ShadowPermissions

Do not edit. On update, this file and the language files are moved to the new version automatically: everything you changed is carried over, the old files are kept in backup/<date>/, and if something needs your attention you will find PORTING-<version>.txt in this folder. starter.yml is never touched.

The name of this server. It becomes the "server=<id>" context on its own and identifies this server in multi-server synchronisation.

The server language. Matches a file in lang/ (without .yml). Ships with en_US and it_IT. Set "it_IT" here for an Italian server.

true = each player sees the language of their own client, when available.

Used only for keys missing from the chosen language.

true = lets you open the file with DBeaver while the server is running.

Table prefix. Useful when the database is shared with other plugins.

true = if the database stops answering the plugin enters safe mode instead of shutting down: permissions keep working read-only from the snapshot.

true = if the configured MySQL does not answer, use the local database.

Seconds between local snapshots (0 = off).

true = resolves the UUID of a never-seen name by asking Mojang. Off by default: no data leaves the server.

INJECT     replaces the player's Permissible: complete wildcards, even over
           nodes no plugin ever declared. Recommended.

ATTACHMENT uses the Bukkit API only: more conservative, wildcards limited to

declared permissions. If INJECT fails this is used on its own.

The group a new arrival lands in. Out of the box it is "member", the first rung of the ladder the plugin builds by itself on the first start (see starter.yml). Change it if your ladder starts somewhere else.

true = every new player joins the default group automatically.

true = a group you create inherits the default group straight away.

How the main group is chosen: STORED | HIGHEST_WEIGHT | FIRST

FULL    essentials.* also covers essentials.fly.others

SHALLOW essentials.* covers only the next level down

OFF     wildcards are ordinary nodes

true = a node with a context beats a global node of the same holder.

RESPECT an operator gets every OP-default permission, as on a plain server

IGNORE  being an operator grants nothing: only groups count (recommended)

MANAGED like IGNORE, but /op and /deop add and remove managed-group

Contexts that always apply, decided by you.

A player is usually in more than one group. Which one shows in front of their name?

HIGHEST  only one: the most important.
CONCAT   all of them, most important first.
         A Founder who is also a VIP becomes  [FOUNDER][VIP] Name

1. the prefix set on the person, if there is one;
2. among groups, the highest priority;
3. on equal priority, the group with the greater weight.

What to put between one prefix and the next with CONCAT.

How many prefixes at most with CONCAT (0 = all of them). Somebody in six groups would carry six tags in front of their name: that is not a rank any more, it is a wall.

true = the plugin puts the space between a prefix and the name, and between the name and a suffix, when whoever wrote them did not. Nobody should have to remember a trailing space, and forgetting it glues [VIP] to the name in chat, in the tab list and above the head all at once. Set it to false if you want a prefix deliberately touching the name.

Seconds an offline player stays in memory (0 = for ever).

How often temporary permissions are checked for expiry, in seconds.

When text is needed (a group name, a search, a prefix) the plugin asks for it in chat, with the [✔] and [✘] buttons underneath. Seconds to wait before giving up on its own:

A blank line above and below the request, to set it apart from the chat.

Shortcut for gui.icons.common.filler.

The eleven ranks of starter.yml, each one recognisable at a glance.

Iron, amethyst and a nether star: the icons ShadowEssentials gives the same three tiers in vips/, so a rank looks the same wherever you meet it.

Shared by every menu

Main menu

Group list

The screen of one group or one user

Node list and node editor

Yellow means "not this group's": it arrives from a group above and is shown read-only, because the place to change it is the group that owns it.

Context picker

Duration picker

Permission catalogue

The four states of a permission in the catalogue: the one the group has, the one it is denied, the one it inherits, the one it inherits denied.

Tracks

Status screen

Change log

Operators

true = you cannot edit a group whose weight is equal to or above your own.

true = you cannot take your own main group away from yourself.

true = handing out a "shadowperms.*" node requires already holding it. Without this, anybody who can edit permissions can grant "shadowperms.bypass.weight" to a second account and then log into it: two legal moves, one administrator more. Outside our own namespace nothing changes, and taking a permission away is always allowed.

0 = keep for ever.

Also registers /lp with the same syntax. Ignored when LuckPerms is present.

true = also includes nodes never declared but actually checked.

What is sent, every 30 minutes: that this server runs ShadowPermissions, the plugin, Minecraft/Paper and Java versions, the operating system, the number of CPU cores, how many players are online (a number, nothing else), a random serverUuid that identifies nothing, and whether the storage is the local database or MySQL. No player data leaves the server: no names, no UUIDs, no addresses, no groups or permissions.

Half red and half white, like the mark itself.