Aurelium Patch Notes

⚠️ EXPERIMENTAL WEB FEATURES ⚠️

The newly added Web Dashboard features are currently in active development. Please expect potential bugs or instability if you enable web.enabled in your configuration. The core in-game economy, GUI markets, and auction house are stable.

Version 1.3.2 — Web Dashboard Polish & Security (Minecraft 1.21.11)

🌐 Cloud Dashboard Improvements

• Fix: Stock Change % Fix — Resolved a bug where item base prices (like Diamonds) were being overwritten, causing 0% change to show on the web.
• Fix: Auction Display Fix — Fixed a bug where auction prices would show as undefined instead of the correct currency symbol.
• New: Icons — Replaced all legacy emojis with a premium SVG icon system for better clarity and aesthetics.
• Security: Self-Trade Protection — Players can no longer bid on their own auctions or fill their own buy orders via the web.
  • Buy buttons are now explicitly labeled "Your Auction/Order" and disabled for owned items.
  • Added backend validation to reject self-trading attempts.
• New: Added sellerUuid and buyerUuid to sync payloads for improved identity tracking on the frontend.

🎮 In-Game Fixes

• Fix: GUI De-duplication — Removed redundant item entries in the /stocks GUI that appeared if an item was in multiple categories.

Version 1.3.1 — Request Limit Update (Minecraft 1.21.11)

• Updated: Increased the web dashboard API rate limit to 330 requests per minute.
• New: Added an automatic rate-limit bypass for authenticated Minecraft servers.

Aurelium Patch Notes

⚠️ EXPERIMENTAL WEB FEATURES ⚠️

The newly added Web Dashboard features are currently in active development. Please expect potential bugs or instability if you enable web.enabled in your configuration. The core in-game economy, GUI markets, and auction house are stable.

Version 1.3.0 — Cloud Dashboard Expansion (Minecraft 1.21.11)

🌐 Cloud Dashboard — New Pages

• New: Added Navigation Bar to the web dashboard with tabs for Market, Auction, Orders, and Stocks.
• New: Auction House page — view all active auctions with item icons, BIN/BID tags, countdown timers, seller names, and search.
• New: Buy Orders page — view all active buy orders with progress bars (filled/requested), price per piece, buyer name, and status badges.
• New: Stocks / Price Tracker page — view all items with buy price, sell price, and change % (green ↑ / red ↓). Sortable by name, price, or change.
• New: Interactive Stock Charts — click any item on the Stocks page to open a Modrinth-inspired chart modal with:
  • Smooth bezier curve lines with gradient fill (green for positive trend, red for negative)
  • Y-axis price labels and X-axis date labels
  • Hover tooltips showing exact date, buy price, and sell price
• New: Price History Recording — item prices are recorded every 10 minutes and stored for 7 days.
• New: price_history database table for persistent price tracking.
• New: Multi-Version Icon Fallback: The dashboard will gracefully fallback to older version icons (1.20, 1.19, 1.18) if a 1.21.11 icon is missing from the API, preventing broken images.
• The Web Dashboard is now fully interactive! Players can now purchase items from the Server Market, place bids on the Auction House, buyout BIN auctions, and fulfill Buy Orders straight from their browser.
  • Note: To fulfill orders or buy/bid on auctions from the web, players must have the required funds/items currently in their online inventory.
• New: Web Dashboard sessions now use a rolling 1-hour timeout. The timer resets every time you interact with the dashboard, so active users are never kicked out. Sessions only expire after 1 full hour of inactivity.
• New: A styled 🔒 Session Required error screen now appears when visiting the dashboard without a valid session, guiding users to issue /web in-game.
• New: Added Tab Sleep Mode using the browser's Page Visibility API. If a player switches to another tab or minimizes the browser, the 20-second background data sync pauses to save data and RAM. It instantly fetches fresh data the moment they return to the dashboard.

🎮 GUI Improvements

• New: Added Page Indicator Books to the center of the navigation bar in both MarketGUI and ShopGUI.
• Fix: Fixed a bug where pagination was infinite; players can no longer navigate into empty pages.
• New: Command Separation — /market now strictly opens the in-game GUI (Classic or Modern). The browser dashboard is now exclusively accessed via the /web command.

🖥️ Cloud Sync Improvements

• New: Cross-server dashboard activation queue. To prevent crashes, the global Node.js backend (render-server) now monitors memory usage (>= 500MB). If a server tries to activate its dashboard when memory is maxed out, it will be placed in a fair waitlist queue.
• Optimization: Auction, Order, Stock, and Price History data are now stored as raw JSON strings instead of parsed JavaScript objects, drastically reducing RAM usage per server.
• Improved timeout handling for Render server cold starts (60s connect timeout, per-request timeouts).
• Added retry logic for server registration (5 attempts, 15 seconds apart).
• Sync payload now includes auction, order, stock, and price history data.
• Increased server JSON request limit to 5MB for larger sync payloads.

🛡️ Web Security Hardening

• Fixed XSS vulnerability — the frontend HTML escaping function now properly sanitizes <, >, and & characters, preventing malicious script injection via crafted item or player names.
• CORS locked down — API now only accepts requests from https://webaureliummc.onrender.com, blocking malicious third-party websites.
• Rate limiting — API endpoints now enforce 60 requests per minute per IP to prevent spam and DDoS.
• Token moved to Authorization header — session tokens are no longer visible in URLs, preventing leaks via browser history, server logs, or screenshots.
• Security headers (Helmet) — added X-Frame-Options, X-Content-Type-Options, and other standard HTTP security headers to prevent clickjacking and MIME sniffing.
• IDOR fix — purchase status endpoint now verifies that the requesting player owns the purchase, preventing information leakage.
• Stale purchase cleanup — pending purchases abandoned for 10+ minutes are now automatically cleaned up.
• Queue cap — registration queue capped at 50 entries to prevent abuse.

