A server owner in Discord today reported that players on their server seem to be able to spawn TWA mobs without any permissions. Having looked at the code and plugin.yml, I believe this is due to a bug with the way permissions are checked.

In plugin.yml, the permission tardisweepingangels.spawn defaults to OP and claims to allow players to spawn TWA monsters. It has several children for each individual TWA monster, which all default to true:

The issue is that the command handler code never checks the base permission node and only checks the permission node for the specific monster called in the command. Since each monster permission defaults to true, this results in all players being able to spawn TWA monsters by default:

Suggested fix: Check the base permission tardisweepingangels.spawn in the command handler as well as the monster-specific permission.

It looks like the original reporter was mistaken and can't actually spawn monsters. Closing as invalid. Apologies.

If I'm de-opped I can't spawn TWA monsters...