feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

* feat(config): put the operator-owned surfaces behind TREK_MANAGED The switch landed last release with nothing behind it. This is what it turns off, plus the four fixes that came out of walking every one of these surfaces. Nothing here changes anything for an install that does not set the flag. That is not a hope, it is what managed-inert.test.ts asserts: the mode stays off for any unparseable value, no other variable can turn it on, every settings key stays writable, and splitManagedKeys hands back the same object rather than a copy so no write path can quietly diverge on self-hosted installs only. WHAT THE MODE WITHHOLDS Fourteen routes carry @ManagedForbidden: key validation, static MCP tokens, JWT rotation, the OIDC admin pair, restore and auto-backup, plugin sideload and reload, the Ollama model list and pull, and the SMTP test send. Each names the reason it is not the instance admin's, and the reason is mandatory. Eighteen settings keys are filtered instead of refused. SMTP, the OIDC toggles and the WebAuthn pair share one handler with keys the admin does own, and the llm_* family is reachable through per-user settings, the instance defaults and the addon config alike, so a route-level refusal would be both too coarse and incomplete. A locked key is skipped and reported as managed_keys; the rest of the save goes through. Refusing the request would take the registration toggles down with the SMTP block. GET /api/auth/me/settings stops returning the three API keys in the clear. It is the only endpoint that decrypts a stored credential back to the caller, which is fine when the admin pasted it in and wrong when the operator supplied it. Two multipart routes check in the handler rather than the guard: a guard throws before the parser drains the body and the client gets an ECONNRESET instead of the 403 (PROFILE-015). They still carry the marker so the boot gate sees them. WHAT KEEPS IT FROM DRIFTING validate-managed-routes.ts refuses to boot on a marking that is not on the reviewed list, a list entry whose route lost its marking, or a marking with no reason. The third case has no equivalent in the guard gate next door and is the one that matters most: a blank reason destroys the only record of why a control was taken away, and nothing recovers that later. It found two wrong entries in my own list while I was writing this. managed-keys.test.ts asserts that every key in ADMIN_SETTINGS_KEYS and DEFAULTABLE_USER_SETTING_KEYS belongs to exactly one of two sets. A key added to either list belongs to neither until somebody decides, and that is the failure this prevents: the lists grow, the mode does not. PLACES_API_BASE AND PLACES_API_KEY The nine Places endpoints spell out googleapis.com, so an install that wants those calls to leave through something of its own has no way to say so. One variable, substituted where every call already funnels through. A second one supplies the key, and when it is set the users table is not consulted at all — a per-user key would route around whatever the endpoint counts, and those columns are readable by any admin of the instance. FOUR FIXES THAT ARE NOT ABOUT THE MODE An admin setting somebody's password now bumps password_version and clears their MCP tokens. An admin sets a password for one reason, and until now verifyJwtAndLoadUser kept accepting every cookie the intruder already had: the one action taken to lock them out was the one action that did not. The four OIDC provider calls go through the SSRF guard. Three are worse than they look — the token, userinfo and JWKS URLs come out of the discovery response, so they are chosen by the other end, not by an admin. safeFetchLlm is renamed safeFetchAdminConfigured and keeps its old name as an alias, because it is the variant that allows loopback and LAN: a self-hoster with Authentik on localhost:9000 must keep working. The token exchange follows no redirect at all, since one would hand client_secret to a second host. DELETE /api/admin/users/:id/mfa clears another account's TOTP. The passkey half has existed since passkeys landed; the TOTP half never did, which left "somebody on the trip lost their phone" with no answer short of an operator in the database. Never for the caller themselves. TREK_PLUGIN_PERMISSIONS=off refuses to boot when the install is centrally administered. A warning is right for a machine its owner chose to trust; where the person who set the flag and the people whose data is in the database are not the same person, fail closed. TEXTS Four strings lose the phrase "self-hosted" because they describe somebody else's software — an Ollama endpoint, an AirTrail instance, a service a plugin talks to — and read better without it in both modes. The one string that describes TREK itself keeps it, and the mode picks a second key instead, so self-hosters lose nothing. A grep gate in shared/ keeps the canonical locale honest, because the parity check compares the file set and the top-level keys and never looks at a value: re-wording a string is invisible to CI today, and so is putting it back. * feat(maps): supply the map credential with the instance when centrally administered MAPBOX_ACCESS_TOKEN joins PLACES_API_KEY as an operator-supplied value. SettingsService injects it when the settings are read, and picks GL as the provider if the reader is still on Leaflet, since a token is always present. The key moves from the customer set to the locked set. It is the one locked key whose value is public by design — a pk.* token has to reach the browser to be useful — so this is not about secrecy: a per-user save landing on top of the instance token would only break the map for that user. Both settings fields for it go away with it. * fix(auth): count the operator key when reporting whether Google features work has_maps_key only looked at the users table, but getMapsKey prefers the PLACES_API_KEY env over anything stored there. On an install that supplies the key that way and has an empty column, every lookup worked while the client was told there was no key and hid the search, the autocomplete and the place photos. Found by walking the running instance rather than the code: the map came up, the search box did not. * feat(admin): hide the settings a centrally administered install cannot act on A control that answers 403 is worse than no control: the AI section rendered the refusal as "Request failed with status code 403", which tells an admin they broke something rather than that the decision is not theirs. So the surfaces go rather than being disabled in place: - AI parsing and AirTrail leave the addon list, and the AI addon route now refuses outright. The endpoint, the model and what a document costs come with the instance, so there is no instance decision left — not even whether it runs. - Immich and Synology Photos leave it too. Both connect to a server the reader runs at home, and there is no route from here to one. - The SMTP block, the admin webhook and ntfy targets, and the passkey RP ID and origins follow the same rule: they configure something the operator owns, and a wrong RP ID on a shared parent domain reaches past this instance entirely. - The About tab goes. It is about the project — what TREK is, where to file a bug, where to support it — and is aimed at the person running the software. The version and the link to the source move to the sidebar footer, on both the desktop page and the mobile twin, because AGPL 13 wants that offer wherever people reach the software over a network. - The update check stops asking GitHub and reports nothing available. Separately, the version footers lose the "self-hosted" suffix everywhere, not just here. It read as a label on the software rather than on the install, and the version alone says what it needs to. * feat(config): refuse to boot centrally administered without an at-rest key Measured on a running instance rather than assumed: with ENCRYPTION_KEY unset, the at-rest key falls back to a file in the data volume, and backupService bundles that file into every archive it builds. The archive is downloadable by any instance admin, so the encryption ships with its own key in the same zip. The skip in backupService already handles this — it only omits the file when the key came from the env — but nothing made sure the env actually carried one. Provisioning sets it; forgetting it was silent. validateEnvAtBoot now carries a second kind of check next to the schema: cross- field rules that only apply with the flag set, for combinations where every value is individually valid and the result is wrong. Empty without the flag, so an install that never asked to be centrally administered cannot meet it. * feat(client): add an attachment point for install-specific screens Two empty exports on the client, an empty module on the server, and the four places that read them. Nothing here adds a route, a nav entry or an endpoint — the arrays are empty and the module contributes nothing, which managed-ext.test pins so it stays that way. Read unconditionally, never behind a flag. On the server a conditional import would tie the module graph to an environment variable, and the graph is built once per app while the flag is read live; on the client an empty array costs nothing to spread, so every build walks the same path instead of one build walking a path nobody tests. Anything attached here follows the same rules as the rest of src/nest and src/components: a real module with a controller and a provider, bodies through the Zod pipe, routes under the global guards, tests. * test(shared): move the wording gate out of src so shared typechecks again CI installs shared with its own dependencies only (npm ci --workspace shared), so there is no @types/node and the `node:fs` import inside src/ failed to compile. The tests passed the whole time — vitest supplies the module — which is why this only showed up in the typecheck step. The walk moves to scripts/, next to i18n-parity.mjs, and the spec imports it the same way that one does. It also runs on its own now (`node scripts/i18n-selfhost-wording.mjs`), which is what you want when CI names a line you have to go find. * test(server): repair the call sites typecheck:tests caught tests/ sits outside the build tsconfig, so none of this showed up in a green test run — which is exactly the gap `npm run typecheck:tests` exists to close. Three kinds, all mine: - Seven `import type` paths for RuntimeEnvService carried one `../` too many. Type-only imports are erased, so vitest never resolved them and nothing failed. - VersionCheckJob and PluginsController grew a constructor parameter and eleven hand-wired `new` calls kept passing the old count. The argument arrived as undefined and no assertion happened to read it. - ConditionContext grew `managed`, and the shared context object in the conditions suite did not. The condition also had no test of its own, so it has one now: both directions, since the registry uses `is: false` to keep a notice away and a notice that only belongs on a centrally administered install would use `is: true`.
2026-10-23 15:36:33 +00:00 · 2026-08-15 16:42:27 +02:00
parent bfb3bcd63c
commit 3a0604b3f5
108 changed files with 1926 additions and 111 deletions
@@ -28,6 +28,7 @@ import OfflineBanner from './components/Layout/OfflineBanner'
 import { SystemNoticeHost } from './components/SystemNotices/SystemNoticeHost.js'
 // Notice action registrations (side-effect imports):
 import './pages/Trips/noticeActions.js'
+import { managedRoutes } from './managed'

