ВЕРСИИ (32)

version parity to paper, no changes.

just a few bug fixes on spawn related issues

### Improvements * Added `/auth changepassword <player> <newPassword>` and `/auth setpassword <player> <newPassword>` to proxy commands, allowing network staff to reset player passwords directly with real-time notification to the player if online. * Added `peyajauth.changepassword.admin` check alongside `peyajauth.admin`, allowing server owners to grant password management privileges to moderators without giving full root admin permissions. * Added configurable password complexity requirements (`password.require-number`, `password.require-uppercase`, and `password.require-lowercase`) across `/register`, `/changepassword`, and `/auth changepassword` to match Paper parity. * Resetting a password administratively now invalidates stored session tokens and expiry dates so players are forced to log in with their new credentials.

### Improvements * Added `/auth changepassword <player> <newPassword>` and `/auth setpassword <player> <newPassword>` for server administrators. Staff can now reset player passwords directly from the console or in-game without needing the previous password. * Resetting a player's password now immediately clears active session tokens and expiration timers, preventing compromised sessions from staying auto-logged in. * Enhanced login spawn handling to dismount players from vehicles and wake sleeping players prior to auth teleportation, avoiding vehicle duplication or position desyncs.

### Fixes - Fixed Floodgate Bedrock checks to use official API validation, preventing prefix spoofing and account takeovers. - Fixed database error handling across proxy auth commands so database outages fail safely. - Fixed two-factor authentication on Velocity proxies so 2FA codes are verified directly during proxy login. - Fixed logout command to de-authenticate players on backend servers and return them to the limbo waiting room. - Fixed brute-force protection to track failed attempts and disconnect players who exceed limits. - Fixed duplicate listeners to resolve command conflicts and allow disconnect for unauthenticated players. - Fixed title display timings so fade-in, stay, and fade-out durations are properly applied. - Fixed prompt spam by removing redundant limbo auth reminders and accurately distinguishing premium accounts. ### Improvements - Added support for session duration and remember-login settings from proxy configuration. - Added startup warnings when the auth bridge secret is left empty. - Improved login command concurrency to prevent race conditions during rapid authentication attempts. - Improved captcha generation by using a cryptographically secure random generator.

### Fixes - Fixed database error handling across all auth commands so database connection drops fail safely instead of allowing unauthenticated access. - Fixed database upsert queries to properly save offline UUID bindings during account updates. - Fixed two-factor setup to keep secrets strictly local rather than sending them to third-party QR generators. - Fixed Argon2 password verification to read algorithm parameters directly from stored hashes. - Fixed LuckPerms permission cloning between offline and online accounts by using public API interfaces. - Fixed console logging for sensitive commands to strip passwords cleanly without causing logger recursion crashes. - Fixed Bedrock and Java name collisions to protect registered Java accounts from unauthenticated Bedrock takeovers. - Fixed placeholder requests so they read from local memory caches rather than performing blocking database reads on the main thread. ### Improvements - Improved Folia support (it was half baked last time, not really reliable) - Improved database lookup performance with case-insensitive indexing and automatic migration for existing SQLite databases. - Added startup warnings when the auth bridge secret is left empty. - Improved console logging to show clear success messages only when players successfully log in or register.

### Changes * discord webhook notifications across your proxy for registrations, logins, failed attempts, brute-force lockouts, password changes, 2FA setup, and admin commands. * performance improvements * some bug fixes on importing data from other auth plugin

### Changes * discord webhook notifications for player registrations, logins, failed attempts, brute-force lockouts, password changes, 2FA setup, and admin commands. * performance improvements * fixed some bugs on importing data from other auth plugins

### Connection Fixes * Verified premium (online-mode) players now bypass the internal Limbo server. * Added active server connection deduplication in redirect routines to prevent redundant server switch requests. * Fixed an issue where players with an existing premium account were blocked by `/premiumverify` with an incorrect password prompt. * Minecraft 26.3 Support ### Security Hardening * Intercepted incoming PluginMessageEvent to drop any client-injected packets from cheat clients, preventing forged proxy authentication bypasses. * Added HMAC-SHA256 signatures with timestamp expiration to proxy-to-server auth sync packets. * Removed unsafe auto-authentication of offline-mode players in Limbo when matching a premium username. Offline players attempting to access premium accounts are strictly required to verify ownership via `/premiumverify`. * Denied Bedrock auto-bypass if an existing account exists in the database with a non-matching UUID, protecting both premium and cracked accounts from being hijacked.

