Potential issue with AuthorizedDamage flag

after using this flag for many months, it has recently come to my attention that it is the cause of players being able to remove security doors, and destroy outpost vending machines by shooting them with regular ammo. not sure if this was intentional but it seems to happen only when this flag is enabled in the config.

in vanilla security doors and NPC vending machines cannot be damaged

custom security doors and vending machines require rust edit to be installed in order to protect them. this would explain why not having the flag in use would cause truepve to protect these instead.

Hello,
When this flag enabled, even non-authorized player allowed to damage to the building, which building owner is online.
Would you please check it?
Here is my config:

{
  "Config Version": "2.0.8",
  "Default RuleSet": "default",
  "Configuration Options": {
    "handleDamage": true,
    "useZones": true,
    "Trace To Player Console": false,
    "Trace To Server Console": false,
    "Maximum Distance From Player To Trace": 10.0,
    "Prevent Water From Extinguishing BaseOven": false,
    "Prevent Players From Being Marked Hostile": false
  },
  "Mappings": {
    "default": "default"
  },
  "Schedule": {
    "enabled": false,
    "useRealtime": false,
    "broadcast": false,
    "entries": []
  },
  "RuleSets": [
    {
      "name": "default",
      "enabled": true,
      "defaultAllowDamage": false,
      "flags": "SelfDamage, AuthorizedDamage, HumanNPCDamage, LockedBoxesImmortal, LockedDoorsImmortal, PlayerSamSitesIgnorePlayers, TrapsIgnorePlayers, TurretsIgnorePlayers",
      "rules": [
        "anything can hurt dispensers",
        "anything can hurt resources",
        "anything can hurt barricades",
        "anything can hurt traps",
        "anything can hurt heli",
        "anything can hurt npcs",
        "anything can hurt players",
        "anything can hurt ch47",
        "nothing can hurt cars",
        "nothing can hurt mini",
        "nothing can hurt snowmobiles",
        "nothing can hurt ridablehorses",
        "nothing can hurt scrapheli",
        "cars cannot hurt anything",
        "mini cannot hurt anything",
        "ch47 cannot hurt anything",
        "scrapheli cannot hurt anything",
        "mlrs cannot hurt anything",
        "players cannot hurt players",
        "players cannot hurt traps",
        "guards can hurt players",
        "fire can hurt players",
        "traps cannot hurt players",
        "highwalls can hurt players",
        "barricades can hurt players",
        "npcs can hurt players",
        "junkyard can hurt players",
        "junkyard can hurt cars",
        "players can hurt carlift"
      ]
    }
  ],
  "Entity Groups": [
    {
      "name": "barricades",
      "members": "Barricade, icewall, GraveYardFence",
      "exclusions": "barricade.concrete, barricade.sandbags, barricade.metal, barricade.stone, barricade.wood, barricade.woodwire"
    },
    {
      "name": "dispensers",
      "members": "BaseCorpse, HelicopterDebris, PlayerCorpse, NPCPlayerCorpse, HorseCorpse, SkyLantern",
      "exclusions": ""
    },
    {
      "name": "fire",
      "members": "FireBall, FlameExplosive, FlameThrower, BaseOven, FlameTurret, rocket_heli_napalm, napalm, oilfireball2",
      "exclusions": ""
    },
    {
      "name": "guards",
      "members": "bandit_guard, scientistpeacekeeper, sentry.scientist.static",
      "exclusions": ""
    },
    {
      "name": "heli",
      "members": "BaseHelicopter",
      "exclusions": ""
    },
    {
      "name": "highwalls",
      "members": "SimpleBuildingBlock, wall.external.high.ice, gates.external.high.stone, gates.external.high.wood",
      "exclusions": ""
    },
    {
      "name": "ridablehorses",
      "members": "RidableHorse",
      "exclusions": ""
    },
    {
      "name": "cars",
      "members": "BasicCar, ModularCar, BaseModularVehicle, BaseVehicleModule, VehicleModuleEngine, VehicleModuleSeating, VehicleModuleStorage, VehicleModuleTaxi, ModularCarSeat",
      "exclusions": ""
    },
    {
      "name": "mini",
      "members": "minicopter.entity",
      "exclusions": ""
    },
    {
      "name": "scrapheli",
      "members": "ScrapTransportHelicopter",
      "exclusions": ""
    },
    {
      "name": "ch47",
      "members": "ch47.entity",
      "exclusions": ""
    },
    {
      "name": "npcs",
      "members": "ch47scientists.entity, BradleyAPC, CustomScientistNPC, CustomScientistNpc, ScarecrowNPC, HumanNPC, NPCPlayer, ScientistNPC, TunnelDweller, SimpleShark, UnderwaterDweller, Zombie, ZombieNPC",
      "exclusions": ""
    },
    {
      "name": "players",
      "members": "BasePlayer, FrankensteinPet",
      "exclusions": ""
    },
    {
      "name": "resources",
      "members": "ResourceEntity, TreeEntity, OreResourceEntity, LootContainer",
      "exclusions": "hobobarrel.deployed"
    },
    {
      "name": "snowmobiles",
      "members": "snowmobile, tomahasnowmobile",
      "exclusions": ""
    },
    {
      "name": "traps",
      "members": "AutoTurret, BearTrap, FlameTurret, Landmine, GunTrap, ReactiveTarget, TeslaCoil, spikes.floor",
      "exclusions": ""
    },
    {
      "name": "junkyard",
      "members": "magnetcrane.entity, carshredder.entity",
      "exclusions": ""
    },
    {
      "name": "mlrs",
      "members": "MLRSRocket, rocket_mlrs",
      "exclusions": ""
    },
    {
      "name": "carlift",
      "members": "ModularCarGarage",
      "exclusions": ""
    }
  ],
  "Allow Killing Sleepers": false,
  "Allow Killing Sleepers (Ally Only)": false,
  "Ignore Firework Damage": true
}​

