feat: request approval (#16784)

* feat: add connections without sending passwords

Add Without password actions and pass the selection through desktop,
mobile and Web sessions. Omit the password when constructing LoginRequest,
preserve saved credentials, and reuse the existing approval and OS login
dialogs. Keep protocol and controlled-side authentication changes separate.

* fix: preserve login method across session windows

* fix: skip password persistence for consent connections

* refactor: unify request approval menus and naming

* chore: move request approval translation key to the end

* i18n: translate request approval menu label

* fix: align request approval menu layout and icons

* fix: avoid duplicate focus stops in request approval menus

* fix: distinguish request approval submenus on mobile

* fix: open overflowing submenus to the left

* Revert "fix: distinguish request approval submenus on mobile"

This reverts commit 7f0e50d4e4.

flutter/lib/common.dart

@@ -2286,6 +2286,7 @@ bool handleUriLink({List<String>? cmdArgs, Uri? uri, String? uriString}) {
   String? password;
   String? switchUuid;
   bool? forceRelay;
+  var loginMethod = '';
   for (int i = 0; i < args.length; i++) {
     switch (args[i]) {
       case '--connect':
@@ -2329,6 +2330,9 @@ bool handleUriLink({List<String>? cmdArgs, Uri? uri, String? uriString}) {
         password = args[i + 1];
         i++;
         break;
+      case '--request-approval':
+        loginMethod = 'request-approval';
+        break;
       case '--switch_uuid':
         switchUuid = args[i + 1];
         i++;
@@ -2340,11 +2344,15 @@ bool handleUriLink({List<String>? cmdArgs, Uri? uri, String? uriString}) {
         break;
     }
   }
+  if (loginMethod == 'request-approval') {
+    password = null;
+  }
   if (type != null && id != null) {
     switch (type) {
       case UriLinkType.remoteDesktop:
         Future.delayed(Duration.zero, () {
           rustDeskWinManager.newRemoteDesktop(id!,
+              loginMethod: loginMethod,
               password: password,
               switchUuid: switchUuid,
               forceRelay: forceRelay);
@@ -2353,30 +2361,35 @@ bool handleUriLink({List<String>? cmdArgs, Uri? uri, String? uriString}) {
       case UriLinkType.fileTransfer:
         Future.delayed(Duration.zero, () {
           rustDeskWinManager.newFileTransfer(id!,
+              loginMethod: loginMethod,
               password: password, forceRelay: forceRelay);
         });
         break;
       case UriLinkType.viewCamera:
         Future.delayed(Duration.zero, () {
           rustDeskWinManager.newViewCamera(id!,
+              loginMethod: loginMethod,
               password: password, forceRelay: forceRelay);
         });
         break;
       case UriLinkType.portForward:
         Future.delayed(Duration.zero, () {
           rustDeskWinManager.newPortForward(id!, false,
+              loginMethod: loginMethod,
               password: password, forceRelay: forceRelay);
         });
         break;
       case UriLinkType.rdp:
         Future.delayed(Duration.zero, () {
           rustDeskWinManager.newPortForward(id!, true,
+              loginMethod: loginMethod,
               password: password, forceRelay: forceRelay);
         });
         break;
       case UriLinkType.terminal:
         Future.delayed(Duration.zero, () {
           rustDeskWinManager.newTerminal(id!,
+              loginMethod: loginMethod,
               password: password, forceRelay: forceRelay);
         });
         break;
@@ -2473,6 +2486,10 @@ List<String>? urlLinkToCmdArgs(Uri uri) {
 
   var queryParameters =
       uri.queryParameters.map((k, v) => MapEntry(k.toLowerCase(), v));
+  final requestApproval = queryParameters['request-approval'] == 'true';
+  if (requestApproval) {
+    queryParameters.remove('password');
+  }
 
   var key = queryParameters["key"];
   if (id != null) {
@@ -2484,24 +2501,30 @@ List<String>? urlLinkToCmdArgs(Uri uri) {
   if (isMobile && id != null) {
     final forceRelay = queryParameters["relay"] != null;
     final password = queryParameters["password"];
+    final loginMethod = requestApproval ? 'request-approval' : '';
 
     // Determine connection type based on command
     if (command == '--file-transfer') {
       connect(Get.context!, id,
+          loginMethod: loginMethod,
           isFileTransfer: true, forceRelay: forceRelay, password: password);
     } else if (command == '--view-camera') {
       connect(Get.context!, id,
+          loginMethod: loginMethod,
           isViewCamera: true, forceRelay: forceRelay, password: password);
     } else if (command == '--terminal') {
       connect(Get.context!, id,
+          loginMethod: loginMethod,
           isTerminal: true, forceRelay: forceRelay, password: password);
-    } else if (command == 'terminal-admin') {
+    } else if (command == '--terminal-admin') {
       setEnvTerminalAdmin();
       connect(Get.context!, id,
+          loginMethod: loginMethod,
           isTerminal: true, forceRelay: forceRelay, password: password);
     } else {
       // Default to remote desktop for '--connect', '--play', or direct connection
-      connect(Get.context!, id, forceRelay: forceRelay, password: password);
+      connect(Get.context!, id,
+          loginMethod: loginMethod, forceRelay: forceRelay, password: password);
     }
     return null;
   }
@@ -2513,6 +2536,7 @@ List<String>? urlLinkToCmdArgs(Uri uri) {
     var param = queryParameters;
     String? password = param["password"];
     if (password != null) args.addAll(['--password', password]);
+    if (requestApproval) args.add('--request-approval');
     String? switch_uuid = param["switch_uuid"];
     if (switch_uuid != null) args.addAll(['--switch_uuid', switch_uuid]);
     if (param["relay"] != null) args.add("--relay");
@@ -2531,33 +2555,39 @@ connectMainDesktop(String id,
     bool? forceRelay,
     String? password,
     String? connToken,
-    bool? isSharedPassword}) async {
+    bool? isSharedPassword,
+    String loginMethod = ''}) async {
   if (isFileTransfer) {
     await rustDeskWinManager.newFileTransfer(id,
+        loginMethod: loginMethod,
         password: password,
         isSharedPassword: isSharedPassword,
         connToken: connToken,
         forceRelay: forceRelay);
   } else if (isViewCamera) {
     await rustDeskWinManager.newViewCamera(id,
+        loginMethod: loginMethod,
         password: password,
         isSharedPassword: isSharedPassword,
         connToken: connToken,
         forceRelay: forceRelay);
   } else if (isTcpTunneling || isRDP) {
     await rustDeskWinManager.newPortForward(id, isRDP,
+        loginMethod: loginMethod,
         password: password,
         isSharedPassword: isSharedPassword,
         connToken: connToken,
         forceRelay: forceRelay);
   } else if (isTerminal) {
     await rustDeskWinManager.newTerminal(id,
+        loginMethod: loginMethod,
         password: password,
         isSharedPassword: isSharedPassword,
         connToken: connToken,
         forceRelay: forceRelay);
   } else {
     await rustDeskWinManager.newRemoteDesktop(id,
+        loginMethod: loginMethod,
         password: password,
         isSharedPassword: isSharedPassword,
         forceRelay: forceRelay);
@@ -2578,7 +2608,8 @@ connect(BuildContext context, String id,
     bool forceRelay = false,
     String? password,
     String? connToken,
-    bool? isSharedPassword}) async {
+    bool? isSharedPassword,
+    String loginMethod = ''}) async {
   if (id == '') return;
   if (!isDesktop || desktopType == DesktopType.main) {
     try {
@@ -2603,6 +2634,7 @@ connect(BuildContext context, String id,
     if (desktopType == DesktopType.main) {
       await connectMainDesktop(
         id,
+        loginMethod: loginMethod,
         isFileTransfer: isFileTransfer,
         isViewCamera: isViewCamera,
         isTerminal: isTerminal,
@@ -2624,6 +2656,7 @@ connect(BuildContext context, String id,
         'isSharedPassword': isSharedPassword,
         'forceRelay': forceRelay,
         'connToken': connToken,
+        'loginMethod': loginMethod,
       });
     }
   } else {
@@ -2635,6 +2668,7 @@ connect(BuildContext context, String id,
             builder: (BuildContext context) =>
                 desktop_file_manager.FileManagerPage(
                     id: id,
+                    loginMethod: loginMethod,
                     password: password,
                     isSharedPassword: isSharedPassword),
           ),
@@ -2645,6 +2679,7 @@ connect(BuildContext context, String id,
           MaterialPageRoute(
             builder: (BuildContext context) => FileManagerPage(
                 id: id,
+                loginMethod: loginMethod,
                 password: password,
                 isSharedPassword: isSharedPassword,
                 forceRelay: forceRelay),
@@ -2660,6 +2695,7 @@ connect(BuildContext context, String id,
                 desktop_view_camera.ViewCameraPage(
               key: ValueKey(id),
               id: id,
+              loginMethod: loginMethod,
               toolbarState: ToolbarState(),
               password: password,
               isSharedPassword: isSharedPassword,
@@ -2672,6 +2708,7 @@ connect(BuildContext context, String id,
           MaterialPageRoute(
             builder: (BuildContext context) => ViewCameraPage(
                 id: id,
+                loginMethod: loginMethod,
                 password: password,
                 isSharedPassword: isSharedPassword,
                 forceRelay: forceRelay),
@@ -2684,6 +2721,7 @@ connect(BuildContext context, String id,
         MaterialPageRoute(
           builder: (BuildContext context) => TerminalPage(
             id: id,
+            loginMethod: loginMethod,
             password: password,
             isSharedPassword: isSharedPassword,
             forceRelay: forceRelay,
@@ -2698,6 +2736,7 @@ connect(BuildContext context, String id,
             builder: (BuildContext context) => desktop_remote.RemotePage(
               key: ValueKey(id),
               id: id,
+              loginMethod: loginMethod,
               toolbarState: ToolbarState(),
               password: password,
               isSharedPassword: isSharedPassword,
@@ -2710,6 +2749,7 @@ connect(BuildContext context, String id,
           MaterialPageRoute(
             builder: (BuildContext context) => RemotePage(
                 id: id,
+                loginMethod: loginMethod,
                 password: password,
                 isSharedPassword: isSharedPassword,
                 forceRelay: forceRelay),

flutter/lib/common/widgets/dialog.dart

@@ -937,13 +937,15 @@ void enterPasswordDialog(
 }
 
 void enterUserLoginDialog(SessionID sessionId,
-    OverlayDialogManager dialogManager, String osAccountDescTip) async {
+    OverlayDialogManager dialogManager, String osAccountDescTip,
+    {bool waitForAccept = false}) async {
   await _connectDialog(
     sessionId,
     dialogManager,
     osUsernameController: TextEditingController(),
     osPasswordController: TextEditingController(),
     osAccountDescTip: osAccountDescTip,
+    waitForAccept: waitForAccept,
   );
 }
 
@@ -966,6 +968,7 @@ _connectDialog(
   TextEditingController? osPasswordController,
   TextEditingController? passwordController,
   String? osAccountDescTip,
+  bool waitForAccept = false,
 }) async {
   final errUsername = ''.obs;
   var rememberPassword = false;
@@ -1008,8 +1011,17 @@ _connectDialog(
         rememberPassword,
       );
       close();
-      dialogManager.showLoading(translate('Logging in...'),
-          onCancel: closeConnection);
+      if (waitForAccept) {
+        showWaitAcceptDialog(
+            sessionId,
+            'wait-remote-accept-nook',
+            'Prompt',
+            'Please wait for the remote side to accept your session request...',
+            dialogManager);
+      } else {
+        dialogManager.showLoading(translate('Logging in...'),
+            onCancel: closeConnection);
+      }
     }
 
     descWidget(String text) {

flutter/lib/common/widgets/peer_card.dart

@@ -15,6 +15,7 @@ import '../../models/peer_model.dart';
 import '../../models/platform_model.dart';
 import '../../desktop/widgets/material_mod_popup_menu.dart' as mod_menu;
 import '../../desktop/widgets/popup_menu.dart';
+import 'request_approval_menu.dart';
 import 'dart:math' as math;
 
 typedef PopupMenuEntryBuilder = Future<List<mod_menu.PopupMenuEntry<String>>>
@@ -572,7 +573,36 @@ abstract class BasePeerCard extends StatelessWidget {
   @protected
   Future<List<MenuEntryBase<String>>> _buildMenuItems(BuildContext context);
 
-  MenuEntryBase<String> _connectCommonAction(
+  @protected
+  Future<List<MenuEntryBase<String>>> _buildConnectionMenuItems(
+      BuildContext context) async {
+    final List<MenuEntryBase<String>> menuItems = [
+      _connectAction(context),
+      _transferFileAction(context),
+      _viewCameraAction(context),
+      _terminalAction(context),
+    ];
+
+    if (peer.platform == kPeerPlatformWindows) {
+      menuItems.add(_terminalRunAsAdminAction(context));
+    }
+
+    if (isDesktop && peer.platform != kPeerPlatformAndroid) {
+      menuItems.add(_tcpTunnelingAction(context));
+    }
+    if (isWindows && peer.platform == kPeerPlatformWindows) {
+      menuItems.add(_rdpAction(context, peer.id));
+    }
+    menuItems.add(MenuEntryDivider<String>());
+    menuItems.add(_requestApprovalAction(context));
+    // menuItems.add(await _openNewConnInOptAction(peer.id));
+    if (!isWeb) {
+      menuItems.add(await _forceAlwaysRelayAction(peer.id));
+    }
+    return menuItems;
+  }
+
+  MenuEntryButton<String> _connectCommonAction(
     BuildContext context,
     String title, {
     bool isFileTransfer = false,
@@ -581,12 +611,10 @@ abstract class BasePeerCard extends StatelessWidget {
     bool isRDP = false,
     bool isTerminal = false,
     bool isTerminalRunAsAdmin = false,
+    String loginMethod = '',
   }) {
     return MenuEntryButton<String>(
-      childBuilder: (TextStyle? style) => Text(
-        title,
-        style: style,
-      ),
+      childBuilder: (TextStyle? style) => Text(title, style: style),
       proc: () {
         if (isTerminalRunAsAdmin) {
           setEnvTerminalAdmin();
@@ -600,6 +628,7 @@ abstract class BasePeerCard extends StatelessWidget {
           isTcpTunneling: isTcpTunneling,
           isRDP: isRDP,
           isTerminal: isTerminal || isTerminalRunAsAdmin,
+          loginMethod: loginMethod,
         );
       },
       padding: menuPadding,
@@ -607,13 +636,53 @@ abstract class BasePeerCard extends StatelessWidget {
     );
   }
 
