- more commands, permissions,

- placeholders, updated readme,
- further testing done.
- pre-release beta. Dont use in live yet

Author: mrfloris

README.md

@@ -13,7 +13,7 @@ The Gradle build creates the legacy reference jar and the current Paper 26.1.2 t
 | Jar | Purpose |
 | --- | --- |
 | `1MB-XMas-2026-v2.0.0-004-v21-1.21.8.jar` | Legacy reference jar copied from the deployed 2025 server jar. |
-| `1MB-XMas-2026-v2.0.1-010-v25-26.1.2.jar` | Modern Paper 26.1.2 build, Java 25 bytecode. |
+| `1MB-XMas-2026-v2.0.1-011-v25-26.1.2.jar` | Modern Paper 26.1.2 build, Java 25 bytecode. |
 
 The checked-in source targets Paper 26.1.2. The legacy jar is preserved so the deployed working 2025 behavior can be compared or rolled back during testing.
 
@@ -44,17 +44,17 @@ The checked-in source targets Paper 26.1.2. The legacy jar is preserved so the d
 
 For the 2026 target, use the modern Paper 26.1.2 jar:
 
-- Paper 26.1.2: `1MB-XMas-2026-v2.0.1-010-v25-26.1.2.jar`
+- Paper 26.1.2: `1MB-XMas-2026-v2.0.1-011-v25-26.1.2.jar`
 
 ## Building
 
 Requirements:
 
 - JDK 25
 - Gradle
-- The local Paper server folder in `servers/Server-Two-Paper-26.1.2`
-- The local PlaceholderAPI jar in `servers/Server-Two-Paper-26.1.2/plugins`
-- The deployed legacy jar in `servers/Server-One-Paper-1.21.11/plugins` if you want `legacyJar`
+- The current local dev/test setup in this repo uses `servers/Server-Two-Paper-26.1.2` for Paper API jars and local smoke testing
+- The current local dev/test setup in this repo uses `servers/Server-Two-Paper-26.1.2/plugins/PlaceholderAPI-2.12.3-DEV-265.jar` for the optional PlaceholderAPI compile-time classpath
+- The deployed legacy jar in `servers/Server-One-Paper-1.21.11/plugins` is only needed if you want the `legacyJar` copy task
 
 Build the current Paper 26.1.2 jar and the legacy reference jar:
 
