rAuth - 2.7.0

---

• Added Bot Protection.

  # =======================================================
  #              Bot Protection System
  # =======================================================
  bot-protection:
    # Main switch to turn ON/OFF the entire Bot Protection System
    enabled: true
    max-attempts: 5
    kick-after: 5
    ip-ban-after: 15
    ip-ban-time: 30m
    block-time-multiplier:
      enabled: true
      multiplier: 2

    # Session Verification Bypass Window (in minutes)
    # If a verified player rejoins within this window, bot verification is skipped.
    session-timeout-minutes: 20

    # Post-Verification Action
    kick-on-success: true
    success-kick-message: '&a&lVerified! &ePlease rejoin the server to authenticate.'

    # Bot Protection Bypass Configurations
    bypass:
      premium: true
      whitelisted-countries: true
      whitelisted-continents: true
      whitelisted-ips: true

    # Custom choice questions asked on a single line. Either choice is valid.
    # The system randomizes questions without immediate repetition.
    choice-questions:
      - question: Messi or Ronaldo?
        options:
          - Messi
          - Ronaldo
      - question: Cats or Dogs?
        options:
          - Cats
          - Dogs
      - question: Pizza or Burger?
        options:
          - Pizza
          - Burger
      - question: Summer or Winter?
        options:
          - Summer
          - Winter
      - question: MrBeast or T-Series?
        options:
          - MrBeast
          - T-Series
      - question: Windows or Linux?
        options:
          - Windows
          - Linux
      - question: Coffee or Tea?
        options:
          - Coffee
          - Tea

    messages:
      prefix: '&a&lrAuth&7» '
      start: '&ePlease answer the following question to verify you are human:'
      invalid-answer: '&cInvalid response! Please type one of the given choices.'
      kick-message: '&cYou have been kicked for too many invalid bot verification responses.'
      ban-message: '&cYour IP has been temporarily banned for %time% due to failing bot verification.'
      remaining-attempts: '&cAttempts left before action: &e%left%'

    sounds:
      question-shown: BLOCK_NOTE_BLOCK_PLING
      success: ENTITY_PLAYER_LEVELUP
      invalid-answer: ENTITY_VILLAGER_NO
      kick: ENTITY_VILLAGER_DEATH
      ban: ENTITY_ENDER_DRAGON_GROWL
    spawn:
      world: world
      x: -45.8830560260036
      y: 95.0
      z: -2.882257117741117
      yaw: 167.97032
      pitch: 47.75597

• Now, two or more players with the same name cannot join the server simultaneously.

  already-online-protection:
    enabled: true
    kick-message: '&cThis player is already in game!'

• Turned off IP Auto Login by default (you can turn it back on from config.yml).

  login-gamemode: ADVENTURE
  premium-bypass: true
  ip-auto-login: false
  bedrock-bypass: true

• Added an option to whitelist and block entire countries and continents (can be turned on or off from config.yml).

# =============================================================
  #         GEOGRAPHIC COUNTRY & CONTINENT FILTER
  # =============================================================
  country-filter:
    enabled: false
    kick-message: '&cConnections from your country (%country%) are blocked!'
    blocked-countries:
      - KP
      - PK
    whitelisted-countries:
      - IN
      - RU
    # Whitelisted countries bypass bot protection and authentication entirely
    whitelisted-auto-login:
      title: '&a&lVerified Region'
      subtitle: '&7Auto-logged in from %country%!'
      sound: ENTITY_PLAYER_LEVELUP

  continent-filter:
    enabled: false
    kick-message: '&cConnections from your continent (%continent%) are blocked!'
    blocked-continents:
      - 
    whitelisted-continents:
      - 

• Added a notification message for admins when a player logs in from a new IP.

  ip-warning:
    # Enable or disable the IP warning system for administrators (rlogin.admin)
    enabled: true
    message:
      - '&e--------------------------------------------------'
      - '&c&l[ADMIN SECURITY WARNING] &eYou logged in from a new IP!'
      - '&7Last Login: &f%last_date%'
      - '&7Last IP: &f%last_ip%'
      - '&7Last Location: &f%last_location%'
      - '&e--------------------------------------------------'

• Added an option to block weak passwords.

 # =====================================
  #        WEAK PASSWORD PROTECTION
  # =====================================
  password-rules:
    min-length: 6
    max-length: 20
    require-numbers: true
    require-uppercase: false
    require-special: false
    blacklist:
      - '12345'
      - '123456'
      - '12345678'
      - password
      - qwerty
      - abcdef
    messages:
      blacklisted: '&cPassword rejected! This password is too common and insecure.'
      require-numbers: '&cPassword rejected! Must contain at least one number.'
      require-uppercase: '&cPassword rejected! Must contain at least one uppercase letter.'
      require-special: '&cPassword rejected! Must contain at least one special character.'

• Added a password recovery option, using /forgot, /forgotpass, or /forgotpassword. Players can first set a recovery question and its answer. If they use these commands again while logged in, they can change their question and answer. If a player uses these commands before logging in, their saved recovery question will be asked by rAuth. They must answer it using /forgotpass answer <answer>. If the answer is correct, the player will be granted permission to change their password using /rauth newpass <newpass> one time only. To use this feature again, the player must repeat the same recovery process.

  # =============================
  # RECOVERY (Forgot Password)
  # =============================
  forgot-pass:
    messages:
      prefix: '&a&lrAuth &r&b[Recovery] &7» '
      no-recovery: '&cNo security question set! Since you are not logged in, you cannot recover your password.'
      setup-prompt: '&eTo secure your account, set up a recovery question: &b/forgotpass setup <question> | <answer>'
      change-prompt: '&eTo change your recovery details, use: &b/forgotpass change <current_answer> | <new_question> | <new_answer>'
      setup-success: '&aSecurity question configured successfully!'
      setup-usage: '&eUsage: /forgotpass setup <question> | <answer>'
      already-logged: '&cYou are already logged in. To change recovery, use &e/forgotpass change <current_answer> | <new_question> | <new_answer>'
      question-prompt: '&eSecurity Question: &f%question%&e. Answer with &b/forgotpass answer <answer>'
      incorrect-answer: '&cIncorrect recovery answer!'
      correct-answer: '&aRecovery correct! You now have permission to run &e/rauth newpass <newpassword> &aonce.'
      newpass-usage: '&eUsage: /rauth newpass <newpassword>'
      newpass-no-permission: '&cYou do not have permission to run this command! Verify security question first.'
      change-success: '&aSecurity question and answer updated successfully!'
      change-usage: '&eUsage: /forgotpass change <current_answer> | <new_question> | <new_answer>'

• Dependencies are now optional.
• Mixed and changed the version update message.
• Added new SFX, which can be turned on or off from config.yml.
• Every single thing, from chat messages to SFX to the entire feature set, is configurable.

Join our Discord to report bugs.