add protected room mount type.

internal/room/manager.go

@@ -336,7 +336,10 @@ func (manager *RoomManagerCtx) Create(settings types.RoomSettings) (string, erro
 
 			// prefix host path
 			hostPath = path.Join(manager.config.StorageExternal, templateStoragePath, hostPath)
-		} else if mount.Type == types.MountPublic {
+		} else if mount.Type == types.MountProtected || mount.Type == types.MountPublic {
+			// readonly if mount type is protected
+			readOnly = mount.Type == types.MountProtected
+
 			// public whitelisted mounts
 			var isAllowed = false
 			for _, path := range manager.config.MountsWhitelist {

internal/types/room.go

@@ -44,9 +44,10 @@ type RoomEntry struct {
 type MountType string
 
 const (
-	MountPrivate  MountType = "private"
-	MountTemplate MountType = "template"
-	MountPublic   MountType = "public"
+	MountPrivate   MountType = "private"
+	MountTemplate  MountType = "template"
+	MountProtected MountType = "protected"
+	MountPublic    MountType = "public"
 )
 
 type RoomMount struct {