ForgeGuardAuth

What's New in v1.5.0

🔒 Security

- Password hashing - passwords are now securely stored using PBKDF2-HMAC-SHA256 with 120,000 iterations and a random 16-byte salt.
- Existing plaintext passwords are automatically migrated to the new format after the player's first successful login.
- Brute-force protection- accounts are temporarily locked after multiple failed login attempts.
- Default configuration: 3 failed attempts → 60-second lockout.

🌐 Russian & English Localization

- Full Russian and English language support.
- Language is automatically detected from the player's client.
- The language can also be forced through the configuration:

`language = "auto"`  
`language = "ru"`  
`language = "en"`

- All player-facing messages are localized.

🛠 Admin Commands

OP-only commands:

`/authmod changepassword `  
Changes the password of any player, including offline players.

`/authmod resetpassword `  
Deletes a player's registration. Online players are immediately locked and must register again.

- Tab completion for registered player names.

 🔐 Improved Authentication Lockdown

Unauthenticated players are now placed into Spectator mode.

Their previous game mode is restored after successful authentication.

Additional restrictions before authentication:

- Chat is disabled.
- All commands except `/login` and `/register` are blocked.
- Block breaking is blocked.
- Entity interaction is blocked.
- Left-click block interaction is blocked.
- Item dropping and pickup are blocked.

 ⚙️ Other Improvements

- Fixed duplicate event handler registration.
- Added atomic file writes to reduce the risk of `authmod_data.json` corruption during crashes.
- UTF-8 encoding is now used for data files.
- Added proper error logging.
- Added `/changepassword ` for players to change their own password.
- Commands without arguments now display localized usage hints.
- Removed the duplicate root `mods.toml`.