Add folder/direct-device/strategy assignment from User Management, clearer Pro vs Remote Operator labeling, optional restricted device scope mode, and Go/Node scope parity.
RustDesk 1.4.x filters Available Devices locally by exact
device_group_name match; only folder names were set before, so manual
panel groups appeared in the sidebar but showed zero peers. Also align
the TOTP login challenge with RustDesk 1.4.7 (email_check/tfa_check).
Register missing Go client-compat endpoints (server-key, software, user
groups, strategies, audit, peer-key), enforce audit.view on audit GET
routes, and align admin checks with global_admin.
The pro (API-only) role now has zero device permissions: no inventory,
folder/group sidebar, peer keys, or server-side AB enrichment — it is
intended solely for RustDesk PRO activation in the desktop client.
Refs #138
Panel device groups, folders, ACL and assignments moved from auth.db into
the consolidated Postgres schema. Go now uses PanelSyncStore on PostgresDB
when -db is postgres://, with auth.db kept only as a SQLite fallback.
Auto-detect /opt/BetterDeskConsole/data/auth.db when AUTH_DB_PATH is unset
(Postgres deployments). Merge server tags into GET /api/ab for the legacy
Tagi sidebar. Return lightweight payloads on /api/device-group/accessible.
Split peer list building from device groups so /api/group only returns
panel groups and folders from auth.db, while /api/ab/tags and peer tags
stay on their own channels. Apply the same group scope and allowed_users
filters as the Node client API, including folder peer lists.
Node requireAuth only accepts 64-char auth.db tokens, so local /api/group
handlers returned 401 after Go JWT login. Proxy group routes to Go again,
always merge peer-tag groups, resolve auth.db path candidates, and map
console user ids for group ACL checks.
Panel groups and folders live in console auth.db, but Go /api/group only
exposed peer tags. Read auth.db (AUTH_DB_PATH), apply allowed_users and
user-group access, and mirror Node getRustDeskDeviceGroups. Keep /api/group
on the Node :21121 proxy for compatibility; document verification steps.
UNITRONIX