Premium Player AutoLogin

Relevant source files

The following files were used as context for generating this wiki page:

• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/premium/AuthenticPremiumProvider.java
• API/src/main/java/xyz/xreatlabs/nexauth/api/premium/PremiumProvider.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/command/commands/premium/PremiumCommand.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/listener/AuthenticListeners.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/database/AuthenticUser.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/command/commands/premium/PremiumEnableCommand.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/command/commands/staff/NexAuthCommand.java
• Plugin/src/main/java/xyz/xreatlabs/nexauth/common/database/provider/NexAuthSQLDatabaseProvider.java

The Premium Player AutoLogin feature in NexAuth provides a seamless authentication experience for players who own a legitimate ("premium") Minecraft account. By verifying a player's identity with Mojang's servers, this system allows them to bypass the standard password-based login process, enhancing both convenience and security. When a player with this feature enabled joins the server, NexAuth automatically authenticates them, logs them in, and sends them directly to a lobby server.

This system is deeply integrated with the player login lifecycle, database management, and command structure. It relies on external API calls to validate premium status and stores this information within the NexAuth database to enable automatic login on subsequent joins. Players can opt-in to this feature, and server administrators have tools to manage it for any user.

Core Architecture

The auto-login functionality is built upon several key components that work together to identify, verify, and authenticate premium players.

Premium Provider

The PremiumProvider interface defines the contract for fetching premium user data. The primary implementation, AuthenticPremiumProvider, handles the logic of communicating with external APIs to verify a player's premium status.

• Interface: PremiumProvider.java
• Implementation: AuthenticPremiumProvider.java

It includes methods to get user data by username (getUserForName) or UUID (getUserForUUID). To ensure reliability and avoid rate-limiting, it employs a fallback mechanism, querying multiple APIs if the primary one fails.

Sources: API/src/main/java/xyz/xreatlabs/nexauth/api/premium/PremiumProvider.java, Plugin/src/main/java/xyz/xreatlabs/nexauth/common/premium/AuthenticPremiumProvider.java

User Data Model

The AuthenticUser class represents a player's data in NexAuth. For premium auto-login, the most critical field is premiumUUID.

• premiumUUID (UUID): If this field is not null, the auto-login feature is considered enabled for the user. It stores the player's official Mojang UUID.

The autoLoginEnabled() method provides a clear way to check if the feature is active for a user.

// Plugin/src/main/java/xyz/xreatlabs/nexauth/common/database/AuthenticUser.java:100-102
public boolean autoLoginEnabled() {
    return premiumUUID != null;
}

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/database/AuthenticUser.java:18, 80-82, 100-102

Event Listeners

The AuthenticListeners class hooks into the server's login events to orchestrate the auto-login process.

• onPreLogin: Intercepts the player before they fully join. It checks the username against the PremiumProvider to determine if the connection should be forced into online mode. This is crucial for security, as it ensures a player's session is verified by Mojang.
• onPostLogin: After the player has successfully connected, this method checks if autoLoginEnabled() is true for their user profile. If so, it bypasses the password prompt, fires an AuthenticatedEvent, and sends a confirmation message and title to the player.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/listener/AuthenticListeners.java

Player Login Flow

The auto-login process is handled during the pre-login and post-login phases of a player's connection.

The following diagram illustrates the sequence of events when a premium player with auto-login enabled joins the server.

Pre-Login Phase (onPreLogin)

1. NexAuth receives the player's username.
2. It calls premiumProvider.getUserForName(username) to check if a Mojang account exists with that name.
3. If a premium account is found, NexAuth instructs the server to enforce online-mode for this connection (FORCE_ONLINE). This ensures the player's session is cryptographically verified with Mojang.
4. If the user has a premiumUUID in the database but is connecting with a name that doesn't match a Mojang account, the connection is still forced to online mode to prevent a cracked client from disabling another user's premium status.
5. If no premium account is found, the connection proceeds in offline mode (FORCE_OFFLINE), and the player will be prompted for a password.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/listener/AuthenticListeners.java:95-171

