Implement argument based permissions for LP commands - closes #52, #170, #174

bukkit/src/main/java/me/lucko/luckperms/bukkit/BukkitSenderFactory.java

@@ -25,6 +25,7 @@
 
 package me.lucko.luckperms.bukkit;
 
+import me.lucko.luckperms.api.Tristate;
 import me.lucko.luckperms.bukkit.compat.MessageHandler;
 import me.lucko.luckperms.common.commands.sender.SenderFactory;
 import me.lucko.luckperms.common.constants.Constants;
@@ -79,6 +80,14 @@ public class BukkitSenderFactory extends SenderFactory<CommandSender> {
         messageHandler.sendJsonMessage(sender, message);
     }
 
+    @Override
+    protected Tristate getPermissionValue(CommandSender sender, String node) {
+        boolean isSet = sender.isPermissionSet(node);
+        boolean val = sender.hasPermission(node);
+
+        return !isSet ? val ? Tristate.TRUE : Tristate.UNDEFINED : Tristate.fromBoolean(val);
+    }
+
     @Override
     protected boolean hasPermission(CommandSender sender, String node) {
         return sender.hasPermission(node);

bukkit/src/main/java/me/lucko/luckperms/bukkit/model/LPPermissible.java

@@ -146,22 +146,28 @@ public class LPPermissible extends PermissibleBase {
 
     @Override
     public boolean isPermissionSet(@NonNull String name) {
-        return user.getUserData().getPermissionData(calculateContexts()).getPermissionValue(name) != Tristate.UNDEFINED;
+        Tristate ts = user.getUserData().getPermissionData(calculateContexts()).getPermissionValue(name);
+        return ts != Tristate.UNDEFINED || Permission.DEFAULT_PERMISSION.getValue(isOp());
     }
 
     @Override
     public boolean isPermissionSet(@NonNull Permission perm) {
-        return isPermissionSet(perm.getName());
+        Tristate ts = user.getUserData().getPermissionData(calculateContexts()).getPermissionValue(perm.getName());
+        if (ts != Tristate.UNDEFINED) {
+            return true;
+        }
+
+        if (!plugin.getConfiguration().get(ConfigKeys.APPLY_BUKKIT_DEFAULT_PERMISSIONS)) {
+            return Permission.DEFAULT_PERMISSION.getValue(isOp());
+        } else {
+            return perm.getDefault().getValue(isOp());
+        }
     }
 
     @Override
     public boolean hasPermission(@NonNull String name) {
         Tristate ts = user.getUserData().getPermissionData(calculateContexts()).getPermissionValue(name);
-        if (ts != Tristate.UNDEFINED) {
+        return ts != Tristate.UNDEFINED ? ts.asBoolean() : Permission.DEFAULT_PERMISSION.getValue(isOp());
-            return ts.asBoolean();
-        }
-
-        return Permission.DEFAULT_PERMISSION.getValue(isOp());
     }
 
     @Override

bukkit/src/main/resources/config.yml

@@ -101,6 +101,15 @@ temporary-add-behaviour: deny
 #                           directly and indirectly
 primary-group-calculation: stored
 
+# If the plugin should check for "extra" permissions with users run LP commands.
+#
+# These extra permissions allow finer control over what users can do with each command, and
+# who they have access to edit.
+#
+# The permissions are *not* static, unlike the 'base' permisssions, and will depend upon the
+# arguments given within the command.
+argument-based-command-permissions: false
+
 
 
 

bungee/src/main/java/me/lucko/luckperms/bungee/BungeeListener.java

@@ -30,6 +30,7 @@ import lombok.RequiredArgsConstructor;
 import me.lucko.luckperms.api.Contexts;
 import me.lucko.luckperms.api.Tristate;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.bungee.event.TristateCheckEvent;
 import me.lucko.luckperms.common.config.ConfigKeys;
 import me.lucko.luckperms.common.core.model.User;
 import me.lucko.luckperms.common.locale.Message;
@@ -165,6 +166,38 @@ public class BungeeListener implements Listener {
         e.setHasPermission(result.asBoolean());
     }
 
+    @EventHandler(priority = EventPriority.HIGH)
+    public void onPlayerTristateCheck(TristateCheckEvent e) {
+        if (!(e.getSender() instanceof ProxiedPlayer)) {
+            return;
+        }
+
+        final ProxiedPlayer player = ((ProxiedPlayer) e.getSender());
+
+        User user = plugin.getUserManager().getIfLoaded(plugin.getUuidCache().getUUID(player.getUniqueId()));
+        if (user == null) {
+            e.setResult(Tristate.UNDEFINED);
+            return;
+        }
+
+        Contexts contexts = new Contexts(
+                plugin.getContextManager().getApplicableContext(player),
+                plugin.getConfiguration().get(ConfigKeys.INCLUDING_GLOBAL_PERMS),
+                plugin.getConfiguration().get(ConfigKeys.INCLUDING_GLOBAL_WORLD_PERMS),
+                true,
+                plugin.getConfiguration().get(ConfigKeys.APPLYING_GLOBAL_GROUPS),
+                plugin.getConfiguration().get(ConfigKeys.APPLYING_GLOBAL_WORLD_GROUPS),
+                false
+        );
+
+        Tristate result = user.getUserData().getPermissionData(contexts).getPermissionValue(e.getPermission());
+        if (result == Tristate.UNDEFINED && plugin.getConfiguration().get(ConfigKeys.APPLY_BUNGEE_CONFIG_PERMISSIONS)) {
+            return; // just use the result provided by the proxy when the event was created
+        }
+
+        e.setResult(result);
+    }
+
     // We don't pre-process all servers, so we have to do it here.
     @EventHandler(priority = EventPriority.LOWEST)
     public void onServerSwitch(ServerConnectEvent e) {

bungee/src/main/java/me/lucko/luckperms/bungee/BungeeSenderFactory.java

@@ -25,6 +25,8 @@
 
 package me.lucko.luckperms.bungee;
 
+import me.lucko.luckperms.api.Tristate;
+import me.lucko.luckperms.bungee.event.TristateCheckEvent;
 import me.lucko.luckperms.common.commands.sender.SenderFactory;
 import me.lucko.luckperms.common.constants.Constants;
 import me.lucko.luckperms.common.plugin.LuckPermsPlugin;
@@ -72,6 +74,11 @@ public class BungeeSenderFactory extends SenderFactory<CommandSender> {
         }
     }
 
