jrmy_admin

An original, server-authoritative administration suite for FiveM with the Jaramiyo cacao and rose interface.

Highlights

• Responsive administration dashboard with live server health and activity.
• Online player search, rich profiles, map positions and lifecycle-safe targeting.
• Heal, revive, freeze, teleport, spectate, direct message, vehicle spawn, repair, flip and cleanup tools.
• Persistent bans, warnings, notes and audit records for sensitive staff actions.
• Player reports with claim, conversation and close workflows.
• Staff roles, hierarchy protection, duty tracking and granular permissions.
• Inventory, economy and job adapters for supported frameworks.
• World, announcement, event scheduling and resource modules behind explicit safety gates.
• Quick tools for noclip, god mode, invisibility, player names and coordinates.
• Spanish and English UI, keyboard navigation, reduced motion and local WebAudio SFX.
• No CDN, telemetry, external panel or remote service.

Requirements

• A recent FiveM server artifact with OneSync enabled.
• oxmysql.
• One supported framework, or standalone mode for framework-independent features:
  • ESX Legacy
  • QBCore
  • Qbox

Installation

1. Copy the resource as jrmy_admin.
2. Configure config.lua.
3. Make sure the database user can create and alter the jrmy_admin_ tables. The resource installs its schema on first start. If DDL permissions are disabled, import sql/install.sql manually.
4. Configure the first owner using the dedicated section below.
5. Start dependencies before the panel:

set onesync on

ensure oxmysql
ensure qbx_core # or qb-core / es_extended
ensure jrmy_admin

For standalone mode, omit the framework ensure line and set Config.Framework = 'standalone'.

First owner and panel access

Opening the panel and receiving an administrative role are separate permissions:

• jrmy_admin.open only opens the panel shell. It does not grant dashboard, duty or moderation permissions.
• jrmy_admin.bootstrap creates the first database owner only while jrmy_admin_staff has no enabled staff records.
• Config.Owners always promotes the listed identifier to the protected owner role and is the recommended first setup.

Recommended setup

Copy the exact license2: identifier into config.lua:

Config.Owners = {
    'license2:REPLACE_WITH_YOUR_IDENTIFIER'
}

Restart the resource after saving:

restart jrmy_admin

The configured owner can open the panel directly with /admin or F10. A database role already contains panel.open; no extra jrmy_admin.open ACE is required.

One-time ACE bootstrap

Use this alternative only when the staff table is empty. Place these lines before ensure jrmy_admin or in a permissions file executed before it:

add_principal identifier.license2:REPLACE_WITH_YOUR_IDENTIFIER group.admin
add_ace group.admin jrmy_admin.bootstrap allow

Do not mix group names. If the principal belongs to group.admin, the ACE must also be assigned to group.admin.

ACE changes in server.cfg require a full server restart. If the lines live in a separate permissions file, run exec permissions.cfg from the server console and then restart jrmy_admin.

Connect with that identifier and open the panel once. The resource creates the first owner record. After confirming that the profile shows Owner, remove the bootstrap line and perform a full server restart. To revoke it immediately without restarting the server, run:

remove_ace group.admin jrmy_admin.bootstrap allow

If the profile shows ACE, the account only has panel-shell access. Close the panel and use Config.Owners, or grant the one-time bootstrap permission while the staff table is empty. Repeated No access and Too many requests messages are a symptom of the missing role, not a reason to grant jrmy_admin.all.

Commands

Command	Audience	Purpose
/admin	Authorized staff	Opens the administration panel
/report	All players	Opens the report form

The default panel key is F10 and can be changed in FiveM key bindings.

Roles

The included role hierarchy is:

Role	Intended scope
Owner	Full access and staff management
Admin	Player, moderation, economy, world and audit tools
Moderator	Moderation, reports and common player actions
Helper	Reports and low-risk support actions

Roles and their permission patterns are configured in Config.Roles. Every sensitive request is checked again on the server; hiding a UI action is never treated as authorization.

Safe defaults

The following mutations are disabled by default in Config.AdvancedActions:

• Inventory changes
• Economy changes
• Job changes
• Resource start, stop or restart
• Integrated world control

Enable only the modules that match the server setup. Read-only views can remain available independently.

Framework behavior

Config.Framework = 'auto' selects Qbox, QBCore or ESX when exactly one supported framework is running. Set the value explicitly on servers that expose more than one compatibility layer.

Framework adapters normalize:

• Character identity and display name
• Job and grade
• Cash and bank accounts
• Inventory reads and supported mutations
• Job and account mutations

An unsupported adapter fails closed and reports the capability as unavailable.

Config.Inventory = 'auto' detects a single compatible inventory. If more than one compatible inventory is active, select ox, qb, esx or none explicitly. Ambiguous or unavailable adapters stay disabled instead of guessing.

Qbox inventory tools require ox_inventory. QBCore supports qb-inventory or ox_inventory, and ESX supports its native inventory or ox_inventory.

Config.Medical = 'auto' integrates with qbx_medical, qb-ambulancejob or esx_ambulancejob when it matches the selected framework. Native health handling is selected automatically only in standalone mode. Set native explicitly to use it with another framework. Missing or incompatible medical adapters fail closed.

Security model

The server derives the actor identity from source and applies this sequence to every RPC:

1. Request shape and rate limit
2. Staff access and duty state
3. Permission pattern
4. Target availability and hierarchy
5. Payload validation and configured feature gate
6. Framework or database operation
7. Server-generated audit entry for sensitive mutations
8. Redacted response

Client-supplied permissions, identifiers, roles and audit fields are ignored. Source reuse, stale UI requests and disconnected targets are rejected.

Ban identifiers and player tokens are stored as hashes. The map exposes current positions only to authorized staff while the panel requests them; it does not keep a location history.

Data

The resource owns only tables prefixed with jrmy_admin_. It does not alter framework schemas. Persistent data includes:

• Staff members and duty sessions
• Player index for offline lookup
• Bans, warnings and notes
• Reports and messages
• Audit records
• Staff events

Back up these tables before schema changes.

Smoke test

1. Start the resource with oxmysql and one supported framework.
2. Join with the configured owner identifier.
3. Open /admin, enter duty and confirm dashboard/player updates.
4. Test heal, freeze and teleport with a second player.
5. Submit /report from the second player, claim it, reply and close it.
6. Create and revoke a temporary ban, then verify the audit trail.
7. Leave duty and confirm privileged toggles are restored.
8. Restart jrmy_admin while connected and verify the panel can reopen cleanly.
9. Stop the resource while noclip or spectate is active and verify player state is restored.

Exports

exports.jrmy_admin:IsStaff(source)
exports.jrmy_admin:HasPermission(source, 'players.view')
exports.jrmy_admin:IsOnDuty(source)
exports.jrmy_admin:OpenPanel()
exports.jrmy_admin:ClosePanel()
exports.jrmy_admin:IsPanelOpen()

Server exports receive a player source. OpenPanel, ClosePanel and IsPanelOpen are client exports.

License

Original code and Jaramiyo assets are released under the MIT License. Bundled fonts and icon artwork retain their respective licenses in THIRD_PARTY_NOTICES.md.