add capability to restrict remote panel modes

mk2driver/managed_writer_test.go

@@ -77,3 +77,21 @@ func TestManagedWriterModeRateLimit(t *testing.T) {
 	assert.Error(t, err)
 	assert.Equal(t, 1, base.panelWrites)
 }
+
+func TestManagedWriterPanelModeAllowlist(t *testing.T) {
+	base := &writerStub{}
+	managed := NewManagedWriter(base, WriterPolicy{
+		Profile: WriterProfileNormal,
+		AllowedPanelStates: map[PanelSwitchState]struct{}{
+			PanelSwitchOff: {},
+		},
+	})
+
+	err := managed.SetPanelStateWithSource(CommandSourceMQTT, PanelSwitchOn, nil)
+	assert.Error(t, err)
+	assert.Equal(t, 0, base.panelWrites)
+
+	err = managed.SetPanelStateWithSource(CommandSourceMQTT, PanelSwitchOff, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, 1, base.panelWrites)
+}