package com.example.microsoftauthmod.auth; import com.example.microsoftauthmod.AstrixPaths; import com.google.gson.JsonObject; import com.google.gson.JsonParser; import net.fabricmc.api.EnvType; import net.fabricmc.api.Environment; import java.io.File; import java.io.FileReader; import java.io.FileWriter; import java.io.IOException; import java.net.URI; import java.net.URLEncoder; import java.net.http.HttpClient; import java.net.http.HttpRequest; import java.net.http.HttpResponse; import java.nio.charset.StandardCharsets; import java.util.concurrent.CompletableFuture; import java.util.concurrent.atomic.AtomicBoolean; import java.util.function.Consumer; /** * Implements Microsoft OAuth2 device-code flow to authenticate a Minecraft account. * Flow: Device Code → Poll for MS token → Xbox Live → XSTS → Minecraft → Profile * * Tokens are cached in AstrixPaths.getAuthCacheFile() so the player remains * authenticated across restarts without having to log in again every session. * The cache is stored inside the isolated Astrix Client directory — never inside * .minecraft — to prevent data leakage to other clients. */ @Environment(EnvType.CLIENT) public class AuthManager { // Azure app client ID registered for public device-code flow private static final String CLIENT_ID = "00000000402b5328"; private static final String DEVICE_CODE_URL = "https://login.microsoftonline.com/consumers/oauth2/v2.0/devicecode"; private static final String TOKEN_URL = "https://login.microsoftonline.com/consumers/oauth2/v2.0/token"; private static final String XBOX_AUTH_URL = "https://user.auth.xboxlive.com/user/authenticate"; private static final String XSTS_URL = "https://xsts.auth.xboxlive.com/xsts/authorize"; private static final String MC_TOKEN_URL = "https://api.minecraftservices.com/authentication/login_with_xbox"; private static final String MC_PROFILE_URL = "https://api.minecraftservices.com/minecraft/profile"; private static final String SCOPE = "XboxLive.signin offline_access"; private final HttpClient httpClient = HttpClient.newHttpClient(); private volatile AuthState state = AuthState.IDLE; private volatile AuthResult lastResult = null; private volatile DeviceCodeResponse pendingDeviceCode = null; private final AtomicBoolean cancelRequested = new AtomicBoolean(false); private Consumer onStateChange = s -> {}; private Consumer onComplete = r -> {}; public AuthManager() { // Attempt to restore a previously saved session from the Astrix directory. // If the cache loads successfully, the user is already authenticated on startup. tryLoadCachedAuth(); } // ----------------------------------------------------------------------- // Public API // ----------------------------------------------------------------------- public void setOnStateChange(Consumer listener) { this.onStateChange = listener; } public void setOnComplete(Consumer listener) { this.onComplete = listener; } public AuthState getState() { return state; } public AuthResult getLastResult() { return lastResult; } public DeviceCodeResponse getPendingDeviceCode() { return pendingDeviceCode; } public boolean isAuthenticated() { return state == AuthState.SUCCESS && lastResult != null && lastResult.success(); } public void cancel() { cancelRequested.set(true); setState(AuthState.CANCELLED); } public void logout() { lastResult = null; pendingDeviceCode = null; cancelRequested.set(false); deleteCachedAuth(); setState(AuthState.IDLE); } /** * Starts the device-code auth flow asynchronously. * Returns a future that resolves once the device code is available (so the * UI can display it immediately while polling continues in the background). */ public CompletableFuture startAuth() { cancelRequested.set(false); lastResult = null; return CompletableFuture.supplyAsync(() -> { try { setState(AuthState.REQUESTING_DEVICE_CODE); DeviceCodeResponse code = requestDeviceCode(); pendingDeviceCode = code; setState(AuthState.AWAITING_USER); pollForTokenAsync(code); return code; } catch (Exception e) { AuthResult fail = AuthResult.fail(e.getMessage()); lastResult = fail; setState(AuthState.FAILED); onComplete.accept(fail); throw new RuntimeException(e); } }); } // ----------------------------------------------------------------------- // Auth-cache persistence (Astrix-isolated directory) // ----------------------------------------------------------------------- /** * Writes the authenticated profile (name + UUID) to the Astrix auth cache. * This cache is intentionally stored in the Astrix Client directory so it * is never accessible to other client installations. */ private void saveAuthCache(AuthResult result) { if (!result.success()) return; AstrixPaths.ensureDirectories(); File cacheFile = AstrixPaths.getAuthCacheFile(); JsonObject json = new JsonObject(); json.addProperty("username", result.username()); json.addProperty("uuid", result.uuid()); json.addProperty("savedAt", System.currentTimeMillis()); try (FileWriter writer = new FileWriter(cacheFile, StandardCharsets.UTF_8)) { writer.write(json.toString()); } catch (IOException e) { System.err.println("[AstrixClient] Could not save auth cache: " + e.getMessage()); } } /** * Tries to read a previously saved auth result from the Astrix cache file. * On success, marks the manager as SUCCESS so the title screen shows the * logged-in state without requiring a new device-code flow. */ private void tryLoadCachedAuth() { File cacheFile = AstrixPaths.getAuthCacheFile(); if (!cacheFile.exists()) return; try (FileReader reader = new FileReader(cacheFile, StandardCharsets.UTF_8)) { JsonObject json = JsonParser.parseReader(reader).getAsJsonObject(); String username = json.get("username").getAsString(); String uuid = json.get("uuid").getAsString(); if (username != null && !username.isBlank() && uuid != null && !uuid.isBlank()) { lastResult = AuthResult.ok(username, uuid); state = AuthState.SUCCESS; // set directly — no listener to fire yet System.out.println("[AstrixClient] Restored cached session for: " + username); } } catch (Exception e) { System.err.println("[AstrixClient] Auth cache unreadable, ignoring: " + e.getMessage()); deleteCachedAuth(); } } /** Removes the auth cache file on logout or after a corrupt-cache error. */ private void deleteCachedAuth() { File cacheFile = AstrixPaths.getAuthCacheFile(); if (cacheFile.exists()) { //noinspection ResultOfMethodCallIgnored cacheFile.delete(); } } // ----------------------------------------------------------------------- // Internal auth-flow helpers // ----------------------------------------------------------------------- private void pollForTokenAsync(DeviceCodeResponse code) { CompletableFuture.runAsync(() -> { try { setState(AuthState.POLLING); String msAccessToken = pollForMicrosoftToken(code); if (msAccessToken == null) return; // cancelled or expired setState(AuthState.FETCHING_XBOX_TOKEN); String xblToken = fetchXboxLiveToken(msAccessToken); setState(AuthState.FETCHING_XSTS_TOKEN); String[] xstsData = fetchXstsToken(xblToken); String xstsToken = xstsData[0]; String userHash = xstsData[1]; setState(AuthState.FETCHING_MC_TOKEN); String mcAccessToken = fetchMinecraftToken(xstsToken, userHash); setState(AuthState.FETCHING_PROFILE); AuthResult result = fetchMinecraftProfile(mcAccessToken); lastResult = result; // Persist to Astrix-isolated cache before notifying listeners if (result.success()) { saveAuthCache(result); } setState(AuthState.SUCCESS); onComplete.accept(result); } catch (Exception e) { if (cancelRequested.get()) return; AuthResult fail = AuthResult.fail(e.getMessage()); lastResult = fail; setState(AuthState.FAILED); onComplete.accept(fail); } }); } private DeviceCodeResponse requestDeviceCode() throws IOException, InterruptedException { String body = "client_id=" + URLEncoder.encode(CLIENT_ID, StandardCharsets.UTF_8) + "&scope=" + URLEncoder.encode(SCOPE, StandardCharsets.UTF_8); HttpRequest req = HttpRequest.newBuilder() .uri(URI.create(DEVICE_CODE_URL)) .header("Content-Type", "application/x-www-form-urlencoded") .POST(HttpRequest.BodyPublishers.ofString(body)) .build(); HttpResponse resp = httpClient.send(req, HttpResponse.BodyHandlers.ofString()); if (resp.statusCode() != 200) { throw new IOException("Device code request failed: HTTP " + resp.statusCode()); } JsonObject json = JsonParser.parseString(resp.body()).getAsJsonObject(); return new DeviceCodeResponse( json.get("device_code").getAsString(), json.get("user_code").getAsString(), json.get("verification_uri").getAsString(), json.get("expires_in").getAsInt(), json.get("interval").getAsInt(), json.has("message") ? json.get("message").getAsString() : "" ); } /** * Polls the token endpoint until the user completes sign-in, the code * expires, or cancellation is requested. * Returns the Microsoft access token, or null if cancelled/expired. */ private String pollForMicrosoftToken(DeviceCodeResponse code) throws IOException, InterruptedException { long deadline = System.currentTimeMillis() + (code.expiresIn() * 1000L); int interval = Math.max(code.interval(), 5); while (System.currentTimeMillis() < deadline) { if (cancelRequested.get()) return null; Thread.sleep(interval * 1000L); if (cancelRequested.get()) return null; String body = "grant_type=urn:ietf:params:oauth:grant-type:device_code" + "&client_id=" + URLEncoder.encode(CLIENT_ID, StandardCharsets.UTF_8) + "&device_code=" + URLEncoder.encode(code.deviceCode(), StandardCharsets.UTF_8); HttpRequest req = HttpRequest.newBuilder() .uri(URI.create(TOKEN_URL)) .header("Content-Type", "application/x-www-form-urlencoded") .POST(HttpRequest.BodyPublishers.ofString(body)) .build(); HttpResponse resp = httpClient.send(req, HttpResponse.BodyHandlers.ofString()); JsonObject json = JsonParser.parseString(resp.body()).getAsJsonObject(); if (json.has("access_token")) { return json.get("access_token").getAsString(); } if (json.has("error")) { String error = json.get("error").getAsString(); if ("authorization_pending".equals(error)) continue; if ("slow_down".equals(error)) { interval += 5; continue; } if ("expired_token".equals(error)) { setState(AuthState.EXPIRED); return null; } throw new IOException("Token poll error: " + error); } } setState(AuthState.EXPIRED); return null; } private String fetchXboxLiveToken(String msAccessToken) throws IOException, InterruptedException { String body = "{\"Properties\":{\"AuthMethod\":\"RPS\",\"SiteName\":\"user.auth.xboxlive.com\"," + "\"RpsTicket\":\"d=" + msAccessToken + "\"}," + "\"RelyingParty\":\"http://auth.xboxlive.com\",\"TokenType\":\"JWT\"}"; HttpRequest req = HttpRequest.newBuilder() .uri(URI.create(XBOX_AUTH_URL)) .header("Content-Type", "application/json") .header("Accept", "application/json") .POST(HttpRequest.BodyPublishers.ofString(body)) .build(); HttpResponse resp = httpClient.send(req, HttpResponse.BodyHandlers.ofString()); if (resp.statusCode() != 200) { throw new IOException("Xbox Live auth failed: HTTP " + resp.statusCode()); } return JsonParser.parseString(resp.body()).getAsJsonObject() .get("Token").getAsString(); } /** Returns [xstsToken, userHash]. */ private String[] fetchXstsToken(String xblToken) throws IOException, InterruptedException { String body = "{\"Properties\":{\"SandboxId\":\"RETAIL\",\"UserTokens\":[\"" + xblToken + "\"]}," + "\"RelyingParty\":\"rp://api.minecraftservices.com/\",\"TokenType\":\"JWT\"}"; HttpRequest req = HttpRequest.newBuilder() .uri(URI.create(XSTS_URL)) .header("Content-Type", "application/json") .header("Accept", "application/json") .POST(HttpRequest.BodyPublishers.ofString(body)) .build(); HttpResponse resp = httpClient.send(req, HttpResponse.BodyHandlers.ofString()); if (resp.statusCode() == 401) { JsonObject json = JsonParser.parseString(resp.body()).getAsJsonObject(); long xerr = json.has("XErr") ? json.get("XErr").getAsLong() : 0; if (xerr == 2148916233L) throw new IOException("This Microsoft account has no Xbox profile"); if (xerr == 2148916238L) throw new IOException("Child accounts must add an adult to their family"); throw new IOException("XSTS auth failed (XErr=" + xerr + ")"); } if (resp.statusCode() != 200) { throw new IOException("XSTS auth failed: HTTP " + resp.statusCode()); } JsonObject json = JsonParser.parseString(resp.body()).getAsJsonObject(); String xstsToken = json.get("Token").getAsString(); String userHash = json.getAsJsonObject("DisplayClaims") .getAsJsonArray("xui").get(0).getAsJsonObject() .get("uhs").getAsString(); return new String[]{ xstsToken, userHash }; } private String fetchMinecraftToken(String xstsToken, String userHash) throws IOException, InterruptedException { String body = "{\"identityToken\":\"XBL3.0 x=" + userHash + ";" + xstsToken + "\"}"; HttpRequest req = HttpRequest.newBuilder() .uri(URI.create(MC_TOKEN_URL)) .header("Content-Type", "application/json") .POST(HttpRequest.BodyPublishers.ofString(body)) .build(); HttpResponse resp = httpClient.send(req, HttpResponse.BodyHandlers.ofString()); if (resp.statusCode() != 200) { throw new IOException("Minecraft token fetch failed: HTTP " + resp.statusCode()); } return JsonParser.parseString(resp.body()).getAsJsonObject() .get("access_token").getAsString(); } private AuthResult fetchMinecraftProfile(String mcToken) throws IOException, InterruptedException { HttpRequest req = HttpRequest.newBuilder() .uri(URI.create(MC_PROFILE_URL)) .header("Authorization", "Bearer " + mcToken) .GET() .build(); HttpResponse resp = httpClient.send(req, HttpResponse.BodyHandlers.ofString()); if (resp.statusCode() == 404) return AuthResult.fail("This account does not own Minecraft Java Edition"); if (resp.statusCode() != 200) return AuthResult.fail("Profile fetch failed: HTTP " + resp.statusCode()); JsonObject json = JsonParser.parseString(resp.body()).getAsJsonObject(); return AuthResult.ok(json.get("name").getAsString(), json.get("id").getAsString()); } private void setState(AuthState newState) { this.state = newState; onStateChange.accept(newState); } }