 // Every page below loads on demand. The entry chunk used to carry all twenty of
 // them eagerly, so opening /dashboard also paid for the planner, the journal, the
@@ -472,6 +473,15 @@ export default function App() {
              </ProtectedRoute>
            }
          />
+          {/* Empty in this repository, and read unconditionally so the public
+              build walks the same path as any other. See client/src/managed. */}
+          {managedRoutes.map(r => (
+            <Route
+              key={r.path}
+              path={r.path}
+              element={<ProtectedRoute>{r.element}</ProtectedRoute>}
+            />
+          ))}
          <Route
            path="/vacay"
            element={
@@ -18,6 +18,7 @@ import {
  styleSettingKey,
  type GlMapProvider,
 } from '../Map/glProviders'
+import { useAuthStore } from '../../store/authStore'

 const MAP_PRESETS = [
  { name: 'OpenStreetMap', url: 'https://tile.openstreetmap.org/{z}/{x}/{y}.png' },
@@ -108,6 +109,7 @@ export default function DefaultUserSettingsTab(): React.ReactElement {
  const [defaults, setDefaults] = useState<Defaults>({})
  const [loaded, setLoaded] = useState(false)
  const [mapTileUrl, setMapTileUrl] = useState('')
+  const managed = useAuthStore((s) => s.managed)
  const [mapboxToken, setMapboxToken] = useState('')
  const [mapboxStyle, setMapboxStyle] = useState('')

