Skip to main content
TriBridge has two permission systems, and they are separate on purpose. Bot-admin is a flat list of Discord role ids. Anyone holding any of those roles is an admin as far as the bot is concerned. The list is shared with the THG Community bot: it is set there, with the community bot’s /adminrole, and TriBridge reads it from the shared database. One list decides who is staff on both bots. TriBridge has no /adminrole of its own.

​
Setting it up

On the community bot, a bot admin, or someone with the Discord Administrator permission, runs these (or uses the admin-roles picker in /setup):
Until at least one role is added, nothing admin-gated works on either bot, so the first role is set by a Discord administrator. That is the intended starting state, not a bug — do this during installation. Any bot admin can add or remove admin roles after that, which means any bot admin can make someone else an admin on both bots, /send included. Give admin roles only to people you would trust with that. TriBridge caches the list for 15 seconds, so a change made on the community bot takes effect here within that. If the database cannot be read, nobody is an admin: failing open would hand /send to anybody during an outage.

​
What bot-admin unlocks

Everything under Management — /invite, /kick, /promote, /demote, /mute, /unmute, /send, /login, /guilds, /adminpanel, /auditchannel, /blacklist — plus /links, /whois and /unlink user:. Commands marks them all with 🔒. /send deserves singling out: it runs arbitrary commands as a Minecraft account. Anyone with a bot-admin role can make the account do anything a player could, including leaving the guild. Treat the list the way you would treat guild officer.

​
One Discord server

Slash commands are registered globally, but TriBridge serves exactly one Discord server: one bridge channel, one flat admin role list. Every command dispatch refuses an interaction that did not come from it. This is the single most important guard in the bot. Without it:
  1. Anyone can add the bot to a server they own — a bot in a public server can be invited elsewhere.
  2. They hold Administrator there, because it is their server.
  3. Admin roles are looked up for the server a command comes from, and the owner of that server can set them with the community bot’s /adminrole if it is there too.
  4. They now hold bot-admin over the bridge’s Minecraft accounts, including /send.
The server is resolved at startup from the bridge channel, or named explicitly with DISCORD_GUILD_ID. It fails closed: if it cannot be resolved, every command is refused rather than falling back to permissive behaviour. Interactions in DMs are refused for the same reason. If every command suddenly returns a refusal after a restart, this is the first thing to check — see Troubleshooting.

​
Next