Permissions
Zander uses LuckPerms for permission management across all components. Permissions follow dot-notation (e.g. zander.discord.punish.warn) and support wildcard notation (e.g. zander.discord.punish.* grants all punish sub-permissions).
Permissions are checked against the user's linked Minecraft account - both Discord commands and the web dashboard look up the player's LuckPerms groups via that account.
Minecraft Plugin Permissions
zander-addon
No permission nodes are declared in plugin.yml or checked in code - /policy and /social are open to any player (console senders are rejected, but there's no LuckPerms gate). If the current build behaves differently in your deployment, treat that as a local customisation rather than default behaviour.
zander-hub
| Permission | Default | Description |
|---|---|---|
zander.hub.fly | op (undeclared) | The node that actually gates /fly. Checked directly by commands/fly.java (sender.hasPermission("zander.hub.fly")). Grant this to give a player flight. |
zander.fly | op | Declared in plugin.yml for /fly, but no code reads it - it is an orphaned declaration with no runtime effect. |
zanderhub.administrator | op | Declared in plugin.yml; no corresponding check was found in the reviewed source - may gate features not covered in this pass |
zanderhub.build | op | Declared in plugin.yml; no corresponding check was found in the reviewed source |
/fly node is zander.hub.flyzander-hub's plugin.yml declares the /fly permission as zander.fly, but commands/fly.java gates execution on sender.hasPermission("zander.hub.fly") - Bukkit does not require the code to check the string a command declares in plugin.yml, and here it doesn't. The declared zander.fly node is therefore dead: nothing reads it. The node that grants flight is zander.hub.fly, which is not declared in plugin.yml and so falls back to Bukkit's default for undeclared permissions (op-only). To grant fly access via LuckPerms, grant zander.hub.fly - granting zander.fly alone does nothing.
zander-hub also declares /connect <server> in plugin.yml, but no command executor for it was found in the reviewed source - it may be unimplemented in the current build.
zander-pgm
| Permission | Default | Description |
|---|---|---|
zanderpgm.admin | op | /zpgm admin subcommands (status, reload, reconnect, flush, debug) |
zanderpgm.vote | true | /vote, /mapvote |
zanderpgm.rate | true | /maprate, /mapfeedback, /maprating |
zanderpgm.stats | true | Stat-viewing access |
zanderpgm.profile | true | Profile access |
zanderpgm.maptokens.admin / .grant / .remove / .set / .balance.others / .history / .status / .clear | op | In-game Map Token admin subcommands - note that balance management (grant/remove/set/history) has moved to the zander-web dashboard; only status and clear remain functional in-game |
These zanderpgm.* nodes are separate from zander-web's LuckPerms-style zander.web.mixed dashboard permission - they gate in-game command usage only, not the web dashboard.
zander-velocity (Private Messaging & Moderation)
| Permission | Description |
|---|---|
zander.command.message | Send private messages to other online players |
zander.command.reply | Reply to the last private message conversation |
zander.command.ignore | Manage your personal ignore list |
zander.command.togglemessages | Toggle whether you receive inbound private messages |
zander.moderation.chat.freeze | Confirmed in code - toggle network-wide chat freeze (/freezechat) |
zander.report.notify | Confirmed in code - receive broadcast notifications when a /report is submitted |
Only /freezechat and /report were confirmed against source for permission checks. Other zander-velocity commands (/message, /reply, /ignore, /togglemessages, /clearchat, /discord, /rules, /website, /ping) exist and are registered, but their exact permission requirements weren't individually re-verified in the newer research pass - the table above reflects what's documented; if enforcement matters, check the command classes directly.
zander-waterfall
No permission nodes are declared in plugin.yml, and no code-level permission checks were identified for this module's commands (/ping, /rules, /discord, /website, /report) - unlike zander-velocity, it has no equivalent moderation command with a confirmed permission node.
zander-bridge
zander-bridge declares no permission nodes and registers no player-facing commands - confirmed against its source (on branch codex/support-velocity-and-paper-in-bridge; plugin.yml, velocity-plugin.json, and the paper/velocity plugin classes). It runs entirely as a background service: it polls zander-web for tasks and executes them as console commands, so there is nothing for in-game permissions to gate. Access control is instead the API key (x-access-token) it presents to zander-web. See the Overview page for the module note.
Discord Permissions
These permission nodes are stored in LuckPerms and checked when Discord bot commands are invoked. The calling user must have their Minecraft account linked for permission checks to resolve.