🔒 Security & Exploits

• CRITICAL: Fixed a major bug that allowed players to bypass transaction costs and duplicate items by interacting with their personal bottom-inventory slots while MarketGUI, AuctionGUI, BidGUI, OffersGUI, or ConfirmPurchaseGUI were open.
• CRITICAL: Fixed a race-condition in AuctionGUI's collection bin that would occasionally grant an item twice if clicked extremely fast via macros or due to server lag.
• Fixed an issue allowing players to drag and lose personal items into empty GUIHolder slots.

💱 Multi-Currency System

• New: Server owners can now define multiple currencies in config.yml (e.g., Aurels, Dollars, Euros) with unique symbols and starting balances.
• New: Each market item can be assigned a specific currency via market.items.<ITEM>.currency.
• New: /bal, /pay, and /eco commands now accept an optional [currency] argument.
• New: /ah sell and /orders create accept an optional currency argument — buyers pay in the seller's specified currency.
• New: player_balances database table stores per-player, per-currency balances with automatic migration from legacy single-balance data.
• Fix: The web dashboard now correctly displays the exact currency symbol (e.g. ₳ or $) sent by the plugin, instead of hardcoded text.
• Vault integration defaults to economy.default-currency for backward compatibility.

🖥️ GUI Mode Selector

• New: Added market.gui-mode config option — server owners choose between three market interfaces:
  • classic — Original chest-based MarketGUI.
  • modern — New ShopGUI with MiniMessage gradient titles, glass-pane borders, and styled lore.
  • web — Opens a browser-based dashboard (see below).

🌐 Web Dashboard

• New: Embedded Modrinth-inspired web dashboard served by the plugin's built-in HTTP server (zero external dependencies).
• New: /web command generates a secure, time-limited clickable link that opens the market in the player's browser.
• Dark-themed UI with category sidebar, item card grid, real-time search, buy modal with amount selector, and toast notifications.
• Session tokens use a rolling 1-hour timeout (hardcoded for security).
• All purchases are executed on the main server thread for thread-safety.
• Configuration: web: enabled: false port: 8585

  Session timeout: rolling 1 hour of inactivity (hardcoded)

📚 Enchanted Books

• Fix: CRITICAL bug where purchasing an Enchanted Book from the MarketGUI or ShopGUI would give the player a completely blank, unenchanted book. The plugin now perfectly parses internal names (like "Protection IV") into actual Bukkit EnchantmentStorageMeta drops!

Aurelium Patch Notes

v1.2.2 (Database Update)

🚀 Core Updates

• MySQL Support: Implemented an optional dual-backend database toggle. Server owners can now switch from SQLite to MySQL directly in the config.yml for massively improved I/O speeds during high-volume trading on larger networks.

Aurelium Patch Notes

v1.2.1 (Minecraft 1.21.11 Update)

🚀 Core Updates

• Minecraft 1.21.11 Support: Updated the paper-api dependency and paperweight versions to compile natively against Paper 1.21.11.
• API Parity Fix: Replaced the removed Material.CHAIN constant with a dynamic lookup and updated its market fallback material from IRON_BLOCK to a more cost-effective IRON_NUGGET.

🛒 Market Updates

• Search Bug Fixed: The /market search function previously iterated through the internal Category.ALL_ITEMS list (a backend survival-items master list for the global order system), causing hundreds of un-buyable items to falsely appear in market search results. This category is now explicitly excluded from market searches.
• Pale Garden Update Items: Added all newly introduced Pale Oak crafts to the Market (Category.WOOD), including logs, stripped variants, plaques, doors, trapdoors, signs, boats, and pale moss blocks/carpets.
• Copper Update Items: Added new Copper variants to the Market (Category.COPPER), including Chests, Lanterns, Torches, Chains, and Bars (including all waxed/oxidized stages).
• Extra Nature Items: Added Firefly Bushes, Leaf Litter, Cactus Flowers, Wildflowers, and Short/Tall Dry Grass to Category.NATURE.
• GUI Price Display Fixes: Items possessing no intrinsic market base price (like Smelted Ores) previously defaulted to an inaccurate 1.0 Aurel display value within the /stocks menu and /orders create GUI. They now intelligently retrieve and display their exact Last Sold Price directly from recent player trading history. Additionally, all 120+ Enchanted Books were incorrectly bundled under a single query; they now properly isolate their prices based on their specific enchantment and level.
• Stocks GUI Sorting: The /stocks menu has been heavily upgraded to feature dynamic live-sorting. Items are now beautifully organized: true dynamic-market items are prioritized at the top of the menu, followed sequentially by pure-trading (Order/Auction) items. Both sections are then sub-sorted by Absolute Percentage Change, ensuring the most volatile and active items (crashing or skyrocketing) are always displayed on the very first page!
• Note: To prevent compilation or runtime errors on servers running without experimental Winter Drop flags, all new 1.21.11 items are integrated via dynamic string matching rather than strict enum constants.

🪲 Bug Fixes

• Fixed a visual bug in /market where the "Previous Page" paper icon mysteriously stopped rendering after navigating to the second page.
• Fixed a severe bug where purchasing multiple items (e.g. 64x) simultaneously evaluated dynamic market volatility as a simple 1x transaction. Large bulk purchases now apply mathematically sound compound inflation models.
• Fixed a bug where recently added Server items (like Pale/Copper) were locked at 1.0 base prices because older server configuration data was mistakenly permanently overriding their new values.