# PureAuth 6.3.1 ## Authentication and sessions - Reconnect sessions require matching IP and identity, an unexpired lifetime and current account security settings. Legacy session records cannot grant automatic access. - Password, PIN, 2FA and recovery changes invalidate previous trust. Administrative changes and password recovery require fresh authentication; an owner changing their own settings may retain the current connection. - Active accounts are checked periodically so a security change on another backend cannot leave old access active indefinitely. - The connection deadline covers password login, PIN, 2FA and mandatory Admin Guard setup. Closing a GUI or entering another stage does not remove the deadline. ## Proxy synchronization and Redis - Fixed the PIN window remaining open after an authenticated player switches from the lobby to another backend. Valid synchronization closes the required login window without marking login as interrupted; delayed window opening or an earlier PIN result cannot bring it back. - Streamlined completion of valid synchronization while retaining signature, security freshness, account-lock, Fair Play and mandatory Admin Guard checks. Voluntary PIN setup and change windows remain separate operations. - Backend login synchronization now requires signed confirmations and the same shared secret on every backend and proxy. - Confirmations are tied to the player, current connection, current account security settings and a short validity period. Old, replayed and unsigned messages cannot grant access. - Improved initialization and valid synchronization handling so a signed response is not blocked by concurrent player-join preparation. - Improved username reservation maintenance: abandoned connection attempts are not renewed indefinitely, and rejected duplicates cannot release the real player's reservation. - Reservation ownership is checked again when a connection completes. An unavailable required Redis or database denies admission instead of bypassing protection. - Improved Velocity YAML configuration handling and cached editable messages on both proxies. ## Recovery - Recovery failures and penalty history survive reconnects and restarts. Stages share history with incorrect-login penalties. - Password recovery removes a forgotten PIN, revokes previous sessions and requires reconnection. Existing 2FA remains required. - A previously verified answer cannot overwrite a newer security change. Password replacement and PIN removal are one operation; a failed write does not announce success. - Administrative unlock also clears the recovery-answer failure counter. ## TOTP, backup codes and Admin Guard - Fixed an intermittent disconnect immediately after the owner correctly removed 2FA. External security resets and account locks still revoke access. - New TOTP secrets provide 160 bits; existing compatible secrets remain supported. - Strengthened secret and six-digit code validation while retaining standard 30-second TOTP app windows. - Enabling 2FA stores the secret, enabled state and entire backup-code set together. Concurrent or stale updates cannot overwrite newer security settings. - Backup-code recovery can succeed only once even with simultaneous requests across instances. It disables the previous 2FA setup and invalidates its entire previous code set. - Admin Guard withholds full authentication until required 2FA has been correctly confirmed and saved. - Wrong codes and failed writes cannot release protection. The ordinary removal command cannot disable mandatory 2FA. - Backup recovery by an already authenticated administrator restricts the account again until a new mandatory 2FA setup is complete. ## Registration and persistence - Per-IP limits and account creation are checked atomically in the shared database. Simultaneous registrations cannot bypass the limit through concurrent reads. - Player responses distinguish an IP limit, an existing account and a storage failure. - Enforced BCrypt's 72-byte UTF-8 input limit to prevent silent truncation of overlong values. - Failed and stale security writes cannot announce success or grant authentication. ## Performance and spam limits - Fixed waiting for an earlier PIN attempt after valid synchronization: an obsolete attempt no longer holds up new commands. Other limits and protection against parallel authentication attempts remain effective. - Bounded database, cryptography and network work queues. Saturation does not move expensive work onto the server's main thread. - Each player can perform one authentication operation at a time; rapidly repeated commands do not multiply concurrent attempts. - Added `performance.request_interval_ms`, defaulting to 250 ms. Thread counts, queue sizes and this interval require a full restart. - Disconnecting cancels queued work for that connection. Old callbacks cannot erase a newer connection's request state. - Expensive administrative operations and auditing run outside the main thread. Improved overload handling and rate-limited repeated warnings. - Limited pending Discord webhooks to 16, with a 5-second request timeout. Excess notifications are dropped; webhooks are not guaranteed event storage. - Added missing Discord notifications for registration, Premium enable/disable and successful module startup. Account-change events follow successful saves; rejected attempts do not announce success. Category switches and delivery limits remain effective. - Added editable English and Polish `authentication_wait` and `authentication_busy` messages. ## Visibility and pre-login protection - Fixed inventory dragging during Fair Play Guard inspections when inventory restrictions are enabled. Both clicks and dragging are restricted according to configuration and inspection state. - Inventories remain on players during Ghost Mode instead of being cleared and