ВЕРСИИ (10)

Fixed an issue where the mod could not load on 26.1 and above due to an incorrect allowed version range.

# Changelog ## 2026-07-23 ### Added - **Heartbeat system**: Automatically starts when the API is enabled, calling `/health` every 30s to check connectivity; switches to 5s fast retry on failure, and reverts to 30s once restored. The heartbeat is bound to the API toggle – disabling the API stops it. - **Player logout reporting**: When a player leaves the game, a `POST /login/logout` request is sent, reporting `player_name`, `player_uuid`, `player_ip`, and `server_id`. This shares the `logLoginEvents` toggle with login events. - **Global `server_id` propagation**: All API requests (`/health`, `/whitelist/sync`, `/whitelist/entries`, `/login/log`, `/login/logout`) now forcibly carry `server_id`. If not configured, `"undefined"` is used as fallback. - **Warning for missing `server_id`**: When API mode is enabled but `serverId` is empty, a prominent warning is printed to the console, prompting the server owner to configure it. - **Singleplayer host player detection**: Added `isHostPlayer()` method; the owner of a singleplayer world is automatically allowed and detected via the `isSingleplayerOwner` API, with log entries marked as `[Host Login]`. - **Server-side translation preloading**: Translation files for `en_us` and `zh_cn` are preloaded at startup. Kick messages are translated server‑side based on the client’s language, so clients do not need the mod installed to see correct messages. ### Changed - **Removed `sendServerId` config option**: `server_id` is now always sent with every request; the `sendServerId` setting in the config file is deprecated. - **Removed `API_SEND_SERVER_ID` config option**: The relevant field and build code have been deleted from `Config.java`. ### Fixed - **Inverted `isValidForWriting` semantics**: Previously returned `!isActive || !canWrite || isExpired()`; corrected to `isActive && canWrite && !isExpired()`. - **Inverted `hasValidToken` semantics**: Previously returned `!isTokenVerified.get() || tokenInfo == null`; corrected to `isTokenVerified.get() && tokenInfo != null`. - **Inverted permission checks in sync operations**: Token permission checks in `syncWhitelist`, `addEntry`, `removeEntry`, and `logLoginEvent` were corrected from `hasValidToken() || tokenInfo.isValidForXxx()` to `!hasValidToken() || !tokenInfo.isValidForXxx()`. - **Inverted `getTokenStatus` logic**: The `hasValidToken()` condition was corrected from `true` to `!false`. - **Local singleplayer players being incorrectly blocked**: In `isAllowed()`, the initial `allowed` value was changed from `false` to `isHost`, so the singleplayer owner is no longer intercepted by the whitelist. - **`getPlayerIP` security enhancement**: No longer directly casts to `InetSocketAddress`; uses `instanceof` pattern matching, with fallback for `LocalAddress` (returns `<host>` for singleplayer/LAN), and returns `"unknown"` on exception. - **Blank logs during initialization**: Log writing and API login events now include an `isLoaded` guard, executing only after the whitelist has been fully loaded, preventing empty entries from being generated during mod initialization. ### Important - If you need to use the API functionality, please make sure to use backend version **2.1.0** or higher.

# Changelog ## 2026-07-23 ### Added - **Heartbeat system**: Automatically starts when the API is enabled, calling `/health` every 30s to check connectivity; switches to 5s fast retry on failure, and reverts to 30s once restored. The heartbeat is bound to the API toggle – disabling the API stops it. - **Player logout reporting**: When a player leaves the game, a `POST /login/logout` request is sent, reporting `player_name`, `player_uuid`, `player_ip`, and `server_id`. This shares the `logLoginEvents` toggle with login events. - **Global `server_id` propagation**: All API requests (`/health`, `/whitelist/sync`, `/whitelist/entries`, `/login/log`, `/login/logout`) now forcibly carry `server_id`. If not configured, `"undefined"` is used as fallback. - **Warning for missing `server_id`**: When API mode is enabled but `serverId` is empty, a prominent warning is printed to the console, prompting the server owner to configure it. - **Singleplayer host player detection**: Added `isHostPlayer()` method; the owner of a singleplayer world is automatically allowed and detected via the `isSingleplayerOwner` API, with log entries marked as `[Host Login]`. - **Server-side translation preloading**: Translation files for `en_us` and `zh_cn` are preloaded at startup. Kick messages are translated server‑side based on the client’s language, so clients do not need the mod installed to see correct messages. ### Changed - **Removed `sendServerId` config option**: `server_id` is now always sent with every request; the `sendServerId` setting in the config file is deprecated. - **Removed `API_SEND_SERVER_ID` config option**: The relevant field and build code have been deleted from `Config.java`. ### Fixed - **Inverted `isValidForWriting` semantics**: Previously returned `!isActive || !canWrite || isExpired()`; corrected to `isActive && canWrite && !isExpired()`. - **Inverted `hasValidToken` semantics**: Previously returned `!isTokenVerified.get() || tokenInfo == null`; corrected to `isTokenVerified.get() && tokenInfo != null`. - **Inverted permission checks in sync operations**: Token permission checks in `syncWhitelist`, `addEntry`, `removeEntry`, and `logLoginEvent` were corrected from `hasValidToken() || tokenInfo.isValidForXxx()` to `!hasValidToken() || !tokenInfo.isValidForXxx()`. - **Inverted `getTokenStatus` logic**: The `hasValidToken()` condition was corrected from `true` to `!false`. - **Local singleplayer players being incorrectly blocked**: In `isAllowed()`, the initial `allowed` value was changed from `false` to `isHost`, so the singleplayer owner is no longer intercepted by the whitelist. - **`getPlayerIP` security enhancement**: No longer directly casts to `InetSocketAddress`; uses `instanceof` pattern matching, with fallback for `LocalAddress` (returns `<host>` for singleplayer/LAN), and returns `"unknown"` on exception. - **Blank logs during initialization**: Log writing and API login events now include an `isLoaded` guard, executing only after the whitelist has been fully loaded, preventing empty entries from being generated during mod initialization. ### Important - If you need to use the API functionality, please make sure to use backend version **2.1.0** or higher.

