  if (!authRole) return;
+  if (authRoles.length === 0) return;
 
-  // Disable TX/PTT/frequency/mode/VFO controls for rx role
+  // Disable TX/PTT/frequency/mode/VFO controls for user role
-  if (authRole === "rx") {
+  if (!hasAuthRole("control")) {
     const pttBtn = document.getElementById("ptt-btn") as HTMLButtonElement | null;
     const powerBtn = document.getElementById("power-btn") as HTMLButtonElement | null;
     const lockBtn = document.getElementById("lock-btn") as HTMLButtonElement | null;
@@ -867,14 +884,15 @@ window.applyDecodeHistoryRetention = function() {
 };
 
 function syncTopBarAccess() {
-  const loggedOut = authEnabled && !authRole;
+  const loggedOut = authEnabled && authRoles.length === 0;
   const tabBar = document.getElementById("tab-bar");
   const rigSwitch = document.querySelector<HTMLElement>(".header-rig-switch");
   if (tabBar) tabBar.style.display = "";
 
   document.querySelectorAll<HTMLButtonElement>(".tab-bar .tab").forEach((btn) => {
     const isMain = btn.dataset.tab === "main";
-    btn.style.display = !loggedOut || isMain ? "" : "none";
+    const lacksLogbookAccess = authEnabled && btn.dataset.tab === "logbook" && !hasAuthRole("write");
+    btn.style.display = (!loggedOut || isMain) && !lacksLogbookAccess ? "" : "none";
     btn.disabled = false;
   });
 
@@ -883,7 +901,7 @@ function syncTopBarAccess() {
   }
 
   if (headerRigSwitchSelect) {
-    headerRigSwitchSelect.disabled = loggedOut || authRole === "rx" || lastRigIds.length === 0;
+    headerRigSwitchSelect.disabled = loggedOut || !hasAuthRole("control") || lastRigIds.length === 0;
   }
 }
 
@@ -1464,7 +1482,7 @@ function applyRigList(activeRigId: string | null, rigIds: string[], displayNames
   }
   const nextKey = lastRigIds.join("\0") + "|" + (lastActiveRigId || "");
   const rigListChanged = prevKey !== nextKey;
-  const disableSwitch = lastRigIds.length === 0 || !authRole || authRole === "rx";
+  const disableSwitch = lastRigIds.length === 0 || !hasAuthRole("control");
   populateRigPicker(headerRigSwitchSelect, lastRigIds, lastActiveRigId, disableSwitch);
   updateRigSubtitle(lastActiveRigId);
   window.trxUi?.setActiveRig(lastActiveRigId);
@@ -3352,7 +3370,7 @@ function scheduleTuneLinkSync() {
 async function applyTuneLink(link: TuneLink) {
   const wanted = link.rig || link.mode || link.freqHz != null || link.bandwidthHz != null;
   if (!wanted) return;
-  if (authRole === "rx") {
+  if (!hasAuthRole("control")) {
     showHint("Read-only session — link not applied", 2500);
     return;
   }
@@ -4162,7 +4180,7 @@ async function postPath(path: string, options: PostOptions = {}) {
   const resp = await fetch(path, { method: "POST" });
   if (authEnabled && resp.status === 401) {
     // Not authenticated - return to login
-    authRole = null;
+    setAuthRoles([]);
     if (es) es.close();
     showAuthGate();
     throw new Error("Authentication required");
@@ -4191,7 +4209,7 @@ async function switchRigFromSelect(selectEl: HTMLSelectElement) {
     showHint("No rig selected", 1500);
     return;
   }
-  if (authRole === "rx") {
+  if (!hasAuthRole("control")) {
     showHint("Control role required", 1500);
     return;
   }
@@ -4874,8 +4892,13 @@ function navigateToTab(name: TabName, options: { updateHistory?: boolean; replac
   window.trxUi?.closeMobileOverlays?.();
   const leavingSatellites = _activeTab === "satellites" && name !== "satellites";
   const { updateHistory = true, replaceHistory = false } = options;
-  if (authEnabled && !authRole && name !== "main") {
+  if (authEnabled && authRoles.length === 0 && name !== "main") {
-    showAuthGate(false);
+    showAuthGate();
+    return;
+  }
+  if (authEnabled && name === "logbook" && !hasAuthRole("write")) {
+    showHint("Write role required for logbook access", 2500);
+    navigateToTab("main", options);
     return;
   }
   const btn = document.querySelector<HTMLElement>(`.tab-bar .tab[data-tab="${name}"]`);
@@ -5008,12 +5031,12 @@ window.addEventListener("resize", () => { scheduleSpectrumLayout(); });
 
 // --- Auth startup sequence ---
 async function initializeApp() {
-  showAuthGate(false);
+  showAuthGate();
   const authStatus = await checkAuthStatus();
   authEnabled = !authStatus.auth_disabled;
 
   if (!authEnabled) {
-    authRole = "control";
+    setAuthRoles(ALL_AUTH_ROLES);
     hideAuthGate();
     updateAuthUI();
     connect();
@@ -5026,7 +5049,8 @@ async function initializeApp() {
 
   if (authStatus.authenticated) {
     // User has valid session
-    authRole = authStatus.role ?? null;
+    setAuthRoles(authStatus.roles);
+    authUsername = authStatus.username ?? null;
     hideAuthGate();
     updateAuthUI();
     applyAuthRestrictions();
@@ -5036,10 +5060,7 @@ async function initializeApp() {
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
   } else {
-    // No valid session - show auth gate
+    showAuthGate();
-    // Guest button is shown if guest mode is available (role granted without auth)
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
   }
 }
 
@@ -5055,22 +5076,124 @@ function initSettingsUI() {
     window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRole);
     window.trx.modules.backgroundDecode.wireEvents();
   }
+  void refreshUserManagement();
 }
 