@@ -379,7 +381,9 @@ export default function DefaultUserSettingsTab(): React.ReactElement {

        {mapProvider !== 'leaflet' && (
          <div style={{ marginTop: 16, display: 'flex', flexDirection: 'column', gap: 18 }}>
-            {mapProvider === 'mapbox-gl' && (
+            {/* The token comes with the instance on a managed install, injected when the
+              settings are read. A field here would only let somebody save a worse one. */}
+            {mapProvider === 'mapbox-gl' && !managed && (
            <div>
              <label className="block text-sm font-medium mb-1.5 text-content-secondary">
                {t('admin.defaultSettings.mapboxToken')}
@@ -6,6 +6,7 @@ import { useTranslation } from '../../i18n'
 import { LayoutGrid, CalendarDays, Globe, Compass, Bookmark, Plus } from 'lucide-react'
 import type { LucideIcon } from 'lucide-react'
 import { resolvePluginIcon } from '../shared/PluginIcon'
+import { managedNavItems } from '../../managed'

 const ADDON_NAV: Record<string, { icon: LucideIcon; labelKey: string }> = {
  vacay:       { icon: CalendarDays, labelKey: 'admin.addons.catalog.vacay.name' },
@@ -67,6 +68,8 @@ export default function BottomNav() {
      return nav ? [{ to: `/${addon.id}`, label: t(nav.labelKey), icon: nav.icon }] : []
    }),
    ...pagePlugins.map(p => ({ to: `/plugins/${p.id}`, label: p.name, icon: resolvePluginIcon(p.icon) })),
+    // Empty in this repository — see client/src/managed.
+    ...managedNavItems.map(m => ({ to: m.path, label: m.label, icon: m.Icon })),
  ]
  // Split the items so the raised "+" sits dead centre.
  const splitAt = Math.ceil(items.length / 2)
@@ -10,6 +10,7 @@ import { Plane, LogOut, Settings, ChevronDown, Shield, ArrowLeft, Users, Moon, S
 import type { LucideIcon } from 'lucide-react'
 import InAppNotificationBell from './InAppNotificationBell.tsx'
 import { resolvePluginIcon } from '../shared/PluginIcon'
+import { managedNavItems } from '../../managed'

 const ADDON_ICONS: Record<string, LucideIcon> = { CalendarDays, Briefcase, Globe, Compass, Bookmark }

@@ -151,7 +152,9 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
        >
          {[{ id: '__trips', path: '/dashboard', label: t('nav.myTrips'), Icon: Briefcase },
            ...globalAddons.map(a => ({ id: a.id, path: `/${a.id}`, label: getAddonName(a), Icon: ADDON_ICONS[a.icon] || CalendarDays })),
-            ...pagePlugins.map(p => ({ id: `plugin:${p.id}`, path: `/plugins/${p.id}`, label: p.name, Icon: resolvePluginIcon(p.icon) }))
+            ...pagePlugins.map(p => ({ id: `plugin:${p.id}`, path: `/plugins/${p.id}`, label: p.name, Icon: resolvePluginIcon(p.icon) })),
+            // Empty in this repository — see client/src/managed.
+            ...managedNavItems.map(m => ({ id: `managed:${m.id}`, path: m.path, label: m.label, Icon: m.Icon }))
          ].map(tab => {
            const isActive = location.pathname === tab.path
            return (
@@ -2,6 +2,7 @@ import { BookOpen, Bug, Coffee, ExternalLink, Heart, Info, Lightbulb } from 'luc
 import React from 'react';
 import { useTranslation } from '../../i18n';
 import Section from './Section';
+import { useAuthStore } from '../../store/authStore';

 interface Props {
  appVersion: string;
@@ -9,6 +10,7 @@ interface Props {

 export default function AboutTab({ appVersion }: Props): React.ReactElement {
  const { t, locale } = useTranslation();
+  const managed = useAuthStore((s) => s.managed);

  return (
    <Section title={t('settings.about')} icon={Info}>
@@ -22,7 +24,11 @@ export default function AboutTab({ appVersion }: Props): React.ReactElement {
        className="text-content-secondary"
        style={{ fontSize: 'calc(13px * var(--fs-scale-body, 1))', lineHeight: 1.6, marginBottom: 6, marginTop: -4 }}
      >
-        {t('settings.about.description')}
+        {/* The stock line calls TREK self-hosted and points at 'your own server'.
+            Both are true for the reader who set it up and neither is for a customer
+            of a hosted instance, so the mode picks the sentence rather than the
+            wording being watered down for everybody. */}
+        {t(managed ? 'settings.about.descriptionManaged' : 'settings.about.description')}
      </p>
      <p
        className="text-content-faint"
@@ -52,6 +58,14 @@ export default function AboutTab({ appVersion }: Props): React.ReactElement {
        </span>
      </p>

