CraftersLogin v2.1

This major release brings production-grade quality, security, and independent infrastructure to your server's authentication system. Version 2.1 eliminates third-party premium authentication dependencies, integrates advanced security APIs, and introduces a native 2FA system for staff members.

---

Key Features

🛠️ Independent Premium Authentication

We have completely removed reliance on external premium authentication libraries. Premium verification is now handled securely at the protocol level via our new specialized hook: CraftersFastAuth.

• Seamless Entry: Verifies players directly against Mojang session services, bypassing password prompts for premium accounts while maintaining the standard flow for non-premium users.
• Note: Requires ProtocolLib and CraftersFastAuth to function on standalone servers.
• 📢 Where to find CraftersFastAuth: You can get the required CraftersFastAuth dependency exclusively through our official Discord server. Join here: https://discord.gg/k6KNKPXsUb

🔑 Two-Factor Authentication (TOTP)

Protect high-privilege staff accounts from credential theft with a native Time-Based One-Time Password system.

• Compatibility: Works with Google Authenticator, Authy, and any standard TOTP app.
• Workflow: Setup via /2fa start, confirmation via /2fa confirm <code>, and verification on login via /2fa verify <code>. Restricted to accounts with the crafterslogin.2fa permission.

🌐 Threat Detection & API Integrations

• Anti-VPN & Proxy (ProxyCheck.io): Detects and rejects connections from anonymizing networks during the pre-login event before they enter the server.
• Geographic Filtering (IP-API): Restrict or block connections from high-risk regions using standard ISO country codes.
• Compromised Passwords (HIBP): Blocks registrations using leaked credentials using the secure k-Anonymity model (raw passwords/hashes are never sent over the network).

📊 Monitoring & Performance

• Asynchronous Discord Webhooks: Sends real-time embedded notifications for registrations, successful logins, and failed attempts directly to your Discord staff channels without affecting server ticks.
• PlaceholderAPI Support: Register statistics using %crafterslogin_total_accounts% and %crafterslogin_premium_accounts%.
• Automated Config Updater: Automatically injects missing configuration keys into config.yml on startup without overwriting your custom values.

⚙️ Database & Stability Optimizations

• Automated Data Migration: A new administrator-only command allows full account and session data migration between H2 and MySQL backends in any direction.
• H2 Connection Pool Refactor: Rewritten connection management to guarantee absolute stability and prevent failures under heavy concurrent login pressure.
• Core Fixes: Resolved SHA-256 password verification failures and fixed session expiration desynchronization on rejoin.

---

Upgrade Notes

1. Dependencies: Ensure ProtocolLib is installed and download CraftersFastAuth from our Discord Server if you plan to use independent premium authentication.
2. Configuration: New security keys will automatically inject into your config.yml. Review them to toggle features like Anti-VPN, Geo-IP, or HIBP protections.
3. Localization: Every player-facing string can now be fully customized inside the new messages.yml file.