🛡️ RayLogin v1.0.3 – Fixed & Enhanced

🔧 Bugs & Stability Fixes

• 🐞 Fixed race conditions in login state changes that caused players getting stuck in unauthenticated UI.
• 🐞 Fixed async login/database race issues that occasionally caused duplicate or inconsistent account data.
• 🐞 Fixed teleport glitches between /raylogin spawn locations during login and first‑join flows.
• 🐞 Fixed IP‑session system skipping login on some edge cases when IP changed slightly.
• 🐞 Fixed console‑log leaks and debug‑print issues that could accidentally expose sensitive auth information.
• ⚡ Improved performance of login‑throttle and concurrent‑auth handling.

✨ UI & UX Improvements

• 🎨 Refined gradient‑style login/register messages for a more premium feel.
• 🎨 Improved title and bossbar timing so cinematic countdown looks smoother.
• 🎨 Polish particles and sound events on login/register success and failure.
• 🎨 Minor tweaks to clickable chat messages for better readability and responsiveness.
• 🎨 Small visual polish on emergency/login‑confirm UI for premium‑style UX.

🔐 Security & Session System Upgrades

• 🔐 Smart Session Logic
  • Sessions now refresh on successful login, extending auto‑login duration.
  • IP‑change handling is smarter: quick re‑join from same IP triggers auto‑login, big IP change may ask for re‑confirmation.
• 🔐 Trusted IP / Trusted Device
  • Admins can mark IPs as trusted for extended auto‑login grace.
  • Optional re‑confirm on suspicious IP‑change to stop simple bypass attempts.
• 🔐 Suspicious Login / IP Tracker
  • Track failed login attempts per IP and per player.
  • Admin command /rl suspicious <player|ip> shows history and stats.
  • Console warning for abnormal failed‑attempt bursts.
• 🔐 Login‑Throttle Protection
  • Added soft limits:
    • Max concurrent logins per IP.
    • Max concurrent logins per server.
  • If limits hit, players are gently queued or delayed instead of crashing the server.
• 🔐 login / register packet handling made safer when ProtocolLib is present.
• 🔐 Improved brute‑force protection tolerance and auto‑kick behavior.

✅ New / Premium-Like Features

🎯 Emergency One-Time Pass

• Added /rl emergencypass <player>
  • Generates a temporary one‑time code for that player.
  • Player can use /templogin de> once to log in.
  • Code expires after configurable time and is single‑use.
  • Useful for recovery when players forget passwords or don’t use external support tools.

✅ Click‑To‑Verify Login Confirmation

• Optional login‑confirmation mode:
  • After successful password input, player receives a clickable message like ✅ Confirm Login.
  • If not clicked within the configured time, the login is canceled.
  • This is a light UI‑based bot‑filter that doesn’t affect normal players but makes basic automation attacks a bit harder.
• Toggle via config.

✅ Premium UI Bypass

• Added raylogin.premium.ui permission:
  • Premium players skip the blindness effect, countdown timer, and boss bar before login (visually).
  • They still actually log in securely in the background.
  • Great for VIP/boosted players who expect “instant” join‑style UX.

✅ Premium Visual Effects

• Added unique particles + title effects for:
  • Premium successful login (for players with raylogin.premium).
• Slight visual polish for “queue‑style” UI when many players are logging in at once.

⚙️ Config & Messages

• ✅ config.yml improvements:
  • New sessions: section for:
    • session-duration-hours
    • premium-session-duration-hours
    • trusted-ips: []
  • New security: section for:
    • max-concurrent-logins-per-ip
    • max-concurrent-logins-per-server
    • click-to-verify-enabled: true/false
    • click-to-verify-timeout-seconds
  • emergency: section for emergency one‑time pass settings.
  • All options are documented and commented clearly.
• ✅ messages.yml:
  • Added gradient‑style messaging for /premium, emergency‑pass, and click‑to‑verify.
  • Better‑worded error messages and UX hints for login‑throttle and suspicious‑IP cases.

🧩 Commands & Permissions

New Commands

• /rl emergencypass <player> – generate a one‑time login code.
• /templogin de> – single‑use emergency login.

New Permissions

• raylogin.premium – for premium auto‑login and trusted‑session benefits.
• raylogin.emergency – for /rl emergencypass.
• raylogin.bypass.clickverify – skips the click‑verify confirmation step.
• raylogin.premium.ui – disables visual login UI (blindness, countdown, bossbar) for premium players.
• raylogin.staff.info.suspicious – for /rl suspicious.