+async function refreshUserManagement() {
+  const section = document.getElementById("user-management");
+  const tab = document.getElementById("settings-users-tab");
+  if (!section || !tab) return;
+  const canManageUsers = authEnabled && hasAuthRole("administrator");
+  tab.style.display = canManageUsers ? "" : "none";
+  if (!canManageUsers) {
+    const panel = document.getElementById("subtab-settings-users");
+    if (panel) panel.style.display = "none";
+    if (tab.classList.contains("active")) {
+      document.querySelector<HTMLButtonElement>('[data-subtab="settings-scheduler"]')?.click();
+    }
+    return;
+  }
+  const list = requiredElement("user-list");
+  try {
+    const users = await listUsers();
+    const adminCount = users.filter(user => user.roles.includes("administrator")).length;
+    list.replaceChildren(...users.map((user) => {
+      const row = document.createElement("div");
+      row.className = "sch-row";
+      row.style.cssText = "display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;margin:.4rem 0";
+      const name = document.createElement("strong");
+      name.textContent = user.username;
+      name.style.minWidth = "10rem";
+      const roleInputs = ALL_AUTH_ROLES.map((value) => {
+        const label = document.createElement("label");
+        label.className = "auth-role-choice";
+        const input = document.createElement("input");
+        input.type = "checkbox";
+        input.value = value;
+        input.checked = user.roles.includes(value);
+        label.append(input, ` ${AUTH_ROLE_LABELS[value]}`);
+        return { label, input, value };
+      });
+      const roles = document.createElement("span");
+      roles.className = "auth-role-choices";
+      roles.append(...roleInputs.map(({ label }) => label));
+      const isOnlyAdmin = user.roles.includes("administrator") && adminCount === 1;
+      const administratorInput = roleInputs.find(item => item.value === "administrator")?.input;
+      if (isOnlyAdmin && administratorInput) {
+        administratorInput.disabled = true;
+        administratorInput.title = "The final administrator cannot be demoted";
+      }
+      const password = document.createElement("input");
+      password.type = "password"; password.placeholder = "New password (8+ characters)"; password.autocomplete = "new-password"; password.className = "auth-input"; password.minLength = 8;
+      const save = document.createElement("button"); save.type = "button"; save.textContent = "Save";
+      save.addEventListener("click", async () => {
+        const changes: { roles?: AuthRole[]; password?: string } = {
+          roles: roleInputs.filter(({ input }) => input.checked).map(({ value }) => value),
+        };
+        if (password.value) changes.password = password.value;
+        await runUserOperation(() => updateUser(user.username, changes));
+      });
+      const remove = document.createElement("button"); remove.type = "button"; remove.textContent = "Remove"; remove.className = "danger";
+      remove.disabled = user.username === authUsername || isOnlyAdmin;
+      if (isOnlyAdmin) remove.title = "The final administrator cannot be removed";
+      remove.addEventListener("click", async () => {
+        if (await window.trxUi.confirm({ title: "Remove user?", message: `Remove ${user.username} and revoke their sessions?`, confirmLabel: "Remove", danger: true })) {
+          await runUserOperation(() => deleteUser(user.username));
+        }
+      });
+      row.append(name, roles, password, save, remove);
+      return row;
+    }));
+  } catch (error) {
+    showUserManagementError(error);
+  }
+}
+
+function showUserManagementError(error: unknown) {
+  const element = document.getElementById("user-management-error");
+  if (!element) return;
+  element.textContent = error instanceof Error ? error.message : String(error);
+  element.style.display = "block";
+}
+
+async function runUserOperation(operation: () => Promise<void>) {
+  try {
+    await operation();
+    const error = document.getElementById("user-management-error");
+    if (error) error.style.display = "none";
+    await refreshUserManagement();
+  } catch (reason) {
+    showUserManagementError(reason);
+  }
+}
+
+document.getElementById("user-create-form")?.addEventListener("submit", (event) => {
+  event.preventDefault();
+  const username = requiredElement<HTMLInputElement>("user-create-username");
+  const password = requiredElement<HTMLInputElement>("user-create-password");
+  const roles = Array.from(document.querySelectorAll<HTMLInputElement>("#user-create-roles input[type=checkbox]"));
+  void runUserOperation(async () => {
+    await createUser(username.value, password.value, roles.filter(input => input.checked).map(input => input.value as AuthRole));
+    username.value = ""; password.value = "";
+    roles.forEach(input => { input.checked = input.value === "read"; });
+  });
+});
+
 // Setup auth form
 requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (e) => {
   e.preventDefault();
-  const passphraseEl = requiredElement<HTMLInputElement>("auth-passphrase");
+  const usernameEl = requiredElement<HTMLInputElement>("auth-username");
-  const passphrase = passphraseEl.value;
+  const passwordEl = requiredElement<HTMLInputElement>("auth-password");
   const btn = requiredElement<HTMLFormElement>("auth-form").querySelector<HTMLButtonElement>("button[type=submit]");
   if (!btn) return;
   btn.disabled = true;
   btn.textContent = "Logging in...";
 
   try {
-    const result = await authLogin(passphrase);
+    const result = await authLogin(usernameEl.value, passwordEl.value);
-    authRole = result.role ?? null;
+    setAuthRoles(result.roles);
-    passphraseEl.value = "";
+    authUsername = result.username ?? usernameEl.value;
+    passwordEl.value = "";
     hideAuthGate();
     updateAuthUI();
     applyAuthRestrictions();
@@ -5080,7 +5203,7 @@ requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
   } catch (err) {
-    showAuthError("Invalid passphrase");
+    showAuthError("Invalid username or password");
     console.error("Login error:", err);
   } finally {
     btn.disabled = false;
@@ -5088,35 +5211,18 @@ requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (
   }
 });
 
