Permission bits

"It is one number, and it decides who is allowed to set the archive on fire." — Archivist Yenna Tal
Verified

3 settings decide which commands each admin tier can run, and each one is a single very large number.

Read this before you edit those numbers by hand. The calculator further down this page writes them for you.

What it does

Every permission-checked command in StoryForce has a number, called a bit. Each admin tier has one setting holding a list of those numbers, packed into one decimal value called a mask.

When someone runs a command, the server asks a single question. Is this command's bit in a mask my tier can reach?

Access is additive, so the tiers stack rather than replace each other:

  • a community admin is checked against the community mask
  • a clerical admin is checked against the community mask and the clerical mask
  • leadership is checked against all 3

2 rules sit outside the masks entirely. An account with no admin level fails every bit check, whatever the masks say. A mask set to -1 means every bit, so that tier can run everything.

The 3 masks

Server-side. Commands community admins can run, and the base every higher tier inherits. Shipped value 270549387263. Server-side. Commands clerical admins add on top of the community mask. Shipped value 279173920768. Server-side. Commands only leadership can run. Shipped value 549771542528.

All 3 are archived, so the engine writes their current values back on shutdown.

A known issue with the compiled defaults

The values compiled into the game module are older and narrower than the ones in storyforce_server.cfg, and 5 settings are affected. The config file values are the intended ones.

The 3 masks are missing bits 34 to 39. Between them, the compiled defaults grant no tier the 7 commands those bits gate: /changemap, /teleport with /telemark, /centersay with its alias /cs, /playcinematic, /sfkick and /sfban. The compiled sf_storytoolsblock is 4070 rather than 65510, which leaves 4 of the same tools out of the soft lock, from /changemap to /playcinematic. And the compiled sf_forcemarkduration is 1 rather than the shipped 0, so Force marks expire after a minute instead of lasting the whole map.

Because all 5 settings are archived, a single boot without +exec storyforce_server.cfg writes the narrow values into your server's saved settings, where they stay. Always launch with the config file. See server configuration.

What each bit gates

Bit Gates Tier in the shipped config
0 /director <true|false> on yourself community
1 noclip community
2 /npc, /llm community
3 /communitychars list, create, createx community
4 /communitychars set community
5 /communitychars delete community
6 /fade community
7 /crawl community
8 /origin all, /origin <player> community
9 nodraw community
10 nonsolid community
11 /director <true|false> <player> clerical
12 /sf_setmember clerical
13 /comadmin create clerical
14 /comadmin initiate clerical
15 /comadmin retire clerical
16 /comadmin reinstate clerical
17 /comadmin admin promote, demote clerical
18 notarget clerical
19 /comadmin list, find, show, npclist clerical
20 nothing at all. See the dead bits note leadership
21 /comadmin disable, and disabled through /sf_setmember leadership
22 god leadership
23 /comadmin set leadership
24 nothing. Retired, and in no shipped mask none
25 /add, /edit, /remove, /list community
26 /trace community
27 /camera community
28 /remap community
29 /setscore community
30 /prepmap community
31 /scene, /sceneinfo community
32 /comadmin status, faction, rank, listedname, loadout clerical
33 /poi community
34 /changemap community
35 /teleport, /tp, /telemark, /tm community
36 /centersay, /cs community
37 /playcinematic community
38 /sfkick clerical
39 /sfban leadership

Bits 40 to 63 are unused and available for future commands.

Dead bits

2 entries in the bit table are dead weight. Bit 20 is an orphan. It sits in the leadership mask in both the compiled default and the shipped config. The command it was written for does not exist, so the bit gates nothing. Bit 24 is retired, its feature having moved into /add, and it appears in no shipped mask. Leave both as they are, because neither does anything either way.

Working out a value

Set the minimum tier for each command below, then copy the generated block into your config. Access is granted to that tier and every tier above it. Setting a command to community makes it available to clerical and leadership as well.

To start from what your server runs now, paste your current values into the import box at the bottom and load them.

Server-side. Which commands count as story tools and follow director rules. Shipped value -1, meaning all of them. Server-side. Story tools locked to directors while any director is connected. Shipped value 65510. Server-side. Story tools that always require director mode, scene or no scene. Shipped value 804.

Those 3 settings share a second, separate bit space and are explained in director locks.

Command permissions
PermissionMinimum tierShipped
Director-mode behaviour

Three cvars share the director bit space and only affect commands flagged as story tools. Story tool (sf_storytools) is the master gate. Clear it and director mode never touches that command. Locked in scene (sf_storytoolsblock) restricts a story tool to directors while any director is connected. Requires director (sf_directorrequired) forces director mode for that command at all times, and beats the other two. The last two only apply while Story tool is on.

ToolStory toolLocked in sceneRequires director
Generated config 






Import an existing config


Paste your current cvar values to load them into the editor. Where the same bit appears in more than one mask, the lowest tier wins and the redundant entry is dropped from the cleaned output.

















Things to note


    

  • A tier of none fails every check. Someone with no admin level cannot run a bit-gated command
even if you set every mask to -1.
    • 

  • There is no leadership override. Leadership passes because the bits are in a mask it reaches,
so clearing a bit from all 3 masks removes the command from everyone.
    • 

  • The masks are archived, so the engine saves whatever they currently hold when the server shuts
down. Edit the config file, not the running server.
    • 

  • A bit in 2 masks is harmless but confusing. The lowest tier wins, and the calculator strips
the duplicate when it rewrites the block.
    • 

  • Story tools are checked before the masks. A director lock can allow or refuse a command before
the tier check happens at all. See director locks.
    • 

  • /givexp is not on this list. It is gated by membership rather than by a bit. See
managing accounts.
    • 

  • The calculator runs in your browser. It reads nothing from your server and sends nothing
anywhere.
    • 





Next