### Dependencies & Version * Updated PacketEvents to 2.14.0 * Minecrart 26.3 Support ### Security Improvements * Implemented HMAC-SHA256 signature checks on incoming proxy auth bridge packets. Forged packets from cheat clients are rejected and logged. * Enforced player connection matching on incoming bridge packets to ensure a client connection cannot forge authentication for a different player. ### Bedrock & Floodgate Fixes * Added UUID bitmask checks so Floodgate players are detected even if Geyser's username prefix is empty (""). * Prevented authentic Mojang UUIDs from ever being overwritten by Bedrock UUIDs during name collisions. ### Network * Mojang API timeouts now display a clean, informative single-line warning instead of dumping long Java SSL stack traces when server hosts experience outbound network latency. * Prevented ghost packet handler errors when players disconnect while waiting for slow upstream API lookups. ### Fixes * If an admin runs `/auth unregister` on a premium or Bedrock account, the plugin cleanly recreates the account and auto-logs them in on their next join.

### Velocity Commands Polish * I forgot to load other commands for velocity, only reg and login was loaded, so now its fix thanks to Crisopeo for reporting!

### Bedrock & Floodgate Fixes * Bedrock players joining with the same username as a premium Java player won't get kicked with encryption/session errors anymore. The server detects Bedrock clients before the handshake and skips Java RSA encryption. ### Also * support for **Folia**

### changelogs * made it a 10-second looped chat reminders for the interactive `[ YES ]` and `[ NO ]` clickable buttons for idle unregistered players. * synchronized proxy session protocols and database schemas with the Paper 1.6.7 release.

### changelogs - improved handshakes

### Added * **Velocity Forced-Hosts Support**: Added `proxy.follow-forced-hosts` in `config.yml` (enabled by default). When players join using domain subdomains mapped in Velocity's `[forced-hosts]` (e.g. `survival.example.com`), they authenticate in Limbo and are automatically sent straight to `survival` upon login instead of the generic lobby! * **Custom Auth Lobby Server Option**: Added `limbo.enabled: false` and `limbo.auth-server` in `config.yml` allowing networks to route unauthenticated players to a dedicated Paper lobby instead of the virtual Limbo void. ### QoL fixes * **Disconnect Safety**: Added automatic memory cleanup for intended destination servers upon player disconnect.

### New Features & Database Migration * **Multi-Hash Algorithm Support**: Added automatic verification for legacy password formats from other plugins / custom databases: * **Plain Hex SHA-256** (raw 64 hex characters) * **Double SHA-256** (`hex(sha256(sha256(password)))`) * **AuthMe SHA-256** (`$SHA$<salt>$<hash>`) * **AuthMe MD5** (`$MD5$<salt>$<hash>`) * **Plain & Double MD5** (32 hex characters) * **Plain SHA-512** (128 hex characters) * **Database Converter**: Added `/auth import <file.db>` (also accessible via `/auth migrate <file.db>`). Automatically scans user tables, extracts usernames, password hashes, IPs, and emails, and batches them directly into peyajAuth with live progress logging.

### Features * **Custom Auth Lobby Support**: Added `limbo.enabled` (default `true`) and `limbo.auth-server` (default `"auth"`) in `config.yml`. Networks can now choose between the built-in virtual void Limbo or routing unauthenticated players to their own dedicated Paper auth lobby server. ### Localization & Parity * **Ukrainian Language Support**: Added full Ukrainian translation (`messages_uk.yml`) for proxy prompts, errors, and titles with automatic client locale detection (`uk`). *(Thanks to [binraptor!](https://github.com/binraptor))*

### Bug Fixes * **Bedrock & Premium Ghost Mode Fix**: Fixed an issue where Bedrock (GeyserMC) players and auto-logged in players (Premium/Session) experienced player visibility desyncs when Ghost Mode was active. Ghost Mode now strictly applies only to unauthenticated cracked players undergoing `/login` or `/register`. * **Client Entity Resync**: Added an automatic delayed entity visibility sweep upon login to ensure Bedrock clients properly restore player rendering without cache desyncs. ### Features & Localization * **Ukrainian Language Support**: Added full Ukrainian translation (`messages_uk.yml`) with automatic client locale detection (`uk`). *Thanks to [binraptor!](https://github.com/binraptor))*

# peyajAuth Velocity 1.6.4 ### New Features * **Proxy ➔ Paper Auth Bridge (IMPROVED)**: improved the `peyajauth:auth_bridge` plugin messaging pipeline to automatically forward authentication and premium states to backend Paper servers in real-time. Eliminates double-authentication across the entire network. * **Multi-Language (i18n)**: Added automatic client locale detection with built-in translation bundles for English (`en`), Spanish (`es`), Russian (`ru`), and Chinese (`zh`). ### Bug Fixes & Security * **Account IP Lock Wildcard Fix**: Fixed an issue where wildcard patterns (e.g., `10.0.0.*` or `192.168.*`) were treated as literal text instead of wildcards. * **CIDR Subnet Validation**: Added bitmask-based network subnet validation for Account IP locks supporting IPv4 (`10.0.0.0/24`, `172.16.0.0/12`) and IPv6 (`2001:db8::/32`).

