Access levels

Access levels

Who can sign in to the web page and what each level can change. Levels come from Discord each time someone signs in (and are checked again every 5 minutes), and apply per Discord server.

Who	How	Can
Host	Your Discord user ID in OWNER_IDS, or the host password on your LAN	Every server, plus the Servers page (approve or remove servers) and the host password
Owner	The Discord server's owner	Everything in that server
Admin	Manage Server in that server, or a role its owner picked under Settings → Access and security → Admin roles (or ADMIN_ROLE_IDS)	Events and alert toggles, boss timers and button order, maintenance, party finder content, panels and member chat, members, defaults, stats, logs, posting the roles channel. Not message wording, role IDs, roles channel setup, classes, Settings, export/import or history, unless the owner opens them (below). 30 changes an hour.
Member	Anyone in the server	My page: their boss timers, classes and pings, gear score, quiet hours, registration and party

Someone in two servers that use the same Nyerk can have a different level in each; the server picker in the top bar switches between them.

Hands off? On Settings → Access and security → What admins may change, a server's owner can open any of the owner-only areas to admins: Settings and games, Message wording, Roles and role IDs, Change history. Importing a settings file also needs the first three, and restoring from history needs all four. The Access page always stays the owner's, and an import or restore can never change who may do what.

If an admin account looks compromised: Settings → Access and security → Lock admin access (instant, for that server), then Change history to restore anything they changed, then remove their role or Manage Server in Discord. Sign everyone out there signs everyone out of that server's pages.

Limits on every account

So one compromised admin (or member) account can't wear Nyerk down, even from many IP addresses. The owner is exempt from all of these.

What	Limit
Any page or action	120 a minute per account
Settings search	30 a minute
Live search suggestions (as you type)	180 a minute, separate from the page limit
Stats	20 a minute
Settings export	10 per 10 minutes
My page (reads and changes Discord roles)	30 a minute
Configuration changes by admins	30 an hour
Repost the dashboard, post panels, create dungeon roles	once a minute, shared by everyone
Repost the roles channel	once every 2 minutes, shared
Check shugo.gg now	once every 5 minutes, shared

Hitting a limit shows "Too many requests" and logs one line to #logs per account per 10 minutes, never more. #logs itself holds at most 200 waiting lines; anything beyond that is still on the web Logs page.