ThunderPerms

ThunderPerms

ThunderPerms is a lightweight permissions plugin for Paper servers. It manages users, groups, inheritance, wildcard permissions, temporary grants, world-scoped grants, backups, audits, and storage diagnostics without NMS or a custom permissible replacement.

It works out of the box with YAML storage and also supports SQLite, MySQL, and MariaDB for larger setups.

Features

• Manage player permissions by UUID.
• Create and manage permission groups.
• Add users to one or more groups.
• Add temporary user permissions, group permissions, and group memberships.
• Add world-scoped permission grants with world:<world>.
• Set true and false permission nodes.
• Use wildcard nodes such as teamwork.*, blockledger.*, and *.
• Configure group inheritance with cycle prevention.
• Use group weights to control priority between inherited permissions.
• Use /thunderperms check to inspect a permission result.
• Use /thunderperms why to see where a permission result came from.
• List known users and groups with pagination.
• Delete non-protected groups safely and reassign affected users.
• Run /thunderperms verify to check data integrity.
• Run /thunderperms repair to back up and repair invalid data references.
• Automatically clean expired permissions and memberships.
• Apply Bukkit PermissionAttachment entries so normal sender.hasPermission(...) checks work.
• Reapply attachments when other plugins enable and register permissions.
• View storage, user, group, membership, assignment, integrity, and audit status.
• Create backups for both YAML and database-backed storage.
• Write an audit log for permission, group, repair, and backup actions.
• Protect configured file paths from directory traversal.
• Database connections use the shared secure storage layer, including safer default TLS settings for MySQL/MariaDB and redacted credential handling.

Integrations

• Bukkit permissions: ThunderPerms applies permissions through Bukkit attachments, so plugins using normal permission checks can be managed by ThunderPerms.
• AugmentedThunder plugins: the plugin suite is configured to work with ThunderPerms-managed permission nodes while still falling back safely when ThunderPerms is absent.
• StormEconomy, StormParty, and StormFactions: include direct ThunderPerms permission bridge support.
• External plugins: any plugin with registered Bukkit permission nodes can be granted or denied through ThunderPerms.

ThunderPerms also registers ThunderPermsApi so other plugins can check permissions, resolve detailed permission reasons, inspect users and groups, read group parents, read permission assignments, list known groups, and check storage health.

Commands

Main command aliases:

• /thunderperms
• /tperms
• /tpms

Common commands:

• /thunderperms user <player|uuid> info
• /thunderperms user <player|uuid> permission set <node> <true|false> [duration] [world:<world>]
• /thunderperms user <player|uuid> permission unset <node> [world:<world>]
• /thunderperms user <player|uuid> group add|remove <group> [duration]
• /thunderperms list users|groups [page]
• /thunderperms group <group> create [weight]
• /thunderperms group <group> delete [replacement-group]
• /thunderperms group <group> weight <weight>
• /thunderperms group <group> permission set <node> <true|false> [duration] [world:<world>]
• /thunderperms group <group> permission unset <node> [world:<world>]
• /thunderperms group <group> parent add|remove <parent>
• /thunderperms group <group> info
• /thunderperms check <player|uuid> <permission> [world]
• /thunderperms why <player|uuid> <permission> [world]
• /thunderperms status
• /thunderperms verify
• /thunderperms repair
• /thunderperms backup
• /thunderperms reload
• /thunderperms save

Permissions

• thunderperms.command
• thunderperms.user
• thunderperms.group
• thunderperms.list
• thunderperms.check
• thunderperms.verify
• thunderperms.repair
• thunderperms.status
• thunderperms.reload
• thunderperms.save
• thunderperms.backup
• thunderperms.admin

Notes

The default storage backend is YAML.

SQLite, MySQL, and MariaDB are optional.

Operators can bypass ThunderPerms API checks when op-bypass is enabled.

The default group and built-in admin group are protected from deletion.

ThunderPerms is designed as a practical permissions manager for small and medium Paper servers, plugin suites, and local development servers.