### New Features * **Proxy ➔ Paper Auth Bridge (IMPROVED)**: improved synchronizing authentication states directly from Velocity. Cracked and premium players authenticate once at the proxy gateway and never need to re-login on backend servers. * **Ghost Mode**: Added `restrictions.ghost-mode` (disabled by default) to make unauthenticated players completely invisible to authenticated players and vice versa, eliminating spawn clutter and preventing client rendering lag during bot attacks. * **Spawn Teleportation & Return**: Added `spawn.enabled` and `spawn.teleport-back-on-login` (enabled by default) to teleport players to a dedicated login spawn and return them to their exact previous location upon successful `/login`. Includes `/peyajauth setauthspawn` command. * **Multi-Language**: Added automatic client locale detection with built-in translation bundles for English (`en`), Spanish (`es`), Russian (`ru`), and Chinese (`zh`). ### Bug Fixes & Security * **Account IP Lock Wildcard Fix**: Fixed an issue where wildcard patterns (e.g., `10.0.0.*` or `192.168.*`) failed to match dynamic IPs due to regex escaping. * **CIDR Subnet Validation**: Added native bitmask-based network subnet validation for Account IP locks supporting IPv4 (`10.0.0.0/24`, `172.16.0.0/12`) and IPv6 (`2001:db8::/32`).

### Bug Fixes * **Adventure API Version Conflict Fix**: Resolved a critical `NoSuchMethodError` related to `Title.Times.of(...)` that would cause players to disconnect upon joining. This occurred when running the plugin on newer Velocity versions (e.g., Velocity 4.1.0 Snapshot) that use Kyori Adventure 4.17.0+ where the old method was removed. * **Title API Refactor**: Refactored the title display logic to use a version-agnostic implementation, ensuring 100% compatibility across all older and newer Velocity versions. ### Features * **Configurable Messages & Prefixes**: Added full support for customizing all plugin messages (prompts, errors, kicks, captchas, etc.) via `messages.yml` using the MiniMessage format. A configurable `prefix` setting has also been added, which can be injected dynamically into any custom title or message using the `{prefix}` placeholder! * **Live Reload Command**: Added the `/peyajauth reload` administrative command to instantly apply `config.yml` and `messages.yml` changes without requiring a proxy restart.

### Updates * **Configurable Messages & Prefixes**: Added full support for customizing all plugin messages (prompts, errors, kicks, captchas, etc.) via `messages.yml` using the MiniMessage format. A configurable `prefix` setting has also been added, which can be injected dynamically into any custom title or message using the `{prefix}` placeholder! * **Dialog UI**: added an optional support for custom dialogs gui/screen **NOTE**: only minecraft clients version 1.21.6 above have support on dialog ui, below this version would always use default login/register (chat)

* fixed misconfiguration of `floodgate-auto-bypass` setting in `premium.yml`. it still has issues of 26.2 below client version would get network protocol error, no eta for fixing the issue yet.

# peyajAuth-Paper v1.6.2 * Fixed LuckPerms data pre-load disconnections.

# peyajAuth-Velocity v1.6.1 peyajAuth-Velocity v1.6.1 introduces a zero-dependency Embedded Void Limbo Server, automated Schematic NBT Normalization to prevent startup crashes, robust Lobby Redirection for auto-login players, and premium visual screen titles. --- ### Built-in Zero-Dependency Void Limbo Server * Native Limbo: Velocity installations now spin up their own virtual void limbo server locally (127.0.0.1) on a dynamically allocated port. * No API Required: Everything runs out of the box. * Void Dimension: Unauthenticated connections spawn in a customizable void platform (using a standard Sponge .schem file). ### Seamless Lobby Redirection * Direct Join: Auto-login session resumes and verified premium connections now bypass the limbo server entirely and connect straight to the lobby server. * Clean Handshake: Solves the initial connection racing condition where auto-login players were left stranded inside limbo. ### Visual Titles and Clean UI * Looping Titles: Unregistered players will see a repeating screen Title reminder asking them to select their registration mode. * Clean Chat: Removed bulky border lines from chat messages. Clickable YES/NO buttons are sent once on join to prevent chat spam, while the Title loops to keep the instruction clear. * Connection Buffering: Delays prompts by 2 seconds after the player successfully establishes their backend connection, ensuring messages are never lost during loading screens.