restored from a second item copy. - Fixed visibility for players joining in different orders and restoration of previous collision and blindness state. - Expanded pre-login restrictions to attacks/projectiles, pickups, entity interactions, inventory dragging, hand swaps, portals, consumption and mounting. - The required PIN GUI remains available for authentication without unlocking other world interactions. ## Command completion - Fixed missing TAB subcommand suggestions for `/pureauth` and its `/pa` alias. - Suggestions respect permissions and the typed prefix without case sensitivity. Location and Fair Play arguments are completed, with visible online player names where a command expects a player. - Password/PIN fields, unknown commands and missing permissions no longer fall back to player-name suggestions. The console-only `stats` command is suggested only to the console. ## Configuration, messages and logs - Fixed exposure of repeated passwords/PINs in extra arguments on malformed administrative commands: every argument from the secret position onward is redacted. - Fixed acceptance of empty/invalid CAPTCHA alphabets and invalid lengths. With CAPTCHA enabled, invalid settings are rejected at startup/reload; rejected reloads retain the previous configuration. - Messages load during initialization/reload; missing entries do not repeatedly read files while handling players. - Reload also refreshes duplicate-name rejection text. Invalid YAML retains the previous working message set and reports an error without printing private file contents. - Restart-only settings are not misleadingly switched by `/pureauth reload`. - Suppressed standard Paper echoes containing full commands with passwords, PINs and recovery codes. Preserved the administrative audit with sensitive arguments redacted. - Failed security initialization keeps new player admission denied. ## Backups and compatibility - SQLite produces a consistent snapshot; MySQL/MariaDB exports preserve every account field, Unicode, quotes, backslashes and control characters under different SQL modes. - A finished backup appears only after the write completes. Failure neither replaces older copies nor starts rotation. - Concurrent requests cannot overlap backups. Rotation retains at least one PureAuth backup and ignores unrelated files; on POSIX, new backup access is restricted to the owner. - The Paper module supports Minecraft 26.2.x and 26.3; both ranges were checked on real Paper servers with protocol clients, including Velocity and BungeeCord paths. ## Upgrade Stop the network, back up data, replace every module and configure the same `network.sync.shared_secret` on proxies and backends with `network.sync.enabled: true`. Synchronization may remain disabled on a standalone server. Keep the account database and merge configuration settings. Full feature and secret instructions: [PureAuth-6.3.1-Wiki-EN.md.](https://github.com/SzymeX-Dev-Studio/PureAuth/wiki/User-Manual-v6.3.1)

# PureAuth 6.3.1 ## Authentication and sessions - Reconnect sessions require matching IP and identity, an unexpired lifetime and current account security settings. Legacy session records cannot grant automatic access. - Password, PIN, 2FA and recovery changes invalidate previous trust. Administrative changes and password recovery require fresh authentication; an owner changing their own settings may retain the current connection. - Active accounts are checked periodically so a security change on another backend cannot leave old access active indefinitely. - The connection deadline covers password login, PIN, 2FA and mandatory Admin Guard setup. Closing a GUI or entering another stage does not remove the deadline. ## Proxy synchronization and Redis - Fixed the PIN window remaining open after an authenticated player switches from the lobby to another backend. Valid synchronization closes the required login window without marking login as interrupted; delayed window opening or an earlier PIN result cannot bring it back. - Streamlined completion of valid synchronization while retaining signature, security freshness, account-lock, Fair Play and mandatory Admin Guard checks. Voluntary PIN setup and change windows remain separate operations. - Backend login synchronization now requires signed confirmations and the same shared secret on every backend and proxy. - Confirmations are tied to the player, current connection, current account security settings and a short validity period. Old, replayed and unsigned messages cannot grant access. - Improved initialization and valid synchronization handling so a signed response is not blocked by concurrent player-join preparation. - Improved username reservation maintenance: abandoned connection attempts are not renewed indefinitely, and rejected duplicates cannot release the real player's reservation. - Reservation ownership is checked again when a connection completes. An unavailable required Redis or database denies admission instead of bypassing protection. - Improved Velocity YAML configuration handling and cached editable messages on both proxies. ## Recovery - Recovery failures and penalty history survive reconnects and restarts. Stages share history with incorrect-login penalties. - Password recovery removes a forgotten PIN, revokes previous sessions and requires reconnection. Existing 2FA remains required. - A previously verified answer cannot overwrite a newer security change. Password replacement and PIN removal are one operation; a failed write does not announce success. - Administrative unlock also clears the recovery-answer failure counter. ## TOTP, backup codes and Admin Guard - Fixed an intermittent disconnect immediately after the owner correctly removed 2FA. External security resets and account locks still revoke access. - New TOTP secrets provide 160 bits; existing compatible secrets