Use LuckPerms contexts for Region Management where Applicable

[burdoto]

The Problem

On our server, we have two worlds:

• A citybuild world where people create claims, build bases and have elevated flag-related permissions to set flags like block-trampling, mob-griefing etc
• An SMP world where people can still claim, but claims are limited to just block damage limitation

Our permission manager, LuckPerms, allows me to set permissions on a per-world basis. Thus, I can use contexts to allow people access to certain flags in the citybuild world, but not in the smp world.

Considering that region flags can be set across dimensions, using the -w option, this behaviour will lead to potential to evade the permission plugin.

A Solution

WorldGuard should, if present, use LuckPerms and its Contexts in respective to the -w option to ensure proper permission checks.

Alternatives

It may be possible to avoid such evasion cases with further limitation of subcommands, like the flag command, but that will also limit options for the users whatsoever.

Anything Else?

No response

[me4502]

From my understanding based on how permission contexts have historically been used, this feels like it's an inappropriate use of context? Context should be information about the player, not the action itself. And then the action should be encoded into the permission node, which WorldGuard currently already does for its per-world permissions.

It feels like doing this would inadvertently confuse more people by deviating from the standard way permission contexts actually works.

[burdoto]

i understand the idea, yet the problem of evasion potential remains.
possibly it would be more feasible to instead introduce a different context for such a usecase?
Maybe we can get an opinion from a @LuckPerms contributor on this?

right now, the described problem is, although its a niche case, quite prone for abuse
personally, i vividly disagree with the thought that this might be out of scope; from my understanding, the context system isnt made with such cross-dimensional options in mind in the first place.
simulating a context for the affected area would seem just reasonable and semantically correct

[burdoto]

An update to this;
Luck did approve of the idea that contexts should contain info about the Player.
However, this leads me to an undefined state with the setup I'm having here, only allowing one or more of the following conclusions;

• My setup needs revision to a solution that I cannot grasp, as the concept of the server itself only seems to allow for a solution as described
• WorldGuard cross-dimension options are imperatively incompatible with LuckPerms context solution
• A third option that maybe this concept of LP contexts should be revised was worded by me, but not responded to as of right now

Either way, this leaves me in a strange situation with no apparent solution.
Possibly, a midway solution could be a certain permission node to be necessary in order to allow a -w option in the first place, limiting its usability for users where the original idea of using contexts would come into play. From my understanding, this would also make the option semantically compatible with contexts and edge-case scenarios such as the one described.

[me4502]

I feel this issue is just solvable by setting up the permission nodes correctly. The permission nodes are setup by specifying a world, so just specifying the worlds you want rather than using a wildcard is a better solution. Adding contexts on top here would just open up more room for ever, as it'd behave differently than everything else / as expected.

I'm not entirely convinced there's an issue here, beyond just applying too lenient permissions via wildcards.

[burdoto]

In the described situation, I'm referring to Flags.
Those permission nodes do not wildcard for a world, but for a flag value (allow, deny,...) and a region id, as stated by https://worldguard.enginehub.org/en/latest/permissions/#flag-command
None of the affiliated nodes refer to world parts.

Users are getting widened access to more flags in a different world, and can then invoke these permissions back into other worlds using the -w option.
I'd appreciate for you to check the context before suggesting I'm doing it wrong.