+      {/* Ko-fi, Buy Me a Coffee, Discord, and the issue/discussion links assume
+          the reader runs this install and can act on it. On a centrally
+          administered one they support somebody they are not the customer of,
+          and file bugs against an instance they do not operate. The version and
+          the source link below stay in both modes: AGPL §13 wants the source
+          offered prominently to the people using it over a network, and that is
+          not the part being trimmed here. */}
+      {!managed && (<>
      <div className="grid grid-cols-1 gap-3 sm:grid-cols-3">
        <a
          href="https://ko-fi.com/mauriceboe"
@@ -263,6 +277,26 @@ export default function AboutTab({ appVersion }: Props): React.ReactElement {
          <ExternalLink size={14} className="ml-auto flex-shrink-0 text-content-faint" />
        </a>
      </div>
+      </>)}
+
+      {/* What replaces the grids above. AGPL §13 asks for the source to be
+          offered prominently to whoever uses the software over a network, and a
+          customer of a hosted instance is exactly that reader. The support and
+          bug-report links go; this does not. */}
+      {managed && (
+        <a
+          href="https://github.com/liketrek/TREK"
+          target="_blank"
+          rel="noopener noreferrer"
+          className="flex items-center gap-4 overflow-hidden rounded-xl border border-edge bg-surface-card px-5 py-4 no-underline"
+        >
+          <div>
+            <div className="text-sm font-semibold text-content">{t('settings.about.sourceTitle')}</div>
+            <div className="text-xs text-content-faint">{t('settings.about.sourceHint')}</div>
+          </div>
+          <ExternalLink size={14} className="ml-auto flex-shrink-0 text-content-faint" />
+        </a>
+      )}
    </Section>
  );
 }
@@ -10,6 +10,7 @@ import AirTrailConnectionSection from './AirTrailConnectionSection'
 import LlmConnectionSection from './LlmConnectionSection'
 import { ALL_SCOPES } from '../../api/oauthScopes'
 import ScopeGroupPicker from '../OAuth/ScopeGroupPicker'
+import { useAuthStore } from '../../store/authStore'

 interface OAuthPreset {
  id: string
@@ -96,11 +97,18 @@ interface McpToken {

 export default function IntegrationsTab(): React.ReactElement {
  const S = useIntegrations()
+  const managed = useAuthStore((s) => s.managed)
  return (
    <>
-      <PhotoProvidersSection />
-      {S.airtrailEnabled && <AirTrailConnectionSection />}
-      {S.llmEnabled && <LlmConnectionSection />}
+      {/* Immich, Synology Photos and AirTrail all connect to a server the reader
+          runs themselves. On a managed install there is none, and every one of
+          these would ask for an address that cannot be reached from here. */}
+      {!managed && <PhotoProvidersSection />}
+      {S.airtrailEnabled && !managed && <AirTrailConnectionSection />}
+      {/* Which model reads a booking, and what that costs, comes with the instance on
+       a managed install. The per-user fallback exists for people who supply their
+       own key, and there nobody does. */}
+      {S.llmEnabled && !managed && <LlmConnectionSection />}
      {S.mcpEnabled && <IntegrationsMcpSection {...S} />}
      <McpTokenModals {...S} />
      <OAuthClientModals {...S} />
@@ -66,7 +66,7 @@ describe('LlmConnectionSection', () => {
    // The endpoint is instance configuration since #1772, so it has no field here.
    expect(screen.queryByPlaceholderText('http://localhost:11434')).not.toBeInTheDocument();
    expect(
-      screen.getByText('A self-hosted (Ollama) endpoint is set up once for the whole instance in the admin settings. You can still use your own OpenAI or Anthropic key here.'),
+      screen.getByText('A local (Ollama) endpoint is set up once for the whole instance in the admin settings. You can still use your own OpenAI or Anthropic key here.'),
    ).toBeInTheDocument();
  });

@@ -20,6 +20,7 @@ import {
  normalizeStyleForProvider,
  type GlMapProvider,
 } from '../Map/glProviders'
+import { useAuthStore } from '../../store/authStore'

