implement control protection.

internal/websocket/handler/session.go

@@ -37,6 +37,16 @@ func (h *MessageHandlerCtx) SessionConnected(session types.Session) error {
 		if err := h.systemAdmin(session); err != nil {
 			return err
 		}
+
+		// update settings in atomic way
+		h.sessions.UpdateSettingsFunc(func(settings *types.Settings) bool {
+			// if control protection & locked controls: unlock controls
+			if settings.LockedControls && settings.ControlProtection {
+				settings.LockedControls = false
+				return true // update settings
+			}
+			return false // do not update settings
+		})
 	}
 
 	return h.SessionStateChanged(session)
@@ -49,6 +59,27 @@ func (h *MessageHandlerCtx) SessionDisconnected(session types.Session) error {
 		h.sessions.ClearHost()
 	}
 
+	if session.Profile().IsAdmin {
+		hasAdmin := false
+		h.sessions.Range(func(s types.Session) bool {
+			if s.Profile().IsAdmin && s.ID() != session.ID() && s.State().IsConnected {
+				hasAdmin = true
+				return false
+			}
+			return true
+		})
+
+		// update settings in atomic way
+		h.sessions.UpdateSettingsFunc(func(settings *types.Settings) bool {
+			// if control protection & not locked controls & no admin: lock controls
+			if !settings.LockedControls && settings.ControlProtection && !hasAdmin {
+				settings.LockedControls = true
+				return true // update settings
+			}
+			return false // do not update settings
+		})
+	}
+
 	return h.SessionStateChanged(session)
 }