# CWhitelist Changelog ## v3.0 - 2026-01-18 ### Fixes #### 🐛 API Sync Fix - Fixed `api sync` command using cache instead of refreshing - Added forced refresh mechanism to ensure latest data is fetched #### 🔤 Translation System Fix - Fixed translation keys showing as key names instead of translated content - Optimized translation file paths and formats #### 🔧 Version Compatibility Fix - Fixed compatibility issues on Minecraft 1.21.10 and newer versions - Ensured command system works properly in new versions ### Update Recommendation All users are recommended to upgrade to this version, especially administrators using API integration features.

# CWhitelist Changelog ## v2.1 - 2026-01-17 ### 🔧 New Features #### API Token Authentication System - **Complete Token Authentication Support**: Added secure token authentication mechanism for API servers - **Dual Authentication Methods**: - **Header Authentication**: Authenticate via `Authorization: Bearer <token>` header (Recommended) - **Query Parameter Authentication**: Authenticate via `?token=<token>` query parameter - **Permission Validation**: Automatically verify token read/write/delete/management permissions - **Token Expiration Detection**: Real-time token validity checks with automatic handling of expired tokens #### Enhanced Permission Management - **Granular Permission Control**: - `can_read`: Read permission for synchronizing whitelist - `can_write`: Write permission for adding entries and logging events - `can_delete`: Delete permission for removing entries - `can_manage`: Management permission for system administration - **Smart Permission Verification**: Automatically validates required permissions based on operation type - **Clear Permission Feedback**: Detailed permission error messages #### Token Status Management - **Token Verification Command**: Added `/cwhitelist api verify` command to validate token effectiveness - **Status Information Display**: Detailed token information shown in `/cwhitelist api status` - **Automatic Verification**: Tokens are automatically verified on server startup ### ⚙️ Configuration Updates #### New Configuration Options ```toml [api] # Basic Authentication Configuration token = "your-api-token-here" # API authentication token useHeaderAuth = true # Authentication method (true:header/false:query parameter) # Optional Configuration serverId = "" # Server identifier (optional) sendServerId = false # Whether to include server ID in requests includeExpired = false # Whether to include expired entries ``` #### Configuration Change Notes - **Backward Compatible**: Existing configurations require no changes, new options have reasonable defaults - **Security Recommendation**: Strongly recommend using Header authentication for better security ### 🎮 Command Extensions #### New API Management Commands | Command | Description | Permission | |---------|-------------|------------| | `/cwhitelist api verify` | Verify API token validity | OP (2) | | `/cwhitelist api status` | Display detailed API and token status | OP (2) | #### Enhanced Commands - **`/cwhitelist api health`**: Added network error handling and timeout control - **`/cwhitelist api sync`**: Enhanced permission validation, only tokens with read permission allowed - **All API-related operations**: Now require valid token authentication ### 🔒 Security Improvements #### Authentication Security - **Secure Token Storage**: Tokens stored only in configuration files, not hardcoded - **Secure Communication**: Two authentication methods to meet different security needs - **Permission Isolation**: Operation scope limited based on token permissions #### Error Handling - **Authentication Failure Handling**: Automatic fallback to local mode ensuring service availability - **Clear Error Messages**: Detailed permission and authentication failure notifications - **Logging**: Records all authentication attempts and permission checks ### 📊 Performance Optimizations #### Smart Caching - **Token Verification Cache**: Reduces duplicate token validation requests - **Permission Caching**: Caches token permission information for faster verification - **Intelligent Refresh**: Automatically re-validates tokens upon expiration #### Network Optimization - **Connection Reuse**: HTTP client connection reuse reduces connection establishment overhead - **Timeout Control**: Configurable timeout settings prevent long blocks - **Queue Management**: Optimized request queues to avoid concurrency issues ### 📋 Change Summary #### Core Changes 1. **API Client Refactor**: Rewrote `ApiClient` class to support token authentication 2. **Token Information Model**: Added `TokenInfo` class to manage token data and permissions 3. **Authentication Header Management**: Simplified to single token configuration, replacing complex header lists #### Configuration Simplification - **Removed**: `API_AUTH_HEADERS` configuration option - **Added**: `API_TOKEN` single token configuration - **Optimized**: More intuitive authentication method selection #### User Experience - **Status Display**: More detailed token and permission information - **Error Notifications**: More user-friendly permission denial messages - **Operation Feedback**: Real-time authentication status feedback ### 🐛 Known Issues - None - This version is a feature enhancement release with no bug fixes --- **Update Recommendation**: Strongly recommended for all server administrators requiring API integration, providing a more secure and flexible authentication mechanism. **Technical Support**: For upgrade issues, please refer to documentation or seek assistance through GitHub Issues.

Increase module priority, while modifying whitelist data reading to asynchronous loading and adding whitelist data cache

Added multilingual support (currently only supports English and Simplified Chinese) Add switch function for whitelist system check items (modified in configuration file) Fixed the control issue of the log system in the configuration file

first update（this version have some mistakes, please use the newest version instead this)