BlokLogin - Best Login Plugin

# BlokLogin

**A lightweight, fully configurable authentication plugin for offline-mode Minecraft servers — with built-in premium auto-login support.**

---

## Features

### Authentication
- **Registration** with a 6-digit captcha delivered in chat — prevents bots from auto-registering
- **Login** with password — securely hashed using SHA-256
- **Premium auto-login** — players with genuine Mojang accounts are verified via the Mojang API and logged in automatically without a password
- **Duplicate login prevention** — if a player is already online, no one can join using the same username
- **Login timeout** — players who don't authenticate within a configurable time limit are kicked automatically

### Security
- Passwords hashed with **SHA-256 + server-side salt** — never stored in plain text
- Players are **fully locked** during authentication: no movement, no chat, no commands (except allowed ones), no interactions, no item drops, no inventory access, no block breaking or placing, no attacking or being attacked
- **Blindness + Darkness effects** applied during auth so players can't see the world
- Players are **teleported to a configurable spawn** during authentication

### Highly Configurable
- **Full language support** — comes with English (`en`) and Polish (`pl`) out of the box; switch with one line in `config.yml`
- **Every single message is configurable** with 5 display types:
- `chat` — regular chat message
- `title` — large screen title with subtitle
- `subtitle` — subtitle only
- `actionbar` — message above the hotbar
- `bossbar` — boss bar at the top of the screen
- **Hex color support** — use `&#RRGGBB` anywhere in messages
- Configurable **allowed commands** during auth (e.g. `/helpop` is allowed by default)
- Configurable **password length** (min/max)
- Configurable **spawn location** for the auth phase

---

## Commands

| Command | Aliases | Description | Permission |
|---|---|---|---|
| `/register <pass> <pass> <captcha>` | `/reg` | Register a new account | — |
| `/login <password>` | `/l` | Log in to your account | — |
| `/changepassword <old> <new>` | `/zmienhaslo`, `/passwordchange` | Change your password | — |
| `/unregister <player>` | `/unreg` | Unregister a player's account | `bloklogin.unregister` |

---

## Permissions

| Permission | Description | Default |
|---|---|---|
| `bloklogin.unregister` | Allows using `/unregister` | OP |
| `bloklogin.bypass` | Bypasses all auth restrictions | false |

---

## ⚙️ Configuration

### config.yml
```yaml
# Language: en or pl
language: en

# Teleport players to this location during auth
spawn-teleport: true
spawn-location:
world: world
x: 0.5
y: 64
z: 0.5

# Kick players who don't authenticate in time (seconds, 0 = disabled)
login-timeout: 60

# Password length limits
min-password-length: 5
max-password-length: 32

# Premium verification via Mojang API
premium:
enabled: true

# Commands allowed during auth (no slash)
allowed-commands:
- helpop
- login
- l
- register
- reg

# Effects during auth
effects:
blindness: true
darkness: true
```

### Language files (lang/en.yml, lang/pl.yml)
Every message has a `type` field. Switch any message to a different display type instantly:
```yaml
login:
success:
type: title # Change to: chat, subtitle, actionbar, bossbar
message: "&#00FF88&lLogged in!"
subtitle: "&7Welcome back, {player}"
fade-in: 10
stay: 60
fade-out: 20
```

---

## Languages

| Code | Language | Built-in |
|---|---|---|
| `en` | English | ✅ |
| `pl` | Polish | ✅ |

Want to add your own language? Copy `lang/en.yml`, translate it, save it as e.g. `lang/de.yml`, and set `language: de` in `config.yml`.

---

## Installation

1. Drop `BlokLogin.jar` into your `plugins/` folder
2. Make sure your server is running in **offline mode** (`online-mode=false` in `server.properties`) — required for cracked + premium hybrid servers
3. Start the server — config files are generated automatically
4. Edit `plugins/BlokLogin/config.yml` and `plugins/BlokLogin/lang/en.yml` to your liking
5. Reload with `/bloklogin reload` or restart the server

---

## Requirements

- **Spigot / Paper** 1.19.x – 1.21.x
- **Java 17+**
- Server in **offline mode** (`online-mode=false`)

> **Note:** Premium auto-login requires the server to have internet access to reach the Mojang API (`api.mojang.com`). If the API is unreachable, the player is treated as cracked and must register/login with a password.

---

## ️ How Premium Login Works

1. Player joins the server
2. BlokLogin queries the Mojang API: `api.mojang.com/users/profiles/minecraft/{name}`
3. If the API returns a valid UUID → player is **premium** → logged in automatically
4. If the API returns 404 → player is **cracked** → must register/login with password
5. Premium status is **cached** on disk — subsequent joins skip the API call for faster login

---

## Data Storage

Player data is stored in `plugins/BlokLogin/playerdata.yml`. Passwords are **never stored in plain text** — only SHA-256 hashes.

---

## ❓ FAQ

**Q: Can I use this with BungeeCord?**
A: BlokLogin works on individual Spigot/Paper instances. For BungeeCord networks, run it on each backend server.

**Q: What happens if a premium player registers a password?**
A: Premium players are auto-logged in and skip the registration step entirely.

**Q: Can I add more languages?**
A: Yes — copy any existing lang file, translate it, and point to it in `config.yml`.

**Q: Is data saved on restart?**
A: Yes — all player data is persisted to `playerdata.yml` immediately after each change.

---

*Made by BlokMC • Open source • Lightweight • No dependencies*