hbb_common

AGENTS.md

@@ -84,3 +84,9 @@ Then translate that source into the file's target language (infer the language f
 * Preserve placeholders (`{}`) and escape sequences (`\n`, `\"`) exactly as in the source.
 * Do not translate brand or technical tokens: `RustDesk`, `Socks5`, `TLS`, `UAC`, `Wayland`, `X11`, `TCP`, `UDP`, `2FA`, `RDP`, `D3D`, etc.
 * Copy URL values (e.g. `doc_*` keys) verbatim from `en.rs`.
+
+### Adding new keys (feature work)
+
+* New English-text keys use sentence case, not Title Case: `Use ID whitelisting`, **not** `Use ID Whitelisting`. Acronyms (ID, IP, 2FA…) stay uppercase. Legacy Title-Case keys (e.g. `Use IP Whitelisting`) stay as-is — do not rename them.
+* Since the key itself is the English display text, a sentence-case key usually needs **no** `en.rs` entry; add one only when the display text must differ from the key (e.g. `*_tip` keys).
+* Append each new key to `template.rs` (with `""`) and to every `src/lang/*.rs` file (translated, or `""` if unsure), at the end of the list.

flutter/lib/common.dart

@@ -4004,6 +4004,11 @@ bool whitelistNotEmpty() {
   return v != '' && v != ',';
 }
 
+bool idWhitelistNotEmpty() {
+  final v = bind.mainGetOptionSync(key: kOptionIdWhitelist);
+  return v != '' && v != ',';
+}
+
 // `setMovable()` is only supported on macOS.
 //
 // On macOS, the window can be dragged by the tab bar by default.

flutter/lib/common/widgets/dialog.dart

@@ -205,6 +205,10 @@ void changeWhiteList({Function()? callback}) async {
           const SizedBox(
             height: 8.0,
           ),
+          Text(translate("whitelist_cidr_tip")),
+          const SizedBox(
+            height: 8.0,
+          ),
           Row(
             children: [
               Expanded(
@@ -282,6 +286,108 @@ void changeWhiteList({Function()? callback}) async {
   });
 }
 
+void changeIdWhiteList({Function()? callback}) async {
+  final curIdWhiteList = await bind.mainGetOption(key: kOptionIdWhitelist);
+  var newIdWhiteListField = curIdWhiteList == defaultOptionWhitelist
+      ? ''
+      : curIdWhiteList.split(',').join('\n');
+  var controller = TextEditingController(text: newIdWhiteListField);
+  var msg = "";
+  var isInProgress = false;
+  final isOptFixed = isOptionFixed(kOptionIdWhitelist);
+  gFFI.dialogManager.show((setState, close, context) {
+    return CustomAlertDialog(
+      title: Text(translate("ID whitelisting")),
+      content: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Text(translate("whitelist_sep")),
+          const SizedBox(
+            height: 8.0,
+          ),
+          Text(translate("id_whitelist_wildcard_tip")),
+          const SizedBox(
+            height: 8.0,
+          ),
+          Text(translate("id_whitelist_caveat_tip")),
+          const SizedBox(
+            height: 8.0,
+          ),
+          Row(
+            children: [
+              Expanded(
+                child: TextField(
+                        maxLines: null,
+                        decoration: InputDecoration(
+                          errorText: msg.isEmpty ? null : translate(msg),
+                        ),
+                        controller: controller,
+                        enabled: !isOptFixed,
+                        autofocus: true)
+                    .workaroundFreezeLinuxMint(),
+              ),
+            ],
+          ),
+          const SizedBox(
+            height: 4.0,
+          ),
+          // NOT use Offstage to wrap LinearProgressIndicator
+          if (isInProgress) const LinearProgressIndicator(),
+        ],
+      ),
+      actions: [
+        dialogButton("Cancel", onPressed: close, isOutline: true),
+        if (!isOptFixed)
+          dialogButton("Clear", onPressed: () async {
+            await bind.mainSetOption(
+                key: kOptionIdWhitelist, value: defaultOptionWhitelist);
+            callback?.call();
+            close();
+          }, isOutline: true),
+        if (!isOptFixed)
+          dialogButton(
+            "OK",
+            onPressed: () async {
+              setState(() {
+                msg = "";
+                isInProgress = true;
+              });
+              newIdWhiteListField = controller.text.trim();
+              var newIdWhiteList = "";
+              if (newIdWhiteListField.isEmpty) {
+                // pass
+              } else {
+                final ids =
+                    newIdWhiteListField.trim().split(RegExp(r"[\s,;\n]+"));
+                // test id, wildcards '*' and '?' are allowed;
+                // '@' '.' ':' occur in cross-server IDs like "123456789@server:port"
+                final idMatch = RegExp(r"^[a-zA-Z0-9\_\-\*\?\@\.\:]+$");
+                for (final id in ids) {
+                  if (!idMatch.hasMatch(id)) {
+                    msg = "${translate("Invalid ID")} $id";
+                    setState(() {
+                      isInProgress = false;
+                    });
+                    return;
+                  }
+                }
+                newIdWhiteList = ids.join(',');
+              }
+              if (newIdWhiteList.trim().isEmpty) {
+                newIdWhiteList = defaultOptionWhitelist;
+              }
+              await bind.mainSetOption(
+                  key: kOptionIdWhitelist, value: newIdWhiteList);
+              callback?.call();
+              close();
+            },
+          ),
+      ],
+      onCancel: close,
+    );
+  });
+}
+
 Future<String> changeDirectAccessPort(
     String currentIP, String currentPort) async {
   final controller = TextEditingController(text: currentPort);

flutter/lib/consts.dart

@@ -95,6 +95,7 @@ const String kOptionForceAlwaysRelay = "force-always-relay";
 const String kOptionViewOnly = "view_only";
 const String kOptionEnableLanDiscovery = "enable-lan-discovery";
 const String kOptionWhitelist = "whitelist";
+const String kOptionIdWhitelist = "id-whitelist";
 const String kOptionEnableAbr = "enable-abr";
 const String kOptionEnableRecordSession = "enable-record-session";
 const String kOptionDirectServer = "direct-server";

flutter/lib/desktop/pages/desktop_setting_page.dart

@@ -1297,6 +1297,7 @@ class _SafetyState extends State<_Safety> with AutomaticKeepAliveClientMixin {
           reverse: true, enabled: enabled),
       ...directIp(context),
       whitelist(),
+      idWhitelist(),
       ...autoDisconnect(context),
       _OptionCheckBox(context, 'keep-awake-during-incoming-sessions-label',
           kOptionKeepAwakeDuringIncomingSessions,
@@ -1454,6 +1455,52 @@ class _SafetyState extends State<_Safety> with AutomaticKeepAliveClientMixin {
     return tmpWrapper();
   }
 
+  Widget idWhitelist() {
+    bool enabled = !locked;
+    RxBool hasIdWhitelist = idWhitelistNotEmpty().obs;
+    update() async {
+      hasIdWhitelist.value = idWhitelistNotEmpty();
+    }
+
+    onChanged(bool? checked) async {
+      changeIdWhiteList(callback: update);
+    }
+
+    final isOptFixed = isOptionFixed(kOptionIdWhitelist);
+    return GestureDetector(
+      child: Tooltip(
+        message: translate('id_whitelist_tip'),
+        child: Obx(() => Row(
+              children: [
+                Checkbox(
+                        value: hasIdWhitelist.value,
+                        onChanged: enabled && !isOptFixed ? onChanged : null)
+                    .marginOnly(right: 5),
+                Offstage(
+                  offstage: !hasIdWhitelist.value,
+                  child: MouseRegion(
+                    child: const Icon(Icons.warning_amber_rounded,
+                            color: Color.fromARGB(255, 255, 204, 0))
+                        .marginOnly(right: 5),
+                    cursor: SystemMouseCursors.click,
+                  ),
+                ),
+                Expanded(
+                    child: Text(
+                  translate('Use ID whitelisting'),
+                  style: TextStyle(color: disabledTextColor(context, enabled)),
+                ))
+              ],
+            )),
+      ),
+      onTap: enabled
+          ? () {
+              onChanged(!hasIdWhitelist.value);
+            }
+          : null,
+    ).marginOnly(left: _kCheckBoxLeftMargin);
+  }
+
   Widget hide_cm(bool enabled) {
     return ChangeNotifierProvider.value(
         value: gFFI.serverModel,
@@ -2414,17 +2461,20 @@ class _AboutState extends State<_About> {
       final version = await bind.mainGetVersion();
       final buildDate = await bind.mainGetBuildDate();
       final fingerprint = await bind.mainGetFingerprint();
+      final myId = await bind.mainGetMyId();
       return {
         'license': license,
         'version': version,
         'buildDate': buildDate,
-        'fingerprint': fingerprint
+        'fingerprint': fingerprint,
+        'myId': myId
       };
     }(), hasData: (data) {
       final license = data['license'].toString();
       final version = data['version'].toString();
       final buildDate = data['buildDate'].toString();
       final fingerprint = data['fingerprint'].toString();
+      final myId = data['myId'].toString();
       const linkStyle = TextStyle(decoration: TextDecoration.underline);
       final scrollController = ScrollController();
       return SingleChildScrollView(
@@ -2446,6 +2496,9 @@ class _AboutState extends State<_About> {
                 SelectionArea(
                     child: Text('${translate('Fingerprint')}: $fingerprint')
                         .marginSymmetric(vertical: 4.0)),
+              SelectionArea(
+                  child: Text('${translate('ID')}: $myId')
+                      .marginSymmetric(vertical: 4.0)),
               InkWell(
                   onTap: () {
                     launchUrlString('https://rustdesk.com/privacy.html');

flutter/lib/mobile/pages/settings_page.dart

@@ -78,6 +78,7 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
   var _enableAbr = false;
   var _denyLANDiscovery = false;
   var _onlyWhiteList = false;
+  var _onlyIdWhiteList = false;
   var _enableDirectIPAccess = false;
   var _enableRecordSession = false;
   var _enableHardwareCodec = false;
@@ -89,6 +90,7 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
   var _directAccessPort = "";
   var _fingerprint = "";
   var _buildDate = "";
+  var _myId = "";
   var _autoDisconnectTimeout = "";
   var _hideServer = false;
   var _hideProxy = false;
@@ -109,6 +111,7 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
     _denyLANDiscovery = !option2bool(kOptionEnableLanDiscovery,
         bind.mainGetOptionSync(key: kOptionEnableLanDiscovery));
     _onlyWhiteList = whitelistNotEmpty();
+    _onlyIdWhiteList = idWhitelistNotEmpty();
     _enableDirectIPAccess = option2bool(
         kOptionDirectServer, bind.mainGetOptionSync(key: kOptionDirectServer));
     _enableRecordSession = option2bool(kOptionEnableRecordSession,
@@ -217,6 +220,12 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
         _buildDate = buildDate;
       }
 
