🛡️ UltimateAuth - Enterprise Minecraft Authentication & Security

UltimateAuth is a flagship, high-performance authentication and account defense engine designed from the ground up for modern Minecraft networks (1.20 - 1.21.4+). Built on non-blocking async architecture, it safeguards your player accounts and server infrastructure against credential stuffing, bot connection spam, password guessing, and rogue access.

---

⚡ What Makes UltimateAuth Superior?

Feature	Legacy AuthMe	Other Auth Plugins	UltimateAuth (v3.3.0)
Folia Multi-Threading Support	❌ Crashing	⚠️ Partial	✅ Native Thread-Safe & Folia Ready
Brute-Force & Lockout Jail	❌ Static kick	⚠️ Basic IP delay	✅ Progressive Attempts + Account Lockout
Password Policy Enforcement	❌ Length only	❌ None	✅ Common Passwords & Username Filter
Discord Security Webhook	❌ Third-party add-on	❌ None	✅ Async Admin Logins, Lockout Alerts & Diffs
Zero-Rubberband Freeze	❌ Client lag/glitch	⚠️ Basic cancel	✅ Smooth Movement + Camera Lock + Blindness
Database Engines	Legacy files/SQLite	SQLite only	✅ SQLite (HikariCP), MySQL, MariaDB
Performance Overhead	Heavy sync I/O	Medium	✅ 100% Async Non-Blocking DB Thread Pool

---

🚀 Key Features

1. 🔒 Enterprise Brute-Force & Dictionary Defense

• Progressive Rate Limiting: Tracks failed authentication attempts per player and IP.
• Account & IP Lockout: Temporarily locks accounts after configurable attempts (default: 5 attempts -> 15 min cooldown).
• Anti-Bot Connection Throttle: Built-in connection-level burst gate (global-max-per-second and ip-window).

2. 🛡️ Advanced Password Policy

• Blocks trivially vulnerable passwords (123456, password, minecraft, admin, etc.).
• Prevents players from setting passwords that contain or match their username.
• Configurable minimum length and strict max limit (72 characters for BCrypt safety).

3. 🚨 Discord Security Webhook Integration

• Non-blocking HTTP client notifies staff channels instantly when:
  • An administrator or OP account logs in.
  • A brute-force lockout is triggered on any account.
  • An account password is changed or updated.
• Automatically masks sensitive IP addresses (192.168.1.***) for privacy compliance.

4. 👁️ Immersive Blindness & Visual Lockdown

• Gives unauthenticated players a temporary blindness effect to prevent previewing hub builds, secrets, or player positions.
• Smoothly freezes player coordinates and orientation without irritating client-side rubberbanding.

5. 🗄️ Multi-Storage Architecture

• SQLite (Default): Lightning-fast, zero-configuration local database powered by HikariCP.
• MySQL & MariaDB: Enterprise connection pool for multi-server networks and BungeeCord/Velocity setups.
• Secure Password Hashing: Military-grade BCrypt hashing with configurable cost factor (default: 12).

---

📜 Commands & Permissions

Player Commands

Command	Description	Permission
/register <password> <confirm>	Create a new protected account	ultimateauth.auth.use
/login <password>	Authenticate to your existing account	ultimateauth.auth.use
/changepassword <old> <new>	Update your account credentials	ultimateauth.auth.use
/logout	Safely log out and lock current session	ultimateauth.auth.use

Administrator Commands

Command	Description	Permission
/auth info <player>	Inspect account status, UUID, last login & lockout state	ultimateauth.auth.admin
/auth forcelogin <player>	Force-authenticate a player (emergency bypass)	ultimateauth.auth.admin
/auth unlock <player>	Clear brute-force penalties and unlock an account	ultimateauth.auth.admin
/auth changepassword <player> <pass>	Administratively reset a player's password	ultimateauth.auth.admin
/auth unregister <player>	Wipe an account from the authentication database	ultimateauth.auth.admin
/auth reset <player>	Force-kick session and require re-authentication	ultimateauth.auth.admin
/auth reload	Hot-reload all configurations without restart	ultimateauth.auth.admin

---

⚙️ Configuration (config.yml)

# Connection-level anti-bot & account defense.
security:
  connection:
    enabled: true
    global-max-per-second: 80
    ip-max-attempts: 8
    ip-window: 10s
    kick-message: "<red><bold>Slow down</bold></red><gray> • Too many connection attempts, retry in a few seconds.</gray>"

  # Progressive brute-force protection and lockout
  brute-force:
    max-attempts: 5
    lockout-minutes: 15

  # Real-time Discord security alerts (Admin logins, lockouts, password modifications)
  webhook:
    enabled: false
    url: ""

# Authentication module.
auth:
  enabled: true
  login-timeout: 120
  chat-reminder-interval: 10s
  bcrypt-cost: 12

  # Password strength and credential safety rules
  password-policy:
    min-length: 6
    disallow-username: true
    disallow-common: true

  # Visual privacy and spawn protection
  visuals:
    blindness: true

  session-enabled: true
  session-duration: 30m

  database:
    type: sqlite # mysql, mariadb, sqlite
    pool-size: 10
    sqlite:
      file: auth.db

---

🔧 Installation

1. Drop UltimateAuth-3.3.0.jar into your server's plugins/ directory.
2. Start the server to generate plugins/UltimateAuth/config.yml.
3. Configure your database settings (or use default zero-config SQLite) and Discord webhook.
4. Enjoy rock-solid, zero-lag server authentication!