Security and Permissions

Security and Permissions (RBAC)

PCLink implements a robust Role-Based Access Control (RBAC) system that ensures connected devices only access the features they are authorized for.

Authentication Overview

All communication with the PCLink server is encrypted via HTTPS. Authentication is split into two layers:

1. Web Admin Session: Protected by a user-defined password. Grants full access to management endpoints (/ui/*).
2. Device API Tokens: Unique UUID tokens assigned to each mobile device upon pairing approval.

Permission Enforcement

Every request to a resource-sensitive endpoint is intercepted by the service_enforcement_middleware. This middleware checks:

• Global Service Status: Is the feature enabled globally in the Server Settings?
• Admin Bypass: Is the request coming from a valid Web UI session? (Bypasses granular checks).
• Device Capability: Does the device associated with the X-API-Key have the required permission node?

Permission Nodes

The following nodes define granular access to server features:

Node	Title	Description
files_browse	File Browser	Browse system files and view thumbnails
files_download	File Download	Download files from the host to the device
files_upload	File Upload	Upload files from the device to the host
files_delete	File Deletion	Delete files and folders on the host
processes	Processes	View and manage running system processes
power	Power Control	Shutdown, restart, or lock the host system
info	System Status	Monitor battery, hardware, and system stats
mouse	Remote Mouse	Control system cursor and mouse clicks
keyboard	Remote Type	Send keyboard inputs and shortcuts
media	Media Control	Control playback and view media info
terminal	Terminal Access	High Risk: Full interactive shell access
extensions	Extensions	Manage and run server-side extensions
apps	Applications	View and launch installed desktop apps
clipboard	Clipboard Sync	Read and write the system clipboard
screenshot	Screen Capture	Capture snapshots of the host display

Role Templates

To simplify management, the Web UI provides predefined templates for common use cases:

• Admin: Grants all available permissions.
• Viewer: files_browse, info, apps (Safe for basic monitoring).
• Media: media, volume, info, apps (Optimized for remote playback).
• Remote: mouse, keyboard, screenshot, info, volume (Desktop control).
• None: Revokes all access without deleting the device.

Device Revocation & Banning

• Revoke: Deletes the device's API token. The device must re-pair to connect again.
• Ban (Hardware ID): Permanently blacklists the device's unique hardware identifier. Even if the device attempts to re-pair, the server will reject the request at the network layer.

Global Kill-Switches

In the Access Control tab of the Web UI, the administrator can disable specific services globally. This overrides all device permissions, providing a "kill-switch" for features like Terminal or File Deletion across the entire fleet.