you would need to pair it with AuthorizedDamageRequiresOwnership. these flags are in the documentation 

Thanks for the help, but still happening same thing after add that flag.
Trace log says that I have authorization of building, but actually I don't have authorization.

[2023-02-23 17:09:39] ======================
==  STARTING TRACE  ==
==  17:09:39.86698  ==
======================
 From: BasePlayer, player
 To: BuildingBlock, wall
   No shared locations (empty location) - no exclusions
 No exclusion found - looking up RuleSet...
 Using RuleSet "default"
 Initiator is player with authorization over non-player target; allow and return

[2023-02-23 17:09:40] ======================
==  STARTING TRACE  ==
==  17:09:40.01416  ==
======================
 From: BasePlayer, player
 To: BuildingBlock, wall
   No shared locations (empty location) - no exclusions
 No exclusion found - looking up RuleSet...
 Using RuleSet "default"
 Initiator is player with authorization over non-player target; allow and return​

that message is shown when:

if using CupboardOwnership:
- if they can build (they are authed on a cupboard, or no cupboard is built yet)

if not using CupboardOwnership
- the entity is not owned, is owned by the attacker, or the attacker is an ally of the owner. otherwise a cupboard MUST be built and they MUST be authed on it

there are no exceptions to this. it is possible as an admin that a plugin is giving you auto-auth of the TC.

        // checks if the player is authorized to damage the entity
        private bool CheckAuthorized(BaseEntity entity, BasePlayer player, RuleSet ruleSet)
        {
            if (!ruleSet.HasFlag(RuleFlags.CupboardOwnership))
            {
                if (entity.OwnerID == 0 || entity.OwnerID == player.userID || IsAlly(entity.OwnerID, player.userID))
                {
                    return true; // allow damage to entities that the player owns
                }

                return player.IsBuildingAuthed(entity.WorldSpaceBounds());
            }

            // treat entities outside of cupboard range as unowned, and entities inside cupboard range require authorization
            return player.CanBuild(entity.WorldSpaceBounds());
        }​

Ahh! Finally I managed to find of cause.
In fact, I used my hand-made plugin to make to join to one team while player is online.
This plugin will check wheather player belong to the same team. I didn't know that until watch the code in detail.
So in my case, while players are online, plugin will recognize as ally, therefore they can break the building each other.

My solution is to modify to make IsAlly always return false.

I'm really sorry to susupect a bug.

yep, that would do it. glad you figured it out.

the issue is resolved, i just turned off AuthorizedDamage and allow TwigDamage, it looks ugly so isnt important if other players can destroy it