feat: refactor rbac/sharing to support new permissions and auth types

src/ui/sidebar/AdminManagementSections.tsx

@@ -1,16 +1,19 @@
-import type { Dispatch, SetStateAction } from "react";
+import { useState, type Dispatch, type SetStateAction } from "react";
 import { useTranslation } from "react-i18next";
 import {
   deleteRole,
   deleteUser,
+  getPermissionsCatalog,
   revokeAllUserSessions,
   revokeSession,
+  updateRole,
 } from "@/main-axios";
-import type { Role } from "@/main-axios";
+import type { PermissionCatalogEntry, Role } from "@/main-axios";
 import { Button } from "@/components/button";
 import { Input } from "@/components/input";
 import {
   Activity,
+  Check,
   KeyRound,
   Pencil,
   Plus,
@@ -375,6 +378,69 @@ export function AdminRolesSection({
   createRoleLoading,
 }: RolesSectionProps) {
   const { t } = useTranslation();
+  const [catalog, setCatalog] = useState<PermissionCatalogEntry[]>([]);
+  const [editingRoleId, setEditingRoleId] = useState<number | null>(null);
+  const [editingPermissions, setEditingPermissions] = useState<Set<string>>(
+    new Set(),
+  );
+  const [savingPermissions, setSavingPermissions] = useState(false);
+
+  function rolePermissions(role: Role): string[] {
+    if (Array.isArray(role.permissions)) return role.permissions;
+    if (typeof role.permissions === "string") {
+      try {
+        return JSON.parse(role.permissions) as string[];
+      } catch {
+        return [];
+      }
+    }
+    return [];
+  }
+
+  async function openPermissionsEditor(role: Role) {
+    if (editingRoleId === role.id) {
+      setEditingRoleId(null);
+      return;
+    }
+    try {
+      if (catalog.length === 0) {
+        const res = await getPermissionsCatalog();
+        setCatalog(res.catalog ?? []);
+      }
+      setEditingPermissions(new Set(rolePermissions(role)));
+      setEditingRoleId(role.id);
+    } catch {
+      toast.error(t("admin.rolePermissions.loadError"));
+    }
+  }
+
+  function togglePermission(permission: string) {
+    setEditingPermissions((prev) => {
+      const next = new Set(prev);
+      if (next.has(permission)) next.delete(permission);
+      else next.add(permission);
+      return next;
+    });
+  }
+
+  async function savePermissions(role: Role) {
+    setSavingPermissions(true);
+    try {
+      const permissions = [...editingPermissions];
+      await updateRole(role.id, { permissions });
+      setRoles((prev) =>
+        prev.map((entry) =>
+          entry.id === role.id ? { ...entry, permissions } : entry,
+        ),
+      );
+      setEditingRoleId(null);
+      toast.success(t("admin.rolePermissions.saved"));
+    } catch {
+      toast.error(t("admin.rolePermissions.saveError"));
+    } finally {
+      setSavingPermissions(false);
+    }
+  }
 
