VV-Bot

Permissions editor

Edit the LuckPerms groups, permissions and players of a connected Minecraft server from the dashboard, without LuckPerms commands or the LuckPerms web editor. LuckPerms keeps running on your server; the dashboard is a front end for it.

What it does

  • Sync. Read every group the server lets the website see: display name, weight, prefix and suffix, the groups it inherits from, and its permissions with their contexts and expiry.
  • Groups. Create and delete groups, and change their weight, display name, prefix, suffix and inheritance.
  • Permissions. Allow or deny a permission on a group, only on one server or in one world if you like, and for a limited time if you like. The form suggests the permissions your server's plugins register. Several permissions can be added at once, one per line.
  • Players. Look a player up by their linked Minecraft name or their UUID, see their groups and their own permissions, and put them in a group (for good, or for a while) or take them out of one.
  • Ranks. Give a rank a LuckPerms weight by hand, and turn groups that already exist into ranks with "Import from LuckPerms". VV never deletes an imported group.

Every change is sent to the server, applied by LuckPerms, and read back from LuckPerms before the dashboard shows it. Each change has a page that says when it was applied, or why the server refused it.

Switch it on (server owner)

The editor is off until the owner of the Minecraft server switches it on in the plugin's own configuration. Nobody can switch it on from Discord or from this website.

  1. Open plugins/VV-Bot/config.yml in your server's files.
  2. Add this section, or change it if it is there already: 
    lp-editor:
  enabled: true
  groups: ["*"]                # groups the website may read and change
  users: true                  # may the website change which groups a player has
  allow-dangerous-nodes: false # `*`, `luckperms.*` and operator permissions stay refused
  max-nodes-per-group: 1000
  weight-max: 9999
  3. Restart the server, or run /vv reload in its console.
  4. On the dashboard, open Permissions under Minecraft and press "Sync groups from the server".

groups is a list of patterns: only groups that match one can be read in detail or changed. For example ["vip*", "builder"] keeps your staff groups out of reach. users: false keeps players out of it entirely.

What it refuses

  • Anything while it is off. The server answers every request with "the editor is not switched on".
  • Groups outside your list. A group that matches none of your groups patterns is never shown in detail and never changed.
  • Dangerous permissions. *, everything starting with luckperms., and the permissions that make operators, stop or reload the server, unless you set allow-dangerous-nodes: true. Even then, the dashboard asks the person to type the permission before it sends it, and the audit log marks it. Removing a dangerous permission is always allowed.
  • LuckPerms data that is not a permission. Keys such as group.admin or prefix.100.x are refused as permissions; use the group's settings and inheritance instead.
  • The default group cannot be deleted, and a group that one of your ranks uses cannot be deleted until the rank is changed or removed.
  • Too much at once. Name and key lengths, contexts, permissions per group, weights and the number of waiting changes are limited, and the server rate limits requests.

Who can use it

Only administrators of the Discord server: its owner, and people with the Discord Administrator permission. People an administrator added under Panel access never see or reach the editor, whatever parts of the panel they were given, and neither do people who only have Manage Server. A server can raise this further with the command overrides permissions view and permissions edit (for example to Owner only, or switch them off), but never lower it.

The security model in plain words

  • Your server decides. The switch, the list of groups, players and dangerous permissions live in your plugin's config.yml. A Discord administrator, the website and VV-Bot itself cannot change them.
  • No console. The website never sends commands to your server. It sends a short list of typed requests (create a group, set a permission, and so on) that the plugin checks again before LuckPerms applies them.
  • Read back. What the dashboard shows is what LuckPerms reported, never what the website assumed.
  • Recorded. Every change is written to the audit log with who made it, on which server, the group or player, the permission and its value.
  • Waits, then drops. A change for a server that is offline waits up to 24 hours and is then dropped, never applied late.