OnCupboardDeauthorize
OnCupboardDeauthorize is called when a player removes themselves from a tool cupboard (or vehicle privilege) whitelist, right before the game drops their authorization.
object OnCupboardDeauthorize(BuildingPrivlidge privilege, BasePlayer player)Parameters
| Parameter | Type | Description |
|---|---|---|
privilege | BuildingPrivlidge | The TC or vehicle privilege entity the player is trying to remove themselves from. Can be cast to BuildingPrivlidge or VehiclePrivilege depending on which overload fired; use its position or OwnerID for logging and broadcasts. |
player | BasePlayer | The BasePlayer who triggered the deauthorization by holding E on the cupboard. Already passed CanInteract and the admin/auth checks when the hook fires. |
Return value
Returning a non-null value (for example true) stops the original code path, so the player stays authorized and no network update is sent. Returning null lets the game proceed and remove the player from the authorized list.
How it works
The hook fires inside BuildingPrivlidge.RemoveSelfAuthorize, which the client triggers when an authorized player interacts with the TC to remove their own auth. Before calling the hook the game verifies the player can interact and passes CanAdministrate, so only players already on the list reach this point. The same hook name also fires from VehiclePrivilege.RemoveSelfAuthorize with a VehiclePrivilege first argument; if you only declare the BuildingPrivlidge overload, Oxide skips the vehicle calls and your logic runs for tool cupboards only.
Use it to react to auth changes: log who deauthed and when, post to team chat, revoke an associated permission or UI state, or block the removal entirely. Because the hook fires before RemovePlayer, blocking it leaves the player authorized and no network update is sent. Pair it with OnCupboardAuthorize to track the full whitelist lifecycle. It does not fire when an admin or code clears the whole list (OnCupboardClearList) or when the cupboard is destroyed.
Other signatures
Oxide also calls OnCupboardDeauthorize from other places in the game with these parameter types. Declare the overload you need, or several:
object OnCupboardDeauthorize(VehiclePrivilege vehiclePrivilege, BasePlayer player)
Example plugin: Block deauth from players who hold a VIP permission
using System;
using System.Collections.Generic;
using Newtonsoft.Json;
using Oxide.Core;
using UnityEngine;
namespace Oxide.Plugins
{
[Info("Cupboard Deauth Guard", "RustPluginGenerator", "1.0.0")]
[Description("Prevents chosen players from removing their own tool cupboard authorization and logs attempts.")]
public class CupboardDeauthGuard : RustPlugin
{
private const string PermKeepAuth = "cupboarddeauthguard.keepauth";
private PluginConfig config;
private StoredData data;
private class PluginConfig
{
[JsonProperty("Log deauthorization attempts to data file")]
public bool LogAttempts = true;
}
private class StoredData
{
[JsonProperty("Blocked deauthorizations")]
public List<string> Blocked = new List<string>();
}
protected override void LoadDefaultConfig() => config = new PluginConfig();
protected override void LoadConfig()
{
base.LoadConfig();
try
{
config = Config.ReadObject<PluginConfig>();
if (config == null) throw new Exception();
}
catch
{
PrintWarning("Configuration file is invalid, using defaults");
LoadDefaultConfig();
}
SaveConfig();
}
protected override void SaveConfig() => Config.WriteObject(config);
protected override void LoadDefaultMessages()
{
lang.RegisterMessages(new Dictionary<string, string>
{
["DeauthBlocked"] = "You cannot remove your own authorization on this cupboard. Ask another authorized player."
}, this);
}
private string Msg(string key, string userId = null, params object[] args) =>
string.Format(lang.GetMessage(key, this, userId), args);
private void Init()
{
permission.RegisterPermission(PermKeepAuth, this);
data = Interface.Oxide.DataFileSystem.ReadObject<StoredData>(Name) ?? new StoredData();
}
private object OnCupboardDeauthorize(BuildingPrivlidge privilege, BasePlayer player)
{
if (privilege == null || player == null || player.IsNpc) return null;
if (!permission.UserHasPermission(player.UserIDString, PermKeepAuth)) return null;
player.ChatMessage(Msg("DeauthBlocked", player.UserIDString));
if (config.LogAttempts && data.Blocked.Count < 500)
{
Vector3 pos = privilege.transform.position;
data.Blocked.Add($"{DateTime.UtcNow:yyyy-MM-dd HH:mm:ss} {player.displayName} ({player.UserIDString}) " +
$"cupboard {pos.x:F0} {pos.y:F0} {pos.z:F0}");
}
return true;
}
private void Unload()
{
Interface.Oxide.DataFileSystem.WriteObject(Name, data);
}
}
}The plugin registers a cupboarddeauthguard.keepauth permission in Init. When OnCupboardDeauthorize fires, it ignores NPCs and players without that permission, then sends a localized warning and returns true to cancel the removal so the player keeps their authorization. Canceled attempts are appended to a small data file so admins can audit who kept auth and from which cupboard, and the file is written in Unload to avoid disk writes on every interaction. Because only the BuildingPrivlidge overload is declared, vehicle privilege removals are unaffected.
Common use cases
Keep staff authorized while they build
Return a non-null value for players carrying an admin or builder permission so a stray E press on the TC does not silently drop their build authorization mid-session.
Audit whitelist changes
Record the player, cupboard position and timestamp on every self-deauthorize and dump the log to a file or Discord relay in a periodic timer instead of logging inside the hook.
Warn teammates before they lose access
Send a localized chat reply confirming the deauth so players know they can no longer open doors or build inside the privilege area, which prevents support tickets.
Pitfalls
Two overloads, same hook
VehiclePrivilege calls the hook with a different first parameter type. If you want vehicle behaviour, declare the second overload; declaring only
BuildingPrivlidgemakes Oxide skip vehicle calls entirely.Admins bypass the checks
The game only calls
RemoveSelfAuthorizeafterCanAdministratesucceeds, so admins who clear auth through admin commands or plugins that callRemovePlayerdirectly never hit this hook.Not a full whitelist wipe
Clearing the whole list fires
OnCupboardClearList, and destroying the cupboard fires no deauth hook at all, so do not rely on this hook alone to keep your stored auth data accurate.
Plugin recipes that use OnCupboardDeauthorize
Build a plugin with OnCupboardDeauthorize
Describe what should happen and get a compiled plugin that uses this hook.
Edit the prompt on the next screen. 2 free plugins a month, no card.
Last updated Oct 26, 2026. Found a mistake? Email support@rustplugingenerator.com.
Build a plugin with OnCupboardDeauthorize
Generate