@helyx/module-account-gate

Access Control keeps joining members in a Discord-managed restricted area until they complete a configured interaction, password, emoji, or server-question gate and Helyx safely grants the access role.

Availability and deployment

Access Control is Live and supported by Hosted Helyx and Helyx Self-Hosted. It uses Helyx runtime and Discord capabilities only and requires no external provider credentials. It cannot be enabled alongside Verification because both own the server entry-role workflow.

What it does

Managers choose generated Challenges, Password Entry, or Emoji Entry. Generated flows can combine quick sums, button sequences, number ordering, symbol matching, modal recall, and managed server questions. The module also supports bounded attempts and cooldowns, account-age rules, returning-member restoration, staff review, join deadlines, and temporary strict mode.

Access Control is a Discord-native human-interaction gate. It can deter basic automated joins, but it does not assess devices, network risk, alternate accounts, or ban evasion. Discord channel permissions remain the authority for what pending members can see.

Commands and interactions

| Path or control | Default access | Purpose | | -------------------------------- | -------------- | -------------------------------------------------------- | | /access control start | Everyone | Start or resume the caller's current pending check. | | /access control reset | Manage Roles | Revoke the caller's access and begin a fresh generation. | | /access control status | Manage Roles | Inspect setup health and temporary strict-mode state. | | /access control strict | Manage Roles | Add one generated challenge for a bounded period. | | Published gate panel | Everyone | Start the configured member flow. | | Password message or emoji action | Pending member | Complete the selected single-step gate. | | Dashboard and review actions | Manage Roles | Approve, retry, kick, dismiss, or revoke a current case. |

Every slash-command path has its own permission identity and dashboard override. Responses are private and server-only. Start is limited to five uses per member per minute; Reset is limited to ten.

Dashboard configuration

Settings cover access type, roles, gate and staff-review channels, attempt and timing controls, account age, returning-member behavior, final-failure action, and optional strict mode. Managed resources publish, edit, repair, or repost gate panels and maintain server questions. The Members resource exposes bounded current state and guarded review or revoke actions.

Activation validates the selected roles, channels, Discord capabilities, published panel, and at least one enabled question when Server Questions is used. Helyx does not maintain a second allowlist for every channel visible to a pending role; managers configure those Discord overwrites directly.

Discord requirements

The ordinary flow needs View Channel, Send Messages, Embed Links, Read Message History, and Manage Roles. Kick Members is required only when final failure is configured to kick. Password Entry additionally needs Manage Messages, Guild Messages, and Message Content. Emoji Entry may require Add Reactions and the Guild Message Reactions capability. Helyx must sit above the access role and each temporary role it removes.

The staff-review channel must not be visible to @everyone or configured temporary roles. Helyx validates the audiences it can inspect, but managers remain responsible for keeping every other visible role staff-only.

Data, privacy and retention

The module stores question-creator references, bounded attempt outcomes, member summaries, staff-review decisions, terminal finalisations, recoverable role transitions, strict-mode activations, and privacy suppression state. Raw Password Entry messages and generated answers are never retained; active challenge answers use the shared expiring interaction-session service.

The registered privacy provider supports bounded access and erasure even while the module is disabled. Subject erasure removes or detaches declared member and actor records and uses suppression state to prevent in-flight work from recreating deleted personal data.

Operations and failure behavior

Join deadlines, challenge expiry, strict-mode expiry, and recovery use durable versioned tasks. Exact join generations, session versions, write fences, and terminal receipts prevent restarted or duplicate workers from enforcing stale work. Helyx adds the access role before removing temporary roles, so a partial Discord failure does not remove the member's only access route.

Final kick decisions recheck current module, member, permission, and role state immediately before enforcement. A failed direct message does not block a configured kick. Optional Logging cannot reverse a committed decision, and health exposes bounded setup or recovery state without raw answers or exception details.

Documentation and support

See the Access Control guide, settings, commands, permissions, resources, members, logging, and FAQ.