package com.hybridauth; import com.destroystokyo.paper.profile.PlayerProfile; import org.bukkit.Bukkit; import org.bukkit.command.Command; import org.bukkit.command.CommandExecutor; import org.bukkit.command.CommandSender; import org.bukkit.configuration.file.FileConfiguration; import org.bukkit.configuration.file.YamlConfiguration; import org.bukkit.entity.Player; import org.bukkit.event.EventHandler; import org.bukkit.event.EventPriority; import org.bukkit.event.Listener; import org.bukkit.event.block.BlockBreakEvent; import org.bukkit.event.block.BlockPlaceEvent; import org.bukkit.event.entity.EntityDamageEvent; import org.bukkit.event.player.*; import org.bukkit.plugin.java.JavaPlugin; import java.io.File; import java.io.IOException; import java.net.HttpURLConnection; import java.net.URL; import java.nio.charset.StandardCharsets; import java.security.MessageDigest; import java.util.HashSet; import java.util.Set; import java.util.UUID; public class Auth extends JavaPlugin implements Listener, CommandExecutor { private File authFile; private FileConfiguration authConfig; private final Set unauthenticatedPlayers = new HashSet<>(); // Session expires after 7 days (in milliseconds) private final long SESSION_EXPIRY_TIME = 7L * 24L * 60L * 60L * 1000L; @Override public void onEnable() { authFile = new File(getDataFolder(), "userdata.yml"); if (!authFile.exists()) { authFile.getParentFile().mkdirs(); try { authFile.createNewFile(); } catch (IOException e) { e.printStackTrace(); } } authConfig = YamlConfiguration.loadConfiguration(authFile); getCommand("register").setExecutor(this); getCommand("login").setExecutor(this); Bukkit.getPluginManager().registerEvents(this, this); getLogger().info("HybridAuth successfully initiated with Auto-Login Sessions!"); } private void saveAuthDataAsync() { Bukkit.getScheduler().runTaskAsynchronously(this, () -> { try { authConfig.save(authFile); } catch (IOException e) { e.printStackTrace(); } }); } private String hashPassword(String password) { try { MessageDigest md = MessageDigest.getInstance("SHA-256"); byte[] hash = md.digest(password.getBytes(StandardCharsets.UTF_8)); StringBuilder hexString = new StringBuilder(2 * hash.length); for (byte b : hash) { String hex = Integer.toHexString(0xff & b); if (hex.length() == 1) hexString.append('0'); hexString.append(hex); } return hexString.toString(); } catch (Exception e) { throw new RuntimeException("Failed to hash password", e); } } private String getPlayerIP(Player player) { if (player.getAddress() == null) return "unknown"; return player.getAddress().getAddress().getHostAddress(); } // ========================================== // COMMAND HANDLING (/login & /register) // ========================================== @Override public boolean onCommand(CommandSender sender, Command cmd, String label, String[] args) { if (!(sender instanceof Player)) return true; Player player = (Player) sender; String name = player.getName(); if (!name.endsWith("_c")) { player.sendMessage("§cPremium players do not need authentication commands."); return true; } String path = "users." + name.toLowerCase(); if (cmd.getName().equalsIgnoreCase("register")) { if (!unauthenticatedPlayers.contains(player.getUniqueId())) { player.sendMessage("§cYou are already authenticated."); return true; } if (authConfig.contains(path + ".password")) { player.sendMessage("§cThis account is already registered! Use /login instead."); return true; } if (args.length < 2) { player.sendMessage("§cUsage: /register "); return true; } if (!args[0].equals(args[1])) { player.sendMessage("§cPasswords do not match!"); return true; } // Save Hash, IP, and Time for the session authConfig.set(path + ".password", hashPassword(args[0])); authConfig.set(path + ".last_ip", getPlayerIP(player)); authConfig.set(path + ".last_login", System.currentTimeMillis()); saveAuthDataAsync(); unauthenticatedPlayers.remove(player.getUniqueId()); player.sendMessage("§a§lAccount registered successfully! Session saved."); return true; } if (cmd.getName().equalsIgnoreCase("login")) { if (!unauthenticatedPlayers.contains(player.getUniqueId())) { player.sendMessage("§cYou are already authenticated."); return true; } if (!authConfig.contains(path + ".password")) { player.sendMessage("§cThis account is not registered yet! Use /register."); return true; } if (args.length < 1) { player.sendMessage("§cUsage: /login "); return true; } String storedHash = authConfig.getString(path + ".password"); if (hashPassword(args[0]).equals(storedHash)) { unauthenticatedPlayers.remove(player.getUniqueId()); // Update session memory on successful manual login authConfig.set(path + ".last_ip", getPlayerIP(player)); authConfig.set(path + ".last_login", System.currentTimeMillis()); saveAuthDataAsync(); player.sendMessage("§a§lAccess granted. Welcome