feat: let a request approved in a plugin run by permissions

README.md

@@ -82,6 +82,7 @@ Plugins add everything else. The official ones ship with Termix, and admins can
 | [LDAP](https://github.com/Termix-SSH/Plugin-LDAP)                           | Sign in with your LDAP or Active Directory username and password.                                                               |
 | [Login Security](https://github.com/Termix-SSH/Plugin-Login-Security)       | Sign people out when idle, limit session length, turn off remember me and require a second factor at login.                     |
 | [Network Topology](https://github.com/Termix-SSH/Plugin-Network-Topology)   | Draws your hosts and the links between them as a live, interactive graph.                                                       |
+| [Operations Center](https://github.com/Termix-SSH/Plugin-Operations-Center) | Run, roll out, approve and track every plugin action across your hosts, with a page per host and tables across all of them.     |
 | [OPKSSH](https://github.com/Termix-SSH/Plugin-OPKSSH)                       | Connect to hosts with short-lived OpenPubkey SSH certificates after signing in with your identity provider.                     |
 | [Passkeys](https://github.com/Termix-SSH/Plugin-WebAuthn)                   | Sign in with a passkey or security key instead of a password.                                                                   |
 | [Proxmox](https://github.com/Termix-SSH/Plugin-Proxmox)                     | Import Proxmox VE guests as hosts, keep them in sync and watch node stats.                                                      |

src/backend/operations/approvals.ts

@@ -69,7 +69,8 @@ export function clearApprovalPolicies(): void {
 }
 
 const RANK = { allow: 0, approve: 1, deny: 2 } as const;
-const TRUSTED_VIA = new Set(["automation", "rollout", "fleet"]);
+// approved: a person approved this exact request in the plugin's own UI.
+const TRUSTED_VIA = new Set(["automation", "rollout", "fleet", "approved"]);
 const SELF_APPROVE_VIA = new Set(["assistant", "mcp", "automation"]);
 
 /** A person is the check when the request came from something else. */

src/backend/tests/operations/gate.test.ts

@@ -451,6 +451,15 @@ describe("policy", () => {
     expect(outcome.status).toBe("success");
   });
 
+  it("lets a request a person approved in a plugin go by RBAC", async () => {
+    register();
+    const outcome = await runOperation({
+      ...base,
+      origin: { kind: "plugin", pluginId: "x", via: "approved" },
+    });
+    expect(outcome.status).toBe("success");
+  });
+
   it("treats a community read as a change", async () => {
     state.plugin.source = "user";
     state.plugin.signedTier = "community";

src/types/host-sidebar-preferences.ts

@@ -34,7 +34,7 @@ export type HostTrayTrigger = "always" | "hover" | "click" | "actionsOnly";
 
 /** What clicking a host does when it already has an open tab. */
 export type HostClickBehavior =
-  "newTab" | "focusExisting" | "focusExistingDoubleClickNew";
+  "newTab" | "focusExisting" | "focusExistingDoubleClickNew" | "hostPage";
 
 export interface HostSidebarFilterState {
   status: ("online" | "offline" | "pinned")[];
@@ -136,6 +136,7 @@ const HOST_CLICK_BEHAVIORS: HostClickBehavior[] = [
   "newTab",
   "focusExisting",
   "focusExistingDoubleClickNew",
+  "hostPage",
 ];
 const STATUS_COLOR_SCHEMES: StatusColorScheme[] = ["accent", "status"];
 const FILTER_STATUS: HostSidebarFilterState["status"] = [

src/ui/locales/en.json

@@ -609,6 +609,7 @@
     "hostClickBehavior": "Clicking a host",
     "hostClickBehaviorDesc": "What happens when you click a host that already has an open tab. Ctrl/Cmd click, middle click, or \"Open in new tab\" always start a new one.",
     "hostClickNewTab": "Always open a new tab",
+    "hostClickHostPage": "Open the host page, when a plugin offers one",
     "hostClickFocusExisting": "Switch to the open tab",
     "hostClickFocusExistingDoubleNew": "Click to switch, double click for a new tab",
     "openInNewTab": "Open in new tab",