   return (
     <AccordionSection
@@ -467,52 +533,154 @@ export function AdminRolesSection({
             </div>
           </div>
         )}
-        {roles.map((role) => (
-          <div
-            key={role.id}
-            className="flex items-center justify-between py-2.5 border-b border-border last:border-0"
-          >
-            <div className="flex flex-col gap-0.5 min-w-0">
-              <div className="flex items-center gap-1.5 flex-wrap">
-                <span className="text-xs font-semibold truncate">
-                  {role.displayName}
-                </span>
-                {role.isSystem ? (
-                  <span className="text-[9px] font-semibold px-1 py-px border border-border text-muted-foreground">
-                    {t("admin.systemBadge")}
-                  </span>
-                ) : (
-                  <span className="text-[9px] font-semibold px-1 py-px border border-accent-brand/40 bg-accent-brand/10 text-accent-brand">
-                    {t("admin.customBadge")}
+        {roles.map((role) => {
+          const permissionCount = rolePermissions(role).length;
+          return (
+            <div
+              key={role.id}
+              className="flex flex-col py-2.5 border-b border-border last:border-0"
+            >
+              <div className="flex items-center justify-between">
+                <div className="flex flex-col gap-0.5 min-w-0">
+                  <div className="flex items-center gap-1.5 flex-wrap">
+                    <span className="text-xs font-semibold truncate">
+                      {role.displayName}
+                    </span>
+                    {role.isSystem ? (
+                      <span className="text-[9px] font-semibold px-1 py-px border border-border text-muted-foreground">
+                        {t("admin.systemBadge")}
+                      </span>
+                    ) : (
+                      <span className="text-[9px] font-semibold px-1 py-px border border-accent-brand/40 bg-accent-brand/10 text-accent-brand">
+                        {t("admin.customBadge")}
+                      </span>
+                    )}
+                    {permissionCount > 0 && (
+                      <span className="text-[9px] px-1 py-px border border-border/60 text-muted-foreground">
+                        {t("admin.rolePermissions.count", {
+                          count: permissionCount,
+                        })}
+                      </span>
+                    )}
+                  </div>
+                  <span className="text-[10px] font-mono text-muted-foreground">
+                    {role.name}
                   </span>
+                </div>
+                {!role.isSystem && (
+                  <div className="flex items-center gap-0.5 shrink-0">
+                    <Button
+                      variant="ghost"
+                      size="icon"
+                      className={`size-6 ${editingRoleId === role.id ? "text-accent-brand" : "text-muted-foreground hover:text-foreground"}`}
+                      title={t("admin.rolePermissions.editAction")}
+                      onClick={() => openPermissionsEditor(role)}
+                    >
+                      <KeyRound className="size-3" />
+                    </Button>
+                    <Button
+                      variant="ghost"
+                      size="icon"
+                      className="size-6 text-muted-foreground hover:text-destructive"
+                      onClick={async () => {
+                        await deleteRole(role.id);
+                        setRoles((prev) =>
+                          prev.filter((r) => r.id !== role.id),
+                        );
+                        toast.success(
+                          t("admin.deleteRoleSuccess", {
+                            name: role.displayName,
+                          }),
+                        );
+                      }}
+                    >
+                      <Trash2 className="size-3" />
+                    </Button>
+                  </div>
                 )}
               </div>
-              <span className="text-[10px] font-mono text-muted-foreground">
-                {role.name}
-              </span>
-            </div>
-            {!role.isSystem && (
-              <div className="flex items-center gap-0.5 shrink-0">
-                <Button
-                  variant="ghost"
-                  size="icon"
-                  className="size-6 text-muted-foreground hover:text-destructive"
-                  onClick={async () => {
-                    await deleteRole(role.id);
-                    setRoles((prev) => prev.filter((r) => r.id !== role.id));
-                    toast.success(
-                      t("admin.deleteRoleSuccess", {
-                        name: role.displayName,
-                      }),
+              {editingRoleId === role.id && (
+                <div className="flex flex-col gap-2.5 mt-2.5 p-2.5 border border-border bg-muted/20">
+                  {catalog.map((entry) => {
+                    const wildcard = `${entry.group}.*`;
+                    const wildcardOn = editingPermissions.has(wildcard);
+                    return (
+                      <div key={entry.group} className="flex flex-col gap-1">
+                        <button
+                          onClick={() => togglePermission(wildcard)}
+                          className="flex items-center gap-1.5 text-[10px] font-bold uppercase tracking-widest text-left"
+                        >
+                          <span
+                            className={`size-3 border flex items-center justify-center shrink-0 transition-colors ${wildcardOn ? "border-accent-brand bg-accent-brand" : "border-border bg-background"}`}
+                          >
+                            {wildcardOn && (
+                              <Check className="size-2 text-background" />
+                            )}
+                          </span>
+                          <span
+                            className={
+                              wildcardOn
+                                ? "text-accent-brand"
+                                : "text-muted-foreground"
+                            }
+                          >
+                            {entry.group}.*
+                          </span>
+                        </button>
+                        <div className="flex flex-col gap-0.5 pl-4">
+                          {entry.permissions.map((permission) => {
+                            const checked =
+                              wildcardOn || editingPermissions.has(permission);
+                            return (
+                              <button
+                                key={permission}
+                                disabled={wildcardOn}
+                                onClick={() => togglePermission(permission)}
+                                className="flex items-center gap-1.5 text-[10px] text-left disabled:opacity-60"
+                              >
+                                <span
+                                  className={`size-3 border flex items-center justify-center shrink-0 transition-colors ${checked ? "border-accent-brand bg-accent-brand" : "border-border bg-background"}`}
+                                >
+                                  {checked && (
+                                    <Check className="size-2 text-background" />
+                                  )}
+                                </span>
+                                <span className="font-mono text-muted-foreground">
+                                  {permission}
+                                </span>
+                              </button>
+                            );
+                          })}
+                        </div>
+                      </div>
                     );
-                  }}
-                >
-                  <Trash2 className="size-3" />
-                </Button>
-              </div>
-            )}
-          </div>
-        ))}
+                  })}
+                  <div className="flex justify-end gap-2 pt-1">
+                    <Button
+                      variant="ghost"
+                      size="sm"
+                      className="h-6 text-[10px]"
+                      onClick={() => setEditingRoleId(null)}
+                    >
+                      {t("common.cancel")}
+                    </Button>
+                    <Button
+                      variant="outline"
+                      size="sm"
+                      className="h-6 text-[10px] border-accent-brand/40 text-accent-brand hover:bg-accent-brand/10 hover:text-accent-brand"
+                      disabled={savingPermissions}
+                      onClick={() => savePermissions(role)}
+                    >
+                      {savingPermissions
+                        ? t("admin.rolePermissions.saving")
+                        : t("admin.rolePermissions.save")}
+                    </Button>
+                  </div>
+                </div>
+              )}
+            </div>
+          );
+        })}
       </div>
     </AccordionSection>
   );

src/ui/sidebar/HostManagerData.ts

@@ -113,6 +113,10 @@ export function sshHostToHost(h: SSHHostWithStatus): Host {
     socks5Password: h.socks5Password,
     socks5ProxyChain: parseJson(h.socks5ProxyChain) ?? [],
     overrideCredentialUsername: h.overrideCredentialUsername ?? false,
+    isShared: h.isShared ?? false,
+    permissionLevel: h.permissionLevel,
+    sharedExpiresAt: h.sharedExpiresAt,
+    ownerUsername: h.ownerUsername,
   };
 }
 

src/ui/sidebar/HostShareModal.tsx

@@ -1,9 +1,11 @@
-import { useState, useEffect } from "react";
+import { useState, useEffect, useMemo } from "react";
 import { useTranslation } from "react-i18next";
 import {
   ArrowLeft,
+  Check,
   ListChecks,
-  Plus,
+  Search,
+  Share2,
   Shield,
   User,
   Users,
@@ -12,17 +14,43 @@ import {
 import { toast } from "sonner";
 import { Button } from "@/components/button";
 import { Input } from "@/components/input";
-import { SectionCard } from "@/components/section-card";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/dropdown-menu";
 import {
   getHostAccess,
   shareHost,
+  updateHostAccess,
   revokeHostAccess,
   getUserList,
   getRoles,
   type AccessRecord,
+  type SharePermissionLevel,
+  type ShareTarget,
 } from "@/main-axios";
 import type { Host } from "@/types/ui-types";
 
