What the other resources take from here

What this gives you: one edit that moves every RE : CORD panel at once, instead of the same edit repeated in five config files.

Each resource starts from the defaults in server/sv_config.lua and overrides only what it needs. Anything it leaves alone comes from here.

Who opens the panels

One entry ships with it, and it is the reason a fresh install works at all:

config.webDefaults = {

    ---@type REC_Library.Server.Class.Web.WebConfig.Grant[]
    grants = {
        { ace = "admin", scopes = { "*", }, },
    },
}

A resource adds its own narrower entries on top of this list rather than replacing it, so granting one moderator a read-only view somewhere can never drop the row that lets an admin back in. Every entry that matches contributes its scopes, and somebody matching two of them gets the union. There is no deny form — to take something away, stop granting it.

Each resource decides what its own areas are called; the pattern is "<area>:read" and "<area>:write", with "read" meaning every area's read half and "*" meaning everything. Set useSharedGrants = false in a resource to ignore this list there.

Tokens

Only the convar name lives here, never a value:

tokens = {
    { convar = "adminToken",   label = "admin",   scopes = { "*", }, },
    { convar = "supportToken", label = "support", scopes = { "read", }, },
},

So one pair covers every panel:

  set REC:adminToken "a-random-string-of-32-chars-or-more"
  set REC:supportToken "another-one-for-read-only-access"

A convar named after a resource wins over the shared one, so REC_Economy:adminToken beats REC:adminToken. Adding an entry here gives every RE : CORD panel one more token in a single move, and a resource can still add its own with http.customTokens.

The staff list

Named characters are left out of the figures every RE : CORD resource produces — the money supply, the item circulation, the activity map. What "left out" means exactly is up to each resource, and each one's page says so.

config.staffDefaults = {

    ---@type string[]
    citizenIds = {
        "ABCDEFGH",
    },

    ---@type string[]
    aceGroups = {
        "admin",
    },
}

The convar does the same without touching the file, and the two are merged:

  set REC:staffCitizenIds "ABCDEFGH, K3PQ81ZR"

aceGroups is only consulted where a resource knows the source but not the character yet — a heatmap sample that lands before the character loads, for instance. A resource replaces this one rather than adding to it, because widening a permission boundary should never happen by accident.

UI theme and settings visibility

shared/sh_config.lua selects config.theme: rec uses the RE:CORD appearance and ox uses the classic ox_lib appearance. Shared gauge, subtitle and help-text options control the default layout of those UI elements.

Management panels can grant an entire settings group or a single setting. For example, settings.market:read grants a group and settings.market.enabled:write grants a single switch. settings continues to cover all settings. Settings whose prerequisite is disabled remain visible but cannot be edited. The panel explains which parent setting must be enabled first.

List menus

shared/sh_config.lua → config.ui.menu controls the shared offsets, colour, input handling and navigation sounds for list menus such as REC_AdminMenu. With keepInput = true, players can move while the menu is open; it uses keyboard/gamepad input without a cursor. Use lib.registerMenu / lib.showMenu to register and display menus. Each calling resource owns its menus.

Browser sign-out

The panel’s sign-out button clears its saved token and returns to authentication. Token prompts no longer display the stored value. Signing out does not revoke the server token; update its convar or definition to revoke it.