BungeeCord players see commands in tab-complete without permissions

[BlackBaroness]

Looks like the problem is here:
https://github.com/Rollczi/LiteCommands/blob/master/litecommands-bungee/src/dev/rollczi/litecommands/bungee/BungeeCommand.java
Instead of setting a permission, we pass "", so BungeeCord sends this command to all players

[BlackBaroness]

According to a source code of bungee, if we set a permission correctly, bungee will filter out the command from a tab complete response:
https://github.com/SpigotMC/BungeeCord/blob/36e61543036703a1136aaa977194ca5a06e565ea/proxy/src/main/java/net/md_5/bungee/connection/DownstreamBridge.java#L697

[BlackBaroness]

Actually, I think the root problem here is this part of our code:

    @Override
    public boolean hasPermission(CommandSender sender) {
        boolean isNative = commandSection.meta().get(Meta.NATIVE_PERMISSIONS);

        if (isNative || settings.isNativePermissions()) {
            return permissionService.isPermitted(new BungeeSender(sender), this.commandSection);
        }

        return super.hasPermission(sender);
    }

When native is off (and it is mostly off), we call super.hasPermission which always returns true, since we did not fill the permission field

[Koboo]

Just for documentation purposes, the same behaviour applies in Velocity:

https://github.com/Rollczi/LiteCommands/blob/master/litecommands-velocity/src/dev/rollczi/litecommands/velocity/VelocityCommand.java#L44

    @Override
    public boolean hasPermission(Invocation invocation) {
        boolean isNative = commandSection.meta().get(Meta.NATIVE_PERMISSIONS);

        if (isNative || settings.isNativePermissions()) {
            return permissionService.isPermitted(new VelocitySender(invocation.source()), this.commandSection);
        }

        return true;
    }

The whole nativePermissions implementation for Velocity and BungeeCord was added with #163