@@ -80,7 +80,9 @@ Copy the deployed legacy jar into the requested legacy filename:
 gradle legacyJar
 ```
 
-The build compiles against the Paper 26.1.2 API jars found in `servers/Server-Two-Paper-26.1.2`. If that folder is missing or has not been started far enough for Paper to download its libraries, Gradle will not have the Paper API classpath it needs.
+End users do not need the `servers/` folder. The build output jars are written to `build/libs/`, and those are the files you install on a Paper server.
+
+In this workspace, the current Gradle setup compiles against the Paper 26.1.2 API jars found in `servers/Server-Two-Paper-26.1.2`. If that folder is missing or has not been started far enough for Paper to download its libraries, Gradle will not have the local Paper API classpath it currently expects.
 
 ## Commands
 
@@ -104,7 +106,17 @@ If `core.commands.legacy-command-enabled` is `true`, the legacy `/xmas` alias is
 
 | Permission | Default | Description |
 | --- | --- | --- |
-| `xmas.admin` | `op` | Allows use of the `/xmastree` command and all XMas Tree admin subcommands. |
+| `onembxmastree.admin` | `op` | Umbrella permission for all XMas Tree commands and override actions. |
+| `onembxmastree.command.status` | `true` | Allows viewing `/xmastree` status output. |
+| `onembxmastree.command.help` | `true` | Allows viewing `/xmastree help`. |
+| `onembxmastree.command.give` | `op` | Allows `/xmastree give <player>`. |
+| `onembxmastree.command.gifts` | `op` | Allows `/xmastree gifts`. |
+| `onembxmastree.command.addhand` | `op` | Allows `/xmastree addhand`. |
+| `onembxmastree.command.reload` | `op` | Allows `/xmastree reload`. |
+| `onembxmastree.command.debug` | `op` | Allows `/xmastree debug [page]`. |
+| `onembxmastree.command.debug.toggle` | `op` | Allows `/xmastree debug toggle <key> true\|false`. |
+| `onembxmastree.command.end` | `op` | Allows `/xmastree end`. |
+| `onembxmastree.tree.override` | `op` | Allows managing other players' trees. |
 
 ## Player flow
 
@@ -199,7 +211,7 @@ The dotted key after `onembxmastree_` is supported to keep the placeholders read
 | `%onembxmastree_trees.total%` | `14` | Total loaded X-Mas trees. |
 | `%onembxmastree_trees.owners%` | `6` | Number of unique loaded tree owners. |
 | `%onembxmastree_player.trees%` | `2` | Number of loaded trees owned by the placeholder player. |
-| `%onembxmastree_version%` | `2.0.1-010` | Loaded plugin version. |
+| `%onembxmastree_version%` | `2.0.1-011` | Loaded plugin version. |
 
 CMI hologram example:
 
@@ -229,7 +241,7 @@ ajLeaderboards placeholder examples:
 
 ## Security notes
 
-- Admin commands are gated by `xmas.admin`.
+- Admin and staff access is gated by `onembxmastree.*` permissions.
 - Present texture URLs are restricted to `textures.minecraft.net`.
 - Gift item Base64 entries are capped before deserialization.
 - Config material names are resolved with modern `Material.matchMaterial` and invalid or legacy values are skipped.
@@ -247,7 +259,7 @@ Please report bugs, compatibility problems, and upgrade questions in the GitHub
 - **Ghost_chu** - NMS fixes - [Ghost-chu](https://github.com/Ghost-chu)
 - **LoneDev6** - Optimization patches - [LoneDev6](https://github.com/LoneDev6)
 - **montlikadani** - Hungarian translation - [montlikadani](https://github.com/montlikadani)
-- **1MB / mrfdev** - 2026 Paper modernization, Java 25 builds, and XMasTree maintenance
+- **mrfloris** - 2026 Paper modernization, Java 25 builds, and XMasTree maintenance - [mrfloris](https://github.com/mrfloris)
 
 Original SpigotMC listing:
 

build.gradle

@@ -3,10 +3,10 @@ plugins {
 }
 
 group = 'com.onemb.xmas'
-version = '2.0.1-010'
+version = '2.0.1-011'
 
 def legacyArchiveName = '1MB-XMas-2026-v2.0.0-004-v21-1.21.8.jar'
-def paper2612ArchiveName = '1MB-XMas-2026-v2.0.1-010-v25-26.1.2.jar'
+def paper2612ArchiveName = '1MB-XMas-2026-v2.0.1-011-v25-26.1.2.jar'
 
 def serverOne = layout.projectDirectory.dir('servers/Server-One-Paper-1.21.11')
 def serverTwo = layout.projectDirectory.dir('servers/Server-Two-Paper-26.1.2')

src/main/java/ru/meloncode/xmas/Events.java

@@ -217,7 +217,7 @@ public void onPlayerBreakBlock(BlockBreakEvent event) {
             MagicTree tree = MagicTree.getTreeByBlock(block);
             switch (block.getType()) {
                 case SPRUCE_LOG:
-                    if (player.getUniqueId().equals(tree.getOwner()) || player.hasPermission("xmas.admin")) {
+                    if (player.getUniqueId().equals(tree.getOwner()) || XMasCommand.canOverrideTree(player)) {
                         if (Main.inProgress)
                             if (destroyers.containsKey(player.getUniqueId()) && System.currentTimeMillis() - destroyers.get(player.getUniqueId()) <= 10000) {
