Nexori

Nexori 2.1.0 Patch Notes

Developer Notes

The biggest addition in this release is server-level admission control. You can now set a max player limit per server and define reserved priority slots. For example, if you set maxPlayers = 110 and reservedPrioritySlots = 10, that effectively means 100 public slots plus 10 reserved slots for bypass traffic. You can grant bypass to specific users, but reserved slots still enforce concurrency: if 20 users have bypass and only 10 reserved slots exist, only 10 bypass users can enter when the server is full. In short, always balance your max players, reserved slots, and total bypass assignments. All of this is configurable from the UI, and changes apply at runtime without restarting the server.

I also want to call out an important limitation in backendless multi-server setups. Nexori limits are currently per server, not per tenant/network. So if your network has 3 servers and you want a global cap of 500 players, Nexori will not enforce that total automatically. You need to configure each server’s cap so their combined maximum does not exceed your target.

This matters in real flows like lobby -> match start (minigame server) -> return to lobby. While players are away in minigames, the lobby can fill up. So should returning players be allowed back in? Right now, allowing trusted inter-server returns (bypass referrals) can temporarily push lobby population above its configured cap. In practice, this is controlled damage: once the lobby reaches its limit, manual/direct joins are blocked, while legitimate Nexori transfers (like minigame returns) still work. Operationally, if your true safe ceiling is 500, you can configure the lobby lower (for example 400) to leave headroom for players returning from other servers.

For the next release, I want to experiment with cross-server population caching using player travel itself as the transport layer. Since players constantly move between lobby and minigame servers, each transfer can carry server-state snapshots. It won’t be perfectly exact, but it should be accurate enough for practical scaling decisions. Yes, edge cases exist (for example, a player disconnects on the minigame server before returning), but the cache self-corrects as soon as later players complete the normal return flow. If this works well, we could move toward tenant-level population control and smarter matchmaking decisions, including per-minigame-server limits on concurrent active instances.

New Features

• Added Access Gate to control server admission under load.
• Added Access Gate tabs: ACCESS GATE and MANUAL CONNECTIONS.
• Added gate runtime controls: enabled, trusted referral bypass, max players, reserved priority slots, and full server message.
• Added manual direct-join protection with trusted redirect target selection.
• Added trusted servers table for manual-connection redirect management.
• Added bypass player management using UUID + username pairs.
• Added connected players table with quick add-to-bypass actions.
• Added Access Gate config persistence at mods/Nexori_NexoriPlugin/config/access-gate.json.
• Added lifecycle enforcement hooks (setup/connect/disconnect) to apply caps during player transitions.
• Added pending setup tracking with TTL cleanup to reduce oversubscription on simultaneous joins.
• Added unified bypass config naming around bypassPlayerUuids.
• Added legacy config normalization for older Access Gate JSON formats.

Security and Permissions

• Hardened OP/admin command access checks across Nexori command surfaces.
• Standardized admin permission registration and reduced exposed command surface.
• Added secure trusted-referral validation for referral-based bypass decisions.

A major security fix in this release addresses a serious issue where players could run OP-related commands and escalate privileges in-game. That behavior has now been locked down, and players can no longer grant themselves OP through commands.

If you are the tenant/server owner and want OP privileges, you now need to assign them manually in the server permissions.json under your UUID, for example:

"groups": [ "OP", "Adventure", "Creative" ]

Another important fix: in the first release, I missed restricting Nexori admin commands to OP users only. In 2.0.0, any player could execute those admin commands. In this version, Nexori admin commands are now restricted to OP users.

For clarity, most of these commands mirror actions already available in the UI. I use commands first to validate features quickly, then move stable flows into UI controls. So these commands currently remain as fallback/admin tooling, though I may revisit whether they should stay long-term to avoid command clutter.

Hotfixes

• The integrated last_player_alive death flow has been updated to remove the respawn button and prevent the user from respawning upon death.
• Updated current Skywars instance behavior: PvP enabled, adventure mode set, instance save disabled for players/chunks, and chest loot refresh applied.