From 46dde49889eea000b793bd1b0136fa2397a19b01 Mon Sep 17 00:00:00 2001 From: Ryan Barlow <7389646+ryanbarlow97@users.noreply.github.com> Date: Thu, 15 Oct 2026 15:12:46 +0000 Subject: [PATCH 1/2] Document the staff panel Commands tab Co-Authored-By: Claude Opus 5.5 --- projects/ProvinceSystem/README.md | 2 +- .../docs/integrations/luckperms.md | 54 +++++++++++++++++++ projects/TFMCWeb/luckperms-bridge.md | 7 +++ 3 files changed, 62 insertions(+), 1 deletion(-) diff --git a/projects/ProvinceSystem/README.md b/projects/ProvinceSystem/README.md index b6e6fe3..5db572e 100644 --- a/projects/ProvinceSystem/README.md +++ b/projects/ProvinceSystem/README.md @@ -13,7 +13,7 @@ TFMC runs Minecraft **1.21.10**. See the [shared platform and build baseline](.. - [Architecture](docs/architecture.md) - [Accounts, authentication and security](docs/identity/auth-security.md) - [CoreProtect activity and movement](docs/integrations/coreprotect.md) -- [LuckPerms staff panel](docs/integrations/luckperms.md) +- [LuckPerms staff panel and Commands tab](docs/integrations/luckperms.md) - [Rail network](docs/integrations/rail.md) - [Server plugin versions and restart controls](docs/integrations/servers.md) - [Patreon integration](docs/integrations/patreon.md) and [backend protocol](docs/integrations/patreon-backend.md) diff --git a/projects/ProvinceSystem/docs/integrations/luckperms.md b/projects/ProvinceSystem/docs/integrations/luckperms.md index 6f703f1..8cef4ef 100644 --- a/projects/ProvinceSystem/docs/integrations/luckperms.md +++ b/projects/ProvinceSystem/docs/integrations/luckperms.md @@ -135,3 +135,57 @@ are told to check the player); a late result still settles it. A change not fetc bridge is gone. New changes are refused with `bridge_offline` unless the bridge polled in the last 60 s, and always on a site with `LUCKPERMS_READ_ONLY=1` (dev.tfminecraft.net, whose server shares LuckPerms with Main). + +## Commands tab + +`/admin/commands` lists every command the server knows, grouped by plugin, and +which LuckPerms groups may use it. It has two views: a table of commands against +groups, and one group at a time with the commands it may use, those it gains over +the group before it, and the permissions set on the group itself. Mods and above +can see it (`view_luckperms`). + +Access is worked out on the server from the command's own permission only. +Plugins may still refuse a command for other reasons when it runs. A command with +no permission is offered to every player in tab completion; the tab marks these +as "no permission set". + +Groups are shown in three sections. A track's last group is a staff rank, the +groups before it on the track are its steps (hidden until asked for), and every +other group is a player rank. Each section is in weight order. + +### Protocol + +`PUT /luckperms/plugin/commands` (JSON, at most 8 MiB, primary key): + +```json +{ + "server": "main", + "generated_at": 1792076432, + "hash": "", + "groups": ["commoner", "default", "staff"], + "plugins": [{"name": "Essentials", "version": "2.22.0"}], + "commands": [{ + "plugin": "Essentials", + "name": "me", + "aliases": ["eme"], + "description": "Describes an action in the context of the player.", + "usage": null, + "permission": "essentials.me", + "shadowed": false, + "access": "yyy" + }] +} +``` + +`access` has one `y` (allowed) or `n` per entry of `groups`, or is `null` when the +command has no permission. `shadowed` means another plugin owns the plain label, so +this command only runs as `/:`. The site checks the shape, replaces its +stored list (`lp_commands`) and answers `{"ok": true, "commands": }`; a +malformed list is refused with `400 bad_commands`. + +`GET /admin/luckperms/commands` returns `status` (`server`, `generated_at`, +`received_at`, and `fresh` while the list arrived in the last 30 minutes, else +`null` before the first list), `groups` in display order with `kind` +(`rank`, `staff` or `step`), `track`, `members`, `parents` and the group's own +permission nodes from the mirror, and `plugins` with their commands, each `access` +reordered to match `groups`. diff --git a/projects/TFMCWeb/luckperms-bridge.md b/projects/TFMCWeb/luckperms-bridge.md index 66bf26b..789398f 100644 --- a/projects/TFMCWeb/luckperms-bridge.md +++ b/projects/TFMCWeb/luckperms-bridge.md @@ -21,6 +21,13 @@ the group it adds, or any group that group inherits, is outside the admin groups and the age of the last snapshot. +While the bridge runs it also publishes the server's command list for the staff +panel's Commands tab: every registered command with its plugin, aliases and +permission, and whether each LuckPerms group's permissions allow it on this server +(Bukkit's defaults count where LuckPerms has no node). It reads the list a minute +after starting, checks each minute, and uploads when it changes or every ten +minutes. + Set `LUCKPERMS_READ_ONLY=1` on a website that must never queue writes. The backend also refuses new changes without a recent applying bridge poll. See the [website protocol and permission policy](../ProvinceSystem/docs/integrations/luckperms.md), [plugin configuration](https://github.com/TF-Minecraft/TFMCWeb/blob/main/src/main/resources/config.yml), and [bridge implementation](https://github.com/TF-Minecraft/TFMCWeb/tree/main/src/main/java/net/tfminecraft/tfmcweb/luckperms). From 3d904d964b5a8d2e2873eec40d697b18acefbf9d Mon Sep 17 00:00:00 2001 From: Ryan Barlow <7389646+ryanbarlow97@users.noreply.github.com> Date: Thu, 15 Oct 2026 15:35:21 +0000 Subject: [PATCH 2/2] Say what the Commands tab cannot see Co-Authored-By: Claude Opus 5.5 --- projects/ProvinceSystem/docs/integrations/luckperms.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/projects/ProvinceSystem/docs/integrations/luckperms.md b/projects/ProvinceSystem/docs/integrations/luckperms.md index 8cef4ef..ab6c721 100644 --- a/projects/ProvinceSystem/docs/integrations/luckperms.md +++ b/projects/ProvinceSystem/docs/integrations/luckperms.md @@ -144,10 +144,11 @@ groups, and one group at a time with the commands it may use, those it gains ove the group before it, and the permissions set on the group itself. Mods and above can see it (`view_luckperms`). -Access is worked out on the server from the command's own permission only. -Plugins may still refuse a command for other reasons when it runs. A command with -no permission is offered to every player in tab completion; the tab marks these -as "no permission set". +Access is worked out on the server from the command's own Bukkit permission +only. Plugins may still refuse a command when it runs, and Brigadier requirements +or a plugin's own rules may hide it from tab completion. The tab marks a command +that exposes no Bukkit permission as "no permission set"; unless its plugin hides +it some other way, every player is offered it. Groups are shown in three sections. A track's last group is a staff rank, the groups before it on the track are its steps (hidden until asked for), and every