DirectAuth 1.3.0 (NeoForge 1.21.1)

Upgrading from 1.2.0: if 1.3.0 needs to change your database on first start, it saves a copy first (serverconfig/directauth-backup-<date>.db). Stored passwords are not converted: they keep the format 1.1 and 1.2 use, so players keep their passwords and you can go back to 1.2.0 just by putting the old jar back.

Security

• Failed logins are now counted per account and IP: reconnecting no longer resets the limit, and someone on another IP cannot lock the owner out. New option loginLockoutSeconds (default 300) sets how long logins stay blocked after maxLoginAttempts.
• /changepassword, /directauth resetpass and /directauth unregister log out every other session of the account and kick all its connections.
• /online only checks valid Minecraft names with Mojang and verifies the returned profile (a name like Notch# could resolve to someone else's account).
• Unauthenticated players can no longer drop items, click in their inventory or containers, use creative slots or interact with armor stands.
• ItemPhysic compatibility: its own drop and pickup packets are blocked for unauthenticated players too.
• Unauthenticated players who respawn appear at world spawn instead of the account's bed or respawn anchor; normal respawn rules apply after /login.
• Other mods' automation (FakePlayers such as deployers or miners) is never restricted.

Improved

• Password hashing and all database access run off the server thread: no more lag spikes on login.
• Automatic database backup (serverconfig/directauth-backup-<date>.db) before an upgrade changes the database.
• Online Mode conversion: the player is kicked as soon as the data is moved, and if any step fails everything is rolled back and the account stays offline.
• /directauth online <user> false now migrates the data back to the offline UUID, and works while the player is offline for accounts converted with this version.
• /directauth resetpass also lifts the failed-login lockout.
• /changepassword keeps the account's Online Mode.
• Admin commands report their result over RCON.

Fixed

• An invalid DirectAuth-config.json no longer crashes the server: the previous settings (or defaults) are kept, the file is not overwritten, and /directauth reload reports the error.
• A corrupt positions file no longer prevents the server from starting.
• Opening a second singleplayer world in the same session no longer crashes.
• FTB Quests data is migrated byte-exactly.
• Account names are matched correctly on servers running with a Turkish locale.