ВЕРСИИ (15)

## [1.1.3] - 2026-09-08 ### Added - **Paper module (alpha):** standalone Paper/Spigot authentication plugin (`RelishAuth-Paper-1.1.3-alpha`). - Paper config defaults for limbo UI toggles: `customization.limbo.title|actionbar.enabled` and `customization.welcome.enabled`. - Paper default config now documents `security.anti-bot`, `security.vpn-protection`, `password-attempts.action`, and `skins.enabled`. - Velocity Discord slash commands honor `commands.commands.*` enable toggles. ### Fixed - Paper: limbo title/actionbar now respect `customization.limbo.title.enabled` / `actionbar.enabled` (titles could not be disabled before). - Paper: config validation no longer overwrites user values on load/`/ra reload` (warn-only). - Paper: migration no longer deletes `customization.limbo` / `welcome` (that wiped title toggles). - Paper: migration no longer forces `authentication.method: hybrid` → `password`. - Paper: migration no longer resets `discord.status.enabled`. - Paper: reload cache order fixed; Discord `/reload` refreshes runtime config cache. - Paper: teleport `previous` / `return` / `last-location` accepted; reads `first-login` key correctly. - Paper: particle migration now writes `customization.particles` (was wrongly `customization.particle`). - Paper: `geyser.enabled: false` now disables Bedrock/Floodgate special handling. - Paper: `security.blacklist.ips|usernames|discord-ids` from config.yml are applied (merged with blacklist.json). - Velocity: Discord `lang/*/discord.yml` reloads on `/ra reload`. - Velocity: welcome title now respects `customization.welcome.enabled` (was reading legacy `welcome.enabled`). - Velocity: `discord.join-notifications.default-enabled` is applied for new accounts. - Both: password special-char requirement accepts `require-special` and `require-special-chars`.

## [1.1.2] - 2026-08-06 ### Changed - Auth limbo world now uses `OVERWORLD` + `ADVENTURE` instead of `THE_END` + `SPECTATOR`. - Fixes Geyser/Bedrock clients disconnecting immediately on Auth Limbo spawn. ### Notes - For Java 1.8 clients on Velocity, install **ViaRewind** (ViaVersion + ViaBackwards alone only go down to ~1.9). - With Via* on the proxy, set LimboAPI `compatibility-mode: true`.

## [1.1.1] - 2026-07-26 ### Fixed - Restored missing `BuildConstants` template and `settings.gradle`. - Restored broken `AuthDatabase.migrateUserUuid` (CFR decompile stub that always threw). - Password login no longer succeeds for accounts with a null/empty password (premium/Discord-only accounts). - Discord auth now ignores `unlinked_*` Discord IDs and compares link ownership with the resolved account UUID. - Hardened async Discord username lookup against disconnect NPEs. - Password hasher edge cases (algorithm normalization, `$2x$` bcrypt, null-safe config). - Group sync no longer wipes LuckPerms groups when Discord role lookup fails or Discord bot is offline. - Group sync resolves account UUID correctly, awaits LuckPerms saves, and clears mapped groups on unlink/guild leave. - Group sync re-initializes on `/ra reload`. - Login method chooser Java buttons now use limbo `runCommand` (`/password` / `/discord`) instead of Adventure callbacks, which LimboAPI does not execute. - `/ra unlink` self-unlink actually unlinks Discord again (it previously always replied with a hard-coded “cannot unlink” stub). - Discord button clicks no longer double-acknowledge interactions (`DiscordBot` + `DiscordCommands` both listened and both replied on expiry / `setduration`). - Bedrock/Floodgate: premium-verification cache now matches Floodgate `.` username prefix so reconnects can use Discord/password sessions instead of always being forced back to limbo. - Discord auth no longer double-sends verify DMs. - Discord slash/button interactions now acknowledge immediately with a blocking `deferReply().complete()` so they are not delayed past Discord’s 3s window behind other REST traffic (fixes `10062 Unknown interaction`). - Removed Floodgate Cumulus forms (they cannot be delivered inside LimboAPI). Bedrock auth uses limbo titles + chat prompts only; FloodgateHelper now only detects Bedrock players. - Login method chooser also appears when `authentication.method` is `discord` if the account has both a password and Discord linked (still disabled for hybrid). - Fixed Bedrock `/ra unlink`: targeted Discord unlink SQL (avoids full `updateUser` failures), Floodgate username/UUID resolution, and widened username column for `.` + gamertag. - Login chooser chat now always sends plain-text options (LimboAPI often drops clickable components); Java and Bedrock both see type `password` / `discord`. - Discord unlink can clear the account password (`authentication.clear-password-on-discord-unlink`, default true) so the old password cannot be reused. - Accounts without a password get a chat tip on backend join (`authentication.set-password-tip-on-join`), similar to the Discord join-alert tip. ### Added - Hybrid authentication mode (`authentication.method: hybrid`): password login/register, then required Discord linking before leaving limbo. - Login method chooser when a player has both password and Discord linked (`authentication.login-chooser.enabled`): - In limbo, type `password` / `discord` (or `1` / `2`); Java may also get clickable buttons (often dropped by LimboAPI) - Works with `method` password or discord; disabled in hybrid mode (both factors required) - Backend chat tip when joining without a password (`authentication.set-password-tip-on-join`) - Language keys for `/ra syncgroups` (EN/AR), hybrid Discord prompt, and login chooser.