-// Setup guest button
-const guestBtn = document.getElementById("auth-guest-btn") as HTMLButtonElement | null;
-if (guestBtn) {
-  guestBtn.addEventListener("click", () => {
-    authRole = "rx";
-    requiredElement<HTMLInputElement>("auth-passphrase").value = "";
-    hideAuthGate();
-    updateAuthUI();
-    applyAuthRestrictions();
-    connect();
-    connectDecode();
-    initSettingsUI();
-    resizeHeaderSignalCanvas();
-    startHeaderSignalSampling();
-  });
-}
-
 // Setup header auth button (Login/Logout)
 const headerAuthBtn = document.getElementById("header-auth-btn") as HTMLButtonElement | null;
 if (headerAuthBtn) {
   headerAuthBtn.addEventListener("click", async () => {
-    if (authRole) {
+    if (authRoles.length > 0) {
       // Logged in - show logout confirmation
       if (await window.trxUi.confirm({ title: "Log out?", message: "Audio and control access for this browser session will end.", confirmLabel: "Log out", danger: false })) {
         await authLogout();
       }
     } else {
       // Not logged in - show auth gate
-      showAuthGate(false);
+      showAuthGate();
     }
   });
 }
@@ -5139,6 +5245,7 @@ Object.defineProperties(trxState, {
   decodeHistoryRetentionMin: { get() { return decodeHistoryRetentionMin; } },
   authEnabled:            { get() { return authEnabled;            } },
   authRole:               { get() { return authRole;               } },
+  authRoles:              { get() { return authRoles;              } },
   decoderRegistry:        { get() { return decoderRegistry;        } },
   sseSessionId:           { get() { return sseSessionId;           } },
   primaryRds:             { get() { return primaryRds;             } },

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/plugins/background-decode.ts

@@ -468,7 +468,9 @@ const bgdWindow = window as unknown as BackgroundBridge;
   }
 
   function isControlRole(): boolean {
-    return backgroundDecodeRole === "control" || hostState.authEnabled === false;
+    return backgroundDecodeRole === "administrator"
+      || backgroundDecodeRole === "control"
+      || hostState.authEnabled === false;
   }
 
   function showToast(msg: string, isError: boolean): void {

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/plugins/bookmarks.ts

@@ -100,7 +100,9 @@ function bmEsc(str: unknown): string {
 }
 
 function bmCanControl() {
-  return !hostState.authEnabled || hostState.authRole === "control";
+  return !hostState.authEnabled
+    || hostState.authRoles.includes("administrator")
+    || hostState.authRoles.includes("write");
 }
 
 // Show/hide the Add Bookmark / Select All buttons based on the current auth role.

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/plugins/host.ts

@@ -26,6 +26,7 @@ export interface HostState {
   readonly ownerCallsign: string | null;
   readonly authEnabled: boolean;
   readonly authRole: string | null;
+  readonly authRoles: readonly string[];
   readonly lastActiveRigId: string | null;
   readonly lastRigIds: string[];
   readonly lastRigDisplayNames: Record<string, string>;

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/plugins/logbook.ts

@@ -120,6 +120,12 @@ let entryGrid: string | null = null;
 let qsos: Qso[] = [];
 let workedRequest = 0;
 
+function canWriteLogbook(): boolean {
+  return !hostState.authEnabled
+    || hostState.authRoles.includes("administrator")
+    || hostState.authRoles.includes("write");
+}
+
 function notify(message: string, kind?: string): void {
   if (bridge.trxUi.notify) bridge.trxUi.notify(message, kind ? { kind } : undefined);
   else hostCore.showHint(message, 2000);
@@ -419,6 +425,11 @@ function renderRows(): void {
       row.appendChild(cell);
     }
     const actions = document.createElement("td");
+    if (!canWriteLogbook()) {
+      row.appendChild(actions);
+      fragment.appendChild(row);
+      continue;
+    }
     // Confirming is the commonest edit a log gets, so it is a button rather
     // than a form: a card arrives, and the contact counts towards an award.
     const confirm = document.createElement("button");
@@ -547,15 +558,20 @@ importFile?.addEventListener("change", () => {
 });
 
 /** Start an entry from a decode, and show the operator where it went. */
-bridge.logContact = (seed) => {
+if (canWriteLogbook()) {
-  bridge.navigateToTab?.("logbook");
+  bridge.logContact = (seed) => {
-  void openEntry(seed).then(() => callInput?.focus());
+    bridge.navigateToTab?.("logbook");
-};
+    void openEntry(seed).then(() => callInput?.focus());
+  };
+} else {
+  if (form) form.style.display = "none";
+  if (importBtn) importBtn.style.display = "none";
+}
 
 renderStation();
 if (cabrilloCallsign && !cabrilloCallsign.value) {
   cabrilloCallsign.value = stationCallEl?.textContent?.trim() ?? "";
 }
 syncCabrilloLink();
-void openEntry();
+if (canWriteLogbook()) void openEntry();
 void refreshLog();

src/trx-client/trx-frontend/trx-frontend-http/frontend/src/plugins/scheduler.ts

@@ -356,7 +356,7 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
     if (!prevBtn || !nextBtn) return;
     const state = schedulerInterleaveState(currentConfig);
     const enabled =
-      schedulerRole === "control" &&
+      (schedulerRole === "administrator" || schedulerRole === "control") &&
       !!currentRigId &&
       !schedulerStepPending &&
       state.activeEntries.length > 1;
@@ -466,7 +466,7 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
     if (!panel) return;
 
     const mode = (currentConfig && currentConfig.mode) || "disabled";
-    const isControl = schedulerRole === "control";
+    const isControl = schedulerRole === "administrator" || schedulerRole === "control";
 
     // Mode selector
     setSelected("scheduler-mode-select", mode);

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/background-decode.test.mjs

@@ -40,7 +40,7 @@ test("background decode loads configuration for the explicitly selected rig", as
   const source = await bundleEntry(new URL("../src/plugins/background-decode.ts", import.meta.url));
   new vm.Script(source).runInContext(context);
 
