mirror of
https://github.com/RedWizardsLab/EchoHub.git
synced 2026-09-04 00:26:07 +02:00
72 lines
3.6 KiB
Markdown
72 lines
3.6 KiB
Markdown
# Moderation & Roles
|
|
|
|
Every EchoHub server has a four-tier role hierarchy. Moderation is **strictly hierarchical**:
|
|
acting on another user requires outranking them — equal rank is never enough — and a few
|
|
invariants protect the server owner from lockouts.
|
|
|
|
## Roles
|
|
|
|
| Role | Rank | Users panel glyph | How it's granted |
|
|
| --- | --- | --- | --- |
|
|
| **Owner** | 3 | ★ | The first account ever registered on the server |
|
|
| **Admin** | 2 | ♦ | Assigned by the Owner |
|
|
| **Mod** | 1 | ❀ | Assigned by an Admin or the Owner |
|
|
| **Member** | 0 | — | Everyone else |
|
|
|
|
Assign roles with `/role <user> <admin|mod|member>`. Two rules apply:
|
|
|
|
- You can only assign roles **strictly below your own** — an Admin can promote to Mod but
|
|
cannot create another Admin; only the Owner can.
|
|
- **Owner is not assignable and not demotable.** There is exactly one Owner (the first
|
|
account), nobody can be promoted to it, and the Owner's role can't be changed.
|
|
|
|
## Actions
|
|
|
|
| Command | Minimum role | Effect |
|
|
| --- | --- | --- |
|
|
| `/kick <user> [reason]` | Mod | Disconnects the user. Not persistent — they can reconnect immediately. |
|
|
| `/ban <user> [reason]` | Admin | Persistent: flags the account banned and disconnects it. Banned accounts are rejected at login. |
|
|
| `/unban <user>` | Admin | Lifts a ban. |
|
|
| `/mute <user> [minutes]` | Mod | Blocks the user from sending messages or uploading files. Without a duration the mute is **indefinite**; with one it auto-expires (checked every ~15 seconds). |
|
|
| `/unmute <user>` | Mod | Lifts a mute early. |
|
|
| `/role <user> <role>` | Admin | Assign a role (see rules above). |
|
|
| `/nuke` | Mod | Deletes the **entire history of the current channel**, including all attachment files on disk. Channel-wide — no per-user check. |
|
|
|
|
Kick, ban, and mute all enforce the hierarchy: the target's role must be **strictly lower**
|
|
than yours. A Mod cannot kick another Mod; nobody can kick, ban, mute, or demote the Owner.
|
|
|
|
## Deleting messages
|
|
|
|
Deletion has its own, slightly different rule set:
|
|
|
|
- **Your own messages** — always deletable, whatever your role. Right-click a message →
|
|
*Delete message*, or press `F6`, pick the message, and hit `Delete`.
|
|
- **Someone else's messages** — requires **Mod or higher** *and* strictly outranking the
|
|
author. A Mod can delete a Member's message, but not another Mod's.
|
|
|
|
Deleting a message also purges its uploaded attachment blobs from the server's disk, and the
|
|
removal is broadcast live — the message disappears from everyone's chat immediately.
|
|
|
|
## How actions surface
|
|
|
|
Everyone in the channel sees moderation happen:
|
|
|
|
- **TUI clients** show system messages — *"alice was kicked (reason)"*, *"bob was banned"*,
|
|
*"Channel history has been cleared by a moderator."* The kicked or banned user themselves
|
|
gets a dialog with the reason, then the client disconnects.
|
|
- **IRC clients** get native protocol events: kicks arrive as a real `KICK` command, bans as
|
|
a server `NOTICE`. (See the [IRC Gateway guide](irc-gateway.md).)
|
|
|
|
Muted users aren't announced; they simply receive *"You are muted and cannot send messages."*
|
|
when they try to speak.
|
|
|
|
## Design notes
|
|
|
|
- All checks run server-side in the moderation API — the client commands are conveniences,
|
|
and the same rules bind IRC users and any direct API caller.
|
|
- Bans are account-level, not IP-level. A banned person can register a fresh account; pair
|
|
bans with registration hygiene on public servers.
|
|
- In [end-to-end encrypted rooms](encrypted-rooms.md) moderation still works at the metadata
|
|
level — messages can be deleted and users muted/kicked by identity — but no moderator can
|
|
*read* the content, including the Owner.
|