PANAS AUTH

PANAS AUTH is a lightweight, ultra-secure, and modern authentication plugin built specifically for crossplay Minecraft servers (Paper 1.21.x to 26.2+) running Java 21–25+. Designed from the ground up to support both Java Edition players and Bedrock Edition players seamlessly without compromising server safety.

---

Key Features

Dual-Platform Authentication

• Bedrock Edition (Floodgate): Instant 100% passwordless auto-login via Floodgate API verification. Bedrock players connect securely without typing passwords while non-Floodgate spoofers are automatically blocked.
• Java Edition: Full-featured secure password registration and authentication (/register & /login) with BCrypt salted hashing.

Bulletproof Anti-Exploit System

• Case-Sensitivity Normalization: Prevents username hijacking or database corruption caused by capitalization tricks (e.g., Player vs player).
• Command Preprocess Blocking: Blocks all player commands, interactions, movements, inventories, item pickups, drops, and damage events until the player is fully logged in.
• IP Rate-Limiting: Protects your server against connection floods and bot attacks at the pre-login layer.
• Strict Session Hijacking Defense: Smart session reconnect checks both UUID and IP Address simultaneously to prevent session theft on shared Wi-Fi networks.

Maximum Performance

• 100% Async Database Operations: Powered by HikariCP connection pooling for both SQLite and MySQL/MariaDB. Database queries run completely off the main thread—zero server lag or TPS drops during login spikes.
• Zero External Library Dependencies: SQLite Driver, HikariCP, and BCrypt are shaded directly into the plugin jar.

Fully Customizable UI & Localization

• Custom Titles & Subtitles: Display dynamic login/register prompts on the player's screen (&cPLEASE LOGIN!).
• BossBar Countdown Timer: Animated visual countdown showing remaining time before a player gets kicked for inactivity.
• 100% Translatable: All in-game messages, title texts, kick reasons, BossBar labels, and admin responses are fully customizable in languages/ (en_US.yml, id_ID.yml).

---

Commands & Permissions

Player Commands

Command	Aliases	Description	Permission
/register <pass> <confirm>	/reg	Register a new account	Default
/login <password>	/l	Log in to an existing account	Default
/logout	—	End your active session	Default
/changepassword <old> <new>	/cp, /changepass	Change your account password	Default

Admin Commands

Command	Description	Permission
/panasauth resetpass <player> <newpass>	Reset a player's password	panasauth.admin
/panasauth unregister <player>	Remove a player account from database	panasauth.admin
/panasauth alts <player/IP>	Check all linked alt accounts by IP/User	panasauth.admin
/panasauth reload	Reload configuration & language files	panasauth.admin

Special Permissions

• panasauth.admin — Gives full access to /panasauth admin commands (Default: OP).
• panasauth.bypass.altlimit — Bypasses the maximum accounts registered per IP restriction (Default: false).

---

Installation & Setup

1. Drop PANASAuth-1.0.0.jar into your server's plugins/ folder.
2. (Optional) Install Floodgate if you run a Geyser.
3. Start or restart your server to generate configuration files.
4. Customise settings in plugins/PANASAuth/config.yml and language files in plugins/PANASAuth/languages/.
5. Enjoy a bulletproof authentication setup!

---

Default Configuration (config.yml)

# PANAS AUTH Configuration
# Author: sandreamin

language: "en_US" # Select language (en_US, id_ID, or custom files in languages/)

database:
  type: "SQLITE" # Options: SQLITE or MYSQL
  mysql:
    host: "localhost"
    port: 3306
    database: "panasauth"
    username: "root"
    password: ""
    pool-size: 10

auto-login:
  bedrock-floodgate: true # Instant auto-login for Floodgate Bedrock players

security:
  login-timeout: 30 # Seconds allowed to log in before kick
  min-password-length: 6
  max-accounts-per-ip: 1
  rate-limit-per-ip: 3 # Max connection requests per IP in 10 seconds
  session:
    enabled: true
    reconnect-window: 120 # Duration (seconds) to preserve session on disconnect

---

Tested on Paper 26.2 Java 25

Compatibility

• Server Software: Paper, Purpur (1.21.x – 26.2+).
• Java Runtime: Java 21 to Java 25+.
• Optional Integrations: Floodgate (for Bedrock auto-login).

---