Punishment Commands (/punish)
| Permission | Subcommand(s) | Description |
|---|---|---|
zander.discord.punish.warn | warn | Issue a warning to a Discord user |
zander.discord.punish.kick | kick | Kick a user from the Discord guild |
zander.discord.punish.ban | ban, tempban, unban | Permanently or temporarily ban/unban a user |
zander.discord.punish.mute | mute, tempmute, unmute | Mute/unmute a user in chat and voice |
zander.discord.punish.history | history | View cross-platform punishment history |
Staff Commands
| Permission | Command | Description |
|---|---|---|
zander.web.audit | /audit, /staff-audit-report | Audit user activity or trigger the staff audit report |
zander.web.bridge | /bridge | Manage the command bridge executor queue |
zander.discord.lpaudit | /lp-audit | Read-only audit of LuckPerms ↔ Discord role sync |
zander.web.nicknamecheck | /nicknamecheck | Manually scan for Discord nickname mismatches |
Web Dashboard Permissions
All dashboard routes are protected by a session check (user must be logged in) and a LuckPerms permission check via the user's linked Minecraft account.
| Permission | Dashboard Section | Description |
|---|---|---|
zander.web.dashboard | Overview | Access the main admin dashboard |
zander.web.logs | Logs | View system activity and audit logs |
zander.web.application | Applications | Create, edit, and delete application listings |
zander.web.server | Servers | Add, edit, and remove server entries |
zander.web.announcements | Announcements | Create and manage announcements |
zander.web.vault | Vault | Manage vault entries |
zander.web.badges | Badges | Create, edit, duplicate, and manually assign/revoke badges |
zander.web.rank | Ranks | View and configure ranks |
zander.web.scheduler | Scheduler | Schedule Discord messages |
zander.web.tickets | Support | Base access to the support ticket dashboard |
zander.web.tickets.<slug> | Support | Access tickets in a specific category (e.g. zander.web.tickets.general) |
zander.web.tickets.* | Support | Access tickets in all categories |
zander.web.punishment.manage | Web Punishments | Create and lift website punishments |
zander.web.punishment.view | Punishments | View the public punishment log at /punishments |
zander.web.forms | Forms | Access the Forms dashboard |
zander.web.forms.<slug> | Forms | Access responses for a specific form (e.g. zander.web.forms.feedback) |
zander.web.forms.* | Forms | Access responses for all forms |
zander.web.voting | Voting | Manage voting sites, reward templates, and leaderboards |
zander.web.events | Events | Create, edit, and manage events and templates |
zander.web.events.review | Events | Access the event review queue; approve or reject submissions |
zander.web.bridge | Bridge | Access the bridge executor dashboard |
Forum Permissions
| Permission | Description |
|---|---|
zander.forums.moderate | General forum moderation - edit or manage any content |
zander.forums.post.delete | Delete any forum post |
zander.forums.viewArchived | View archived discussions |
zander.forums.discussion.sticky | Pin or unpin discussions |
zander.forums.discussion.lock | Lock or unlock discussions |
zander.forums.discussion.archive | Archive or unarchive discussions |
zander.forums.category.manage | Manage forum categories from the dashboard |
Forum categories can also carry per-category view and post permission nodes, configured when creating or editing a category from the dashboard.
Events Permissions
| Permission | Description |
|---|---|
zander.web.events | Access the events dashboard, create and edit events and templates |
zander.web.events.review | Access the review queue; approve or reject events submitted for review |
Forms Permissions
| Permission | Description |
|---|---|
zander.web.forms | Base access to the Forms dashboard - view the forms list |
zander.web.forms.<slug> | Access responses for a specific form (e.g. zander.web.forms.feedback) |
zander.web.forms.* | Access responses for all forms |
Use slug-specific permissions to create focused form teams - your events team can have zander.web.forms.event-signup without seeing general enquiry responses.
Creator Content
| Permission | Description |
|---|---|
zander.watch.creator | Marks the user as a content creator - their Twitch/YouTube content appears on the Watch page |
Wildcard Behaviour
LuckPerms wildcard notation is fully supported across all Zander permission trees:
| Wildcard | Grants |
|---|---|
zander.discord.punish.* | All Discord punishment commands |
zander.forums.* | All forum moderation permissions |
zander.web.forms.* | Access to all form responses |
zander.web.tickets.* | Access to all support ticket categories |
zander.web.* | All web dashboard permissions |
zander.* | All Zander permissions (use with caution) |
Granting zander.* gives full access to all Zander features including punishment commands, event approval, and bridge execution. Only assign this to highly trusted accounts.