# peyajAuth-Paper v1.6.1 peyajAuth-Paper v1.6.1 aligns database structures, session sync hooks, and security integrations with the unified v1.6.1 protocol. --- ### Unified Session Synchronizer * Proxy Alignment: Handshake queries and database schema alignments ensure backend Paper servers receive the correct session authorization packets from the Velocity gateway. * Data Integrity: Asynchronous SQLite/MySQL threads guarantee zero-thread main lag when writing or verifying player sessions. ### Compilation and Library Upgrades * Version Alignments: Recompiled dependencies and shared libraries to fully support the v1.6.1 release schedule.

# v1.6.0 Changelog peyajAuth v1.6.0 introduces powerful advanced security features, including Two-Factor Authentication (2FA), recovery email confirmation codes, packet-based inventory hiding, independent login/registration timeouts, and native compatibility updates for Minecraft 26.2 and Java 25. --- ## Key Highlights ### Google Authenticator Two-Factor Authentication (2FA) * **TOTP Security**: Players can now secure their accounts using standard Google Authenticator or Authy apps. * **Restricted State**: Players with 2FA enabled are kept restricted (unable to move, execute commands, use chat, or see their inventory) even after inputting their password correctly, until they execute `/2fa verify <code>`. * **Admin Bypass**: Operators can force-disable 2FA for a player who lost access to their authenticator device using `/auth 2fa disable <player>`. ### Linked Recovery Emails with SMTP Verification * **Linked Accounts**: Players can link a recovery email address to their account to facilitate password resets. * **Verification Codes**: Adding or changing an email address dispatches a random 6-digit confirmation code to the email. The player must run `/email confirm <code>` in-game within 5 minutes to finalize the change. * **Local Fallback**: If SMTP is disabled or connection fails, the plugin automatically falls back to local in-game verification (`/email confirm` without a code), ensuring no broken features. ### Packet-Based Inventory Hiding * **Visual Privacy**: Unauthenticated players see an empty inventory screen client-side, preventing item leakage. Normal inventory contents are safely restored sync on the main thread upon successful login. ### Separate Login & Registration Timeouts * **Dynamic Timeouts**: Replaced the single timeout setting with two separate configurations: `login-timeout` and `register-timeout`. * **Better UX**: Allows administrators to give new players more time to register passwords while enforcing strict, faster timeouts on existing players logging in. ### Minecraft 26.2 & Java 25 Support * **PacketEvents 2.13.0**: Upgraded PacketEvents dependency to resolve startup class mapping conflicts on Minecraft 26.2 servers. * **Cross-Version Compatibility**: Shaded dependency libraries (including Adventure API) directly into the JAR without relocation, allowing the plugin to run natively on both Minecraft 1.21.x (Java 21) and Minecraft 26.2 (Java 25) servers. --- ## Commands & Permissions Reference * `/2fa <setup|confirm|disable|verify>` - Manage Google Authenticator settings (Default: Everyone). * `/email <add|change|remove|confirm|show>` - Manage recovery email links (Default: Everyone). * `/auth 2fa disable <player>` - Disable 2FA for a player (Default: OP, Permission: `peyajauth.admin`).