+  MenuEntryBase<String> _requestApprovalAction(BuildContext context) {
+    MenuEntryButton<String> action(String title,
+            {bool isFileTransfer = false,
+            bool isViewCamera = false,
+            bool isTcpTunneling = false,
+            bool isRDP = false,
+            bool isTerminal = false,
+            bool isTerminalRunAsAdmin = false}) =>
+        _connectCommonAction(
+          context,
+          isTerminal || isTerminalRunAsAdmin
+              ? '${translate(title)} (beta)'
+              : translate(title),
+          isFileTransfer: isFileTransfer,
+          isViewCamera: isViewCamera,
+          isTcpTunneling: isTcpTunneling,
+          isRDP: isRDP,
+          isTerminal: isTerminal,
+          isTerminalRunAsAdmin: isTerminalRunAsAdmin,
+          loginMethod: 'request-approval',
+        );
+
+    return RequestApprovalMenu(
+      title: translate('Request approval'),
+      padding: menuPadding,
+      entries: [
+        action('Connect'),
+        action('Transfer file', isFileTransfer: true),
+        action('View camera', isViewCamera: true),
+        action('Terminal', isTerminal: true),
+        if (peer.platform == kPeerPlatformWindows)
+          action('Terminal (Run as administrator)', isTerminalRunAsAdmin: true),
+        if (isDesktop && peer.platform != kPeerPlatformAndroid)
+          action('TCP tunneling', isTcpTunneling: true),
+        if (isWindows && peer.platform == kPeerPlatformWindows)
+          action('RDP', isRDP: true),
+      ],
+    );
+  }
+
   @protected
   MenuEntryBase<String> _connectAction(BuildContext context) {
     return _connectCommonAction(
       context,
-      (peer.alias.isEmpty
+      peer.alias.isEmpty
           ? translate('Connect')
-          : '${translate('Connect')} ${peer.id}'),
+          : '${translate('Connect')} ${peer.id}',
     );
   }
 
@@ -682,6 +751,10 @@ abstract class BasePeerCard extends StatelessWidget {
                     child: IconButton(
                       icon: const Icon(Icons.edit),
                       padding: EdgeInsets.zero,
+                      constraints: const BoxConstraints(
+                        minWidth: kMinInteractiveDimension - 8,
+                        minHeight: kMinInteractiveDimension,
+                      ),
                       onPressed: () {
                         if (Navigator.canPop(context)) {
                           Navigator.pop(context);
@@ -1000,33 +1073,13 @@ class RecentPeerCard extends BasePeerCard {
   @override
   Future<List<MenuEntryBase<String>>> _buildMenuItems(
       BuildContext context) async {
-    final List<MenuEntryBase<String>> menuItems = [
-      _connectAction(context),
-      _transferFileAction(context),
-      _viewCameraAction(context),
-      _terminalAction(context),
-    ];
-
-    if (peer.platform == kPeerPlatformWindows) {
-      menuItems.add(_terminalRunAsAdminAction(context));
-    }
-
     final List favs = (await bind.mainGetFav()).toList();
 
-    if (isDesktop && peer.platform != kPeerPlatformAndroid) {
-      menuItems.add(_tcpTunnelingAction(context));
-    }
-    // menuItems.add(await _openNewConnInOptAction(peer.id));
-    if (!isWeb) {
-      menuItems.add(await _forceAlwaysRelayAction(peer.id));
-    }
-    if (isWindows && peer.platform == kPeerPlatformWindows) {
-      menuItems.add(_rdpAction(context, peer.id));
-    }
+    final menuItems = await _buildConnectionMenuItems(context);
+    menuItems.add(MenuEntryDivider());
     if (isWindows) {
       menuItems.add(_createShortCutAction(peer.id));
     }
-    menuItems.add(MenuEntryDivider());
     if (isMobile || isDesktop || isWebDesktop) {
       menuItems.add(_renameAction(peer.id));
     }
@@ -1065,31 +1118,11 @@ class FavoritePeerCard extends BasePeerCard {
   @override
   Future<List<MenuEntryBase<String>>> _buildMenuItems(
       BuildContext context) async {
-    final List<MenuEntryBase<String>> menuItems = [
-      _connectAction(context),
-      _transferFileAction(context),
-      _viewCameraAction(context),
-      _terminalAction(context),
-    ];
-
-    if (peer.platform == kPeerPlatformWindows) {
-      menuItems.add(_terminalRunAsAdminAction(context));
-    }
-
-    if (isDesktop && peer.platform != kPeerPlatformAndroid) {
-      menuItems.add(_tcpTunnelingAction(context));
-    }
-    // menuItems.add(await _openNewConnInOptAction(peer.id));
-    if (!isWeb) {
-      menuItems.add(await _forceAlwaysRelayAction(peer.id));
-    }
-    if (isWindows && peer.platform == kPeerPlatformWindows) {
-      menuItems.add(_rdpAction(context, peer.id));
-    }
+    final menuItems = await _buildConnectionMenuItems(context);
+    menuItems.add(MenuEntryDivider());
     if (isWindows) {
       menuItems.add(_createShortCutAction(peer.id));
     }
-    menuItems.add(MenuEntryDivider());
     if (isMobile || isDesktop || isWebDesktop) {
       menuItems.add(_renameAction(peer.id));
     }
@@ -1125,29 +1158,10 @@ class DiscoveredPeerCard extends BasePeerCard {
   @override
   Future<List<MenuEntryBase<String>>> _buildMenuItems(
       BuildContext context) async {
-    final List<MenuEntryBase<String>> menuItems = [
-      _connectAction(context),
-      _transferFileAction(context),
-      _viewCameraAction(context),
-      _terminalAction(context),
-    ];
-
-    if (peer.platform == kPeerPlatformWindows) {
-      menuItems.add(_terminalRunAsAdminAction(context));
-    }
-
     final List favs = (await bind.mainGetFav()).toList();
 
-    if (isDesktop && peer.platform != kPeerPlatformAndroid) {
-      menuItems.add(_tcpTunnelingAction(context));
-    }
-    // menuItems.add(await _openNewConnInOptAction(peer.id));
-    if (!isWeb) {
-      menuItems.add(await _forceAlwaysRelayAction(peer.id));
-    }
-    if (isWindows && peer.platform == kPeerPlatformWindows) {
-      menuItems.add(_rdpAction(context, peer.id));
-    }
+    final menuItems = await _buildConnectionMenuItems(context);
+    menuItems.add(MenuEntryDivider());
     menuItems.add(_wolAction(peer.id));
     if (isWindows) {
       menuItems.add(_createShortCutAction(peer.id));
@@ -1184,32 +1198,12 @@ class AddressBookPeerCard extends BasePeerCard {
   @override
   Future<List<MenuEntryBase<String>>> _buildMenuItems(
       BuildContext context) async {
-    final List<MenuEntryBase<String>> menuItems = [
-      _connectAction(context),
-      _transferFileAction(context),
-      _viewCameraAction(context),
-      _terminalAction(context),
-    ];
-
-    if (peer.platform == kPeerPlatformWindows) {
-      menuItems.add(_terminalRunAsAdminAction(context));
-    }
-
-    if (isDesktop && peer.platform != kPeerPlatformAndroid) {
-      menuItems.add(_tcpTunnelingAction(context));
-    }
-    // menuItems.add(await _openNewConnInOptAction(peer.id));
-    if (!isWeb) {
-      menuItems.add(await _forceAlwaysRelayAction(peer.id));
-    }
-    if (isWindows && peer.platform == kPeerPlatformWindows) {
-      menuItems.add(_rdpAction(context, peer.id));
-    }
+    final menuItems = await _buildConnectionMenuItems(context);
+    menuItems.add(MenuEntryDivider());
     if (isWindows) {
       menuItems.add(_createShortCutAction(peer.id));
     }
     if (gFFI.abModel.current.canWrite()) {
-      menuItems.add(MenuEntryDivider());
       if (isMobile || isDesktop || isWebDesktop) {
         menuItems.add(_renameAction(peer.id));
       }
@@ -1341,26 +1335,9 @@ class MyGroupPeerCard extends BasePeerCard {
   @override
   Future<List<MenuEntryBase<String>>> _buildMenuItems(
       BuildContext context) async {
-    final List<MenuEntryBase<String>> menuItems = [
-      _connectAction(context),
-      _transferFileAction(context),
-      _viewCameraAction(context),
-      _terminalAction(context),
-    ];
-
-    if (peer.platform == kPeerPlatformWindows) {
-      menuItems.add(_terminalRunAsAdminAction(context));
-    }
-
-    if (isDesktop && peer.platform != kPeerPlatformAndroid) {
-      menuItems.add(_tcpTunnelingAction(context));
-    }
-    // menuItems.add(await _openNewConnInOptAction(peer.id));
-    if (!isWeb) {
-      menuItems.add(await _forceAlwaysRelayAction(peer.id));
-    }
-    if (isWindows && peer.platform == kPeerPlatformWindows) {
-      menuItems.add(_rdpAction(context, peer.id));
+    final menuItems = await _buildConnectionMenuItems(context);
+    if (isWindows || gFFI.userModel.userName.isNotEmpty) {
+      menuItems.add(MenuEntryDivider());
     }
     if (isWindows) {
       menuItems.add(_createShortCutAction(peer.id));
@@ -1591,7 +1568,8 @@ void connectInPeerTab(BuildContext context, Peer peer, PeerTabIndex tab,
     bool isViewCamera = false,
     bool isTcpTunneling = false,
     bool isRDP = false,
-    bool isTerminal = false}) async {
+    bool isTerminal = false,
+    String loginMethod = ''}) async {
   var password = '';
   bool isSharedPassword = false;
   if (tab == PeerTabIndex.ab) {
@@ -1619,6 +1597,7 @@ void connectInPeerTab(BuildContext context, Peer peer, PeerTabIndex tab,
     }
   }
   connect(context, peer.id,
+      loginMethod: loginMethod,
       password: password,
       isSharedPassword: isSharedPassword,
       isFileTransfer: isFileTransfer,

flutter/lib/common/widgets/request_approval_menu.dart

@@ -0,0 +1,52 @@
+import 'package:flutter/material.dart';
+
+import '../../desktop/widgets/material_mod_popup_menu.dart' as mod_menu;
+import '../../desktop/widgets/popup_menu.dart';
+
+class RequestApprovalMenu extends MenuEntryBase<String> {
+  final String title;
+  final List<MenuEntryButton<String>> entries;
+  final EdgeInsets? padding;
+  final double arrowScale;
+
+  RequestApprovalMenu(
+      {required this.title,
+      required this.entries,
+      this.padding,
+      this.arrowScale = 1.0});
+
+  @override
+  List<mod_menu.PopupMenuEntry<String>> build(
+      BuildContext context, MenuConfig conf) {
+    final theme = Theme.of(context);
+    final checkboxTheme = CheckboxTheme.of(context);
+    final checkboxWidth =
+        ((checkboxTheme.materialTapTargetSize ?? theme.materialTapTargetSize) ==
+                    MaterialTapTargetSize.padded
+                ? kMinInteractiveDimension
+                : kMinInteractiveDimension - 8) +
+            (checkboxTheme.visualDensity ?? theme.visualDensity)
+                .baseSizeAdjustment
+                .dx;
+    final arrowInset = (checkboxWidth - (IconTheme.of(context).size ?? 24)) / 2;
+    return MenuEntrySubMenu<String>(
+      text: title,
+      dismissParentOnCanceled: true,
+      arrowScale: arrowScale,
+      padding: (padding ?? EdgeInsets.zero)
+          .copyWith(right: (padding?.right ?? 0) + arrowInset),
+      entries: entries
+          .map((entry) => MenuEntryButton<String>(
+                childBuilder: entry.childBuilder,
+                proc: entry.proc,
+                padding: entry.padding,
+                enabled: entry.enabled,
+                dismissOnClicked: true,
+                dismissCallback: () {
+                  if (Navigator.canPop(context)) Navigator.pop(context);
+                },
+              ))
+          .toList(),
+    ).build(context, conf);
+  }
+}

flutter/lib/common/widgets/toolbar.dart

@@ -579,6 +579,9 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
       bool isTerminal = false}) {
     final connToken = bind.sessionGetConnToken(sessionId: ffi.sessionId);
     connect(context, id,
+        loginMethod: bind.sessionGetCommonSync(
+                sessionId: ffi.sessionId, key: 'login_method', param: '') ??
+            '',
         isFileTransfer: isFileTransfer,
         isViewCamera: isViewCamera,
         isTerminal: isTerminal,

flutter/lib/desktop/pages/connection_page.dart

@@ -18,6 +18,7 @@ import '../../common.dart';
 import '../../common/formatter/id_formatter.dart';
 import '../../common/widgets/peer_tab_page.dart';
 import '../../common/widgets/autocomplete.dart';
+import '../../common/widgets/request_approval_menu.dart';
 import '../../models/platform_model.dart';
 import '../../desktop/widgets/material_mod_popup_menu.dart' as mod_menu;
 
