Security, roles, and permissions

Authentication, 2FA, sessions, operation-level access control, auditing, and privileged actions.

Authentication

Passwords use Argon2id. Administrative accounts use six-digit TOTP; secrets are encrypted with a key derived from totp_key in config.php. Sessions are stored in the database, use HttpOnly and SameSite cookies, expire, and can be revoked. Login attempts are rate-limited. POST operations validate a CSRF token.

Roles and permissions

The owner has all permissions. Other administrators receive them through roles and optional direct grants. The role editor displays exact permission keys with toggles. Hierarchy protects higher-ranked accounts and roles: an administrator cannot grant capabilities they do not hold. The interface hides unauthorized actions, but PHP functions perform the effective authorization.

Entering or leaving Police, EMS, and Donors uses separate permissions from editing a positive rank. Removing an RCON ban while deleting its record or the player requires rcon.unban. See the full technical catalog under API and permissions.

Auditing

The panel records actor, target, old and new values, date, and outcome. RCON commands have their own queue and results. Deleting or clearing logs requires separate permissions and leaves a maintenance record in ac_log_maintenance. Log deletion is not a substitute for a retention and backup policy.

Secure deployment

• Serve the panel over HTTPS. Protect config.php, storage/, database/, bin/, and update/ with the included web rules.
• Use a SQL account with only the privileges required by the enabled features.
• Limit rcon.console.raw, update installation, and administrator management to trusted staff.
• Back up config.php and the database before production changes.