Admin Roles & Permissions

[WolfoTheWolf]

Being able to specify certain permissions for administrator users on the /admin side of the panel. Basically, one person cannot manage nodes, but another can.

[WolfoTheWolf]

Kind of like this -> https://builtbybit.com/resources/pterodactyl-v1-addon-staff-permissions.20507/

[devnote-dev]

On the permissions side of things, I would strongly advise that role permissions and subuser permissions were separated. Having one Permission class sounds convenient on paper but leads to a lot of complications in practice. Also, I would implore that some kind of enum class type is used instead of the current class of string constants (note that I am not referring to PHP's native enum type, but a class acting as an enum). String permissions are annoying to deal with on their own, but when used in the panel it has lead to several annoying issues such as pterodactyl/panel#4328, pterodactyl/panel#4792, and most recently pterodactyl/panel#5062. Using bitwise permissions would massively simplify handling permissions along with the added benefit of being able to store them in the database as an integer rather than an array of strings.

[TekExplorer]

it doesnt need to extend anything. a simple array of strings is self-contained and easily extendible by virtue of... adding new arbitrary strings.

a plugin could require a permission called "all yo base are belong to ME" and that would be perfectly fine.

we could require or heavily suggest that it be in the form of "plugin_name.some.permission" and that would be perfectly acceptable

bitwise permissions would require we understand the integers. also, what plugin uses what integer? its a time bomb.

arbitrary strings are basically automatically unique, and self-describing, so plugins could even share permissions without ever talking to each other, and it would be meaningful

[devnote-dev]

What you're asking for and what you're describing are two different things. In order for plugins to register their own permissions they would need to extend the existing permissions model which is not possible. What you're describing is a permissions system specific the to plugin which is irrelevant to the original post.

bitwise permissions would require we understand the integers. also, what plugin uses what integer? its a time bomb.

This feels like a straw man argument, you don't need to understand the lower-level workings of bitwise integers, you just need to know what values to use. Most programming languages have some kind of support for enumerations which does the majority of the work for you.

arbitrary strings are basically automatically unique, and self-describing, so plugins could even share permissions without ever talking to each other, and it would be meaningful

Uniqueness doesn't apply here. I suggest you look into Bitwise Integer Operations. Also refer to my last several points about extensibility.

[TekExplorer]

they wouldnt need to "register" anything. Just check if a list contains a string. I see no reason for a more complicated system. Its not like storage space is an issue.

Minecraft LuckPerms style.

[devnote-dev]

How is it a more complicated system? The current string-based one has already proven to have many faults, one being a potential security issue. This simply isn't possible with an integer-based permissions system.

[TekExplorer]

devs who want to use the permissions system would have a harder time with an int based one.
it worsens discoverability, which can be useful if an existing permission can be reused

what faults and security issues are there?

all it does is show what you're allowed to do. an int based system is unnecessarily obfuscated

[Poseidon281]

#157

[lancepioch]

Thanks, please follow: #193