bruh

docs/08_Commands.md

@@ -4,6 +4,20 @@ Currently one in-game admin command: `/networkcore`.
 
 All subcommands are run by an in-world player. Console support isn't wired up yet.
 
+## Permissions
+
+Every subcommand is gated by a permission node, checked via Hytale's `PermissionsModule`. Assign these to your staff/admin groups in the Hytale server's own permission config.
+
+| Subcommand | Required permission |
+|---|---|
+| `/networkcore status`   | `networkcore.status` |
+| `/networkcore servers`  | `networkcore.servers` |
+| `/networkcore publish`  | `networkcore.publish` |
+
+You can grant the whole namespace with `networkcore.*` (Hytale's permission system handles wildcards). A player without the relevant node sees Hytale's standard `You do not have permission for this command.` message - the command system itself blocks execution before our code runs.
+
+Permissions are wired via `AbstractCommand.requirePermission(node)` in each subcommand constructor, and `canGeneratePermission()` is overridden to false on every command (including the root) so Hytale doesn't auto-generate a different one and clash with ours.
+
 ## /networkcore status
 
 Prints local server identity, Redis state, and the metrics endpoint.
@@ -49,10 +63,6 @@ The JSON is parsed and wrapped in the standard envelope (with your auth token if
 
 This is dangerous in production - it lets anyone with command access spoof any message on any channel. Lock it down with permissions before exposing to non-admins.
 
-## Permissions
-
-Subcommand permissions aren't enforced yet. If your server runs HytalePerms, gate `/networkcore` behind an admin group at the command-routing layer.
-
 ## Things this command does *not* do (and why)
 
 - **Restart Redis / reload config.** Restart the server. Reload is fragile - half-loaded state is worse than no state.