BedrockPassport

🪪 BedrockPassport 1.0.1

This update hardens the identity handoff between BedrockPassport, Floodgate and authentication plugins.

🔐 Safer authentication handoff

BedrockPassport no longer exposes the selected Java identity to authentication plugins as a trusted Floodgate account link.

The selected identity is still preserved:

• Java username
• Java/offline UUID
• real Bedrock XUID
• Xbox username
• device and input information

But before authentication plugins make their login decision:

• isLinked() is now false
• getLinkedPlayer() is now null

A saved Passport identity therefore remains exactly what it should be: an identity shortcut, not proof of account ownership.

Authentication plugins must still perform their normal password, PIN, form, registration or other verification.

🛡️ Fail-safe identity verification

Added a new protected handoff stage that verifies the selected Passport identity before backend authentication continues.

If the Floodgate identity state cannot be safely converted or verified, the login is rejected instead of continuing with an ambiguous identity.

🧩 Authentication compatibility

• BedrockPassport now loads before AlixSystem so the untrusted identity view can be installed before its authentication decision.
• AuthMe continues to work as a separate authentication layer without a dedicated adapter.
• Added runtime reporting for the active identity trust mode.

/bp status now shows:

identity trust: untrusted handoff