@@ -340,6 +341,38 @@ class _ConnectionPageState extends State<ConnectionPage>
         isTcpTunneling: isTcpTunneling);
   }
 
+  RequestApprovalMenu _requestApprovalMenu(BuildContext context) {
+    MenuEntryButton<String> action(String title,
+            {bool isFileTransfer = false,
+            bool isViewCamera = false,
+            bool isTerminal = false,
+            bool isTcpTunneling = false}) =>
+        MenuEntryButton<String>(
+          childBuilder: (style) => Text(translate(title), style: style),
+          proc: () => connect(context, _idController.id,
+              loginMethod: 'request-approval',
+              isFileTransfer: isFileTransfer,
+              isViewCamera: isViewCamera,
+              isTerminal: isTerminal,
+              isTcpTunneling: isTcpTunneling),
+          padding: EdgeInsets.symmetric(horizontal: kDesktopMenuPadding.left),
+          dismissOnClicked: true,
+        );
+
+    return RequestApprovalMenu(
+      title: translate('Request approval'),
+      padding: EdgeInsets.symmetric(horizontal: kDesktopMenuPadding.left),
+      arrowScale: MenuConfig.iconScale,
+      entries: [
+        action('Connect'),
+        action('Transfer file', isFileTransfer: true),
+        action('View camera', isViewCamera: true),
+        action('${translate('Terminal')} (beta)', isTerminal: true),
+        if (isDesktop) action('TCP tunneling', isTcpTunneling: true),
+      ],
+    );
+  }
+
   /// UI for the remote ID TextField.
   /// Search for a peer.
   Widget _buildRemoteIDTextField(BuildContext context) {
@@ -579,7 +612,8 @@ class _ConnectionPageState extends State<ConnectionPage>
                                         () => onConnect(isTcpTunneling: true)
                                       ),
                                   ]
-                                      .map((e) => MenuEntryButton<String>(
+                                      .map<MenuEntryBase<String>>(
+                                          (e) => MenuEntryButton<String>(
                                             childBuilder: (TextStyle? style) =>
                                                 Text(
                                               translate(e.$1),
@@ -591,6 +625,10 @@ class _ConnectionPageState extends State<ConnectionPage>
                                                     kDesktopMenuPadding.left),
                                             dismissOnClicked: true,
                                           ))
+                                      .followedBy([
+                                        MenuEntryDivider<String>(),
+                                        _requestApprovalMenu(context),
+                                      ])
                                       .map((e) => e.build(
                                           context,
                                           const MenuConfig(

flutter/lib/desktop/pages/desktop_home_page.dart

@@ -804,6 +804,7 @@ class _DesktopHomePageState extends State<DesktopHomePage>
           password: call.arguments['password'],
           forceRelay: call.arguments['forceRelay'],
           connToken: call.arguments['connToken'],
+          loginMethod: call.arguments['loginMethod'] ?? '',
         );
       } else if (call.method == kWindowBumpMouse) {
         return RdPlatformChannel.instance.bumpMouse(

flutter/lib/desktop/pages/file_manager_page.dart

@@ -56,6 +56,7 @@ class FileManagerPage extends StatefulWidget {
       {Key? key,
       required this.id,
       required this.password,
+      this.loginMethod = '',
       required this.isSharedPassword,
       this.tabController,
       this.connToken,
@@ -63,6 +64,7 @@ class FileManagerPage extends StatefulWidget {
       : super(key: key);
   final String id;
   final String? password;
+  final String loginMethod;
   final bool? isSharedPassword;
   final bool? forceRelay;
   final String? connToken;
@@ -99,6 +101,7 @@ class _FileManagerPageState extends State<FileManagerPage>
     _ffi.start(widget.id,
         isFileTransfer: true,
         password: widget.password,
+        loginMethod: widget.loginMethod,
         isSharedPassword: widget.isSharedPassword,
         connToken: widget.connToken,
         forceRelay: widget.forceRelay);

flutter/lib/desktop/pages/file_manager_tab_page.dart

@@ -54,6 +54,7 @@ class _FileManagerTabPageState extends State<FileManagerTabPage> {
           key: ValueKey(params['id']),
           id: params['id'],
           password: params['password'],
+          loginMethod: params['loginMethod'] ?? '',
           isSharedPassword: params['isSharedPassword'],
           tabController: tabController,
           forceRelay: params['forceRelay'],
@@ -91,6 +92,7 @@ class _FileManagerTabPageState extends State<FileManagerTabPage> {
               key: ValueKey(id),
               id: id,
               password: args['password'],
+              loginMethod: args['loginMethod'] ?? '',
               isSharedPassword: args['isSharedPassword'],
               tabController: tabController,
               forceRelay: args['forceRelay'],

flutter/lib/desktop/pages/port_forward_page.dart

@@ -29,6 +29,7 @@ class PortForwardPage extends StatefulWidget {
     Key? key,
     required this.id,
     required this.password,
+    this.loginMethod = '',
     required this.tabController,
     required this.isRDP,
     required this.isSharedPassword,
@@ -37,6 +38,7 @@ class PortForwardPage extends StatefulWidget {
   }) : super(key: key);
   final String id;
   final String? password;
+  final String loginMethod;
   final DesktopTabController tabController;
   final bool isRDP;
   final bool? forceRelay;
@@ -69,6 +71,7 @@ class _PortForwardPageState extends State<PortForwardPage>
     _ffi.start(widget.id,
         isPortForward: true,
         password: widget.password,
+        loginMethod: widget.loginMethod,
         isSharedPassword: widget.isSharedPassword,
         forceRelay: widget.forceRelay,
         connToken: widget.connToken,

flutter/lib/desktop/pages/port_forward_tab_page.dart

@@ -44,6 +44,7 @@ class _PortForwardTabPageState extends State<PortForwardTabPage> {
           key: ValueKey(params['id']),
           id: params['id'],
           password: params['password'],
+          loginMethod: params['loginMethod'] ?? '',
           isSharedPassword: params['isSharedPassword'],
           tabController: tabController,
           isRDP: isRDP,
@@ -79,6 +80,7 @@ class _PortForwardTabPageState extends State<PortForwardTabPage> {
               key: ValueKey(args['id']),
               id: id,
               password: args['password'],
+              loginMethod: args['loginMethod'] ?? '',
               isSharedPassword: args['isSharedPassword'],
               isRDP: isRDP,
               tabController: tabController,

flutter/lib/desktop/pages/remote_page.dart

@@ -41,6 +41,7 @@ class RemotePage extends StatefulWidget {
     this.sessionId,
     this.tabWindowId,
     this.password,
+    this.loginMethod = '',
     this.display,
     this.displays,
     this.tabController,
@@ -57,6 +58,7 @@ class RemotePage extends StatefulWidget {
   final int? display;
   final List<int>? displays;
   final String? password;
+  final String loginMethod;
   final ToolbarState toolbarState;
   final String? switchUuid;
   final bool? forceRelay;
@@ -180,6 +182,7 @@ class _RemotePageState extends State<RemotePage>
     _ffi.start(
       widget.id,
       password: widget.password,
+      loginMethod: widget.loginMethod,
       isSharedPassword: widget.isSharedPassword,
       switchUuid: widget.switchUuid,
       forceRelay: widget.forceRelay,

flutter/lib/desktop/pages/remote_tab_page.dart

@@ -97,6 +97,7 @@ class _ConnectionTabPageState extends State<ConnectionTabPage> {
           display: display,
           displays: displays?.cast<int>(),
           password: params['password'],
+          loginMethod: params['loginMethod'] ?? '',
           toolbarState: ToolbarState(),
           tabController: tabController,
           switchUuid: params['switch_uuid'],
@@ -470,6 +471,7 @@ class _ConnectionTabPageState extends State<ConnectionTabPage> {
           display: display,
           displays: displays?.cast<int>(),
           password: args['password'],
+          loginMethod: args['loginMethod'] ?? '',
           toolbarState: ToolbarState(),
           tabController: tabController,
           switchUuid: switchUuid,

flutter/lib/desktop/pages/terminal_connection_manager.dart

@@ -14,6 +14,7 @@ class TerminalConnectionManager {
   static FFI getConnection({
     required String peerId,
     required String? password,
+    String loginMethod = '',
     required bool? isSharedPassword,
     required bool? forceRelay,
     required String? connToken,
@@ -32,6 +33,7 @@ class TerminalConnectionManager {
     ffi.start(
       peerId,
       password: password,
+      loginMethod: loginMethod,
       isSharedPassword: isSharedPassword,
       forceRelay: forceRelay,
       connToken: connToken,

flutter/lib/desktop/pages/terminal_page.dart

@@ -13,6 +13,7 @@ class TerminalPage extends StatefulWidget {
     Key? key,
     required this.id,
     required this.password,
+    this.loginMethod = '',
     required this.tabController,
     required this.isSharedPassword,
     required this.terminalId,
@@ -24,6 +25,7 @@ class TerminalPage extends StatefulWidget {
   }) : super(key: key);
   final String id;
   final String? password;
+  final String loginMethod;
   final DesktopTabController tabController;
   final bool? forceRelay;
   final bool? isSharedPassword;
@@ -68,6 +70,7 @@ class _TerminalPageState extends State<TerminalPage>
     _ffi = TerminalConnectionManager.getConnection(
       peerId: widget.id,
       password: widget.password,
+      loginMethod: widget.loginMethod,
       isSharedPassword: widget.isSharedPassword,
       forceRelay: widget.forceRelay,
       connToken: widget.connToken,

flutter/lib/desktop/pages/terminal_tab_page.dart

@@ -79,6 +79,7 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
       peerId: params['id'],
       terminalId: terminalId,
       password: params['password'],
+      loginMethod: params['loginMethod'] ?? '',
       isSharedPassword: params['isSharedPassword'],
       forceRelay: params['forceRelay'],
       connToken: params['connToken'],
@@ -89,6 +90,7 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
     required String peerId,
     required int terminalId,
     String? password,
+    String loginMethod = '',
     bool? isSharedPassword,
     bool? forceRelay,
     String? connToken,
@@ -114,6 +116,7 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
         terminalId: terminalId,
         tabKey: tabKey,
         password: password,
+        loginMethod: loginMethod,
         isSharedPassword: isSharedPassword,
         tabController: tabController,
         forceRelay: forceRelay,
@@ -514,6 +517,7 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
           peerId: id,
           terminalId: terminalId,
           password: args['password'],
+          loginMethod: args['loginMethod'] ?? '',
           isSharedPassword: args['isSharedPassword'],
           forceRelay: args['forceRelay'],
           connToken: args['connToken'],
@@ -713,6 +717,7 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
         peerId: peerId,
         terminalId: newTerminalId,
         password: page.password,
+        loginMethod: page.loginMethod,
         isSharedPassword: page.isSharedPassword,
         forceRelay: page.forceRelay,
         connToken: page.connToken,

flutter/lib/desktop/pages/view_camera_page.dart

@@ -37,6 +37,7 @@ class ViewCameraPage extends StatefulWidget {
     this.sessionId,
     this.tabWindowId,
     this.password,
+    this.loginMethod = '',
     this.display,
     this.displays,
     this.tabController,
@@ -53,6 +54,7 @@ class ViewCameraPage extends StatefulWidget {
   final int? display;
   final List<int>? displays;
   final String? password;
+  final String loginMethod;
   final ToolbarState toolbarState;
   final bool? forceRelay;
   final bool? isSharedPassword;
@@ -112,6 +114,7 @@ class _ViewCameraPageState extends State<ViewCameraPage>
       widget.id,
       isViewCamera: true,
       password: widget.password,
+      loginMethod: widget.loginMethod,
       isSharedPassword: widget.isSharedPassword,
       forceRelay: widget.forceRelay,
       tabWindowId: widget.tabWindowId,

flutter/lib/desktop/pages/view_camera_tab_page.dart

@@ -97,6 +97,7 @@ class _ViewCameraTabPageState extends State<ViewCameraTabPage> {
           display: display,
           displays: displays?.cast<int>(),
           password: params['password'],
+          loginMethod: params['loginMethod'] ?? '',
           toolbarState: ToolbarState(),
           tabController: tabController,
           connToken: params['connToken'],
@@ -433,6 +434,7 @@ class _ViewCameraTabPageState extends State<ViewCameraTabPage> {
           display: display,
           displays: displays?.cast<int>(),
           password: args['password'],
+          loginMethod: args['loginMethod'] ?? '',
           toolbarState: ToolbarState(),
           tabController: tabController,
           connToken: args['connToken'],

flutter/lib/desktop/widgets/material_mod_popup_menu.dart

@@ -656,11 +656,13 @@ class _PopupMenuRouteLayout extends SingleChildLayoutDelegate {
     this.selectedItemIndex,
     this.textDirection,
     this.padding,
-    this.avoidBounds,
-  );
+    this.avoidBounds, {
+    this.submenuAnchor,
+  });
 
   // Rectangle of underlying button, relative to the overlay's dimensions.
   final RelativeRect position;
+  final Rect? submenuAnchor;
 