Post-Login Phase (onPostLogin)

1. After the player is in the server (typically in a limbo world), NexAuth retrieves their User profile from the database.
2. It checks user.autoLoginEnabled().
3. If true, NexAuth fires an AuthenticatedEvent with the reason PREMIUM.
4. A confirmation message (info-premium-logged-in) is sent to the player.
5. If the use-titles configuration is enabled, a title is displayed to the player.
6. The player is then moved to a lobby server.
7. If false, the standard authentication process begins, and the player is prompted to /login or /register.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/listener/AuthenticListeners.java:49-65

Managing AutoLogin

Players can enable or disable auto-login for their own accounts, and staff with appropriate permissions can manage it for any player.

Player Commands

Players use the /premium and /cracked commands to manage their auto-login status.

Command	Description	Permission
/premium <password>	Starts the process to enable premium auto-login. Requires password verification.	nexauth.command.premium (default)
/confirmpremium	Confirms the action to enable auto-login after using /premium.	nexauth.command.premiumconfirm (default)
/cracked	Disables premium auto-login for the player's account.	nexauth.command.cracked (default)

The flow for a player to enable premium auto-login is as follows:

Staff Commands

Administrators can forcefully enable or disable auto-login for any user.

Command	Description	Permission
/nexauth user premium <name>	Forcefully enables premium auto-login for a user.	librepremium.user.premium
/nexauth user cracked <name>	Forcefully disables premium auto-login for a user.	librepremium.user.cracked

When using /nexauth user premium, the system verifies the username against Mojang's API. If the player is online, they are kicked with a notification that their status has changed.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/command/commands/staff/NexAuthCommand.java:237-271

Mojang API Interaction

The AuthenticPremiumProvider is responsible for all communication with external player identity services.

API Fallback Strategy

To improve resilience, AuthenticPremiumProvider queries multiple APIs in a specific order. If one API fails or is rate-limited, it automatically tries the next one in the list.

The current fetcher order is:

1. Mojang API (api.mojang.com)
2. PlayerDB (playerdb.co)
3. Minetools (api.minetools.eu)

This fallback logic is shown in the diagram below.

Caching

To minimize API calls and avoid rate limits, AuthenticPremiumProvider caches the results of getUserForName requests. The cache has a 10-minute expiration time. This means that repeated checks for the same username within a short period will not trigger new API requests.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/premium/AuthenticPremiumProvider.java:28-31

Database Schema

Premium status is stored directly in the main user data table, librepremium_data.

The diagram below shows the relevant columns for the auto-login feature.

• premium_uuid: This column stores the player's official Mojang UUID. If this column has a value, autoLoginEnabled() returns true, and the system will attempt to log the player in automatically. It has a UNIQUE constraint to prevent multiple server accounts from being linked to the same premium account.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/database/provider/NexAuthSQLDatabaseProvider.java:194-204, Plugin/src/main/java/xyz/xreatlabs/nexauth/common/database/AuthenticUser.java:18

Configuration

Several settings in config.yml control the behavior of the premium auto-login feature.

Key	Type	Default	Description
auto-register	Boolean	false	If true, players with a premium username who are not yet in the database will be automatically registered and have auto-login enabled.
profile-conflict-resolution-strategy	String	BLOCK	Defines how to handle cases where a cracked player has the same name as a premium player. Options: BLOCK, USE_OFFLINE, OVERWRITE.
use-titles	Boolean	true	If true, a title message is shown to premium players when they auto-login.

Sources: Plugin/src/main/java/xyz/xreatlabs/nexauth/common/config/ConfigurationKeys.java:125-131, 74-82, 164-169

Summary

The Premium Player AutoLogin feature is a core part of NexAuth that enhances the user experience for players with legitimate Minecraft accounts. By integrating with Mojang's APIs, listening to login events, and storing premium status in the database, it provides a secure and convenient way to bypass manual password entry. With configurable behaviors and robust management commands, it offers flexibility for both players and server administrators.