 interface MapPreset {
  name: string
@@ -161,6 +162,7 @@ export default function MapSettingsTab(): React.ReactElement {
  const [saving, setSaving] = useState(false)
  const [provider, setProvider] = useState<Provider>(initialProvider)
  const [mapTileUrl, setMapTileUrl] = useState<string>(settings.map_tile_url || '')
+  const managed = useAuthStore((s) => s.managed)
  const [mapboxToken, setMapboxToken] = useState<string>(settings.mapbox_access_token || '')
  const [mapboxStyle, setMapboxStyle] = useState<string>(styleForProvider(initialProvider, slotStyle(initialProvider, settings)))
  const [mapbox3d, setMapbox3d] = useState<boolean>(settings.mapbox_3d_enabled !== false)
@@ -322,7 +324,9 @@ export default function MapSettingsTab(): React.ReactElement {
      {/* GL settings */}
      {provider !== 'leaflet' && (
        <div className="space-y-3">
-          {provider === 'mapbox-gl' && (
+          {/* The token comes with the instance on a managed install, injected when the
+              settings are read. A field here would only let somebody save a worse one. */}
+          {provider === 'mapbox-gl' && !managed && (
          <div>
            <label className="block text-sm font-medium text-slate-700 mb-1.5">{t('settings.mapMapboxToken')}</label>
            <input
@@ -0,0 +1,47 @@
+import type { ReactElement } from 'react'
+import type { LucideIcon } from 'lucide-react'
+
+/**
+ * The attachment point for surfaces that only exist on a centrally administered
+ * install.
+ *
+ * Empty here, and empty in every build of this repository. An installation whose
+ * operator ships additional screens replaces this file at build time; nothing
+ * else in the client changes, because everything below reads from these two
+ * exports rather than naming a screen directly.
+ *
+ * Why it is a file and not a plugin: what belongs here is not a third-party
+ * extension living behind a sandbox boundary. It is part of the product for the
+ * people who get that product operated for them, and it needs the same
+ * components, the same tokens and the same overlays as everything around it. A
+ * frame cannot open a dialog past its own edge.
+ *
+ * Two rules keep this honest:
+ *  - Never import from here conditionally at a call site. The arrays are always
+ *    read, and they are simply empty, so the public build takes exactly the same
+ *    code path as any other.
+ *  - Nothing here may be required for TREK to work. Everything below is
+ *    additive: routes that are not registered, nav entries that are not shown.
+ */
+
+export interface ManagedRoute {
+  /** Router path, e.g. `/subscription`. Must not collide with an existing one. */
+  path: string
+  /** Rendered inside the app's ProtectedRoute wrapper, like every other screen. */
+  element: ReactElement
+}
+
+export interface ManagedNavItem {
+  /** Stable id for React keys; prefixed by the consumer, so keep it bare. */
+  id: string
+  path: string
+  label: string
+  /** lucide-react, like every other icon in the app — see the theme README. */
+  Icon: LucideIcon
+}
+
+/** Extra protected routes. Spread into the router next to the built-in ones. */
+export const managedRoutes: ManagedRoute[] = []
+
+/** Extra entries for the desktop navbar and the mobile tab bar. */
+export const managedNavItems: ManagedNavItem[] = []
@@ -68,7 +68,7 @@ export default function MAdmin() {
  const { t, locale } = useTranslation()
  const admin = useAdmin()
  const {
-    demoMode, mcpEnabled, devMode, toast, navigate,
+    demoMode, mcpEnabled, devMode, managed, toast, navigate,
    activeTab, setActiveTab, stats, serverTimezone,
    bagTrackingEnabled, setBagTrackingEnabled,
    collabFeatures, setCollabFeatures,
@@ -88,8 +88,10 @@ export default function MAdmin() {
    { id: 'plugins', label: t('admin.tabs.plugins'), icon: Puzzle },
    { id: 'notifications', label: t('admin.tabs.notifications'), icon: Bell },
    ...(mcpEnabled ? [{ id: 'mcp-tokens', label: t('admin.tabs.mcpTokens'), icon: Plug }] : []),
-    { id: 'github', label: t('admin.tabs.github'), icon: Github },
-    { id: 'backup', label: t('admin.tabs.backup'), icon: Database },
+    // Same two the desktop list drops: releases and backup schedule belong to
+    // whoever operates the install.
+    ...(managed ? [] : [{ id: 'github', label: t('admin.tabs.github'), icon: Github }]),
+    ...(managed ? [] : [{ id: 'backup', label: t('admin.tabs.backup'), icon: Database }]),
    { id: 'audit', label: t('admin.tabs.audit'), icon: ScrollText },
    ...(devMode ? [{ id: 'dev-notifications', label: 'Dev: Notifications', icon: Bug }] : []),
  ]
@@ -17,6 +17,7 @@ import {
 import type { LucideIcon } from 'lucide-react'
 import { useTranslation } from '../../../i18n'
 import { useSettings } from '../../../pages/settings/useSettings'
+import { useAuthStore } from '../../../store/authStore'
 import { usePluginStore } from '../../../store/pluginStore'
 import MSettingsPlugins from './MSettingsPlugins'
 import MSettingsOffline from './MSettingsOffline'
@@ -44,6 +45,7 @@ export default function MSettings() {
  const { t } = useTranslation()
  const navigate = useNavigate()
  const { hasIntegrations, appVersion, activeTab, setActiveTab } = useSettings()
+  const managed = useAuthStore((s) => s.managed)
  const hasPlugins = usePluginStore((s) => s.plugins.length > 0)
  const [dropOpen, setDropOpen] = useState(false)