   // The sizes of each item are computed when the menu is laid out, and before
   // the route is laid out.
@@ -735,6 +737,14 @@ class _PopupMenuRouteLayout extends SingleChildLayoutDelegate {
         DisplayFeatureSubScreen.subScreensInBounds(
             Offset.zero & size, avoidBounds);
     final Rect subScreen = _closestScreen(subScreens, originCenter);
+    final anchor = submenuAnchor;
+    if (anchor != null) {
+      final left = anchor.left - childSize.width;
+      if (wantedPosition.dx + childSize.width >
+          subScreen.right - _kMenuScreenPadding - padding.right) {
+        return _fitInsideScreen(subScreen, childSize, Offset(left, y));
+      }
+    }
     return _fitInsideScreen(subScreen, childSize, wantedPosition);
   }
 
@@ -781,6 +791,7 @@ class _PopupMenuRouteLayout extends SingleChildLayoutDelegate {
     assert(itemSizes.length == oldDelegate.itemSizes.length);
 
     return position != oldDelegate.position ||
+        submenuAnchor != oldDelegate.submenuAnchor ||
         selectedItemIndex != oldDelegate.selectedItemIndex ||
         textDirection != oldDelegate.textDirection ||
         !listEquals(itemSizes, oldDelegate.itemSizes) ||
@@ -792,6 +803,7 @@ class _PopupMenuRouteLayout extends SingleChildLayoutDelegate {
 class _PopupMenuRoute<T> extends PopupRoute<T> {
   _PopupMenuRoute({
     required this.position,
+    this.submenuAnchor,
     required this.items,
     this.menuWrapper,
     this.initialValue,
@@ -805,6 +817,7 @@ class _PopupMenuRoute<T> extends PopupRoute<T> {
   }) : itemSizes = List<Size?>.filled(items.length, null);
 
   final RelativeRect position;
+  final Rect? submenuAnchor;
   final List<PopupMenuEntry<T>> items;
   final MenuWrapper? menuWrapper;
   final List<Size?> itemSizes;
@@ -874,6 +887,7 @@ class _PopupMenuRoute<T> extends PopupRoute<T> {
               Directionality.of(context),
               mediaQuery.padding,
               _avoidBounds(mediaQuery),
+              submenuAnchor: submenuAnchor,
             ),
             child: capturedThemes.wrap(menu),
           );
@@ -1042,6 +1056,7 @@ class PopupMenu<T> extends StatelessWidget {
 Future<T?> showMenu<T>({
   required BuildContext context,
   required RelativeRect position,
+  Rect? submenuAnchor,
   required List<PopupMenuEntry<T>> items,
   MenuWrapper? menuWrapper,
   T? initialValue,
@@ -1070,6 +1085,7 @@ Future<T?> showMenu<T>({
       Navigator.of(context, rootNavigator: useRootNavigator);
   return navigator.push(_PopupMenuRoute<T>(
     position: position,
+    submenuAnchor: submenuAnchor,
     items: items,
     menuWrapper: menuWrapper,
     initialValue: initialValue,
@@ -1352,6 +1368,9 @@ class PopupMenuButtonState<T> extends State<PopupMenuButton<T>> {
         menuWrapper: widget.menuWrapper,
         initialValue: widget.initialValue,
         position: position,
+        submenuAnchor: widget.position == PopupMenuPosition.overSide
+            ? button.localToGlobal(Offset.zero, ancestor: overlay) & button.size
+            : null,
         shape: widget.shape ?? popupMenuTheme.shape,
         color: widget.color ?? popupMenuTheme.color,
         constraints: widget.constraints,

flutter/lib/desktop/widgets/popup_menu.dart

@@ -15,6 +15,8 @@ class PopupMenuChildrenItem<T> extends mod_menu.PopupMenuEntry<T> {
     this.enabled,
     this.textStyle,
     this.onTap,
+    this.dismissParentOnCanceled = false,
+    this.useButtonLayout = false,
     this.position = mod_menu.PopupMenuPosition.overSide,
     this.offset = Offset.zero,
     required this.itemBuilder,
@@ -27,6 +29,8 @@ class PopupMenuChildrenItem<T> extends mod_menu.PopupMenuEntry<T> {
   final EdgeInsets? padding;
   final RxBool? enabled;
   final void Function()? onTap;
+  final bool dismissParentOnCanceled;
+  final bool useButtonLayout;
   final List<mod_menu.PopupMenuEntry<T>> Function(BuildContext) itemBuilder;
   final Widget child;
 
@@ -69,20 +73,42 @@ class MyPopupMenuItemState<T, W extends PopupMenuChildrenItem<T>>
           position: widget.position,
           offset: widget.offset,
           onSelected: handleTap,
+          onCanceled: widget.dismissParentOnCanceled
+              ? () {
+                  if (ModalRoute.of(context)?.isCurrent == true) {
+                    Navigator.pop(context);
+                  }
+                }
+              : null,
           itemBuilder: widget.itemBuilder,
           padding: EdgeInsets.zero,
-          child: AnimatedDefaultTextStyle(
-            style: style,
-            duration: kThemeChangeDuration,
-            child: Container(
-              alignment: AlignmentDirectional.centerStart,
-              constraints: BoxConstraints(
-                  minHeight: widget.height, maxHeight: widget.height),
-              padding:
-                  widget.padding ?? const EdgeInsets.symmetric(horizontal: 16),
-              child: widget.child,
-            ),
-          ),
+          child: Builder(builder: (context) {
+            final child = AnimatedDefaultTextStyle(
+              style: style,
+              duration: kThemeChangeDuration,
+              child: Container(
+                alignment: AlignmentDirectional.centerStart,
+                constraints: BoxConstraints(
+                    minHeight: widget.height, maxHeight: widget.height),
+                padding: widget.padding ??
+                    const EdgeInsets.symmetric(horizontal: 16),
+                child: widget.child,
+              ),
+            );
+            if (!widget.useButtonLayout) return child;
+            final onPressed = enabled.value
+                ? () => context
+                    .findAncestorStateOfType<mod_menu.PopupMenuButtonState<T>>()
+                    ?.showButtonMenu()
+                : null;
+            // The popup trigger owns keyboard focus; retain the menu button sizing.
+            return ExcludeFocus(
+              child: TextButton(
+                onPressed: onPressed,
+                child: TextButton(onPressed: onPressed, child: child),
+              ),
+            );
+          }),
         ));
   }
 }
@@ -645,11 +671,15 @@ class MenuEntrySubMenu<T> extends MenuEntryBase<T> {
   final String text;
   final List<MenuEntryBase<T>> entries;
   final EdgeInsets? padding;
+  final bool dismissParentOnCanceled;
+  final double arrowScale;
 
   MenuEntrySubMenu({
     required this.text,
     required this.entries,
     this.padding,
+    this.dismissParentOnCanceled = false,
+    this.arrowScale = MenuConfig.iconScale,
     RxBool? enabled,
   }) : super(enabled: enabled);
 
@@ -662,13 +692,14 @@ class MenuEntrySubMenu<T> extends MenuEntryBase<T> {
         enabled: super.enabled,
         height: conf.height,
         padding: padding,
+        dismissParentOnCanceled: dismissParentOnCanceled,
+        useButtonLayout: true,
         position: mod_menu.PopupMenuPosition.overSide,
         itemBuilder: (BuildContext context) => entries
             .map((entry) => entry.build(context, conf))
             .expand((i) => i)
             .toList(),
         child: Row(children: [
-          const SizedBox(width: MenuConfig.midPadding),
           Obx(() => Text(
                 text,
                 style: super.enabled!.value
@@ -678,10 +709,15 @@ class MenuEntrySubMenu<T> extends MenuEntryBase<T> {
           Expanded(
               child: Align(
             alignment: Alignment.centerRight,
-            child: Obx(() => Icon(
-                  Icons.keyboard_arrow_right,
-                  color: super.enabled!.value ? conf.commonColor : Colors.grey,
-                )),
+            child: Transform.scale(
+              scale: arrowScale,
+              child: Obx(() => Icon(
+                    Icons.keyboard_arrow_right,
+                    color: super.enabled!.value
+                        ? Theme.of(context).unselectedWidgetColor
+                        : disabledStyle().color,
+                  )),
+            ),
           ))
         ]),
       )

flutter/lib/mobile/pages/file_manager_page.dart

@@ -16,11 +16,13 @@ class FileManagerPage extends StatefulWidget {
   FileManagerPage(
       {Key? key,
       required this.id,
+      this.loginMethod = '',
       this.password,
       this.isSharedPassword,
       this.forceRelay})
       : super(key: key);
   final String id;
+  final String loginMethod;
   final String? password;
   final bool? isSharedPassword;
   final bool? forceRelay;
@@ -276,6 +278,7 @@ class _FileManagerPageState extends State<FileManagerPage> {
     super.initState();
     gFFI.start(widget.id,
         isFileTransfer: true,
+        loginMethod: widget.loginMethod,
         password: widget.password,
         isSharedPassword: widget.isSharedPassword,
         forceRelay: widget.forceRelay);

flutter/lib/mobile/pages/home_page.dart

@@ -208,6 +208,7 @@ class WebHomePage extends StatelessWidget {
     bool isTerminal = false;
     String? id;
     String? password;
+    var loginMethod = '';
     for (int i = 0; i < args.length; i++) {
       switch (args[i]) {
         case '--connect':
@@ -240,6 +241,9 @@ class WebHomePage extends StatelessWidget {
           password = args[i + 1];
           i++;
           break;
+        case '--request-approval':
+          loginMethod = 'request-approval';
+          break;
         default:
           break;
       }
@@ -249,6 +253,7 @@ class WebHomePage extends StatelessWidget {
         isFileTransfer: isFileTransfer, 
         isViewCamera: isViewCamera, 
         isTerminal: isTerminal,
+        loginMethod: loginMethod,
         password: password);
     }
   }

flutter/lib/mobile/pages/remote_page.dart

@@ -71,12 +71,14 @@ class RemotePage extends StatefulWidget {
   RemotePage(
       {Key? key,
       required this.id,
+      this.loginMethod = '',
       this.password,
       this.isSharedPassword,
       this.forceRelay})
       : super(key: key);
 
   final String id;
+  final String loginMethod;
   final String? password;
   final bool? isSharedPassword;
   final bool? forceRelay;
@@ -123,6 +125,7 @@ class _RemotePageState extends State<RemotePage> with WidgetsBindingObserver {
     gFFI.ffiModel.updateEventListener(sessionId, widget.id);
     gFFI.start(
       widget.id,
+      loginMethod: widget.loginMethod,
       password: widget.password,
       isSharedPassword: widget.isSharedPassword,
       forceRelay: widget.forceRelay,

flutter/lib/mobile/pages/terminal_page.dart

@@ -71,8 +71,10 @@ class TerminalPage extends StatefulWidget {
     required this.isSharedPassword,
     this.forceRelay,
     this.connToken,
+    this.loginMethod = '',
   }) : super(key: key);
   final String id;
+  final String loginMethod;
   final String? password;
   final bool? forceRelay;
   final bool? isSharedPassword;
@@ -141,6 +143,7 @@ class _TerminalPageState extends State<TerminalPage>
     // Use shared FFI instance from connection manager
     _ffi = TerminalConnectionManager.getConnection(
       peerId: widget.id,
+      loginMethod: widget.loginMethod,
       password: widget.password,
       isSharedPassword: widget.isSharedPassword,
       forceRelay: widget.forceRelay,

flutter/lib/mobile/pages/view_camera_page.dart

@@ -40,12 +40,14 @@ class ViewCameraPage extends StatefulWidget {
   ViewCameraPage(
       {Key? key,
       required this.id,
+      this.loginMethod = '',
       this.password,
       this.isSharedPassword,
       this.forceRelay})
       : super(key: key);
 
   final String id;
+  final String loginMethod;
   final String? password;
   final bool? isSharedPassword;
   final bool? forceRelay;
@@ -90,6 +92,7 @@ class _ViewCameraPageState extends State<ViewCameraPage>
     gFFI.start(
       widget.id,
       isViewCamera: true,
+      loginMethod: widget.loginMethod,
       password: widget.password,
       isSharedPassword: widget.isSharedPassword,
       forceRelay: widget.forceRelay,

flutter/lib/models/model.dart

@@ -920,9 +920,10 @@ class FfiModel with ChangeNotifier {
       enter2FaDialog(sessionId, dialogManager);
     } else if (type == 'input-password') {
       enterPasswordDialog(sessionId, dialogManager);
-    } else if (type == 'terminal-admin-login') {
-      enterUserLoginDialog(
-          sessionId, dialogManager, 'terminal-admin-login-tip');
+    } else if (type == 'terminal-admin-login' ||
+        type == 'terminal-admin-login-request-approval') {
+      enterUserLoginDialog(sessionId, dialogManager, 'terminal-admin-login-tip',
+          waitForAccept: type == 'terminal-admin-login-request-approval');
     } else if (type == 'terminal-admin-login-password') {
       enterUserLoginAndPasswordDialog(
           sessionId, dialogManager, 'terminal-admin-login-tip');
@@ -4123,6 +4124,7 @@ class FFI {
     int? tabWindowId,
     int? display,
     List<int>? displays,
+    String loginMethod = '',
   }) {
     closed = false;
     if (isMobile) mobileReset();
@@ -4168,6 +4170,7 @@ class FFI {
         password: password ?? '',
         isSharedPassword: isSharedPassword ?? false,
         connToken: connToken,
+        loginMethod: loginMethod,
       );
     } else if (display != null) {
       if (displays == null) {

flutter/lib/utils/multi_window_manager.dart

@@ -225,6 +225,7 @@ class RustDeskMultiWindowManager {
     String remoteId,
     List<int> windows, {
     String? password,
+    String loginMethod = '',
     bool? forceRelay,
     String? switchUuid,
     bool? isRDP,
@@ -249,6 +250,9 @@ class RustDeskMultiWindowManager {
     if (connToken != null) {
       params['connToken'] = connToken;
     }
+    if (loginMethod.isNotEmpty) {
+      params['loginMethod'] = loginMethod;
+    }
     final msg = jsonEncode(params);
 