+      final myId = await bind.mainGetMyId();
+      if (_myId != myId) {
+        update = true;
+        _myId = myId;
+      }
+
       final isUsingPublicServer = await bind.mainIsUsingPublicServer();
       if (_isUsingPublicServer != isUsingPublicServer) {
         update = true;
@@ -400,6 +409,29 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
           changeWhiteList(callback: update);
         },
       ),
+      SettingsTile.switchTile(
+        title: Row(children: [
+          Expanded(child: Text(translate('Use ID whitelisting'))),
+          Offstage(
+                  offstage: !_onlyIdWhiteList,
+                  child: const Icon(Icons.warning_amber_rounded,
+                      color: Color.fromARGB(255, 255, 204, 0)))
+              .marginOnly(left: 5)
+        ]),
+        initialValue: _onlyIdWhiteList,
+        onToggle: (_) async {
+          update() async {
+            final onlyIdWhiteList = idWhitelistNotEmpty();
+            if (onlyIdWhiteList != _onlyIdWhiteList) {
+              setState(() {
+                _onlyIdWhiteList = onlyIdWhiteList;
+              });
+            }
+          }
+
+          changeIdWhiteList(callback: update);
+        },
+      ),
       SettingsTile.switchTile(
         title: Text(translate('Adaptive bitrate')),
         initialValue: _enableAbr,
@@ -982,6 +1014,14 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
                     child: Text(_fingerprint),
                   ),
                   leading: Icon(Icons.fingerprint)),
+            SettingsTile(
+                onPressed: (context) => onCopyFingerprint(_myId),
+                title: Text(translate("ID")),
+                value: Padding(
+                  padding: EdgeInsets.symmetric(vertical: 8),
+                  child: Text(_myId),
+                ),
+                leading: Icon(Icons.perm_identity)),
             SettingsTile(
               title: Text(translate("Privacy Statement")),
               onPressed: (context) =>

src/lang/ar.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "جميع الشاشات"),
         ("#{} monitor", "الشاشة رقم {}"),
         ("conn-e2ee-unavailable-tip", "تعذر التحقق من التشفير من طرف إلى طرف.\nقد يكون الجهاز البعيد ما يزال قيد الإعداد. حاول مرة أخرى لاحقًا.\nإذا استمر حدوث ذلك، فقد يكون الخادم غير موثوق به.\nهل تريد المتابعة على أي حال؟"),
+        ("ID whitelisting", "القائمة البيضاء للمعرفات"),
+        ("Use ID whitelisting", "استخدام القائمة البيضاء للمعرفات"),
+        ("id_whitelist_tip", "فقط المعرفات في القائمة البيضاء تستطيع الوصول لي"),
+        ("id_whitelist_wildcard_tip", "أحرف البدل مدعومة: '*' يطابق أي عدد من الأحرف، '?' يطابق حرفاً واحداً بالضبط"),
+        ("Invalid ID", "معرف غير صحيح"),
+        ("Your ID is blocked by the peer", "تم حظر معرفك من قبل الطرف الآخر"),
+        ("Your ip is blocked by the peer", "تم حظر عنوان IP الخاص بك من قبل الطرف الآخر"),
+        ("id_whitelist_caveat_tip", "يتم الإبلاغ عن المعرف من قبل العميل المتصل. القائمة البيضاء تقلل من التعرض ولا تغني عن كلمة المرور أو 2FA"),
+        ("whitelist_cidr_tip", "يتم دعم صيغة CIDR، مثال: 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/be.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Усе манітори"),
         ("#{} monitor", "Манітор {}"),
         ("conn-e2ee-unavailable-tip", "Не ўдалося праверыць скразное шыфраванне.\nАддаленая прылада, магчыма, яшчэ наладжваецца. Паспрабуйце пазней.\nКалі гэта будзе паўтарацца, сервер можа быць ненадзейным.\nУсё роўна працягнуць?"),
+        ("ID whitelisting", "Спіс дазволеных ID"),
+        ("Use ID whitelisting", "Выкарыстоўваць белы спіс ID"),
+        ("id_whitelist_tip", "Атрымліваць доступ да маёй прылады могуць толькі ID з белага спісу."),
+        ("id_whitelist_wildcard_tip", "Падтрымліваюцца падстаноўныя знакі: '*' адпавядае любой колькасці сімвалаў, '?' — роўна аднаму сімвалу"),
+        ("Invalid ID", "Няправільны ID"),
+        ("Your ID is blocked by the peer", "Ваш ID заблакаваны аддаленай прыладай"),
+        ("Your ip is blocked by the peer", "Ваш IP-адрас заблакаваны аддаленай прыладай"),
+        ("id_whitelist_caveat_tip", "ID паведамляецца кліентам, які падключаецца. Белы спіс памяншае паверхню атакі і не замяняе пароль або 2FA"),
+        ("whitelist_cidr_tip", "Падтрымліваецца натацыя CIDR, напрыклад: 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/bg.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Всички монитори"),
         ("#{} monitor", "Монитор {}"),
         ("conn-e2ee-unavailable-tip", "Шифроването от край до край не може да бъде проверено.\nОтдалеченото устройство може все още да се настройва. Опитайте отново по-късно.\nАко това продължи, сървърът може да не е надежден.\nДа се продължи ли въпреки това?"),
+        ("ID whitelisting", "Позволени ID"),
+        ("Use ID whitelisting", "Използване бял списък с ID"),
+        ("id_whitelist_tip", "Само ID от белия списък имат достъп до мен"),
+        ("id_whitelist_wildcard_tip", "Поддържат се заместващи символи: '*' съответства на произволен брой знаци, '?' — на точно един знак"),
+        ("Invalid ID", "Невалидно ID"),
+        ("Your ID is blocked by the peer", "Вашето ID е блокирано от отсрещната страна"),
+        ("Your ip is blocked by the peer", "Вашият IP адрес е блокиран от отсрещната страна"),
+        ("id_whitelist_caveat_tip", "ID се съобщава от свързващия се клиент. Белият списък намалява изложеността и не замества паролата или 2FA"),
+        ("whitelist_cidr_tip", "Поддържа се CIDR нотация, например: 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/ca.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Tots els monitors"),
         ("#{} monitor", "Monitor {}"),
         ("conn-e2ee-unavailable-tip", "No s'ha pogut verificar el xifratge d'extrem a extrem.\nEl dispositiu remot encara es pot estar configurant. Torneu-ho a provar més tard.\nSi això continua passant, el servidor pot no ser de confiança.\nVoleu continuar igualment?"),
+        ("ID whitelisting", "ID admesos"),
+        ("Use ID whitelisting", "Utilitza un llistat d'ID admesos"),
+        ("id_whitelist_tip", "Només els ID admesos es podran connectar"),
+        ("id_whitelist_wildcard_tip", "S'admeten comodins: '*' coincideix amb qualsevol nombre de caràcters, '?' amb un sol caràcter"),
+        ("Invalid ID", "ID no vàlid"),
+        ("Your ID is blocked by the peer", "El vostre ID està bloquejat per l'altre extrem"),
+        ("Your ip is blocked by the peer", "La vostra IP està bloquejada per l'altre extrem"),
+        ("id_whitelist_caveat_tip", "L'ID és informat pel client que es connecta. Aquesta llista blanca redueix l'exposició i no substitueix la contrasenya ni la 2FA"),
+        ("whitelist_cidr_tip", "S'admet la notació CIDR, per exemple 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/cn.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "所有显示器"),
         ("#{} monitor", "{}号显示器"),
         ("conn-e2ee-unavailable-tip", "无法验证端到端加密。\n远程设备可能仍在准备中，请稍后重试。\n如果此问题持续出现，服务器可能不受信任。\n仍要继续吗？"),
+        ("ID whitelisting", "ID 白名单"),
+        ("Use ID whitelisting", "只允许白名单上的 ID 访问"),
+        ("id_whitelist_tip", "只有白名单里的 ID 才能访问本机"),
+        ("id_whitelist_wildcard_tip", "支持通配符：'*' 匹配任意数量的字符，'?' 匹配单个字符"),
+        ("Invalid ID", "无效 ID"),
+        ("Your ID is blocked by the peer", "你的 ID 已被对方阻止"),
+        ("Your ip is blocked by the peer", "你的 IP 已被对方阻止"),
+        ("id_whitelist_caveat_tip", "ID 由对端客户端上报，白名单用于减少暴露面，不能替代密码或 2FA"),
+        ("whitelist_cidr_tip", "支持 CIDR 写法，例如 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/cs.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Všechny monitory"),
         ("#{} monitor", "Monitor č. {}"),
         ("conn-e2ee-unavailable-tip", "Nepodařilo se ověřit koncové šifrování.\nVzdálené zařízení se možná stále nastavuje. Zkuste to znovu později.\nPokud se to bude opakovat, server nemusí být důvěryhodný.\nPřesto pokračovat?"),
+        ("ID whitelisting", "Povolování pouze z daných ID"),
+        ("Use ID whitelisting", "Použít bílou listinu ID"),
+        ("id_whitelist_tip", "Přístup je umožněn pouze z ID, nacházejících se na seznamu povolených"),
+        ("id_whitelist_wildcard_tip", "Jsou podporovány zástupné znaky: '*' odpovídá libovolnému počtu znaků, '?' právě jednomu znaku"),
+        ("Invalid ID", "Neplatné ID"),
+        ("Your ID is blocked by the peer", "Vaše ID je protistranou blokováno"),
+        ("Your ip is blocked by the peer", "Vaše IP adresa je protistranou blokována"),
+        ("id_whitelist_caveat_tip", "ID je hlášeno připojujícím se klientem. Tento seznam snižuje vystavení a nenahrazuje heslo ani 2FA"),
+        ("whitelist_cidr_tip", "Je podporován zápis CIDR, například 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/da.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Alle skærme"),
         ("#{} monitor", "Skærm {}"),
         ("conn-e2ee-unavailable-tip", "End-to-end-kryptering kunne ikke bekræftes.\nDen eksterne enhed er muligvis stadig ved at blive konfigureret. Prøv igen senere.\nHvis dette fortsætter, er serveren muligvis ikke pålidelig.\nFortsæt alligevel?"),
+        ("ID whitelisting", "ID whitelisting"),
+        ("Use ID whitelisting", "Brug ID whitelisting"),
+        ("id_whitelist_tip", "Kun ID'er på whitelisten kan få adgang til mig"),
+        ("id_whitelist_wildcard_tip", "Jokertegn understøttes: '*' matcher et vilkårligt antal tegn, '?' matcher præcist ét tegn"),
+        ("Invalid ID", "Ugyldigt ID"),
+        ("Your ID is blocked by the peer", "Dit ID er blokeret af modparten"),
+        ("Your ip is blocked by the peer", "Din IP-adresse er blokeret af modparten"),
+        ("id_whitelist_caveat_tip", "ID'et rapporteres af den klient, der opretter forbindelse. Whitelisten reducerer eksponeringen og erstatter ikke adgangskode eller 2FA"),
+        ("whitelist_cidr_tip", "CIDR-notation understøttes, f.eks. 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/de.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Alle Bildschirme"),
         ("#{} monitor", "Bildschirm {}"),
         ("conn-e2ee-unavailable-tip", "Ende-zu-Ende-Verschlüsselung konnte nicht verifiziert werden.\nDas entfernte Gerät wird möglicherweise noch eingerichtet. Versuchen Sie es später erneut.\nWenn dies weiterhin auftritt, ist der Server möglicherweise nicht vertrauenswürdig.\nTrotzdem fortfahren?"),
+        ("ID whitelisting", "ID-Whitelist"),
+        ("Use ID whitelisting", "ID-Whitelist verwenden"),
+        ("id_whitelist_tip", "Nur IDs auf der Whitelist können zugreifen."),
+        ("id_whitelist_wildcard_tip", "Platzhalter werden unterstützt: '*' steht für beliebig viele Zeichen, '?' für genau ein Zeichen"),
+        ("Invalid ID", "Ungültige ID"),
+        ("Your ID is blocked by the peer", "Ihre ID wird von der Gegenstelle blockiert"),
+        ("Your ip is blocked by the peer", "Ihre IP-Adresse wird von der Gegenstelle blockiert"),
+        ("id_whitelist_caveat_tip", "Die ID wird vom verbindenden Client gemeldet. Die Whitelist verringert die Angriffsfläche und ersetzt weder Passwort noch 2FA"),
+        ("whitelist_cidr_tip", "Die CIDR-Notation wird unterstützt, z. B. 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/el.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Όλες οι οθόνες"),
         ("#{} monitor", "Οθόνη {}"),
         ("conn-e2ee-unavailable-tip", "Δεν ήταν δυνατή η επαλήθευση της κρυπτογράφησης από άκρο σε άκρο.\nΗ απομακρυσμένη συσκευή μπορεί να ρυθμίζεται ακόμα. Δοκιμάστε ξανά αργότερα.\nΑν αυτό συνεχιστεί, ο διακομιστής μπορεί να μην είναι αξιόπιστος.\nΣυνέχεια παρ' όλα αυτά;"),
+        ("ID whitelisting", "Λίστα επιτρεπόμενων ID"),
+        ("Use ID whitelisting", "Χρήση λίστας επιτρεπόμενων ID"),
+        ("id_whitelist_tip", "Μόνο τα ID της λίστας επιτρεπόμενων έχουν πρόσβαση σε εμένα"),
+        ("id_whitelist_wildcard_tip", "Υποστηρίζονται χαρακτήρες μπαλαντέρ: το '*' αντιστοιχεί σε οποιονδήποτε αριθμό χαρακτήρων, το '?' σε έναν ακριβώς χαρακτήρα"),
+        ("Invalid ID", "Μη έγκυρο ID"),
+        ("Your ID is blocked by the peer", "Το ID σας έχει αποκλειστεί από τον απομακρυσμένο υπολογιστή"),
+        ("Your ip is blocked by the peer", "Η διεύθυνση IP σας έχει αποκλειστεί από τον απομακρυσμένο υπολογιστή"),
+        ("id_whitelist_caveat_tip", "Το ID αναφέρεται από τον πελάτη που συνδέεται. Η λίστα επιτρεπόμενων μειώνει την έκθεση και δεν αντικαθιστά τον κωδικό πρόσβασης ή το 2FA"),
+        ("whitelist_cidr_tip", "Υποστηρίζεται η σημειογραφία CIDR, π.χ. 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/en.rs

