From 4cb27b2a1dcbb7b5b0f9403e1e1fd4136cea85d0 Mon Sep 17 00:00:00 2001
From: Jakub Iwicki <jakubiwicki.aj@gmail.com>
Date: Fri, 5 Jun 2026 14:03:02 +0200
Subject: [PATCH] Gate tilemap editor behind admin permission check

Adds AdminFunctionsForAll setting to PermissionSettings and
restricts the tilemap editor toggle to administrators only
unless the admin-functions-for-all override is enabled.

Closes #1280
---
 .gitignore                                    |  1 +
 .../SS3D/Permissions/PermissionSettings.cs    |  9 ++++++
 .../TileMapCreator/TileMapMenuSubSystem.cs    | 30 +++++++++++++++++++
 3 files changed, 40 insertions(+)

diff --git a/.gitignore b/.gitignore
index c4d56b42c9..38339019db 100644
--- a/.gitignore
+++ b/.gitignore
@@ -105,3 +105,4 @@ Assets/Content/Addressables/Windows/addressables_content_state.bin
 Assets/Content/Addressables/Windows/addressables_content_state.bin.meta
 Assets/Content/Addressables/link.xml
 Assets/Content/Addressables/link.xml.meta
+graphify-out/
diff --git a/Assets/Scripts/SS3D/Permissions/PermissionSettings.cs b/Assets/Scripts/SS3D/Permissions/PermissionSettings.cs
index cb1ea3536b..38af196992 100644
--- a/Assets/Scripts/SS3D/Permissions/PermissionSettings.cs
+++ b/Assets/Scripts/SS3D/Permissions/PermissionSettings.cs
@@ -12,9 +12,18 @@ public class PermissionSettings : ScriptableSettings
         [SerializeField]
         private bool _addServerOwnerPermissionToServerHost;
 
+        [SerializeField]
+        private bool _adminFunctionsForAll;
+
         /// <summary>
         /// We can define if the host will get the owner permission when he joins the game.
         /// </summary>
         public static bool AddServerOwnerPermissionToServerHost => GetOrFind<PermissionSettings>()._addServerOwnerPermissionToServerHost;
+
+        /// <summary>
+        /// If true, admin-only functions are available to all users.
+        /// Defaults to false, meaning only admins (host by default) can use admin functions.
+        /// </summary>
+        public static bool AdminFunctionsForAll => GetOrFind<PermissionSettings>()._adminFunctionsForAll;
     }
 }
\ No newline at end of file
diff --git a/Assets/Scripts/SS3D/Systems/Tile/TileMapCreator/TileMapMenuSubSystem.cs b/Assets/Scripts/SS3D/Systems/Tile/TileMapCreator/TileMapMenuSubSystem.cs
index f854abe2c9..887a7f3198 100644
--- a/Assets/Scripts/SS3D/Systems/Tile/TileMapCreator/TileMapMenuSubSystem.cs
+++ b/Assets/Scripts/SS3D/Systems/Tile/TileMapCreator/TileMapMenuSubSystem.cs
@@ -4,6 +4,8 @@
 using SS3D.Core;
 using SS3D.Core.Behaviours;
 using SS3D.Data.Management;
+using SS3D.Logging;
+using SS3D.Permissions;
 using SS3D.Systems.Inputs;
 using TMPro;
 using UnityEngine;
@@ -128,6 +130,12 @@ protected override void OnStart()
         /// </summary>
         private void HandleToggleMenu(InputAction.CallbackContext context)
         {
+            if (!_enabled && !CanAccessTilemapEditor())
+            {
+                Log.Information(this, "Player lacks permission to access the tilemap editor", Logs.ServerOnly);
+                return;
+            }
+
             if (_enabled)
             {
                 _inputSystem.ToggleActionMap(_controls, false, new[] { _controls.ToggleMenu });
@@ -145,6 +153,28 @@ private void HandleToggleMenu(InputAction.CallbackContext context)
             ClearAllTab();
             _tileMapBuildTab.Display();
         }
+
+        /// <summary>
+        /// Checks whether the local player is allowed to use the tilemap editor.
+        /// </summary>
+        private bool CanAccessTilemapEditor()
+        {
+            if (PermissionSettings.AdminFunctionsForAll)
+            {
+                return true;
+            }
+
+            string ckey = Core.Settings.LocalPlayer.Ckey;
+            if (string.IsNullOrEmpty(ckey))
+            {
+                return false;
+            }
+
+            PermissionSubSystem permissionSystem = SubSystems.Get<PermissionSubSystem>();
+            return permissionSystem != null
+                   && permissionSystem.HasLoadedPermissions
+                   && permissionSystem.IsAtLeast(ckey, ServerRoleTypes.Administrator);
+        }
        
         /// <summary>
         /// Hide or show the tilemap menu.