     // separate window for file transfer is not supported
@@ -270,6 +274,7 @@ class RustDeskMultiWindowManager {
   Future<MultiWindowCallResult> newRemoteDesktop(
     String remoteId, {
     String? password,
+    String loginMethod = '',
     bool? isSharedPassword,
     String? switchUuid,
     bool? forceRelay,
@@ -280,6 +285,7 @@ class RustDeskMultiWindowManager {
       remoteId,
       _remoteDesktopWindows,
       password: password,
+      loginMethod: loginMethod,
       forceRelay: forceRelay,
       switchUuid: switchUuid,
       isSharedPassword: isSharedPassword,
@@ -289,6 +295,7 @@ class RustDeskMultiWindowManager {
   Future<MultiWindowCallResult> newFileTransfer(
     String remoteId, {
     String? password,
+    String loginMethod = '',
     bool? isSharedPassword,
     bool? forceRelay,
     String? connToken,
@@ -299,6 +306,7 @@ class RustDeskMultiWindowManager {
       remoteId,
       _fileTransferWindows,
       password: password,
+      loginMethod: loginMethod,
       forceRelay: forceRelay,
       isSharedPassword: isSharedPassword,
       connToken: connToken,
@@ -308,6 +316,7 @@ class RustDeskMultiWindowManager {
   Future<MultiWindowCallResult> newViewCamera(
     String remoteId, {
     String? password,
+    String loginMethod = '',
     bool? isSharedPassword,
     String? switchUuid,
     bool? forceRelay,
@@ -319,6 +328,7 @@ class RustDeskMultiWindowManager {
       remoteId,
       _viewCameraWindows,
       password: password,
+      loginMethod: loginMethod,
       forceRelay: forceRelay,
       switchUuid: switchUuid,
       isSharedPassword: isSharedPassword,
@@ -330,6 +340,7 @@ class RustDeskMultiWindowManager {
     String remoteId,
     bool isRDP, {
     String? password,
+    String loginMethod = '',
     bool? isSharedPassword,
     bool? forceRelay,
     String? connToken,
@@ -340,6 +351,7 @@ class RustDeskMultiWindowManager {
       remoteId,
       _portForwardWindows,
       password: password,
+      loginMethod: loginMethod,
       forceRelay: forceRelay,
       isRDP: isRDP,
       isSharedPassword: isSharedPassword,
@@ -350,6 +362,7 @@ class RustDeskMultiWindowManager {
   Future<MultiWindowCallResult> newTerminal(
     String remoteId, {
     String? password,
+    String loginMethod = '',
     bool? isSharedPassword,
     bool? forceRelay,
     String? connToken,
@@ -375,6 +388,9 @@ class RustDeskMultiWindowManager {
       "isSharedPassword": isSharedPassword,
       "connToken": connToken,
     };
+    if (loginMethod.isNotEmpty) {
+      params['loginMethod'] = loginMethod;
+    }
     final msg = jsonEncode(params);
 
     // Always create a new window for terminal

flutter/lib/web/bridge.dart

@@ -149,6 +149,7 @@ class RustdeskImpl {
       required String password,
       required bool isSharedPassword,
       String? connToken,
+      required String loginMethod,
       dynamic hint}) {
     return js.context.callMethod('setByName', [
       'session_add_sync',
@@ -156,6 +157,7 @@ class RustdeskImpl {
         'id': id,
         'password': password,
         'is_shared_password': isSharedPassword,
+        'login_method': loginMethod,
         'isFileTransfer': isFileTransfer,
         'isViewCamera': isViewCamera,
         'isTerminal': isTerminal
@@ -1964,6 +1966,9 @@ class RustdeskImpl {
       required String key,
       required String param,
       dynamic hint}) {
+    if (key == 'login_method') {
+      return js.context.callMethod('getByName', ['login_method']);
+    }
     throw UnimplementedError("sessionGetCommonSync");
   }
 

flutter/test/request_approval_menu_test.dart

@@ -0,0 +1,297 @@
+import 'package:flutter/material.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:flutter_hbb/common/widgets/request_approval_menu.dart';
+import 'package:flutter_hbb/desktop/widgets/material_mod_popup_menu.dart'
+    as mod_menu;
+import 'package:flutter_hbb/desktop/widgets/popup_menu.dart';
+
+const connectionTypes = [
+  'Connect',
+  'Transfer file',
+  'View camera',
+  'Terminal',
+  'Terminal (Run as administrator)',
+  'TCP tunneling',
+  'RDP',
+];
+
+Future<void> openMenu(WidgetTester tester, List<String> actions,
+    {ThemeData? theme,
+    EdgeInsets? padding,
+    bool includeRelay = false,
+    RelativeRect position = const RelativeRect.fromLTRB(20, 20, 780, 580)}) async {
+  MenuEntryButton<String> entry(String title, {bool requestApproval = false}) =>
+      MenuEntryButton<String>(
+        childBuilder: (style) => Text(title, style: style),
+        proc: () =>
+            actions.add(requestApproval ? '$title:request-approval' : title),
+        padding: padding,
+        dismissOnClicked: true,
+      );
+
+  await tester.pumpWidget(MaterialApp(
+    theme: theme,
+    home: Scaffold(
+      body: Builder(builder: (context) {
+        return TextButton(
+          onPressed: () => mod_menu.showMenu<String>(
+            context: context,
+            position: position,
+            items: [
+              entry('Connect'),
+              entry('Transfer file'),
+              entry('View camera'),
+              MenuEntryButton<String>(
+                childBuilder: (style) => Row(children: [
+                  Text('RDP', style: style),
+                  const Spacer(),
+                  IconButton(
+                    icon: const Icon(Icons.edit),
+                    onPressed: () {
+                      Navigator.pop(context);
+                      actions.add('Edit RDP');
+                    },
+                  ),
+                ]),
+                proc: () => actions.add('RDP'),
+                padding: padding,
+                dismissOnClicked: true,
+              ),
+              RequestApprovalMenu(
+                title: 'Request approval',
+                padding: padding,
+                entries: [
+                  for (final title in connectionTypes)
+                    entry(title, requestApproval: true),
+                ],
+              ),
+              if (includeRelay)
+                MenuEntrySwitchSync<String>(
+                  switchType: SwitchType.scheckbox,
+                  text: 'Always connect via relay',
+                  currentValue: false,
+                  setter: (_) async {},
+                  padding: padding,
+                  dismissOnClicked: true,
+                ),
+              entry('Rename'),
+            ]
+                .expand((entry) => entry.build(context,
+                    const MenuConfig(commonColor: Colors.black, height: 20)))
+                .toList(),
+          ),
+          child: const Text('Open menu'),
+        );
+      }),
+    ),
+  ));
+  await tester.pumpAndSettle();
+  await tester.tap(find.text('Open menu'));
+  await tester.pumpAndSettle();
+}
+
+void main() {
+  testWidgets('submenu prefers the left screen edge when neither side fits',
+      (tester) async {
+    tester.view.physicalSize = const Size(500, 800);
+    tester.view.devicePixelRatio = 1;
+    addTearDown(tester.view.resetPhysicalSize);
+    addTearDown(tester.view.resetDevicePixelRatio);
+    await openMenu(tester, [],
+        position: const RelativeRect.fromLTRB(480, 20, 20, 780));
+    await tester.tap(find.text('Request approval'));
+    await tester.pumpAndSettle();
+    final submenu = tester.getRect(find.ancestor(
+        of: find.text('Connect').last,
+        matching: find.byType(mod_menu.PopupMenuItem<String>)));
+    expect(submenu.left, closeTo(0, 0.01));
+    expect(submenu.right, lessThanOrEqualTo(500));
+    await tester.tapAt(const Offset(2, 2));
+    await tester.pumpAndSettle();
+  });
+
+  testWidgets('approval submenu opens beside its parent on either screen edge',
+      (tester) async {
+    tester.view.physicalSize = const Size(1200, 800);
+    tester.view.devicePixelRatio = 1;
+    addTearDown(tester.view.resetPhysicalSize);
+    addTearDown(tester.view.resetDevicePixelRatio);
+    for (final atRight in [false, true]) {
+      await openMenu(tester, [],
+          position: RelativeRect.fromLTRB(atRight ? 1180 : 20, 20,
+              atRight ? 20 : 1180, 780));
+      final parent = tester.getRect(find.byType(PopupMenuChildrenItem<String>));
+      await tester.tap(find.text('Request approval'));
+      await tester.pumpAndSettle();
+      final submenu = tester.getRect(find.ancestor(
+          of: find.text('Connect').last,
+          matching: find.byType(mod_menu.PopupMenuItem<String>)));
+      if (atRight) {
+        expect(submenu.right, lessThanOrEqualTo(parent.left));
+      } else {
+        expect(submenu.left, greaterThanOrEqualTo(parent.right));
+      }
+      await tester.tapAt(const Offset(2, 2));
+      await tester.pumpAndSettle();
+    }
+  });
+
+  testWidgets('approval trigger has one Tab stop and opens with Enter',
+      (tester) async {
+    await openMenu(tester, []);
+    bool approvalHasFocus() => FocusManager.instance.primaryFocus?.context
+        ?.findAncestorWidgetOfExactType<PopupMenuChildrenItem<String>>() != null;
+
+    for (var i = 0; i < 30 && !approvalHasFocus(); i++) {
+      await tester.sendKeyEvent(LogicalKeyboardKey.tab);
+      await tester.pump();
+    }
+    expect(approvalHasFocus(), isTrue);
+    await tester.sendKeyEvent(LogicalKeyboardKey.tab);
+    await tester.pump();
+    expect(approvalHasFocus(), isFalse,
+        reason: 'Tab must leave the approval row after one stop');
+
+    await tester.sendKeyDownEvent(LogicalKeyboardKey.shiftLeft);
+    await tester.sendKeyEvent(LogicalKeyboardKey.tab);
+    await tester.sendKeyUpEvent(LogicalKeyboardKey.shiftLeft);
+    await tester.pump();
+    expect(approvalHasFocus(), isTrue);
+    await tester.sendKeyEvent(LogicalKeyboardKey.enter);
+    await tester.pumpAndSettle();
+    expect(find.text('Terminal (Run as administrator)'), findsOneWidget);
+  });
+
+  testWidgets('tapping outside the approval submenu closes both menus',
+      (tester) async {
+    final actions = <String>[];
+    await openMenu(tester, actions);
+    await tester.tap(find.text('Request approval'));
+    await tester.pumpAndSettle();
+    await tester.tapAt(const Offset(2, 2));
+    await tester.pumpAndSettle();
+    expect(actions, isEmpty);
+    expect(find.text('Request approval'), findsNothing);
+    expect(find.text('Rename'), findsNothing);
+    expect(find.text('Open menu'), findsOneWidget);
+  });
+
+  testWidgets('approval text and arrow align with normal menu items',
+      (tester) async {
+    for (final (theme, padding) in [
+      (ThemeData(), null),
+      (
+        ThemeData(
+            useMaterial3: false,
+            platform: TargetPlatform.windows,
+            visualDensity: VisualDensity.compact),
+        const EdgeInsets.only(left: 12, right: 3)
+      ),
+      (
+        ThemeData(useMaterial3: false),
+        const EdgeInsets.symmetric(horizontal: 12)
+      ),
+      (
+        ThemeData(
+            useMaterial3: false,
+            textButtonTheme: TextButtonThemeData(
+              style: TextButton.styleFrom(
+                  padding: const EdgeInsets.symmetric(horizontal: 20)),
+            )),
+        null
+      ),
+    ]) {
+      await openMenu(tester, [],
+          theme: theme, padding: padding, includeRelay: true);
+      expect(tester.getTopLeft(find.text('Request approval')).dx,
+          tester.getTopLeft(find.text('Connect')).dx);
+      expect(tester.getCenter(find.byIcon(Icons.keyboard_arrow_right)).dx,
+          closeTo(tester.getCenter(find.byType(Checkbox)).dx, 0.01));
+      await tester.tap(find.text('Rename'));
+      await tester.pumpAndSettle();
+    }
+  });
+
+  testWidgets('normal connections and RDP editing remain direct actions',
+      (tester) async {
+    for (final title in [
+      'Connect',
+      'Transfer file',
+      'View camera',
+      'RDP',
+      'Edit RDP'
+    ]) {
+      final actions = <String>[];
+      await openMenu(tester, actions);
+      expect(find.byIcon(Icons.keyboard_arrow_right), findsOneWidget);
+      final left = tester.getTopLeft(find.text('Rename')).dx;
+      for (final row in ['Connect', 'Transfer file', 'View camera', 'RDP']) {
+        expect(tester.getTopLeft(find.text(row)).dx, left);
+      }
+      await tester.tap(
+          title == 'Edit RDP' ? find.byIcon(Icons.edit) : find.text(title));
+      await tester.pumpAndSettle();
+      expect(actions, [title]);
+      expect(find.text('Request approval'), findsNothing);
+      expect(find.text('Rename'), findsNothing);
+    }
+  });
+
+  testWidgets(
+      'one approval menu offers all connection types and closes both menus',
+      (tester) async {
+    for (var i = 0; i < connectionTypes.length; i++) {
+      final actions = <String>[];
+      await openMenu(tester, actions);
+      await tester.tap(i.isEven
+          ? find.text('Request approval')
+          : find.byIcon(Icons.keyboard_arrow_right));
+      await tester.pumpAndSettle();
+      expect(actions, isEmpty);
+      for (final title in connectionTypes) {
+        expect(find.text(title), findsWidgets);
+      }
+      await tester.tap(find.text(connectionTypes[i]).last);
+      await tester.pumpAndSettle();
+      expect(actions, ['${connectionTypes[i]}:request-approval']);
+      expect(find.text('Request approval'), findsNothing);
+      expect(find.text('Rename'), findsNothing);
+    }
+  },
+      variant: TargetPlatformVariant({
+        TargetPlatform.android,
+        TargetPlatform.iOS,
+        TargetPlatform.linux,
+        TargetPlatform.macOS,
+        TargetPlatform.windows,
+      }));
+
+  testWidgets('the whole approval row opens the submenu on a narrow screen',
+      (tester) async {
+    tester.view.physicalSize = const Size(360, 640);
+    tester.view.devicePixelRatio = 1;
+    addTearDown(tester.view.resetPhysicalSize);
+    addTearDown(tester.view.resetDevicePixelRatio);
+    for (final corner in [
+      Alignment.topLeft,
+      Alignment.topRight,
+      Alignment.bottomLeft,
+      Alignment.bottomRight,
+    ]) {
+      final actions = <String>[];
+      await openMenu(tester, actions);
+      final row = tester.getRect(find.byType(PopupMenuChildrenItem<String>));
+      await tester.tapAt(corner.withinRect(row.deflate(2)));
+      await tester.pumpAndSettle();
+      expect(actions, isEmpty);
+      expect(find.text('Terminal (Run as administrator)'), findsOneWidget);
+      await tester.tap(find.text('Connect').last);
+      await tester.pumpAndSettle();
+      expect(actions, ['Connect:request-approval']);
+      expect(find.text('Rename'), findsNothing);
+    }
+  },
+      variant:
+          TargetPlatformVariant({TargetPlatform.android, TargetPlatform.iOS}));
+}