@@ -279,6 +279,11 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("wayland-soft-keyboard-input-label", "Soft keyboard input"),
         ("wayland-keyboard-input-reset-choice-tip", "Reset keyboard input choice"),
         ("remember-wayland-keyboard-choice-tip", "Don't ask again for this remote computer"),
-        ("conn-e2ee-unavailable-tip", "Could not verify end-to-end encryption.\nThe remote device may still be setting up. Try again later.\nIf this keeps happening, the server may be untrusted.\nContinue anyway?")
+        ("conn-e2ee-unavailable-tip", "Could not verify end-to-end encryption.\nThe remote device may still be setting up. Try again later.\nIf this keeps happening, the server may be untrusted.\nContinue anyway?"),
+        ("id_whitelist_tip", "Only whitelisted IDs can access me"),
+        ("id_whitelist_wildcard_tip", "Wildcards are supported: '*' matches any number of characters, '?' matches exactly one character"),
+        ("id_whitelist_caveat_tip", "The ID is reported by the connecting client. This whitelist reduces exposure and does not replace the password or 2FA."),
+        ("whitelist_cidr_tip", "CIDR notation is supported, e.g. 192.168.1.0/24"),
+        ("Your ip is blocked by the peer", "Your IP is blocked by the peer")
     ].iter().cloned().collect();
 }

