package com.hybridauth; import org.bukkit.Bukkit; import org.bukkit.command.*; import org.bukkit.configuration.file.YamlConfiguration; import org.bukkit.entity.Player; import org.bukkit.event.*; import org.bukkit.event.block.*; import org.bukkit.event.entity.EntityDamageEvent; import org.bukkit.event.entity.EntityPickupItemEvent; import org.bukkit.event.player.*; import org.bukkit.plugin.java.JavaPlugin; import javax.crypto.SecretKeyFactory; import javax.crypto.spec.PBEKeySpec; import java.io.File; import java.net.*; import java.security.*; import java.util.*; import java.util.concurrent.*; /** * HybridAuth 4.0 — 6-Way Matrix Architecture (Fully Persisted Database Edition) * * Matrix-01 Java Premium → no prefix, auto-skip auth * Matrix-02 Java Cracked → prefix *, requires /login * Matrix-03 Bedrock Premium PC → prefix ., auto-skip auth (Floodgate Xbox verified) * Matrix-04 Bedrock Cracked PC → prefix .*, requires /login (Floodgate, no Xbox token) * Matrix-05 Pocket Premium Mobile → prefix _, auto-skip auth (Floodgate Xbox verified) * Matrix-06 Pocket Cracked Mobile → prefix _*, requires /login * * Storage: Bukkit YamlConfiguration (auth.yml) — fully persists all 6 matrix types. */ @SuppressWarnings("deprecation") public class Auth extends JavaPlugin implements Listener, CommandExecutor { // ── Constants ───────────────────────────────────────────────────────────── private static final long SESSION_MS = 7L * 24 * 60 * 60 * 1000; private static final int MAX_ATTEMPTS = 5; private static final String PREFIX_MSG = "§8[§bAuth§8] §r"; /** Bedrock specific prefixes — protects routing from Java client spoofs. */ private static final List RESERVED_PREFIXES = List.of(".*", "_*", ".", "_"); // ── State ───────────────────────────────────────────────────────────────── private final Set pendingAuth = ConcurrentHashMap.newKeySet(); private final Map failCounts = new ConcurrentHashMap<>(); private final Map typeCache = new ConcurrentHashMap<>(); /** Thread-safe in-memory user store — snapshot flushed to auth.yml on changes. */ private final Map users = new ConcurrentHashMap<>(); private File dataFile; private YamlConfiguration yaml; private boolean floodgatePresent = false; // ── Inner record ────────────────────────────────────────────────────────── private static class UserRecord { String username; String passwordHash; // "PREMIUM" for auto-auth matrices String lastIp; long lastLogin; String matrix; UserRecord(String username, String passwordHash, String lastIp, long lastLogin, String matrix) { this.username = username; this.passwordHash = passwordHash; this.lastIp = lastIp; this.lastLogin = lastLogin; this.matrix = matrix; } } // ── Lifecycle ───────────────────────────────────────────────────────────── @Override public void onEnable() { saveDefaultConfig(); loadYaml(); floodgatePresent = Bukkit.getPluginManager().getPlugin("floodgate") != null; getLogger().info(floodgatePresent ? "Floodgate found — Bedrock matrix routing active." : "Floodgate NOT found — all players treated as Java (Matrix-01 or Matrix-02)."); for (String c : List.of("register", "login", "changepassword")) { PluginCommand cmd = getCommand(c); if (cmd != null) cmd.setExecutor(this); } Bukkit.getPluginManager().registerEvents(this, this); for (Player p : Bukkit.getOnlinePlayers()) handleJoinLogic(p); getLogger().info("HybridAuth 4.0 enabled (6-Way Matrix Database Sync Active)."); } @Override public void onDisable() { saveYaml(); getLogger().info("HybridAuth 4.0 disabled — data safely saved."); } // ── YAML persistence (Thread-Safe Isolation) ────────────────────────────── private void loadYaml() { getDataFolder().mkdirs(); dataFile = new File(getDataFolder(), "auth.yml"); if (!dataFile.exists()) { try { dataFile.createNewFile(); } catch (Exception e) { getLogger().severe("Could not create auth.yml: " + e.getMessage()); } } yaml = YamlConfiguration.loadConfiguration(dataFile); if (yaml.isConfigurationSection("users")) { for (String uuid : yaml.getConfigurationSection("users").getKeys(false)) { String path = "users." + uuid + "."; users.put(uuid, new UserRecord( yaml.getString(path + "username", ""), yaml.getString(path + "password", ""), yaml.getString(path + "last_ip", "unknown"), yaml.getLong (path + "last_login", 