Security and Permissions

Valheim Lua Engine provides server-side ACE checks, but resource code still owns input validation and authorization decisions.

Restrict commands

Pass true to require command.<commandName>:

RegisterCommand('spawn_boss', function(source, args)
  -- Runs only after the server ACE check succeeds.
end, true)

Pass an ACE name to use an explicit permission:

RegisterCommand('event_start', function(source)
  -- Start the event.
end, 'events.manage')

Configure ACE

Add grants and principals to server.cfg:

add_ace group.admin command allow
add_ace group.moderator events.manage allow
add_principal identifier.steam:76561198000000000 group.admin

ACE grants are hierarchical. command and command.* both cover command.spawn_boss. The current runtime supports allow; deny rules are rejected with a warning.

Existing permissions.json groups remain supported. Rules from server.cfg are added as a runtime overlay.

Protect network events

RegisterNetEvent allows a remote caller to reach the handler. It does not authorize that caller.

For every server network event:

1. Capture and validate source.
2. Check Player.HasPermission or IsPlayerAceAllowed when needed.
3. Validate every argument and clamp numeric ranges.
4. Resolve player position and identity on the server.
5. Perform mutations only through server APIs.

RegisterNetEvent('admin:give_coins', function(targetPeer, amount)
  local adminPeer = source

  if not IsPlayerAceAllowed(adminPeer, 'inventory.give') then
    return
  end

  local safeAmount = math.floor(tonumber(amount) or 0)
  if safeAmount < 1 or safeAmount > 100 then
    return
  end

  Inventory.AddItem(targetPeer, 'Coins', safeAmount)
end)

Do not trust client state

A modified client can call registered events directly. Hiding a command or UI control on the client is not an authorization mechanism.