+    @Override
+    protected Tristate getPermissionValue(CommandSender sender, String node) {
+        return TristateCheckEvent.call(sender, node);
+    }
+
     @Override
     protected boolean hasPermission(CommandSender sender, String node) {
         return sender.hasPermission(node);

bungee/src/main/java/me/lucko/luckperms/bungee/event/TristateCheckEvent.java

@@ -0,0 +1,62 @@
+/*
+ * This file is part of LuckPerms, licensed under the MIT License.
+ *
+ *  Copyright (c) lucko (Luck) <luck@lucko.me>
+ *  Copyright (c) contributors
+ *
+ *  Permission is hereby granted, free of charge, to any person obtaining a copy
+ *  of this software and associated documentation files (the "Software"), to deal
+ *  in the Software without restriction, including without limitation the rights
+ *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ *  copies of the Software, and to permit persons to whom the Software is
+ *  furnished to do so, subject to the following conditions:
+ *
+ *  The above copyright notice and this permission notice shall be included in all
+ *  copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ *  SOFTWARE.
+ */
+
+package me.lucko.luckperms.bungee.event;
+
+import lombok.AllArgsConstructor;
+import lombok.EqualsAndHashCode;
+import lombok.Getter;
+import lombok.Setter;
+import lombok.ToString;
+
+import me.lucko.luckperms.api.Tristate;
+
+import net.md_5.bungee.api.CommandSender;
+import net.md_5.bungee.api.ProxyServer;
+import net.md_5.bungee.api.plugin.Event;
+
+/**
+ * Copy of the internal BungeeCord "PermissionCheckEvent", returning a tristate instead of a boolean.
+ */
+@Getter
+@AllArgsConstructor
+@EqualsAndHashCode(callSuper = false)
+@ToString
+public class TristateCheckEvent extends Event {
+    public static Tristate call(CommandSender sender, String permission) {
+        return ProxyServer.getInstance().getPluginManager().callEvent(new TristateCheckEvent(sender, permission)).getResult();
+    }
+
+    private final CommandSender sender;
+    private final String permission;
+
+    @Setter
+    private Tristate result;
+
+    public TristateCheckEvent(CommandSender sender, String permission) {
+        this(sender, permission, sender.getPermissions().contains(permission) ? Tristate.TRUE : Tristate.UNDEFINED);
+    }
+
+}

bungee/src/main/resources/config.yml

@@ -104,6 +104,15 @@ temporary-add-behaviour: deny
 #                           directly and indirectly
 primary-group-calculation: stored
 
+# If the plugin should check for "extra" permissions with users run LP commands.
+#
+# These extra permissions allow finer control over what users can do with each command, and
+# who they have access to edit.
+#
+# The permissions are *not* static, unlike the 'base' permisssions, and will depend upon the
+# arguments given within the command.
+argument-based-command-permissions: false
+
 
 
 