0L), yaml.getString(path + "matrix", "matrix02") )); } } getLogger().info("Loaded " + users.size() + " user(s) across the 6-way matrix from auth.yml."); } private synchronized void saveYaml() { if (dataFile == null) return; // Generate an isolated configuration snapshot to eliminate thread race conditions YamlConfiguration snapshotYaml = new YamlConfiguration(); for (Map.Entry e : users.entrySet()) { String path = "users." + e.getKey() + "."; UserRecord r = e.getValue(); snapshotYaml.set(path + "username", r.username); snapshotYaml.set(path + "password", r.passwordHash); snapshotYaml.set(path + "last_ip", r.lastIp); snapshotYaml.set(path + "last_login", r.lastLogin); snapshotYaml.set(path + "matrix", r.matrix); } try { snapshotYaml.save(dataFile); this.yaml = snapshotYaml; } catch (Exception ex) { getLogger().severe("Failed to save auth.yml: " + ex.getMessage()); } } private void saveAsync() { Bukkit.getScheduler().runTaskAsynchronously(this, this::saveYaml); } // ── Password hashing (PBKDF2 / SHA-256) ────────────────────────────────── private String hashPassword(String password) { try { byte[] salt = new byte[16]; new SecureRandom().nextBytes(salt); byte[] hash = pbkdf2(password, salt, 65536); return "65536:" + b64(salt) + ":" + b64(hash); } catch (Exception e) { throw new RuntimeException(e); } } private boolean verifyPassword(String password, String stored) { if (stored == null || !stored.contains(":")) return false; try { String[] parts = stored.split(":"); int itr = Integer.parseInt(parts[0]); byte[] salt = Base64.getDecoder().decode(parts[1]); byte[] hash = Base64.getDecoder().decode(parts[2]); return MessageDigest.isEqual(hash, pbkdf2(password, salt, itr)); } catch (Exception e) { return false; } } private byte[] pbkdf2(String pass, byte[] salt, int itr) throws Exception { PBEKeySpec spec = new PBEKeySpec(pass.toCharArray(), salt, itr, 256); return SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256").generateSecret(spec).getEncoded(); } private String b64(byte[] b) { return Base64.getEncoder().encodeToString(b); } // ── IP helper ───────────────────────────────────────────────────────────── private String ip(Player p) { return p.getAddress() != null ? p.getAddress().getAddress().getHostAddress() : "unknown"; } // ── Matrix type helpers ─────────────────────────────────────────────────── private boolean isAutoAuth(String matrix) { return "matrix01".equals(matrix) || "matrix03".equals(matrix) || "matrix05".equals(matrix); } private String getMatrixLabel(String matrix) { if (matrix == null) return "§7Unknown"; return switch (matrix) { case "matrix01" -> "§aJava Premium"; case "matrix02" -> "§eJava Cracked"; case "matrix03" -> "§bBedrock Premium PC"; case "matrix04" -> "§eBedrock Cracked PC"; case "matrix05" -> "§bPocket Premium Mobile"; case "matrix06" -> "§ePocket Cracked Mobile"; default -> "§7Unknown"; }; } private String bedrockMatrixFromName(String name) { if (name.startsWith(".*")) return "matrix04"; if (name.startsWith("_*")) return "matrix06"; if (name.startsWith(".")) return "matrix03"; if (name.startsWith("_")) return "matrix05"; return "matrix04"; // fallback: cracked bedrock } private boolean checkMojangPremium(String username) { try { URL url = new URL("https://api.mojang.com/users/profiles/minecraft/" + username); HttpURLConnection con = (HttpURLConnection) url.openConnection(); con.setRequestMethod("GET"); con.setConnectTimeout(3000); con.setReadTimeout(3000); return con.getResponseCode() == 200; } catch (Exception e) { getLogger().warning("Mojang API unreachable for " + username + " — treating as cracked."); return false; } } // ── Pre-login ───────────────────────────────────────────────────────────── @EventHandler(priority = EventPriority.LOWEST) public void onPreLogin(AsyncPlayerPreLoginEvent event) { UUID uuid = event.getUniqueId(); String name = event.getName(); // Block vanilla Java clients spoofing Bedrock prefixes if (!floodgatePresent || uuid.getMostSignificantBits() != 0L) { for (String res : RESERVED_PREFIXES) { if (name.startsWith(res)) { event.disallow(AsyncPlayerPreLoginEvent.Result.KICK_OTHER, "§cUsername prefix §e" + res + "§c is reserved for Bedrock routing."); return; } } } // Floodgate Bedrock UUID: MSB == 0 if (floodgatePresent && uuid.getMostSignificantBits() == 0L) { typeCache.put(uuid, bedrockMatrixFromName(name)); return; } // Java Matrix Route boolean premium = checkMojangPremium(name); typeCache.put(uuid, premium ? "matrix01" : "matrix02"); } // ── Join logic ──────────────────────────────────────────────────────────── @EventHandler(priority = EventPriority.MONITOR) public void onJoin(PlayerJoinEvent event) { handleJoinLogic(event.getPlayer()); } private void handleJoinLogic(Player player) { UUID uuid = player.getUniqueId(); String matrix = typeCache.getOrDefault(uuid, "matrix02"); String currentIp = ip(player); long now = System.currentTimeMillis(); // Auto-Auth Matrices (01, 03, 05) Data Persistence & Welcome if (isAutoAuth(matrix)) { player.sendMessage(PREFIX_MSG + getMatrixLabel(matrix) + " §7verified. Welcome!"); // Seamless background data tracking for premium matrices Bukkit.getScheduler().runTaskAsynchronously(this, () -> { users.put(uuid.toString(), new UserRecord(player.getName(), "PREMIUM", currentIp, now, matrix)); saveYaml(); }); return; } // Cracked player handling — needs auth pendingAuth.add(uuid); failCounts.put(uuid, 0); Bukkit.getScheduler().runTaskAsynchronously(this, () -> { UserRecord rec = users.get(uuid.toString()); if (rec != null) { boolean valid = currentIp.equals(rec.lastIp) && (now - rec.lastLogin < SESSION_MS); if (valid) { // Refresh session data rec.lastLogin = now; rec.username = player.getName(); rec.matrix = matrix; // Refresh matrix state identity saveYaml(); Bukkit.getScheduler().runTask(this, () -> { pendingAuth.remove(uuid); player.sendMessage(PREFIX_MSG + "§aSession resumed. Welcome back §e" + player.getName() + "§a!"); }); return; } Bukkit.getScheduler().runTask(this, () -> player.sendMessage(PREFIX_MSG + "§eSession expired. Use §b/login ")); } else { Bukkit.getScheduler().runTask(this, () -> { player.sendMessage(PREFIX_MSG + "§eWelcome! Please register:"); player.sendMessage("§7 §b/register "); }); } }); } @EventHandler public void onQuit(PlayerQuitEvent event) { UUID uuid = event.getPlayer().getUniqueId(); pendingAuth.remove(uuid); failCounts.remove(uuid); typeCache.remove(uuid); } // ── Commands ────────────────────────────────────────────────────────────── @Override public boolean onCommand(CommandSender sender, Command cmd, String label, String[] args) { if (!(sender instanceof Player p)) { sender.sendMessage("§cPlayers only."); return true; } return switch (cmd.getName().toLowerCase()) { case "register" -> cmdRegister(p, args); case "login" -> cmdLogin(p, args); case "changepassword" -> cmdChangePassword(p, args); default -> false; }; } private boolean cmdRegister(Player p, String[] args) { UUID uuid = p.getUniqueId(); String matrix = typeCache.getOrDefault(uuid, "matrix02"); if (isAutoAuth(matrix)) { p.sendMessage(PREFIX_MSG + "§cVerified accounts don't need to register."); return true; } if (!pendingAuth.contains(uuid)) { p.sendMessage(PREFIX_MSG + "§cYou are already logged in."); return true; } if (args.length < 2) { p.sendMessage(PREFIX_MSG + "§cUsage: §b/register "); return true; } if (!args[0].equals(args[1])) { p.sendMessage(PREFIX_MSG + "§cPasswords do not match!"); return true; } if (args[0].length() < 6) { p.sendMessage(PREFIX_MSG + "§cPassword must be at least 6 characters."); return true; } String hash = hashPassword(args[0]); String currentIp = ip(p); long now = System.currentTimeMillis(); Bukkit.getScheduler().runTaskAsynchronously(this, () -> { if (users.containsKey(uuid.toString())) { Bukkit.getScheduler().runTask(this, () -> p.sendMessage(PREFIX_MSG + "§cAlready registered! Use §b/login")); return; } users.put(uuid.toString(), new UserRecord(p.getName(), hash, currentIp, now, matrix)); saveYaml(); Bukkit.getScheduler().runTask(this, () -> { pendingAuth.remove(uuid); failCounts.remove(uuid); p.sendMessage(PREFIX_MSG + "§aRegistered & logged in! Welcome, §e" + p.getName() + "§a!"); }); }); return true; } private boolean cmdLogin(Player p, String[] args) { UUID uuid = p.getUniqueId(); String matrix = typeCache.getOrDefault(uuid, "matrix02"); if (isAutoAuth(matrix)) { p.sendMessage(PREFIX_MSG + "§cVerified accounts don't need to login."); return true; } if (!pendingAuth.contains(uuid)) { p.sendMessage(PREFIX_MSG + "§cYou are already logged in."); return