@@ -56,7 +58,12 @@ export default function MSettings() {
    ...(hasPlugins ? [{ id: 'plugins', label: t('settings.tabs.plugins'), icon: Puzzle }] : []),
    { id: 'offline', label: t('settings.tabs.offline'), icon: CloudOff },
    { id: 'account', label: t('settings.tabs.account'), icon: User },
-    ...(appVersion ? [{ id: 'about', label: t('settings.tabs.about'), icon: Info }] : []),
+    // Same call as the desktop page: About is about the project — what TREK is,
+    // where to file a bug, where to support it — and a customer of a hosted
+    // instance is the audience for none of it. The version and the source link
+    // move to the footer below, because AGPL §13 wants those offered wherever
+    // people reach the software over a network.
+    ...(appVersion && !managed ? [{ id: 'about', label: t('settings.tabs.about'), icon: Info }] : []),
  ]

  const active = tabs.find((tab) => tab.id === activeTab) || tabs[0]
@@ -117,6 +124,19 @@ export default function MSettings() {
      {active.id === 'offline' && <MSettingsOffline />}
      {active.id === 'account' && <MSettingsAccount />}
      {active.id === 'about' && appVersion && <MSettingsAbout appVersion={appVersion} />}
+
+      {managed && appVersion && (
+        <p className="mt-8 text-center text-caption text-m-muted">
+          <a
+            href="https://github.com/liketrek/TREK"
+            target="_blank"
+            rel="noopener noreferrer"
+            className="no-underline"
+          >
+            v{appVersion}
+          </a>
+        </p>
+      )}
    </div>
  )
 }
@@ -4,6 +4,7 @@ import MPhotoProvidersSection from './MPhotoProvidersSection'
 import MAirTrailConnectionSection from './MAirTrailConnectionSection'
 import MLlmConnectionSection from './MLlmConnectionSection'
 import MSettingsMcp from './MSettingsMcp'
+import { useAuthStore } from '../../../store/authStore'

 /**
 * "Integrations" section. The photo-provider / AirTrail / LLM connection forms
@@ -16,6 +17,7 @@ export default function MSettingsIntegrations() {
  const mcpEnabled = addonEnabled('mcp')
  const airtrailEnabled = addonEnabled('airtrail')
  const llmEnabled = addonEnabled('llm_parsing')
+  const managed = useAuthStore((s) => s.managed)

  useEffect(() => {
    loadAddons()
@@ -25,7 +27,10 @@ export default function MSettingsIntegrations() {
    <>
      <MPhotoProvidersSection />
      {airtrailEnabled && <MAirTrailConnectionSection />}
-      {llmEnabled && <MLlmConnectionSection />}
+      {/* Which model reads a booking, and what that costs, comes with the instance on
+       a managed install. The per-user fallback exists for people who supply their
+       own key, and there nobody does. */}
+      {llmEnabled && !managed && <MLlmConnectionSection />}
      {mcpEnabled && <MSettingsMcp />}
    </>
  )
@@ -34,7 +34,7 @@ function AdminPageDesktop(): React.ReactElement {
  // each tab/section renders from a dedicated sub-component.
  const admin = useAdmin()
  const {
-    demoMode, mcpEnabled, devMode, toast,
+    demoMode, mcpEnabled, devMode, managed, toast,
    activeTab, setActiveTab, stats,
    bagTrackingEnabled, setBagTrackingEnabled,
    collabFeatures, setCollabFeatures,
@@ -55,8 +55,11 @@ function AdminPageDesktop(): React.ReactElement {
    { id: 'plugins', label: t('admin.tabs.plugins'), icon: Blocks, group: gConfig },
    { id: 'notifications', label: t('admin.tabs.notifications'), icon: Bell, group: gIntegration },
    ...(mcpEnabled ? [{ id: 'mcp-tokens', label: t('admin.tabs.mcpTokens'), icon: KeyRound, group: gIntegration }] : []),
-    { id: 'github', label: t('admin.tabs.github'), icon: GitBranch, group: gIntegration },
-    { id: 'backup', label: t('admin.tabs.backup'), icon: Database, group: gMaintenance },
+    // Releases and update cadence belong to whoever operates the install.
+    ...(managed ? [] : [{ id: 'github', label: t('admin.tabs.github'), icon: GitBranch, group: gIntegration }]),
+    // Backups run off-volume on a managed install; the tab would offer a
+    // schedule that competes with the real one.
+    ...(managed ? [] : [{ id: 'backup', label: t('admin.tabs.backup'), icon: Database, group: gMaintenance }]),
    { id: 'audit', label: t('admin.tabs.audit'), icon: ScrollText, group: gMaintenance },
    ...(devMode ? [{ id: 'dev-notifications', label: 'Dev: Notifications', icon: Bug, group: gMaintenance }] : []),
  ]
@@ -123,7 +126,7 @@ function AdminPageDesktop(): React.ReactElement {
            tabs={TABS}
            activeTab={activeTab}
            onTabChange={setActiveTab}
-            footer="admin · self-hosted"
+            footer=""
          >
            {/* Tab content */}
          {activeTab === 'users' && (
@@ -570,7 +570,7 @@ export default function LoginPage(): React.ReactElement {
                    </div>
                  )}