# v1.5.3 Changelog peyajAuth v1.5.3 introduces significant performance optimizations, automated database backups, and asynchronous chunk-loading teleportations to deliver a flawless, high-performance authentication experience. --- ## Key Highlights ### Zero-Lag Salted SHA-256 Hashing (New Default) * **Instant Logins**: Replaced the heavy default Argon2id settings with an ultra-fast, hardware-accelerated **Salted SHA-256 Hasher**. * **0% CPU Starvation**: Password verification now executes in **0.1 milliseconds** (1000x faster than BCrypt/Argon2), preventing CPU starvation and eliminating command login lag spikes. * **Seamless Migration**: Built-in automatic format detection verifies existing BCrypt or Argon2id hashes flawlessly without breaking current player account data. ### Automated SQLite Database Backups * **GZIP Compression**: Automatically copies your SQLite database file (`auth.db`) and compresses it into a GZIP archive (`.db.gz`), keeping backups extremely small (only a few KB). * **Async Scheduler**: Scheduled tasks run asynchronously in the background at startup and on a configurable interval (default: every 24 hours), avoiding main server thread ticks. * **Auto-Cleaning Retention**: Automatically keeps only the newest backup files (default: 7), cleaning up older files to save disk space. ### Asynchronous Teleportation (teleportAsync) * **Eliminate Spawn Lag**: Upgraded spawn lobby teleportations and position restorations from synchronous calls to Paper/Spigot's non-blocking **`teleportAsync`** API. * **Smooth Chunks**: Offloads chunk generation and loading to background threads when players join or log in, ensuring 20.0 TPS is maintained. --- ## Config & Defaults Updates * **Remember-Login**: Disabled by default (`enabled: false`) to avoid unnecessary pre-login database lookups. * **Session Timeout**: Lowered default session timeout to `5m` (down from `30m`). * **Premium Skin Caching**: Added local cache `skinCache` for skin properties inside `MojangService` to prevent repeated Mojang API network lookups. Turned `fetch-premium-skins` to `false` by default to avoid connection queues. * **Non-Blocking History Logs**: Removed blocking `.join()` statements from database logging operations. * **Live Config Reloads**: All configurations (sessions, update checker, database backups) reload instantly via `/auth reload` without requiring a reboot.

# v1.5.2 Changelog ### Added * Added support for visual on-screen titles and subtitles during the authentication phase (prompts players dynamically to login/register). * Added a blindness potion effect restriction for unauthenticated players to blank out the world and secure coordinates/builds prior to authentication. * Added support for disabling the login timeout kick entirely by setting "login-timeout" to 0 or -1 in the configuration. * Added a dedicated "session-resume" message configuration key for custom message display on session recovery. ### Optimized * Optimized connection handshake performance by caching NMS packet constructors and lazily caching NMS network manager encryption methods, eliminating runtime reflection search overhead during player join spikes.

# v1.5.1 Changelog ### Added * Integrated bStats metrics tracking to monitor active server installations and player counts in real time (relocated to prevent library conflicts with other plugins). * Added dynamic bStats indicators to documentation. ### Fixed * Fixed a pipeline decryption issue where premium connections on modern Minecraft versions (1.20.5 / 1.21 / 26.x) got disconnected with a "CorruptedFrameException: Frame length cannot be zero" error. The plugin now reflectively injects the NMS ServerboundHelloPacket directly to the packet handler, bypassing the Netty cipher and preventing packet scrambling. * Fixed a vulnerability where cracked connections could attempt to spoof premium player UUIDs during login. The connection is now strictly terminated immediately if session verification fails to return a valid Mojang authentication state.

# peyajAuth v1.5 - Changelog peyajAuth v1.5 is a major release featuring a complete overhaul of the packet interception layer, smooth gameplay restrictions, and significant security hardening. --- ## Key Highlights ### ProtocolLib Removal and PacketEvents Migration * **Zero-Dependency Standalone Build**: Migrated the entire packet interception layer from ProtocolLib to PacketEvents 2.12.0. * **Reduced Maintenance Overhead**: Eliminates the risk of startup crashes during minor Minecraft protocol changes. * **Fully Shaded**: PacketEvents is now shaded and relocated inside peyajAuth.jar — ProtocolLib is no longer required. ### Smooth Freeze Mechanics (No More Jitter!) * **Horizontal Walk/Fly Speed Lock**: On join, unauthenticated players now have their walking and flying speeds locked to 0.0f. This blocks the client-side physics engine from attempting movement, completely eliminating horizontal rubber-banding. * **Horizontal-Only Position Lock**: Position resets now lock X and Z coordinates only. Target Y coordinates are preserved, allowing gravity, falling, and jumping to simulate smoothly without server-reset twitching. * **Speed Cache Restorations**: Original player speeds are recorded and restored seamlessly upon successful authentication (safely falling back to default values). ### Strict Premium Verification and Takeover Protection * **Strict Online Mode Enforcement**: Any player connecting with a username marked as isPremium in the database is strictly forced to complete Mojang's cryptographic encryption handshake. * **Anti-Spoofing and Bypass Block**: Premium players can no longer fall back to cracked mode (even if allow-premium-usernames is enabled) or bypass verification. * **Outage Takeover Protection**: If Mojang authentication servers go down, any connection attempt for a registered premium account is kicked immediately rather than falling back to cracked mode, preventing takeover attempts while authentication is offline. * **Decryption Hardening**: If the client sends a malformed or tampered encryption response, the connection is instantly disconnected rather than falling back to cracked. ### Secure Proxy Tracking * **Unique Netty Channel Keys**: Replaced IP-based state tracking with unique Netty Channel ID long text hashes (channel.id().asLongText()). This uniquely identifies the exact TCP socket connection, preventing state collisions or state poisoning when running behind BungeeCord/Velocity proxies where ports are recycled. ### Username Format Validation * **SSRF and Malformed Request Protection**: Added regex-based username validation (^[a-zA-Z0-9_]{2,16}$) immediately after receiving the LoginStart packet. Connections with malformed usernames are dropped before triggering any Mojang API or database operations. --- ## Internal Refactoring and Fixes * **RSA Key Hardening**: Ephemeral RSA keys generated on server startup have been upgraded from 1024 to 2048 bits.

