ВЕРСИИ (8)

### 🛡️ UltimateAuth v3.3.0 - Enterprise Account Defense & Security Engine We are proud to release **UltimateAuth v3.3.0**, a major security, performance, and administrative overhaul! #### 🚀 What's New: - **🔒 Progressive Brute-Force & Lockout System**: Protects player accounts from dictionary attacks. Repeated failed attempts trigger progressive delays and temporary lockout jails (default 5 attempts -> 15 min lockout). - **🛡️ Enforced Password Policy**: Blocks trivially guessable passwords (`123456`, `minecraft`, `admin`, etc.) and prevents passwords from matching or containing the player's username. - **🚨 Discord Security Webhook**: Integrated non-blocking webhook auditor that alerts administrators on: - Admin/OP account logins - Account brute-force lockout events - Password modifications - Automatic IP masking (`***`) for player privacy. - **👁️ Spawn Privacy & Visual Lockdown**: Added optional blindness effect on join until login is completed, preventing players from peeking at spawn coordinates or secret locations. - **🛠️ New Admin Commands**: - `/auth info <player>`: Displays account UUID, registration status, last login date, and real-time lockout status. - `/auth forcelogin <player>`: Emergency bypass authentication for an online player. - `/auth unlock <player>`: Reset brute-force lockouts and clear failed attempts for a player. - **⚡ Hot-Reload Architecture**: Enhanced `/auth reload` to dynamically reconfigure security policies and webhooks without losing in-memory lockouts or requiring server restart. - **📦 Multi-Version Compatibility**: Fully validated on Paper, Purpur, Spigot, and Folia from Minecraft 1.20 up to 1.21.4+.

# UltimateAuth v3.2.0 — Bedrock Auto-Login & Persistent Sessions ### 🎮 Geyser & Floodgate Bedrock Integration - **Automatic Xbox Live Authentication**: Bedrock players connected through Geyser & Floodgate are seamlessly verified and automatically authenticated without confusing password registration prompts. - **Bedrock Prefix Compatibility**: Configurable allowed username prefixes (e.g. and and ) ensure Bedrock gamertags pass strict username format validation smoothly. - **Custom Bedrock Welcome Title**: High-contrast MiniMessage gradient title greeting Bedrock players on join. ### 💾 Persistent Database Session Caching - **Restart Survival**: Sessions can now persist to SQLite/MySQL/MariaDB databases (). Players no longer need to re-login if the server or proxy performs a scheduled reboot within their session duration. - **Async Database Synchronization**: Zero main-thread lag when saving, invalidating, or periodically purging expired sessions. ### 🛡️ Configurable Sensitive Command Blocker - **Server Administrator Control**: Command blocker is now fully customizable in (), allowing server owners to specify exact blocked commands. - **Datapack Trigger Compatibility**: Removed hardcoded blocking so survival datapacks (like ) function without interference. ### 👁️ Immersion & Anti-Peek Visual Effects - **Visual Restrictions**: Optional blindness and slowness effects applied while unauthenticated to prevent players from peeking at lobby secrets or escaping their spawn coordinates. - **Godmode Invulnerability**: Complete environmental and damage protection while awaiting authentication. ### ⚡ Modern Paper Chat & PlaceholderAPI Support - **Paper AsyncChatEvent**: Direct listener on Paper's modern chat pipeline to eliminate unauthenticated chat leakage on 1.20+ and 26.3 Paper servers. - **PlaceholderAPI Hook**: Native , , and placeholders for scoreboards and TAB.

### 🔐 UltimateAuth v3.1.0 Release Notes - **🌐 Native Folia & Multi-Threading Support**: - Added native Folia declaration (`folia-supported: true`) and modernized thread-safe player state transitions. - **👁️ Smooth Camera Rotation & Anti-Rubberbanding**: - Uncoupled head rotation (pitch/yaw) from position coordinate locking during unauthenticated movement. - Players can now look around smoothly without violent camera snaps or client rubberbanding while waiting to login/register. - **⚡ Enhanced Register UX**: - Supported single-argument registration (`/register <password>`) as well as confirmed registration (`/register <password> <confirm>`). - **🛡️ SQLite-JDBC Shaded Engine**: - Bundled high-performance SQLite-JDBC 3.49 and HikariCP connection pools for rock-solid database reliability without missing driver crashes.

## UltimateAuth v3.0.0 Major Update ### Critical Bug Fixes - Fixed: findByUsername query now uses username_lower column for proper case-insensitive lookup - Fixed: Bypass permission was lobbynexus.commandblock.bypass -> now ultimateauth.commandblock.bypass - Fixed: Missing ban.commands.ip-banned message keys causing NPE crashes - Fixed: /auth command checking wrong permission lobbynexus.auth.admin - Fixed: IpLimitService.allowJoin() was always returning true (feature was disabled) - Fixed: HikariCP pool name and thread name had wrong branding ### New Features - New: Configurable min password length (auth.min-password-length, default 6) - New: Configurable max login attempts (auth.max-login-attempts, default 5) - New: /auth info player command for admins - New: permanentban aliases: /permanentban, /premanentban, /permban - New: Automatic session cleanup every 5 minutes

1. Added configurable bossbar text with %countdown% placeholder. 2. Added full messages: section in config.yml for all messages, titles, subtitles, and kick reasons.

1. Secure login/register flow with BCrypt password hashing 2. Optional verification step with /verify 3. Auth location and spawn location control 4. Darkness effect while unauthenticated 5. Movement and aim lock until authenticated 6. Command/chat/interact/block restrictions before auth 7. Auth timeout with boss bar countdown 8. Periodic title prompts during authentication 9. Optional success title after auth 10. IP registration limits 11. Join rate limiting and brute‑force protection 12. Simple admin GUI for toggling settings