Permissions¶
Canonical specification
This page is ProjectInfo/permissions.md on docs/encryption-modes-spec, rendered at build time. That file is the source of truth; the site holds no copy of it.
Discord-style bitfield system. Server always re-validates — client checks are UI hints only.
Permission Bits¶
| Constant | Value | Description |
|---|---|---|
PermViewChannel |
1 << 0 |
See channel in list + read history |
PermSendMessages |
1 << 1 |
Post new messages |
PermSendTTSMessages |
1 << 2 |
Use /tts command |
PermManageMessages |
1 << 3 |
Delete/pin others' messages |
PermEmbedLinks |
1 << 4 |
Auto-embed URLs |
PermAttachFiles |
1 << 5 |
Upload attachments |
PermReadMessageHistory |
1 << 6 |
Load old messages |
PermMentionEveryone |
1 << 7 |
@everyone / @here |
PermAddReactions |
1 << 8 |
React to messages |
PermConnect |
1 << 10 |
Join voice channel |
PermSpeak |
1 << 11 |
Speak in voice |
PermMuteMembers |
1 << 12 |
Server-mute others |
PermDeafenMembers |
1 << 13 |
Server-deafen others |
PermMoveMembers |
1 << 14 |
Move users between voice channels |
PermUseVAD |
1 << 15 |
Voice Activity Detection |
PermStream |
1 << 16 |
Screen share / stream |
PermChangeNickname |
1 << 17 |
Change own nickname |
PermManageNicknames |
1 << 18 |
Change others' nicknames |
PermManageRoles |
1 << 19 |
Create/edit/delete roles |
PermManageChannels |
1 << 20 |
Create/edit/delete channels |
PermManageServer |
1 << 21 |
Change server settings |
PermKickMembers |
1 << 22 |
Remove members |
PermBanMembers |
1 << 23 |
Ban members |
PermManageWebhooks |
1 << 24 |
Manage webhooks |
PermManageEmoji |
1 << 25 |
Add/remove custom emoji |
PermViewAuditLog |
1 << 26 |
View audit log |
PermViewServerInsights |
1 << 27 |
Server analytics |
PermModerateMembers |
1 << 28 |
Timeout members |
PermAdministrator |
1 << 29 |
Bypasses ALL permission checks |
Default @everyone Permissions¶
PermViewChannel | PermSendMessages | PermReadMessageHistory | PermAddReactions | PermConnect | PermSpeak
Resolution Order¶
1. Start with @everyone role permissions (@everyone role id == server_id)
2. OR in permissions from every role the user holds
3. Apply channel overwrites in order:
a. Role deny bits (AND NOT)
b. Role allow bits (OR)
c. Member deny bits (AND NOT)
d. Member allow bits (OR)
4. If Administrator bit is set at any point → grant all permissions
Server owner shortcut: GetMemberPermissions returns PermAdministrator immediately if server.owner_id == userID, bypassing all role/overwrite checks.
Implementation¶
Server: pkg/middleware/permissions.go — HasPermissions, ComputePermissions
Client: src/permissions/resolver.ts — replicates §4.2 exactly for UI hints.
Example¶
Server:
@everyone: PermSendMessages | PermViewChannel
Moderator: PermManageMessages | PermKickMembers
Alice's roles: [@everyone, Moderator]
Channel #announcements overwrites:
@everyone: deny PermSendMessages
Moderator: allow PermSendMessages
Alice in #announcements:
1. Base = PermSendMessages | PermViewChannel
2. + Moderator = add PermManageMessages | PermKickMembers
3. @everyone deny PermSendMessages → remove it
4. Moderator allow PermSendMessages → add it back
Final = PermSendMessages | PermViewChannel | PermManageMessages | PermKickMembers