src/lang/eo.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Ĉiuj monitoroj"),
         ("#{} monitor", "Monitoro {}"),
         ("conn-e2ee-unavailable-tip", "Ne eblis kontroli la fin-al-finan ĉifradon.\nLa fora aparato eble ankoraŭ estas agordata. Provu denove poste.\nSe tio daŭre okazas, la servilo eble estas nefidinda.\nĈu daŭrigi tamen?"),
+        ("ID whitelisting", "Listo de ID akceptataj"),
+        ("Use ID whitelisting", "Uzi liston de ID akceptataj"),
+        ("id_whitelist_tip", "Nur la ID en la blanka listo povas kontroli mian komputilon"),
+        ("id_whitelist_wildcard_tip", "Ĵokeroj estas subtenataj: '*' kongruas kun iu ajn nombro da signoj, '?' kun ekzakte unu signo"),
+        ("Invalid ID", "ID nevalida"),
+        ("Your ID is blocked by the peer", "Via ID estas blokita de la alia flanko"),
+        ("Your ip is blocked by the peer", "Via IP estas blokita de la alia flanko"),
+        ("id_whitelist_caveat_tip", "La ID estas raportata de la konektiĝanta kliento. La blanka listo malpliigas la eksponiĝon kaj ne anstataŭas la pasvorton aŭ 2FA"),
+        ("whitelist_cidr_tip", "La notacio CIDR estas subtenata, ekzemple 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/es.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Todos los monitores"),
         ("#{} monitor", "Monitor {}"),
         ("conn-e2ee-unavailable-tip", "No se pudo verificar el cifrado de extremo a extremo.\nEs posible que el dispositivo remoto aún se esté configurando. Inténtelo de nuevo más tarde.\nSi esto sigue ocurriendo, es posible que el servidor no sea de confianza.\n¿Continuar de todos modos?"),
+        ("ID whitelisting", "IDs admitidos"),
+        ("Use ID whitelisting", "Usar lista de IDs admitidos"),
+        ("id_whitelist_tip", "Solo los IDs autorizados pueden conectarse a este escritorio"),
+        ("id_whitelist_wildcard_tip", "Se admiten comodines: '*' coincide con cualquier número de caracteres, '?' con exactamente un carácter"),
+        ("Invalid ID", "ID incorrecto"),
+        ("Your ID is blocked by the peer", "Tu ID está bloqueado por el dispositivo remoto"),
+        ("Your ip is blocked by the peer", "Tu IP está bloqueada por el dispositivo remoto"),
+        ("id_whitelist_caveat_tip", "El ID lo comunica el cliente que se conecta. Esta lista blanca reduce la exposición y no sustituye a la contraseña ni al 2FA"),
+        ("whitelist_cidr_tip", "Se admite la notación CIDR, por ejemplo 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/et.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Kõik kuvarid"),
         ("#{} monitor", "Kuvar {}"),
         ("conn-e2ee-unavailable-tip", "Otspunktkrüptimist ei saanud kontrollida.\nKaugseade võib olla veel seadistamisel. Proovige hiljem uuesti.\nKui see jätkub, ei pruugi server olla usaldusväärne.\nKas jätkata siiski?"),
+        ("ID whitelisting", "ID lubamisloend"),
+        ("Use ID whitelisting", "Kasuta ID-lubamisloendit"),
+        ("id_whitelist_tip", "Ainult lubamisloendis ID saab mulle ligi"),
+        ("id_whitelist_wildcard_tip", "Metamärgid on toetatud: '*' vastab suvalisele arvule märkidele, '?' täpselt ühele märgile"),
+        ("Invalid ID", "Sobimatu ID"),
+        ("Your ID is blocked by the peer", "Teine pool on sinu ID blokeerinud"),
+        ("Your ip is blocked by the peer", "Teine pool on sinu IP-aadressi blokeerinud"),
+        ("id_whitelist_caveat_tip", "ID edastab ühenduv klient. Lubamisloend vähendab eksponeeritust ega asenda parooli või 2FA-d"),
+        ("whitelist_cidr_tip", "Toetatud on CIDR-tähistus, näiteks 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/eu.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Monitore guztiak"),
         ("#{} monitor", "{}. monitorea"),
         ("conn-e2ee-unavailable-tip", "Ezin izan da muturretik muturrerako enkriptatzea egiaztatu.\nUrruneko gailua oraindik konfiguratzen ari daiteke. Saiatu berriro geroago.\nHonek jarraitzen badu, zerbitzaria fidagaitza izan daiteke.\nHala ere jarraitu?"),
+        ("ID whitelisting", "Onartutako IDak"),
+        ("Use ID whitelisting", "Erabili ID onartuen zerrenda"),
+        ("id_whitelist_tip", "Baimendutako IDak soilik konektatu daitezke mahaigain honetara"),
+        ("id_whitelist_wildcard_tip", "Komodinak onartzen dira: '*' edozein karaktere kopururekin bat dator, '?' karaktere bakar batekin"),
+        ("Invalid ID", "ID baliogabea"),
+        ("Your ID is blocked by the peer", "Beste aldeak zure IDa blokeatu du"),
+        ("Your ip is blocked by the peer", "Beste aldeak zure IP helbidea blokeatu du"),
+        ("id_whitelist_caveat_tip", "IDa konektatzen den bezeroak jakinarazten du. Zerrenda honek esposizioa murrizten du eta ez du pasahitza edo 2FA ordezkatzen"),
+        ("whitelist_cidr_tip", "CIDR notazioa onartzen da, adibidez 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/fa.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "همه نمایشگرها"),
         ("#{} monitor", "نمایشگر {}"),
         ("conn-e2ee-unavailable-tip", "رمزنگاری سرتاسری قابل تأیید نیست.\nدستگاه راه دور ممکن است هنوز در حال آماده‌سازی باشد. بعداً دوباره تلاش کنید.\nاگر این مشکل ادامه داشت، سرور ممکن است نامطمئن باشد.\nبا این حال ادامه می‌دهید؟"),
+        ("ID whitelisting", "لیست شناسه های مجاز"),
+        ("Use ID whitelisting", "استفاده از لیست شناسه های مجاز"),
+        ("id_whitelist_tip", "فقط شناسه های مجاز می توانند به این دسکتاپ متصل شوند"),
+        ("id_whitelist_wildcard_tip", "نویسه های عام پشتیبانی می شوند: '*' با هر تعداد نویسه و '?' دقیقا با یک نویسه مطابقت دارد"),
+        ("Invalid ID", "شناسه نامعتبر است"),
+        ("Your ID is blocked by the peer", "شناسه شما توسط طرف مقابل مسدود شده است"),
+        ("Your ip is blocked by the peer", "نشانی IP شما توسط طرف مقابل مسدود شده است"),
+        ("id_whitelist_caveat_tip", "شناسه توسط کلاینت متصل شونده گزارش می شود. لیست مجاز سطح در معرض بودن را کاهش می دهد و جایگزین رمز عبور یا 2FA نیست"),
+        ("whitelist_cidr_tip", "نماد CIDR پشتیبانی می شود، برای مثال 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/fi.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Kaikki näytöt"),
         ("#{} monitor", "Näyttö {}"),
         ("conn-e2ee-unavailable-tip", "Päästä päähän -salausta ei voitu vahvistaa.\nEtälaite voi olla vielä määritettävänä. Yritä myöhemmin uudelleen.\nJos tämä jatkuu, palvelin ei ehkä ole luotettava.\nJatketaanko silti?"),
+        ("ID whitelisting", "ID sallintalista"),
+        ("Use ID whitelisting", "Käytä ID sallintalistaa"),
+        ("id_whitelist_tip", "Vain sallitut ID:t voivat muodostaa yhteyden"),
+        ("id_whitelist_wildcard_tip", "Jokerimerkit ovat tuettuja: '*' vastaa mitä tahansa määrää merkkejä, '?' täsmälleen yhtä merkkiä"),
+        ("Invalid ID", "Virheellinen ID"),
+        ("Your ID is blocked by the peer", "Vastapuoli on estänyt ID:si"),
+        ("Your ip is blocked by the peer", "Vastapuoli on estänyt IP-osoitteesi"),
+        ("id_whitelist_caveat_tip", "ID on yhdistävän asiakkaan ilmoittama. Sallintalista pienentää altistusta eikä korvaa salasanaa tai 2FA:ta"),
+        ("whitelist_cidr_tip", "CIDR-merkintä on tuettu, esimerkiksi 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/fr.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Tous les moniteurs"),
         ("#{} monitor", "Moniteur {}"),
         ("conn-e2ee-unavailable-tip", "Impossible de vérifier le chiffrement de bout en bout.\nL'appareil distant est peut-être encore en cours de configuration. Réessayez plus tard.\nSi le problème persiste, le serveur n'est peut-être pas fiable.\nContinuer quand même ?"),
+        ("ID whitelisting", "Liste blanche d’ID"),
+        ("Use ID whitelisting", "Utiliser une liste blanche d’ID"),
+        ("id_whitelist_tip", "Seuls les ID inclus dans la liste blanche pourront accéder à mon appareil"),
+        ("id_whitelist_wildcard_tip", "Les caractères génériques sont pris en charge : '*' correspond à un nombre quelconque de caractères, '?' à un seul caractère"),
+        ("Invalid ID", "ID non valide"),
+        ("Your ID is blocked by the peer", "Votre ID est bloqué par l’appareil distant"),
+        ("Your ip is blocked by the peer", "Votre adresse IP est bloquée par l’appareil distant"),
+        ("id_whitelist_caveat_tip", "L’ID est déclaré par le client qui se connecte. Cette liste blanche réduit l’exposition et ne remplace ni le mot de passe ni la 2FA"),
+        ("whitelist_cidr_tip", "La notation CIDR est prise en charge, par exemple 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/ge.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "ყველა მონიტორი"),
         ("#{} monitor", "მონიტორი {}"),
         ("conn-e2ee-unavailable-tip", "ბოლომდე დაშიფვრის გადამოწმება ვერ მოხერხდა.\nდისტანციური მოწყობილობა შესაძლოა ჯერ კიდევ მზადდება. სცადეთ მოგვიანებით.\nთუ ეს კვლავ გაგრძელდება, სერვერი შესაძლოა არასანდო იყოს.\nმაინც გააგრძელებთ?"),
+        ("ID whitelisting", "დაშვებული ID-ების სია"),
+        ("Use ID whitelisting", "ID თეთრი სიის გამოყენება"),
+        ("id_whitelist_tip", "მხოლოდ თეთრ სიაში არსებულ ID-ებს შეუძლიათ ჩემს მოწყობილობაზე წვდომა."),
+        ("id_whitelist_wildcard_tip", "მხარდაჭერილია ვაილდქარდები: '*' ემთხვევა ნებისმიერი რაოდენობის სიმბოლოს, '?' — ზუსტად ერთ სიმბოლოს"),
+        ("Invalid ID", "არასწორი ID"),
+        ("Your ID is blocked by the peer", "თქვენი ID დაბლოკილია მეორე მხარის მიერ"),
+        ("Your ip is blocked by the peer", "თქვენი IP მისამართი დაბლოკილია მეორე მხარის მიერ"),
+        ("id_whitelist_caveat_tip", "ID-ს აცხადებს დამაკავშირებელი კლიენტი. თეთრი სია ამცირებს ექსპოზიციას და ვერ ჩაანაცვლებს პაროლს ან 2FA-ს"),
+        ("whitelist_cidr_tip", "მხარდაჭერილია CIDR ჩანაწერი, მაგალითად 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/gu.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "બધા મોનિટર"),
         ("#{} monitor", "મોનિટર {}"),
         ("conn-e2ee-unavailable-tip", "એન્ડ-ટુ-એન્ડ એન્ક્રિપ્શન ચકાસી શકાયું નથી.\nરિમોટ ઉપકરણ હજી સેટ થઈ રહ્યું હોઈ શકે છે. પછીથી ફરી પ્રયાસ કરો.\nજો આ ચાલુ રહે, તો સર્વર અવિશ્વસનીય હોઈ શકે છે.\nશું તેમ છતાં ચાલુ રાખવું?"),
+        ("ID whitelisting", "ID વ્હાઇટલિસ્ટિંગ"),
+        ("Use ID whitelisting", "ID વ્હાઇટલિસ્ટિંગનો ઉપયોગ કરો"),
+        ("id_whitelist_tip", "માત્ર વ્હાઇટલિસ્ટ કરેલ ID જ મને એક્સેસ કરી શકે છે"),
+        ("id_whitelist_wildcard_tip", "વાઇલ્ડકાર્ડ સપોર્ટેડ છે: '*' કોઈપણ સંખ્યાના અક્ષરો સાથે મેળ ખાય છે, '?' બરાબર એક અક્ષર સાથે"),
+        ("Invalid ID", "અમાન્ય ID"),
+        ("Your ID is blocked by the peer", "તમારું ID સામેના પક્ષ દ્વારા બ્લોક કરવામાં આવ્યું છે"),
+        ("Your ip is blocked by the peer", "તમારું IP સામેના પક્ષ દ્વારા બ્લોક કરવામાં આવ્યું છે"),
+        ("id_whitelist_caveat_tip", "ID કનેક્ટ થતા ક્લાયન્ટ દ્વારા જણાવવામાં આવે છે. વ્હાઇટલિસ્ટ એક્સપોઝર ઘટાડે છે અને પાસવર્ડ કે 2FA નો વિકલ્પ નથી"),
+        ("whitelist_cidr_tip", "CIDR નોટેશન સપોર્ટેડ છે, ઉदાહરણ તરીકે 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/he.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "כל המסכים"),
         ("#{} monitor", "מסך {}"),
         ("conn-e2ee-unavailable-tip", "לא ניתן לאמת הצפנה מקצה לקצה.\nייתכן שהמכשיר המרוחק עדיין בתהליך הגדרה. נסה שוב מאוחר יותר.\nאם זה ממשיך לקרות, ייתכן שהשרת אינו מהימן.\nלהמשיך בכל זאת?"),
+        ("ID whitelisting", "רשימת מזהים מורשים"),
+        ("Use ID whitelisting", "השתמש ברשימה לבנה של מזהים"),
+        ("id_whitelist_tip", "רק מזהים מהרשימה הלבנה יכולים לגשת אלי"),
+        ("id_whitelist_wildcard_tip", "נתמכים תווים כלליים: '*' תואם כל מספר של תווים, '?' תואם תו אחד בדיוק"),
+        ("Invalid ID", "מזהה לא תקין"),
+        ("Your ID is blocked by the peer", "המזהה שלך נחסם על ידי הצד המרוחק"),
+        ("Your ip is blocked by the peer", "כתובת ה-IP שלך נחסמה על ידי הצד המרוחק"),
+        ("id_whitelist_caveat_tip", "המזהה מדווח על ידי הלקוח המתחבר. הרשימה הלבנה מצמצמת חשיפה ואינה מחליפה סיסמה או 2FA"),
+        ("whitelist_cidr_tip", "יש תמיכה בסימון CIDR, לדוגמה 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/hi.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "सभी मॉनिटर"),
         ("#{} monitor", "मॉनिटर {}"),
         ("conn-e2ee-unavailable-tip", "एंड-टू-एंड एन्क्रिप्शन सत्यापित नहीं किया जा सका।\nदूरस्थ डिवाइस अभी भी सेट अप हो रहा हो सकता है। बाद में फिर प्रयास करें।\nयदि यह समस्या बनी रहती है, तो सर्वर अविश्वसनीय हो सकता है।\nफिर भी जारी रखें?"),
+        ("ID whitelisting", "ID श्वेतसूची (Whitelisting)"),
+        ("Use ID whitelisting", "ID श्वेतसूची का उपयोग करें"),
+        ("id_whitelist_tip", "केवल श्वेतसूचीबद्ध ID ही मुझ तक पहुंच सकते हैं"),
+        ("id_whitelist_wildcard_tip", "वाइल्डकार्ड समर्थित हैं: '*' किसी भी संख्या के अक्षरों से मेल खाता है, '?' ठीक एक अक्षर से"),
+        ("Invalid ID", "अमान्य ID"),
+        ("Your ID is blocked by the peer", "आपकी ID दूसरे पक्ष द्वारा अवरुद्ध कर दी गई है"),
+        ("Your ip is blocked by the peer", "आपका IP दूसरे पक्ष द्वारा अवरुद्ध कर दिया गया है"),
+        ("id_whitelist_caveat_tip", "ID कनेक्ट करने वाले क्लाइंट द्वारा बताई जाती है। श्वेतसूची जोखिम कम करती है और पासवर्ड या 2FA का विकल्प नहीं है"),
+        ("whitelist_cidr_tip", "CIDR नोटेशन समर्थित है, उदाहरण के लिए 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/hr.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Svi monitori"),
         ("#{} monitor", "Monitor {}"),
         ("conn-e2ee-unavailable-tip", "End-to-end enkripcija nije mogla biti potvrđena.\nUdaljeni uređaj se možda još postavlja. Pokušajte ponovno kasnije.\nAko se to nastavi događati, poslužitelj možda nije pouzdan.\nIpak nastaviti?"),
+        ("ID whitelisting", "ID pouzdana lista"),
+        ("Use ID whitelisting", "Koristi popis pouzdanih ID-ova"),
+        ("id_whitelist_tip", "Mogu mi pristupiti samo dozvoljeni ID-ovi"),
+        ("id_whitelist_wildcard_tip", "Podržani su zamjenski znakovi: '*' odgovara bilo kojem broju znakova, '?' točno jednom znaku"),
+        ("Invalid ID", "Nevažeći ID"),
+        ("Your ID is blocked by the peer", "Vaš ID je blokiralo udaljeno računalo"),
+        ("Your ip is blocked by the peer", "Vašu IP adresu je blokiralo udaljeno računalo"),
+        ("id_whitelist_caveat_tip", "ID prijavljuje klijent koji se povezuje. Ova lista smanjuje izloženost i ne zamjenjuje lozinku ni 2FA"),
+        ("whitelist_cidr_tip", "Podržan je CIDR zapis, primjerice 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/hu.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Minden monitor"),
         ("#{} monitor", "{}. monitor"),
         ("conn-e2ee-unavailable-tip", "A végpontok közötti titkosítás nem volt ellenőrizhető.\nA távoli eszköz talán még beállítás alatt áll. Próbálja újra később.\nHa ez továbbra is előfordul, a szerver lehet, hogy nem megbízható.\nFolytatja így is?"),
+        ("ID whitelisting", "Azonosító engedélyezési lista"),
+        ("Use ID whitelisting", "Azonosító engedélyezési lista használata"),
+        ("id_whitelist_tip", "Csak az engedélyezési listán szereplő azonosítók kapcsolódhatnak"),
+        ("id_whitelist_wildcard_tip", "Helyettesítő karakterek használhatók: a '*' tetszőleges számú karakternek, a '?' pontosan egy karakternek felel meg"),
+        ("Invalid ID", "Érvénytelen azonosító"),
+        ("Your ID is blocked by the peer", "Az azonosítóját a távoli fél letiltotta"),
+        ("Your ip is blocked by the peer", "Az IP-címét a távoli fél letiltotta"),
+        ("id_whitelist_caveat_tip", "Az azonosítót a csatlakozó kliens jelenti. Az engedélyezési lista csökkenti a kitettséget, és nem helyettesíti a jelszót vagy a 2FA-t"),
+        ("whitelist_cidr_tip", "A CIDR jelölés támogatott, például 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/id.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Semua monitor"),
         ("#{} monitor", "Monitor {}"),
         ("conn-e2ee-unavailable-tip", "Tidak dapat memverifikasi enkripsi ujung ke ujung.\nPerangkat jarak jauh mungkin masih disiapkan. Coba lagi nanti.\nJika ini terus terjadi, server mungkin tidak tepercaya.\nTetap lanjutkan?"),
+        ("ID whitelisting", "Daftar ID yang diizinkan"),
+        ("Use ID whitelisting", "Gunakan daftar ID yang diizinkan"),
+        ("id_whitelist_tip", "Hanya ID yang diizinkan dapat mengakses"),
+        ("id_whitelist_wildcard_tip", "Wildcard didukung: '*' cocok dengan berapa pun jumlah karakter, '?' dengan tepat satu karakter"),
+        ("Invalid ID", "ID tidak valid"),
+        ("Your ID is blocked by the peer", "ID Anda diblokir oleh perangkat remote"),
+        ("Your ip is blocked by the peer", "IP Anda diblokir oleh perangkat remote"),
+        ("id_whitelist_caveat_tip", "ID dilaporkan oleh klien yang terhubung. Daftar ini mengurangi paparan dan bukan pengganti kata sandi atau 2FA"),
+        ("whitelist_cidr_tip", "Notasi CIDR didukung, misalnya 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/it.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Tutti gli schermi"),
         ("#{} monitor", "Schermo {}"),
         ("conn-e2ee-unavailable-tip", "Impossibile verificare la crittografia end-to-end.\nIl dispositivo remoto potrebbe essere ancora in configurazione. Riprova più tardi.\nSe il problema persiste, il server potrebbe non essere attendibile.\nVuoi continuare?"),
+        ("ID whitelisting", "ID autorizzati"),
+        ("Use ID whitelisting", "Usa elenco ID autorizzati"),
+        ("id_whitelist_tip", "Possono connettersi a questo desktop solo gli ID autorizzati"),
+        ("id_whitelist_wildcard_tip", "Sono supportati i caratteri jolly: '*' corrisponde a un numero qualsiasi di caratteri, '?' a un solo carattere"),
+        ("Invalid ID", "ID non valido"),
+        ("Your ID is blocked by the peer", "Il tuo ID è bloccato dal dispositivo remoto"),
+        ("Your ip is blocked by the peer", "Il tuo IP è bloccato dal dispositivo remoto"),
+        ("id_whitelist_caveat_tip", "L'ID è dichiarato dal client che si connette. Questo elenco riduce l'esposizione e non sostituisce la password o la 2FA"),
+        ("whitelist_cidr_tip", "È supportata la notazione CIDR, ad esempio 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/ja.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "すべてのディスプレイ"),
         ("#{} monitor", "ディスプレイ {}"),
         ("conn-e2ee-unavailable-tip", "エンドツーエンド暗号化を確認できませんでした。\nリモートデバイスはまだ準備中の可能性があります。後でもう一度お試しください。\nこの問題が続く場合、サーバーが信頼できない可能性があります。\nそれでも続行しますか？"),
+        ("ID whitelisting", "ID ホワイトリスト"),
+        ("Use ID whitelisting", "ID ホワイトリストを使用する"),
+        ("id_whitelist_tip", "ホワイトリストに登録された ID からのみ接続を許可します"),
+        ("id_whitelist_wildcard_tip", "ワイルドカードが使用できます。'*' は任意の数の文字、'?' はちょうど1文字に一致します"),
+        ("Invalid ID", "無効な ID"),
+        ("Your ID is blocked by the peer", "あなたの ID は接続先によってブロックされています"),
+        ("Your ip is blocked by the peer", "あなたの IP アドレスは接続先によってブロックされています"),
+        ("id_whitelist_caveat_tip", "ID は接続するクライアントから申告されます。ホワイトリストは露出を減らすもので、パスワードや 2FA の代わりにはなりません"),
+        ("whitelist_cidr_tip", "CIDR 表記に対応しています。例: 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/ko.rs

