Mods able to OE without permissions

[bertboy13]

We have an issue where mods with the permissions openinv.enderchest.edit set to false are still able to remove items from peoples enderchest - any hints on a fix, perhaps we've done something incorrectly.

[Jikoo]

The easiest way to test your permissions is to enable verbose mode with LuckPerms. If you filter for permissions starting with openinv, you can see what permissions OI is checking and how they evaluate. Note that perms for edit-only modes are only evaluated when the inventory is opened - the opened inventory will contain display-only slots in place of normal slots.

[Jikoo]

Could you please repeat the debug test by enabling it, running the command, and then disabling it? OI uses 2 tasks during the course of execution, and the view-only checks come at the end of the tasks. The way you are using it is causing it to report the initial checks to use the command, not the checks that occur during execution once the target is determined.

[Litning11]

Okay, I ran a verbose profiler and had them open up a random EC and move some items around. These are the results: https://luckperms.net/verbose/vUa0tilBR8

It's a bit long so I'll grab some snippets where OE show up:

[Jikoo]

Okay, thanks, that's super helpful. Love that the upload has stack traces in it, I'm used to the ingame one. Right before the access level check we can see that there's a check for opening other, which should be the edit permission.

Sure enough, a silly mistake on my end:

OpenInv/plugin/src/main/java/com/lishid/openinv/OpenInv.java

Line 253 in 56f8cf4

edit = ownContainer ? Permissions.ENDERCHEST_EDIT_SELF : Permissions.ENDERCHEST_OPEN_OTHER;

[Jikoo]

I've pushed f5c31c3, which can be downloaded from https://github.com/Jikoo/OpenInv/actions/runs/12615837548 (the dist artifact) when it finishes. I will probably cut a release in the next few days as well.

[Litning11]

No problem! We'll probably wait for the full release as I just personally avoid running dev builds on production, even if they're fully safe lol. Happy to have helped.