common/src/main/java/me/lucko/luckperms/common/commands/ArgumentPermissions.java

@@ -0,0 +1,222 @@
+/*
+ * This file is part of LuckPerms, licensed under the MIT License.
+ *
+ *  Copyright (c) lucko (Luck) <luck@lucko.me>
+ *  Copyright (c) contributors
+ *
+ *  Permission is hereby granted, free of charge, to any person obtaining a copy
+ *  of this software and associated documentation files (the "Software"), to deal
+ *  in the Software without restriction, including without limitation the rights
+ *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ *  copies of the Software, and to permit persons to whom the Software is
+ *  furnished to do so, subject to the following conditions:
+ *
+ *  The above copyright notice and this permission notice shall be included in all
+ *  copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ *  SOFTWARE.
+ */
+
+package me.lucko.luckperms.common.commands;
+
+import lombok.experimental.UtilityClass;
+
+import me.lucko.luckperms.api.Tristate;
+import me.lucko.luckperms.api.context.ContextSet;
+import me.lucko.luckperms.common.commands.sender.Sender;
+import me.lucko.luckperms.common.config.ConfigKeys;
+import me.lucko.luckperms.common.constants.Permission;
+import me.lucko.luckperms.common.core.model.Group;
+import me.lucko.luckperms.common.core.model.Track;
+import me.lucko.luckperms.common.core.model.User;
+import me.lucko.luckperms.common.plugin.LuckPermsPlugin;
+
+import java.util.Map;
+import java.util.function.BiFunction;
+import java.util.function.Function;
+
+@UtilityClass
+public class ArgumentPermissions {
+    private static final String USER_MODIFY_SELF = Permission.ROOT + "modify.user.self";
+    private static final String USER_MODIFY_OTHERS = Permission.ROOT + "modify.user.others";
+    private static final Function<String, String> GROUP_MODIFY = s -> Permission.ROOT + "modify.group." + s;
+    private static final Function<String, String> TRACK_MODIFY = s -> Permission.ROOT + "modify.track." + s;
+
+    private static final String USER_VIEW_SELF = Permission.ROOT + "view.user.self";
+    private static final String USER_VIEW_OTHERS = Permission.ROOT + "view.user.others";
+    private static final Function<String, String> GROUP_VIEW = s -> Permission.ROOT + "view.group." + s;
+    private static final Function<String, String> TRACK_VIEW = s -> Permission.ROOT + "view.track." + s;
+
+    private static final String CONTEXT_USE_GLOBAL = Permission.ROOT + "usecontext.global";
+    private static final BiFunction<String, String, String> CONTEXT_USE = (k, v) -> Permission.ROOT + "usecontext." + k + "." + v;
+
+    public static boolean checkArguments(LuckPermsPlugin plugin, Sender sender, Permission base, String... args) {
+        if (!plugin.getConfiguration().get(ConfigKeys.USE_ARGUMENT_BASED_COMMAND_PERMISSIONS)) {
+            return false;
+        }
+
+        if (args.length == 0) {
+            throw new IllegalStateException();
+        }
+
+        StringBuilder permission = new StringBuilder(base.getPrimaryPermission());
+        for (String arg : args) {
+            permission.append(".").append(arg);
+        }
+
+        return !sender.hasPermission(permission.toString());
+    }
+
+    public static boolean checkModifyPerms(LuckPermsPlugin plugin, Sender sender, Permission base, Object target) {
+        if (!plugin.getConfiguration().get(ConfigKeys.USE_ARGUMENT_BASED_COMMAND_PERMISSIONS)) {
+            return false;
+        }
+        
+        if (target instanceof User) {
+            User targetUser = ((User) target);
+            
+            if (plugin.getUuidCache().getExternalUUID(targetUser.getUuid()).equals(sender.getUuid())) {
+                // the sender is trying to edit themselves
+                Tristate ret = sender.getPermissionValue(base.getPrimaryPermission() + ".modify.self");
+                if (ret != Tristate.UNDEFINED) {
+                    return !ret.asBoolean();
+                } else {
+                    // fallback to the global perm if the one for the specific command is undefined
+                    Tristate globalRet = sender.getPermissionValue(USER_MODIFY_SELF);
+                    return !globalRet.asBoolean();
+                }
+            } else {
+                // they're trying to edit another user
+                Tristate ret = sender.getPermissionValue(base.getPrimaryPermission() + ".modify.others");
+                if (ret != Tristate.UNDEFINED) {
+                    return !ret.asBoolean();
+                } else {
+                    // fallback to the global perm if the one for the specific command is undefined
+                    Tristate globalRet = sender.getPermissionValue(USER_MODIFY_OTHERS);
+                    return !globalRet.asBoolean();
+                }
+            }
+        } else if (target instanceof Group) {
+            Group targetGroup = ((Group) target);
+
+            Tristate ret = sender.getPermissionValue(base.getPrimaryPermission() + ".modify." + targetGroup.getName());
+            if (ret != Tristate.UNDEFINED) {
+                return !ret.asBoolean();
+            } else {
+                // fallback to the global perm if the one for the specific command is undefined
+                Tristate globalRet = sender.getPermissionValue(GROUP_MODIFY.apply(targetGroup.getName()));
+                return !globalRet.asBoolean();
+            }
+        } else if (target instanceof Track) {
+            Track targetTrack = ((Track) target);
+
+            Tristate ret = sender.getPermissionValue(base.getPrimaryPermission() + ".modify." + targetTrack.getName());
+            if (ret != Tristate.UNDEFINED) {
+                return !ret.asBoolean();
+            } else {
+                // fallback to the global perm if the one for the specific command is undefined
+                Tristate globalRet = sender.getPermissionValue(TRACK_MODIFY.apply(targetTrack.getName()));
+                return !globalRet.asBoolean();
+            }
+        } else {
+            throw new IllegalStateException();
+        }
+    }
+
+    public static boolean checkViewPerms(LuckPermsPlugin plugin, Sender sender, Permission base, Object target) {
+        if (!plugin.getConfiguration().get(ConfigKeys.USE_ARGUMENT_BASED_COMMAND_PERMISSIONS)) {
+            return false;
+        }
+
+        if (target instanceof User) {
+            User targetUser = ((User) target);
+
+            if (plugin.getUuidCache().getExternalUUID(targetUser.getUuid()).equals(sender.getUuid())) {
+                // the sender is trying to view themselves
+                Tristate ret = sender.getPermissionValue(base.getPrimaryPermission() + ".view.self");
+                if (ret != Tristate.UNDEFINED) {
+                    return !ret.asBoolean();
+                } else {
+                    // fallback to the global perm if the one for the specific command is undefined
+                    Tristate globalRet = sender.getPermissionValue(USER_VIEW_SELF);
+                    return !globalRet.asBoolean();
+                }
+            } else {
+                // they're trying to view another user
+                Tristate ret = sender.getPermissionValue(base.getPrimaryPermission() + ".view.others");
+                if (ret != Tristate.UNDEFINED) {
+                    return !ret.asBoolean();
+                } else {
+                    // fallback to the global perm if the one for the specific command is undefined
+                    Tristate globalRet = sender.getPermissionValue(USER_VIEW_OTHERS);
+                    return !globalRet.asBoolean();
+                }
+            }
+        } else if (target instanceof Group) {
+            Group targetGroup = ((Group) target);
+
+            Tristate ret = sender.getPermissionValue(base.getPrimaryPermission() + ".view." + targetGroup.getName());
+            if (ret != Tristate.UNDEFINED) {
+                return !ret.asBoolean();
+            } else {
+                // fallback to the global perm if the one for the specific command is undefined
+                Tristate globalRet = sender.getPermissionValue(GROUP_VIEW.apply(targetGroup.getName()));
+                return !globalRet.asBoolean();
+            }
+        } else if (target instanceof Track) {
+            Track targetTrack = ((Track) target);
+
+            Tristate ret = sender.getPermissionValue(base.getPrimaryPermission() + ".view." + targetTrack.getName());
+            if (ret != Tristate.UNDEFINED) {
+                return !ret.asBoolean();
+            } else {
+                // fallback to the global perm if the one for the specific command is undefined
+                Tristate globalRet = sender.getPermissionValue(TRACK_VIEW.apply(targetTrack.getName()));
+                return !globalRet.asBoolean();
+            }
+        }
+
+        return false;
+    }
+
+    public static boolean checkContext(LuckPermsPlugin plugin, Sender sender, Permission base, ContextSet contextSet) {
+        if (!plugin.getConfiguration().get(ConfigKeys.USE_ARGUMENT_BASED_COMMAND_PERMISSIONS)) {
+            return false;
+        }
+
+        if (contextSet.isEmpty()) {
+            Tristate ret = sender.getPermissionValue(base.getPrimaryPermission() + ".usecontext.global");
+            if (ret != Tristate.UNDEFINED) {
+                return !ret.asBoolean();
+            } else {
+                // fallback to the global perm if the one for the specific command is undefined
+                Tristate globalRet = sender.getPermissionValue(CONTEXT_USE_GLOBAL);
+                return !globalRet.asBoolean();
+            }
+        }
+
+        for (Map.Entry<String, String> context : contextSet.toSet()) {
+            Tristate ret = sender.getPermissionValue(base.getPrimaryPermission() + ".usecontext." + context.getKey() + "." + context.getValue());
+            if (ret != Tristate.UNDEFINED) {
+                if (ret == Tristate.FALSE) {
+                    return true;
+                }
+            } else {
+                // fallback to the global perm if the one for the specific command is undefined
+                Tristate globalRet = sender.getPermissionValue(CONTEXT_USE.apply(context.getKey(), context.getValue()));
+                if (globalRet == Tristate.FALSE) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+    
+}

common/src/main/java/me/lucko/luckperms/common/commands/CommandManager.java

@@ -253,7 +253,7 @@ public class CommandManager {
                 .filter(c -> c.isAuthorized(sender))
                 .forEach(c -> {
                     @SuppressWarnings("unchecked")
-                    String permission = (String) c.getPermission().map(p -> ((Permission) p).getExample()).orElse("None");
+                    String permission = (String) c.getPermission().map(p -> ((Permission) p).getPrimaryPermission()).orElse("None");
 
                     Component component = ComponentSerializer.parseFromLegacy("&3> &a" + String.format(c.getUsage(), label), Constants.FORMAT_CHAR)
                             .applyRecursively(comp -> {

common/src/main/java/me/lucko/luckperms/common/commands/abstraction/MainCommand.java