flutter/test/uri_login_method_test.dart

@@ -0,0 +1,46 @@
+import 'package:flutter_hbb/common.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('request-approval links preserve their connection type', () {
+    for (final type in [
+      'connect',
+      'play',
+      'file-transfer',
+      'view-camera',
+      'port-forward',
+      'rdp',
+      'terminal',
+      'terminal-admin',
+    ]) {
+      expect(
+        urlLinkToCmdArgs(
+            Uri.parse('rustdesk://$type/123456789?request-approval=true')),
+        ['--$type', '123456789', '--request-approval'],
+      );
+    }
+    expect(
+      urlLinkToCmdArgs(Uri.parse('rustdesk://123456789?request-approval=true')),
+      ['--connect', '123456789', '--request-approval'],
+    );
+  });
+
+  test('omitted and empty passwords retain automatic login', () {
+    expect(urlLinkToCmdArgs(Uri.parse('rustdesk://123456789')),
+        ['--connect', '123456789']);
+    for (final query in ['password=', 'password=&request-approval=false']) {
+      expect(urlLinkToCmdArgs(Uri.parse('rustdesk://123456789?$query')),
+          ['--connect', '123456789', '--password', '']);
+    }
+  });
+
+  test('request-approval ignores an explicit password in either order', () {
+    for (final query in [
+      'password=provided&request-approval=true',
+      'request-approval=true&password=provided',
+    ]) {
+      expect(urlLinkToCmdArgs(Uri.parse('rustdesk://123456789?$query')),
+          ['--connect', '123456789', '--request-approval']);
+    }
+  });
+}

src/client.rs

@@ -93,6 +93,8 @@ use crate::ui_session_interface::SessionPermissionConfig;
 
 pub use super::lang::*;
 
+mod login_method;
+
 #[cfg(not(target_os = "linux"))]
 mod audio_playback;
 #[cfg(target_os = "windows")]
@@ -2834,6 +2836,7 @@ pub struct LoginConfigHandler {
     hash: Hash,
     password: Vec<u8>, // remember password for reconnect
     pub remember: bool,
+    login_method: login_method::LoginMethod,
     config: PeerConfig,
     pub port_forward: (String, i32),
     /// This login's `multiplex`, filled with `port_forward` under the turn
@@ -2911,6 +2914,7 @@ impl LoginConfigHandler {
         adapter_luid: Option<i64>,
         shared_password: Option<String>,
         conn_token: Option<String>,
+        login_method: &str,
     ) {
         let mut id = id;
         if id.contains("@") {
@@ -2951,6 +2955,10 @@ impl LoginConfigHandler {
 
         self.id = id;
         self.conn_type = conn_type;
+        self.login_method = Default::default();
+        if !login_method.is_empty() && !self.set_login_method(login_method) {
+            log::warn!("Failed to initialize login method: {}", login_method);
+        }
         let config = self.load_config();
         self.remember = !config.password.is_empty();
         self.config = config;
@@ -3671,7 +3679,7 @@ impl LoginConfigHandler {
         let password0 = config.password.clone();
         let remember = self.remember;
         let hash = self.hash.clone();
-        if remember {
+        if remember && !self.skips_saved_password() {
             // remember is true: use PeerConfig password or ui login
             // not sync shared password to recent
             if !password.is_empty()
@@ -3681,7 +3689,7 @@ impl LoginConfigHandler {
                 config.password = password.clone();
                 log::debug!("remember password of {}", self.id);
             }
-        } else {
+        } else if !self.skips_saved_password() {
             if self.password_source.is_personal_ab(&password) {
                 // sync personal ab password to recent automatically
                 config.password = password.clone();
@@ -3708,7 +3716,8 @@ impl LoginConfigHandler {
         #[cfg(feature = "flutter")]
         {
             // sync connected password to personal ab automatically if it is not shared password
-            if !config.password.is_empty()
+            if !self.skips_saved_password()
+                && !config.password.is_empty()
                 && !self.password_source.is_shared_ab(&password, &hash)
                 && !self.password_source.is_personal_ab(&password)
             {
@@ -3860,6 +3869,9 @@ impl LoginConfigHandler {
             avatar,
             ..Default::default()
         };
+        if self.skips_saved_password() {
+            lr.password.clear();
+        }
         match self.conn_type {
             ConnType::FILE_TRANSFER => lr.set_file_transfer(FileTransfer {
                 dir: self.get_remote_dir(),
@@ -4733,10 +4745,14 @@ pub async fn handle_hash(
 
     lc.write().unwrap().password = password.clone();
 
+    let request_approval = lc.read().unwrap().skips_saved_password();
+
     let is_terminal_admin = lc.read().unwrap().is_terminal_admin;
     let is_terminal = lc.read().unwrap().conn_type.eq(&ConnType::TERMINAL);
     if is_terminal && is_terminal_admin {
-        if password.is_empty() {
+        if request_approval {
+            interface.msgbox("terminal-admin-login-request-approval", "", "", "");
+        } else if password.is_empty() {
             interface.msgbox("terminal-admin-login-password", "", "", "");
         } else {
             interface.msgbox("terminal-admin-login", "", "", "");
@@ -4747,7 +4763,9 @@ pub async fn handle_hash(
 
     let password = if password.is_empty() {
         // login without password, the remote side can click accept
-        interface.msgbox("input-password", "Password Required", "", "");
+        if !request_approval {
+            interface.msgbox("input-password", "Password Required", "", "");
+        }
         Vec::new()
     } else {
         let mut hasher = Sha256::new();
@@ -4756,6 +4774,15 @@ pub async fn handle_hash(
         hasher.finalize()[..].into()
     };
 
+    if request_approval {
+        interface.msgbox(
+            "wait-remote-accept-nook",
+            "Prompt",
+            "Please wait for the remote side to accept your session request...",
+            "",
+        );
+    }
+
     if let Err(error) = send_login(
         lc.clone(),
         String::new(),

src/client/login_method.rs

@@ -0,0 +1,274 @@
+use super::LoginConfigHandler;
+
+#[derive(Default, PartialEq, Eq)]
+pub(super) enum LoginMethod {
+    #[default]
+    Automatic,
+    RequestApproval,
+}
+
+impl LoginConfigHandler {
+    pub(crate) fn set_login_method(&mut self, method: &str) -> bool {
+        self.login_method = match method {
+            "request-approval" => LoginMethod::RequestApproval,
+            _ => return false,
+        };
+        true
+    }
+
+    pub(crate) fn skips_saved_password(&self) -> bool {
+        self.login_method != LoginMethod::Automatic
+    }
+
+    pub(crate) fn get_login_method(&self) -> &'static str {
+        match self.login_method {
+            LoginMethod::Automatic => "",
+            LoginMethod::RequestApproval => "request-approval",
+        }
+    }
+}
+
+#[cfg(all(test, feature = "flutter"))]
+mod tests {
+    use crate::{client, flutter::FlutterHandler, ui_session_interface::Session};
+    use base::message_proto::{Hash, Message, PeerInfo};
+    use hbb_common::{
+        config::PeerConfig, protobuf::Message as _, rendezvous_proto::ConnType, tcp::FramedStream,
+        tokio, Stream,
+    };
+
+    async fn connection() -> (Stream, Stream) {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        let client = tokio::net::TcpStream::connect(addr).await.unwrap();
+        let (socket, addr) = listener.accept().await.unwrap();
+        (
+            Stream::Tcp(FramedStream::from(client, listener.local_addr().unwrap())),
+            Stream::Tcp(FramedStream::from(socket, addr)),
+        )
+    }
+
+    async fn received_password(peer: &mut Stream) -> Vec<u8> {
+        let bytes = peer.next_timeout(3000).await.unwrap().unwrap();
+        Message::parse_from_bytes(&bytes)
+            .unwrap()
+            .login_request()
+            .password
+            .to_vec()
+    }
+
+    #[test]
+    fn session_creation_initializes_login_method() {
+        let remote_id = hbb_common::config::LocalConfig::get_remote_id();
+        for method in ["", "request-approval"] {
+            let session_id = uuid::Uuid::new_v4();
+            let result = crate::flutter_ffi::session_add_sync(
+                session_id,
+                format!("login-method-init-{}", session_id),
+                false,
+                false,
+                false,
+                false,
+                false,
+                String::new(),
+                false,
+                String::new(),
+                false,
+                None,
+                method.to_owned(),
+            );
+            let monitor_session_id = uuid::Uuid::new_v4();
+            let monitor_result = crate::flutter_ffi::session_add_existed_sync(
+                format!("login-method-init-{}", session_id),
+                monitor_session_id,
+                vec![0],
+                false,
+            );
+            let methods = [session_id, monitor_session_id].map(|id| {
+                crate::flutter_ffi::session_get_common_sync(
+                    id,
+                    "login_method".to_owned(),
+                    String::new(),
+                )
+                .0
+            });
+            crate::flutter::sessions::remove_session_by_session_id(&monitor_session_id);
+            let session = crate::flutter::sessions::remove_session_by_session_id(&session_id);
+            hbb_common::config::LocalConfig::set_remote_id(&remote_id);
+            assert!(result.0.is_empty(), "{}", result.0);
+            assert!(monitor_result.0.is_empty(), "{}", monitor_result.0);
+            assert_eq!(methods, [Some(method.to_owned()), Some(method.to_owned())]);
+            let session = session.unwrap();
+            let request = session
+                .lc
+                .read()
+                .unwrap()
+                .create_login_msg(String::new(), String::new(), vec![1; 32]);
+            assert_eq!(
+                request.login_request().password.is_empty(),
+                method == "request-approval"
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn configured_passwords_are_skipped_only_for_the_selected_connection() {
+        for conn_type in [
+            ConnType::DEFAULT_CONN,
+            ConnType::FILE_TRANSFER,
+            ConnType::VIEW_CAMERA,
+            ConnType::PORT_FORWARD,
+            ConnType::RDP,
+            ConnType::TERMINAL,
+        ] {
+            for skip in [false, true] {
+                let session = Session::<FlutterHandler>::default();
+                {
+                    let mut lc = session.lc.write().unwrap();
+                    lc.id = format!("skip-saved-password-test-{}", uuid::Uuid::new_v4());
+                    lc.conn_type = conn_type;
+                    lc.config.password = vec![1; 32];
+                    lc.password = vec![2; 32];
+                    lc.shared_password = Some("shared password".into());
+                    let token = lc.get_conn_token();
+                    if skip {
+                        assert!(lc.set_login_method("request-approval"));
+                    }
+                    assert_eq!(lc.get_conn_token(), token);
+                    let request = lc.create_login_msg(String::new(), String::new(), vec![4; 32]);
+                    assert_eq!(request.login_request().password.is_empty(), skip);
+                }
+                let (mut stream, mut peer) = connection().await;
+                assert!(
+                    client::handle_hash(
+                        session.lc.clone(),
+                        "preset password",
+                        Hash {
+                            salt: "salt".into(),
+                            challenge: "challenge".into(),
+                            ..Default::default()
+                        },
+                        &session,
+                        &mut Default::default(),
+                        &mut stream,
+                    )
+                    .await
+                );
+                let password = received_password(&mut peer).await;
+                assert_eq!(password.is_empty(), skip);
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn admin_terminal_waits_for_os_credentials_before_requesting_approval() {
+        let session = Session::<FlutterHandler>::default();
+        {
+            let mut lc = session.lc.write().unwrap();
+            lc.conn_type = ConnType::TERMINAL;
+            lc.is_terminal_admin = true;
+            assert!(lc.set_login_method("request-approval"));
+        }
+        let (mut stream, mut peer) = connection().await;
+        let mut trust = Default::default();
+        assert!(
+            client::handle_hash(
+                session.lc.clone(),
+                "preset password",
+                Hash::default(),
+                &session,
+                &mut trust,
+                &mut stream,
+            )
+            .await
+        );
+        assert!(peer.next_timeout(50).await.is_none());
+        client::handle_login_from_ui(
+            session.lc.clone(),
+            "administrator".into(),
+            "os password".into(),
+            String::new(),
+            false,
+            &mut trust,
+            &mut stream,
+        )
+        .await
+        .unwrap();
+        let bytes = peer.next_timeout(3000).await.unwrap().unwrap();
+        let message = Message::parse_from_bytes(&bytes).unwrap();
+        let login = message.login_request();
+        assert!(login.password.is_empty());
+        assert_eq!(login.os_login.username, "administrator");
+        assert_eq!(login.os_login.password, "os password");
+    }
+
+    #[test]
+    fn request_approval_does_not_save_personal_ab_password() {
+        for request_approval in [false, true] {
+            let mut lc = client::LoginConfigHandler::default();
+            lc.id = format!("request-approval-ab-password-test-{}", uuid::Uuid::new_v4());
+            lc.password = vec![3; 32];
+            lc.password_source = client::PasswordSource::PersonalAb(lc.password.clone());
+            if request_approval {
+                assert!(lc.set_login_method("request-approval"));
+            }
+            lc.handle_peer_info(&PeerInfo::default());
+            let saved = PeerConfig::load(&lc.id).password;
+            PeerConfig::remove(&lc.id);
+            assert_eq!(
+                saved,
+                if request_approval {
+                    Vec::new()
+                } else {
+                    lc.password
+                }
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn request_approval_preserves_saved_password() {
+        let (mut stream, mut peer) = connection().await;
+        let id = format!("skip-saved-password-test-{}", uuid::Uuid::new_v4());
+        let mut config = PeerConfig::default();
+        config.password = vec![3; 32];
+        config.store(&id);
+        let session = Session::<FlutterHandler>::default();
+        {
+            let mut lc = session.lc.write().unwrap();
+            lc.initialize(
+                id.clone(),
+                ConnType::DEFAULT_CONN,
+                None,
+                false,
+                None,
+                None,
+                None,
+                "",
+            );
+            assert!(!lc.set_login_method("password"));
+            assert!(lc.set_login_method("request-approval"));
+        }
+        assert!(
+            client::handle_hash(
+                session.lc.clone(),
+                "",
+                Hash::default(),
+                &session,
+                &mut Default::default(),
+                &mut stream,
+            )
+            .await
+        );
+        let first = received_password(&mut peer).await;
+        assert!(first.is_empty());
+        session
+            .lc
+            .write()
+            .unwrap()
+            .handle_peer_info(&PeerInfo::default());
+        let saved = PeerConfig::load(&id).password;
+        PeerConfig::remove(&id);
+        assert_eq!(saved, config.password);
+    }
+}