# peyajAuth v1.4 Changelog peyajAuth v1.4 introduces updates to auto-login detection, Bedrock player compatibility, skin restoration, and API integrations for Spigot, Paper, and Folia (1.21+). ## Key Features & Enhancements * **Hybrid Auto-Login**: The plugin now intercepts the connection during the LoginStart phase to compare the client-provided UUID against Mojang's database. Premium clients will auto-login, while cracked clients using premium names will bypass encryption and be prompted for a password instead of being kicked with an "Invalid Session" error. * **Bedrock Temporary Player Fix**: Resolved a critical "UnsupportedOperationException: getUniqueId is not supported for temporary players" by refactoring the Floodgate connection checks to use reflective Netty ChannelPipeline checks during early login stages. * **Bedrock Player Prefix Restoration**: Fixed conflicts where external skin-rendering plugins (like SkinsRestorer) strip Bedrock name prefixes (e.g. ".") during join. The plugin caches and restores the prefixed player profile. * **Offline Premium Skin Retention**: Added dynamic online skin fetching. If cracked/offline players connect using a premium username, the plugin will fetch their skin from Mojang session servers and apply it to their cracked profile automatically. * **Outage Fallback Policies**: Added configurable behaviors during Mojang API outages (defaulting to kicking the player to protect their credentials). * **API Extensions**: Added the "isBedrockPlayer(Player player)" method to the public PeyajAuthAPI interface. ## Security Fixes * **Premium Account Impersonation Protection**: Fixed a critical vulnerability where a cracked player joining with a premium username could be automatically logged in as the premium account owner due to the account cache incorrectly marking their connection as premium. * **Session Hijack Prevention**: Session auto-login now verifies the connecting player's UUID matches the stored offline or premium UUID. Previously, only IP was checked — meaning an impersonator on the same network (LAN, VPN, shared WiFi) could inherit the real player's active session. * **Registration Race Condition Fix**: Registration now uses atomic database inserts (INSERT IGNORE) instead of upserts (ON CONFLICT UPDATE) to prevent a race condition where a cracked impersonator's registration could silently overwrite an existing premium account's password hash and data. * **Brute Force Lock Scope Fix**: Account-level brute force locks no longer block players at the pre-login stage. They are now enforced only at the /login command level, so a real premium player can still join and auto-login via the encryption handshake even if an impersonator triggered the account lockout by spamming wrong passwords. * **Correct Password Bypass on Account Lock**: If an account is locked due to brute force attempts by an impersonator, the real account owner can still log in by entering the correct password. Wrong password attempts while locked will show the lock message, but correct passwords will always succeed and reset the lock. This ensures legitimate cracked players are never locked out of their own accounts. ## Configuration Additions (premium.yml) New settings inside premium.yml: ```yaml # Fallback behavior when Mojang API is offline mojang-outage: # Options: # 'crack' - Treat premium players as cracked and force them to register/login with a password. (Safe) # 'kick' - Kick premium players when Mojang API is down. (Default) fallback: kick kick-message: "<red>Mojang authentication servers are currently down. Please try again later." # Settings for cracked/offline players connecting with premium usernames cracked-players: # Allow cracked players to connect using premium usernames. # If true, the server detects if the client UUID matches the premium UUID. # Real premium players will bypass login automatically, while cracked players will bypass encryption # and be prompted to register/login (preventing "Invalid Session" kicks). # If false, the server enforces encryption for all premium usernames (cracked connections will fail to join). allow-premium-usernames: true # Fetch and apply the real premium player's skin textures to the cracked player's profile on join. # (Requires 'allow-premium-usernames' to be true). fetch-premium-skins: true