@@ -174,7 +174,7 @@ public abstract class MainCommand<T> extends Command<Void, T> {
 
     @Override
     public boolean isAuthorized(Sender sender) {
-        return getChildren().get().stream().filter(sc -> sc.isAuthorized(sender)).count() != 0;
+        return getChildren().get().stream().anyMatch(sc -> sc.isAuthorized(sender));
     }
 
     @Override

common/src/main/java/me/lucko/luckperms/common/commands/abstraction/SharedMainCommand.java

@@ -97,7 +97,7 @@ public class SharedMainCommand<T extends PermissionHolder> extends SubCommand<T>
 
         CommandResult result;
         try {
-            result = sub.execute(plugin, sender, t, strippedArgs, label);
+            result = sub.execute(plugin, sender, t, strippedArgs, label, user ? sub.getUserPermission() : sub.getGroupPermission());
         } catch (CommandException e) {
             result = handleException(e, sender, sub);
         }
@@ -137,7 +137,7 @@ public class SharedMainCommand<T extends PermissionHolder> extends SubCommand<T>
 
     @Override
     public boolean isAuthorized(Sender sender) {
-        return secondaryCommands.stream().filter(sc -> sc.isAuthorized(sender, user)).count() != 0;
+        return secondaryCommands.stream().anyMatch(sc -> sc.isAuthorized(sender, user));
     }
 
     private void sendUsageDetailed(Sender sender, boolean user, String label) {

common/src/main/java/me/lucko/luckperms/common/commands/abstraction/SharedSubCommand.java

@@ -76,7 +76,7 @@ public abstract class SharedSubCommand {
         this.argumentCheck = argumentCheck;
     }
 
-    public abstract CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException;
+    public abstract CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException;
 
     public List<String> onTabComplete(LuckPermsPlugin plugin, Sender sender, List<String> args) {
         return Collections.emptyList();

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/meta/MetaAddChatMeta.java

@@ -28,6 +28,7 @@ package me.lucko.luckperms.common.commands.impl.generic.meta;
 import me.lucko.luckperms.api.ChatMetaType;
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -62,11 +63,21 @@ public class MetaAddChatMeta extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         int priority = ArgumentUtils.handlePriority(0, args);
         String meta = ArgumentUtils.handleString(1, args);
         MutableContextSet context = ArgumentUtils.handleContext(2, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         DataMutateResult result = holder.setPermission(NodeFactory.makeChatMetaNode(type, priority, meta).withExtraContext(context).build());
         if (result.asBoolean()) {
             Message.ADD_CHATMETA_SUCCESS.send(sender, holder.getFriendlyName(), type.name().toLowerCase(), meta, priority, Util.contextSetToString(context));

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/meta/MetaAddTempChatMeta.java

@@ -29,6 +29,7 @@ import me.lucko.luckperms.api.ChatMetaType;
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.Node;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -67,13 +68,23 @@ public class MetaAddTempChatMeta extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         int priority = ArgumentUtils.handlePriority(0, args);
         String meta = ArgumentUtils.handleString(1, args);
         long duration = ArgumentUtils.handleDuration(2, args);
         MutableContextSet context = ArgumentUtils.handleContext(3, args, plugin);
         TemporaryModifier modifier = plugin.getConfiguration().get(ConfigKeys.TEMPORARY_ADD_BEHAVIOUR);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         Map.Entry<DataMutateResult, Node> ret = holder.setPermission(NodeFactory.makeChatMetaNode(type, priority, meta).setExpiry(duration).withExtraContext(context).build(), modifier);
 
         if (ret.getKey().asBoolean()) {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/meta/MetaClear.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.meta;
 
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -50,11 +51,21 @@ public class MetaClear extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         int before = holder.getNodes().size();
 
         MutableContextSet context = ArgumentUtils.handleContext(0, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         if (context.isEmpty()) {
             holder.clearMeta();
         } else {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/meta/MetaInfo.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.meta;
 
 import me.lucko.luckperms.api.LocalizedNode;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -62,7 +63,12 @@ public class MetaInfo extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         SortedSet<Map.Entry<Integer, LocalizedNode>> prefixes = new TreeSet<>(MetaComparator.INSTANCE.reversed());
         SortedSet<Map.Entry<Integer, LocalizedNode>> suffixes = new TreeSet<>(MetaComparator.INSTANCE.reversed());
         Set<LocalizedNode> meta = new HashSet<>();

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/meta/MetaRemoveChatMeta.java

@@ -28,6 +28,7 @@ package me.lucko.luckperms.common.commands.impl.generic.meta;
 import me.lucko.luckperms.api.ChatMetaType;
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -62,11 +63,21 @@ public class MetaRemoveChatMeta extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         int priority = ArgumentUtils.handlePriority(0, args);
         String meta = ArgumentUtils.handleStringOrElse(1, args, "null");
         MutableContextSet context = ArgumentUtils.handleContext(2, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         // Handle bulk removal
         if (meta.equalsIgnoreCase("null") || meta.equals("*")) {
             holder.removeIf(n ->

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/meta/MetaRemoveTempChatMeta.java

@@ -28,6 +28,7 @@ package me.lucko.luckperms.common.commands.impl.generic.meta;
 import me.lucko.luckperms.api.ChatMetaType;
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -62,11 +63,21 @@ public class MetaRemoveTempChatMeta extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         int priority = ArgumentUtils.handlePriority(0, args);
         String meta = ArgumentUtils.handleStringOrElse(1, args, "null");
         MutableContextSet context = ArgumentUtils.handleContext(2, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         // Handle bulk removal
         if (meta.equalsIgnoreCase("null") || meta.equals("*")) {
             holder.removeIf(n ->

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/meta/MetaSet.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.generic.meta;
 
 import me.lucko.luckperms.api.Node;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -52,11 +53,26 @@ public class MetaSet extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String key = args.get(0);
         String value = args.get(1);
         MutableContextSet context = ArgumentUtils.handleContext(2, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, key)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         Node n = NodeFactory.makeMetaNode(key, value).withExtraContext(context).build();
 
         if (holder.hasPermission(n).asBoolean()) {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/meta/MetaSetTemp.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.generic.meta;
 
 import me.lucko.luckperms.api.Node;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -55,13 +56,28 @@ public class MetaSetTemp extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String key = args.get(0);
         String value = args.get(1);
         long duration = ArgumentUtils.handleDuration(2, args);
         MutableContextSet context = ArgumentUtils.handleContext(2, args, plugin);
         TemporaryModifier modifier = plugin.getConfiguration().get(ConfigKeys.TEMPORARY_ADD_BEHAVIOUR);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, key)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         Node n = NodeFactory.makeMetaNode(key, value).withExtraContext(context).setExpiry(duration).build();
 
         if (holder.hasPermission(n).asBoolean()) {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/meta/MetaUnset.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.meta;
 