src/core_main.rs

@@ -73,6 +73,7 @@ pub fn core_main() -> Option<CoreMainAction> {
                 "--view-camera",
                 "--port-forward",
                 "--terminal",
+                "--terminal-admin",
                 "--rdp",
             ]
             .contains(&arg.as_str())
@@ -763,7 +764,7 @@ fn core_main_invoke_new_connection(mut args: std::env::Args) -> Option<Vec<Strin
     while let Some(arg) = args.next() {
         match arg.as_str() {
             "--connect" | "--play" | "--file-transfer" | "--view-camera" | "--port-forward"
-            | "--terminal" | "--rdp" => {
+            | "--terminal" | "--terminal-admin" | "--rdp" => {
                 authority = Some((&arg.to_string()[2..]).to_owned());
                 id = args.next();
             }
@@ -775,6 +776,9 @@ fn core_main_invoke_new_connection(mut args: std::env::Args) -> Option<Vec<Strin
             "--relay" => {
                 param_array.push(format!("relay=true"));
             }
+            "--request-approval" => {
+                param_array.push("request-approval=true".to_owned());
+            }
             // inner
             "--switch_uuid" => {
                 if let Some(switch_uuid) = args.next() {

src/flutter.rs

@@ -1316,6 +1316,7 @@ pub fn session_add(
     password: String,
     is_shared_password: bool,
     conn_token: Option<String>,
+    login_method: &str,
 ) -> ResultType<FlutterSession> {
     let conn_type = if is_file_transfer {
         ConnType::FILE_TRANSFER
@@ -1376,6 +1377,7 @@ pub fn session_add(
         get_adapter_luid(),
         shared_password,
         conn_token,
+        login_method,
     );
 
     let session = Arc::new(session.clone());

src/flutter_ffi.rs

@@ -160,6 +160,7 @@ pub fn session_add_sync(
     password: String,
     is_shared_password: bool,
     conn_token: Option<String>,
+    login_method: String,
 ) -> SyncReturn<String> {
     let add_res = session_add(
         &session_id,
@@ -174,6 +175,7 @@ pub fn session_add_sync(
         password,
         is_shared_password,
         conn_token,
+        &login_method,
     );
     // We can't put the remove call together with `std::env::var("IS_TERMINAL_ADMIN")`.
     // Because there are some `bail!` in `session_add()`, we must make sure `IS_TERMINAL_ADMIN` is removed at last.
@@ -3053,6 +3055,8 @@ pub fn session_get_common(
     if let Some(s) = sessions::get_session_by_session_id(&session_id) {
         let v = if key == "is_screenshot_supported" {
             s.is_screenshot_supported().to_string()
+        } else if key == "login_method" {
+            s.lc.read().unwrap().get_login_method().to_owned()
         } else {
             "".to_owned()
         };

src/lang/ar.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "مدة الثقة (بالأيام)"),
         ("Renew trust", "تجديد الثقة"),
         ("install-directory-not-empty-tip", "المجلد المحدد ليس فارغًا. قد يؤدي التثبيت إلى حذف البيانات الموجودة. يُنصح باختيار مجلد آخر."),
+        ("Request approval", "طلب الموافقة"),
     ].iter().cloned().collect();
 }

src/lang/az.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Etibar müddəti (gün)"),
         ("Renew trust", "Etibarı yenilə"),
         ("install-directory-not-empty-tip", "Seçilmiş qovluq boş deyil. Quraşdırma mövcud məlumatları silə bilər. Başqa qovluq seçməyiniz tövsiyə olunur."),
+        ("Request approval", "Təsdiq istə"),
     ].iter().cloned().collect();
 }

src/lang/be.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Тэрмін даверу (у днях)"),
         ("Renew trust", "Падоўжыць давер"),
         ("install-directory-not-empty-tip", "Выбраная папка не пустая. Усталёўванне можа выдаліць наяўныя даныя. Лепш выберыце іншую папку."),
+        ("Request approval", "Запытаць дазвол"),
     ].iter().cloned().collect();
 }

src/lang/bg.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Срок на доверие (дни)"),
         ("Renew trust", "Подновяване на доверието"),
         ("install-directory-not-empty-tip", "Избраната папка не е празна. Инсталацията може да изтрие съществуващите данни. Препоръчително е да изберете друга папка."),
+        ("Request approval", "Поискай одобрение"),
     ].iter().cloned().collect();
 }

src/lang/ca.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Durada de la confiança (dies)"),
         ("Renew trust", "Renova la confiança"),
         ("install-directory-not-empty-tip", "La carpeta seleccionada no és buida. La instal·lació pot suprimir les dades existents. Considereu triar una altra carpeta."),
+        ("Request approval", "Sol·licita aprovació"),
     ].iter().cloned().collect();
 }

src/lang/cn.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "信任有效期（天）"),
         ("Renew trust", "延长信任有效期"),
         ("install-directory-not-empty-tip", "所选文件夹不为空。安装可能删除现有数据。建议选择其他文件夹。"),
+        ("Request approval", "请求批准"),
     ].iter().cloned().collect();
 }

src/lang/cs.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Doba důvěry (dny)"),
         ("Renew trust", "Obnovit důvěru"),
         ("install-directory-not-empty-tip", "Vybraná složka není prázdná. Instalace může odstranit existující data. Zvažte výběr jiné složky."),
+        ("Request approval", "Požádat o schválení"),
     ].iter().cloned().collect();
 }

src/lang/da.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Tillidsperiode (dage)"),
         ("Renew trust", "Forny tillid"),
         ("install-directory-not-empty-tip", "Den valgte mappe er ikke tom. Installationen kan slette eksisterende data. Overvej at vælge en anden mappe."),
+        ("Request approval", "Anmod om godkendelse"),
     ].iter().cloned().collect();
 }

src/lang/de.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Vertrauensdauer (Tage)"),
         ("Renew trust", "Vertrauen erneuern"),
         ("install-directory-not-empty-tip", "Der ausgewählte Ordner ist nicht leer. Bei der Installation können vorhandene Daten gelöscht werden. Erwägen Sie, einen anderen Ordner auszuwählen."),
+        ("Request approval", "Genehmigung anfordern"),
     ].iter().cloned().collect();
 }

src/lang/el.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Διάρκεια εμπιστοσύνης (ημέρες)"),
         ("Renew trust", "Ανανέωση εμπιστοσύνης"),
         ("install-directory-not-empty-tip", "Ο επιλεγμένος φάκελος δεν είναι κενός. Η εγκατάσταση ενδέχεται να διαγράψει υπάρχοντα δεδομένα. Εξετάστε το ενδεχόμενο να επιλέξετε διαφορετικό φάκελο."),
+        ("Request approval", "Αίτημα έγκρισης"),
     ].iter().cloned().collect();
 }

src/lang/eo.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Daŭro de fido (tagoj)"),
         ("Renew trust", "Renovigi fidon"),
         ("install-directory-not-empty-tip", "La elektita dosierujo ne estas malplena. La instalado povas forigi ekzistantajn datumojn. Konsideru elekti alian dosierujon."),
+        ("Request approval", "Peti aprobon"),
     ].iter().cloned().collect();
 }

src/lang/es.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Duración de la confianza (días)"),
         ("Renew trust", "Renovar confianza"),
         ("install-directory-not-empty-tip", "La carpeta seleccionada no está vacía. La instalación puede eliminar los datos existentes. Considera elegir otra carpeta."),
+        ("Request approval", "Solicitar aprobación"),
     ].iter().cloned().collect();
 }

src/lang/et.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Usalduse kestus (päevades)"),
         ("Renew trust", "Uuenda usaldust"),
         ("install-directory-not-empty-tip", "Valitud kaust ei ole tühi. Paigaldamine võib olemasolevad andmed kustutada. Kaalu teise kausta valimist."),
+        ("Request approval", "Küsi heakskiitu"),
     ].iter().cloned().collect();
 }

src/lang/eu.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Konfiantzaren iraupena (egunak)"),
         ("Renew trust", "Berritu konfiantza"),
         ("install-directory-not-empty-tip", "Hautatutako karpeta ez dago hutsik. Instalazioak lehendik dauden datuak ezaba ditzake. Beste karpeta bat aukeratzea gomendatzen da."),
+        ("Request approval", "Eskatu onespena"),
     ].iter().cloned().collect();
 }

src/lang/fa.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "مدت اعتماد (روز)"),
         ("Renew trust", "تمدید اعتماد"),
         ("install-directory-not-empty-tip", "پوشه انتخاب‌شده خالی نیست. نصب ممکن است داده‌های موجود را حذف کند. بهتر است پوشه دیگری انتخاب کنید."),
+        ("Request approval", "درخواست تأیید"),
     ].iter().cloned().collect();
 }

src/lang/fi.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Luottamuksen kesto (päivää)"),
         ("Renew trust", "Jatka luottamusta"),
         ("install-directory-not-empty-tip", "Valittu kansio ei ole tyhjä. Asennus voi poistaa olemassa olevia tietoja. Harkitse toisen kansion valitsemista."),
+        ("Request approval", "Pyydä hyväksyntää"),
     ].iter().cloned().collect();
 }

src/lang/fr.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Durée de confiance (jours)"),
         ("Renew trust", "Renouveler la confiance"),
         ("install-directory-not-empty-tip", "Le dossier sélectionné n’est pas vide. L’installation peut supprimer des données existantes. Envisagez de choisir un autre dossier."),
+        ("Request approval", "Demander l'approbation"),
     ].iter().cloned().collect();
 }

src/lang/ge.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "ნდობის ხანგრძლივობა (დღე)"),
         ("Renew trust", "ნდობის განახლება"),
         ("install-directory-not-empty-tip", "არჩეული საქაღალდე ცარიელი არ არის. ინსტალაციამ შეიძლება წაშალოს არსებული მონაცემები. რეკომენდებულია სხვა საქაღალდის არჩევა."),
+        ("Request approval", "დამტკიცების მოთხოვნა"),
     ].iter().cloned().collect();
 }

src/lang/gl.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Duración da confianza (días)"),
         ("Renew trust", "Renovar a confianza"),
         ("install-directory-not-empty-tip", "O cartafol seleccionado non está baleiro. A instalación pode eliminar os datos existentes. Considera escoller outro cartafol."),
+        ("Request approval", "Solicitar aprobación"),
     ].iter().cloned().collect();
 }

src/lang/gu.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "વિશ્વાસ અવધિ (દિવસો)"),
         ("Renew trust", "વિશ્વાસ નવીકરણ કરો"),
         ("install-directory-not-empty-tip", "પસંદ કરેલ ફોલ્ડર ખાલી નથી. ઇન્સ્ટોલેશન હાલનો ડેટા કાઢી નાખી શકે છે. બીજું ફોલ્ડર પસંદ કરવાનું વિચારો."),
+        ("Request approval", "મંજૂરીની વિનંતી કરો"),
     ].iter().cloned().collect();
 }

src/lang/he.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "משך האמון (ימים)"),
         ("Renew trust", "חידוש אמון"),
         ("install-directory-not-empty-tip", "התיקייה שנבחרה אינה ריקה. ההתקנה עלולה למחוק נתונים קיימים. מומלץ לבחור תיקייה אחרת."),
+        ("Request approval", "בקש אישור"),
     ].iter().cloned().collect();
 }

