JanusMCD – Discord ↔ Minecraft Chat Bridge & Passwordless Auth.

[0.2.4] - 2026-01-27

Added

• Core Security & Network Evolution:

  • Unified Security Model: The "Gateway & Enforcer" protocol is now the standard for all implementations.
    • In Proxy Networks: Velocity acts as the Gateway, handling all trust; Backend servers act as Enforcers, strictly validating the Gateway's decisions via secure channels.
    • In Single Server: The server acts as both, maintaining the same rigorous "Auto-Vouch" and session security standards locally.
  • Evolution of Trusted Sessions: Expanded the trust architecture to support reliable IP-based "Auto-Vouching," whether managed by a Proxy or a local server.
  • Smart Session Handshake: Intelligent handshake protocol that proactively synchronizes authenticated state. On Velocity, this syncs across servers; on Single Server, it ensures instant state restoration after reloads/relays.
  • Offline Packet Queue: Implemented a "Store and Forward" system for sync packets. Actions taken while servers are empty are queued and flushed when players join, guaranteeing data consistency for both single and multi-server setups.

• Cross-Server Synchronization:

  • Implemented robust janusmcd:sync Plugin Messaging channel.
  • Velocity now actively intercepts/relays LINK and UNLINK packets between backend servers, ensuring account states are consistent across the entire network.

• Visual Feedback:

  • Added distinct notifications for authentication types:
    • ✔ Session verified by Velocity: Indicates an Auto-Vouched trusted session.
    • ✅ Your identity has been verified: Indicates a manual DM button authentication.

• Configuration:

  • Customizable Join/Leave messages via discord.yml.
  • Join/Leave messages can now be toggled via use-embeds.

Changed

• Strict Security Enforcement:
  • Removed janusmcd.auth.bypass: Removed the bypass permission entirely. The "Gateway & Enforcer" model requires ALL connections to be validated by the Proxy (or Janus local auth). No player, including OPs, can bypass this check via permission node, eliminating a potential configuration loophole.
  • Strict Console Security: Implemented a mandatory Role ID check (console-command-role-id) for executing commands via Discord Console channels. If configured, even the Guild Owner is denied access unless they hold the specific role.
  • Nuclear Command Blacklist: Added a dedicated nuclear-blacklist.yml configuration file. This system provides an "Air-Gap" defense by hard-blocking specific commands (default: categorized lists for rank control, server stability, integrity, etc.) from being executed via Discord Console under any circumstances, even by the Owner. Supports recursive namespaced filtering (e.g., blocking op also blocks minecraft:op).
• Critical Sync Bugs:
  • Solved race condition where 'Unlink' from Discord wouldn't propagate to Velocity if the server was empty.
  • Fixed a bug where Backend servers would not receive Sync packets due to missing carrier players.
  • Fixed PluginMessagingManager initialization and logging visibility.
• Security Check:
  • Anti-Spoofing: Velocity now explicitly blocks client-sourced messages on the janusmcd:sync channel, preventing hacked clients from forging link packets.
  • Performance: Database operations during the join handshake are now fully asynchronous, preventing main-thread lag during login storms.
• Build & Compatibility:
  • Relocated GSON library to prevent conflicts with Velocity's internal dependencies.
  • Fixed Folia scheduler reflection issues.

Technical

• Bumped logging levels for Sync operations to INFO for better visibility during setup.
• Refactored AuthHandshakeListener to handle "Lazy Sync" of Discord IDs.