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -50,10 +51,25 @@ public class MetaUnset extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String key = args.get(0);
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, key)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         holder.clearMetaKeys(key, context, false);
         Message.UNSET_META_SUCCESS.send(sender, key, holder.getFriendlyName(), Util.contextSetToString(context));
 

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/meta/MetaUnsetTemp.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.meta;
 
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -50,10 +51,25 @@ public class MetaUnsetTemp extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String key = args.get(0);
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, key)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         holder.clearMetaKeys(key, context, true);
         Message.UNSET_META_TEMP_SUCCESS.send(sender, key, holder.getFriendlyName(), Util.contextSetToString(context));
 

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/other/HolderClear.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.other;
 
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -53,10 +54,20 @@ public class HolderClear<T extends PermissionHolder> extends SubCommand<T> {
 
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, T holder, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, getPermission().get(), holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         int before = holder.getNodes().size();
 
         MutableContextSet context = ArgumentUtils.handleContext(0, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, getPermission().get(), context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         if (context.isEmpty()) {
             holder.clearNodes();
         } else {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/other/HolderEditor.java

@@ -32,6 +32,7 @@ import com.google.gson.JsonArray;
 import com.google.gson.JsonObject;
 import com.google.gson.stream.JsonWriter;
 
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -76,6 +77,11 @@ public class HolderEditor<T extends PermissionHolder> extends SubCommand<T> {
 
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, T holder, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, getPermission().get(), holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         JsonObject data = new JsonObject();
         Set<NodeModel> nodes = holder.getNodes().values().stream().map(NodeModel::fromNode).collect(Collectors.toCollection(LinkedHashSet::new));
         data.add("nodes", serializePermissions(nodes));

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/other/HolderShowTracks.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.other;
 
 import me.lucko.luckperms.api.Node;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -50,6 +51,11 @@ public class HolderShowTracks<T extends PermissionHolder> extends SubCommand<T>
 
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, T holder, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, getPermission().get(), holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         if (!plugin.getStorage().loadAllTracks().join()) {
             Message.TRACKS_LOAD_ERROR.send(sender);
             return CommandResult.LOADING_ERROR;

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/parent/ParentAdd.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.generic.parent;
 
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -54,7 +55,12 @@ public class ParentAdd extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String groupName = ArgumentUtils.handleName(0, args);
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 
@@ -69,6 +75,16 @@ public class ParentAdd extends SharedSubCommand {
             return CommandResult.LOADING_ERROR;
         }
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, group.getName())) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         DataMutateResult result = holder.setInheritGroup(group, context);
 
         if (result.asBoolean()) {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/parent/ParentAddTemp.java

@@ -28,6 +28,7 @@ package me.lucko.luckperms.common.commands.impl.generic.parent;
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.Node;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -60,7 +61,12 @@ public class ParentAddTemp extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String groupName = ArgumentUtils.handleName(0, args);
         long duration = ArgumentUtils.handleDuration(1, args);
         MutableContextSet context = ArgumentUtils.handleContext(2, args, plugin);
@@ -77,6 +83,16 @@ public class ParentAddTemp extends SharedSubCommand {
             return CommandResult.INVALID_ARGS;
         }
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, group.getName())) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         if (group.getName().equalsIgnoreCase(holder.getObjectName())) {
             Message.ALREADY_TEMP_INHERITS.send(sender, holder.getFriendlyName(), group.getDisplayName());
             return CommandResult.STATE_ERROR;

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/parent/ParentClear.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.parent;
 
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -50,11 +51,21 @@ public class ParentClear extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         int before = holder.getNodes().size();
 
         MutableContextSet context = ArgumentUtils.handleContext(0, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         if (context.isEmpty()) {
             holder.clearParents(true);
         } else {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/parent/ParentClearTrack.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.parent;
 
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -55,7 +56,12 @@ public class ParentClearTrack extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         final String trackName = args.get(0).toLowerCase();
         if (!DataConstraints.TRACK_NAME_TEST.test(trackName)) {
             Message.TRACK_INVALID_ENTRY.send(sender);
@@ -81,6 +87,17 @@ public class ParentClearTrack extends SharedSubCommand {
         int before = holder.getNodes().size();
 
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
+
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, track.getName())) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         if (context.isEmpty()) {
             holder.removeIf(node -> node.isGroupNode() && track.containsGroup(node.getGroupName()));
         } else {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/parent/ParentInfo.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.generic.parent;
 
 import me.lucko.luckperms.api.LocalizedNode;
 import me.lucko.luckperms.api.Node;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -50,7 +51,12 @@ public class ParentInfo extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         Message.LISTPARENTS.send(sender, holder.getFriendlyName(), permGroupsToString(holder.mergePermissionsToSortedSet()));
         Message.LISTPARENTS_TEMP.send(sender, holder.getFriendlyName(), tempGroupsToString(holder.mergePermissionsToSortedSet()));
         return CommandResult.SUCCESS;

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/parent/ParentRemove.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.generic.parent;
 
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -56,10 +57,25 @@ public class ParentRemove extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String groupName = ArgumentUtils.handleNameWithSpace(0, args);
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, groupName)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         if (holder instanceof User) {
             User user = (User) holder;
 

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/parent/ParentRemoveTemp.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.generic.parent;
 
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -54,10 +55,25 @@ public class ParentRemoveTemp extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String groupName = ArgumentUtils.handleNameWithSpace(0, args);
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, groupName)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         DataMutateResult result = holder.unsetPermission(NodeFactory.newBuilder("group." + groupName).setExpiry(10L).withExtraContext(context).build());
 
         if (result.asBoolean()) {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/parent/ParentSet.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.parent;
 
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -54,7 +55,12 @@ public class ParentSet extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String groupName = ArgumentUtils.handleName(0, args);
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 
@@ -69,6 +75,16 @@ public class ParentSet extends SharedSubCommand {
             return CommandResult.LOADING_ERROR;
         }
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, group.getName())) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         holder.clearParents(context, false);
         holder.setInheritGroup(group, context);
         if (holder instanceof User) {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/parent/ParentSetTrack.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.parent;
 
