Pokebuilder for Cobblemon

[1.3.5] — 2026-04-16

Changed (security default)

• Bypass permissions are now ignored by default. New config flag security.allow-bypass-permissions (default false) is the master gate for the entire pokebuilder.bypass.* family (bypass.cost, bypass.cooldown). When the gate is off, TransactionService treats those nodes as not-granted no matter what the permission plugin says — defeating the wildcard-grant accident (pokebuilder.* on an admin group) that was silently giving every admin free purchases on cora-on-SYLX and others.
• No more "every op gets free purchases" surprise. Fresh installs, upgrades, and existing configs that don't explicitly set the gate all default to the safe behavior. Admins who want bypass functionality flip security.allow-bypass-permissions = true in config (or via the Security admin GUI panel — new toggle row).

Added

• SecurityAdminGui gets the bypass-gate toggle. Click the new wool button to flip allow-bypass-permissions live without editing config. Toggle is yellow (active = potentially unsafe) when ON, green when OFF (safe default).
• /pokebuilder debug shows the gate state and effective bypass. Distinguishes between perm=true (the permission plugin grants the node) and effective=true (the gate ALSO allows it, so the bypass actually fires). Two separate lines so admins can see "yes the perm is granted but it's being ignored because the gate is off — which is why purchases are correctly deducting."

Migration notes

• If you were relying on bypass.cost (i.e. you intentionally gave certain players free purchases via a permission plugin), upgrade will silently re-enable charging for them. Either:
  1. Set security.allow-bypass-permissions = true in config (or toggle in the Security admin GUI) — restores the 1.3.4 behavior for everyone holding the bypass node, OR
  2. Use the Tiers system instead — set a tier multiplier of 0.0 for the appropriate pokebuilder.tier.<id> permission. Per-player, audited via the existing tier mechanism, and it doesn't require flipping a server-wide gate.
• The bypass nodes (pokebuilder.bypass.cost, .cooldown) themselves are unchanged — same names, same explicit-only resolution. Only the server-side default of whether the node has any effect changed.