-                  {insecureCookie && (
+                  {insecureCookie && !appConfig?.managed && (
                    <div
                      style={{
                        padding: '12px 14px',
@@ -24,7 +24,7 @@ export default function SettingsPage(): React.ReactElement {
 function SettingsPageDesktop(): React.ReactElement {
  const { t } = useTranslation()
  // Page = wiring container: addon/version loading + active-tab state in the hook.
-  const { hasIntegrations, appVersion, activeTab, setActiveTab } = useSettings()
+  const { hasIntegrations, appVersion, activeTab, setActiveTab, managed } = useSettings()
  const hasPlugins = usePluginStore(s => s.plugins.length > 0)

  const tabs: PageSidebarTab[] = [
@@ -40,7 +40,11 @@ function SettingsPageDesktop(): React.ReactElement {
      : []),
    { id: 'offline', label: t('settings.tabs.offline'), icon: CloudOff },
    { id: 'account', label: t('settings.tabs.account'), icon: User },
-    ...(appVersion
+    // About is where the project lives: what TREK is, where to report a bug,
+    // where to support it. A customer of a hosted instance is the audience for
+    // none of that, so the tab goes and the sidebar footer below carries the one
+    // thing that has to stay — the link to the source (AGPL §13).
+    ...(appVersion && !managed
      ? [{ id: 'about', label: t('settings.tabs.about'), icon: Info }]
      : []),
  ]
@@ -65,7 +69,22 @@ function SettingsPageDesktop(): React.ReactElement {
            tabs={tabs}
            activeTab={activeTab}
            onTabChange={setActiveTab}
-            footer={appVersion ? `v${appVersion} · self-hosted` : 'self-hosted'}
+            footer={
+              appVersion
+                ? managed
+                  // No About tab here, so this is the prominent source offer
+                  // AGPL §13 asks for when people use it over a network.
+                  ? <a
+                      href="https://github.com/liketrek/TREK"
+                      target="_blank"
+                      rel="noopener noreferrer"
+                      className="no-underline text-content-faint hover:text-content-secondary"
+                    >
+                      v{appVersion}
+                    </a>
+                  : `v${appVersion}`
+                : ''
+            }
          >
            {activeTab === 'display' && <DisplaySettingsTab />}
            {activeTab === 'appearance' && <AppearanceSettingsTab />}
@@ -14,7 +14,7 @@ interface AdminNotificationsTabProps {
 // trip reminders, admin webhook + ntfy targets, and the per-event preference matrix.
 // Derives channel state from smtpValues exactly as the original inline IIFE did.
 export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTabProps): React.ReactElement {
-  const { toast, smtpValues, setSmtpValues, smtpLoaded, setTripRemindersEnabled } = admin
+  const { toast, smtpValues, setSmtpValues, smtpLoaded, setTripRemindersEnabled, managed } = admin

  // Derive active channels from smtpValues.notification_channels (plural)
  // with fallback to notification_channel (singular) for existing installs
@@ -58,6 +58,10 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa

  return (<>
    <div className="space-y-4">
+      {/* The relay is the operator's: their host, their credential, their sending
+          reputation. An instance that could point it elsewhere would send under a
+          domain it does not own. */}
+      {!managed && (<>
      {/* Email Panel */}
      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
        <div className="px-6 py-4 border-b border-slate-100 flex items-center justify-between">
@@ -132,6 +136,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
        </div>
      </div>

+      </>)}
      {/* Webhook Panel */}
      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
        <div className="px-6 py-4 flex items-center justify-between">
@@ -211,6 +216,9 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
        </div>
      </div>

+      {/* Admin alerts are about running the instance (version notices, and what else
+          lands there later). On a managed install those go to whoever runs it. */}
+      {!managed && (<>
      {/* Admin Webhook Panel */}
      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
        <div className="px-6 py-4 border-b border-slate-100">
@@ -262,7 +270,8 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
        </div>
      </div>

-      {/* Admin Ntfy Panel */}
+      {/* Admin Ntfy Panel — same audience as the webhook above, and inside the
+          same wrapper. */}
      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
        <div className="px-6 py-4 border-b border-slate-100">
          <h2 className="font-semibold text-slate-900">{t('admin.notifications.adminNtfyPanel.title')}</h2>
@@ -361,6 +370,7 @@ export default function AdminNotificationsTab({ admin, t }: AdminNotificationsTa
          </button>
        </div>
      </div>
+      </>)}

    </div>
    <div className="mt-6">
@@ -29,6 +29,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
    webauthnRpId, setWebauthnRpId, webauthnOrigins, setWebauthnOrigins, savingWebauthn, handleSaveWebauthn,
    allowedFileTypes, setAllowedFileTypes, savingFileTypes, setSavingFileTypes,
    mapsKey, setMapsKey, unsplashKey, setUnsplashKey, showKeys, savingKeys, validating, validation,
+    managed,
    setShowRotateJwtModal,
    handleToggleAuthSetting, handleToggleRequireMfa,
    toggleKey, handleSaveApiKeys, handleValidateKey,
@@ -154,6 +155,13 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
            </p>
          )}

+          {/* The domain passkeys bind to and the origins that may present them
+              follow from the address the instance is served on, which the operator
+              owns. Getting either wrong invalidates every enrolled passkey, and on
+              a shared parent domain a wrong RP ID reaches past this instance
+              entirely — so they are pinned per container, not offered here. The
+              switch above stays: whether to offer passkeys at all is a house rule. */}
+          {!managed && (<>
          <div>
            <label className="block text-sm font-medium text-slate-700 mb-1">{t('admin.passkey.rpId')}</label>
            <p className="text-xs text-slate-400 mb-1.5">{t('admin.passkey.rpIdHint')}</p>
@@ -185,6 +193,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
            {savingWebauthn ? <Loader2 size={14} className="animate-spin" /> : <Save size={14} />}
            {t('common.save')}
          </button>
+          </>)}
        </div>
      </div>