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -56,7 +57,12 @@ public class ParentSetTrack extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         final String trackName = args.get(0).toLowerCase();
         if (!DataConstraints.TRACK_NAME_TEST.test(trackName)) {
             Message.TRACK_INVALID_ENTRY.send(sender);
@@ -109,6 +115,16 @@ public class ParentSetTrack extends SharedSubCommand {
             return CommandResult.LOADING_ERROR;
         }
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, track.getName(), group.getName())) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         holder.removeIf(node -> node.isGroupNode() && node.getFullContexts().equals(context) && track.containsGroup(node.getGroupName()));
         holder.setInheritGroup(group, context);
 

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/permission/PermissionCheck.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.generic.permission;
 
 import me.lucko.luckperms.api.Tristate;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -52,7 +53,12 @@ public class PermissionCheck extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String node = ArgumentUtils.handleString(0, args);
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/permission/PermissionCheckInherits.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.generic.permission;
 
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -52,7 +53,12 @@ public class PermissionCheckInherits extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String node = ArgumentUtils.handleString(0, args);
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/permission/PermissionInfo.java

@@ -29,6 +29,7 @@ import com.google.common.collect.Maps;
 
 import me.lucko.luckperms.api.LocalizedNode;
 import me.lucko.luckperms.api.Node;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -66,7 +67,12 @@ public class PermissionInfo extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String filter = null;
         if (args.size() == 1) {
             // it might be a filter, if it's a number, then it relates to a page.

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/permission/PermissionSet.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.generic.permission;
 
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -55,11 +56,26 @@ public class PermissionSet extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         boolean b = ArgumentUtils.handleBoolean(1, args);
         String node = b ? ArgumentUtils.handleNode(0, args) : ArgumentUtils.handleString(0, args);
         MutableContextSet context = ArgumentUtils.handleContext(2, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, node)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         DataMutateResult result = holder.setPermission(NodeFactory.newBuilder(node).setValue(b).withExtraContext(context).build());
 
         if (result.asBoolean()) {

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/permission/PermissionSetTemp.java

@@ -28,6 +28,7 @@ package me.lucko.luckperms.common.commands.impl.generic.permission;
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.Node;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -60,12 +61,27 @@ public class PermissionSetTemp extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         boolean b = ArgumentUtils.handleBoolean(1, args);
         String node = b ? ArgumentUtils.handleNode(0, args) : ArgumentUtils.handleString(0, args);
         long duration = ArgumentUtils.handleDuration(2, args);
         MutableContextSet context = ArgumentUtils.handleContext(3, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, node)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         TemporaryModifier modifier = plugin.getConfiguration().get(ConfigKeys.TEMPORARY_ADD_BEHAVIOUR);
         Map.Entry<DataMutateResult, Node> result = holder.setPermission(NodeFactory.newBuilder(node).setValue(b).withExtraContext(context).setExpiry(duration).build(), modifier);
 

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/permission/PermissionUnset.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.generic.permission;
 
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -54,10 +55,25 @@ public class PermissionUnset extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String node = ArgumentUtils.handleString(0, args);
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, node)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         DataMutateResult result;
         if (node.startsWith("group.")) {
             // unset exact - with false value only

common/src/main/java/me/lucko/luckperms/common/commands/impl/generic/permission/PermissionUnsetTemp.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.generic.permission;
 
 import me.lucko.luckperms.api.DataMutateResult;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -54,10 +55,25 @@ public class PermissionUnsetTemp extends SharedSubCommand {
     }
 
     @Override
-    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label) throws CommandException {
+    public CommandResult execute(LuckPermsPlugin plugin, Sender sender, PermissionHolder holder, List<String> args, String label, Permission permission) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, permission, holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String node = ArgumentUtils.handleString(0, args);
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, permission, context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
+        if (ArgumentPermissions.checkArguments(plugin, sender, permission, node)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         DataMutateResult result = holder.unsetPermission(NodeFactory.newBuilder(node).setExpiry(10L).withExtraContext(context).build());
 
         if (result.asBoolean()) {

common/src/main/java/me/lucko/luckperms/common/commands/impl/group/GroupClone.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.group;
 
 import me.lucko.luckperms.api.event.cause.CreationCause;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -49,6 +50,11 @@ public class GroupClone extends SubCommand<Group> {
 
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, Group group, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, getPermission().get(), group)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String newGroupName = args.get(0).toLowerCase();
         if (!DataConstraints.GROUP_NAME_TEST.test(newGroupName)) {
             Message.GROUP_INVALID_ENTRY.send(sender);
@@ -63,6 +69,11 @@ public class GroupClone extends SubCommand<Group> {
             return CommandResult.LOADING_ERROR;
         }
 
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, getPermission().get(), newGroup)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         newGroup.replaceNodes(group.getNodes());
 
         Message.CLONE_SUCCESS.send(sender, group.getName(), newGroup.getName());

common/src/main/java/me/lucko/luckperms/common/commands/impl/group/GroupInfo.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.group;
 
 import me.lucko.luckperms.api.Node;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -51,6 +52,11 @@ public class GroupInfo extends SubCommand<Group> {
 
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, Group group, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, getPermission().get(), group)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         Message.GROUP_INFO_GENERAL.send(sender,
                 group.getId(),
                 group.getDisplayName(),

common/src/main/java/me/lucko/luckperms/common/commands/impl/group/GroupListMembers.java

@@ -29,6 +29,7 @@ import com.google.common.collect.Maps;
 
 import me.lucko.luckperms.api.HeldPermission;
 import me.lucko.luckperms.api.Node;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -70,6 +71,11 @@ public class GroupListMembers extends SubCommand<Group> {
 
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, Group group, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, getPermission().get(), group)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String query = "group." + group.getName();
         int page = ArgumentUtils.handleIntOrElse(0, args, 1);
 

common/src/main/java/me/lucko/luckperms/common/commands/impl/group/GroupSetWeight.java

@@ -25,6 +25,7 @@
 
 package me.lucko.luckperms.common.commands.impl.group;
 
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -48,6 +49,11 @@ public class GroupSetWeight extends SubCommand<Group> {
 
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, Group group, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, getPermission().get(), group)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         int weight = ArgumentUtils.handlePriority(0, args);
 
         group.removeIf(n -> n.getPermission().startsWith("weight."));

common/src/main/java/me/lucko/luckperms/common/commands/impl/misc/ApplyEditsCommand.java

@@ -32,6 +32,7 @@ import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
 
 import me.lucko.luckperms.api.context.ImmutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SharedSubCommand;
@@ -134,6 +135,11 @@ public class ApplyEditsCommand extends SingleCommand {
             return CommandResult.STATE_ERROR;
         }
 
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, getPermission().get(), holder)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         Set<NodeModel> nodes = deserializePermissions(data.getAsJsonArray("nodes"));
         holder.setNodes(nodes.stream().map(NodeModel::toNode).collect(Collectors.toSet()));
         Message.APPLY_EDITS_SUCCESS.send(sender, nodes.size(), holder.getFriendlyName());

common/src/main/java/me/lucko/luckperms/common/commands/impl/user/UserDemote.java