+const PERMISSION_LEVELS: SharePermissionLevel[] = [
+  "connect",
+  "view",
+  "edit",
+  "manage",
+];
+
+const EXPIRY_PRESETS = [
+  { key: "never", hours: null },
+  { key: "oneHour", hours: 1 },
+  { key: "oneDay", hours: 24 },
+  { key: "sevenDays", hours: 24 * 7 },
+  { key: "thirtyDays", hours: 24 * 30 },
+  { key: "custom", hours: undefined },
+] as const;
+
+type ExpiryPresetKey = (typeof EXPIRY_PRESETS)[number]["key"];
+
 export function HostShareModal({
   open,
   onClose,
@@ -33,18 +61,28 @@ export function HostShareModal({
   host: Host | null;
 }) {
   const { t } = useTranslation();
-  const [shareType, setShareType] = useState<"user" | "role">("user");
-  const [shareGranteeId, setShareGranteeId] = useState("");
-  const [shareExpiryHours, setShareExpiryHours] = useState("");
+  const [targetTab, setTargetTab] = useState<"user" | "role">("user");
+  const [search, setSearch] = useState("");
+  const [selectedUserIds, setSelectedUserIds] = useState<Set<string>>(
+    new Set(),
+  );
+  const [selectedRoleIds, setSelectedRoleIds] = useState<Set<number>>(
+    new Set(),
+  );
+  const [permissionLevel, setPermissionLevel] =
+    useState<SharePermissionLevel>("connect");
+  const [expiryPreset, setExpiryPreset] = useState<ExpiryPresetKey>("never");
+  const [customHours, setCustomHours] = useState("");
   const [accessList, setAccessList] = useState<AccessRecord[]>([]);
   const [shareUsers, setShareUsers] = useState<
     { id: string; username: string }[]
   >([]);
-  const [shareRoles, setShareRoles] = useState<{ id: string; name: string }[]>(
-    [],
-  );
+  const [shareRoles, setShareRoles] = useState<
+    { id: number; name: string; displayName?: string }[]
+  >([]);
   const [sharingLoaded, setSharingLoaded] = useState(false);
   const [sharingLoadError, setSharingLoadError] = useState(false);
+  const [submitting, setSubmitting] = useState(false);
 
   useEffect(() => {
     if (!open || !host) return;
@@ -64,10 +102,13 @@ export function HostShareModal({
           })),
         );
         setShareRoles(
-          (rolesRes.roles ?? []).map((r) => ({
-            id: String(r.id),
-            name: r.name,
-          })),
+          (rolesRes.roles ?? [])
+            .filter((r) => !r.isSystem)
+            .map((r) => ({
+              id: Number(r.id),
+              name: r.name,
+              displayName: r.displayName,
+            })),
         );
       })
       .catch(() => setSharingLoadError(true));
@@ -77,21 +118,102 @@ export function HostShareModal({
     setSharingLoaded(false);
     setSharingLoadError(false);
     setAccessList([]);
-    setShareGranteeId("");
-    setShareExpiryHours("");
-    setShareType("user");
+    setSearch("");
+    setSelectedUserIds(new Set());
+    setSelectedRoleIds(new Set());
+    setPermissionLevel("connect");
+    setExpiryPreset("never");
+    setCustomHours("");
+    setTargetTab("user");
   }, [host?.id]);
 
+  const filteredUsers = useMemo(() => {
+    const q = search.trim().toLowerCase();
+    return q
+      ? shareUsers.filter((u) => u.username.toLowerCase().includes(q))
+      : shareUsers;
+  }, [shareUsers, search]);
+
+  const filteredRoles = useMemo(() => {
+    const q = search.trim().toLowerCase();
+    return q
+      ? shareRoles.filter(
+          (r) =>
+            r.name.toLowerCase().includes(q) ||
+            (r.displayName ?? "").toLowerCase().includes(q),
+        )
+      : shareRoles;
+  }, [shareRoles, search]);
+
+  const selectedCount = selectedUserIds.size + selectedRoleIds.size;
+
+  const durationHours = (() => {
+    if (expiryPreset === "never") return undefined;
+    if (expiryPreset === "custom") {
+      const hours = Number(customHours);
+      return Number.isFinite(hours) && hours > 0 ? hours : undefined;
+    }
+    return (
+      EXPIRY_PRESETS.find((p) => p.key === expiryPreset)?.hours ?? undefined
+    );
+  })();
+
   async function refreshAccessList() {
     if (!host) return;
     const res = await getHostAccess(Number(host.id));
     setAccessList(res.accessList ?? []);
   }
 
-  if (!open) return null;
+  async function handleShare() {
+    if (!host || selectedCount === 0) return;
+    const targets: ShareTarget[] = [
+      ...[...selectedUserIds].map(
+        (id) => ({ type: "user", id }) as ShareTarget,
+      ),
+      ...[...selectedRoleIds].map(
+        (id) => ({ type: "role", id }) as ShareTarget,
+      ),
+    ];
 
-  const hasCredential =
-    !!host?.credentialId || !!host?.rdpCredentialId || !!host?.vncCredentialId;
+    setSubmitting(true);
+    try {
+      await shareHost(Number(host.id), {
+        targets,
+        permissionLevel,
+        ...(durationHours ? { durationHours } : {}),
+      });
+      await refreshAccessList();
+      setSelectedUserIds(new Set());
+      setSelectedRoleIds(new Set());
+      toast.success(t("hosts.hostSharedSuccessfully"));
+    } catch {
+      toast.error(t("hosts.failedToShareHost"));
+    } finally {
+      setSubmitting(false);
+    }
+  }
+
+  async function handleLevelChange(
+    record: AccessRecord,
+    level: SharePermissionLevel,
+  ) {
+    if (!host || record.permissionLevel === level) return;
+    try {
+      await updateHostAccess(Number(host.id), record.id, {
+        permissionLevel: level,
+      });
+      setAccessList((prev) =>
+        prev.map((entry) =>
+          entry.id === record.id ? { ...entry, permissionLevel: level } : entry,
+        ),
+      );
+      toast.success(t("hosts.sharing.accessUpdated"));
+    } catch {
+      toast.error(t("hosts.sharing.accessUpdateFailed"));
+    }
+  }
+
+  if (!open) return null;
 
   return (
     <div className="absolute inset-0 z-20 flex flex-col bg-sidebar">
@@ -101,228 +223,339 @@ export function HostShareModal({
         className="flex items-center gap-2 px-3 py-2 shrink-0 border-b border-border text-xs text-muted-foreground hover:text-foreground transition-colors w-full text-left"
       >
         <ArrowLeft className="size-3.5 shrink-0" />
-        <span>{t("hosts.shareHostTitle", { name: host?.name ?? "" })}</span>
+        <span className="truncate">
+          {t("hosts.shareHostTitle", { name: host?.name ?? "" })}
+        </span>
       </button>
 
-      {/* Scrollable content */}
-      <div className="flex flex-col flex-1 min-h-0 overflow-y-auto p-3 gap-3">
-        {!hasCredential && host !== null && (
-          <div className="flex items-start gap-3 p-3 border border-yellow-500/30 bg-yellow-500/5 text-xs text-yellow-500">
-            <Shield className="size-3.5 shrink-0 mt-0.5" />
-            <div>{t("hosts.sharing.requiresCredential")}</div>
-          </div>
-        )}
+      {sharingLoadError && (
+        <div className="flex items-start gap-2 px-3 py-2 shrink-0 border-b border-destructive/30 bg-destructive/5 text-xs text-destructive">
+          <Shield className="size-3.5 shrink-0 mt-0.5" />
+          <div>{t("hosts.sharing.loadError")}</div>
+        </div>
+      )}
 
