Jixryo Admin

Jixryo Admin is the resource jixryo_admin, version 0.3.1. It is the staff panel: sheets over the game with a type-to-run search over them. Staff and roles live in SQL and are edited in game; a role's permissions also hand out ACE groups, so qbx_core and every Jixryo script follow it. The owner is set in server.cfg. Every action is checked again on the server before it runs (the permission, rank, the arguments, the rate) and logged.

This is phase 3. On top of phase 2's core (players, reports, messages, bans, staff and roles, logs) it adds your own tools (noclip, names above heads, god mode, invisible, player blips, the duty tag, spectate), the live map, vehicles, objects with the gizmo, the Server page (weather, time and the restart countdown, run by the panel itself), the Resources page, the coords tool and the quick layer (the search on its own key, the player card pinned in the world, the Staff slice in the radial). Still to come, each needing another resource or a config line changed: the Crime page's hook into Jixryo Criminal (it shows as "next update"), the Clothing action's hook into Jixryo Clothing, moving the other suite resources' staff tools under these permissions, a Refresh button on the Resources page, and removing qbx_adminmenu.

#What players get

• /report: a window to report a player (an ID or a name), being stuck, a question, or something else. /report some words opens it with those words already in the box (up to 500 characters). Staff answers come back into it and as a notice. One open report at a time, and 60 seconds between reports.
• Staff messages: a card on screen for 30 seconds. /reply some words answers straight away; /reply alone brings the card back with an answer field. An answer is only possible within a day of a staff message.
• Warnings: a box they must hold E (or the mouse) to acknowledge. Until they do, it shows again when they next load in.
• Announcements across the top for 12 seconds, the restart countdown top right with its reason, and the tag "STAFF · ROLE" over on-duty staff within 25 m and in sight.
• The same sky for everyone: weather, clock and blackout, applied once their character is in the city (character selection keeps its own sky).

#What staff get

The panel. F10 or /admin, for anyone with panel.open. Every key is only a default: each staff member can change it in Settings, Key Bindings, FiveM. Ctrl+K searches players and commands; Esc closes.

The actions (each needs its permission; red ones hurt or remove): Bring, Go to, Send back, Spectate, Freeze, Teleport (waypoint, saved place, coordinates or a map point), World (routing bucket 0 to 63); Revive, Heal (qbx_medical), Kill; Inventory, Give item, Money (always with a reason), Job or gang and grade; Message, Screenshot (screencapture), Mute, Jail (Jixryo Prison), Cuff (Jixryo Police), Add note; Warn, Kick, Ban; Set on fire, Slap, Ragdoll, Launch; To my waypoint, Revive myself, Noclip, Names above heads, God mode, Invisible, Player blips; Fix, Clean, Fill the tank (Jixryo Fuel or ox_fuel), Delete, Clear empty vehicles; Delete laser, Clear area; Coords tool; Announcement. Actions whose resource is not running are not offered.

Your own tools need duty: switching one on puts you on duty, going off duty switches them all off, and the server switches each one and logs it.

Duty. Click your name at the bottom of the rail. On duty, new reports reach you and the tag shows over your head.

#Install

1. Stop nothing yet. qbx_adminmenu may keep running: Jixryo Admin takes over its /admin and /report (a command registered in the player's own game is found before a server command of the same name). Remove qbx_adminmenu once your staff are on Jixryo Admin.

2. Order in server.cfg.

   ensure ox_lib
   ensure oxmysql
   ensure qbx_core
   ensure jixryo_core
   ensure jixryo_admin

   Copy

3. The owner, in server.cfg or a file it runs such as permissions.cfg, with your own fivem: identifier (txAdmin, Players, you, IDs). It takes effect when the server next starts. The owner holds everything at weight 100 and is never in the database: nobody can edit, ban or remove them in game.

   add_ace identifier.fivem:YOUR_FIVEM_ID jixryo.admin.owner allow

   Copy

4. ox_lib hands out the ACE groups, so it needs these four lines:

   add_ace resource.ox_lib command.add_ace allow
   add_ace resource.ox_lib command.remove_ace allow
   add_ace resource.ox_lib command.add_principal allow
   add_ace resource.ox_lib command.remove_principal allow

   Copy

5. Never grant jixryo or jixryo.admin as a whole (add_ace group.admin jixryo allow): that would include the owner ACE. The panel refuses to hand out any ACE group that holds the owner ACE and says so in the console, but a line in permissions.cfg is beyond its reach.