@@ -25,8 +25,11 @@
 
 package me.lucko.luckperms.common.commands.impl.user;
 
+import com.google.common.collect.Iterables;
+
 import me.lucko.luckperms.api.Node;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -58,6 +61,11 @@ public class UserDemote extends SubCommand<User> {
 
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, User user, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, getPermission().get(), user)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         final String trackName = args.get(0).toLowerCase();
         if (!DataConstraints.TRACK_NAME_TEST.test(trackName)) {
             Message.TRACK_INVALID_ENTRY.send(sender);
@@ -83,6 +91,11 @@ public class UserDemote extends SubCommand<User> {
         boolean silent = args.remove("-s");
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, getPermission().get(), context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         // Load applicable groups
         Set<Node> nodes = user.getNodes().values().stream()
                 .filter(Node::isGroupNode)
@@ -102,7 +115,7 @@ public class UserDemote extends SubCommand<User> {
             return CommandResult.FAILURE;
         }
 
-        final Node oldNode = nodes.stream().findAny().get();
+        final Node oldNode = Iterables.getFirst(nodes, null);
         final String old = oldNode.getGroupName();
         final String previous;
         try {
@@ -112,6 +125,11 @@ public class UserDemote extends SubCommand<User> {
             return CommandResult.STATE_ERROR;
         }
 
+        if (ArgumentPermissions.checkArguments(plugin, sender, getPermission().get(), track.getName(), oldNode.getGroupName())) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         if (previous == null) {
 
             user.unsetPermission(oldNode);

common/src/main/java/me/lucko/luckperms/common/commands/impl/user/UserInfo.java

@@ -28,6 +28,7 @@ package me.lucko.luckperms.common.commands.impl.user;
 import me.lucko.luckperms.api.Contexts;
 import me.lucko.luckperms.api.Node;
 import me.lucko.luckperms.api.caching.MetaData;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -54,6 +55,11 @@ public class UserInfo extends SubCommand<User> {
     @SuppressWarnings("unchecked")
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, User user, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkViewPerms(plugin, sender, getPermission().get(), user)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         Message.USER_INFO_GENERAL.send(sender,
                 user.getName().orElse("Unknown"),
                 user.getUuid(),

common/src/main/java/me/lucko/luckperms/common/commands/impl/user/UserPromote.java

@@ -27,6 +27,7 @@ package me.lucko.luckperms.common.commands.impl.user;
 
 import me.lucko.luckperms.api.Node;
 import me.lucko.luckperms.api.context.MutableContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -58,6 +59,11 @@ public class UserPromote extends SubCommand<User> {
 
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, User user, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, getPermission().get(), user)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         final String trackName = args.get(0).toLowerCase();
         if (!DataConstraints.TRACK_NAME_TEST.test(trackName)) {
             Message.TRACK_INVALID_ENTRY.send(sender);
@@ -83,6 +89,11 @@ public class UserPromote extends SubCommand<User> {
         boolean silent = args.remove("-s");
         MutableContextSet context = ArgumentUtils.handleContext(1, args, plugin);
 
+        if (ArgumentPermissions.checkContext(plugin, sender, getPermission().get(), context)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         // Load applicable groups
         Set<Node> nodes = user.getNodes().values().stream()
                 .filter(Node::isGroupNode)
@@ -101,6 +112,11 @@ public class UserPromote extends SubCommand<User> {
                 return CommandResult.LOADING_ERROR;
             }
 
+            if (ArgumentPermissions.checkArguments(plugin, sender, getPermission().get(), track.getName(), nextGroup.getName())) {
+                Message.COMMAND_NO_PERMISSION.send(sender);
+                return CommandResult.NO_PERMISSION;
+            }
+
             user.setPermission(NodeFactory.newBuilder("group." + first).withExtraContext(context).build());
 
             Message.USER_TRACK_ADDED_TO_FIRST.send(sender, user.getFriendlyName(), first, Util.contextSetToString(context));
@@ -143,6 +159,11 @@ public class UserPromote extends SubCommand<User> {
             return CommandResult.LOADING_ERROR;
         }
 
+        if (ArgumentPermissions.checkArguments(plugin, sender, getPermission().get(), track.getName(), nextGroup.getName())) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         user.unsetPermission(oldNode);
         user.setPermission(NodeFactory.newBuilder("group." + nextGroup.getName()).withExtraContext(context).build());
 

common/src/main/java/me/lucko/luckperms/common/commands/impl/user/UserSwitchPrimaryGroup.java

@@ -26,6 +26,7 @@
 package me.lucko.luckperms.common.commands.impl.user;
 
 import me.lucko.luckperms.api.context.ContextSet;
+import me.lucko.luckperms.common.commands.ArgumentPermissions;
 import me.lucko.luckperms.common.commands.CommandException;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.abstraction.SubCommand;
@@ -50,6 +51,11 @@ public class UserSwitchPrimaryGroup extends SubCommand<User> {
 
     @Override
     public CommandResult execute(LuckPermsPlugin plugin, Sender sender, User user, List<String> args, String label) throws CommandException {
+        if (ArgumentPermissions.checkModifyPerms(plugin, sender, getPermission().get(), user)) {
+            Message.COMMAND_NO_PERMISSION.send(sender);
+            return CommandResult.NO_PERMISSION;
+        }
+
         String opt = plugin.getConfiguration().get(ConfigKeys.PRIMARY_GROUP_CALCULATION_METHOD);
         if (!opt.equals("stored")) {
             Message.USER_PRIMARYGROUP_WARN_OPTION.send(sender, opt);

common/src/main/java/me/lucko/luckperms/common/commands/sender/AbstractSender.java

@@ -30,6 +30,7 @@ import lombok.Getter;
 
 import com.google.common.base.Splitter;
 
+import me.lucko.luckperms.api.Tristate;
 import me.lucko.luckperms.common.constants.Constants;
 import me.lucko.luckperms.common.constants.Permission;
 import me.lucko.luckperms.common.plugin.LuckPermsPlugin;
@@ -94,6 +95,32 @@ public final class AbstractSender<T> implements Sender {
         }
     }
 
