SecPlayer

### Added

- **Remember me (auto-login):** Login screen checkbox; when checked and login succeeds, password is stored client-side (AES-GCM) per server. Next join to the same server auto-sends login after a short delay. On failed auto-login the stored credential is cleared.

- **Alternative username:** Registration and display name use an “alternative username” (stored in the mod DB) instead of Discord. Same behavior: optional field and “Use as in-game name” toggle; no Discord validation.

- **Admin: Set alternative username:** In admin player detail, “Set alternative username” opens a screen to edit or clear the value (no spaces). Tab list display name refreshes after change.

- **Player command `/secplayer setAlt <name>`:** Players can set or clear their own alternative username (no spaces; empty to clear). Tab list updates immediately.

- **Localhost label in admin list:** When connected to 127.0.0.1/localhost, player list shows **[Local]** instead of a country flag (avoids missing-glyph box).

- **Banned alternative usernames:** `config/secplayer.properties` option **`bannedAltNames`** (comma-separated, case-insensitive). Players cannot use these names as display names (registration, `/secplayer setAlt`, or admin Set alternative username). Default: `herobrine`.

- **Server-sent login logo:** Server can send a custom login logo to clients (up to 50 KB) so all players see the same logo without per-client config. Logo is scaled to a fixed size (296×64 px) to fit the panel.

### Changed

- **Login UI:** Login, Forgot password?, and Disconnect buttons are side-by-side. Enter (or Numpad Enter) submits the login form. Logo forced to fixed size (stretch to fit).

- **Admin list:** Country/flag column shows **[Local]** for localhost; “Alternative username” and “Use alternative name” in player detail; new “Set alternative username” action.

### Fixed

- (none)

### Removed

- (none)

## [1.1.0] - 2025-02-28

### Added

- **Editable TOS:** Server ops can edit **`config/secplayer_tos.txt`** to customize the Terms of Service. File is created on server start with default text if missing. Use `%d` for minimum age. TOS text is sent from server to client when opening the TOS screen.

- **Login logo:** Optional image at `assets/secplayer/textures/gui/login_logo.png` shown under the Login title. Logo can be overridden via **`config/secplayer_client.properties`** (client) or **`config/secplayer.properties`** (server sends filename; clients load from their `config/`). Images of any size are scaled to fit the panel (no repeat).

- **Disconnect button** on TOS, Registration, and Login screens so players can leave without completing the flow.

- **Password masking:** Login, Registration, and Reset password fields display bullet characters (●) instead of plain text; actual value is still sent on submit.

- **TOS feedback:** Message “Please accept the Terms of Service to continue.” when clicking Continue without checking the box; message clears when the box is checked.

### Changed

- **TOS screen:** Single wrapped checkbox (“I have read and agree to the Terms of Service and confirm I am X+ years old”); label wraps within the panel. More space between title and checkbox, and between checkbox and TOS body. Scrollable TOS content, scrollbar when needed. ESC no longer closes the screen.

- **Registration:** Panel UI aligned with TOS/Login; no TOS checkbox (agreement is done on TOS screen). Error/feedback message moved above the buttons with a dark strip for readability. ESC no longer closes the screen.

- **Login:** Panel UI; optional logo (config override, correct scaling). Disconnect button. ESC no longer closes the screen.

### Fixed

- **Form placeholders:** Placeholder text no longer stays visible next to input; suggestion is hidden when the field has content (tick-based update).

- **secplayer_tos.txt** is created on server start in `SecPlayerConfig.load()`, not only when the first unregistered player joins.

- **Login logo** no longer draws twice (blit now samples texture once and scales; larger images scale down correctly).

- **Admin command:** `/secplayer admin` is now registered in time by subscribing the command class to the event bus at mod load (fixes missing admin UI for ops).

### Removed

- Duplicate “I agree to the Terms of Service” checkbox on the registration form (age/agreement confirmed once on the TOS screen).

## [1.0.0] - 2025-02-25

### Added

- Initial release.

- Registration: full name, email, optional Discord, password, optional birth year, “Use Discord as my in-game name” checkbox.

- TOS screen before registration with “I agree” and configurable minimum age (13+ by default).

- Login screen with password; “Forgot password?” flow (email reset code, configurable SMTP).

- Password reset: request code by email, enter code + new password in-game.

- SQLite storage for accounts, logins, and password reset tokens.

- IP and geolocation (country/region) on registration and login (GeoLite2-City.mmdb in config).

- Config file `config/secplayer.properties`: minAge, SMTP settings.

- OP admin UI: `/secplayer admin` lists registered players (username, email, last IP, country); Ban/Unban using Minecraft’s ban list.

- Display name override: optional Discord username as in-game name (chat, tab list, above head).

- Player freeze until authenticated (no movement, block break, or damage).

- Version from `build.gradle` injected into `mods.toml` at build time.