-        {sharingLoadError && hasCredential && (
-          <div className="flex items-start gap-3 p-3 border border-destructive/30 bg-destructive/5 text-xs text-destructive">
-            <Shield className="size-3.5 shrink-0 mt-0.5" />
-            <div>{t("hosts.guac.sharingLoadError")}</div>
+      {/* Share form: fixed, non-scrolling */}
+      <div className="flex flex-col gap-2 p-3 shrink-0 border-b border-border">
+        <div className="flex items-center justify-between gap-2">
+          <div className="flex items-center gap-1.5 text-[10px] font-semibold uppercase tracking-widest text-muted-foreground">
+            <Users className="size-3.5" />
+            {t("hosts.sharing.shareWithSection")}
           </div>
-        )}
+          <a
+            href="https://docs.termix.site/features/authentication/rbac"
+            target="_blank"
+            rel="noreferrer"
+            className="text-[10px] text-accent-brand hover:underline shrink-0"
+          >
+            {t("hosts.docsLink")}
+          </a>
+        </div>
 
-        {hasCredential && (
-          <>
-            <SectionCard
-              title={t("hosts.guac.shareHostSection")}
-              icon={<Users className="size-3.5" />}
-              action={
-                <a
-                  href="https://docs.termix.site/features/authentication/rbac"
-                  target="_blank"
-                  rel="noreferrer"
-                  className="text-[10px] text-accent-brand hover:underline normal-case tracking-normal font-normal"
-                >
-                  {t("hosts.docsLink")}
-                </a>
-              }
+        <div className="flex gap-1.5">
+          {(["user", "role"] as const).map((tab) => (
+            <button
+              key={tab}
+              onClick={() => setTargetTab(tab)}
+              className={`flex-1 flex items-center justify-center gap-1 px-2 py-1.5 text-[10px] font-bold uppercase tracking-widest border transition-colors ${targetTab === tab ? "border-accent-brand/40 bg-accent-brand/10 text-accent-brand" : "border-border text-muted-foreground hover:text-foreground"}`}
             >
-              <div className="flex flex-col gap-4 py-3">
-                <div className="flex gap-2">
-                  {(["user", "role"] as const).map((shareTypeOpt) => (
-                    <button
-                      key={shareTypeOpt}
-                      onClick={() => {
-                        setShareType(shareTypeOpt);
-                        setShareGranteeId("");
-                      }}
-                      className={`px-3 py-1.5 text-[10px] font-bold uppercase tracking-widest border transition-colors ${shareType === shareTypeOpt ? "border-accent-brand/40 bg-accent-brand/10 text-accent-brand" : "border-border text-muted-foreground hover:text-foreground"}`}
-                    >
-                      {shareTypeOpt === "user" ? (
-                        <>
-                          <User className="size-3 inline mr-1" />
-                          {t("hosts.guac.shareWithUser")}
-                        </>
-                      ) : (
-                        <>
-                          <Shield className="size-3 inline mr-1" />
-                          {t("hosts.guac.shareWithRole")}
-                        </>
-                      )}
-                    </button>
-                  ))}
-                </div>
-                <div className="flex flex-col gap-1.5">
-                  <label className="text-[10px] font-bold uppercase tracking-widest text-muted-foreground">
-                    {shareType === "user"
-                      ? t("hosts.guac.selectUser")
-                      : t("hosts.guac.selectRole")}
-                  </label>
-                  <select
-                    className="flex h-9 w-full border border-border bg-background px-3 py-1 text-xs outline-none focus:ring-1 focus:ring-ring"
-                    value={shareGranteeId}
-                    onChange={(e) => setShareGranteeId(e.target.value)}
-                  >
-                    <option value="">
-                      {shareType === "user"
-                        ? t("hosts.guac.selectUserOption")
-                        : t("hosts.guac.selectRoleOption")}
-                    </option>
-                    {shareType === "user"
-                      ? shareUsers.map((u) => (
-                          <option key={u.id} value={u.id}>
-                            {u.username}
-                          </option>
-                        ))
-                      : shareRoles.map((r) => (
-                          <option key={r.id} value={r.id}>
-                            {r.name}
-                          </option>
-                        ))}
-                  </select>
-                </div>
-                <div className="flex flex-col gap-1.5">
-                  <label className="text-[10px] font-bold uppercase tracking-widest text-muted-foreground">
-                    {t("hosts.guac.expiresInHours")}
-                  </label>
-                  <Input
-                    type="number"
-                    placeholder={t("hosts.guac.noExpiryPlaceholder")}
-                    value={shareExpiryHours}
-                    onChange={(e) => setShareExpiryHours(e.target.value)}
-                    className="[appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none"
-                  />
-                </div>
-                <div className="flex justify-end">
-                  <Button
-                    variant="outline"
-                    className="border-accent-brand/40 text-accent-brand hover:bg-accent-brand/10 hover:text-accent-brand"
-                    disabled={!shareGranteeId}
-                    onClick={async () => {
-                      try {
-                        await shareHost(Number(host!.id), {
-                          targetType: shareType,
-                          ...(shareType === "user"
-                            ? { targetUserId: shareGranteeId }
-                            : { targetRoleId: Number(shareGranteeId) }),
-                          permissionLevel: "view",
-                          ...(shareExpiryHours
-                            ? { durationHours: Number(shareExpiryHours) }
-                            : {}),
-                        });
-                        await refreshAccessList();
-                        setShareGranteeId("");
-                        setShareExpiryHours("");
-                        toast.success(t("hosts.hostSharedSuccessfully"));
-                      } catch {
-                        toast.error(t("hosts.failedToShareHost"));
-                      }
-                    }}
-                  >
-                    <Plus className="size-3.5 mr-1.5" />
-                    {t("hosts.guac.shareBtn")}
-                  </Button>
-                </div>
+              {tab === "user" ? (
+                <User className="size-3 shrink-0" />
+              ) : (
+                <Shield className="size-3 shrink-0" />
+              )}
+              {tab === "user"
+                ? t("hosts.sharing.usersTab")
+                : t("hosts.sharing.rolesTab")}
+              {tab === "user" && selectedUserIds.size > 0 && (
+                <span>({selectedUserIds.size})</span>
+              )}
+              {tab === "role" && selectedRoleIds.size > 0 && (
+                <span>({selectedRoleIds.size})</span>
+              )}
+            </button>
+          ))}
+        </div>
+
+        <div className="relative">
+          <Search className="absolute left-2.5 top-1/2 -translate-y-1/2 size-3.5 text-muted-foreground/50" />
+          <Input
+            placeholder={t("hosts.sharing.searchPlaceholder")}
+            value={search}
+            onChange={(e) => setSearch(e.target.value)}
+            className="pl-8"
+          />
+        </div>
+
+        <div className="flex flex-col border border-border h-28 overflow-y-auto">
+          {targetTab === "user" &&
+            (filteredUsers.length === 0 ? (
+              <div className="px-3 py-4 text-xs text-muted-foreground/50 text-center">