+    @Override
+    public Tristate getPermissionValue(String permission) {
+        if (isConsole()) return Tristate.TRUE;
+
+        T t = ref.get();
+        if (t != null) {
+            return factory.getPermissionValue(t, permission);
+        }
+
+        return Tristate.UNDEFINED;
+    }
+
+    @Override
+    public boolean hasPermission(String permission) {
+        if (isConsole()) return true;
+
+        T t = ref.get();
+        if (t != null) {
+            if (factory.hasPermission(t, permission)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     @Override
     public boolean hasPermission(Permission permission) {
         if (isConsole()) return true;

common/src/main/java/me/lucko/luckperms/common/commands/sender/Sender.java

@@ -25,6 +25,7 @@
 
 package me.lucko.luckperms.common.commands.sender;
 
+import me.lucko.luckperms.api.Tristate;
 import me.lucko.luckperms.common.constants.Constants;
 import me.lucko.luckperms.common.constants.Permission;
 import me.lucko.luckperms.common.plugin.LuckPermsPlugin;
@@ -73,6 +74,22 @@ public interface Sender {
      */
     void sendMessage(Component message);
 
+    /**
+     * Gets the tristate a permission is set to.
+     *
+     * @param permission the permission to check for
+     * @return a tristate
+     */
+    Tristate getPermissionValue(String permission);
+
+    /**
+     * Check if the Sender has a permission.
+     *
+     * @param permission the permission to check for
+     * @return true if the sender has the permission
+     */
+    boolean hasPermission(String permission);
+
     /**
      * Check if the Sender has a permission.
      *

common/src/main/java/me/lucko/luckperms/common/commands/sender/SenderFactory.java

@@ -29,6 +29,7 @@ import lombok.AccessLevel;
 import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 
+import me.lucko.luckperms.api.Tristate;
 import me.lucko.luckperms.common.plugin.LuckPermsPlugin;
 
 import net.kyori.text.Component;
@@ -54,6 +55,8 @@ public abstract class SenderFactory<T> {
 
     protected abstract void sendMessage(T t, Component message);
 
+    protected abstract Tristate getPermissionValue(T t, String node);
+
     protected abstract boolean hasPermission(T t, String node);
 
     public final Sender wrap(T t) {

common/src/main/java/me/lucko/luckperms/common/config/ConfigKeys.java

@@ -160,6 +160,11 @@ public class ConfigKeys {
         }
     }));
 
+    /**
+     * If the plugin should check for "extra" permissions with users run LP commands
+     */
+    public static final ConfigKey<Boolean> USE_ARGUMENT_BASED_COMMAND_PERMISSIONS = BooleanKey.of("argument-based-command-permissions", false);
+
     /**
      * If wildcards are being applied
      */

common/src/main/java/me/lucko/luckperms/common/constants/Permission.java

@@ -28,6 +28,8 @@ package me.lucko.luckperms.common.constants;
 import lombok.AllArgsConstructor;
 import lombok.Getter;
 
+import com.google.common.base.Preconditions;
+
 import me.lucko.luckperms.common.commands.sender.Sender;
 import me.lucko.luckperms.common.utils.ImmutableCollectors;
 
@@ -163,7 +165,7 @@ public enum Permission {
     SPONGE_OPTION_UNSET(list("option.unset"), Type.SPONGE),
     SPONGE_OPTION_CLEAR(list("option.clear"), Type.SPONGE);
 
-    private static final String IDENTIFIER = "luckperms.";
+    public static final String ROOT = "luckperms.";
 
     private static List<String> list(String... args) {
         return Arrays.asList(args);
@@ -174,15 +176,16 @@ public enum Permission {
 
     Permission(List<String> tags, Type type) {
         this.type = type;
+        Preconditions.checkArgument(tags != null && !tags.isEmpty());
 
         if (type == Type.NONE) {
-            this.nodes = tags.stream().map(t -> IDENTIFIER + t).collect(ImmutableCollectors.toImmutableList());
+            this.nodes = tags.stream().map(t -> ROOT + t).collect(ImmutableCollectors.toImmutableList());
         } else {
-            this.nodes = tags.stream().map(t -> IDENTIFIER + type.getTag() + "." + t).collect(ImmutableCollectors.toImmutableList());
+            this.nodes = tags.stream().map(t -> ROOT + type.getTag() + "." + t).collect(ImmutableCollectors.toImmutableList());
         }
     }
 
-    public String getExample() {
+    public String getPrimaryPermission() {
         return nodes.get(0);
     }
 

common/src/main/java/me/lucko/luckperms/common/data/Importer.java

@@ -32,6 +32,7 @@ import lombok.Setter;
 import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableSet;
 
+import me.lucko.luckperms.api.Tristate;
 import me.lucko.luckperms.common.commands.CommandManager;
 import me.lucko.luckperms.common.commands.CommandResult;
 import me.lucko.luckperms.common.commands.sender.Sender;
@@ -208,6 +209,16 @@ public class Importer implements Runnable {
             logMessage(ComponentSerializer.toLegacy(message, Constants.COLOR_CHAR));
         }
 
+        @Override
+        public Tristate getPermissionValue(String permission) {
+            return Tristate.TRUE;
+        }
+
+        @Override
+        public boolean hasPermission(String permission) {
+            return true;
+        }
+
         @Override
         public boolean hasPermission(Permission permission) {
             return true;

sponge/src/main/java/me/lucko/luckperms/sponge/SpongeSenderFactory.java

@@ -25,9 +25,11 @@
 
 package me.lucko.luckperms.sponge;
 
+import me.lucko.luckperms.api.Tristate;
 import me.lucko.luckperms.common.commands.sender.SenderFactory;
 import me.lucko.luckperms.common.constants.Constants;
 import me.lucko.luckperms.common.plugin.LuckPermsPlugin;
+import me.lucko.luckperms.sponge.service.model.CompatibilityUtil;
 
 import net.kyori.text.Component;
 import net.kyori.text.serializer.ComponentSerializer;
@@ -74,6 +76,11 @@ public class SpongeSenderFactory extends SenderFactory<CommandSource> {
         }
     }
 
+    @Override
+    protected Tristate getPermissionValue(CommandSource source, String node) {
+        return CompatibilityUtil.convertTristate(source.getPermissionValue(source.getActiveContexts(), node));
+    }
+
     @Override
     protected boolean hasPermission(CommandSource source, String node) {
         return source.hasPermission(node);

sponge/src/main/resources/luckperms.conf

@@ -102,6 +102,15 @@ temporary-add-behaviour="deny"
 #                           directly and indirectly
 primary-group-calculation="parents-by-weight"
 
+# If the plugin should check for "extra" permissions with users run LP commands.
+#
+# These extra permissions allow finer control over what users can do with each command, and
+# who they have access to edit.
+#
+# The permissions are *not* static, unlike the 'base' permisssions, and will depend upon the
+# arguments given within the command.
+argument-based-command-permissions=false
+