@@ -246,6 +255,10 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
        </div>
      </div>

+      {/* Google and Unsplash come with the instance, and so does what a lookup costs;
+          the per-place toggles only ever traded away quota that is not the customer’s
+          to spend. Weather needs no key at all and has nothing to configure. */}
+      {!managed && (<>
      {/* API Keys */}
      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
        <div className="px-6 py-4 border-b border-slate-100">
@@ -253,6 +266,10 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
          <p className="text-xs text-slate-400 mt-1">{t('admin.apiKeysHint')}</p>
        </div>
        <div className="p-6 space-y-4">
+          {/* The two key fields, not the toggles below them: on a centrally
+              administered install the operator supplies the keys, while whether
+              photos and lookups are offered at all stays the admin’s call. */}
+          {!managed && (<>
          {/* Google Maps Key */}
          <div>
            <label className="flex items-center gap-2 text-sm font-medium text-slate-700 mb-1.5">
@@ -329,6 +346,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
            </div>
            <p className="text-xs text-slate-400 mt-1">{t('admin.unsplashKeyHint')}</p>
          </div>
+          </>)}

          {/* Place Photos Toggle */}
          <div className="flex items-center justify-between gap-4 py-3 border-t border-slate-100">
@@ -444,6 +462,11 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
        </div>
      </div>

+      {/* An issuer the instance names can assert any address as verified, and the
+          discovery calls leave from inside the operator’s network. Sign-on is theirs
+          to wire, so the fields are not offered. */}
+      {!managed && (<>
+      </>)}
      {/* OIDC / SSO Configuration */}
      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
        <div className="px-6 py-4 border-b border-slate-100">
@@ -524,6 +547,10 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
          </button>
        </div>
      </div>
+      {/* Rotating the secret signs every user out and fixes nothing an instance admin
+          can reach: the file it writes belongs to the host. */}
+      {!managed && (<>
+      </>)}
      {/* Danger Zone */}
      <div className="bg-white rounded-xl border border-red-200 overflow-hidden">
        <div className="px-6 py-4 border-b border-red-100 bg-red-50">
@@ -548,6 +575,7 @@ export default function AdminSettingsTab({ admin, t }: AdminSettingsTabProps): R
          </div>
        </div>
      </div>
+      </>)}
    </div>
  )
-}
+}
@@ -22,6 +22,7 @@ export function useAdmin() {
  const hour12 = useSettingsStore(s => s.settings.time_format) === '12h'
  const mcpEnabled = useAddonStore(s => s.isEnabled('mcp'))
  const devMode = useAuthStore(s => s.devMode)
+  const managed = useAuthStore(s => s.managed)

  const [activeTab, setActiveTab] = useState<string>('users')
  const [users, setUsers] = useState<AdminUser[]>([])
@@ -121,6 +122,9 @@ export function useAdmin() {
    loadAppConfig()
    loadApiKeys()
    adminApi.getOidc().then(setOidcConfig).catch(() => {})
+    // The operator decides when this instance upgrades, so there is nothing to
+    // check and nothing the admin could act on.
+    if (managed) return
    adminApi.checkVersion().then(data => {
      if (data.update_available) setUpdateInfo(data)
    }).catch(() => {})
@@ -361,7 +365,7 @@ export function useAdmin() {

  return {
    // store-derived
-    demoMode, serverTimezone, hour12, mcpEnabled, devMode, currentUser,
+    demoMode, serverTimezone, hour12, mcpEnabled, devMode, managed, currentUser,
    updateApiKeys, setAppRequireMfa, setTripRemindersEnabled,
    setPlacesPhotosEnabled, setPlacesAutocompleteEnabled, setPlacesDetailsEnabled, setPlacesEnrichEnabled, logout,
    navigate, toast,
@@ -2,6 +2,7 @@ import { useState, useEffect } from 'react'
 import { useSearchParams } from 'react-router'
 import { authApi } from '../../api/client'
 import { useAddonStore } from '../../store/addonStore'
+import { useAuthStore } from '../../store/authStore'

 /**
 * Settings page logic — loads addons + the app version, tracks the active tab
@@ -13,6 +14,7 @@ import { useAddonStore } from '../../store/addonStore'
 export function useSettings() {
  const [searchParams] = useSearchParams()
  const { isEnabled: addonEnabled, loadAddons } = useAddonStore()
+  const managed = useAuthStore(s => s.managed)

  const memoriesEnabled = addonEnabled('memories')
  const mcpEnabled = addonEnabled('mcp')
@@ -43,5 +45,5 @@ export function useSettings() {
    if (tab) setActiveTab(tab)
  }, [searchParams])

-  return { hasIntegrations, appVersion, activeTab, setActiveTab }
+  return { hasIntegrations, appVersion, activeTab, setActiveTab, managed }
 }