6. Items. None.

7. The database. Eleven tables (jixryo_admin_roles, _staff, _people, _log, _warns, _notes, _bans, _ban_ids, _reports, _report_lines, _dms) are made on the first start in one migration step, with five roles from the config: Management 90, Senior admin 70, Admin 50, Moderator 30, Support 10. From then on roles live in the database: editing the config later only adds roles that are missing.

8. The sky. The panel runs the weather and clock. If you ever add a weather script, set Config.world.on = false so they do not fight.

9. Full restart. Then open the panel as the owner, go to Staff & roles, and add your staff from the players in the city.

The page is built into web/build, with the live map's tiles (the MDT's) and the props' pictures.

#How other scripts' calls behave

Jixryo Admin provides no other resource's name. What it offers and reads:

• Exports for other scripts: can(src, perm), role(src), registerPermission(id, label, description, danger) and registerAction(def, run, args) (below).
• The clock and the sky are kept where a weather script keeps them, so Jixryo Core's clock, Jixryo Prison and Jixryo Keys read them as before: GlobalState.currentTime = { hour, minute } written each game minute (cleared when the panel stops, so nothing reads a stale clock), and GlobalState.jxWorld = { weather, blackout, frozen }. Each on-duty staff member's player state bag jxStaff = { role, colour } draws the tag.
• What it calls: qbx_core (money, jobs and gangs, the vehicle list, and qbx.spawnVehicle from its lib), qbx_medical (Revive, Heal), Jixryo Prison (JailPlayer, GetInmate), Jixryo Police (IsRestrained, SetRestraint, Release), screencapture (serverCapture), ox_inventory (inventories, items), Jixryo Keys through Jixryo Core's vehicles module (keys for a spawn), Jixryo Fuel (SetFuel) or ox_fuel (its fuel state bag), vehiclehandler (repairs through the car's own game), qbx_vehicles (CreatePlayerVehicle), qbx_garages (GetGarages), Jixryo Characters (IsChoosing, so the sky waits), and qbx_radialmenu's radialmenu:client:deadradial to put the Staff slice back.
• The ban check runs on playerConnecting for everyone: a matching active ban presents the ban card, counts the try and adds the PC's hardware tokens to the ban. The owner is always let in. If the tables could not be made, it fails open, loudly.
• Removed resources: an action another resource registered goes when that resource stops; the built-in jail and cuff stay and check their resource each time.

exports.jixryo_admin:can(src, 'players.kill')    --> true / false
exports.jixryo_admin:role(src)                   --> { id, name, weight, colour, onDuty } or nil

exports.jixryo_admin:registerPermission('crime.place', 'Place crime spots', 'Put a crime spot down', false)

exports.jixryo_admin:registerAction({
    id = 'crimespot', label = 'Crime spot', icon = 'pin', group = 'tools', perm = 'crime.place',
    target = 'player', form = 'none', description = 'Put a crime spot where they stand.', rate = 1.0,
}, function(ctx)
    -- ctx = { src, id, target = { id, cid, name }, args }
    return { success = true, message = 'Placed.', log = 'Crime spot placed' }
end)

form is one of the panel's forms: none, confirm, reason, ban, money, job, item, message, teleport, bucket, jail. The third argument is an optional args(args, ctx) check that returns the clean arguments, or nil, 'why'. A registered action runs behind the same checks (permission, target online, rank, rate) and is logged like the rest.

#Its own API

Every page call is an ox_lib callback named jixryo_admin:server:<name>, checked on every call: the panel is ready, the caller holds the permission (panel.open unless the call says otherwise), a flood guard of 30 calls a second, the call's own wait, and the handler in pcall.

Events:

State: GlobalState.currentTime, GlobalState.jxWorld, the player state bag jxStaff, and the entity state bags jxAdminSpawn (a staff spawn) and jxProp (a temporary prop).

Audit: every logged action also goes to Jixryo Core's audit log as admin.<action>.

#Commands and keybinds

All five keys are key mappings (RegisterKeyMapping), so each staff member can change them in GTA's settings.

