Automated Crafting Chamber ignores crafting-permissions
TheFangster opened this issue · 9 comments
Description (Required)
Individual permissions for sf items only work in the Enchanted Crafting Table. Using the Automated Crafting Chamber bypasses these permissions giving players the ability to craft these items even if they don't have the required permission.
Steps to reproduce the Issue (Required)
Set permission for an item in the items.yml, try crafting in enchanted table and get denied, then craft in automated crafting table.
Expected behavior (Required)
Server Log / Error Report
No logs required for this.
Environment (Required)
- Minecraft Version: 1.14.4 Paper #209
- Slimefun Version: Slimefun4 - DEV 276 (git 74ee0)
- CS-CoreLib Version: CS-CoreLib - DEV 77 (git 6e171)
It is probably not possible to fix this issue without making Slimefun dependent on a plugin like Vault to check permissions. This is because the player who placed down the Automated Crafting Chamber might be offline which means that a permission check using Player.hasPermission() is not possible and OfflinePlayer does not provide a function to check for permission.
If dependency to other plugins isn't wanted, could the auto crafting machine have a option to choose which recipes it can craft and which not in the config? Or this one is related to the permissions too?
Possible fix: Store all items the player cannot craft in the block data? Might not be worth if too many items are blacklisted, maybe make it toggle-able in the config?
Dislike that approach @BigBadE
In theory, store the owner UUID and then just on craft lookup Player#hasPermission
Obviously this requires the player to be online. Could be possible to find a secondary fallback player depending on protection plugin. If no one is there then no point crafting anyway.
I don't know. Could also make it store what the player has unlocked when place (though, won't update obviously). Though, I think the way research unlock is handled in data should be changed for that first.
Either way, for this to be done it needs to be lightweight, easy and efficient. Not very easy in this case to hit all 3.
I think this can be fixed like this:
Block stores the owner UUID.
PlayerProfile now stores a copy of players' permissions list.
on craft check if the owner has the right permissions via PlayerProfile.
(This could be made better in performance by making machine also store the perms it needs, though this will need to be updated when the recipe changes)
Store the player UUID when placed then just look at what they have unlocked when crafting. You are only accessing slimefun data then so no offline player to mess with. As for the permission, no permission no unlocking recipe.