src/lang/hi.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "विश्वास अवधि (दिन)"),
         ("Renew trust", "विश्वास नवीनीकृत करें"),
         ("install-directory-not-empty-tip", "चयनित फ़ोल्डर खाली नहीं है। इंस्टॉलेशन से मौजूदा डेटा हट सकता है। कोई दूसरा फ़ोल्डर चुनने पर विचार करें।"),
+        ("Request approval", "स्वीकृति का अनुरोध करें"),
     ].iter().cloned().collect();
 }

src/lang/hr.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Trajanje povjerenja (dani)"),
         ("Renew trust", "Obnovi povjerenje"),
         ("install-directory-not-empty-tip", "Odabrana mapa nije prazna. Instalacija može izbrisati postojeće podatke. Razmislite o odabiru druge mape."),
+        ("Request approval", "Zatraži odobrenje"),
     ].iter().cloned().collect();
 }

src/lang/hu.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Megbízhatóság időtartama (nap)"),
         ("Renew trust", "Megbízhatóság megújítása"),
         ("install-directory-not-empty-tip", "A kiválasztott mappa nem üres. A telepítés törölheti a meglévő adatokat. Fontolja meg egy másik mappa kiválasztását."),
+        ("Request approval", "Jóváhagyás kérése"),
     ].iter().cloned().collect();
 }

src/lang/id.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Durasi kepercayaan (hari)"),
         ("Renew trust", "Perbarui kepercayaan"),
         ("install-directory-not-empty-tip", "Folder yang dipilih tidak kosong. Instalasi dapat menghapus data yang ada. Pertimbangkan untuk memilih folder lain."),
+        ("Request approval", "Minta persetujuan"),
     ].iter().cloned().collect();
 }

src/lang/it.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Durata attendibilità (giorni)"),
         ("Renew trust", "Rinnova attendibilità"),
         ("install-directory-not-empty-tip", "La cartella selezionata non è vuota. L'installazione potrebbe eliminare i dati esistenti. Valuta la possibilità di scegliere una cartella diversa."),
+        ("Request approval", ""),
     ].iter().cloned().collect();
 }

src/lang/ja.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "信頼期間 (日)"),
         ("Renew trust", "信頼を更新"),
         ("install-directory-not-empty-tip", "選択したフォルダーは空ではありません。インストールにより既存のデータが削除される可能性があります。別のフォルダーを選択することをおすすめします。"),
+        ("Request approval", "承認を要求"),
     ].iter().cloned().collect();
 }

src/lang/ko.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "신뢰 유지 기간 (일)"),
         ("Renew trust", "신뢰 갱신"),
         ("install-directory-not-empty-tip", "선택한 폴더가 비어 있지 않습니다. 설치 시 기존 데이터가 삭제될 수 있습니다. 다른 폴더를 선택하는 것이 좋습니다."),
+        ("Request approval", "승인 요청"),
     ].iter().cloned().collect();
 }

src/lang/kz.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Сенім мерзімі (күн)"),
         ("Renew trust", "Сенімді жаңарту"),
         ("install-directory-not-empty-tip", "Таңдалған бума бос емес. Орнату бар деректерді жоюы мүмкін. Басқа буманы таңдаған жөн."),
+        ("Request approval", "Мақұлдауды сұрау"),
     ].iter().cloned().collect();
 }

src/lang/lt.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Pasitikėjimo trukmė (dienomis)"),
         ("Renew trust", "Atnaujinti pasitikėjimą"),
         ("install-directory-not-empty-tip", "Pasirinktas aplankas nėra tuščias. Diegimas gali ištrinti esamus duomenis. Apsvarstykite galimybę pasirinkti kitą aplanką."),
+        ("Request approval", "Prašyti patvirtinimo"),
     ].iter().cloned().collect();
 }

src/lang/lv.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Uzticēšanās ilgums (dienas)"),
         ("Renew trust", "Atjaunot uzticēšanos"),
         ("install-directory-not-empty-tip", "Izvēlētā mape nav tukša. Instalēšana var izdzēst esošos datus. Apsveriet iespēju izvēlēties citu mapi."),
+        ("Request approval", "Pieprasīt apstiprinājumu"),
     ].iter().cloned().collect();
 }

src/lang/ml.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "വിശ്വാസ കാലാവധി (ദിവസം)"),
         ("Renew trust", "വിശ്വാസം പുതുക്കുക"),
         ("install-directory-not-empty-tip", "തിരഞ്ഞെടുത്ത ഫോൾഡർ ശൂന്യമല്ല. ഇൻസ്റ്റാളേഷൻ നിലവിലുള്ള ഡാറ്റ ഇല്ലാതാക്കിയേക്കാം. മറ്റൊരു ഫോൾഡർ തിരഞ്ഞെടുക്കുന്നത് പരിഗണിക്കുക."),
+        ("Request approval", "അംഗീകാരം അഭ്യർത്ഥിക്കുക"),
     ].iter().cloned().collect();
 }

src/lang/nb.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Klareringsperiode (dager)"),
         ("Renew trust", "Forny klarering"),
         ("install-directory-not-empty-tip", "Den valgte mappen er ikke tom. Installasjonen kan slette eksisterende data. Vurder å velge en annen mappe."),
+        ("Request approval", "Be om godkjenning"),
     ].iter().cloned().collect();
 }

src/lang/nl.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Vertrouwensperiode (dagen)"),
         ("Renew trust", "Vertrouwen hernieuwen"),
         ("install-directory-not-empty-tip", "De geselecteerde map is niet leeg. De installatie kan bestaande gegevens verwijderen. Overweeg een andere map te kiezen."),
+        ("Request approval", "Goedkeuring aanvragen"),
     ].iter().cloned().collect();
 }

src/lang/pl.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Okres zaufania (dni)"),
         ("Renew trust", "Odnów zaufanie"),
         ("install-directory-not-empty-tip", "Wybrany folder nie jest pusty. Instalacja może usunąć istniejące dane. Rozważ wybranie innego folderu."),
+        ("Request approval", "Poproś o zatwierdzenie"),
     ].iter().cloned().collect();
 }

src/lang/pt_BR.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Duração da confiança (dias)"),
         ("Renew trust", "Renovar confiança"),
         ("install-directory-not-empty-tip", "A pasta selecionada não está vazia. A instalação pode excluir dados existentes. Considere escolher outra pasta."),
+        ("Request approval", "Solicitar aprovação"),
     ].iter().cloned().collect();
 }

src/lang/pt_PT.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Duração da confiança (dias)"),
         ("Renew trust", "Renovar confiança"),
         ("install-directory-not-empty-tip", "A pasta selecionada não está vazia. A instalação pode eliminar dados existentes. Considere escolher outra pasta."),
+        ("Request approval", "Solicitar aprovação"),
     ].iter().cloned().collect();
 }

src/lang/ro.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Durata încrederii (zile)"),
         ("Renew trust", "Reînnoiește încrederea"),
         ("install-directory-not-empty-tip", "Folderul selectat nu este gol. Instalarea poate șterge datele existente. Ia în considerare alegerea altui folder."),
+        ("Request approval", "Solicită aprobarea"),
     ].iter().cloned().collect();
 }

src/lang/ru.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Срок доверия (в днях)"),
         ("Renew trust", "Продлить доверие"),
         ("install-directory-not-empty-tip", "Выбранная папка не пуста. При установке существующие данные могут быть удалены. Рекомендуется выбрать другую папку."),
+        ("Request approval", "Запросить одобрение"),
     ].iter().cloned().collect();
 }

src/lang/sc.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Durada de sa fidùtzia (dies)"),
         ("Renew trust", "Annoa sa fidùtzia"),
         ("install-directory-not-empty-tip", "Sa cartella seletzionada non est bòida. S'installatzione diat pòdere iscantzellare sos datos chi bi sunt. Ti cussigiamus de isseberare un'àtera cartella."),
+        ("Request approval", "Pedi s'aprovatzione"),
     ].iter().cloned().collect();
 }

src/lang/sk.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Doba dôvery (dni)"),
         ("Renew trust", "Obnoviť dôveru"),
         ("install-directory-not-empty-tip", "Vybraný priečinok nie je prázdny. Inštalácia môže odstrániť existujúce údaje. Zvážte výber iného priečinka."),
+        ("Request approval", "Požiadať o schválenie"),
     ].iter().cloned().collect();
 }

src/lang/sl.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Trajanje zaupanja (dni)"),
         ("Renew trust", "Obnovi zaupanje"),
         ("install-directory-not-empty-tip", "Izbrana mapa ni prazna. Namestitev lahko izbriše obstoječe podatke. Razmislite o izbiri druge mape."),
+        ("Request approval", "Zahtevaj odobritev"),
     ].iter().cloned().collect();
 }

src/lang/sq.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Kohëzgjatja e besimit (ditë)"),
         ("Renew trust", "Rinovo besimin"),
         ("install-directory-not-empty-tip", "Dosja e zgjedhur nuk është bosh. Instalimi mund të fshijë të dhënat ekzistuese. Konsideroni të zgjidhni një dosje tjetër."),
+        ("Request approval", "Kërko miratim"),
     ].iter().cloned().collect();
 }

src/lang/sr.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Trajanje poverenja (dani)"),
         ("Renew trust", "Obnovi poverenje"),
         ("install-directory-not-empty-tip", "Izabrani direktorijum nije prazan. Instalacija može da obriše postojeće podatke. Razmislite o izboru drugog direktorijuma."),
+        ("Request approval", "Zatraži odobrenje"),
     ].iter().cloned().collect();
 }

src/lang/sv.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Förtroendeperiod (dagar)"),
         ("Renew trust", "Förnya förtroende"),
         ("install-directory-not-empty-tip", "Den valda mappen är inte tom. Installationen kan radera befintliga data. Överväg att välja en annan mapp."),
+        ("Request approval", "Begär godkännande"),
     ].iter().cloned().collect();
 }

src/lang/ta.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "நம்பிக்கைக் காலம் (நாட்கள்)"),
         ("Renew trust", "நம்பிக்கையைப் புதுப்பி"),
         ("install-directory-not-empty-tip", "தேர்ந்தெடுக்கப்பட்ட கோப்புறை காலியாக இல்லை. நிறுவல் ஏற்கனவே உள்ள தரவை நீக்கக்கூடும். வேறு கோப்புறையைத் தேர்ந்தெடுப்பது நல்லது."),
+        ("Request approval", "ஒப்புதல் கோரவும்"),
     ].iter().cloned().collect();
 }

src/lang/template.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", ""),
         ("Renew trust", ""),
         ("install-directory-not-empty-tip", ""),
+        ("Request approval", ""),
     ].iter().cloned().collect();
 }

src/lang/th.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "ระยะเวลาการเชื่อถือ (วัน)"),
         ("Renew trust", "ต่ออายุการเชื่อถือ"),
         ("install-directory-not-empty-tip", "โฟลเดอร์ที่เลือกไม่ว่างเปล่า การติดตั้งอาจลบข้อมูลที่มีอยู่ ควรพิจารณาเลือกโฟลเดอร์อื่น"),
+        ("Request approval", "ขออนุมัติ"),
     ].iter().cloned().collect();
 }

src/lang/tr.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Güven süresi (gün)"),
         ("Renew trust", "Güveni yenile"),
         ("install-directory-not-empty-tip", "Seçilen klasör boş değil. Kurulum mevcut verileri silebilir. Farklı bir klasör seçmeyi düşünün."),
+        ("Request approval", "Onay iste"),
     ].iter().cloned().collect();
 }

src/lang/tw.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "信任有效期（天）"),
         ("Renew trust", "延長信任期限"),
         ("install-directory-not-empty-tip", "所選資料夾不是空的。安裝可能刪除現有資料。建議選擇其他資料夾。"),
+        ("Request approval", "請求批准"),
     ].iter().cloned().collect();
 }

src/lang/uk.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Термін довіри (у днях)"),
         ("Renew trust", "Подовжити довіру"),
         ("install-directory-not-empty-tip", "Вибрана тека не порожня. Встановлення може видалити наявні дані. Радимо вибрати іншу теку."),
+        ("Request approval", "Запросити схвалення"),
     ].iter().cloned().collect();
 }

src/lang/ur.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "اعتماد کی مدت (دن)"),
         ("Renew trust", "اعتماد کی تجدید کریں"),
         ("install-directory-not-empty-tip", "منتخب فولڈر خالی نہیں ہے۔ انسٹالیشن موجودہ ڈیٹا کو حذف کر سکتی ہے۔ کوئی دوسرا فولڈر منتخب کرنے پر غور کریں۔"),
+        ("Request approval", "منظوری کی درخواست کریں"),
     ].iter().cloned().collect();
 }

src/lang/vi.rs

@@ -824,5 +824,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
         ("Trust duration (days)", "Thời hạn tin cậy (ngày)"),
         ("Renew trust", "Gia hạn tin cậy"),
         ("install-directory-not-empty-tip", "Thư mục đã chọn không trống. Quá trình cài đặt có thể xóa dữ liệu hiện có. Hãy cân nhắc chọn một thư mục khác."),
+        ("Request approval", "Yêu cầu phê duyệt"),
     ].iter().cloned().collect();
 }

src/ui/remote.rs

@@ -621,7 +621,7 @@ impl SciterSession {
             .lc
             .write()
             .unwrap()
-            .initialize(id, conn_type, None, force_relay, None, None, None);
+            .initialize(id, conn_type, None, force_relay, None, None, None, "");
 
         Self(session)
     }