@@ -764,5 +764,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "모든 모니터"),
         ("#{} monitor", "#{} 모니터"),
         ("conn-e2ee-unavailable-tip", "종단 간 암호화를 확인할 수 없습니다.\n원격 장치가 여전히 설정 중일 수 있습니다. 나중에 다시 시도해 보세요.\n이런 일이 계속 발생하면 서버가 신뢰할 수 없을 수도 있습니다.\n어쨌든 계속하시겠습니까?"),
+        ("ID whitelisting", "ID 화이트리스트"),
+        ("Use ID whitelisting", "ID 화이트리스트 사용"),
+        ("id_whitelist_tip", "화이트리스트에 있는 ID만 나에게 액세스할 수 있음"),
+        ("id_whitelist_wildcard_tip", "와일드카드를 지원합니다: '*'는 임의 개수의 문자와, '?'는 정확히 한 문자와 일치합니다"),
+        ("Invalid ID", "유효하지 않은 ID입니다"),
+        ("Your ID is blocked by the peer", "귀하의 ID가 상대방에 의해 차단되었습니다"),
+        ("Your ip is blocked by the peer", "귀하의 IP가 상대방에 의해 차단되었습니다"),
+        ("id_whitelist_caveat_tip", "ID는 연결하는 클라이언트가 보고합니다. 화이트리스트는 노출을 줄이는 것으로 비밀번호나 2FA를 대체하지 않습니다"),
+        ("whitelist_cidr_tip", "CIDR 표기를 지원합니다. 예: 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/kz.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Барлық мониторлар"),
         ("#{} monitor", "Монитор {}"),
         ("conn-e2ee-unavailable-tip", "Ұштан-ұшқа шифрлауды тексеру мүмкін болмады.\nҚашықтағы құрылғы әлі бапталып жатқан болуы мүмкін. Кейінірек қайталап көріңіз.\nЕгер бұл қайталана берсе, сервер сенімсіз болуы мүмкін.\nСонда да жалғастыру керек пе?"),
+        ("ID whitelisting", "ID Ақ-тізімі"),
+        ("Use ID whitelisting", "ID ақ-тізімін қолдану"),
+        ("id_whitelist_tip", "Маған тек ақ-тізімделген ID қол жеткізе алады"),
+        ("id_whitelist_wildcard_tip", "Қойылмалы таңбаларға қолдау көрсетіледі: '*' кез келген таңба санына, '?' дәл бір таңбаға сәйкес келеді"),
+        ("Invalid ID", "Бұрыс ID"),
+        ("Your ID is blocked by the peer", "Сіздің ID қарсы тараппен бұғатталған"),
+        ("Your ip is blocked by the peer", "Сіздің IP-мекенжайыңыз қарсы тараппен бұғатталған"),
+        ("id_whitelist_caveat_tip", "ID қосылатын клиентпен хабарланады. Ақ-тізім әсер ету аумағын азайтады және құпия сөзді немесе 2FA-ны алмастырмайды"),
+        ("whitelist_cidr_tip", "CIDR жазбасына қолдау көрсетіледі, мысалы 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/lt.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Visi monitoriai"),
         ("#{} monitor", "Monitorius {}"),
         ("conn-e2ee-unavailable-tip", "Nepavyko patikrinti galinio šifravimo.\nNuotolinis įrenginys galbūt vis dar nustatomas. Bandykite dar kartą vėliau.\nJei tai kartojasi, serveris gali būti nepatikimas.\nVis tiek tęsti?"),
+        ("ID whitelisting", "ID baltasis sąrašas"),
+        ("Use ID whitelisting", "Naudoti patikimą ID sąrašą"),
+        ("id_whitelist_tip", "Mane gali pasiekti tik baltajame sąraše esantys ID"),
+        ("id_whitelist_wildcard_tip", "Palaikomi pakaitos simboliai: '*' atitinka bet kokį simbolių skaičių, '?' – lygiai vieną simbolį"),
+        ("Invalid ID", "Netinkamas ID"),
+        ("Your ID is blocked by the peer", "Jūsų ID užblokavo nuotolinis įrenginys"),
+        ("Your ip is blocked by the peer", "Jūsų IP adresą užblokavo nuotolinis įrenginys"),
+        ("id_whitelist_caveat_tip", "ID praneša prisijungiantis klientas. Šis sąrašas sumažina atakos paviršių ir nepakeičia slaptažodžio ar 2FA"),
+        ("whitelist_cidr_tip", "Palaikomas CIDR žymėjimas, pavyzdžiui 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/lv.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Visi monitori"),
         ("#{} monitor", "Monitors {}"),
         ("conn-e2ee-unavailable-tip", "Neizdevās pārbaudīt pilnīgu šifrēšanu.\nAttālā ierīce, iespējams, vēl tiek iestatīta. Mēģiniet vēlreiz vēlāk.\nJa tas turpinās, serveris var nebūt uzticams.\nVai tomēr turpināt?"),
+        ("ID whitelisting", "ID baltais saraksts"),
+        ("Use ID whitelisting", "Izmantot balto ID sarakstu"),
+        ("id_whitelist_tip", "Man var piekļūt tikai baltajā sarakstā iekļautie ID"),
+        ("id_whitelist_wildcard_tip", "Tiek atbalstītas aizstājzīmes: '*' atbilst jebkuram rakstzīmju skaitam, '?' — tieši vienai rakstzīmei"),
+        ("Invalid ID", "Nederīgs ID"),
+        ("Your ID is blocked by the peer", "Jūsu ID ir bloķējusi otra puse"),
+        ("Your ip is blocked by the peer", "Jūsu IP adresi ir bloķējusi otra puse"),
+        ("id_whitelist_caveat_tip", "ID paziņo klients, kas veido savienojumu. Baltais saraksts samazina pakļautību un neaizstāj paroli vai 2FA"),
+        ("whitelist_cidr_tip", "Tiek atbalstīts CIDR pieraksts, piemēram 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/ml.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "എല്ലാ മോണിറ്ററുകളും"),
         ("#{} monitor", "മോണിറ്റർ {}"),
         ("conn-e2ee-unavailable-tip", "എൻഡ്-ടു-എൻഡ് എൻക്രിപ്ഷൻ പരിശോധിക്കാൻ കഴിഞ്ഞില്ല.\nദൂരസ്ഥ ഉപകരണം ഇനിയും സജ്ജീകരണത്തിലായിരിക്കാം. പിന്നീട് വീണ്ടും ശ്രമിക്കുക.\nഇത് തുടർന്നാൽ സർവർ വിശ്വസനീയമല്ലായിരിക്കാം.\nഎങ്കിലും തുടരണമോ?"),
+        ("ID whitelisting", "ID വൈറ്റ്‌ലിസ്റ്റിംഗ്"),
+        ("Use ID whitelisting", "ID വൈറ്റ്‌ലിസ്റ്റിംഗ് ഉപയോഗിക്കുക"),
+        ("id_whitelist_tip", "വൈറ്റ്‌ലിസ്റ്റ് ചെയ്ത ID-കൾക്ക് മാത്രമേ എന്നെ ആക്‌സസ് ചെയ്യാൻ കഴിയൂ"),
+        ("id_whitelist_wildcard_tip", "വൈൽഡ്കാർഡുകൾ പിന്തുണയ്ക്കുന്നു: '*' എത്ര അക്ഷരങ്ങളുമായും, '?' കൃത്യം ഒരു അക്ഷരവുമായും പൊരുത്തപ്പെടുന്നു"),
+        ("Invalid ID", "അസാധുവായ ID"),
+        ("Your ID is blocked by the peer", "നിങ്ങളുടെ ID മറുവശം ബ്ലോക്ക് ചെയ്തിരിക്കുന്നു"),
+        ("Your ip is blocked by the peer", "നിങ്ങളുടെ IP വിലാസം മറുവശം ബ്ലോക്ക് ചെയ്തിരിക്കുന്നു"),
+        ("id_whitelist_caveat_tip", "കണക്റ്റ് ചെയ്യുന്ന ക്ലയന്റാണ് ID റിപ്പോർട്ട് ചെയ്യുന്നത്. വൈറ്റ്‌ലിസ്റ്റ് എക്സ്പോഷർ കുറയ്ക്കുന്നു; പാസ്‌വേഡിനോ 2FA-യ്ക്കോ പകരമല്ല"),
+        ("whitelist_cidr_tip", "CIDR നൊട്ടേഷൻ പിന്തുണയ്ക്കുന്നു, ഉദാഹരണത്തിന് 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/nb.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Alle skjermer"),
         ("#{} monitor", "Skjerm {}"),
         ("conn-e2ee-unavailable-tip", "Ende-til-ende-kryptering kunne ikke verifiseres.\nDen eksterne enheten kan fortsatt være under oppsett. Prøv igjen senere.\nHvis dette fortsetter, kan serveren være upålitelig.\nFortsette likevel?"),
+        ("ID whitelisting", "ID-hvitelisting"),
+        ("Use ID whitelisting", "Bruk ID-hvitelisting"),
+        ("id_whitelist_tip", "Kun ID-er på hvitelisten kan få adgang til meg"),
+        ("id_whitelist_wildcard_tip", "Jokertegn støttes: '*' samsvarer med et hvilket som helst antall tegn, '?' med nøyaktig ett tegn"),
+        ("Invalid ID", "Ugyldig ID"),
+        ("Your ID is blocked by the peer", "ID-en din er blokkert av motparten"),
+        ("Your ip is blocked by the peer", "IP-adressen din er blokkert av motparten"),
+        ("id_whitelist_caveat_tip", "ID-en rapporteres av klienten som kobler til. Hvitelisten reduserer eksponeringen og erstatter ikke passord eller 2FA"),
+        ("whitelist_cidr_tip", "CIDR-notasjon støttes, for eksempel 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/nl.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Alle monitoren"),
         ("#{} monitor", "Monitor {}"),
         ("conn-e2ee-unavailable-tip", "End-to-endversleuteling kon niet worden geverifieerd.\nHet externe apparaat wordt mogelijk nog ingesteld. Probeer het later opnieuw.\nAls dit blijft gebeuren, is de server mogelijk niet vertrouwd.\nToch doorgaan?"),
+        ("ID whitelisting", "ID Witte Lijst"),
+        ("Use ID whitelisting", "Gebruik een witte lijst van ID's"),
+        ("id_whitelist_tip", "Alleen ID's op de witte lijst krijgen toegang tot mijn toestel"),
+        ("id_whitelist_wildcard_tip", "Jokertekens worden ondersteund: '*' komt overeen met een willekeurig aantal tekens, '?' met precies één teken"),
+        ("Invalid ID", "Ongeldig ID"),
+        ("Your ID is blocked by the peer", "Je ID is geblokkeerd door de andere partij"),
+        ("Your ip is blocked by the peer", "Je IP-adres is geblokkeerd door de andere partij"),
+        ("id_whitelist_caveat_tip", "Het ID wordt gemeld door de verbindende client. De witte lijst vermindert blootstelling en vervangt het wachtwoord of 2FA niet"),
+        ("whitelist_cidr_tip", "CIDR-notatie wordt ondersteund, bijvoorbeeld 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/pl.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Wszystkie ekrany"),
         ("#{} monitor", "Ekran {}"),
         ("conn-e2ee-unavailable-tip", "Nie można zweryfikować szyfrowania end-to-end.\nUrządzenie zdalne może nadal się konfigurować. Spróbuj ponownie później.\nJeśli problem będzie się powtarzał, serwer może być niezaufany.\nKontynuować mimo to?"),
+        ("ID whitelisting", "Biała lista ID"),
+        ("Use ID whitelisting", "Użyj białej listy ID"),
+        ("id_whitelist_tip", "Zezwalaj na łączenie z tym komputerem tylko z ID znajdujących się na białej liście"),
+        ("id_whitelist_wildcard_tip", "Obsługiwane są symbole wieloznaczne: '*' odpowiada dowolnej liczbie znaków, '?' dokładnie jednemu znakowi"),
+        ("Invalid ID", "Nieprawidłowe ID"),
+        ("Your ID is blocked by the peer", "Twoje ID zostało zablokowane przez drugą stronę"),
+        ("Your ip is blocked by the peer", "Twój adres IP został zablokowany przez drugą stronę"),
+        ("id_whitelist_caveat_tip", "ID jest zgłaszane przez łączącego się klienta. Biała lista zmniejsza ekspozycję i nie zastępuje hasła ani 2FA"),
+        ("whitelist_cidr_tip", "Obsługiwana jest notacja CIDR, na przykład 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/pt_PT.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Todos os monitores"),
         ("#{} monitor", "Monitor {}"),
         ("conn-e2ee-unavailable-tip", "Não foi possível verificar a encriptação de ponta a ponta.\nO dispositivo remoto ainda pode estar a ser configurado. Tente novamente mais tarde.\nSe isto continuar a acontecer, o servidor pode não ser fidedigno.\nContinuar mesmo assim?"),
+        ("ID whitelisting", "Whitelist de ID"),
+        ("Use ID whitelisting", "Usar whitelist de ID"),
+        ("id_whitelist_tip", "Somente IDs na whitelist podem me acessar"),
+        ("id_whitelist_wildcard_tip", "São suportados carateres universais: '*' corresponde a qualquer número de carateres, '?' a exatamente um caráter"),
+        ("Invalid ID", "ID inválido"),
+        ("Your ID is blocked by the peer", "O seu ID está bloqueado pelo dispositivo remoto"),
+        ("Your ip is blocked by the peer", "O seu IP está bloqueado pelo dispositivo remoto"),
+        ("id_whitelist_caveat_tip", "O ID é comunicado pelo cliente que se liga. A whitelist reduz a exposição e não substitui a palavra-passe nem o 2FA"),
+        ("whitelist_cidr_tip", "A notação CIDR é suportada, por exemplo 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/ptbr.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Todas as telas"),
         ("#{} monitor", "Tela {}"),
         ("conn-e2ee-unavailable-tip", "Não foi possível verificar a criptografia de ponta a ponta.\nO dispositivo remoto ainda pode estar sendo configurado. Tente novamente mais tarde.\nSe isso continuar acontecendo, o servidor pode não ser confiável.\nContinuar mesmo assim?"),
+        ("ID whitelisting", "Lista de IDs permitidos"),
+        ("Use ID whitelisting", "Utilizar lista de IDs permitidos"),
+        ("id_whitelist_tip", "Somente IDs confiáveis podem me acessar"),
+        ("id_whitelist_wildcard_tip", "Curingas são suportados: '*' corresponde a qualquer número de caracteres, '?' a exatamente um caractere"),
+        ("Invalid ID", "ID inválido"),
+        ("Your ID is blocked by the peer", "Seu ID foi bloqueado pelo dispositivo remoto"),
+        ("Your ip is blocked by the peer", "Seu IP foi bloqueado pelo dispositivo remoto"),
+        ("id_whitelist_caveat_tip", "O ID é informado pelo cliente que se conecta. A lista reduz a exposição e não substitui a senha ou o 2FA"),
+        ("whitelist_cidr_tip", "A notação CIDR é suportada, por exemplo 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/ro.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Toate monitoarele"),
         ("#{} monitor", "Monitor {}"),
         ("conn-e2ee-unavailable-tip", "Criptarea end-to-end nu a putut fi verificată.\nDispozitivul la distanță poate fi încă în curs de configurare. Încercați din nou mai târziu.\nDacă acest lucru continuă, serverul poate să nu fie de încredere.\nContinuați oricum?"),
+        ("ID whitelisting", "Listă de ID-uri autorizate"),
+        ("Use ID whitelisting", "Folosește lista de ID-uri autorizate"),
+        ("id_whitelist_tip", "Doar ID-urile autorizate pot accesa acest dispozitiv"),
+        ("id_whitelist_wildcard_tip", "Sunt acceptate metacaractere: '*' corespunde oricărui număr de caractere, '?' exact unui caracter"),
+        ("Invalid ID", "ID nevalid"),
+        ("Your ID is blocked by the peer", "ID-ul tău este blocat de dispozitivul de la distanță"),
+        ("Your ip is blocked by the peer", "Adresa ta IP este blocată de dispozitivul de la distanță"),
+        ("id_whitelist_caveat_tip", "ID-ul este raportat de clientul care se conectează. Lista albă reduce expunerea și nu înlocuiește parola sau 2FA"),
+        ("whitelist_cidr_tip", "Notația CIDR este acceptată, de exemplu 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/ru.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Все мониторы"),
         ("#{} monitor", "Монитор {}"),
         ("conn-e2ee-unavailable-tip", "Не удалось проверить сквозное шифрование.\nУдаленное устройство, возможно, еще настраивается. Повторите попытку позже.\nЕсли это повторяется, сервер может быть ненадежным.\nВсе равно продолжить?"),
+        ("ID whitelisting", "Список разрешённых ID"),
+        ("Use ID whitelisting", "Использовать белый список ID"),
+        ("id_whitelist_tip", "Только ID из белого списка могут получить доступ к моему устройству."),
+        ("id_whitelist_wildcard_tip", "Поддерживаются подстановочные знаки: '*' соответствует любому количеству символов, '?' — ровно одному символу"),
+        ("Invalid ID", "Неправильный ID"),
+        ("Your ID is blocked by the peer", "Ваш ID заблокирован удалённым устройством"),
+        ("Your ip is blocked by the peer", "Ваш IP-адрес заблокирован удалённым устройством"),
+        ("id_whitelist_caveat_tip", "ID сообщается подключающимся клиентом. Белый список уменьшает поверхность атаки и не заменяет пароль или 2FA"),
+        ("whitelist_cidr_tip", "Поддерживается нотация CIDR, например 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/sc.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Totu sos ischermos"),
         ("#{} monitor", "Ischermu {}"),
         ("conn-e2ee-unavailable-tip", "No est istadu possìbile verificare sa tzifratzione de punta a punta.\nSu dispositivu remotu podet èssere ancora in fase de configuratzione. Torra a proare prus a tardu.\nSi custu sighit a acontèssere, su server podet non èssere fidadu.\nBoles sighire comente siat?"),
+        ("ID whitelisting", "ID autorizados"),
+        ("Use ID whitelisting", "Imprea elencu ID autorizados"),
+        ("id_whitelist_tip", "Si podent connètere a custa iscrivania petzi sos ID autorizados"),
+        ("id_whitelist_wildcard_tip", "Sos caràteres jolly sunt suportados: '*' currispondet a cale si siat nùmeru de caràteres, '?' a unu caràtere ebbia"),
+        ("Invalid ID", "ID non vàlidu"),
+        ("Your ID is blocked by the peer", "S'ID tuo est blocadu dae s'àtera parte"),
+        ("Your ip is blocked by the peer", "S'indiritzu IP tuo est blocadu dae s'àtera parte"),
+        ("id_whitelist_caveat_tip", "S'ID est decraradu dae su cliente chi si connetet. Custu elencu minimat s'espositzione e non sostituit sa crae o su 2FA"),
+        ("whitelist_cidr_tip", "Sa notatzione CIDR est suportada, pro esempru 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/sk.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Všetky monitory"),
         ("#{} monitor", "Monitor {}"),
         ("conn-e2ee-unavailable-tip", "Nepodarilo sa overiť koncové šifrovanie.\nVzdialené zariadenie sa možno stále nastavuje. Skúste to znova neskôr.\nAk sa to bude opakovať, server nemusí byť dôveryhodný.\nNapriek tomu pokračovať?"),
+        ("ID whitelisting", "Zoznam povolených ID"),
+        ("Use ID whitelisting", "Použiť ID whitelisting"),
+        ("id_whitelist_tip", "Len vymenované ID majú oprávnenie sa pripojiť k vzdialenej správe"),
+        ("id_whitelist_wildcard_tip", "Podporované sú zástupné znaky: '*' zodpovedá ľubovoľnému počtu znakov, '?' presne jednému znaku"),
+        ("Invalid ID", "Neplatné ID"),
+        ("Your ID is blocked by the peer", "Vaše ID je blokované protistranou"),
+        ("Your ip is blocked by the peer", "Vaša IP adresa je blokovaná protistranou"),
+        ("id_whitelist_caveat_tip", "ID nahlasuje pripájajúci sa klient. Tento zoznam znižuje vystavenie a nenahrádza heslo ani 2FA"),
+        ("whitelist_cidr_tip", "Je podporovaný zápis CIDR, napríklad 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/sl.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Vsi zasloni"),
         ("#{} monitor", "Zaslon {}"),
         ("conn-e2ee-unavailable-tip", "Šifriranja od konca do konca ni bilo mogoče preveriti.\nOddaljena naprava se morda še nastavlja. Poskusite znova pozneje.\nČe se to še naprej dogaja, strežnik morda ni zaupanja vreden.\nVseeno nadaljevati?"),
+        ("ID whitelisting", "Seznam dovoljenih ID-jev"),
+        ("Use ID whitelisting", "Omogoči seznam dovoljenih ID-jev"),
+        ("id_whitelist_tip", "Dostop je možen samo z dovoljenih ID-jev"),
+        ("id_whitelist_wildcard_tip", "Podprti so nadomestni znaki: '*' ustreza poljubnemu številu znakov, '?' natanko enemu znaku"),
+        ("Invalid ID", "Neveljaven ID"),
+        ("Your ID is blocked by the peer", "Vaš ID je blokirala oddaljena naprava"),
+        ("Your ip is blocked by the peer", "Vaš IP je blokirala oddaljena naprava"),
+        ("id_whitelist_caveat_tip", "ID sporoči odjemalec, ki se povezuje. Seznam zmanjšuje izpostavljenost in ne nadomešča gesla ali 2FA"),
+        ("whitelist_cidr_tip", "Podprt je zapis CIDR, na primer 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/sq.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Të gjithë monitorët"),
         ("#{} monitor", "Monitori {}"),
         ("conn-e2ee-unavailable-tip", "Enkriptimi nga skaji në skaj nuk mund të verifikohej.\nPajisja e largët mund të jetë ende duke u konfiguruar. Provoni përsëri më vonë.\nNëse kjo vazhdon të ndodhë, serveri mund të mos jetë i besueshëm.\nTë vazhdohet gjithsesi?"),
+        ("ID whitelisting", "Lista e bardhë e ID-ve"),
+        ("Use ID whitelisting", "Përdor listën e bardhë të ID-ve"),
+        ("id_whitelist_tip", "Vetëm ID-të e listës së bardhë mund të më aksesojnë."),
+        ("id_whitelist_wildcard_tip", "Mbështeten karakteret zëvendësuese: '*' përputhet me çdo numër karakteresh, '?' me saktësisht një karakter"),
+        ("Invalid ID", "ID e pavlefshme"),
+        ("Your ID is blocked by the peer", "ID-ja juaj është bllokuar nga pala tjetër"),
+        ("Your ip is blocked by the peer", "IP-ja juaj është bllokuar nga pala tjetër"),
+        ("id_whitelist_caveat_tip", "ID-ja raportohet nga klienti që lidhet. Lista e bardhë zvogëlon ekspozimin dhe nuk zëvendëson fjalëkalimin ose 2FA"),
+        ("whitelist_cidr_tip", "Mbështetet shënimi CIDR, për shembull 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/sr.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Svi monitori"),
         ("#{} monitor", "Monitor {}"),
         ("conn-e2ee-unavailable-tip", "Није могуће проверити енд-то-енд шифровање.\nУдаљени уређај се можда још подешава. Покушајте поново касније.\nАко се ово настави, сервер можда није поуздан.\nНаставити свеједно?"),
+        ("ID whitelisting", "ID pouzdana lista"),
+        ("Use ID whitelisting", "Koristi listu pouzdanih ID"),
+        ("id_whitelist_tip", "Samo dozvoljeni ID mi mogu pristupiti"),
+        ("id_whitelist_wildcard_tip", "Podržani su džoker znakovi: '*' odgovara bilo kom broju znakova, '?' tačno jednom znaku"),
+        ("Invalid ID", "Nevažeći ID"),
+        ("Your ID is blocked by the peer", "Vaš ID je blokirala druga strana"),
+        ("Your ip is blocked by the peer", "Vašu IP adresu je blokirala druga strana"),
+        ("id_whitelist_caveat_tip", "ID prijavljuje klijent koji se povezuje. Ova lista smanjuje izloženost i ne zamenjuje lozinku ni 2FA"),
+        ("whitelist_cidr_tip", "Podržan je CIDR zapis, na primer 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/sv.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Alla skärmar"),
         ("#{} monitor", "Skärm {}"),
         ("conn-e2ee-unavailable-tip", "End-to-end-kryptering kunde inte verifieras.\nFjärrenheten kan fortfarande konfigureras. Försök igen senare.\nOm detta fortsätter kan servern vara opålitlig.\nFortsätta ändå?"),
+        ("ID whitelisting", "ID-vitlistning"),
+        ("Use ID whitelisting", "Använd ID-vitlistning"),
+        ("id_whitelist_tip", "Bara vitlistade ID:n kan koppla upp till mig"),
+        ("id_whitelist_wildcard_tip", "Jokertecken stöds: '*' matchar valfritt antal tecken, '?' matchar exakt ett tecken"),
+        ("Invalid ID", "Ogiltigt ID"),
+        ("Your ID is blocked by the peer", "Ditt ID är blockerat av motparten"),
+        ("Your ip is blocked by the peer", "Din IP-adress är blockerad av motparten"),
+        ("id_whitelist_caveat_tip", "ID:t rapporteras av klienten som ansluter. Vitlistan minskar exponeringen och ersätter inte lösenord eller 2FA"),
+        ("whitelist_cidr_tip", "CIDR-notation stöds, till exempel 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/ta.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "அனைத்து மானிட்டர்களும்"),
         ("#{} monitor", "மானிட்டர் {}"),
         ("conn-e2ee-unavailable-tip", "முடிவு-முதல்-முடிவு குறியாக்கத்தை சரிபார்க்க முடியவில்லை.\nதொலை சாதனம் இன்னும் அமைக்கப்பட்டுக் கொண்டிருக்கலாம். பின்னர் மீண்டும் முயற்சிக்கவும்.\nஇது தொடர்ந்து நடந்தால், சேவையகம் நம்பகமற்றதாக இருக்கலாம்.\nஎப்படியும் தொடரவா?"),
+        ("ID whitelisting", "ID அனுமதிப்பட்டியல்"),
+        ("Use ID whitelisting", "ID அனுமதிப்பட்டியலைப் பயன்படுத்து"),
+        ("id_whitelist_tip", "அனுமதிப்பட்டியலில் உள்ள ID-கள் மட்டுமே என்னை அணுக முடியும்"),
+        ("id_whitelist_wildcard_tip", "வைல்டு கார்டுகள் ஆதரிக்கப்படுகின்றன: '*' எத்தனை எழுத்துகளுக்கும், '?' சரியாக ஒரு எழுத்துக்கும் பொருந்தும்"),
+        ("Invalid ID", "தவறான ID"),
+        ("Your ID is blocked by the peer", "உங்கள் ID மறுமுனையால் தடுக்கப்பட்டுள்ளது"),
+        ("Your ip is blocked by the peer", "உங்கள் IP முகவரி மறுமுனையால் தடுக்கப்பட்டுள்ளது"),
+        ("id_whitelist_caveat_tip", "இணைக்கும் கிளையண்டே ID-ஐ தெரிவிக்கிறது. அனுமதிப்பட்டியல் வெளிப்பாட்டைக் குறைக்கிறது; கடவுச்சொல் அல்லது 2FA-க்கு மாற்றாகாது"),
+        ("whitelist_cidr_tip", "CIDR குறியீடு ஆதரிக்கப்படுகிறது, எடுத்துக்காட்டாக 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/template.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", ""),
         ("#{} monitor", ""),
         ("conn-e2ee-unavailable-tip", ""),
+        ("ID whitelisting", ""),
+        ("Use ID whitelisting", ""),
+        ("id_whitelist_tip", ""),
+        ("id_whitelist_wildcard_tip", ""),
+        ("Invalid ID", ""),
+        ("Your ID is blocked by the peer", ""),
+        ("Your ip is blocked by the peer", ""),
+        ("id_whitelist_caveat_tip", ""),
+        ("whitelist_cidr_tip", ""),
     ].iter().cloned().collect();
 }