-  window.trx.modules.backgroundDecode.initialize("rig/a", "control");
+  window.trx.modules.backgroundDecode.initialize("rig/a", "administrator");
   await new Promise((resolve) => setTimeout(resolve, 0));
   assert.ok(requested.includes("/background-decode/rig%2Fa"));
   assert.ok(requested.includes("/bookmarks"));

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/bookmarks.test.mjs

@@ -32,7 +32,8 @@ function hostFixture(overrides = {}) {
   const calls = { postPath: [], setRigFrequency: [], armOptimisticFrequency: [], applyLocalTunedFrequency: [], syncBandwidthInput: [], scheduleSpectrumDraw: 0, syncModePicker: 0 };
   const state = {
     authEnabled: false,
-    authRole: "control",
+    authRole: "administrator",
+    authRoles: ["read", "control", "write", "administrator"],
     lastActiveRigId: null,
     lastRigIds: [],
     lastRigDisplayNames: {},
@@ -157,7 +158,7 @@ test("bookmark controls follow the host authentication state", async () => {
     if (!elements.has(id)) elements.set(id, new ElementFixture());
     return elements.get(id);
   };
-  const { window } = hostFixture({ authEnabled: true, authRole: "rx" });
+  const { window } = hostFixture({ authEnabled: true, authRole: "read", authRoles: ["read"] });
   const context = vm.createContext({
     window,
     document: documentFixture(element),
@@ -171,7 +172,8 @@ test("bookmark controls follow the host authentication state", async () => {
 
   assert.equal(element("bm-add-btn").style.display, "none");
 
-  window.trx.state.authRole = "control";
+  window.trx.state.authRole = "write";
+  window.trx.state.authRoles = ["read", "write"];
   await window.trx.modules.bookmarks.fetch("");
   assert.equal(element("bm-add-btn").style.display, "");
 });

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/host-fixture.mjs

@@ -19,7 +19,8 @@ export function createHost({ state = {}, core = {}, modules = {} } = {}) {
         serverLat: null,
         serverLon: null,
         authEnabled: false,
-        authRole: "control",
+        authRole: "administrator",
+        authRoles: ["read", "control", "write", "administrator"],
         lastActiveRigId: null,
         lastRigIds: [],
         lastRigDisplayNames: {},

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/scheduler.test.mjs

@@ -76,7 +76,7 @@ test("scheduler self-initializes for the active rig when a role is already known
     return elements.get(id);
   };
   const window = {
-    ...createHost({ state: { authRole: "control", lastActiveRigId: "sdr" } }),
+    ...createHost({ state: { authRole: "administrator", lastActiveRigId: "sdr" } }),
     trxUi: { confirm: async () => true },
   };
   const context = vm.createContext({

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/smoke.test.mjs

@@ -9,6 +9,7 @@ import { readFile } from "node:fs/promises";
 const indexPath = new URL("../../assets/web/index.html", import.meta.url);
 const pluginLoaderPath = new URL("../src/plugin-loader.ts", import.meta.url);
 const mapCorePath = new URL("../src/map-core.ts", import.meta.url);
+const appPath = new URL("../src/app.ts", import.meta.url);
 
 test("index loads one first-party application bootstrap", async () => {
   const html = await readFile(indexPath, "utf8");
@@ -30,6 +31,17 @@ test("startup has no remote script or stylesheet dependencies", async () => {
   );
 });
 
+test("administrator user management is a dedicated Settings sub-tab", async () => {
+  const [html, app] = await Promise.all([
+    readFile(indexPath, "utf8"),
+    readFile(appPath, "utf8"),
+  ]);
+  assert.match(html, /data-subtab="settings-users"/);
+  assert.match(html, /id="subtab-settings-users" class="sub-tab-panel"/);
+  assert.match(app, /authEnabled && hasAuthRole\("administrator"\)/);
+  assert.match(app, /settings-users-tab/);
+});
+
 test("lazy frontend features use modules and local map symbols", async () => {
   const [loader, map] = await Promise.all([
     readFile(pluginLoaderPath, "utf8"),

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/web-fixture.mjs

@@ -232,7 +232,7 @@ export async function startWebFixture({
   };
 
   const jsonRoutes = new Map([
-    ["/auth/session", { authenticated: true, role: "control", auth_disabled: true }],
+    ["/auth/session", { authenticated: true, roles: ["read", "control", "write", "administrator"], auth_disabled: true }],
     ["/decoders", DECODER_REGISTRY],
     ["/rigs", rigsResponse],
     ["/status", status],

src/trx-client/trx-frontend/trx-frontend-http/src/api/bookmarks.rs

@@ -9,7 +9,7 @@ use std::sync::Arc;
 use actix_web::Error;
 use actix_web::{delete, get, post, put, web, HttpRequest, HttpResponse};
 
-use super::{no_cache_response, request_accepts_html, require_control};
+use super::{no_cache_response, request_accepts_html, require_write};
 use crate::server::status;
 
 // ============================================================================
@@ -165,7 +165,7 @@ pub async fn create_bookmark(
     body: web::Json<BookmarkInput>,
     auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
     let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
     if store.freq_taken(body.freq_hz, None) {
         return Err(actix_web::error::ErrorConflict(
@@ -201,7 +201,7 @@ pub async fn update_bookmark(
     body: web::Json<BookmarkInput>,
     auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
     let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
     let id = path.into_inner();
     if store.freq_taken(body.freq_hz, Some(&id)) {
@@ -235,7 +235,7 @@ pub async fn delete_bookmark(
     query: web::Query<BookmarkScopeQuery>,
     auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
     let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
     let id = path.into_inner();
     if store.remove(&id) {
@@ -253,7 +253,7 @@ pub async fn batch_delete_bookmarks(
     query: web::Query<BookmarkScopeQuery>,
     auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
     let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
     let mut deleted = 0usize;
     for id in &body.ids {
@@ -272,7 +272,7 @@ pub async fn batch_move_bookmarks(
     query: web::Query<BookmarkScopeQuery>,
     auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
     let from_store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
     let to_store = resolve_bookmark_store(Some(body.to.as_str()), store_map.get_ref());
     let mut moved = 0usize;

src/trx-client/trx-frontend/trx-frontend-http/src/api/logbook.rs

@@ -15,7 +15,7 @@ use serde::{Deserialize, Serialize};
 use trx_logbook::qso::{adif_mode_for_rig_mode, band_for_hz, mode_for_decoder};
 use trx_logbook::{LogQuery, Logbook, Qso};
 
