CraftersLogin 3.0 — Release Notes

Compatible with: Paper / Spigot 1.13 – 1.21.x
Required: ProtocolLib 5.x (for SIGN authentication mode)
Optional: PlaceholderAPI, CraftersFastAuth, CraftersStaff

🆕 New Features

🔐 Sign GUI Authentication System (Anti-Logger)

Players can now authenticate using a native Minecraft Sign editor interface. When /login or /register is executed in SIGN mode, the sign editor opens automatically — no chat required.

ProtocolLib-Powered: A fake sign block is sent to the client via ProtocolLib packets. When the player types their password and clicks Done, the packet is intercepted server-side — the sign is never placed in the world, and the block is instantly restored.
Alphanumeric Support: Players can type full passwords (letters, numbers, special characters) using their keyboard — no more PIN pads!
Security: Completely bypasses chat, rendering malicious client chat-loggers completely useless.
Registration Flow: On /register, the Sign opens twice — once for the new password and once for confirmation. If the passwords don't match, the flow restarts.
Configurable: Toggle between CHAT and SIGN mode in config.yml via authentication.type.
Cleanup on Quit: If a player disconnects mid-authentication, their sign state and block data are automatically cleaned up.

🌐 Smart Proxy & Bedrock Auto-Detection (Plug and Play)

Silent Reflection: Replaced noisy floodgate-api checks with silent Reflection — fully compatible with GeyserMC without dependency conflicts.
Auto-Routing: The plugin automatically detects if the server is Standalone or behind a Proxy (BungeeCord/Velocity) by safely reading paper-global.yml and spigot.yml in memory. It adapts its network behavior entirely on its own.

📧 Automated Password Recovery (Self-Service)

JavaMail Integration: Embedded an asynchronous SMTP mailer (javax.mail).
/recovery Command: Players can link their emails, request a recovery PIN, and set a new password without needing staff intervention.

🚫 Advanced Anti-Alt Limits

SQL Counting: Uses SELECT COUNT(*) instead of memory-heavy Java list counting, preventing memory spikes.
Network Exemption: Includes an IP whitelist system (whitelisted-ips) for cybercafes and sibling households.

🔄 Redis Session Synchronization

Multi-Proxy Support: Introduced SessionStore architecture.
High Availability: Uses JedisPool and Redis native SETEX for cross-server session state persistence. Falls back to memory safely if Redis drops.

🗄️ Universal Database Migration Tool

AuthMe & nLogin Support: The /crafterslogin import command directly streams accounts from an old plugin's database (SQLite/MySQL) straight into CraftersLogin.
Smart Hashing: BCrypt passwords migrate 1:1 seamlessly. Older SHA hashes import safely, prompting the user for an update upon login.

🏠 Spawn Management System

A completely new dedicated system for defining player spawn points. Administrators can now configure five distinct spawn types — for login, registration, first-time join, general join, and respawn — each independently set via the /crafterslogin spawn command. Spawn locations are now stored in a separate spawns.yml file.

👻 Player Invisibility During Authentication

Players who have not yet logged in or registered are now automatically hidden from all other online players. Fully configurable via config.yml.

🎒 Inventory Isolation During Authentication

When a player joins and is placed into the authentication flow, their inventory is securely backed up and cleared. Once they successfully authenticate, their full inventory is restored. This prevents potential item exploits during the unauthenticated state.

⏱️ ActionBar Countdown Toggle

A new option in config.yml (actionbar.enabled) allows server owners to completely disable the login/register countdown displayed in the action bar.

✅ Full Command Autocompletion (TabComplete)

All /crafterslogin commands and their subcommands now support tab-completion. This includes the full spawn tree: /crafterslogin spawn → set/unset/teleport/list → auth/firstjoin/join/register/respawn. Autocompletion is permission-aware.

🤝 Crafters Synergy Bridge (CraftersLogin ↔ CraftersStaff)

When a staff member who has their Staff Mode or Vanish active reconnects, both systems are automatically coordinated during the authentication flow — the player's staff state is suspended until login is complete, then transparently restored.

🔒 Have I Been Pwned (HIBP) Integration

An optional check against the HIBP public database prevents players from registering with compromised passwords.