back!"); } else { player.sendMessage("§cIncorrect password!"); } return true; } return true; } // ========================================== // EVENT HANDLING (Handshaking & Security) // ========================================== @EventHandler(priority = EventPriority.LOWEST) public void onPlayerPreLogin(AsyncPlayerPreLoginEvent event) { String baseName = event.getName(); if (baseName == null || baseName.endsWith("_p") || baseName.endsWith("_c")) return; boolean isPremium = checkPremiumStatus(baseName); String newName = isPremium ? baseName + "_p" : baseName + "_c"; UUID separateUUID = UUID.nameUUIDFromBytes(("OfflinePlayer:" + newName).getBytes(StandardCharsets.UTF_8)); PlayerProfile profile = Bukkit.createProfile(separateUUID, newName); event.setPlayerProfile(profile); } @EventHandler public void onPlayerJoin(PlayerJoinEvent event) { Player player = event.getPlayer(); String name = player.getName(); if (name.endsWith("_p")) { player.sendMessage("§a§l[HybridAuth] §7Premium account verified automatically. Welcome back!"); } else if (name.endsWith("_c")) { String path = "users." + name.toLowerCase(); // Auto-Login Session Check if (authConfig.contains(path + ".password")) { long lastLogin = authConfig.getLong(path + ".last_login", 0); String lastIp = authConfig.getString(path + ".last_ip", ""); String currentIp = getPlayerIP(player); if (currentIp.equals(lastIp) && (System.currentTimeMillis() - lastLogin < SESSION_EXPIRY_TIME)) { // Session is valid! Update the timer so they get another 7 days. authConfig.set(path + ".last_login", System.currentTimeMillis()); saveAuthDataAsync(); player.sendMessage("§a§l[HybridAuth] §7Session resumed automatically. Welcome back!"); return; // Stop here, do not add them to unauthenticated list } } // If session is expired, invalid IP, or new player: require auth unauthenticatedPlayers.add(player.getUniqueId()); player.sendMessage("§e§l--- Welcome ---"); if (authConfig.contains(path + ".password")) { player.sendMessage("§6Session expired or IP changed. Please log in: §b/login "); } else { player.sendMessage("§6Please register using: §b/register "); } player.sendMessage("§e-----------------"); } } @EventHandler public void onQuit(PlayerQuitEvent event) { unauthenticatedPlayers.remove(event.getPlayer().getUniqueId()); } // ========================================== // RESTRICTION HANDLERS (Prevents unauthenticated players from doing anything) // ========================================== @EventHandler(priority = EventPriority.HIGHEST) public void onMove(PlayerMoveEvent event) { if (!unauthenticatedPlayers.contains(event.getPlayer().getUniqueId())) return; if (event.hasChangedPosition()) { event.setTo(event.getFrom()); } } @EventHandler(priority = EventPriority.HIGHEST) public void onCommand(PlayerCommandPreprocessEvent event) { if (!unauthenticatedPlayers.contains(event.getPlayer().getUniqueId())) return; String cmd = event.getMessage().toLowerCase(); if (!cmd.startsWith("/login") && !cmd.startsWith("/register")) { event.setCancelled(true); event.getPlayer().sendMessage("§c§l[!] §cYou must authenticate first! Use /login or /register."); } } @EventHandler(priority = EventPriority.HIGHEST) public void onChat(AsyncPlayerChatEvent event) { if (unauthenticatedPlayers.contains(event.getPlayer().getUniqueId())) { event.setCancelled(true); event.getPlayer().sendMessage("§c§l[!] §cYou must authenticate first!"); } } @EventHandler(priority = EventPriority.HIGHEST) public void onBlockBreak(BlockBreakEvent event) { if (unauthenticatedPlayers.contains(event.getPlayer().getUniqueId())) event.setCancelled(true); } @EventHandler(priority = EventPriority.HIGHEST) public void onBlockPlace(BlockPlaceEvent event) { if (unauthenticatedPlayers.contains(event.getPlayer().getUniqueId())) event.setCancelled(true); } @EventHandler(priority = EventPriority.HIGHEST) public void onDamage(EntityDamageEvent event) { if (event.getEntity() instanceof Player) { Player p = (Player) event.getEntity(); if (unauthenticatedPlayers.contains(p.getUniqueId())) event.setCancelled(true); } } @EventHandler(priority = EventPriority.HIGHEST) public void onDropItem(PlayerDropItemEvent event) { if (unauthenticatedPlayers.contains(event.getPlayer().getUniqueId())) event.setCancelled(true); } // ========================================== // MOJANG API VERIFICATION HANDLER // ========================================== private boolean checkPremiumStatus(String username) { try { URL url = new URL("https://api.mojang.com/users/profiles/minecraft/" + username); HttpURLConnection connection = (HttpURLConnection) url.openConnection(); connection.setRequestMethod("GET"); connection.setConnectTimeout(2000); connection.setReadTimeout(2000); return (connection.getResponseCode() == HttpURLConnection.HTTP_OK); } catch (Exception e) { return false; } } }