+                {t("hosts.sharing.noMatches")}
               </div>
-            </SectionCard>
-
-            <SectionCard
-              title={t("hosts.guac.currentAccess")}
-              icon={<ListChecks className="size-3.5" />}
-            >
-              <div className="py-2">
-                {accessList.length === 0 && (
-                  <div className="px-2 py-4 text-xs text-muted-foreground/50 text-center">
-                    {t("hosts.guac.noAccessEntries")}
-                  </div>
-                )}
-                {accessList.map((r, i) => {
-                  const expired =
-                    r.expiresAt && new Date(r.expiresAt) < new Date();
-                  return (
+            ) : (
+              filteredUsers.map((user) => {
+                const isSelected = selectedUserIds.has(user.id);
+                return (
+                  <button
+                    key={user.id}
+                    onClick={() =>
+                      setSelectedUserIds((prev) => {
+                        const next = new Set(prev);
+                        if (next.has(user.id)) next.delete(user.id);
+                        else next.add(user.id);
+                        return next;
+                      })
+                    }
+                    className={`flex items-center gap-2 px-2.5 py-1.5 text-xs text-left border-b border-border/50 last:border-0 transition-colors shrink-0 ${isSelected ? "bg-accent-brand/10 text-accent-brand" : "hover:bg-muted/40"}`}
+                  >
                     <div
-                      key={i}
-                      className="flex flex-col gap-1 px-2 py-2.5 border-b border-border last:border-0 text-xs"
+                      className={`size-3.5 border flex items-center justify-center shrink-0 transition-colors ${isSelected ? "border-accent-brand bg-accent-brand" : "border-border bg-background"}`}
                     >
-                      <div className="flex items-center justify-between gap-2">
-                        <div className="flex items-center gap-1.5 min-w-0">
-                          {r.targetType === "user" ? (
-                            <User className="size-3 text-muted-foreground shrink-0" />
-                          ) : (
-                            <Shield className="size-3 text-muted-foreground shrink-0" />
-                          )}
-                          <span className="font-semibold truncate">
-                            {r.username ??
-                              r.roleName ??
-                              r.roleDisplayName ??
-                              r.userId ??
-                              r.roleId}
-                          </span>
-                          <span className="text-muted-foreground capitalize shrink-0">
-                            ({r.targetType})
-                          </span>
-                        </div>
-                        <Button
-                          variant="ghost"
-                          size="sm"
-                          className="h-6 text-[10px] px-2 text-destructive hover:bg-destructive/10 shrink-0"
-                          onClick={async () => {
-                            try {
-                              await revokeHostAccess(Number(host!.id), r.id);
-                              setAccessList((prev) =>
-                                prev.filter((_, idx) => idx !== i),
-                              );
-                              toast.success(t("hosts.accessRevoked"));
-                            } catch {
-                              toast.error(t("hosts.failedToRevokeAccess"));
-                            }
-                          }}
-                        >
-                          {t("hosts.guac.revokeBtn")}
-                        </Button>
-                      </div>
-                      <div className="flex items-center gap-3 text-[10px] text-muted-foreground pl-4">
-                        <span>
-                          {t("hosts.guac.grantedByHeader")}:{" "}
-                          <span className="text-foreground/70">
-                            {r.grantedByUsername ?? "—"}
-                          </span>
-                        </span>
-                        <span className={expired ? "text-destructive" : ""}>
-                          {t("hosts.guac.expiresHeader")}:{" "}
-                          {expired ? (
-                            <span className="inline-flex items-center gap-0.5 text-destructive">
-                              <X className="size-3" />
-                              {t("hosts.guac.expiredLabel")}
-                            </span>
-                          ) : r.expiresAt ? (
-                            <span className="text-foreground/70">
-                              {new Date(r.expiresAt).toLocaleDateString()}
-                            </span>
-                          ) : (
-                            <span className="text-foreground/70">
-                              {t("hosts.guac.neverLabel")}
-                            </span>
-                          )}
-                        </span>
-                      </div>
+                      {isSelected && (
+                        <Check className="size-2.5 text-background" />
+                      )}
                     </div>
-                  );
-                })}
+                    <User className="size-3 text-muted-foreground shrink-0" />
+                    <span className="truncate">{user.username}</span>
+                  </button>
+                );
+              })
+            ))}
+          {targetTab === "role" &&
+            (filteredRoles.length === 0 ? (
+              <div className="px-3 py-4 text-xs text-muted-foreground/50 text-center">
+                {t("hosts.sharing.noMatches")}
               </div>
-            </SectionCard>
-          </>
+            ) : (
+              filteredRoles.map((role) => {
+                const isSelected = selectedRoleIds.has(role.id);
+                return (
+                  <button
+                    key={role.id}
+                    onClick={() =>
+                      setSelectedRoleIds((prev) => {
+                        const next = new Set(prev);
+                        if (next.has(role.id)) next.delete(role.id);
+                        else next.add(role.id);
+                        return next;
+                      })
+                    }
+                    className={`flex items-center gap-2 px-2.5 py-1.5 text-xs text-left border-b border-border/50 last:border-0 transition-colors shrink-0 ${isSelected ? "bg-accent-brand/10 text-accent-brand" : "hover:bg-muted/40"}`}
+                  >
+                    <div
+                      className={`size-3.5 border flex items-center justify-center shrink-0 transition-colors ${isSelected ? "border-accent-brand bg-accent-brand" : "border-border bg-background"}`}
+                    >
+                      {isSelected && (
+                        <Check className="size-2.5 text-background" />
+                      )}
+                    </div>
+                    <Shield className="size-3 text-muted-foreground shrink-0" />
+                    <span className="truncate">
+                      {role.displayName || role.name}
+                    </span>
+                  </button>
+                );
+              })
+            ))}
+        </div>
+
+        <div className="flex items-end gap-2">
+          <div className="flex flex-col gap-1 flex-1 min-w-0">
+            <span className="text-[10px] font-semibold uppercase tracking-widest text-muted-foreground">
+              {t("hosts.sharing.permissionLevelLabel")}
+            </span>
+            <select
+              value={permissionLevel}
+              onChange={(e) =>
+                setPermissionLevel(e.target.value as SharePermissionLevel)
+              }
+              className="h-8 w-full px-2.5 text-xs border border-border bg-background hover:bg-muted/40 transition-colors"
+            >
+              {PERMISSION_LEVELS.map((level) => (
+                <option key={level} value={level}>