remain supported. - Strengthened secret and six-digit code validation while retaining standard 30-second TOTP app windows. - Enabling 2FA stores the secret, enabled state and entire backup-code set together. Concurrent or stale updates cannot overwrite newer security settings. - Backup-code recovery can succeed only once even with simultaneous requests across instances. It disables the previous 2FA setup and invalidates its entire previous code set. - Admin Guard withholds full authentication until required 2FA has been correctly confirmed and saved. - Wrong codes and failed writes cannot release protection. The ordinary removal command cannot disable mandatory 2FA. - Backup recovery by an already authenticated administrator restricts the account again until a new mandatory 2FA setup is complete. ## Registration and persistence - Per-IP limits and account creation are checked atomically in the shared database. Simultaneous registrations cannot bypass the limit through concurrent reads. - Player responses distinguish an IP limit, an existing account and a storage failure. - Enforced BCrypt's 72-byte UTF-8 input limit to prevent silent truncation of overlong values. - Failed and stale security writes cannot announce success or grant authentication. ## Performance and spam limits - Fixed waiting for an earlier PIN attempt after valid synchronization: an obsolete attempt no longer holds up new commands. Other limits and protection against parallel authentication attempts remain effective. - Bounded database, cryptography and network work queues. Saturation does not move expensive work onto the server's main thread. - Each player can perform one authentication operation at a time; rapidly repeated commands do not multiply concurrent attempts. - Added `performance.request_interval_ms`, defaulting to 250 ms. Thread counts, queue sizes and this interval require a full restart. - Disconnecting cancels queued work for that connection. Old callbacks cannot erase a newer connection's request state. - Expensive administrative operations and auditing run outside the main thread. Improved overload handling and rate-limited repeated warnings. - Limited pending Discord webhooks to 16, with a 5-second request timeout. Excess notifications are dropped; webhooks are not guaranteed event storage. - Added missing Discord notifications for registration, Premium enable/disable and successful module startup. Account-change events follow successful saves; rejected attempts do not announce success. Category switches and delivery limits remain effective. - Added editable English and Polish `authentication_wait` and `authentication_busy` messages. ## Visibility and pre-login protection - Fixed inventory dragging during Fair Play Guard inspections when inventory restrictions are enabled. Both clicks and dragging are restricted according to configuration and inspection state. - Inventories remain on players during Ghost Mode instead of being cleared and restored from a second item copy. - Fixed visibility for players joining in different orders and restoration of previous collision and blindness state. - Expanded pre-login restrictions to attacks/projectiles, pickups, entity interactions, inventory dragging, hand swaps, portals, consumption and mounting. - The required PIN GUI remains available for authentication without unlocking other world interactions. ## Command completion - Fixed missing TAB subcommand suggestions for `/pureauth` and its `/pa` alias. - Suggestions respect permissions and the typed prefix without case sensitivity. Location and Fair Play arguments are completed, with visible online player names where a command expects a player. - Password/PIN fields, unknown commands and missing permissions no longer fall back to player-name suggestions. The console-only `stats` command is suggested only to the console. ## Configuration, messages and logs - Fixed exposure of repeated passwords/PINs in extra arguments on malformed administrative commands: every argument from the secret position onward is redacted. - Fixed acceptance of empty/invalid CAPTCHA alphabets and invalid lengths. With CAPTCHA enabled, invalid settings are rejected at startup/reload; rejected reloads retain the previous configuration. - Messages load during initialization/reload; missing entries do not repeatedly read files while handling players. - Reload also refreshes duplicate-name rejection text. Invalid YAML retains the previous working message set and reports an error without printing private file contents. - Restart-only settings are not misleadingly switched by `/pureauth reload`. - Suppressed standard Paper echoes containing full commands with passwords, PINs and recovery codes. Preserved the administrative audit with sensitive arguments redacted. - Failed security initialization keeps new player admission denied. ## Backups and compatibility - SQLite produces a consistent snapshot; MySQL/MariaDB exports preserve every account field, Unicode, quotes, backslashes and control characters under different SQL modes. - A finished backup appears only after the write completes. Failure neither replaces older copies nor starts rotation. - Concurrent requests cannot overlap backups. Rotation retains at least one PureAuth backup and ignores unrelated files; on POSIX, new backup access is restricted to the owner. - The Paper module supports Minecraft 26.2.x and 26.3; both ranges were checked on real Paper servers with protocol clients, including Velocity and BungeeCord paths. ## Upgrade Stop the network, back up data, replace every module and configure the same `network.sync.shared_secret` on proxies and backends with `network.sync.enabled: true`. Synchronization may remain disabled on a standalone server. Keep the account database and merge configuration settings. Full feature and secret instructions: [PureAuth-6.3.1-Wiki-EN.md.](https://github.com/SzymeX-Dev-Studio/PureAuth/wiki/User-Manual-v6.3.1)

# PureAuth 6.3.1 ## Authentication and sessions - Reconnect sessions require matching IP and identity, an unexpired lifetime and current account security settings. Legacy session records cannot grant automatic access. - Password, PIN, 2FA and recovery changes invalidate previous trust. Administrative changes and password recovery require fresh authentication; an owner changing their own settings may retain the current connection. - Active accounts are checked periodically so a security change on another backend cannot leave old access active indefinitely. - The connection deadline covers password login, PIN, 2FA and mandatory Admin Guard setup. Closing a GUI or entering another stage does not remove the deadline. ## Proxy synchronization and Redis - Fixed the PIN window remaining open after an authenticated player switches from the lobby to another backend. Valid synchronization closes the required login window without marking login as interrupted; delayed window opening or an earlier PIN result cannot bring it back. - Streamlined completion of valid synchronization while retaining signature, security freshness, account-lock, Fair Play and mandatory Admin Guard checks. Voluntary PIN setup and change windows remain separate operations. - Backend login synchronization now requires signed confirmations and the same shared secret on every backend and proxy. - Confirmations are tied to the player, current connection, current account security settings and a short validity period. Old, replayed and unsigned messages cannot grant access. - Improved initialization and valid synchronization handling so a signed response is not blocked by concurrent player-join preparation. - Improved username reservation maintenance: abandoned connection attempts are not renewed indefinitely, and rejected duplicates cannot release the real player's reservation. - Reservation ownership is checked again when a connection completes. An unavailable required Redis or database denies admission instead of bypassing protection. - Improved Velocity YAML configuration handling and cached editable messages on both proxies. ## Recovery - Recovery failures and penalty history survive reconnects and restarts. Stages share history with incorrect-login penalties. - Password recovery removes a forgotten PIN, revokes previous sessions and requires reconnection. Existing 2FA remains required. - A previously verified answer cannot overwrite a newer security change. Password replacement and PIN removal are one operation; a failed write does not announce success. - Administrative unlock also clears the recovery-answer failure counter. ## TOTP, backup codes and Admin Guard - Fixed an intermittent disconnect immediately after the owner correctly removed 2FA. External security resets and account locks still revoke access. - New TOTP secrets provide 160 bits; existing compatible secrets remain supported. - Strengthened secret and six-digit code validation while retaining standard 30-second TOTP app windows. - Enabling 2FA stores the secret, enabled state and entire backup-code set together. Concurrent or stale updates cannot overwrite newer security settings. - Backup-code recovery can succeed only once even with simultaneous requests across instances. It disables the previous 2FA setup and invalidates its entire previous code set. - Admin Guard withholds full authentication until required 2FA has been correctly confirmed and saved. - Wrong codes and failed writes cannot release protection. The ordinary removal command cannot disable mandatory 2FA. - Backup recovery by an already authenticated administrator restricts the account again until a new mandatory 2FA setup is complete. ## Registration and persistence - Per-IP limits and account creation are checked atomically in the shared database. Simultaneous registrations cannot bypass the limit through concurrent reads. - Player responses distinguish an IP limit, an existing account and a storage failure. - Enforced BCrypt's 72-byte UTF-8 input limit to prevent silent truncation of overlong values. - Failed and stale security writes cannot announce success or grant authentication. ## Performance and spam limits - Fixed waiting for an earlier PIN attempt after valid synchronization: an obsolete attempt no longer holds up new commands. Other limits and protection against parallel authentication attempts remain effective. - Bounded database, cryptography and network work queues. Saturation does not move expensive work onto the server's main thread. - Each player can perform one authentication operation at a time; rapidly repeated commands do not multiply concurrent attempts. - Added `performance.request_interval_ms`, defaulting to 250 ms. Thread counts, queue sizes and this interval require a full restart. - Disconnecting cancels queued work for that connection. Old callbacks cannot erase a newer connection's request state. - Expensive administrative operations and auditing run outside the main thread. Improved overload handling and rate-limited repeated warnings. - Limited pending Discord webhooks to 16, with a 5-second request timeout. Excess notifications are dropped; webhooks are not guaranteed event storage. - Added missing Discord notifications for registration, Premium enable/disable and successful module startup. Account-change events follow successful saves; rejected attempts do not announce success. Category switches and delivery limits remain effective. - Added editable English and Polish `authentication_wait` and `authentication_busy` messages. ## Visibility and pre-login protection - Fixed inventory dragging during Fair Play Guard inspections when inventory restrictions are enabled. Both clicks and dragging are restricted according to configuration and inspection