                                 if (Main.resourceBack) {
@@ -247,14 +247,14 @@ public void onPlayerBreakBlock(BlockBreakEvent event) {
                 case GLOWSTONE:
                     if (Main.inProgress)
                         TextUtils.sendMessage(player, "<dark_green>" + LocaleManager.DESTROY_LEAVES_SANTA);
-                    if (player.getUniqueId().equals(tree.getOwner()) || player.hasPermission("xmas.admin")) {
+                    if (player.getUniqueId().equals(tree.getOwner()) || XMasCommand.canOverrideTree(player)) {
                         TextUtils.sendMessage(player, "<red>" + LocaleManager.DESTROY_LEAVES_TUT);
                     } else {
                         TextUtils.sendMessage(player, LocaleManager.DESTROY_FAIL_OWNER);
                     }
                     break;
                 case SPRUCE_SAPLING:
-                    if (player.getUniqueId().equals(tree.getOwner()) || player.hasPermission("xmas.admin")) {
+                    if (player.getUniqueId().equals(tree.getOwner()) || XMasCommand.canOverrideTree(player)) {
                         if (Main.inProgress) {
                             if (destroyers.containsKey(player.getUniqueId()) && System.currentTimeMillis() - destroyers.get(player.getUniqueId()) <= 10000) {
                                 if (Main.resourceBack) {

src/main/java/ru/meloncode/xmas/XMasCommand.java

@@ -20,6 +20,17 @@
 public class XMasCommand implements CommandExecutor, TabCompleter {
     public static final String PRIMARY_COMMAND = "xmastree";
     public static final String LEGACY_COMMAND = "xmas";
+    public static final String PERMISSION_ADMIN = "onembxmastree.admin";
+    public static final String PERMISSION_STATUS = "onembxmastree.command.status";
+    public static final String PERMISSION_HELP = "onembxmastree.command.help";
+    public static final String PERMISSION_GIVE = "onembxmastree.command.give";
+    public static final String PERMISSION_GIFTS = "onembxmastree.command.gifts";
+    public static final String PERMISSION_ADDHAND = "onembxmastree.command.addhand";
+    public static final String PERMISSION_RELOAD = "onembxmastree.command.reload";
+    public static final String PERMISSION_DEBUG = "onembxmastree.command.debug";
+    public static final String PERMISSION_DEBUG_TOGGLE = "onembxmastree.command.debug.toggle";
+    public static final String PERMISSION_END = "onembxmastree.command.end";
+    public static final String PERMISSION_TREE_OVERRIDE = "onembxmastree.tree.override";
     private static final List<String> COMMANDS = Arrays.asList("help", "give", "end", "gifts", "reload", "addhand", "debug");
     private static final Set<String> DEBUG_TOGGLE_KEYS = new LinkedHashSet<>(Arrays.asList(
             "core.commands.legacy-command-enabled",
@@ -29,6 +40,7 @@ public class XMasCommand implements CommandExecutor, TabCompleter {
             "core.particles-enabled",
             "xmas.luck.enabled"
     ));
+    private static final Map<String, String> PERMISSIONS = createPermissionDescriptions();
     private static final int DEBUG_PAGE_SIZE = 8;
     private static XMasCommand registeredExecutor;
     private static PluginCommand legacyAliasCommand;
@@ -65,12 +77,20 @@ public boolean onCommand(CommandSender sender, Command command, String label, St
             String action = args[0].toLowerCase(Locale.ENGLISH);
             switch (action) {
                 case "help": {
+                    if (!hasPermission(sender, PERMISSION_HELP)) {
+                        sendNoPermission(sender);
+                        break;
+                    }
                     for (String line : getHelpLines()) {
                         TextUtils.sendRawMessage(sender, line);
                     }
                     break;
                 }
                 case "give": {
+                    if (!hasPermission(sender, PERMISSION_GIVE)) {
+                        sendNoPermission(sender);
+                        break;
+                    }
                     if (args.length > 1) {
                         String name = args[1];
                         Player player = Bukkit.getPlayer(name);
@@ -85,10 +105,18 @@ public boolean onCommand(CommandSender sender, Command command, String label, St
                     break;
                 }
                 case "end": {
+                    if (!hasPermission(sender, PERMISSION_END)) {
+                        sendNoPermission(sender);
+                        break;
+                    }
                     plugin.end();
                     break;
                 }
                 case "gifts": {
