rAuth - 3.0.0

---

• Added Two-Factor Authentication using TOTP, compatible with Google Authenticator and similar authenticator applications.

  # =============================
  # TWO-FACTOR AUTHENTICATION
  # =============================
  two-factor:
    enabled: true
    issuer: rAuth
    code-length: 6
    code-ttl-seconds: 30
    max-attempts: 5
    lock-minutes: 10
    require-on-auto-login: true
    timeout-seconds: 60
    bossbar-title: '&aTwo-Factor Authentication'

Commands:

/2fa <enable|disable|code>
/totp <enable|disable|code>
/twofactor <enable|disable|code>

• Added Argon2id password hashing as an alternative to BCrypt.

  # =============================
  # ARGON2ID PASSWORD HASHING
  # =============================
  argon2:
    enabled: false
    iterations: 3
    memory-kib: 65536
    parallelism: 2
    upgrade-legacy-hashes: true

• Added email-based password recovery using one-time SMTP verification codes.

  # =============================
  # EMAIL PASSWORD RECOVERY
  # =============================
  email-recovery:
    enabled: false
    smtp:
      host: smtp.example.com
      port: 587
      ssl: false
      starttls: true
      username: ''
      password: ''
      from: ''
      from-name: rAuth
    code-length: 6
    code-ttl-minutes: 10
    max-attempts: 5
    resend-cooldown-seconds: 60

  forgot-pass:
    methods:
      email: true

Commands:

/forgotpass setemail <email>
/forgotpass email <email>
/forgotpass emailcode <code>

• Added name-change detection and account data transfer. rAuth can detect when a player changes their Minecraft name and allows administrators to transfer account data between names.

  # =============================
  # NAME CHANGE DETECTION
  # =============================
  name-change:
    enabled: true
    auto-detect: true
    notify-admins: true
    update-stored-name: true

Command:

/rauth transfer <oldName> <newName>

• Added Discord webhook notifications for security and login events through WebhookNotifier.

  # =============================
  # DISCORD SECURITY WEBHOOKS
  # =============================
  discord-webhooks:
    enabled: false
    webhook-url: ''
    username: rAuth
    avatar-url: ''
    timeout-seconds: 10
    queue-capacity: 100

    events:
      join: true
      login: true
      register: true
      wrong-password: true
      ip-blocked: true
      bot-banned: true
      name-change: true
      geo-blocked: true
      register-flood: true
      brute-force-wave: true

• Added Redis multi-server synchronization for bans, account locks, bot bans, bot sessions, whitelists, blacklists, and related authentication data.

  # =============================
  # REDIS MULTI-SERVER SYNC
  # =============================
  redis:
    enabled: false
    host: localhost
    port: 6379
    password: ''
    database: 0
    timeout-seconds: 5
    key-prefix: rauth:
    sync-interval-seconds: 5

    sync:
      ip-bans: true
      subnet-bans: true
      account-locks: true
      bot-bans: true
      bot-sessions: true
      whitelists: true
      blacklists: true

• Added PlaceholderAPI support with rAuth placeholders.

  placeholders:
    enabled: true

Available placeholders include:

%rauth_status%
%rauth_registered%
%rauth_lastlogin%
%rauth_2fa_enabled%
%rauth_session_active%
%rauth_language%
%rauth_ip%

• Added per-player language selection with 8 bundled locales: English, German, Spanish, French, Hindi, Portuguese, Russian, and Chinese.

  # =============================
  # PLAYER LOCALES
  # =============================
  locales:
    enabled: true
    default-locale: en
    available:
      - en
      - de
      - es
      - fr
      - hi
      - pt
      - ru
      - zh

Command:

/language <code>
/lang <code>
/locale <code>

• Added an interactive Setup Wizard GUI for configuring rAuth directly in-game.

  # =============================
  # SETUP WIZARD
  # =============================
  setup-wizard:
    enabled: true
    title: '&a&l rAuth Setup'
    main-title: '&8rAuth Configuration'

Command:

/rauth setup

• Added anonymous bStats metrics through MetricsManager.

  # =============================
  # BSTATS METRICS
  # =============================
  metrics:
    enabled: true
    plugin-id: 0

• Added saved sessions, allowing players to use a "remember me" option for a configurable number of days.

  # =============================
  # SAVED SESSIONS
  # =============================
  session:
    enabled: true
    login-flag: -s
    max-days: 30
    max-sessions-per-player: 5
    auto-login: true
    bypass-bot-protection: false
    show-tip: true

Command:

/login <password> -s

• Added a rejoin grace period. Players who quickly reconnect from the same IP can skip entering their password again during the configured grace period.

  # =============================
  # REJOIN GRACE PERIOD
  # =============================
  rejoin-grace:
    enabled: true
    period-minutes: 5

• Added password reset functionality for administrators and players who successfully complete the recovery verification flow.

Commands:

/rauth resetpass <player>
/rauth newpass <newpassword>

The password reset flow is protected by the recovery verification system.

• Added administrator session inspection and session purge commands.

/rauth sessions
/rauth sessions [player]
/rauth clearsessions
/rauth clearsessions [player]

Session-related limits use the existing session.* configuration.

• Added a version information command.

/rauth version

The Bot Protection history can be viewed through /auth.

• Added pre-authentication restrictions for block breaking, block placing, and general player interaction through LobbyRestrictionsListener.

These restrictions are hard-blocked for security and do not have a configuration toggle. See the restrictions: comment in config.yml for details.

• Added hunger and food-level cancellation while a player is unauthenticated.

This is hard-blocked for security and does not have a configuration toggle.

• Added console password masking using Log4j and JUL filters.

  mask-console-passwords: true

• Added flat-file storage fallback. rAuth can now operate without MySQL by using local flat-file caches.

  mysql:
    enabled: false

When MySQL is disabled, rAuth uses flat-file storage for data such as:

users
last-location
sessions
recovery
emails

• All the dependencies are optional but reccomended otherwise some feature like Bedrock & Premium auto bypass will not work.

• Updated and improved the version update notification message.

• Added new sound effects throughout the plugin, with configurable sound settings.

• Expanded configuration support across the plugin. Chat messages, sounds, authentication systems, recovery methods, security features, storage, webhooks, Redis synchronization, locales, sessions, and other feature settings can be configured from config.yml.

Join our Discord to report bugs.