ThunderPerms

# ThunderPerms ThunderPerms is a lightweight permissions plugin for Paper servers. It manages users, groups, inheritance, wildcard permissions, temporary grants, world-scoped grants, backups, audits, and storage diagnostics without NMS or a custom permissible replacement. It works out of the box with YAML storage and also supports SQLite, MySQL, and MariaDB for larger setups. ## Features - Manage player permissions by UUID. - Create and manage permission groups. - Add users to one or more groups. - Add temporary user permissions, group permissions, and group memberships. - Add world-scoped permission grants with `world:`. - Set true and false permission nodes. - Use wildcard nodes such as `teamwork.*`, `blockledger.*`, and `*`. - Configure group inheritance with cycle prevention. - Use group weights to control priority between inherited permissions. - Use `/thunderperms check` to inspect a permission result. - Use `/thunderperms why` to see where a permission result came from. - List known users and groups with pagination. - Delete non-protected groups safely and reassign affected users. - Run `/thunderperms verify` to check data integrity. - Run `/thunderperms repair` to back up and repair invalid data references. - Automatically clean expired permissions and memberships. - Apply Bukkit `PermissionAttachment` entries so normal `sender.hasPermission(...)` checks work. - Reapply attachments when other plugins enable and register permissions. - View storage, user, group, membership, assignment, integrity, and audit status. - Create backups for both YAML and database-backed storage. - Write an audit log for permission, group, repair, and backup actions. - Protect configured file paths from directory traversal. - Database connections use the shared secure storage layer, including safer default TLS settings for MySQL/MariaDB and redacted credential handling. ## Integrations - Bukkit permissions: ThunderPerms applies permissions through Bukkit attachments, so plugins using normal permission checks can be managed by ThunderPerms. - AugmentedThunder plugins: the plugin suite is configured to work with ThunderPerms-managed permission nodes while still falling back safely when ThunderPerms is absent. - StormEconomy, StormParty, and StormFactions: include direct ThunderPerms permission bridge support. - External plugins: any plugin with registered Bukkit permission nodes can be granted or denied through ThunderPerms. ThunderPerms also registers `ThunderPermsApi` so other plugins can check permissions, resolve detailed permission reasons, inspect users and groups, read group parents, read permission assignments, list known groups, and check storage health. ## Commands Main command aliases: - `/thunderperms` - `/tperms` - `/tpms` Common commands: - `/thunderperms user info` - `/thunderperms user permission set [duration] [world:]` - `/thunderperms user permission unset [world:]` - `/thunderperms user group add|remove [duration]` - `/thunderperms list users|groups [page]` - `/thunderperms group create [weight]` - `/thunderperms group delete [replacement-group]` - `/thunderperms group weight ` - `/thunderperms group permission set [duration] [world:]` - `/thunderperms group permission unset [world:]` - `/thunderperms group parent add|remove ` - `/thunderperms group info` - `/thunderperms check [world]` - `/thunderperms why [world]` - `/thunderperms status` - `/thunderperms verify` - `/thunderperms repair` - `/thunderperms backup` - `/thunderperms reload` - `/thunderperms save` ## Permissions - `thunderperms.command` - `thunderperms.user` - `thunderperms.group` - `thunderperms.list` - `thunderperms.check` - `thunderperms.verify` - `thunderperms.repair` - `thunderperms.status` - `thunderperms.reload` - `thunderperms.save` - `thunderperms.backup` - `thunderperms.admin` ## Notes The default storage backend is YAML. SQLite, MySQL, and MariaDB are optional. Operators can bypass ThunderPerms API checks when `op-bypass` is enabled. The default group and built-in `admin` group are protected from deletion. ThunderPerms is designed as a practical permissions manager for small and medium Paper servers, plugin suites, and local development servers.