src/lang/th.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "จอภาพทั้งหมด"),
         ("#{} monitor", "จอภาพ {}"),
         ("conn-e2ee-unavailable-tip", "ไม่สามารถยืนยันการเข้ารหัสแบบต้นทางถึงปลายทางได้\nอุปกรณ์ระยะไกลอาจยังอยู่ระหว่างการตั้งค่า โปรดลองอีกครั้งภายหลัง\nหากปัญหานี้ยังเกิดขึ้นต่อไป เซิร์ฟเวอร์อาจไม่น่าเชื่อถือ\nต้องการดำเนินการต่อหรือไม่?"),
+        ("ID whitelisting", "ID ไวท์ลิสต์"),
+        ("Use ID whitelisting", "ใช้งาน ID ไวท์ลิสต์"),
+        ("id_whitelist_tip", "อนุญาตเฉพาะการเชื่อมต่อจาก ID ที่ไวท์ลิสต์"),
+        ("id_whitelist_wildcard_tip", "รองรับสัญลักษณ์แทน: '*' แทนอักขระจำนวนเท่าใดก็ได้, '?' แทนอักขระหนึ่งตัวพอดี"),
+        ("Invalid ID", "ID ไม่ถูกต้อง"),
+        ("Your ID is blocked by the peer", "ID ของคุณถูกบล็อกโดยฝั่งตรงข้าม"),
+        ("Your ip is blocked by the peer", "IP ของคุณถูกบล็อกโดยฝั่งตรงข้าม"),
+        ("id_whitelist_caveat_tip", "ID ถูกรายงานโดยไคลเอนต์ที่เชื่อมต่อ ไวท์ลิสต์ช่วยลดการเปิดเผยและไม่สามารถใช้แทนรหัสผ่านหรือ 2FA ได้"),
+        ("whitelist_cidr_tip", "รองรับรูปแบบ CIDR เช่น 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/tr.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Tüm monitörler"),
         ("#{} monitor", "Monitör {}"),
         ("conn-e2ee-unavailable-tip", "Uçtan uca şifreleme doğrulanamadı.\nUzak cihaz hâlâ kuruluyor olabilir. Daha sonra tekrar deneyin.\nBu sorun devam ederse sunucu güvenilir olmayabilir.\nYine de devam edilsin mi?"),
+        ("ID whitelisting", "İzinli ID listesi"),
+        ("Use ID whitelisting", "İzinli ID listesini kullan"),
+        ("id_whitelist_tip", "Bu masaüstüne yalnızca izinli ID'ler bağlanabilir"),
+        ("id_whitelist_wildcard_tip", "Joker karakterler desteklenir: '*' herhangi bir sayıda karakterle, '?' tam olarak bir karakterle eşleşir"),
+        ("Invalid ID", "Geçersiz ID"),
+        ("Your ID is blocked by the peer", "ID'niz karşı taraf tarafından engellendi"),
+        ("Your ip is blocked by the peer", "IP adresiniz karşı taraf tarafından engellendi"),
+        ("id_whitelist_caveat_tip", "ID, bağlanan istemci tarafından bildirilir. Bu liste maruziyeti azaltır; parolanın veya 2FA'nın yerini tutmaz"),
+        ("whitelist_cidr_tip", "CIDR gösterimi desteklenir, örneğin 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/tw.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "所有顯示器"),
         ("#{} monitor", "{}號顯示器"),
         ("conn-e2ee-unavailable-tip", "無法驗證端對端加密。\n遠端裝置可能仍在準備中，請稍後重試。\n如果此問題持續發生，伺服器可能不受信任。\n仍要繼續嗎？"),
+        ("ID whitelisting", "ID 白名單"),
+        ("Use ID whitelisting", "只允許白名單上的 ID 進行連線"),
+        ("id_whitelist_tip", "只有白名單上的 ID 可以存取"),
+        ("id_whitelist_wildcard_tip", "支援萬用字元：'*' 符合任意數量的字元，'?' 符合單一字元"),
+        ("Invalid ID", "ID 無效"),
+        ("Your ID is blocked by the peer", "你的 ID 已被對方封鎖"),
+        ("Your ip is blocked by the peer", "你的 IP 已被對方封鎖"),
+        ("id_whitelist_caveat_tip", "ID 由對端用戶端回報，白名單用於減少暴露面，不能取代密碼或 2FA"),
+        ("whitelist_cidr_tip", "支援 CIDR 寫法，例如 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/uk.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Усі монітори"),
         ("#{} monitor", "Монітор {}"),
         ("conn-e2ee-unavailable-tip", "Не вдалося перевірити наскрізне шифрування.\nВіддалений пристрій, можливо, ще налаштовується. Спробуйте пізніше.\nЯкщо це повторюється, сервер може бути ненадійним.\nПродовжити все одно?"),
+        ("ID whitelisting", "Список дозволених ID"),
+        ("Use ID whitelisting", "Використовувати білий список ID"),
+        ("id_whitelist_tip", "Лише ID з білого списку можуть отримати доступ до мене"),
+        ("id_whitelist_wildcard_tip", "Підтримуються символи підстановки: '*' відповідає будь-якій кількості символів, '?' — рівно одному символу"),
+        ("Invalid ID", "Неправильний ID"),
+        ("Your ID is blocked by the peer", "Ваш ID заблоковано віддаленим пристроєм"),
+        ("Your ip is blocked by the peer", "Вашу IP-адресу заблоковано віддаленим пристроєм"),
+        ("id_whitelist_caveat_tip", "ID повідомляється клієнтом, що підключається. Білий список зменшує поверхню атаки і не замінює пароль або 2FA"),
+        ("whitelist_cidr_tip", "Підтримується нотація CIDR, наприклад 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/lang/vi.rs

