Skip to content

Role-Based Access Control Update

Choose a tag to compare

View all tags
@FlaxiGG FlaxiGG released this 20 Jun 07:56
1.3.0
8c5e896
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MinePanel v1.3.0 — Role-Based Access Control Update

This update introduces one of the biggest improvements to MinePanel so far.

MinePanel now supports multi-user access with a complete fixed role-based permission system, allowing server owners to safely manage staff access across the web panel.

This update was built directly from community feedback.

✨ New Feature — Role Based Access Control (RBAC)

MinePanel now supports 4 fixed permission roles.

Available roles:

  • Owner
  • Admin
  • Moderator
  • Viewer

Each role has different access permissions inside the panel.

👑 New Default Account System

The default account has been changed.

Before:

admin / admin123

Now:

owner / admin123

Default account properties:

role = owner
mustChangePassword = true

The first login still requires a mandatory password change for security.

🔐 Permission Roles

Owner

Full access to everything.

Permissions:

  • Dashboard
  • Players Management
  • Console View
  • Console Commands
  • Ban Management
  • Whitelist Management
  • Weather / Time Controls
  • Player Actions (Kick, Ban, Heal, Feed, Kill, Gamemode, Teleport)
  • Save Server
  • Reload Server
  • Stop Server
  • User Management

Admin

Administrative access.

Permissions:

  • Dashboard
  • Players Management
  • Console View
  • Console Commands
  • Ban Management
  • Whitelist Management
  • Weather / Time Controls
  • Player Actions

Restrictions:

  • Cannot manage users
  • Cannot reload server
  • Cannot stop server

Moderator

Basic moderation access.

Permissions:

  • Dashboard
  • Players List
  • Console View
  • Kick Players

Restrictions:

  • Cannot execute console commands
  • Cannot ban players
  • Cannot manage whitelist
  • Cannot manage users
  • Cannot reload or stop server

Viewer

Read-only access.

Permissions:

  • Dashboard
  • Players List

Restrictions:

  • No server actions allowed

🛡 3-Layer Permission Protection

MinePanel now protects restricted actions using 3 security layers.

Layer 1 — Sidebar Protection

Navigation items are automatically hidden if the user does not have permission.

Example:

  • No user permission → User Management tab hidden
  • No console permission → Console tab hidden

Layer 2 — Frontend Page Protection

If a user tries to manually access a restricted page:

You are not able to see this

The page will be blocked before loading.

Layer 3 — Backend API Protection

All protected API endpoints now validate permissions server-side.

Even if users try direct requests using:

  • curl
  • Postman
  • Browser requests

MinePanel will return:

{
  "success": false,
  "message": "Permission denied"
}

Frontend will automatically show an error toast.

🎨 Frontend Permission-Based UI

Buttons and actions are automatically hidden if the user does not have permission.

Examples:

Hidden automatically:

  • Kick button
  • Ban button
  • Reload Server button
  • Stop Server button
  • User Management page
  • Player action buttons
  • Console command input

This keeps the interface clean and prevents accidental misuse.

🔒 Security Rules (User Management)

Additional security protections were added.

Rules:

  • Owner account cannot be deleted
  • Owner cannot change its own role
  • Owner account cannot be created manually through UI
  • Only Owner can manage users
  • Admin cannot manage users
  • Moderator cannot manage users
  • Viewer cannot manage users

This prevents privilege mistakes and account lockout scenarios.

📋 Permission Matrix

Feature Owner Admin Moderator Viewer
Dashboard ✅ ✅ ✅ ✅
Players List ✅ ✅ ✅ ✅
Console View ✅ ✅ ✅ ❌
Console Commands ✅ ✅ ❌ ❌
Bans List ✅ ✅ ❌ ❌
Whitelist View ✅ ✅ ❌ ❌
Whitelist Add/Remove ✅ ✅ ❌ ❌
Weather / Time Controls ✅ ✅ ❌ ❌
Kick Player ✅ ✅ ✅ ❌
Ban / Heal / Feed / Kill / Gamemode / TP ✅ ✅ ❌ ❌
Save Server ✅ ❌ ❌ ❌
Reload Server ✅ ❌ ❌ ❌
Stop Server ✅ ❌ ❌ ❌
User Management ✅ ❌ ❌ ❌

⚙ Internal Changes

Updated systems:

  • New centralized permissions map
  • Backend permission middleware (hasPermission())
  • Frontend permission-based UI rendering
  • 403 unauthorized API protection
  • Updated user account structure with roles
  • Updated default account creation flow
  • Updated authentication flow to support roles

📌 Notes

This version uses Fixed Roles Only.

Custom Role Editor is not included in this update.

The goal of this release is:

  • Simplicity
  • Stability
  • Better security
  • Better multi-user support

Custom roles may be considered in future versions depending on community feedback.

Compatibility

Minecraft Versions

  • 1.13.2+
  • Tested up to 1.26.2

Java Versions

  • Java 8+
  • Tested on Java 8 / Java 21 / Java 25

Supported Server Software

  • Spigot
  • Paper
  • Purpur (Experimental)

Thank you to everyone providing feedback and helping improve MinePanel.

MinePanel continues evolving based on real community feedback.

More updates coming soon 🚀

Assets 2
Loading