-use super::{active_rig_id_from_context, require_control};
+use super::{active_rig_id_from_context, require_write};
 use crate::server::auth::AuthState;
 
 /// What a contact looks like on the wire.
@@ -225,7 +225,7 @@ pub async fn add_qso(
     logbook: web::Data<Arc<Logbook>>,
     auth_state: web::Data<AuthState>,
 ) -> Result<HttpResponse, actix_web::Error> {
-    require_control(&req, auth_state.get_ref())?;
+    require_write(&req, auth_state.get_ref())?;
     let qso = match input.into_inner().into_qso(None) {
         Ok(qso) => qso,
         Err(reason) => {
@@ -248,7 +248,7 @@ pub async fn edit_qso(
     logbook: web::Data<Arc<Logbook>>,
     auth_state: web::Data<AuthState>,
 ) -> Result<HttpResponse, actix_web::Error> {
-    require_control(&req, auth_state.get_ref())?;
+    require_write(&req, auth_state.get_ref())?;
     let id = path.into_inner();
     let Some(existing) = book(&logbook).get(&id) else {
         return Ok(HttpResponse::NotFound().json(serde_json::json!({ "error": "no such contact" })));
@@ -276,7 +276,7 @@ pub async fn delete_qso(
     logbook: web::Data<Arc<Logbook>>,
     auth_state: web::Data<AuthState>,
 ) -> Result<HttpResponse, actix_web::Error> {
-    require_control(&req, auth_state.get_ref())?;
+    require_write(&req, auth_state.get_ref())?;
     match book(&logbook).delete(&path.into_inner()) {
         Ok(true) => Ok(HttpResponse::Ok().json(serde_json::json!({ "deleted": true }))),
         Ok(false) => {
@@ -312,7 +312,7 @@ pub async fn import_adi(
     logbook: web::Data<Arc<Logbook>>,
     auth_state: web::Data<AuthState>,
 ) -> Result<HttpResponse, actix_web::Error> {
-    require_control(&req, auth_state.get_ref())?;
+    require_write(&req, auth_state.get_ref())?;
     match book(&logbook).import_adi(&body) {
         Ok(outcome) => Ok(HttpResponse::Ok().json(outcome)),
         Err(err) => Ok(HttpResponse::InternalServerError()

src/trx-client/trx-frontend/trx-frontend-http/src/api/mod.rs

@@ -391,16 +391,20 @@ fn gz_cache_entry(src: &[u8], name: &str) -> GzCacheEntry {
     GzCacheEntry { gz, br, etag }
 }
 
-fn require_control(
+fn require_write(
     req: &HttpRequest,
     auth_state: &crate::server::auth::AuthState,
 ) -> Result<(), actix_web::Error> {
-    if !auth_state.config.enabled {
+    if !auth_state.config.enabled
-        return Ok(());
+        || crate::server::auth::session_grants(
-    }
+            req,
-    match crate::server::auth::get_session_role(req, auth_state) {
+            auth_state,
-        Some(crate::server::auth::AuthRole::Control) => Ok(()),
+            crate::server::auth::AuthRole::Write,
-        _ => Err(actix_web::error::ErrorForbidden("control role required")),
+        )
+    {
+        Ok(())
+    } else {
+        Err(actix_web::error::ErrorForbidden("write role required"))
     }
 }
 
@@ -709,6 +713,10 @@ pub fn configure(cfg: &mut web::ServiceConfig) {
         .service(crate::server::auth::login)
         .service(crate::server::auth::logout)
         .service(crate::server::auth::session_status)
+        .service(crate::server::auth::list_users)
+        .service(crate::server::auth::create_user)
+        .service(crate::server::auth::update_user)
+        .service(crate::server::auth::delete_user)
         // Logbook
         .service(logbook::list_qsos)
         .service(logbook::add_qso)
@@ -949,30 +957,39 @@ mod tests {
         );
     }
 
-    /// Auth off: every session may write, as a station with no passphrase set.
+    /// Auth off: every session may write without an account.
     fn auth_state_disabled() -> crate::server::auth::AuthState {
         crate::server::auth::AuthState::new(crate::server::auth::AuthConfig::new(
             false,
+            std::path::PathBuf::from("unused-users.json"),
             None,
             None,
             false,
+            "guest".to_string(),
+            None,
             std::time::Duration::from_secs(3600),
             false,
             crate::server::auth::SameSite::Lax,
         ))
+        .unwrap()
     }
 
     /// Auth on with no session presented, which is what a listener is.
     fn auth_state_locked() -> crate::server::auth::AuthState {
+        let directory = tempfile::tempdir().unwrap();
         crate::server::auth::AuthState::new(crate::server::auth::AuthConfig::new(
             true,
-            Some("listen".to_string()),
+            directory.path().join("users.json"),
-            Some("control".to_string()),
+            Some("admin".to_string()),
+            Some("password123".to_string()),
             false,
+            "guest".to_string(),
+            None,
             std::time::Duration::from_secs(3600),
             false,
             crate::server::auth::SameSite::Lax,
         ))
+        .unwrap()
     }
 