@@ -765,5 +765,14 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("All monitors", "Tất cả màn hình"),
         ("#{} monitor", "Màn hình {}"),
         ("conn-e2ee-unavailable-tip", "Không thể xác minh mã hóa đầu cuối.\nThiết bị từ xa có thể vẫn đang được thiết lập. Hãy thử lại sau.\nNếu điều này tiếp tục xảy ra, máy chủ có thể không đáng tin cậy.\nVẫn tiếp tục?"),
+        ("ID whitelisting", "Danh sách trắng ID"),
+        ("Use ID whitelisting", "Sử dụng danh sách trắng ID"),
+        ("id_whitelist_tip", "Chỉ ID trong danh sách trắng mới có thể truy cập"),
+        ("id_whitelist_wildcard_tip", "Hỗ trợ ký tự đại diện: '*' khớp với số lượng ký tự bất kỳ, '?' khớp với đúng một ký tự"),
+        ("Invalid ID", "ID không hợp lệ"),
+        ("Your ID is blocked by the peer", "ID của bạn đã bị phía bên kia chặn"),
+        ("Your ip is blocked by the peer", "IP của bạn đã bị phía bên kia chặn"),
+        ("id_whitelist_caveat_tip", "ID do máy khách kết nối tự khai báo. Danh sách trắng giúp giảm mức độ lộ diện và không thay thế mật khẩu hay 2FA"),
+        ("whitelist_cidr_tip", "Hỗ trợ ký hiệu CIDR, ví dụ 192.168.1.0/24"),
     ].iter().cloned().collect();
 }