+                    if (!hasPermission(sender, PERMISSION_GIFTS)) {
+                        sendNoPermission(sender);
+                        break;
+                    }
                     Random random = new Random();
                     for (MagicTree magicTree : XMas.getAllTrees()) {
                         for (int i = 0; i < 3 + random.nextInt(4); i++) {
@@ -99,8 +127,8 @@ public boolean onCommand(CommandSender sender, Command command, String label, St
                     break;
                 }
                 case "reload": {
-                    if (!sender.hasPermission("xmas.admin")) {
-                        TextUtils.sendRawMessage(sender, "<red>You do not have permission to use this command.");
+                    if (!hasPermission(sender, PERMISSION_RELOAD)) {
+                        sendNoPermission(sender);
                         break;
                     }
                     plugin.reloadPluginConfig();
@@ -112,8 +140,8 @@ public boolean onCommand(CommandSender sender, Command command, String label, St
                         TextUtils.sendRawMessage(sender, "<red>Only players can use this command.");
                         break;
                     }
-                    if (!sender.hasPermission("xmas.admin")) {
-                        TextUtils.sendRawMessage(sender, "<red>You do not have permission to use this command.");
+                    if (!hasPermission(sender, PERMISSION_ADDHAND)) {
+                        sendNoPermission(sender);
                         break;
                     }
                     ItemStack item = player.getInventory().getItemInMainHand();
@@ -134,7 +162,11 @@ public boolean onCommand(CommandSender sender, Command command, String label, St
                     return false;
             }
         } else {
-            sendStatus(sender);
+            if (!hasPermission(sender, PERMISSION_STATUS)) {
+                sendNoPermission(sender);
+            } else {
+                sendStatus(sender);
+            }
         }
         return true;
     }
@@ -145,7 +177,7 @@ public List<String> onTabComplete(CommandSender sender, Command command, String
         if (args.length == 1) {
             String typed = args[0].toLowerCase(Locale.ENGLISH);
             for (String subCommand : COMMANDS) {
-                if (subCommand.startsWith(typed)) {
+                if (subCommand.startsWith(typed) && canUseSubCommand(sender, subCommand)) {
                     suggestions.add(subCommand);
                 }
             }
@@ -199,13 +231,17 @@ private List<String> getStatusLines() {
     }
 
     private void handleDebug(CommandSender sender, String[] args) {
-        if (!sender.hasPermission("xmas.admin")) {
-            TextUtils.sendRawMessage(sender, "<red>You do not have permission to use this command.");
+        if (args.length >= 2 && args[1].equalsIgnoreCase("toggle")) {
+            if (!hasPermission(sender, PERMISSION_DEBUG_TOGGLE)) {
+                sendNoPermission(sender);
+                return;
+            }
+            handleDebugToggle(sender, args);
             return;
         }
 
-        if (args.length >= 2 && args[1].equalsIgnoreCase("toggle")) {
-            handleDebugToggle(sender, args);
+        if (!hasPermission(sender, PERMISSION_DEBUG)) {
+            sendNoPermission(sender);
             return;
         }
 
@@ -263,7 +299,9 @@ private void sendDebugPage(CommandSender sender, int requestedPage) {
         }
         lines.add("");
         lines.add("<gold>Permissions");
-        lines.add("<gray>xmas.admin - allows all " + TextUtils.DISPLAY_NAME + " admin commands");
+        for (Map.Entry<String, String> permission : PERMISSIONS.entrySet()) {
+            lines.add("<gray>" + permission.getKey() + " - " + permission.getValue());
+        }
         lines.add("");
         lines.add("<gold>Placeholders");
         lines.add("<gray>Requires PlaceholderAPI. Use '_' after prefix, then dotted keys.");
@@ -312,6 +350,10 @@ private boolean isLegacyAliasEnabled() {
         return plugin.getConfig().getBoolean("core.commands.legacy-command-enabled", true);
     }
 
+    public static boolean canOverrideTree(CommandSender sender) {
+        return hasPermission(sender, PERMISSION_TREE_OVERRIDE);
+    }
+
     private static void syncLegacyAlias(Main plugin, XMasCommand executor) {
         CommandMap commandMap = getCommandMap();
         if (commandMap == null) {
@@ -346,7 +388,7 @@ private static void syncLegacyAlias(Main plugin, XMasCommand executor) {
         }
         aliasCommand.setDescription("Legacy alias for /" + PRIMARY_COMMAND);