     /// A contact written over HTTP comes back out of the log, and out of an
@@ -1164,10 +1181,16 @@ mod tests {
         let logbook = std::sync::Arc::new(
             trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
         );
+        let auth_state = auth_state_locked();
+        let session_id = auth_state.store.create(
+            "reader".to_string(),
+            [crate::server::auth::AuthRole::Read].into_iter().collect(),
+            std::time::Duration::from_secs(3600),
+        );
         let app = actix_test::init_service(
             App::new()
                 .app_data(web::Data::new(logbook))
-                .app_data(web::Data::new(auth_state_locked()))
+                .app_data(web::Data::new(auth_state))
                 .service(logbook::add_qso)
                 .service(logbook::list_qsos),
         )
@@ -1177,6 +1200,10 @@ mod tests {
             &app,
             actix_test::TestRequest::post()
                 .uri("/api/logbook")
+                .cookie(actix_web::cookie::Cookie::new(
+                    "trx_http_sid",
+                    session_id.clone(),
+                ))
                 .set_json(serde_json::json!({
                     "call": "SP2SJG", "freq_hz": 14_074_000_u64, "mode": "FT8",
                 }))
@@ -1192,12 +1219,47 @@ mod tests {
             &app,
             actix_test::TestRequest::get()
                 .uri("/api/logbook")
+                .cookie(actix_web::cookie::Cookie::new("trx_http_sid", session_id))
                 .to_request(),
         )
         .await;
         assert_eq!(listed["total"], 0);
     }
 
+    #[actix_web::test]
+    async fn a_write_session_can_write_to_the_log() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let auth_state = auth_state_locked();
+        let session_id = auth_state.store.create(
+            "writer".to_string(),
+            [crate::server::auth::AuthRole::Write].into_iter().collect(),
+            std::time::Duration::from_secs(3600),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook))
+                .app_data(web::Data::new(auth_state))
+                .service(logbook::add_qso),
+        )
+        .await;
+
+        let response = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .cookie(actix_web::cookie::Cookie::new("trx_http_sid", session_id))
+                .set_json(serde_json::json!({
+                    "call": "SP2SJG", "freq_hz": 14_074_000_u64, "mode": "FT8",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert_eq!(response.status(), actix_web::http::StatusCode::OK);
+    }
+
     /// A contact needs a callsign; the panel is not the only thing that has to
     /// insist on it.
     #[actix_web::test]

src/trx-client/trx-frontend/trx-frontend-http/src/server.rs

@@ -254,9 +254,12 @@ fn build_server(
     };
     let auth_config = AuthConfig::new(
         context.http_auth.enabled,
-        context.http_auth.rx_passphrase.clone(),
+        context.http_auth.users_file.clone().into(),
-        context.http_auth.control_passphrase.clone(),
+        context.http_auth.bootstrap_admin_username.clone(),
-        context.http_auth.tx_access_control_enabled,
+        context.http_auth.bootstrap_admin_password.clone(),
+        context.http_auth.bootstrap_read_enabled,
+        context.http_auth.bootstrap_read_username.clone(),
+        context.http_auth.bootstrap_read_password.clone(),
         Duration::from_secs(context.http_auth.session_ttl_secs),
         context.http_auth.cookie_secure,
         same_site,
@@ -273,7 +276,9 @@ fn build_server(
     }
 
     let context_data = web::Data::new(context);
-    let auth_state = web::Data::new(AuthState::new(auth_config.clone()));
+    let auth_state = web::Data::new(
+        AuthState::new(auth_config.clone()).map_err(actix_web::error::ErrorInternalServerError)?,
+    );
 
     // Spawn session cleanup task if auth is enabled
     if auth_config.enabled {

src/trx-config/src/client.rs

@@ -268,18 +268,21 @@ impl AsRef<str> for CookieSameSite {
 pub struct HttpAuthConfig {
     /// Enable HTTP frontend authentication
     pub enabled: bool,
-    /// Passphrase for read-only access (rx role)
+    /// JSON file containing the managed user database.
-    pub rx_passphrase: Option<String>,
+    pub users_file: String,
-    /// Read the rx passphrase from this file instead.
+    /// Username used to create the first administrator when the database is absent.
+    pub bootstrap_admin_username: Option<String>,
+    /// Password used to create the first administrator when the database is absent.
+    pub bootstrap_admin_password: Option<String>,
+    /// Read the bootstrap administrator password from this file instead.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub rx_passphrase_file: Option<String>,
+    pub bootstrap_admin_password_file: Option<String>,
-    /// Passphrase for full control access (control role)
+    /// Create a read-only account when bootstrapping a new database.
-    pub control_passphrase: Option<String>,
+    pub bootstrap_read_enabled: bool,
-    /// Read the control passphrase from this file instead.
+    /// Username for the read-only bootstrap account.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub bootstrap_read_username: String,
-    pub control_passphrase_file: Option<String>,
+    /// Password for the read-only bootstrap account.
-    /// Enforce TX/PTT access control (hide from unauthenticated/rx users)
+    pub bootstrap_read_password: Option<String>,
-    pub tx_access_control_enabled: bool,
     /// Session time-to-live in minutes
     pub session_ttl_min: u64,
     /// Set Secure flag on session cookie (required for HTTPS)
@@ -292,11 +295,13 @@ impl Default for HttpAuthConfig {
     fn default() -> Self {
         Self {
             enabled: false,
-            rx_passphrase: None,
+            users_file: "trx-http-users.json".to_string(),
-            rx_passphrase_file: None,
+            bootstrap_admin_username: None,
-            control_passphrase: None,
+            bootstrap_admin_password: None,
-            control_passphrase_file: None,
+            bootstrap_admin_password_file: None,
-            tx_access_control_enabled: true,
+            bootstrap_read_enabled: true,
+            bootstrap_read_username: "guest".to_string(),
+            bootstrap_read_password: Some("guest".to_string()),
             session_ttl_min: 480,
             cookie_secure: false,
             cookie_same_site: CookieSameSite::Lax,
@@ -802,14 +807,9 @@ impl ClientConfig {
             )?;
         }
         resolve_secret(
-            &mut self.frontends.http.auth.rx_passphrase,
+            &mut self.frontends.http.auth.bootstrap_admin_password,
-            &self.frontends.http.auth.rx_passphrase_file,
+            &self.frontends.http.auth.bootstrap_admin_password_file,
-            "[frontends.http.auth].rx_passphrase",
+            "[frontends.http.auth].bootstrap_admin_password",
-        )?;
-        resolve_secret(
-            &mut self.frontends.http.auth.control_passphrase,
-            &self.frontends.http.auth.control_passphrase_file,
-            "[frontends.http.auth].control_passphrase",
         )?;
         resolve_secret_list(
             &mut self.frontends.http_json.auth.tokens,
@@ -819,7 +819,7 @@ impl ClientConfig {
 
