**Migrated from GitHub issue icub3d/decentcom#88** **Original Author:** @icub3d **Original Date:** 2026-04-18T15:00:28Z --- # Feature: Fine-grained Permissions ## Overview Extend the role-based permission system with additional, more granular permission bits to support complex server configurations, bot management, and historical access control. ## Background The current permission system uses a 64-bit mask but only defines 14 bits. To support common server needs (like read-only announcement channels with historical access control or restricting bot command usage), we need more specific flags. ## Requirements - [ ] Add `READ_MESSAGE_HISTORY` (bit 14) - Allow viewing messages sent before the user's current session or before they joined. - [ ] Add `USE_APPLICATION_COMMANDS` (bit 15) - Allow using slash commands or interacting with bots. - [ ] Add `CREATE_INVITE` (bit 16) - Separate the ability to create new invites from the ability to manage/delete them (`MANAGE_INVITES`). - [ ] Update `ALL_PERMISSIONS` and `@admin` role to include these new bits. - [ ] Enforce these permissions in the relevant API handlers. ## Design ### API / Interface Changes - Update `server/src/permissions.rs` to include the new constants. - Update `server/src/messages/handlers.rs` to check `READ_MESSAGE_HISTORY` in `list_messages`. - Update `server/src/invites/handlers.rs` (if it exists) to check `CREATE_INVITE`. ### Data Model Changes - Update the default permissions for the `@everyone` and `@admin` roles in the database migration (`server/migrations/002_roles.sql`) or via a new migration. ### Component Changes - `server/src/permissions.rs`: Define new bit constants. - `server/src/messages/handlers.rs`: Update `list_messages` to check `READ_MESSAGE_HISTORY`. ## Task List - [ ] Define new permission constants in `server/src/permissions.rs`. - [ ] Create a new database migration to update existing roles if necessary (or just update the seed logic). - [ ] Implement permission checks in `list_messages` for `READ_MESSAGE_HISTORY`. - [ ] Implement permission checks for `CREATE_INVITE` in the invite creation handler. - [ ] (Future) Implement UI toggle for these permissions in the client. ## Test List - [ ] Unit test in `permissions.rs` to verify bitwise operations with new bits. - [ ] Integration test: A user with `READ_MESSAGES` but without `READ_MESSAGE_HISTORY` can see live messages but cannot fetch past ones. - [ ] Integration test: A user without `CREATE_INVITE` cannot create an invite link even if they have other membership permissions. ## Open Questions - Should `READ_MESSAGE_HISTORY` apply to all messages in the channel or only those since the user joined? (Standard behavior is usually "all messages in the channel if they have the bit").

icub3d commented

2026-04-26 16:46:18 +00:00

Owner

Migrated from GitHub issue icub3d/decentcom#88
Original Author: @icub3d
Original Date: 2026-04-18T15:00:28Z

Feature: Fine-grained Permissions

Overview

Extend the role-based permission system with additional, more granular permission bits to support complex server configurations, bot management, and historical access control.

Background

The current permission system uses a 64-bit mask but only defines 14 bits. To support common server needs (like read-only announcement channels with historical access control or restricting bot command usage), we need more specific flags.

Requirements

Add READ_MESSAGE_HISTORY (bit 14) - Allow viewing messages sent before the user's current session or before they joined.
Add USE_APPLICATION_COMMANDS (bit 15) - Allow using slash commands or interacting with bots.
Add CREATE_INVITE (bit 16) - Separate the ability to create new invites from the ability to manage/delete them (MANAGE_INVITES).
Update ALL_PERMISSIONS and @admin role to include these new bits.
Enforce these permissions in the relevant API handlers.

Design

API / Interface Changes

Update server/src/permissions.rs to include the new constants.
Update server/src/messages/handlers.rs to check READ_MESSAGE_HISTORY in list_messages.
Update server/src/invites/handlers.rs (if it exists) to check CREATE_INVITE.

Data Model Changes

Update the default permissions for the @everyone and @admin roles in the database migration (server/migrations/002_roles.sql) or via a new migration.

Component Changes

server/src/permissions.rs: Define new bit constants.
server/src/messages/handlers.rs: Update list_messages to check READ_MESSAGE_HISTORY.

Task List

Define new permission constants in server/src/permissions.rs.
Create a new database migration to update existing roles if necessary (or just update the seed logic).
Implement permission checks in list_messages for READ_MESSAGE_HISTORY.
Implement permission checks for CREATE_INVITE in the invite creation handler.
(Future) Implement UI toggle for these permissions in the client.

Test List

Unit test in permissions.rs to verify bitwise operations with new bits.
Integration test: A user with READ_MESSAGES but without READ_MESSAGE_HISTORY can see live messages but cannot fetch past ones.
Integration test: A user without CREATE_INVITE cannot create an invite link even if they have other membership permissions.

Open Questions

Should READ_MESSAGE_HISTORY apply to all messages in the channel or only those since the user joined? (Standard behavior is usually "all messages in the channel if they have the bit").