ZMN Bot Documentation
Setup guides and configuration reference for every ZMN module — security, moderation, roles, leveling, and access control.
Quick Navigation
Access Control
Manage who can access and modify your server dashboard
Overview
The Access Control module allows you to configure granular permissions for your server dashboard. Control who can view and modify settings through role-based or user-based access control.
Why Access Control?
- • Delegate dashboard management to trusted staff members
- • Grant access without giving Discord server permissions
- • Fine-tune who can modify specific settings
- • Maintain security while enabling collaboration
Key Features
User-Based Access
Grant dashboard access to specific users by their Discord ID
Role-Based Access
Allow entire roles to access the dashboard
Owner Priority
Server owners always have full access regardless of settings
Secure by Default
When disabled, only the server owner can access the dashboard
How It Works
1User Attempts Access
When a user tries to access your server dashboard, the system checks their permissions.
2Owner Check
First, the system checks if the user is the server owner. Owners always have full access and bypass all other checks.
3Access Control Check
If Access Control is enabled, the system checks if the user is in the allowed users list or has an allowed role.
4Grant or Deny
If any check passes, the user gains access. Otherwise, they see an access denied message.
Access Hierarchy
The system checks permissions in the following order:
1. Server Owner
The Discord server owner always has full access. This cannot be disabled or overridden.
2. Allowed Users
If Users Access is enabled, users in the allowed list gain access immediately.
3. Allowed Roles
If Roles Access is enabled, users with any of the allowed roles gain access.
4. Access Denied
If none of the above checks pass, access is denied with an error message.
Configuration
Main Toggle
Enable Access Control
toggleTurn on dashboard access control. When disabled, only the server owner can access the dashboard.
Users Access
Grant access to specific users by their Discord ID. Useful for trusted individuals who may not have specific roles.
Enable Users Access
toggleAllow specific users to access the dashboard
Allowed Users
user-searchSearch and add users by username, display name, or Discord ID
Roles Access
Grant access to all members with specific roles. Ideal for staff teams or management roles.
Enable Roles Access
toggleAllow users with specific roles to access the dashboard
Bypass Roles
rolesSelect roles that can access the dashboard
User Search
The user search feature allows you to find and add users to the allowed list easily:
Search by Username
Type the user's Discord username to find them
Search by Display Name
Search using the user's server nickname
Search by Discord ID
Paste the user's 18-digit Discord ID for exact matching
Backend Validation
Access control is enforced at multiple levels for maximum security:
Frontend Check
The dashboard UI checks permissions before displaying content, providing immediate feedback.
API Middleware
Every API request is validated by the checkDashboardAccess middleware, which verifies the user's Discord token and checks their permissions against the database.
Shard Manager Integration
The system queries Discord's API through the bot's shard manager to verify ownership and fetch real-time role information.
Redis Caching
Access control settings are cached in Redis for fast validation without database queries on every request.
Use Cases
Scenario 1: Staff Team Access
Goal: Allow all moderators and administrators to manage the bot.
Setup: Enable Roles Access and add your "Moderator" and "Admin" roles to the bypass list.
Result: Anyone with these roles can access the dashboard without needing to be added individually.
Scenario 2: Specific User Access
Goal: Grant access to a trusted member who doesn't have a staff role.
Setup: Enable Users Access and add their Discord ID to the allowed users list.
Result: That specific user can access the dashboard regardless of their roles.
Scenario 3: Hybrid Approach
Goal: Allow staff roles plus a few specific users.
Setup: Enable both Users Access and Roles Access. Add staff roles and specific user IDs.
Result: Anyone with a staff role OR in the users list can access the dashboard.
Scenario 4: Owner-Only Mode
Goal: Restrict dashboard access to only the server owner.
Setup: Disable the Access Control module entirely.
Result: Only the server owner can access the dashboard. Maximum security.
Best Practices
✓ Recommended
- • Use role-based access for staff teams (easier to manage)
- • Add specific users only when they don't fit into a role category
- • Regularly review the allowed users and roles list
- • Remove access immediately when staff members leave
- • Use descriptive role names to identify their purpose
✗ Avoid
- • Don't add @everyone or large public roles to bypass list
- • Don't share dashboard access with untrusted members
- • Don't forget to remove access when someone leaves your team
- • Don't use user-based access for large teams (use roles instead)
Security Considerations
Dashboard vs Discord Permissions
Dashboard access is separate from Discord server permissions. A user can have dashboard access without having any Discord permissions, and vice versa. This allows you to delegate bot management without giving server admin rights.
Owner Protection
The server owner cannot be locked out. Even if all access control settings are misconfigured, the owner will always have full access to fix the configuration.
Audit Trail
All dashboard actions are logged with the user who performed them. This helps track changes and identify unauthorized modifications.