Hi @Wulf.  If you (or anyone else that knows) sees this, can you help me understand how this code from the plugin works?  

foreach (var player in players.All)
{
if (!player.HasPermission("whitelist.allowed")) continue;
permission.GrantUserPermission(player.Id, permAllow, null);
permission.RevokeUserPermission(player.Id, "whitelist.allowed");
}

permAllow is set to "whitelist.allow", but the hasPermission is looking for "whitelist.allowed".  I must be missing something, because the way I'm reading this is that no one has "allowed", and everyone connected will get "allow" and therefore whitelisted if you've already been able to connect?

Thanks for any help, would like to understand more about the permissions system.

The old permission was whitelist.allowed; the check you are looking at is to remove that old permission and replace it with the new one if they have it. The actual check during connection uses the one listed on the plugin's page.

Thanks Wulf