state. - Inventories remain on players during Ghost Mode instead of being cleared and restored from a second item copy. - Fixed visibility for players joining in different orders and restoration of previous collision and blindness state. - Expanded pre-login restrictions to attacks/projectiles, pickups, entity interactions, inventory dragging, hand swaps, portals, consumption and mounting. - The required PIN GUI remains available for authentication without unlocking other world interactions. ## Command completion - Fixed missing TAB subcommand suggestions for `/pureauth` and its `/pa` alias. - Suggestions respect permissions and the typed prefix without case sensitivity. Location and Fair Play arguments are completed, with visible online player names where a command expects a player. - Password/PIN fields, unknown commands and missing permissions no longer fall back to player-name suggestions. The console-only `stats` command is suggested only to the console. ## Configuration, messages and logs - Fixed exposure of repeated passwords/PINs in extra arguments on malformed administrative commands: every argument from the secret position onward is redacted. - Fixed acceptance of empty/invalid CAPTCHA alphabets and invalid lengths. With CAPTCHA enabled, invalid settings are rejected at startup/reload; rejected reloads retain the previous configuration. - Messages load during initialization/reload; missing entries do not repeatedly read files while handling players. - Reload also refreshes duplicate-name rejection text. Invalid YAML retains the previous working message set and reports an error without printing private file contents. - Restart-only settings are not misleadingly switched by `/pureauth reload`. - Suppressed standard Paper echoes containing full commands with passwords, PINs and recovery codes. Preserved the administrative audit with sensitive arguments redacted. - Failed security initialization keeps new player admission denied. ## Backups and compatibility - SQLite produces a consistent snapshot; MySQL/MariaDB exports preserve every account field, Unicode, quotes, backslashes and control characters under different SQL modes. - A finished backup appears only after the write completes. Failure neither replaces older copies nor starts rotation. - Concurrent requests cannot overlap backups. Rotation retains at least one PureAuth backup and ignores unrelated files; on POSIX, new backup access is restricted to the owner. - The Paper module supports Minecraft 26.2.x and 26.3; both ranges were checked on real Paper servers with protocol clients, including Velocity and BungeeCord paths. ## Upgrade Stop the network, back up data, replace every module and configure the same `network.sync.shared_secret` on proxies and backends with `network.sync.enabled: true`. Synchronization may remain disabled on a standalone server. Keep the account database and merge configuration settings. Full feature and secret instructions: [PureAuth-6.3.1-Wiki-EN.md.](https://github.com/SzymeX-Dev-Studio/PureAuth/wiki/User-Manual-v6.3.1)

PureAuth 6.3.0 NETWORK AND REDIS - Added network.mode values LOCAL and REDIS. - Added atomic, case-insensitive, network-wide duplicate username leases for multi-proxy networks. - Added lease heartbeats, TTL crash recovery and owner-checked Lua refresh/release operations. - Added shared Redis authentication state and session expiry. - Added configurable Redis host, port, ACL username, password, database, key prefix, connect/read timeouts, player lease TTL and authentication TTL. - Added fail-closed DENY and emergency local fallback ALLOW policies. - Added localized duplicate-name and Redis-unavailable kick messages. - Added Jedis 5.2.0 and safely relocated Jedis/Commons Pool inside proxy artifacts. FAIR PLAY GUARD - Added Fair Play Guard, enabled by default and fully configurable. - Added /pureauth check <player>. - Added /pureauth check setup and /pureauth check setup confirm. - Added /pureauth check clear <player> for online inspections and offline persistent restrictions. - Added permissions pureauth.admin.check, .check.start, .check.setup and .check.clear. - Added inspection teleport, Adventure mode, flight suppression and original-state tracking. - Added configurable drop, inventory, world interaction, command and damage restrictions. - Added inspector-only chat, including console inspection support. - Added configurable radius enforcement with a default 50-block limit. - Added configurable title, chat reminder and Discord/waiting-area instructions. - Added persistent account restriction when a player leaves during inspection. - Added optional console disconnect command with %player% and %uuid% placeholders. - Added administrative ban detection using Paper kick causes, the name ban list and configurable ban command roots. - Added safe restoration on clear, administrative ban, plugin shutdown and normal cleanup. - Extended /pureauth unlock to clear Fair Play Guard restrictions. MESSAGES AND CONFIGURATION - Moved player/admin messages, titles, subtitles, actionbars, PIN GUI names/lore and recovery questions out of config.yml. - Added editable Messages/EN_en.txt and Messages/PL_pl.txt resources to every module. - Added editable plugin prefix and placeholders throughout the message system. - Added automatic upgrade migration: missing message keys are appended without overwriting customized values. - Added reload support for message files and Fair Play Guard task intervals. - Kept config.yml focused on operational values, materials, textures, sounds and feature settings. DATABASE AND COMPATIBILITY - Added fair_play_locked and fair_play_lock_reason database columns with automatic SQLite/MySQL migration. - Preserved existing accounts, hashes, PINs, 2FA, recovery, sessions and lock history. - Added explicit parent permission inheritance for pureauth.admin.

