ValleyAuth v0.1.0-alpha

First alpha release. Authentication, identity, and player-data migration plugin for Paper servers (1.21+).

What's Included

Stage 1: Authentication System

Three identity types are recognized and handled automatically:

Authentication Flow (Non-Bedrock Players)

1. Client sends LOGIN_START
2. ValleyAuth intercepts, sends EncryptionRequest (standard Minecraft encryption handshake)
3. Client responds with encrypted shared secret + verify token
4. ValleyAuth enables AES/CFB8/NoPadding channel encryption
5. ValleyAuth calls Mojang's sessionserver/minecraft/hasJoined endpoint
6. Premium accounts: Mojang UUID verified, player joins with real identity
7. Offline accounts: Verification fails, player gets - prefixed username + ValleyAuth UUID

Commands

• /register <password> <confirmPassword> - Register a password for Offline identities
• /login <password> - Authenticate with a previously registered password

Enforcement

Unauthenticated Offline players are restricted to survival mode with movement, interaction, chat, and inventory blocked until /login is completed.

Dependencies

• Required: Paper 1.21+ (any recent version)
• Required: PacketEvents 2.13.0 (included)
• Optional: Floodgate 2.2+ (Bedrock player detection)
• Optional: Geyser-Spigot (Bedrock protocol translation)
• Optional: ProtocolLib (fallback packet listener if PacketEvents unavailable)

Configuration

• server.properties online-mode=false required for ValleyAuth auth to activate
• When online-mode=true, ValleyAuth runs Floodgate detection and identity tracking only (for future Stage 2 migration bookkeeping), but skips the auth handshake

Known Limitations

• Mojang sessions are one-time-use — restarting the client is required between different servers
• Passwords stored in YAML (plain text) — will be migrated to proper storage in a future stage
• No configurable restriction messages or bypass permissions yet
• No /changepassword or /forgotpassword commands yet