## [1.1.0] - 2026-05-31 ### Added - Discord role to LuckPerms group sync via `group-sync.role-to-group`. - Manual `/ra syncgroups [player]` command for queueing a group sync.

## [1.0.9] - 2026-05-30 ### Fixed - Forced-host routing for already-authenticated/session-valid players now respects Velocity's selected initial server when `routing.post-auth-server` is empty.

## [1.0.8] - 2026-05-23 ### Changed - Discord config: `discord.server-id` now accepts either a single guild ID string or a list of guild IDs ### Fixed - Forced-host routing: players now leave limbo to the server chosen by Velocity (respects `forced-hosts`) instead of always using `attempt-connection-order`

## [1.0.7] - 2026-05-21 ### Fixed - PostgreSQL: correct column types (`BOOLEAN`, `BIGINT`) with auto-migration on startup for existing installs - PostgreSQL: `createSession` using SQLite-only `INSERT OR REPLACE` syntax - Config validation incorrectly warning on `postgresql` database type - Eliminated all `password4j` `PropertyReader` startup warnings - Missing language key `error-auth-failed-generic` in EN and AR

## [1.0.6] - 2026-05-13 ### Added - PostgreSQL database support: - Full PostgreSQL configuration options (host, port, database, credentials) - HikariCP connection pooling support - Config schema customization for PostgreSQL tables

## [1.0.5] - 2026-04-13 ### Added - `bcrypt2y` password hashing support. - Limbo auth timeout HUD support: - boss bar toggle, color, and overlay ### Changed - Updated RelishAuth for newer LimboAPI behavior: - adjusted limbo session flow for current LimboAPI releases - hardened limbo attach/auth handling - kept the auth world behavior stable with a fixed End auth world and spectator flow - Simplified limbo/world customization: - removed configurable limbo world layout/dimension/gamemode tuning - removed configurable limbo movement blocking - movement restriction is now handled internally for stability - Simplified title timing by hardcoding fade/stay/fade values instead of exposing them in config. - Improved verification logging and debug output: - neutral verification tags such as `[ACCOUNT-VERIFY]` and `[PROFILE-LOOKUP]` - clearer auth decision logs - less confusing premium wording on offline/cracked paths ### Fixed - Cached offline/non-premium verification results so cracked players do not hit missing-verification decisions after verification already completed. - Fixed new config generation after limbo HUD/config changes. - Fixed missing language keys for new help/admin command entries. - Fixed limbo session UI/message flow on current LimboAPI builds.

## [1.0.4] - 2026-03-30 ### Added - Language file updater: automatically merges missing keys into `lang/<lang>/plugin.yml` and `lang/<lang>/discord.yml` on startup and `/ra reload` to prevent "Missing message key" spam. - New admin commands: - `/ra setpassword <player> <new> <confirm>` - `/ra resetpassword <player> [length]` - `/ra block <username> <from>` / `/ra unblock <username> <from>` / `/ra clearblocks <username>` ### Changed - In-game admin command outputs now use translatable language keys (EN/AR) for `/ra block|unblock|clearblocks`, `/ra setpassword`, `/ra resetpassword`. ### Fixed - Admin permission node casing mismatch

## [1.0.3] - 2026-03-17 ### Added - Post-auth routing config (`routing.post-auth-server`) with default fallback to Velocity's `attempt-connection-order`. - Versioned config updates via `config-version` (config updater now bumps the schema version when syncing defaults). ### Changed - Session duration presets are now fully driven by `session.available-durations` for both: - In-game `/ra session` menu - Discord `/session` buttons + validation - Session duration parsing now supports arbitrary `Ns/Nm/Nh/Nd` durations consistently across the proxy.

## [1.0.2] - 2025-03-13 ### Added - Skin restore: - Cached-skin resolver with offline/premium UUID fallbacks and safeguards to prevent wrong skins being applied to the wrong username. - Optional default cape injection for unsigned textures (`skins.capes.default-unsigned-cape`). - Preserve existing textures to avoid overriding Bedrock/Geyser skins (`skins.preserve-existing-textures`). - Configurable skin API endpoints for username textures, UUID lookup, and Mojang session (`skins.api.*`). - Optional login wait for skin fetching (`skins.api.login-wait-timeout`). - Premium official UUID injection (`authentication.premium-use-official-uuid`) with optional DB migration (`authentication.premium-use-official-uuid-migrate-database`). ### Changed - Simplified update/config options: - Removed the old `auto-update` config section. - Config migration now runs automatically on startup and `/ra reload` (backs up before changes). - Renamed config key `authentication.allow-premium-offline` → `authentication.allow-premium-username-impersonation` (legacy key is still supported).

## [1.0.1] - 2025-01-31 ### Changed - Updated command prefix from `/ro` to `/ra` to match plugin name :) - Updated all language files to reflect new command prefix - Updated documentation and help messages