McChatBridge

Added

• Account System: Login and registration windows before accessing the chat.
• Sessions: Login is remembered for 7 days (HttpOnly cookie), surviving server restarts—no re-login required.
• "Logout" button: Added to the player panel.
• Brute-force protection: Rate limiting on login (5 failed attempts per IP → 15-minute lockout).
• Emoji support: The emoji panel is now functional.
• Image and GIF uploads: The 📎 button is now working; images display in-game via ChatImage.
• Notification sound: A harp sound plays for new global and private messages (built into the mod).
• Background switcher: Personal button 🖼️ (desktop only); the background is stored in the user's browser.
• "Scroll to bottom" button: Appears when scrolling up, returns instantly to the latest messages, 50% transparency, blinks yellow on new messages. Styled in a square, Minecraft-inspired design.
• New endpoints: /auth/register, /auth/login, /auth/logout, /auth/me, /notify.wav.

Changed

• Nickname binding: Nicknames are now tied to accounts and cannot be edited manually (prevents impersonation).
• Smelting window: Fully localized (EN/RU); previously, some labels were hardcoded in Russian.
• Interface language: Applied on page load, rather than only after manual switching.
• Avatar delivery: Detects actual file type (PNG/JPEG/GIF) and serves the correct Content-Type.

Fixed

• SSE connection drops: Resolved constant disconnections and ERR_INCOMPLETE_CHUNKED_ENCODING errors; the connection now stays open until the client disconnects.
• Smelting item loss: Fixed items disappearing from smelting slots during the process (server-side race condition—furnace access is now synchronized).
• "Gave Air!" message: Fixed the issue where items were transferred as "Air"; the item name is now retrieved before adding it to the inventory.
• Hardcoded labels: Removed hardcoded Russian labels that appeared in English mode (chat tabs/smelting/tooltips).

Security

• Password hashing: PBKDF2-HMAC-SHA256 (210,000 iterations) + individual salt. Passwords are never stored in plain text.
• Session identity binding: Sending messages, PMs, reading PM history, and uploading avatars use the nickname from the session—users cannot write as others or read private messages that aren't theirs.
• Avatar upload validation: Verified by file signature (magic bytes) + 2MB limit.
• Path traversal: Eliminated a vulnerability in avatar nickname processing.

New Files (created automatically)

• config/mcchatbridge_accounts.json — accounts (salt + hash).
• config/mcchatbridge_sessions.json — active sessions.