Existing Commands (Unchanged core)

• /login <password>
• /register <password> >
• /changepassword <old> <new> >
• /premium <on|off>
• /rl help
• /rl reload
• /rl info <player>
• /rl changepass <player> <new_password>
• /rl forcelogin <player>
• /raylogin spawn set <type>

🧹 Backwards Compatibility

• ✅ raylogin.db schema is unchanged where possible.
• ✅ Old passwords and accounts are fully preserved.
• ✅ config.yml and messages.yml from v1.0.2 can be safely migrated (with minor config‑merge required for new options).
• ✅ ProtocolLib integration behavior is kept compatible, but made safer.

💬 Notes

• This is a bug‑fix + premium‑feature release.
• If you used RayLogin v1.0.2, you can safely update without deleting player data.
• Recommended:
  • Test login‑throttle, click‑to‑verify, and emergency‑pass system on a staging server before enabling for production.

📢 Feedback

• Please report any remaining bugs or UI issues.
• Feature ideas for future v1.x versions are welcome!

🛡️ RayLogin v1.0.2 - The Ultimate Authentication Update

RayLogin v1.0.2 redefines server security with a complete visual overhaul, enterprise-grade protection, and seamless player experience features. This update focuses on a "Premium Feel" with gradients, animations, and smart automation.

✨ New Features

💎 Premium Auto-Login

• New Command: Added /premium <on|off>.
• Smart Sessions: Premium players (or those with valid sessions) are now automatically logged in without typing passwords.
• Session Persistence: If you rejoin quickly from the same IP, you skip the queue.

📍 Multi-Spawn System

Admins can now set specific spawn points for different login stages:

• /raylogin spawn set auth - Where players wait to login.
• /raylogin spawn set register - Where new players wait.
• /raylogin spawn set login - Where players go after logging in (e.g., Hub).
• /raylogin spawn set firstjoin - Where players go immediately after registering.

🎨 Visual & Audio Overhaul

• Clickable Chat: Login and Register messages are now clickable for faster typing.
• Cinematic Timer: Added a 5-second countdown title (5..4..3..) with ticking sounds before a timeout kick.
• Console Art: Added a stunning ASCII gradient banner on startup.
• Animations: Particle effects on login/register success and failure.

🔒 Enterprise Security

• Argon2id Hashing: Industry-standard password hashing.
• Log4j Console Filter: Strictly hides /login and /register passwords from console logs to prevent leaks.
• Tab Completion: Intelligent command suggestions based on permissions.

---

🛠️ Commands

• /login <password> - Login to the server.
• /register <password> <confirm> - Create a new account.
• /premium <on|off> - Toggle auto-login for your account.
• /raylogin spawn set <type> - (Admin) Set spawn locations.
• /raylogin help - View the interactive help menu.

---

⚙️ Installation & Update

1. Stop your server.
2. Delete your old config.yml and messages.yml (Required for new gradient settings).
3. Upload the new jar to your /plugins/ folder.
4. Start the server.

Note: You do not need to delete your raylogin.db database. Player accounts are safe.

v1.0.0 - The Ultimate Initial Release

This is the first public release of RayLogin, a powerful and feature-rich authentication plugin built from the ground up for modern servers.

✨ Player & User Experience

• Secure /register and /login system.
• Auto-Login on Register: Players are logged in instantly after registering.
• IP Session Management: Players can be automatically logged in when rejoining from the same IP address.
• Immersive UI:
  • Animated on-screen titles for login/register prompts.
  • Dynamic Boss Bar countdown timer that changes color from green to red.
  • Blindness effect applied to unauthenticated players.
• Configurable sound effects for login, registration, and failed attempts.
• A celebratory (and damage-free) firework is launched when a new player registers.
• Bedrock Edition (via GeyserMC) compatibility.
• /changepassword command for users to manage their own account.

🔒 Security Enhancements

• Guaranteed Console Privacy: Player passwords are 100% hidden from the server console using network-level packet interception (requires ProtocolLib).
• Brute-Force Protection: Automatically kicks players after multiple failed login attempts.
• Secure Hashing: All passwords are securely hashed using the industry-standard BCrypt algorithm.
• Action Blocking: Unauthenticated players are completely restricted from moving, chatting, interacting, or using commands.
• OP players are required to authenticate just like regular players.

🔧 Admin Tools

• Comprehensive /raylogin command suite (/rl).
• /rl info <player>: View detailed account information like registration date, last login, and last known IP.
• /rl spawn set: Easily set the post-login teleport location.
• /rl changepass <player> <new_password>: Change a player's password.
• /rl forcelogin <player>: Force a player to log in.
• /rl reload: Reload the plugin's configuration file.

⚙️ Backend

• Dependency: Now requires ProtocolLib to be installed for the enhanced security features.
• All features are fully configurable in a clean, well-documented config.yml.