🛡️ Brute Force Protection

A graduated brute force defense system. Failed login attempts are tracked per IP. After a configurable threshold, the IP is temporarily blocked. After a higher threshold, it can be permanently blocked.

🤖 Captcha Verification

An optional CAPTCHA challenge (item-based, no external URLs required) can be triggered for suspicious IPs or for all unauthenticated players.

🌍 GeoIP Country Blocking for Staff

Staff members with crafterslogin.staff.security permission can be restricted to only connect from allowed countries.

🗝️ Staff Secret Answer Challenge

Staff members are prompted to configure a secret answer on first login. If a staff member connects from a different IP, they are challenged to provide this answer before being granted access.

📱 2FA System for Staff (Optional)

An optional TOTP-based Two-Factor Authentication system for staff. Staff can self-enroll via /2fa start. If a staff member loses access to their authenticator, they can request removal which alerts online administrators for approval.

💤 AFK Session Timeout

Staff sessions expire after a configurable period of inactivity. When the session expires, the player is logged out and must authenticate again.

📊 PlaceholderAPI Integration

Full PlaceholderAPI expansion registered under %crafterslogin_<variable>%, providing all player-specific data (registration status, last IP, login count, 2FA status, etc.) to compatible plugins and scoreboards.

🔧 Improvements

Database Architecture

Uses a factory-based database initialization approach. The database is connected and validated before any other subsystem starts, eliminating startup crashes caused by dependency injection ordering issues.

Dependency Injection Order

Corrected the initialization sequence so all managers receive a fully initialized and connected database instance at construction time. This resolved the [Guice/MissingImplementation] startup error.

Admin Command Infrastructure

The /crafterslogin command has been fully rebuilt with individual sub-handlers for each administrative action. Permissions are checked granularly, allowing server owners to grant access to specific admin actions without giving full crafterslogin.admin access.

Help Menu

The /crafterslogin help menu now accurately lists all available commands including the new spawn management and migration tools.

🐛 Bug Fixes

Secret Answer Not Saving (SQL Error 90012)

The database update query for player accounts was missing the secret_answer field binding. This caused the /setsecurityanswer command to throw a SQL error and fail to save the answer. The parameter mapping has been corrected.

plugin.yml YAML Syntax Error

A malformed YAML node in the plugin descriptor was preventing the plugin from loading entirely on the server. The permission tree has been corrected and validated.

Missing Messages (All Admin Commands)

The following message keys were missing from messages.yml, causing the plugin to log Missing message: <key> in the chat for all administrative operations:

admin.accounts-count, admin.player-not-found, admin.kick.unregistered, admin.kick.password-changed
admin.dupeip-header, admin.dupeip-entry, admin.force-login-success, admin.force-logout-success
admin.changepass-success, admin.unregister-success, admin.delete-warning, admin.delete-success
admin.purge-success, admin.reload, admin.version-info, admin.error
admin.migratedb.* (all sub-keys), admin.usage.* (all sub-keys), admin.title, admin.help.* (all sub-keys)
register.already-registered, errors.unknown-subcommand, errors.invalid-number, spawn.* (all sub-keys)

Spawn Command Accepted Wrong Type Names

The spawn command previously required exact internal enum names (FIRST_JOIN). It now accepts user-friendly lowercase names as documented (firstjoin), with automatic conversion.

Duplicate YAML Sections

The register and errors sections were duplicated across the file due to an editing error. The duplicate entries have been removed.

⚙️ Configuration Changes

File	Key	Description
`config.yml`	`actionbar.enabled`	Toggles the login/register countdown display in the action bar
`config.yml`	`spawns.hide-players-while-unauthenticated`	Controls whether unauthenticated players are hidden from authenticated players
`config.yml`	`security.anti-alts` (new section)	Limits accounts per IP with exemptions
`config.yml`	`network-sessions` (new section)	Multi-proxy synchronization configuration with Redis support
`config.yml`	`recovery` (new section)	Email integration settings for password resets
`config.yml`	`authentication.type`	Now accepts `CHAT` (classic) or `SIGN` (Sign GUI via ProtocolLib). The old `GUI` inventory PIN pad mode has been replaced entirely with `SIGN`.
`spawns.yml`	(new file)	Dedicated file for spawn point coordinates. Replaces the old `data/locations.yml` internal file.

CraftersLogin