ZMN Bot Logo
    التوثيق

    ZMN Bot التوثيق

    أدلة الإعداد ومرجع الضبط لكل وحدات زمن — الحماية، الإشراف، الأدوار، المستويات، والتحكم بالوصول.

    تنقل سريع

    الأساسيات
    الوحدات

    التحكم في الوصول

    إدارة من يمكنه الوصول إلى لوحة تحكم خادمك وتعديلها

    نظرة عامة

    يسمح لك وحدة التحكم في الوصول بتكوين صلاحيات مفصلة لوحة تحكم خادمك. تحكم في من يمكنه عرض وتعديل الإعدادات من خلال التحكم في الوصول القائم على الرتب أو المستخدمين.

    لماذا التحكم في الوصول؟

    • • تفويض إدارة لوحة التحكم إلى أعضاء الموظفين الموثوقين
    • • منح الوصول بدون إعطاء صلاحيات خادم Discord
    • • ضبط دقيق لمن يمكنه تعديل إعدادات محددة
    • • الحفاظ على الأمان مع تمكين التعاون

    الميزات الرئيسية

    الوصول القائم على المستخدم

    منح الوصول إلى لوحة التحكم لمستخدمين محددين بواسطة معرف Discord الخاص بهم

    الوصول القائم على الرتب

    السماح للرتب بأكملها بالوصول إلى لوحة التحكم

    أولوية المالك

    يمتلك ملاك الخوادم دائماً وصولاً كاملاً بغض النظر عن الإعدادات

    آمن افتراضياً

    عند التعطيل، يمكن فقط لمالك الخادم الوصول إلى لوحة التحكم

    How It Works

    1User Attempts Access

    When a user tries to access your server dashboard, the system checks their permissions.

    2Owner Check

    First, the system checks if the user is the server owner. Owners always have full access and bypass all other checks.

    3Access Control Check

    If Access Control is enabled, the system checks if the user is in the allowed users list or has an allowed role.

    4Grant or Deny

    If any check passes, the user gains access. Otherwise, they see an access denied message.

    Access Hierarchy

    The system checks permissions in the following order:

    1. Server Owner

    The Discord server owner always has full access. This cannot be disabled or overridden.

    2. Allowed Users

    If Users Access is enabled, users in the allowed list gain access immediately.

    3. Allowed Roles

    If Roles Access is enabled, users with any of the allowed roles gain access.

    4. Access Denied

    If none of the above checks pass, access is denied with an error message.

    Configuration

    Main Toggle

    Enable Access Control

    toggle

    Turn on dashboard access control. When disabled, only the server owner can access the dashboard.

    Users Access

    Grant access to specific users by their Discord ID. Useful for trusted individuals who may not have specific roles.

    Enable Users Access

    toggle

    Allow specific users to access the dashboard

    Allowed Users

    user-search

    Search and add users by username, display name, or Discord ID

    Roles Access

    Grant access to all members with specific roles. Ideal for staff teams or management roles.

    Enable Roles Access

    toggle

    Allow users with specific roles to access the dashboard

    Bypass Roles

    roles

    Select roles that can access the dashboard

    User Search

    The user search feature allows you to find and add users to the allowed list easily:

    Search by Username

    Type the user's Discord username to find them

    Search by Display Name

    Search using the user's server nickname

    Search by Discord ID

    Paste the user's 18-digit Discord ID for exact matching

    Users appear with their avatar and display name for easy identification. Click on a user badge to remove them from the allowed list.

    Backend Validation

    Access control is enforced at multiple levels for maximum security:

    Frontend Check

    The dashboard UI checks permissions before displaying content, providing immediate feedback.

    API Middleware

    Every API request is validated by the checkDashboardAccess middleware, which verifies the user's Discord token and checks their permissions against the database.

    Shard Manager Integration

    The system queries Discord's API through the bot's shard manager to verify ownership and fetch real-time role information.

    Redis Caching

    Access control settings are cached in Redis for fast validation without database queries on every request.

    Use Cases

    Scenario 1: Staff Team Access

    Goal: Allow all moderators and administrators to manage the bot.

    Setup: Enable Roles Access and add your "Moderator" and "Admin" roles to the bypass list.

    Result: Anyone with these roles can access the dashboard without needing to be added individually.

    Scenario 2: Specific User Access

    Goal: Grant access to a trusted member who doesn't have a staff role.

    Setup: Enable Users Access and add their Discord ID to the allowed users list.

    Result: That specific user can access the dashboard regardless of their roles.

    Scenario 3: Hybrid Approach

    Goal: Allow staff roles plus a few specific users.

    Setup: Enable both Users Access and Roles Access. Add staff roles and specific user IDs.

    Result: Anyone with a staff role OR in the users list can access the dashboard.

    Scenario 4: Owner-Only Mode

    Goal: Restrict dashboard access to only the server owner.

    Setup: Disable the Access Control module entirely.

    Result: Only the server owner can access the dashboard. Maximum security.

    Best Practices

    ✓ Recommended

    • • Use role-based access for staff teams (easier to manage)
    • • Add specific users only when they don't fit into a role category
    • • Regularly review the allowed users and roles list
    • • Remove access immediately when staff members leave
    • • Use descriptive role names to identify their purpose

    ✗ Avoid

    • • Don't add @everyone or large public roles to bypass list
    • • Don't share dashboard access with untrusted members
    • • Don't forget to remove access when someone leaves your team
    • • Don't use user-based access for large teams (use roles instead)

    Security Considerations

    Important: Users with dashboard access can modify ALL bot settings for your server, including security configurations, module settings, and access control itself. Only grant access to highly trusted individuals.

    Dashboard vs Discord Permissions

    Dashboard access is separate from Discord server permissions. A user can have dashboard access without having any Discord permissions, and vice versa. This allows you to delegate bot management without giving server admin rights.

    Owner Protection

    The server owner cannot be locked out. Even if all access control settings are misconfigured, the owner will always have full access to fix the configuration.

    Audit Trail

    All dashboard actions are logged with the user who performed them. This helps track changes and identify unauthorized modifications.