🛡️ RayLogin v1.0.3 – Fixed & Enhanced

🔧 Bugs & Stability Fixes

• 🐞 Fixed race conditions in login state changes that caused players getting stuck in unauthenticated UI.
• 🐞 Fixed async login/database race issues that occasionally caused duplicate or inconsistent account data.
• 🐞 Fixed teleport glitches between /raylogin spawn locations during login and first‑join flows.
• 🐞 Fixed IP‑session system skipping login on some edge cases when IP changed slightly.
• 🐞 Fixed console‑log leaks and debug‑print issues that could accidentally expose sensitive auth information.
• ⚡ Improved performance of login‑throttle and concurrent‑auth handling.

✨ UI & UX Improvements

• 🎨 Refined gradient‑style login/register messages for a more premium feel.
• 🎨 Improved title and bossbar timing so cinematic countdown looks smoother.
• 🎨 Polish particles and sound events on login/register success and failure.
• 🎨 Minor tweaks to clickable chat messages for better readability and responsiveness.
• 🎨 Small visual polish on emergency/login‑confirm UI for premium‑style UX.

🔐 Security & Session System Upgrades

• 🔐 Smart Session Logic
  • Sessions now refresh on successful login, extending auto‑login duration.
  • IP‑change handling is smarter: quick re‑join from same IP triggers auto‑login, big IP change may ask for re‑confirmation.
• 🔐 Trusted IP / Trusted Device
  • Admins can mark IPs as trusted for extended auto‑login grace.
  • Optional re‑confirm on suspicious IP‑change to stop simple bypass attempts.
• 🔐 Suspicious Login / IP Tracker
  • Track failed login attempts per IP and per player.
  • Admin command /rl suspicious <player|ip> shows history and stats.
  • Console warning for abnormal failed‑attempt bursts.
• 🔐 Login‑Throttle Protection
  • Added soft limits:
    • Max concurrent logins per IP.
    • Max concurrent logins per server.
  • If limits hit, players are gently queued or delayed instead of crashing the server.
• 🔐 login / register packet handling made safer when ProtocolLib is present.
• 🔐 Improved brute‑force protection tolerance and auto‑kick behavior.

✅ New / Premium-Like Features

🎯 Emergency One-Time Pass

• Added /rl emergencypass <player>
  • Generates a temporary one‑time code for that player.
  • Player can use /templogin de> once to log in.
  • Code expires after configurable time and is single‑use.
  • Useful for recovery when players forget passwords or don’t use external support tools.

✅ Click‑To‑Verify Login Confirmation

• Optional login‑confirmation mode:
  • After successful password input, player receives a clickable message like ✅ Confirm Login.
  • If not clicked within the configured time, the login is canceled.
  • This is a light UI‑based bot‑filter that doesn’t affect normal players but makes basic automation attacks a bit harder.
• Toggle via config.

✅ Premium UI Bypass

• Added raylogin.premium.ui permission:
  • Premium players skip the blindness effect, countdown timer, and boss bar before login (visually).
  • They still actually log in securely in the background.
  • Great for VIP/boosted players who expect “instant” join‑style UX.

✅ Premium Visual Effects

• Added unique particles + title effects for:
  • Premium successful login (for players with raylogin.premium).
• Slight visual polish for “queue‑style” UI when many players are logging in at once.

⚙️ Config & Messages

• ✅ config.yml improvements:
  • New sessions: section for:
    • session-duration-hours
    • premium-session-duration-hours
    • trusted-ips: []
  • New security: section for:
    • max-concurrent-logins-per-ip
    • max-concurrent-logins-per-server
    • click-to-verify-enabled: true/false
    • click-to-verify-timeout-seconds
  • emergency: section for emergency one‑time pass settings.
  • All options are documented and commented clearly.
• ✅ messages.yml:
  • Added gradient‑style messaging for /premium, emergency‑pass, and click‑to‑verify.
  • Better‑worded error messages and UX hints for login‑throttle and suspicious‑IP cases.

🧩 Commands & Permissions

New Commands

• /rl emergencypass <player> – generate a one‑time login code.
• /templogin de> – single‑use emergency login.

New Permissions

• raylogin.premium – for premium auto‑login and trusted‑session benefits.
• raylogin.emergency – for /rl emergencypass.
• raylogin.bypass.clickverify – skips the click‑verify confirmation step.
• raylogin.premium.ui – disables visual login UI (blindness, countdown, bossbar) for premium players.
• raylogin.staff.info.suspicious – for /rl suspicious.

Existing Commands (Unchanged core)

• /login <password>
• /register <password> >
• /changepassword <old> <new> >
• /premium <on|off>
• /rl help
• /rl reload
• /rl info <player>
• /rl changepass <player> <new_password>
• /rl forcelogin <player>
• /raylogin spawn set <type>

🧹 Backwards Compatibility

• ✅ raylogin.db schema is unchanged where possible.
• ✅ Old passwords and accounts are fully preserved.
• ✅ config.yml and messages.yml from v1.0.2 can be safely migrated (with minor config‑merge required for new options).
• ✅ ProtocolLib integration behavior is kept compatible, but made safer.

💬 Notes

• This is a bug‑fix + premium‑feature release.
• If you used RayLogin v1.0.2, you can safely update without deleting player data.
• Recommended:
  • Test login‑throttle, click‑to‑verify, and emergency‑pass system on a staging server before enabling for production.

📢 Feedback

• Please report any remaining bugs or UI issues.
• Feature ideas for future v1.x versions are welcome!