         aliasCommand.setUsage("/" + LEGACY_COMMAND + " [help|give|gifts|addhand|reload|debug|end]");
-        aliasCommand.setPermission("xmas.admin");
+        aliasCommand.setPermission(null);
         aliasCommand.setExecutor(executor);
         aliasCommand.setTabCompleter(executor);
         commandMap.register(plugin.getDescription().getName().toLowerCase(Locale.ENGLISH), aliasCommand);
@@ -420,4 +462,41 @@ private List<String> filterStartingWith(List<String> values, String typed) {
         return matches;
     }
 
+    private boolean canUseSubCommand(CommandSender sender, String subCommand) {
+        return switch (subCommand.toLowerCase(Locale.ENGLISH)) {
+            case "help" -> hasPermission(sender, PERMISSION_HELP);
+            case "give" -> hasPermission(sender, PERMISSION_GIVE);
+            case "end" -> hasPermission(sender, PERMISSION_END);
+            case "gifts" -> hasPermission(sender, PERMISSION_GIFTS);
+            case "reload" -> hasPermission(sender, PERMISSION_RELOAD);
+            case "addhand" -> hasPermission(sender, PERMISSION_ADDHAND);
+            case "debug" -> hasPermission(sender, PERMISSION_DEBUG) || hasPermission(sender, PERMISSION_DEBUG_TOGGLE);
+            default -> false;
+        };
+    }
+
+    private static boolean hasPermission(CommandSender sender, String permission) {
+        return sender.hasPermission(PERMISSION_ADMIN) || sender.hasPermission(permission);
+    }
+
+    private void sendNoPermission(CommandSender sender) {
+        TextUtils.sendRawMessage(sender, "<red>You do not have permission to use this command.");
+    }
+
+    private static Map<String, String> createPermissionDescriptions() {
+        Map<String, String> permissions = new LinkedHashMap<>();
+        permissions.put(PERMISSION_ADMIN, "allows all " + TextUtils.DISPLAY_NAME + " commands and overrides");
+        permissions.put(PERMISSION_STATUS, "shows /" + PRIMARY_COMMAND + " status output");
+        permissions.put(PERMISSION_HELP, "shows /" + PRIMARY_COMMAND + " help output");
+        permissions.put(PERMISSION_GIVE, "allows /" + PRIMARY_COMMAND + " give");
+        permissions.put(PERMISSION_GIFTS, "allows /" + PRIMARY_COMMAND + " gifts");
+        permissions.put(PERMISSION_ADDHAND, "allows /" + PRIMARY_COMMAND + " addhand");
+        permissions.put(PERMISSION_RELOAD, "allows /" + PRIMARY_COMMAND + " reload");
+        permissions.put(PERMISSION_DEBUG, "allows /" + PRIMARY_COMMAND + " debug");
+        permissions.put(PERMISSION_DEBUG_TOGGLE, "allows /" + PRIMARY_COMMAND + " debug toggle");
+        permissions.put(PERMISSION_END, "allows /" + PRIMARY_COMMAND + " end");
+        permissions.put(PERMISSION_TREE_OVERRIDE, "allows managing other players' trees");
+        return permissions;
+    }
+
 }

src/main/java/ru/meloncode/xmas/XMasPlaceholderExpansion.java

@@ -19,7 +19,7 @@ public String getIdentifier() {
 
     @Override
     public String getAuthor() {
-        return "1MB / mrfdev";
+        return "mrfloris";
     }
 
     @Override

src/main/resources/plugin.yml

@@ -8,8 +8,48 @@ commands:
  xmastree:
   description: Manage the 1MB XMas Tree event
   usage: /<command> [help|give|gifts|addhand|reload|debug|end]
-  permission: xmas.admin
 permissions:
- xmas.admin:
-  description: Allows all XMas Tree admin commands
+ onembxmastree.admin:
+  description: Allows all XMas Tree commands and overrides
+  default: op
+  children:
+   onembxmastree.command.status: true
+   onembxmastree.command.help: true
+   onembxmastree.command.give: true
+   onembxmastree.command.gifts: true
+   onembxmastree.command.addhand: true
+   onembxmastree.command.reload: true
+   onembxmastree.command.debug: true
+   onembxmastree.command.debug.toggle: true
+   onembxmastree.command.end: true
+   onembxmastree.tree.override: true
+ onembxmastree.command.status:
+  description: Allows viewing /xmastree status
+  default: true
+ onembxmastree.command.help:
+  description: Allows viewing /xmastree help
+  default: true
+ onembxmastree.command.give:
+  description: Allows /xmastree give
+  default: op
+ onembxmastree.command.gifts:
+  description: Allows /xmastree gifts
+  default: op
+ onembxmastree.command.addhand:
+  description: Allows /xmastree addhand
+  default: op
+ onembxmastree.command.reload:
+  description: Allows /xmastree reload
+  default: op
+ onembxmastree.command.debug:
+  description: Allows /xmastree debug
+  default: op
+ onembxmastree.command.debug.toggle:
+  description: Allows /xmastree debug toggle
+  default: op
+ onembxmastree.command.end:
+  description: Allows /xmastree end
+  default: op
+ onembxmastree.tree.override:
+  description: Allows managing other players' trees
   default: op