PureAuth 6.3.0 NETWORK AND REDIS - Added network.mode values LOCAL and REDIS. - Added atomic, case-insensitive, network-wide duplicate username leases for multi-proxy networks. - Added lease heartbeats, TTL crash recovery and owner-checked Lua refresh/release operations. - Added shared Redis authentication state and session expiry. - Added configurable Redis host, port, ACL username, password, database, key prefix, connect/read timeouts, player lease TTL and authentication TTL. - Added fail-closed DENY and emergency local fallback ALLOW policies. - Added localized duplicate-name and Redis-unavailable kick messages. - Added Jedis 5.2.0 and safely relocated Jedis/Commons Pool inside proxy artifacts. FAIR PLAY GUARD - Added Fair Play Guard, enabled by default and fully configurable. - Added /pureauth check <player>. - Added /pureauth check setup and /pureauth check setup confirm. - Added /pureauth check clear <player> for online inspections and offline persistent restrictions. - Added permissions pureauth.admin.check, .check.start, .check.setup and .check.clear. - Added inspection teleport, Adventure mode, flight suppression and original-state tracking. - Added configurable drop, inventory, world interaction, command and damage restrictions. - Added inspector-only chat, including console inspection support. - Added configurable radius enforcement with a default 50-block limit. - Added configurable title, chat reminder and Discord/waiting-area instructions. - Added persistent account restriction when a player leaves during inspection. - Added optional console disconnect command with %player% and %uuid% placeholders. - Added administrative ban detection using Paper kick causes, the name ban list and configurable ban command roots. - Added safe restoration on clear, administrative ban, plugin shutdown and normal cleanup. - Extended /pureauth unlock to clear Fair Play Guard restrictions. MESSAGES AND CONFIGURATION - Moved player/admin messages, titles, subtitles, actionbars, PIN GUI names/lore and recovery questions out of config.yml. - Added editable Messages/EN_en.txt and Messages/PL_pl.txt resources to every module. - Added editable plugin prefix and placeholders throughout the message system. - Added automatic upgrade migration: missing message keys are appended without overwriting customized values. - Added reload support for message files and Fair Play Guard task intervals. - Kept config.yml focused on operational values, materials, textures, sounds and feature settings. DATABASE AND COMPATIBILITY - Added fair_play_locked and fair_play_lock_reason database columns with automatic SQLite/MySQL migration. - Preserved existing accounts, hashes, PINs, 2FA, recovery, sessions and lock history. - Added explicit parent permission inheritance for pureauth.admin.

