Permissions - CosmicCubicle/PariahBot GitHub Wiki
Permissions
Everything PariahBot needs to be allowed to do, and which feature needs it. It covers the bot's gateway intents, its server permissions, where its role has to sit, and who in your server can use each command.
The invite links that grant these are on Bot-Setup (step 3).
Gateway intents
These are set in the bot's code, not in your server. One is privileged and always requested: Server Members. It has to be switched on once in the Developer Portal (your application → Bot → Privileged Gateway Intents), or Discord refuses the bot's login. The bot then prints which switch to turn on and stops. See Bot-Setup, step 1.
| Intent | Privileged | Needed for |
|---|---|---|
| Guilds | No | Everything |
| Guild Voice States | No | Temporary voice channels |
| Guild Messages | No | Message auto-deletion, honeypot, activity XP, the server log's message edits and deletes |
| Auto Moderation Execution | No | Banned words: hearing about each message AutoMod blocks, so it can be reported |
| Guild Moderation | No | The server log: audit log entries (kicks, bans, role and channel changes) |
| Server Members | Yes, always | The server log's joins and leaves. Nothing else reports them |
| Message Content | Yes, only if you opt in | The text of edited and deleted messages in the server log. Requested only when SERVER_LOG_MESSAGE_CONTENT is on (see Configuration); switch this on too before setting it |
Discord reviews privileged intents only for bots in 100 or more servers. Below that, the switch just works.
Features are still built to avoid privileged intents where they can:
- The captcha works from a button in a screening channel, rather than listening for members joining. It works the same whether or not Server Members is on.
- Banned words use Discord AutoMod, rather than reading messages. That would need Message Content. See Banned-Words.
Bot permissions
There are two sets, each with an invite link on Bot-Setup:
- Required (14 permissions): the ones PariahBot's code actually uses.
- Recommended (34 permissions): the required 14, plus 20 commonly granted extras. This is the standard invite.
Required: each permission and what it's for
Leaving one out only breaks the features that use it. Everything else keeps working.
| Permission | Used by | What for |
|---|---|---|
| View Channels | Everything | Seeing the channels it works in |
| Send Messages | Everything | Command replies, role menus, alerts, verification, honeypot, level-ups, giveaways, stream and Instagram alerts |
| Embed Links | Most commands | Embeds, which nearly every reply and alert uses |
| Read Message History | /autodelete, giveaways, role menus, captcha |
Reading channel backlog and pins (/autodelete); finding messages the bot posted earlier, to edit or replace them |
| Manage Channels | /voice, temp channels, /vc, /alerts, /security |
Creating and deleting channels and categories: hubs, temp channels, the default alert channel, the screening and honeypot channels. /vc name and /vc limit |
| Manage Roles | /setup, role menus, captcha, /vc, /roles, /security |
Creating roles (/setup), granting roles (role menus, captcha), and channel permission overwrites (/vc lock, /roles apply-channel-defaults, the screening and honeypot channels) |
| Move Members | Temp channels, /vc kick |
Moving members into their new temp channel, and out of it |
| Connect | /vc lock, /vc unlock |
Discord only lets a bot set a permission it holds itself. The bot grants itself Connect before denying it to @everyone |
| Manage Messages | /autodelete |
Deleting other people's messages |
| Manage Server | /bannedwords |
Creating and updating the server's Discord AutoMod rules. Discord requires it for AutoMod |
| Ban Members | /security honeypot, /mod |
Removing whoever posts in the trap: its default "remove" is a softban (ban, then unban straight away). /mod ban, softban and unban, and lifting temporary bans |
| Kick Members | /mod kick, Kick member |
Kicking a member |
| Timeout Members | /mod timeout, /mod untimeout, Timeout member |
Timing a member out, and ending it early |
| View Audit Log | /logging (server log) |
Seeing kicks, bans, role and channel changes, and members' role changes, with who made them. Discord has no other source for a kick |
Recommended: the extras
The code doesn't use these, apart from footnote ¹, so removing one won't break a feature.
| Area | Also granted |
|---|---|
| General | Create Invite, Change Nickname, Manage Nicknames |
| Text | Mention @everyone, @here and All Roles¹, Attach Files, Add Reactions, Pin Messages, Bypass Slowmode, Send Voice Messages, Create Polls, Send Messages in Threads, Create Public Threads, Create Private Threads, Manage Threads and Posts |
| Voice | Speak, Mute Members, Deafen Members, Set Voice Channel Status |
| Apps | Use Application Commands, Use Activities |
¹ /streamers, /instagram and /rss use it to ping a role that isn't set to Allow
anyone to @mention this role. Without it, make the ping role mentionable.
