Moderation & Roles

Every EchoHub server has a four-tier role hierarchy. Moderation is strictly hierarchical: acting on another user requires outranking them — equal rank is never enough — and a few invariants protect the server owner from lockouts.

Roles

Role	Rank	Users panel glyph	How it's granted
Owner	3	★	The first account ever registered on the server
Admin	2	♦	Assigned by the Owner
Mod	1	❀	Assigned by an Admin or the Owner
Member	0	—	Everyone else

Assign roles with /role <user> <admin|mod|member>. Two rules apply:

• You can only assign roles strictly below your own — an Admin can promote to Mod but cannot create another Admin; only the Owner can.
• Owner is not assignable and not demotable. There is exactly one Owner (the first account), nobody can be promoted to it, and the Owner's role can't be changed.

Actions

Command	Minimum role	Effect
/kick <user> [reason]	Mod	Disconnects the user. Not persistent — they can reconnect immediately.
/ban <user> [reason]	Admin	Persistent: flags the account banned and disconnects it. Banned accounts are rejected at login.
/unban <user>	Admin	Lifts a ban.
/mute <user> [minutes]	Mod	Blocks the user from sending messages or uploading files. Without a duration the mute is indefinite; with one it auto-expires (checked every ~15 seconds).
/unmute <user>	Mod	Lifts a mute early.
/role <user> <role>	Admin	Assign a role (see rules above).
/nuke	Mod	Deletes the entire history of the current channel, including all attachment files on disk. Channel-wide — no per-user check.

Kick, ban, and mute all enforce the hierarchy: the target's role must be strictly lower than yours. A Mod cannot kick another Mod; nobody can kick, ban, mute, or demote the Owner.

Deleting messages

Deletion has its own, slightly different rule set:

• Your own messages — always deletable, whatever your role. Right-click a message → Delete message, or press F6, pick the message, and hit Delete.
• Someone else's messages — requires Mod or higher and strictly outranking the author. A Mod can delete a Member's message, but not another Mod's.

Deleting a message also purges its uploaded attachment blobs from the server's disk, and the removal is broadcast live — the message disappears from everyone's chat immediately.

How actions surface

Everyone in the channel sees moderation happen:

• TUI clients show system messages — "alice was kicked (reason)", "bob was banned", "Channel history has been cleared by a moderator." The kicked or banned user themselves gets a dialog with the reason, then the client disconnects.
• IRC clients get native protocol events: kicks arrive as a real KICK command, bans as a server NOTICE. (See the IRC Gateway guide.)

Muted users aren't announced; they simply receive "You are muted and cannot send messages." when they try to speak.

Design notes

• All checks run server-side in the moderation API — the client commands are conveniences, and the same rules bind IRC users and any direct API caller.
• Bans are account-level, not IP-level. A banned person can register a fresh account; pair bans with registration hygiene on public servers.
• In end-to-end encrypted rooms moderation still works at the metadata level — messages can be deleted and users muted/kicked by identity — but no moderator can read the content, including the Owner.