> For the complete documentation index, see [llms.txt](https://atiysus-organization.gitbook.io/aty-scripts/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://atiysus-organization.gitbook.io/aty-scripts/map-editor/getting-started/permissions.md).

# Permissions

## Permissions

Access is granted if **any** of three checks passes. They are all tested, so a framework answering "no" can never override an ACE grant you added by hand.

1. **The ACE object** in `Config.Permission.Ace` — works on every framework:

   ```cfg
   add_ace group.admin aty_mapeditor.admin allow
   # or one specific player:
   add_ace identifier.license:YOUR_LICENSE_HERE aty_mapeditor.admin allow
   ```
2. **Your framework** — QBCore `HasPermission`, or ESX `xPlayer.getGroup()` matched against `Config.Permission.Groups` (default `admin`, `superadmin`, `god`).
3. **The group names as ACE objects**, which covers QBCore's `/addpermission` — that command grants `qbcore.admin`.

{% hint style="info" %}
Authorization is enforced on **both** the command and every server-side edit — spawn, move, delete, import, export, clear logs. A modified client cannot bypass it. Reading the map stays open so all players see placed props. The server console (rcon) is always allowed.
{% endhint %}

### When `/opencreator` says you have no permission

**Read the server console.** Every denial prints exactly what the script saw, because "my admin menu says I'm an admin" and "the script can read that" are different claims:

```
[aty_mapeditor] Ad (id 3) DENIED — none of the checks passed.
  framework : qb-core  |  HasPermission admin=false, superadmin=false, god=false
  license   : license:381befc3...
  config    : Groups = { admin, superadmin, god }  Ace = 'aty_mapeditor.admin'
  ace 'aty_mapeditor.admin' = false
  ace 'admin' = false | ace 'qbcore.admin' = true
  Fix: add_ace identifier.license:381befc3... aty_mapeditor.admin allow
       …or set Config.Permission.Enabled = false for a closed dev server.
```

The `Fix:` line is a copy-paste command that works whatever your framework reports.

{% hint style="warning" %}
`qbcore.admin = true` with `aty_mapeditor.admin = false` is the usual case. It means you were added through QBCore's own command, which grants a QBCore principal — not this script's ACE object. Either add the ACE line above, or add `qbcore.admin` to `Config.Permission.Groups`.
{% endhint %}

### Opening it up on a dev server

```lua
Config.Permission.Enabled = false
```

This lets **everyone** spawn, move and delete props. Turn it back on before players join. The console prints a warning on every start while it is off, so you do not forget.

### Configuration reference

```lua
Config.Permission = {
    Enabled = true,
    Ace     = "aty_mapeditor.admin",
    Groups  = { "admin", "superadmin", "god" },
}
```

| Key       | Meaning                                              |
| --------- | ---------------------------------------------------- |
| `Enabled` | Master switch. `false` grants everyone access        |
| `Ace`     | The ACE object tested first                          |
| `Groups`  | Framework group names, also tested as ACE principals |