PureAuth 6.3.0 NETWORK AND REDIS - Added network.mode values LOCAL and REDIS. - Added atomic, case-insensitive, network-wide duplicate username leases for multi-proxy networks. - Added lease heartbeats, TTL crash recovery and owner-checked Lua refresh/release operations. - Added shared Redis authentication state and session expiry. - Added configurable Redis host, port, ACL username, password, database, key prefix, connect/read timeouts, player lease TTL and authentication TTL. - Added fail-closed DENY and emergency local fallback ALLOW policies. - Added localized duplicate-name and Redis-unavailable kick messages. - Added Jedis 5.2.0 and safely relocated Jedis/Commons Pool inside proxy artifacts. FAIR PLAY GUARD - Added Fair Play Guard, enabled by default and fully configurable. - Added /pureauth check <player>. - Added /pureauth check setup and /pureauth check setup confirm. - Added /pureauth check clear <player> for online inspections and offline persistent restrictions. - Added permissions pureauth.admin.check, .check.start, .check.setup and .check.clear. - Added inspection teleport, Adventure mode, flight suppression and original-state tracking. - Added configurable drop, inventory, world interaction, command and damage restrictions. - Added inspector-only chat, including console inspection support. - Added configurable radius enforcement with a default 50-block limit. - Added configurable title, chat reminder and Discord/waiting-area instructions. - Added persistent account restriction when a player leaves during inspection. - Added optional console disconnect command with %player% and %uuid% placeholders. - Added administrative ban detection using Paper kick causes, the name ban list and configurable ban command roots. - Added safe restoration on clear, administrative ban, plugin shutdown and normal cleanup. - Extended /pureauth unlock to clear Fair Play Guard restrictions. MESSAGES AND CONFIGURATION - Moved player/admin messages, titles, subtitles, actionbars, PIN GUI names/lore and recovery questions out of config.yml. - Added editable Messages/EN_en.txt and Messages/PL_pl.txt resources to every module. - Added editable plugin prefix and placeholders throughout the message system. - Added automatic upgrade migration: missing message keys are appended without overwriting customized values. - Added reload support for message files and Fair Play Guard task intervals. - Kept config.yml focused on operational values, materials, textures, sounds and feature settings. DATABASE AND COMPATIBILITY - Added fair_play_locked and fair_play_lock_reason database columns with automatic SQLite/MySQL migration. - Preserved existing accounts, hashes, PINs, 2FA, recovery, sessions and lock history. - Added explicit parent permission inheritance for pureauth.admin.

# PureAuth 6.2.0 — Progressive Login Lock PureAuth 6.2.0 introduces a three-stage account protection system for repeated failed authentication. It applies to password, PIN and invalid 2FA attempts while retaining the existing permanent account lock. ## Progressive lock stages - After 3 failed attempts by default, the player is kicked and login is blocked for 30 minutes. - A second max-attempt kick blocks login for 24 hours. - A third max-attempt kick permanently locks the account. - Lock stages and expiry timestamps persist across server restarts. - Players may join during a temporary lock, but remain hidden, frozen and unable to authenticate until it expires. - If the timer expires while the player is online, the normal authentication flow resumes automatically. - `/pureauth unlock <player>` clears temporary or permanent locks and resets escalation history. ## Configurable display and behavior - Live title, subtitle, actionbar and periodic chat countdowns are available during temporary locks. - All player commands are blocked while authentication is locked. - Every new message and display option is configurable in English and Polish. - New settings control both lock durations, stage-history reset, reminder interval and each display channel. - Existing `max_attempts`, `account_lock_enabled` and `kicks_before_lock` settings remain supported. ## Database, compatibility and fixes - Added automatic, data-preserving migration for `temporary_lock_until`. - Lock escalation is saved atomically in a database transaction. - Added safe handling for nulls, missing accounts, unavailable databases, invalid values and time overflow. - Fixed the updater incorrectly treating an older Modrinth release as newer. - Added semantic version comparison and 5/10-second network timeouts to the updater. - Built against stable Paper API `26.2.build.117-stable` and Velocity API `3.5.1`.

# PureAuth 6.2.0 — Progressive Login Lock PureAuth 6.2.0 introduces a three-stage account protection system for repeated failed authentication. It applies to password, PIN and invalid 2FA attempts while retaining the existing permanent account lock. ## Progressive lock stages - After 3 failed attempts by default, the player is kicked and login is blocked for 30 minutes. - A second max-attempt kick blocks login for 24 hours. - A third max-attempt kick permanently locks the account. - Lock stages and expiry timestamps persist across server restarts. - Players may join during a temporary lock, but remain hidden, frozen and unable to authenticate until it expires. - If the timer expires while the player is online, the normal authentication flow resumes automatically. - `/pureauth unlock <player>` clears temporary or permanent locks and resets escalation history. ## Configurable display and behavior - Live title, subtitle, actionbar and periodic chat countdowns are available during temporary locks. - All player commands are blocked while authentication is locked. - Every new message and display option is configurable in English and Polish. - New settings control both lock durations, stage-history reset, reminder interval and each display channel. - Existing `max_attempts`, `account_lock_enabled` and `kicks_before_lock` settings remain supported. ## Database, compatibility and fixes - Added automatic, data-preserving migration for `temporary_lock_until`. - Lock escalation is saved atomically in a database transaction. - Added safe handling for nulls, missing accounts, unavailable databases, invalid values and time overflow. - Fixed the updater incorrectly treating an older Modrinth release as newer. - Added semantic version comparison and 5/10-second network timeouts to the updater. - Built against stable Paper API `26.2.build.117-stable` and Velocity API `3.5.1`.