src/server/connection.rs

@@ -73,8 +73,14 @@ use windows::Win32::Foundation::{CloseHandle, HANDLE};
 use crate::virtual_display_manager;
 pub type Sender = mpsc::UnboundedSender<(Instant, Arc<Message>)>;
 
+const FAILURE_IDX_ID_WHITELIST: usize = 2;
+
 lazy_static::lazy_static! {
-    static ref LOGIN_FAILURES: [Arc::<Mutex<HashMap<String, (i32, i32, i32)>>>; 2] = Default::default();
+    // [0] password, [1] 2FA, [2] ID whitelist.
+    // The ID whitelist has its own bucket: its counters never decay, and a peer rejected by
+    // it can never clear them with a successful login, so sharing the password bucket would
+    // let a rejected ID lock out whitelisted peers behind the same IP / IPv6 prefix.
+    static ref LOGIN_FAILURES: [Arc::<Mutex<HashMap<String, (i32, i32, i32)>>>; 3] = Default::default();
     static ref SESSIONS: Arc::<Mutex<HashMap<SessionKey, Session>>> = Default::default();
     static ref ALIVE_CONNS: Arc::<Mutex<Vec<i32>>> = Default::default();
     pub static ref AUTHED_CONNS: Arc::<Mutex<Vec<AuthedConn>>> = Default::default();
@@ -1373,6 +1379,32 @@ impl Connection {
         true
     }
 
+    async fn check_id_whitelist(&mut self) -> bool {
+        let id_whitelist: Vec<String> = Config::get_option(keys::OPTION_ID_WHITELIST)
+            .split(',')
+            .map(|x| x.trim().to_owned())
+            .filter(|x| !x.is_empty())
+            .collect();
+        if id_whitelist_allows(&id_whitelist, &self.lr.my_id) {
+            return true;
+        }
+        // Rate limit rejections so that the whitelist can not be used as an oracle to
+        // enumerate allowed IDs. Whitelisted peers return above without touching this
+        // bucket, so a rejected ID can not lock them out.
+        let (failure, res) = self.check_failure(FAILURE_IDX_ID_WHITELIST).await;
+        if !res {
+            return false;
+        }
+        self.update_failure(failure, false, FAILURE_IDX_ID_WHITELIST);
+        self.send_login_error("Your ID is blocked by the peer")
+            .await;
+        self.post_alarm_audit(
+            AlarmAuditType::IdWhitelist,
+            json!({ "id": self.lr.my_id.clone(), "ip": self.ip.clone(), "name": self.lr.my_name.clone() }),
+        );
+        false
+    }
+
     async fn on_open(&mut self, addr: SocketAddr) -> bool {
         log::debug!("#{} Connection opened from {}.", self.inner.id, addr);
         if !self.check_whitelist(&addr).await {
@@ -1506,7 +1538,7 @@ impl Connection {
         v["typ"] = json!(typ as i8);
         v["info"] = serde_json::Value::String(info.to_string());
         v["conn_id"] = json!(self.inner.id());
-        if typ == AlarmAuditType::IpWhitelist {
+        if typ == AlarmAuditType::IpWhitelist || typ == AlarmAuditType::IdWhitelist {
             if let Some(audit_ref) = self.conn_audit_ref() {
                 v["conn_audit_ref"] = json!(audit_ref);
             }
@@ -2528,6 +2560,9 @@ impl Connection {
                 return true;
             }
             self.reset_session_scope_for_login();
+            if !self.check_id_whitelist().await {
+                return false;
+            }
             match lr.union {
                 Some(login_request::Union::FileTransfer(ft)) => {
                     if !Self::permission(
@@ -2808,6 +2843,11 @@ impl Connection {
             #[cfg(not(any(target_os = "android", target_os = "ios")))]
             if let Some(lr) = _s.lr.clone().take() {
                 self.handle_login_request_without_validation(&lr).await;
+                // Switching sides authorizes without a password, so it must not bypass the
+                // whitelist, which can be a locked policy pushed by the server.
+                if !self.check_id_whitelist().await {
+                    return false;
+                }
                 SWITCH_SIDES_UUID
                     .lock()
                     .unwrap()
@@ -6057,6 +6097,7 @@ pub enum AlarmAuditType {
     TerminalOsLoginBackoff = 7,
     TerminalOsLoginConcurrency = 8,
     SessionScopeViolation = 9,
+    IdWhitelist = 10,
 }
 
 pub enum FileAuditType {
@@ -6674,11 +6715,144 @@ mod raii {
     }
 }
 
+// An empty whitelist allows everyone.
+//
+// A peer connecting across servers reports `<its id>@<its own server>` (see
+// `create_login_msg`), so the bare id is matched as well. That suffix is self-asserted and
+// unsigned, so matching only the full form would reject the honest cross-server peer while
+// an attacker just reports the bare id: it can produce false rejects but no true ones.
+fn id_whitelist_allows(id_whitelist: &[String], my_id: &str) -> bool {
+    if id_whitelist.is_empty() {
+        return true;
+    }
+    let bare_id = my_id.split('@').next().unwrap_or(my_id);
+    id_whitelist
+        .iter()
+        .any(|x| wildcard_match(x, my_id) || wildcard_match(x, bare_id))
+}
+
+// Simple glob matching for the ID whitelist: '*' matches any sequence of characters
+// (including the empty one), '?' matches exactly one character. Case-insensitive.
+fn wildcard_match(pattern: &str, text: &str) -> bool {
+    let p: Vec<char> = pattern.trim().to_lowercase().chars().collect();
+    let t: Vec<char> = text.trim().to_lowercase().chars().collect();
+    let (mut pi, mut ti) = (0, 0);
+    let mut star: Option<(usize, usize)> = None;
+    while ti < t.len() {
+        if pi < p.len() && (p[pi] == '?' || p[pi] == t[ti]) {
+            pi += 1;
+            ti += 1;
+        } else if pi < p.len() && p[pi] == '*' {
+            star = Some((pi + 1, ti));
+            pi += 1;
+        } else if let Some((sp, st)) = star {
+            pi = sp;
+            ti = st + 1;
+            star = Some((sp, st + 1));
+        } else {
+            return false;
+        }
+    }
+    while pi < p.len() && p[pi] == '*' {
+        pi += 1;
+    }
+    pi == p.len()
+}
+
 #[cfg(test)]
 mod test {
     #[allow(unused)]
     use super::*;
 
+    #[test]
+    fn test_wildcard_match() {
+        // Exact match.
+        assert!(wildcard_match("123456789", "123456789"));
+        assert!(!wildcard_match("123456789", "123456780"));
+        assert!(!wildcard_match("12345678", "123456789"));
+        assert!(!wildcard_match("123456789", "12345678"));
+        // Case-insensitive.
+        assert!(wildcard_match("MyCustomId", "mycustomid"));
+        // '*' matches any sequence.
+        assert!(wildcard_match("*", "123456789"));
+        assert!(wildcard_match("*", ""));
+        assert!(wildcard_match("123*", "123456789"));
+        assert!(wildcard_match("123*", "123"));
+        assert!(!wildcard_match("123*", "124456789"));
+        assert!(wildcard_match("*789", "123456789"));
+        assert!(wildcard_match("1*9", "123456789"));
+        assert!(wildcard_match("1*4*9", "123456789"));
+        assert!(!wildcard_match("1*4*9", "123456780"));
+        assert!(wildcard_match("*456*", "123456789"));
+        // '?' matches exactly one character.
+        assert!(wildcard_match("12345678?", "123456789"));
+        assert!(!wildcard_match("123456789?", "123456789"));
+        assert!(wildcard_match("???456???", "123456789"));
+        assert!(wildcard_match("1?3*7?9", "123456789"));
+        // Whitespace around entries is ignored.
+        assert!(wildcard_match(" 123456789 ", "123456789"));
+    }
+
+    #[test]
+    fn test_id_whitelist_allows() {
+        let list = |v: &[&str]| v.iter().map(|x| x.to_string()).collect::<Vec<_>>();
+
+        // An empty whitelist allows everyone.
+        assert!(id_whitelist_allows(&[], "123456789"));
+
+        // Same server: the peer reports a bare id.
+        assert!(id_whitelist_allows(&list(&["123456789"]), "123456789"));
+        assert!(!id_whitelist_allows(&list(&["123456789"]), "987654321"));
+
+        // Cross server: the peer appends its own server, which must not reject it.
+        assert!(id_whitelist_allows(
+            &list(&["123456789"]),
+            "123456789@example.com:21116"
+        ));
+        // Cross server from web, whose server is a WebSocket URI.
+        assert!(id_whitelist_allows(
+            &list(&["123456789"]),
+            "123456789@ws://example.com:21118"
+        ));
+        // A different id is still rejected, suffix or not.
+        assert!(!id_whitelist_allows(
+            &list(&["123456789"]),
+            "987654321@example.com:21116"
+        ));
+
+        // An entry pinned to one server keeps matching that exact form.
+        assert!(id_whitelist_allows(
+            &list(&["123456789@example.com:21116"]),
+            "123456789@example.com:21116"
+        ));
+        assert!(!id_whitelist_allows(
+            &list(&["123456789@example.com:21116"]),
+            "123456789@other.com:21116"
+        ));
+        // ... and no longer matches the bare id, which is the point of pinning.
+        assert!(!id_whitelist_allows(
+            &list(&["123456789@example.com:21116"]),
+            "123456789"
+        ));
+
+        // Wildcards keep working on both forms.
+        assert!(id_whitelist_allows(&list(&["abc*"]), "abcdef"));
+        assert!(id_whitelist_allows(
+            &list(&["abc*"]),
+            "abcdef@example.com:21116"
+        ));
+        assert!(id_whitelist_allows(
+            &list(&["*"]),
+            "123456789@example.com:21116"
+        ));
+
+        // Any entry of the list is enough.
+        assert!(id_whitelist_allows(
+            &list(&["111111111", "123456789", "222222222"]),
+            "123456789@example.com:21116"
+        ));
+    }
+
     #[cfg(target_os = "macos")]
     #[test]
     fn retina() {