Deliberately left out
- Not needed: Use External Stickers, Request to Speak, Use Soundboard, Use External Sounds, Use External Apps.
- Control of the server itself: Administrator, Manage Webhooks, Manage Expressions, Manage Events.
Manage Server is the one server-level permission granted, and only because Discord requires it for AutoMod.
By feature
The same information the other way round: what to check when one feature doesn't work.
| Feature | Bot permissions | Also needs |
|---|---|---|
Temporary voice channels (/voice, /vc) |
Manage Channels, Move Members, Connect, Manage Roles | — |
Role menus (/roles) |
Manage Roles, Read Message History | Bot's role above every role in a menu |
Captcha (/security captcha) |
Manage Roles, Manage Channels, Read Message History | Bot's role above the member role |
Honeypot (/security honeypot) |
Ban Members, Manage Channels, Manage Roles | Bot's role above anyone it should remove |
Moderation (/mod, right-click actions) |
Kick Members, Ban Members, Timeout Members | Bot's role above the target. The moderator must also outrank them |
Banned words (/bannedwords) |
Manage Server | An admin alert destination, to see the reports |
Message auto-deletion (/autodelete) |
Manage Messages, Read Message History | — |
Admin alerts (/alerts) |
Manage Channels (only for the default channel) | — |
Stream alerts (/streamers) |
Send Messages, Embed Links | Mention Everyone, or a mentionable ping role |
Instagram alerts (/instagram) |
Send Messages, Embed Links | Mention Everyone, or a mentionable ping role |
RSS feeds (/rss) |
Send Messages, Embed Links, in each feed's channel | Mention Everyone, or a mentionable ping role |
Giveaways (/giveaway) |
Send Messages, Embed Links, Read Message History | — |
Activity levels (/level) |
Send Messages | — |
Server roles (/setup) |
Manage Roles (only to create roles) | — |
Server log (/logging) |
View Audit Log (kicks and bans, server changes); View Channels, Send Messages, Embed Links in each log channel | The Server Members intent (always). The Message Content intent, only for message text |
Every feature also needs View Channels, Send Messages and Embed Links in the channels it uses.
Role hierarchy
Permissions aren't enough on their own. Discord won't let the bot grant, remove, or act on anyone whose highest role is above the bot's own. In Server Settings → Roles, drag PariahBot above:
- the member role the captcha grants
- every role offered through a role menu
- anyone the honeypot should be able to remove
Keep the bot's permissions on its own PariahBot role. See Bot-Setup, step 4.
Who can use each command
| Who | Commands |
|---|---|
| Everyone | /help, /ping, /level, the captcha's Start verification button, giveaway Enter buttons, role menus |
| Temp channel owner | /vc in the channel they own. Admins can switch off each control except claim with /voice owner-control |
| Members with the streamer role | /streamers link, /streamers unlink |
Mods: any mod role from /setup mod-role add, or any admin |
Everything marked (Mod): /mod (warn, kick, ban, softban, unban, timeout, untimeout, history), the right-click Kick member, Ban member and Timeout member, /alerts, /autodelete, /voice, /roles, /streamers add/remove/channel/message/clear-message/disable/list, /instagram, /rss, /giveaway, and /bannedwords word add/remove and status |
Admins: Discord's Administrator permission, or any admin role from /setup admin-role add |
Everything mods can, plus everything marked (Admin): /setup, /security, /logging, /mod config and /mod remove-case, /bannedwords enable/disable/list, and the Admin-Dashboard |
The Admin-Dashboard follows the Admins row: mods don't get it. Server admins sign in and see only the servers they admin, checked against their live roles. The bot's owner (the application's owner, or its team members) sees every server, plus the Status page. It needs no bot permission of its own, but the changes it makes need the same permissions as the matching commands.
Manage Channels alone is not admin, and it is not staff. It grants exactly one thing:
/vc claim, to take over a temp channel whose owner is still in it
The Prune and Restore buttons on a deleted-hub alert (see
Admin-Alerts) used to accept it too. They now require staff — a mod
role, an admin role, or Administrator — matching /voice, which manages the
same hubs. Someone whose only permission is Manage Channels can no longer use
those buttons; give them a mod role if they need to.
Keeping this page right
This page has to match the code. Whenever the docs are updated for a change, check here as well, if the change:
- adds or removes a permission or intent
- moves a feature onto a different permission
- changes who can run a command
If a permission changes, there are two more places to update:
lib/invitePermissions.js, which is what the dashboard’s invite builder asks Discord for. A permission a feature cannot work without goes on that feature; one it merely benefits from goes inRECOMMENDED_EXTRAS.- Both invite numbers on Bot-Setup, which have to match what that file
computes.
test/invitePermissions.test.jspins them, so the test fails until the wiki is updated too.