+                  {t(`hosts.sharing.levels.${level}.label`)}
+                </option>
+              ))}
+            </select>
+          </div>
+
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <button className="flex flex-col gap-1 shrink-0">
+                <span className="text-[10px] font-semibold uppercase tracking-widest text-muted-foreground text-left">
+                  {t("hosts.sharing.expiryLabel")}
+                </span>
+                <span className="h-8 flex items-center justify-center px-2.5 text-xs border border-border hover:bg-muted/40 transition-colors whitespace-nowrap">
+                  {t(`hosts.sharing.expiry.${expiryPreset}`)}
+                </span>
+              </button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" className="text-xs">
+              {EXPIRY_PRESETS.map((preset) => (
+                <DropdownMenuItem
+                  key={preset.key}
+                  onClick={() => setExpiryPreset(preset.key)}
+                >
+                  {expiryPreset === preset.key ? (
+                    <Check className="size-3 mr-1.5" />
+                  ) : (
+                    <span className="size-3 mr-1.5" />
+                  )}
+                  {t(`hosts.sharing.expiry.${preset.key}`)}
+                </DropdownMenuItem>
+              ))}
+            </DropdownMenuContent>
+          </DropdownMenu>
+
+          <Button
+            variant="outline"
+            className="h-8 shrink-0 border-accent-brand/40 text-accent-brand hover:bg-accent-brand/10 hover:text-accent-brand"
+            disabled={
+              selectedCount === 0 ||
+              submitting ||
+              (expiryPreset === "custom" && !durationHours)
+            }
+            onClick={handleShare}
+          >
+            <Share2 className="size-3.5 mr-1.5" />
+            {selectedCount > 0
+              ? t("hosts.sharing.shareWithCount", { count: selectedCount })
+              : t("hosts.sharing.shareButton")}
+          </Button>
+        </div>
+
+        <p className="text-[11px] text-muted-foreground leading-snug">
+          {t(`hosts.sharing.levels.${permissionLevel}.description`)}
+        </p>
+
+        {expiryPreset === "custom" && (
+          <Input
+            type="number"
+            autoFocus
+            placeholder={t("hosts.sharing.customHoursPlaceholder")}
+            value={customHours}
+            onChange={(e) => setCustomHours(e.target.value)}
+            className="[appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none"
+          />
         )}
       </div>
+
+      {/* Current access: takes remaining space, scrolls independently */}
+      <div className="flex flex-col flex-1 min-h-0">
+        <div className="flex items-center gap-1.5 px-3 py-2 shrink-0 border-b border-border text-[10px] font-semibold uppercase tracking-widest text-muted-foreground">
+          <ListChecks className="size-3.5" />
+          {t("hosts.sharing.currentAccess")}
+          {accessList.length > 0 && (
+            <span className="text-muted-foreground/40">
+              ({accessList.length})
+            </span>
+          )}
+        </div>
+        <div className="flex-1 min-h-0 overflow-y-auto">
+          {accessList.length === 0 && (
+            <div className="px-3 py-6 text-xs text-muted-foreground/50 text-center">
+              {t("hosts.sharing.noAccessEntries")}
+            </div>
+          )}
+          {accessList.map((record) => {
+            const expired =
+              record.expiresAt && new Date(record.expiresAt) < new Date();
+            return (
+              <div
+                key={record.id}
+                className="flex flex-col gap-1 px-3 py-2 border-b border-border/60 last:border-0 text-xs"
+              >
+                <div className="flex items-center justify-between gap-2">
+                  <div className="flex items-center gap-1.5 min-w-0">
+                    {record.targetType === "user" ? (
+                      <User className="size-3 text-muted-foreground shrink-0" />
+                    ) : (
+                      <Shield className="size-3 text-muted-foreground shrink-0" />
+                    )}
+                    <span className="font-semibold truncate">
+                      {record.username ??
+                        record.roleDisplayName ??
+                        record.roleName ??
+                        record.userId ??
+                        record.roleId}
+                    </span>
+                  </div>
+                  <div className="flex items-center gap-1 shrink-0">
+                    <DropdownMenu>
+                      <DropdownMenuTrigger asChild>
+                        <button className="px-1.5 py-0.5 text-[9px] font-bold uppercase tracking-widest border border-accent-brand/30 bg-accent-brand/10 text-accent-brand transition-colors hover:bg-accent-brand/20">
+                          {t(
+                            `hosts.sharing.levels.${record.permissionLevel ?? "connect"}.label`,
+                          )}
+                        </button>
+                      </DropdownMenuTrigger>
+                      <DropdownMenuContent align="end" className="text-xs">
+                        {PERMISSION_LEVELS.map((level) => (
+                          <DropdownMenuItem
+                            key={level}
+                            onClick={() => handleLevelChange(record, level)}
+                          >
+                            {record.permissionLevel === level ? (
+                              <Check className="size-3 mr-1.5" />
+                            ) : (
+                              <span className="size-3 mr-1.5" />
+                            )}
+                            {t(`hosts.sharing.levels.${level}.label`)}
+                          </DropdownMenuItem>
+                        ))}
+                      </DropdownMenuContent>
+                    </DropdownMenu>
+                    <Button
+                      variant="ghost"
+                      size="sm"
+                      className="h-6 text-[10px] px-2 text-destructive hover:bg-destructive/10"
+                      onClick={async () => {
+                        try {
+                          await revokeHostAccess(Number(host!.id), record.id);
+                          setAccessList((prev) =>
+                            prev.filter((entry) => entry.id !== record.id),
+                          );
+                          toast.success(t("hosts.accessRevoked"));
+                        } catch {
+                          toast.error(t("hosts.failedToRevokeAccess"));
+                        }
+                      }}
+                    >
+                      {t("hosts.sharing.revoke")}
+                    </Button>
+                  </div>
+                </div>
+                <div className="flex items-center gap-3 text-[10px] text-muted-foreground pl-4">
+                  <span>
+                    {t("hosts.sharing.grantedBy")}:{" "}
+                    <span className="text-foreground/70">
+                      {record.grantedByUsername ?? "?"}
+                    </span>
+                  </span>
+                  <span className={expired ? "text-destructive" : ""}>
+                    {t("hosts.sharing.expires")}:{" "}
+                    {expired ? (
+                      <span className="inline-flex items-center gap-0.5 text-destructive">
+                        <X className="size-3" />
+                        {t("hosts.sharing.expired")}
+                      </span>
+                    ) : record.expiresAt ? (
+                      <span className="text-foreground/70">
+                        {new Date(record.expiresAt).toLocaleString()}
+                      </span>
+                    ) : (
+                      <span className="text-foreground/70">
+                        {t("hosts.sharing.never")}
+                      </span>
+                    )}
+                  </span>
+                </div>
+              </div>
+            );
+          })}
+        </div>
+      </div>
     </div>
   );
 }