true; } if (args.length < 1) { p.sendMessage(PREFIX_MSG + "§cUsage: §b/login "); return true; } int attempts = failCounts.getOrDefault(uuid, 0); if (attempts >= MAX_ATTEMPTS) { p.kickPlayer(PREFIX_MSG + "§cToo many failed attempts. Reconnect to try again."); return true; } String currentIp = ip(p); long now = System.currentTimeMillis(); Bukkit.getScheduler().runTaskAsynchronously(this, () -> { UserRecord rec = users.get(uuid.toString()); if (rec == null) { Bukkit.getScheduler().runTask(this, () -> p.sendMessage(PREFIX_MSG + "§cNot registered yet. Use §b/register ")); return; } if (verifyPassword(args[0], rec.passwordHash)) { rec.lastIp = currentIp; rec.lastLogin = now; rec.username = p.getName(); rec.matrix = matrix; saveYaml(); Bukkit.getScheduler().runTask(this, () -> { pendingAuth.remove(uuid); failCounts.remove(uuid); p.sendMessage(PREFIX_MSG + "§aLogged in! Welcome back, §e" + p.getName() + "§a!"); }); } else { failCounts.merge(uuid, 1, Integer::sum); int left = MAX_ATTEMPTS - failCounts.getOrDefault(uuid, 0); Bukkit.getScheduler().runTask(this, () -> { if (left <= 0) p.kickPlayer(PREFIX_MSG + "§cToo many failed attempts."); else p.sendMessage(PREFIX_MSG + "§cWrong password. §e" + left + " §cattempt(s) left."); }); } }); return true; } private boolean cmdChangePassword(Player p, String[] args) { UUID uuid = p.getUniqueId(); String matrix = typeCache.getOrDefault(uuid, "matrix02"); if (isAutoAuth(matrix)) { p.sendMessage(PREFIX_MSG + "§cVerified accounts can't change a password here."); return true; } if (pendingAuth.contains(uuid)) { p.sendMessage(PREFIX_MSG + "§cYou must be logged in to change your password."); return true; } if (args.length < 3) { p.sendMessage(PREFIX_MSG + "§cUsage: §b/changepassword "); return true; } if (!args[1].equals(args[2])) { p.sendMessage(PREFIX_MSG + "§cNew passwords do not match."); return true; } if (args[1].length() < 6) { p.sendMessage(PREFIX_MSG + "§cNew password must be at least 6 characters."); return true; } Bukkit.getScheduler().runTaskAsynchronously(this, () -> { UserRecord rec = users.get(uuid.toString()); if (rec == null || !verifyPassword(args[0], rec.passwordHash)) { Bukkit.getScheduler().runTask(this, () -> p.sendMessage(PREFIX_MSG + "§cOld password is incorrect.")); return; } rec.passwordHash = hashPassword(args[1]); saveYaml(); Bukkit.getScheduler().runTask(this, () -> p.sendMessage(PREFIX_MSG + "§aPassword changed successfully!")); }); return true; } // ── Restriction events ──────────────────────────────────────────────────── @EventHandler(priority = EventPriority.HIGHEST) public void onMove(PlayerMoveEvent e) { if (pendingAuth.contains(e.getPlayer().getUniqueId()) && e.hasChangedPosition()) e.setTo(e.getFrom()); } @EventHandler(priority = EventPriority.HIGHEST) public void onCommand(PlayerCommandPreprocessEvent e) { if (!pendingAuth.contains(e.getPlayer().getUniqueId())) return; String cmd = e.getMessage().toLowerCase(); if (!cmd.startsWith("/login") && !cmd.startsWith("/register")) { e.setCancelled(true); e.getPlayer().sendMessage(PREFIX_MSG + "§cAuthenticate first: §b/login §7or §b/register"); } } @EventHandler(priority = EventPriority.HIGHEST) public void onChat(AsyncPlayerChatEvent e) { if (pendingAuth.contains(e.getPlayer().getUniqueId())) { e.setCancelled(true); e.getPlayer().sendMessage(PREFIX_MSG + "§cAuthenticate first!"); } } @EventHandler(priority = EventPriority.HIGHEST) public void onBreak(BlockBreakEvent e) { if (pendingAuth.contains(e.getPlayer().getUniqueId())) e.setCancelled(true); } @EventHandler(priority = EventPriority.HIGHEST) public void onPlace(BlockPlaceEvent e) { if (pendingAuth.contains(e.getPlayer().getUniqueId())) e.setCancelled(true); } @EventHandler(priority = EventPriority.HIGHEST) public void onDamage(EntityDamageEvent e) { if (e.getEntity() instanceof Player p && pendingAuth.contains(p.getUniqueId())) e.setCancelled(true); } @EventHandler(priority = EventPriority.HIGHEST) public void onDrop(PlayerDropItemEvent e) { if (pendingAuth.contains(e.getPlayer().getUniqueId())) e.setCancelled(true); } @EventHandler(priority = EventPriority.HIGHEST) public void onPickup(EntityPickupItemEvent e) { if (e.getEntity() instanceof Player p && pendingAuth.contains(p.getUniqueId())) e.setCancelled(true); } }