Ability to limit tools by roles or scope #2936
Description
First check out our main documentation site at https://openc3.com.
What is the use case or problem this feature would solve?
Tools are global — if a tool is installed in the DEFAULT scope, it appears for everyone.
Describe the solution you'd like
The ability to configure tool visibility based on user roles, so that different users see only the tools relevant to their role. This could be accomplished by adding an optional ROLE keyword to the tool definition in plugin.txt, allowing plugin authors to specify which roles are permitted to see a given tool in the sidebar. If no role is specified, the tool would remain visible to all users as it does today.
Example:
TOOL my-custom-tool "My Custom Tool"
INLINE_URL main.js
ICON mdi-wrench
ROLE operator
ROLE admin
The sidebar would then filter the tool list based on the authenticated user's assigned Keycloak roles, showing only the tools they are permitted to access.
Additional context
Currently, tools installed in the DEFAULT scope are visible to all authenticated users regardless of their Keycloak role. The only mechanism to hide a tool is the global SHOWN flag, which hides it from everyone. There is no supported way to show different tools to different users.
Scopes were considered as a potential workaround, but tools installed in a non-DEFAULT scope do not appear in the sidebar at all, making scopes unsuitable for this purpose.
This would be particularly useful for organizations that install custom tools for specific teams or user groups and do not want those tools visible to all users across the system.