src/ui/sidebar/SessionLogsPanel.tsx

@@ -117,7 +117,7 @@ function LogRow({
         <span className="text-[10px] text-muted-foreground/60 truncate">
           {formatDate(log.startedAt)}
           {" · "}
-          {log.protocol.toUpperCase()}
+          {(log.protocol ?? "ssh").toUpperCase()}
           {log.username ? ` · ${log.username}` : ""}
           {" · "}
           {formatDuration(log.duration)}

src/ui/sidebar/SidebarTree.tsx

@@ -36,6 +36,7 @@ import {
   Share2,
   Terminal,
   Trash2,
+  Users,
   Zap,
 } from "lucide-react";
 import {
@@ -64,6 +65,11 @@ import type { SSHHostData } from "@/types/index";
 import { FolderIconEl } from "@/components/folder-style";
 import { resolveHostTabType } from "@/lib/host-connection-tabs";
 import { copyToClipboard } from "@/lib/clipboard";
+import {
+  canDeleteHost,
+  canEditHost,
+  canShareHost,
+} from "@/sidebar/host-permissions";
 import { FolderMetadataDialog } from "./FolderMetadataDialog";
 import {
   useStatusColorScheme,
@@ -266,8 +272,8 @@ function folderHostCount(folder: HostFolder): {
 export function HostItem({
   host,
   onOpenTab,
-  onEditHost,
-  onShareHost,
+  onEditHost: onEditHostProp,
+  onShareHost: onShareHostProp,
   onProxmoxDiscover,
   onDelete,
   onDuplicate,
@@ -306,6 +312,10 @@ export function HostItem({
   depth?: number;
 }) {
   const { t } = useTranslation();
+  // Shared hosts expose actions matching the recipient's permission level.
+  const onEditHost = canEditHost(host) ? onEditHostProp : undefined;
+  const onShareHost = canShareHost(host) ? onShareHostProp : undefined;
+  const allowDelete = canDeleteHost(host);
   const metricsEnabled =
     host.enableSsh && host.statsConfig?.metricsEnabled !== false;
   const [trayOnClick, setTrayOnClick] = useState(
@@ -328,8 +338,8 @@ export function HostItem({
   const isTouchOnly =
     typeof window !== "undefined" && window.matchMedia("(hover: none)").matches;
   const shouldUseClickTray = trayOnClick || isTouchOnly;
-  const showPasswordCopy = canCopyHostPassword(host);
-  const showSudoPasswordCopy = canCopyHostSudoPassword(host);
+  const showPasswordCopy = !host.isShared && canCopyHostPassword(host);
+  const showSudoPasswordCopy = !host.isShared && canCopyHostSudoPassword(host);
 
