---

📖 About

SleepyAuth is an authentication and account-protection plugin for Paper servers. It asks players to register or log in, restricts unauthenticated players, and provides account security, session management, moderation tools, maintenance mode, logging, and optional Discord/Floodgate features.

Offline-mode (cracked) servers have no Mojang authentication — anyone can join as any username. SleepyAuth fixes this by locking usernames to real owners, protecting player progress, and adding layered security.

Compatibility: Paper 1.20.x and newer (Java 17 bytecode; Paper 1.21+ needs Java 21)

Optional Integrations: Floodgate for Bedrock detection • Discord webhooks for event notifications

---

✨ Features

🔐 Registration & Login

Players register with /register <password> <password> [true|false] and log in with /login <password>. Passwords are hashed — PBKDF2 by default, with salted SHA256 support. Plaintext passwords are never stored or logged.

🛡️ Login Protection

Unauthenticated players receive prompts and action-bar reminders. Join/quit announcements are suppressed until authentication. Configurable restrictions block movement, chat, commands, interactions, damage, hunger, item pickup/drop, and inventory access.

🌌 Void World Protection

An optional generated void world isolates unauthenticated players on a small protected platform. Prevents base stealing, coordinate leaking, griefing, and player tracking.

⏱️ Protection Countdown

After login, a configurable countdown shows a TextDisplay above the player and blocks damage until it expires. Can apply only to first-time registrations.

🔑 Remember Me & Sessions

Optional Remember Me tokens provide longer auto-login (configurable lifetime, optional same-IP enforcement). Short-lived sessions restore login after disconnects. Cleared on logout or password change.

🎮 Bedrock / Floodgate Support

Optional Floodgate detection recognizes Bedrock players. By default, verified Bedrock players skip authentication; force-auth can require them to register or log in instead.

👥 Alt Detection

Tracks registered accounts that share the same IP. Auto-creates alternate-account records (without password hashes) and can alert admins in-game or via Discord.

🔒 Account Security

Per-account brute-force lockouts, per-IP failed-login rate limiting, account-per-IP limits (with bypass permission), and same-name/different-IP connection checks. Lockouts persist in bans.yml across restarts.

🛠️ Admin Tools

Full admin command suite: /sa reload, /forcelogin, /forcelogout, /resetpassword, /unban, /sessions, /info, /stats, /void, and more. Java admins must authenticate by default.

🚧 Maintenance Mode

/maintenance on [reason] [| estimated time] announces a kick countdown, rejects new non-staff connections, and kicks current non-staff players. Operators are exempt unless configured otherwise.

🔗 Discord Webhook Logging

Colored embeds for first-time registrations, alt detections, admin force-logins, private messages (/msg, /tell, /whisper), sign placement/edits, and maintenance start/end.

📍 Spawn System

Teleport players to spawn before login, then return them to their last saved or configured location after authentication.

---

📜 Commands

👤 Player Commands

Command	Description
/register <password> <password> [true|false]	Create an account (optional Remember Me toggle)
/login <password>	Log into your account
/logout	Log out and clear Remember Me token
/changepassword <old> <new>	Change your password
/unregister <password>	Delete your account
/rememberme <true|false>	Toggle Remember Me

🛠️ Admin Commands

Command	Description
/sa help	Show admin command list
/sa reload	Reload config & messages
/sa forcelogin <player>	Authenticate an online player
/sa forcelogout <player>	Return player to unauthenticated state
/sa resetpassword <player> <new>	Reset a player's password
/sa unban <player|ip>	Remove lockout or rate-limit state
/sa sessions	List active remembered sessions
/sa info <player>	Show player account details
/sa stats	Show plugin statistics
/sa void	Toggle between void world and spawn
/maintenance on/off [reason] [| time]	Toggle maintenance mode

---

🔑 Permissions

Permission	Description	Default
sleepyauth.admin	All admin permissions	OP
sleepyauth.reload	/sa reload	OP
sleepyauth.forcelogin	/sa forcelogin	OP
sleepyauth.forcelogout	/sa forcelogout	OP
sleepyauth.resetpassword	/sa resetpassword	OP
sleepyauth.unban	/sa unban	OP
sleepyauth.sessions	/sa sessions	OP
sleepyauth.info	/sa info	OP
sleepyauth.stats	/sa stats	OP
sleepyauth.void	/sa void	OP
sleepyauth.maintenance	/maintenance	OP
sleepyauth.bypass	Java admin login bypass	—
sleepyauth.bypass.iplimit	Bypass IP account limit	OP

---

📝 Changelog

V4.0.0 — Stable Authentication & Security Update

✨ New

• Void World Protection for unauthenticated players
• Protection Countdown with TextDisplay & damage blocking
• Account-per-IP limit with bypass permission
• Alternate-account tracking (no password hashes copied)
• Remember Me toggle (/register ... [true|false], /rememberme)
• Floodgate/Bedrock auto-login support
• Maintenance Mode with reason & estimated time
• Discord webhooks: registrations, alts, force-logins, PMs, signs, maintenance
• Spawn system — return to last saved or configured location after login
• Admin tools: /sa forcelogin, /sa forcelogout, /sa resetpassword, /sa unban, /sa sessions, /sa info, /sa stats, /sa void

🔧 Changed

• Paper 1.20.x+ support (Java 17 bytecode)
• PBKDF2 default hashing (SHA256 fallback); BCrypt/Argon2 fall back to PBKDF2
• Async password hashing & verification
• Brute-force lockouts + IP rate limiting with persistence in bans.yml
• Configurable restrictions: movement, chat, commands, interaction, damage, hunger, items, inventory
• Java admins must authenticate by default

⚠️ Notes

• No tags or rank system
• Passwords never logged in plaintext
• Requires Java 21+ on Paper 1.21 servers

---

🚀 Why SleepyAuth?

SleepyAuth is designed to provide more than just a basic /login command.

It combines authentication, security, session management, moderation tools, and server utilities into one organized plugin.

The goal is simple:

«Keep players protected while making server management easier.»

Install SleepyAuth, configure it for your server, and let your players enjoy a safer Minecraft experience.

---

📥 Installation

1. Use a Paper server (install Floodgate separately if Bedrock detection is needed)
2. Place SleepyAuth-4.0.0.jar in your server's plugins folder
3. Start the server once to create config and data folders
4. Review config.yml — especially authentication, account limits, void-world, maintenance, and Discord settings
5. You're done! 🎉

Building from source:

mvn clean package
# Output: target/SleepyAuth-4.0.0.jar

---

💬 Etherno Project — Community & Support

---