# PureAuth 6.2.0 — Progressive Login Lock PureAuth 6.2.0 introduces a three-stage account protection system for repeated failed authentication. It applies to password, PIN and invalid 2FA attempts while retaining the existing permanent account lock. ## Progressive lock stages - After 3 failed attempts by default, the player is kicked and login is blocked for 30 minutes. - A second max-attempt kick blocks login for 24 hours. - A third max-attempt kick permanently locks the account. - Lock stages and expiry timestamps persist across server restarts. - Players may join during a temporary lock, but remain hidden, frozen and unable to authenticate until it expires. - If the timer expires while the player is online, the normal authentication flow resumes automatically. - `/pureauth unlock <player>` clears temporary or permanent locks and resets escalation history. ## Configurable display and behavior - Live title, subtitle, actionbar and periodic chat countdowns are available during temporary locks. - All player commands are blocked while authentication is locked. - Every new message and display option is configurable in English and Polish. - New settings control both lock durations, stage-history reset, reminder interval and each display channel. - Existing `max_attempts`, `account_lock_enabled` and `kicks_before_lock` settings remain supported. ## Database, compatibility and fixes - Added automatic, data-preserving migration for `temporary_lock_until`. - Lock escalation is saved atomically in a database transaction. - Added safe handling for nulls, missing accounts, unavailable databases, invalid values and time overflow. - Fixed the updater incorrectly treating an older Modrinth release as newer. - Added semantic version comparison and 5/10-second network timeouts to the updater. - Built against stable Paper API `26.2.build.117-stable` and Velocity API `3.5.1`.

# PureAuth 6.1.0 - Secure PIN Login PureAuth 6.1.0 adds a complete and configurable GUI-based PIN authentication system while preserving password, 2FA, recovery and existing PureAuth security behavior. ## PIN authentication - Added `/setpin` for authenticated players. - PINs are entered using an interactive GUI with player heads representing digits `0-9`. - A new PIN must be entered twice before it is saved. - The default PIN length is 6 digits and can be configured from 1 to 9 digits. - PINs are stored only as BCrypt hashes. - PIN length is stored per account so future configuration changes do not lock existing users out. - Accounts with a PIN automatically receive the login GUI when joining. - `/login` is blocked for PIN accounts. - Sessions and Premium Auto-Login cannot bypass PIN verification. - Invalid PIN attempts use the existing attempt, kick, account-lock and Discord notification systems. ## 2FA and recovery - PIN verification happens before 2FA when both methods are enabled. - 2FA backup-code recovery remains available at the correct login stage. - Account recovery can remove a forgotten PIN and restore password authentication. - Recovery password changes and PIN removal are saved atomically. ## PIN management - `/changepass` opens the PIN change GUI for PIN accounts. - Changing a PIN requires the current PIN and two matching entries of the new PIN. - `/rempin` disables PIN authentication and restores password login. - `/rempin` remains available when the PIN feature is globally disabled. ## Login GUI security - Closing the PIN GUI stops authentication. - Configurable title, subtitle and chat instructions explain that the player must reconnect. - Recovery instructions are displayed when recovery is enabled and configured for the account. - Unnecessary commands, chat, movement, interaction and inventory actions stay blocked before authentication. ## Administration Added: - `/pureauth setpin <player> <pin>` - `/pureauth changepin <player> <pin>` - `/pureauth rempin <player>` - `/pa` alias for `/pureauth` - `pureauth.admin.pin` permission Administrative PIN commands validate input, handle missing accounts and invalid states, redact plaintext PINs from logs and safely refresh online authentication state. ## Configuration Server owners can configure the feature toggle, PIN length, GUI title, materials, digit head textures, item names, lore, status indicators, controls, sounds and all Polish/English notifications. ## Database and fixes - Added automatic migration for `pin_enabled`, `pin_hash` and `pin_length`. - Added null, missing-record and unavailable-database handling. - Fixed PIN cache lifecycle and `/changepass` mode selection. - Fixed GUI indicator overlap and centered the number pad. - Improved shutdown ordering for async tasks and the database pool. - Fixed account registration so a failed database insert cannot log the player in. ## Compatibility Available on Wiki.