   async function handleCopyPassword(
     e: MouseEvent,
@@ -465,6 +475,26 @@ export function HostItem({
             <span className="text-[13px] font-medium truncate text-foreground leading-none">
               {host.name}
             </span>
+            {host.isShared && (
+              <TooltipProvider delayDuration={300}>
+                <Tooltip>
+                  <TooltipTrigger asChild>
+                    <span className="flex items-center gap-0.5 text-[9px] px-1 py-px border border-accent-brand/30 bg-accent-brand/10 text-accent-brand shrink-0 leading-none uppercase tracking-wider">
+                      <Users className="size-2.5" />
+                      {t("hosts.sharing.sharedBadge")}
+                    </span>
+                  </TooltipTrigger>
+                  <TooltipContent side="right">
+                    {t("hosts.sharing.sharedBadgeTooltip", {
+                      owner: host.ownerUsername || "?",
+                      level: t(
+                        `hosts.sharing.levels.${host.permissionLevel ?? "connect"}.label`,
+                      ),
+                    })}
+                  </TooltipContent>
+                </Tooltip>
+              </TooltipProvider>
+            )}
             {!selectionMode && shouldUseClickTray && (
               <button
                 title={
@@ -666,27 +696,31 @@ export function HostItem({
                         {t("nav.copySudoPassword")}
                       </DropdownMenuItem>
                     )}
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem
-                      onClick={(e) => {
-                        e.stopPropagation();
-                        onDuplicate();
-                      }}
-                    >
-                      <CopyPlus className="size-3.5 mr-2" />
-                      {t("hosts.cloneHostAction")}
-                    </DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem
-                      className="text-destructive focus:text-destructive"
-                      onClick={(e) => {
-                        e.stopPropagation();
-                        onDelete();
-                      }}
-                    >
-                      <Trash2 className="size-3.5 mr-2" />
-                      {t("common.delete")}
-                    </DropdownMenuItem>
+                    {allowDelete && (
+                      <>
+                        <DropdownMenuSeparator />
+                        <DropdownMenuItem
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            onDuplicate();
+                          }}
+                        >
+                          <CopyPlus className="size-3.5 mr-2" />
+                          {t("hosts.cloneHostAction")}
+                        </DropdownMenuItem>
+                        <DropdownMenuSeparator />
+                        <DropdownMenuItem
+                          className="text-destructive focus:text-destructive"
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            onDelete();
+                          }}
+                        >
+                          <Trash2 className="size-3.5 mr-2" />
+                          {t("common.delete")}
+                        </DropdownMenuItem>
+                      </>
+                    )}
                   </DropdownMenuContent>
                 </DropdownMenu>
               </div>
@@ -862,27 +896,31 @@ export function HostItem({
                         {t("nav.copySudoPassword")}
                       </DropdownMenuItem>
                     )}
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem
-                      onClick={(e) => {
-                        e.stopPropagation();
-                        onDuplicate();
-                      }}
-                    >
-                      <CopyPlus className="size-3.5 mr-2" />
-                      {t("hosts.cloneHostAction")}
-                    </DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem
-                      className="text-destructive focus:text-destructive"
-                      onClick={(e) => {
-                        e.stopPropagation();
-                        onDelete();
-                      }}
-                    >
-                      <Trash2 className="size-3.5 mr-2" />
-                      {t("common.delete")}
-                    </DropdownMenuItem>
+                    {allowDelete && (
+                      <>
+                        <DropdownMenuSeparator />
+                        <DropdownMenuItem
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            onDuplicate();
+                          }}
+                        >
+                          <CopyPlus className="size-3.5 mr-2" />
+                          {t("hosts.cloneHostAction")}
+                        </DropdownMenuItem>
+                        <DropdownMenuSeparator />
+                        <DropdownMenuItem
+                          className="text-destructive focus:text-destructive"
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            onDelete();
+                          }}
+                        >
+                          <Trash2 className="size-3.5 mr-2" />
+                          {t("common.delete")}
+                        </DropdownMenuItem>
+                      </>
+                    )}
                   </DropdownMenuContent>
                 </DropdownMenu>
               </div>
@@ -974,6 +1012,26 @@ export function HostItem({
           {host.pin && (
             <Pin className="size-2.5 text-accent-brand/50 shrink-0" />
           )}
+          {host.isShared && (
+            <TooltipProvider delayDuration={300}>
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <span className="flex items-center gap-0.5 text-[9px] px-1 py-px border border-accent-brand/30 bg-accent-brand/10 text-accent-brand shrink-0 leading-none uppercase tracking-wider">
+                    <Users className="size-2.5" />
+                    {t("hosts.sharing.sharedBadge")}
+                  </span>
+                </TooltipTrigger>
+                <TooltipContent side="right">
+                  {t("hosts.sharing.sharedBadgeTooltip", {
+                    owner: host.ownerUsername || "?",
+                    level: t(
+                      `hosts.sharing.levels.${host.permissionLevel ?? "connect"}.label`,
+                    ),
+                  })}
+                </TooltipContent>
+              </Tooltip>
+            </TooltipProvider>
+          )}
           {!selectionMode && shouldUseClickTray && (
             <button
               title={
@@ -1445,27 +1503,31 @@ export function HostItem({
                       )}
                     </DropdownMenuSubContent>
                   </DropdownMenuSub>
-                  <DropdownMenuSeparator />
-                  <DropdownMenuItem
-                    onClick={(e) => {
-                      e.stopPropagation();
-                      onDuplicate();
-                    }}
-                  >
-                    <CopyPlus className="size-3.5 mr-2" />
-                    {t("hosts.cloneHostAction")}
-                  </DropdownMenuItem>
-                  <DropdownMenuSeparator />
-                  <DropdownMenuItem
-                    className="text-destructive focus:text-destructive"
-                    onClick={(e) => {
-                      e.stopPropagation();
-                      onDelete();
-                    }}
-                  >
-                    <Trash2 className="size-3.5 mr-2" />
-                    {t("common.delete")}
-                  </DropdownMenuItem>
+                  {allowDelete && (
+                    <>
+                      <DropdownMenuSeparator />
+                      <DropdownMenuItem
+                        onClick={(e) => {
+                          e.stopPropagation();
+                          onDuplicate();
+                        }}
+                      >
+                        <CopyPlus className="size-3.5 mr-2" />
+                        {t("hosts.cloneHostAction")}
+                      </DropdownMenuItem>
+                      <DropdownMenuSeparator />
+                      <DropdownMenuItem
+                        className="text-destructive focus:text-destructive"
+                        onClick={(e) => {
+                          e.stopPropagation();
+                          onDelete();
+                        }}
+                      >
+                        <Trash2 className="size-3.5 mr-2" />
+                        {t("common.delete")}
+                      </DropdownMenuItem>
+                    </>
+                  )}
                 </DropdownMenuContent>
               </DropdownMenu>
             </div>

src/ui/sidebar/host-permissions.ts

@@ -0,0 +1,28 @@
+import type { Host, SharePermissionLevel } from "@/types/ui-types";
+
+const LEVEL_RANK: Record<SharePermissionLevel, number> = {
+  connect: 1,
+  view: 2,
+  edit: 3,
+  manage: 4,
+};
+
+function sharedLevelRank(host: Host): number {
+  return LEVEL_RANK[host.permissionLevel ?? "connect"] ?? 1;
+}
+
+export function canViewHostConfig(host: Host): boolean {
+  return !host.isShared || sharedLevelRank(host) >= LEVEL_RANK.view;
+}
+
+export function canEditHost(host: Host): boolean {
+  return !host.isShared || sharedLevelRank(host) >= LEVEL_RANK.edit;
+}
+
+export function canShareHost(host: Host): boolean {
+  return !host.isShared || sharedLevelRank(host) >= LEVEL_RANK.manage;
+}
+
+export function canDeleteHost(host: Host): boolean {
+  return !host.isShared;
+}