Roadmap: Parent Lock for family-safe protection

[MrSaneApps]

Outcome

Add an optional Parent Lock that prevents a standard macOS user from turning off or changing an active family-safe protection profile without parent or administrator approval.

This is not a claim of comprehensive macOS parental controls. SaneHosts remains a hosts-file blocker. Parents should still use a separate standard child account and macOS Screen Time for app limits, account restrictions, and broader content controls.

Why

The current Touch ID/password prompt authenticates the logged-in macOS user. It protects the privileged hosts-file write, but it does not distinguish a parent from a child using the same installed SaneHosts app.

Scope

• Parent enables or disables Parent Lock with administrator authorization.
• The privileged helper, not just the SwiftUI app, owns the lock policy.
• When locked, turning off protection, switching profiles, and changing protected rules requires fresh parent/admin authorization.
• Store policy and any verification material outside user-writable preferences.
• Ensure an older SaneHosts release cannot bypass the lock through the existing helper protocol.
• Explain the boundary clearly: a local administrator or someone with physical recovery access can always undo local controls.
• Add behavioral coverage for setup, lock enforcement, unlock, cancellation, update migration, and old-client rejection.

Delivery Plan

1. Threat model and helper authorization design.
2. Root-helper policy enforcement and app protocol changes.
3. Parent-facing setup/recovery UX and precise copy.
4. Upgrade-path, regression, and real standard-user acceptance testing.
5. Documentation update: recommend Screen Time + a standard child account for comprehensive macOS parental controls.

Non-goals

• Claiming that a four-digit in-app PIN is a secure parental control.
• Building a full VPN, DNS proxy, or Network Extension content-filter product in this issue.
• Replacing macOS Screen Time, Family Sharing, or account restrictions.