# Tools and permissions

> All 54 Droost tools in three permission groups: content tools for any site, build tools for development, developer tools for local only.

Droost's 54 tools are grouped by what they touch, and each group is one
permission. `drush droost:tool` runs as the site's administrator, who holds
all three. Over the web, a call is the account's own, held to its
permission and to Drupal's own access.

| Permission | For | Where |
|---|---|---|
| `use droost content tools` | what an editor manages | any site |
| `use droost build tools` | site building | development and staging; refuses web requests |
| `use droost developer tools` | the site's internals | local development only; refuses web requests |

A tool marked **write** changes the site and needs its
[write gate](https://droost.org/docs/module-gates.md) armed.

## Content tools

| Tool | Module | What it does |
|---|---|---|
| `droost_entities` | droost | entity types, bundles and fields |
| `droost_entity_load` | droost | one entity's values (secrets redacted) |
| `droost_content_query` | droost | content by its fields, with counts; aware of the trash |
| `droost_entity_create` | droost | **write**: create an entity, and report its saved state |
| `droost_entity_update` | droost | **write**: update an entity, and report what was kept |
| `droost_entity_delete` | droost | **write**: delete an entity, and report what still points at it |
| `droost_views_execute` | droost | run a View display and return its real results |
| `droost_url` | droost | an absolute URL from a path, or a route and its parameters |
| `droost_tokens` | droost | token types and tokens, and what a token text resolves to |
| `droost_canvas` | droost_canvas | the Canvas surface: its version, components, pages and their aliases |
| `droost_canvas_tree_get` | droost_canvas | a page's component tree |
| `droost_canvas_tree_validate` | droost_canvas | check a tree before writing it |
| `droost_canvas_tree_set` | droost_canvas | **write**: a page's component tree |

## Build tools

| Tool | Module | What it does |
|---|---|---|
| `droost_config_get` | droost_build | a configuration object (secrets redacted) |
| `droost_config_status` | droost_build | drift between active configuration and the export |
| `droost_config_validate` | droost_build | configuration against its schema |
| `droost_config_set` | droost_build | **write**: configuration, through the entity API |
| `droost_config_import_one` | droost_build | **write**: import one configuration object |
| `droost_structure_create` | droost_build | **write**: content types, fields, bundles, view modes |
| `droost_permissions` | droost_build | permissions and the roles that hold them |
| `droost_sdc_components` | droost_build | Single Directory Components: props, slots, schemas |
| `droost_display_get` | droost_build | a display, as a field-to-component mapping |
| `droost_display_check` | droost_build | whether every binding a display names exists |
| `droost_views_get` | droost_build | a View's definition |
| `droost_views_handlers` | droost_build | the fields, filters and sorts a View can use |
| `droost_views_compose` | droost_build | **write**: a new View from an intent, validated by Views |
| `droost_views_alter` | droost_build | **write**: change an existing View |
| `droost_canvas_component_lint` | droost_canvas | components against Canvas's requirements |
| `droost_canvas_component_toggle` | droost_canvas | **write**: show or hide a component in the editor |
| `droost_canvas_variant_tree_set` | droost_canvas | **write**: a page variant's tree (the frame) |

[Droost UI Kit](https://droost.org/docs/droost-ui-kit.md) adds two more build tools,
`droost_display_sources` and `droost_display_compose`.

## Developer tools

| Tool | Module | What it does |
|---|---|---|
| `droost_app_info` | droost_dev | Drupal and PHP versions, the database, themes, enabled modules and their versions |
| `droost_routes` | droost_dev | routes, with their controllers |
| `droost_route_access` | droost_dev | whether an account may reach a path |
| `droost_services` | droost_dev | a service, and the interface to type-hint |
| `droost_runtime_inspect` | droost_dev | runtime state: State API, queues, cache bins, live hook implementors, event listeners |
| `droost_logs` | droost_dev | recent log entries (needs `dblog`) |
| `droost_last_error` | droost_dev | the last error (needs `dblog`) |
| `droost_update_status` | droost_dev | pending database updates and post-update functions |
| `droost_profile`, `droost_profile_list` | droost_dev | profiled requests, with their slowest queries |
| `droost_db_schema` | droost_dev | the database schema |
| `droost_db_read` | droost_dev | a read-only SQL query |
| `droost_db_create`, `droost_db_update`, `droost_db_delete` | droost_dev | **write**: raw SQL, one statement of their own verb |
| `droost_module_install`, `droost_module_uninstall` | droost_dev | **write**: modules |
| `droost_cache_rebuild` | droost_dev | rebuild the caches |
| `droost_cron_run` | droost_dev | **write**: run cron |
| `droost_deploy_hook_reset` | droost_dev | **write**: let a deploy hook run again |
| `droost_eval` | droost_dev | **write**: run PHP (its own gate, off by default) |
| `droost_ai_tools`, `droost_ai_invoke` | droost_ai | the site's Drupal AI function calls; one that may write needs `allow_destructive` |
| `droost_generate` | droost_devel | **write**: generated content, through Devel |

## Asking a tool about itself

Every tool answers `help` with what it does and its arguments:

```bash
drush droost:tool droost_content_query help
```