         if let Some(path) = config_path {
             if self.has_inline_secrets() {
-                crate::secrets::warn_if_group_readable(path, "tokens/passphrases");
+                crate::secrets::warn_if_group_readable(path, "tokens/passwords");
             }
         }
         Ok(())
@@ -832,10 +832,22 @@ impl ClientConfig {
                 .remotes
                 .iter()
                 .any(|r| r.auth.token_file.is_none() && r.auth.token.is_some())
-            || self.frontends.http.auth.rx_passphrase_file.is_none()
+            || self
-                && self.frontends.http.auth.rx_passphrase.is_some()
+                .frontends
-            || self.frontends.http.auth.control_passphrase_file.is_none()
+                .http
-                && self.frontends.http.auth.control_passphrase.is_some()
+                .auth
+                .bootstrap_admin_password_file
+                .is_none()
+                && self.frontends.http.auth.bootstrap_admin_password.is_some()
+            || self.frontends.http.auth.enabled
+                && self.frontends.http.auth.bootstrap_read_enabled
+                && self
+                    .frontends
+                    .http
+                    .auth
+                    .bootstrap_read_password
+                    .as_deref()
+                    .is_some_and(|password| password != "guest")
             || self.frontends.http_json.auth.tokens_file.is_none()
                 && !self.frontends.http_json.auth.tokens.is_empty()
     }
@@ -905,11 +917,13 @@ impl ClientConfig {
                     decode_history_retention_min_by_rig: HashMap::new(),
                     auth: HttpAuthConfig {
                         enabled: false,
-                        rx_passphrase: Some("rx-passphrase-example".to_string()),
+                        users_file: "trx-http-users.json".to_string(),
-                        rx_passphrase_file: None,
+                        bootstrap_admin_username: Some("admin".to_string()),
-                        control_passphrase: Some("control-passphrase-example".to_string()),
+                        bootstrap_admin_password: Some("change-this-password".to_string()),
-                        control_passphrase_file: None,
+                        bootstrap_admin_password_file: None,
-                        tx_access_control_enabled: true,
+                        bootstrap_read_enabled: true,
+                        bootstrap_read_username: "guest".to_string(),
+                        bootstrap_read_password: Some("guest".to_string()),
                         session_ttl_min: 480,
                         cookie_secure: false,
                         cookie_same_site: CookieSameSite::Lax,
@@ -948,27 +962,34 @@ fn validate_http_auth(auth: &HttpAuthConfig) -> Result<(), String> {
         return Ok(());
     }
 
-    // If enabled, require at least one passphrase
+    if auth.users_file.trim().is_empty() {
-    if auth.rx_passphrase.is_none() && auth.control_passphrase.is_none() {
+        return Err("[frontends.http.auth].users_file must not be empty".to_string());
+    }
+    if auth.bootstrap_admin_username.is_some() != auth.bootstrap_admin_password.is_some() {
+        return Err("[frontends.http.auth] bootstrap_admin_username and bootstrap_admin_password must be set together".to_string());
+    }
+    if auth
+        .bootstrap_admin_username
+        .as_deref()
+        .is_some_and(|v| v.trim().is_empty())
+        || auth
+            .bootstrap_admin_password
+            .as_deref()
+            .is_some_and(|v| v.is_empty())
+    {
         return Err(
-            "[frontends.http.auth] enabled=true requires at least one passphrase \
+            "[frontends.http.auth] bootstrap administrator credentials must not be empty"
-             (rx_passphrase and/or control_passphrase)"
                 .to_string(),
         );
     }
-
+    if auth.bootstrap_read_enabled
-    // Validate passphrases are not empty strings
+        && (auth.bootstrap_read_username.trim().is_empty()
-    if let Some(rx) = &auth.rx_passphrase {
+            || auth
-        if rx.trim().is_empty() {
+                .bootstrap_read_password
-            return Err("[frontends.http.auth].rx_passphrase must not be empty if set".to_string());
+                .as_deref()
-        }
+                .is_none_or(str::is_empty))
-    }
+    {
-    if let Some(ctrl) = &auth.control_passphrase {
+        return Err("[frontends.http.auth] enabled bootstrap read account requires a non-empty username and password".to_string());
-        if ctrl.trim().is_empty() {
-            return Err(
-                "[frontends.http.auth].control_passphrase must not be empty if set".to_string(),
-            );
-        }
     }
 
     // Session TTL must be > 0
@@ -1238,42 +1259,34 @@ home-hf = "audio://10.0.0.5:4600"
     }
 
     #[test]
-    fn test_validate_rejects_http_auth_enabled_without_passphrases() {
+    fn test_validate_accepts_http_auth_with_user_database() {
         let mut config = ClientConfig::default();
         config.frontends.http.auth.enabled = true;
+        assert!(config.validate().is_ok());
+    }
+
+    #[test]
+    fn test_validate_accepts_bootstrap_admin_pair() {
+        let mut config = ClientConfig::default();
+        config.frontends.http.auth.enabled = true;
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
+        config.frontends.http.auth.bootstrap_admin_password = Some("secret-password".to_string());
+        assert!(config.validate().is_ok());
+    }
+
+    #[test]
+    fn test_validate_rejects_incomplete_bootstrap_admin_pair() {
+        let mut config = ClientConfig::default();
+        config.frontends.http.auth.enabled = true;
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
         assert!(config.validate().is_err());
     }
 
