Reliably negating permissions inside of a region

To reliably negate permission inside of a region

What might not work out is that you define a group in your permissions plugin that contains the negated permissions. Then you create and link a permdef to have inside of the region where you want permisisons to be negated. This might not work due to the adding order of groups and how your specific permission plugin handles that. Assuming the group for negation is named groupneg it would look like:

permdefs:
  # permdef states how permissions are manipulated.
  defneg:
    have-inside:
      groups:
      - groupneg
links:
  TheWorld:
    RegionA:
    - defneg

This would be pretty simple, however you would have to test it with your permissions plugin, if the negation works, also adding groups with permission plugins usually mean that the permission plugin will save back the permissions, which costs a good bit of performance.

Recommended way, but a little more complicated to set up:

You remove the permissions to be negated from your permissions plugins groups (you will add them only with RSP to guarantee negation is working), for the world you want the negation to take place in. Instead you add a filter permission to the groups / players who shall have the permissions normally, say rsp.filter.havesomething.

Assume the permissions you want to negate are something.first and something.second. RSP will use the filter permission to determine who should have the other permissions.

Now the configuration looks like this:

permdefs:
  # The permdef to be added normally inside of that world:
  defsomething:
    # The filter permission decides who is affected by this permdef.
    #  The players that have this permission from your permissions plugin,
    #   will have the groupsomething addedm then.
    filter-perm: rsp.filter.havesomething
    have-inside:
      groups:
      - groupsomething
  # The negation permdef:
  defneg:
    # Priority to ensure the negation overrides the other groups.
    priority: 10
    have-inside:
      groups:
      - groupneg

links:
   TheWorld:
     # __global__ concerns "everywhere" in that world:
     __global__:
     - defsomething
     # In region a the permdef "defneg" is applied.
     RegionA:
     - defneg

# Finally you define the grouping with permissions right here:
transient-groups:
  # The normal group containing the permissions.
  groupsomething:
  - something.second
  - something.first
  # The negating group with the permissions negated.
  # (Negation works with a prefix "-".)
  groupneg:
  - -something.second
  - -something.first

So the steps usually contain to set up your permission plugin with filter-permissions (and if needed ignore-permissions), then define permdefs, link them to regions, and also the transient-groups carrying the permissions finally.