v1.6.0 Changelog

peyajAuth v1.6.0 introduces powerful advanced security features, including Two-Factor Authentication (2FA), recovery email confirmation codes, packet-based inventory hiding, independent login/registration timeouts, and native compatibility updates for Minecraft 26.2 and Java 25.

---

Key Highlights

Google Authenticator Two-Factor Authentication (2FA)

• TOTP Security: Players can now secure their accounts using standard Google Authenticator or Authy apps.
• Restricted State: Players with 2FA enabled are kept restricted (unable to move, execute commands, use chat, or see their inventory) even after inputting their password correctly, until they execute /2fa verify <code>.
• Admin Bypass: Operators can force-disable 2FA for a player who lost access to their authenticator device using /auth 2fa disable <player>.

Linked Recovery Emails with SMTP Verification

• Linked Accounts: Players can link a recovery email address to their account to facilitate password resets.
• Verification Codes: Adding or changing an email address dispatches a random 6-digit confirmation code to the email. The player must run /email confirm <code> in-game within 5 minutes to finalize the change.
• Local Fallback: If SMTP is disabled or connection fails, the plugin automatically falls back to local in-game verification (/email confirm without a code), ensuring no broken features.

Packet-Based Inventory Hiding

• Visual Privacy: Unauthenticated players see an empty inventory screen client-side, preventing item leakage. Normal inventory contents are safely restored sync on the main thread upon successful login.

Separate Login & Registration Timeouts

• Dynamic Timeouts: Replaced the single timeout setting with two separate configurations: login-timeout and register-timeout.
• Better UX: Allows administrators to give new players more time to register passwords while enforcing strict, faster timeouts on existing players logging in.

Minecraft 26.2 & Java 25 Support

• PacketEvents 2.13.0: Upgraded PacketEvents dependency to resolve startup class mapping conflicts on Minecraft 26.2 servers.
• Cross-Version Compatibility: Shaded dependency libraries (including Adventure API) directly into the JAR without relocation, allowing the plugin to run natively on both Minecraft 1.21.x (Java 21) and Minecraft 26.2 (Java 25) servers.

---

Commands & Permissions Reference

• /2fa <setup|confirm|disable|verify> - Manage Google Authenticator settings (Default: Everyone).
• /email <add|change|remove|confirm|show> - Manage recovery email links (Default: Everyone).
• /auth 2fa disable <player> - Disable 2FA for a player (Default: OP, Permission: peyajauth.admin).