# Moderation & Roles | EchoHub Documentation

# Moderation & Roles

Every EchoHub server has a four-tier role hierarchy. Moderation is strictly hierarchical: acting on another user requires outranking them — equal rank is never enough — and a few invariants protect the server owner from lockouts.

## Roles

Role | Rank | Users panel glyph | How it's granted
--- | --- | --- | ---
Owner | 3 | ★ | The first account ever registered on the server
Admin | 2 | ♦ | Assigned by the Owner
Mod | 1 | ❀ | Assigned by an Admin or the Owner
Member | 0 | — | Everyone else

Assign roles with `/role <user> <admin|mod|member>`. Two rules apply:

- You can only assign roles strictly below your own — an Admin can promote to Mod but cannot create another Admin; only the Owner can.
- Owner is not assignable and not demotable. There is exactly one Owner (the first account), nobody can be promoted to it, and the Owner's role can't be changed.

## Actions

Command | Minimum role | Effect
--- | --- | ---
`/kick <user> [reason]` | Mod | Disconnects the user. Not persistent — they can reconnect immediately.
`/ban <user> [reason]` | Admin | Persistent: flags the account banned and disconnects it. Banned accounts are rejected at login.
`/unban <user>` | Admin | Lifts a ban.
`/mute <user> [minutes]` | Mod | Blocks the user from sending messages or uploading files. Without a duration the mute is indefinite; with one it auto-expires (checked every ~15 seconds).
`/unmute <user>` | Mod | Lifts a mute early.
`/role <user> <role>` | Admin | Assign a role (see rules above).
`/nuke` | Mod | Deletes the entire history of the current channel, including all attachment files on disk. Channel-wide — no per-user check.

Kick, ban, and mute all enforce the hierarchy: the target's role must be strictly lower than yours. A Mod cannot kick another Mod; nobody can kick, ban, mute, or demote the Owner.

## Deleting messages

Deletion has its own, slightly different rule set:

- Your own messages — always deletable, whatever your role. Right-click a message → Delete message, or press `F6`, pick the message, and hit `Delete`.
- Someone else's messages — requires Mod or higher and strictly outranking the author. A Mod can delete a Member's message, but not another Mod's.

Deleting a message also purges its uploaded attachment blobs from the server's disk, and the removal is broadcast live — the message disappears from everyone's chat immediately.

## How actions surface

Everyone in the channel sees moderation happen:

- TUI clients show system messages — "alice was kicked (reason)", "bob was banned", "Channel history has been cleared by a moderator." The kicked or banned user themselves gets a dialog with the reason, then the client disconnects.
- IRC clients get native protocol events: kicks arrive as a real `KICK` command, bans as a server `NOTICE`. (See the IRC Gateway guide.)

Muted users aren't announced; they simply receive "You are muted and cannot send messages." when they try to speak.

## Design notes

- All checks run server-side in the moderation API — the client commands are conveniences, and the same rules bind IRC users and any direct API caller.
- Bans are account-level, not IP-level. A banned person can register a fresh account; pair bans with registration hygiene on public servers.
- In end-to-end encrypted rooms moderation still works at the metadata level — messages can be deleted and users muted/kicked by identity — but no moderator can read the content, including the Owner.