#Configuration

#Security

• The page only asks. Every call goes to a server callback that checks again: the panel is ready, the caller holds the permission, a flood guard of 30 calls a second, the call's own wait, then the handler in pcall.
• Every action through one door: the permission; the resource it needs is running; the burst limit (8 in 3 seconds) and the action's own wait; the target is in the city; not on yourself unless the action allows it; rank; the arguments re-checked (whole numbers, ranges, real items, jobs, grades and places, coordinates inside the map); the log line in jixryo_admin_log and Jixryo Core's audit.
• Money: always with a reason, never below zero, one change above the cap needs money.large, qbx_core makes the change.
• Rank and grants: nobody acts on, edits, bans offline or removes anyone at or above their weight; the owner cannot be touched; nobody hands out a role at or above their own, or a permission they do not hold; an ACE group only if your own role or a role below you already hands it out.
• Offline bans: a license, license2, FiveM or Discord identifier counts as the whole account it belongs to (qbx_core's users table), so the Discord ID of the owner or of staff at or above you is refused like their license. Steam, Xbox and IP identifiers cannot be tied to an account, so only the owner bans by them offline. The owner is always let in, whatever a ban row says.
• ACE groups are given as player.<id> principals, taken back on leaving and when the resource stops, never one that holds the owner ACE.
• Your tools each need their permission and duty, every time. Losing a permission switches its tool off at once; leaving duty or staff switches them all off and takes the tag. Names and blips go only to staff with them on.
• Resources: Management only. The panel never stops itself, what it runs on, txAdmin's monitor, or anything that would take them with it. A stop or restart that takes running resources with it needs the page's confirm. Paths on disk never reach the page.
• Vehicles and objects: your game only names a thing (its network id); the server checks it exists, what it is, that it is near you, and never touches a player. Plates are checked and unique. Spawned props come only from the catalog, near you, within the limits, and are temporary.
• Spectate: rank checked on every step to the next player; your world and spot are kept on the server and given back when you stop or they leave.
• What a player's game does (a teleport, fire, freeze, a repair) only ever comes from the server, to that player, and only touches their own ped or the car their game owns.
• Identifiers are masked unless you hold players.identifiers. Staff notes need players.notes.
• The ban check fails open, loudly, if the tables could not be made, so a broken database never locks everyone out.

#Tests

Both suites run on a real database (the resource's own SQL and migrations on SQLite) with Jixryo Core's real validate, db, rate, audit, player and hud modules, against a stand-in world shared in tests/jixryo_admin.setup.lua. Run on 2026-10-31.

cd dev-tools/luarun && node run.mjs ../../jixryo_scripts/jixryo_admin tests/jixryo_admin.lua

cd dev-tools/luarun && node run.mjs ../../jixryo_scripts/jixryo_admin tests/jixryo_admin.client.lua

The README records 66 of 66 planted bugs caught (2026-10-15), and the built page driven through dev-tools/nui/cdp-game.mjs with this resource's real answers.

#Check it in game

1. The owner: with the owner line in server.cfg, F10 opens the panel with your name, the crown and "Owner". Add a staff member as Admin: they open the panel and qbx_core's admin commands work for them; remove them and the panel closes and the commands stop.
2. Bring, Go to, Send back; Teleport to the waypoint and each saved place lands on the ground. Freeze, the fun actions, health, inventory, screenshot, mute, jail, cuff, warn, ban, /report and /reply.
3. Restart the resource with staff online: their ACE groups come back and nothing is left behind.
4. Noclip (F2): fly with W A S D, E and Q; the wheel's speeds; Shift; with a car you drive. A second player sees nothing where you fly. F2 lands you on the ground.
5. Names (F3): IDs, names, jobs and health over players near you; the mic while someone talks. God and invisible: no damage; a second player cannot see you; you see yourself ghosted. Blips: every player on your minimap, moving.
6. The duty tag: a second player sees "STAFF · ROLE" over you on duty, not off duty, not while invisible.
7. Spectate a player across the map: their camera, the arrows to the next player, E for their file, Esc back where you were; follow them into an apartment.
8. The live map: players in their colours; click the map and "Teleport me here" lands on the ground.
9. Vehicles: spawn one (you in the seat, the keys work, a full tank); give a player one and find it in their garage; fix, clean and fill a damaged car someone else drives; clear empty vehicles (the warning, owned cars stay).
10. Objects: inspect a car, a ped and a map prop; the laser; place a prop with the gizmo (check that GTA's arrows show) and move it; clear the area.
11. Weather and time: a weather for everyone, rolling in; the clock and freeze; blackout; character selection keeps its own sky; the weather changing on its own after 40 minutes.
12. The restart countdown: the banner on a second player's screen and its marks; cancel.
13. Resources: stop and start something small; stop something others need and see the warning; the panel's own are locked.
14. The coords tool (F7): where you stand; hold the right button to aim; 1 to 4 paste correctly into a script; save a point and see its marker; 6; 7 with a pasted vec3. Your hotbar keys do nothing while it is open.
15. The quick layer: INSERT, type a name, the card pinned on them; its actions; Tab; Enter for the file; the Staff slice in Z (and again after you go down and are revived).