Add Fabric/Forge version builds and Paper integration, preserve permanent player identities across renames, harden session authorization, and surface privacy-conscious launcher/server activity in the panel.
- Servers: live status, players and TPS; add a server and get its token
with copy-paste setup for the plugin/mod and authlib-injector; detail
page with leaderboard (sortable), online players and activity feed
- Capes: upload, preview, and choose who can wear each one
- Players: click a player for their skin (upload, arm style, reset),
cape, playtime and per-server stats; disable with a reason
- Settings: Microsoft section replaced by the auth server (public
address, Yggdrasil URL, start flag, signing key)
- Dashboard: players online now and connected servers
- Avatars come from the panel's own skins
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS
Game servers (Paper plugin, Fabric/Forge mods) authenticate with a
per-server token and report to /api/server/v1:
- hello: records software/version, returns the auth server URL
- login: allow/deny with a message (account status + reason, access
all/members/groups, optional "must join through the launcher" check
matching the player's recent launch IP)
- sync: online players, TPS, stat deltas and events; answers with
players to kick when their account was disabled meanwhile
Admins create servers (token shown once, stored hashed), regenerate
tokens, and read leaderboards, events and per-player activity. The
dashboard stats include who's online right now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS
Microsoft sign-in is gone. Server accounts now receive Yggdrasil tokens
from the panel and launch with authlib-injector pointed at the panel's
auth server, so online-mode servers verify players against it.
- Download authlib-injector from the panel mirror (fallback: official),
SHA-256 verified and cached, with prefetched metadata
- New Skin & cape settings tab: upload, arm style, reset, cape picker
with front/back previews
- Avatars render from the panel's head endpoint
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS
- Yggdrasil API per the authlib-injector spec: metadata with signing key
and skin domains, authenticate/refresh/validate/invalidate/signout,
join/hasJoined, profile lookup, texture upload, and the minecraftservices
endpoints (chat certificates, publickeys, attributes, blocklist)
- 4096-bit signing key generated once into the data volume; textures and
chat certificates signed SHA1withRSA (verified with Java's own crypto)
- Skins/capes stored content-addressed after validation and re-encoding;
cape library with public/group/private visibility; head avatars API
- Launcher login returns a game session; launcher sessions recorded for
launcher-only servers; authlib-injector download mirror
- Schema v2: player UUIDs (offline UUID backfilled), skins, capes, tokens,
sessions, chat keys, game server tables
- Remove Microsoft sign-in from the engine and panel
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS
- Brand is now SCOPENET everywhere (defaults, UI, installer, docs)
- Launcher: solid backgrounds (no animated orbs/grain), flat Play button
without gradient/shine/glow, quieter rail with a simple active
indicator, smaller type scale, Inter as default font, glass off by
default, restyled sliders
- Panel: same flat treatment; live preview mirrors the new launcher
- New flat scope-reticle logo and app icons
- Calmer default palette
- Fix: lock the shared cargo cache in the Docker build (amd64/arm64 raced)
- Fix: Windows-only clippy lint in sys.rs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS
SCOPEDD