     #[test]
-    fn test_validate_accepts_http_auth_with_rx_passphrase() {
+    fn test_validate_rejects_empty_users_file() {
         let mut config = ClientConfig::default();
         config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
+        config.frontends.http.auth.users_file.clear();
-        assert!(config.validate().is_ok());
-    }
-
-    #[test]
-    fn test_validate_accepts_http_auth_with_control_passphrase() {
-        let mut config = ClientConfig::default();
-        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.control_passphrase = Some("control-secret".to_string());
-        assert!(config.validate().is_ok());
-    }
-
-    #[test]
-    fn test_validate_accepts_http_auth_with_both_passphrases() {
-        let mut config = ClientConfig::default();
-        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
-        config.frontends.http.auth.control_passphrase = Some("control-secret".to_string());
-        assert!(config.validate().is_ok());
-    }
-
-    #[test]
-    fn test_validate_rejects_empty_rx_passphrase() {
-        let mut config = ClientConfig::default();
-        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("".to_string());
         assert!(config.validate().is_err());
     }
 
@@ -1281,16 +1294,27 @@ home-hf = "audio://10.0.0.5:4600"
     fn test_validate_rejects_zero_session_ttl() {
         let mut config = ClientConfig::default();
         config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
         config.frontends.http.auth.session_ttl_min = 0;
         assert!(config.validate().is_err());
     }
 
     #[test]
-    fn test_validate_auth_disabled_ignores_passphrases() {
+    fn test_validate_allows_disabling_read_bootstrap_credentials() {
+        let mut config = ClientConfig::default();
+        config.frontends.http.auth.enabled = true;
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
+        config.frontends.http.auth.bootstrap_admin_password = Some("secret-password".to_string());
+        config.frontends.http.auth.bootstrap_read_enabled = false;
+        config.frontends.http.auth.bootstrap_read_username.clear();
+        config.frontends.http.auth.bootstrap_read_password = None;
+        assert!(config.validate().is_ok());
+    }
+
+    #[test]
+    fn test_validate_auth_disabled_ignores_user_settings() {
         let mut config = ClientConfig::default();
         config.frontends.http.auth.enabled = false;
-        config.frontends.http.auth.rx_passphrase = Some("".to_string());
+        config.frontends.http.auth.users_file.clear();
         assert!(config.validate().is_ok());
     }
 
@@ -1298,9 +1322,12 @@ home-hf = "audio://10.0.0.5:4600"
     fn test_http_auth_config_default() {
         let auth = HttpAuthConfig::default();
         assert!(!auth.enabled);
-        assert!(auth.rx_passphrase.is_none());
+        assert_eq!(auth.users_file, "trx-http-users.json");
-        assert!(auth.control_passphrase.is_none());
+        assert!(auth.bootstrap_admin_username.is_none());
-        assert!(auth.tx_access_control_enabled);
+        assert!(auth.bootstrap_admin_password.is_none());
+        assert!(auth.bootstrap_read_enabled);
+        assert_eq!(auth.bootstrap_read_username, "guest");
+        assert_eq!(auth.bootstrap_read_password.as_deref(), Some("guest"));
         assert_eq!(auth.session_ttl_min, 480);
         assert!(!auth.cookie_secure);
         assert!(matches!(auth.cookie_same_site, CookieSameSite::Lax));
@@ -1602,15 +1629,21 @@ spectrum_interval_ms = 0
     }
 
     #[test]
-    fn test_passphrase_file_fills_passphrase() {
+    fn test_bootstrap_password_file_fills_password() {
         let f = secret_file("hunter2\n");
         let mut config = ClientConfig::default();
         config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.control_passphrase_file =
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
+        config.frontends.http.auth.bootstrap_admin_password_file =
             Some(f.path().to_str().unwrap().to_string());
         config.resolve_secrets(None).unwrap();
         assert_eq!(
-            config.frontends.http.auth.control_passphrase.as_deref(),
+            config
+                .frontends
+                .http
+                .auth
+                .bootstrap_admin_password
+                .as_deref(),
             Some("hunter2")
         );
         assert!(config.validate().is_ok());

src/trx-config/src/example.rs

@@ -111,8 +111,8 @@ const SECTION_COMMENTS: &[(&str, &str)] = &[
     ),
     (
         "trx-client.frontends.http.auth",
-        "Passphrase login for the web UI.  rx_passphrase_file and\n\
+        "Optional user/password ACL for the web UI. Administrators manage\n\
-         control_passphrase_file keep the secrets out of this file.",
+         accounts stored in users_file.",
     ),
     (
         "trx-client.frontends.rigctl",

trx-rs.toml.example

@@ -203,13 +203,16 @@ decode_history_retention_min = 1440
 
 [trx-client.frontends.http.decode_history_retention_min_by_rig]
 
-# Passphrase login for the web UI.  rx_passphrase_file and
+# Optional user/password ACL for the web UI. Administrators manage
-# control_passphrase_file keep the secrets out of this file.
+# accounts stored in users_file.
 [trx-client.frontends.http.auth]
 enabled = false
-rx_passphrase = "rx-passphrase-example"
+users_file = "trx-http-users.json"
-control_passphrase = "control-passphrase-example"
+bootstrap_admin_username = "admin"
-tx_access_control_enabled = true
+bootstrap_admin_password = "change-this-password"
+bootstrap_read_enabled = true
+bootstrap_read_username = "guest"
+bootstrap_read_password = "guest"
 session_ttl_min = 480
 cookie_secure = false
 cookie_same_site = "Lax"