fix(premium): reject proxy premium claims and notify proxy while premium is disabled

ProxyLoginRequestValidator.validate() had no enablePremium gate, unlike
canBypassWithPremium: a proxy-verified claim for a player whose row still
carries a premiumUuid was accepted while the feature was disabled. Reject
it and answer with premium.unset so the proxy drops the stale entry and
persists its cache. State now converges per player on first contact,
without waiting for a proxy restart to trigger the full premium.list
resync.

Refs #3127

Author: strobil

authme-core/src/main/java/fr/xephi/authme/service/ProxyLoginRequestValidator.java

@@ -8,6 +8,8 @@
 import fr.xephi.authme.message.Messages;
 import fr.xephi.authme.output.ConsoleLoggerFactory;
 import fr.xephi.authme.service.bungeecord.BungeeSender;
+import fr.xephi.authme.settings.Settings;
+import fr.xephi.authme.settings.properties.PremiumSettings;
 import org.bukkit.entity.Player;
 
 import javax.inject.Inject;
@@ -43,6 +45,9 @@ public class ProxyLoginRequestValidator {
     @Inject
     private Messages messages;
 
+    @Inject
+    private Settings settings;
+
     ProxyLoginRequestValidator() {
     }
 
@@ -60,6 +65,14 @@ public boolean validate(Player player, UUID verifiedPremiumUuid) {
         }
 
         String playerName = player.getName();
+        if (!settings.getProperty(PremiumSettings.ENABLE_PREMIUM)) {
+            // The proxy still holds this name in its premium cache; tell it to drop the entry so the
+            // player is not forced through Mojang verification again while the feature is disabled.
+            logger.info("Rejected proxy premium login for " + playerName + ": premium is disabled");
+            bungeeSender.sendPremiumUnset(playerName);
+            return false;
+        }
+
         PlayerAuth auth = playerCache.getAuth(playerName);
         if (auth == null) {
             auth = dataSource.getAuth(playerName.toLowerCase(Locale.ROOT));

authme-core/src/test/java/fr/xephi/authme/service/ProxyLoginRequestValidatorTest.java

@@ -5,6 +5,8 @@
 import fr.xephi.authme.message.MessageKey;
 import fr.xephi.authme.message.Messages;
 import fr.xephi.authme.service.bungeecord.BungeeSender;
+import fr.xephi.authme.settings.Settings;
+import fr.xephi.authme.settings.properties.PremiumSettings;
 import org.bukkit.entity.Player;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -19,6 +21,7 @@
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
 
 /**
  * Test for {@link ProxyLoginRequestValidator}.
@@ -47,6 +50,9 @@ class ProxyLoginRequestValidatorTest {
     @Mock
     private Messages messages;
 
+    @Mock
+    private Settings settings;
+
     @Mock
     private Player player;
 
@@ -55,6 +61,7 @@ void shouldAcceptStoredPremiumUuidFromProxy() {
         UUID premiumUuid = UUID.randomUUID();
         PlayerAuth auth = PlayerAuth.builder().name("bobby").premiumUuid(premiumUuid).build();
         given(player.getName()).willReturn("Bobby");
+        given(settings.getProperty(PremiumSettings.ENABLE_PREMIUM)).willReturn(true);
         given(playerCache.getAuth("Bobby")).willReturn(auth);
 
         assertTrue(validator.validate(player, premiumUuid));
@@ -67,6 +74,7 @@ void shouldRejectStoredPremiumUuidMismatch() {
         UUID forwardedUuid = UUID.randomUUID();
         PlayerAuth auth = PlayerAuth.builder().name("bobby").premiumUuid(storedUuid).build();
         given(player.getName()).willReturn("Bobby");
+        given(settings.getProperty(PremiumSettings.ENABLE_PREMIUM)).willReturn(true);
         given(playerCache.getAuth("Bobby")).willReturn(auth);
 
         assertFalse(validator.validate(player, forwardedUuid));
@@ -78,6 +86,7 @@ void shouldFinalizeMatchingPendingPremiumUuid() {
         UUID pendingUuid = UUID.randomUUID();
         PlayerAuth auth = PlayerAuth.builder().name("bobby").build();
         given(player.getName()).willReturn("Bobby");
+        given(settings.getProperty(PremiumSettings.ENABLE_PREMIUM)).willReturn(true);
         given(playerCache.getAuth("Bobby")).willReturn(auth);
         given(pendingPremiumCache.removePending("Bobby")).willReturn(pendingUuid);
 
@@ -92,6 +101,7 @@ void shouldStaySilentWhenPendingAlreadyConsumed() {
         UUID forwardedUuid = UUID.randomUUID();
         PlayerAuth auth = PlayerAuth.builder().name("bobby").build();
         given(player.getName()).willReturn("Bobby");
+        given(settings.getProperty(PremiumSettings.ENABLE_PREMIUM)).willReturn(true);
         given(playerCache.getAuth("Bobby")).willReturn(auth);
         given(pendingPremiumCache.removePending("Bobby")).willReturn(null);
 
@@ -107,6 +117,7 @@ void shouldRejectPendingPremiumUuidMismatchAndNotifyPlayer() {
         UUID forwardedUuid = UUID.randomUUID();
         PlayerAuth auth = PlayerAuth.builder().name("bobby").build();
         given(player.getName()).willReturn("Bobby");
+        given(settings.getProperty(PremiumSettings.ENABLE_PREMIUM)).willReturn(true);
         given(playerCache.getAuth("Bobby")).willReturn(auth);
         given(pendingPremiumCache.removePending("Bobby")).willReturn(pendingUuid);
 
@@ -115,4 +126,16 @@ void shouldRejectPendingPremiumUuidMismatchAndNotifyPlayer() {
         verify(messages).send(player, MessageKey.PREMIUM_PENDING_FAIL);
         verify(premiumService, never()).finalizePendingPremium(player, forwardedUuid);
     }
+
+    @Test
+    void shouldRejectProxyPremiumClaimAndNotifyProxyWhenPremiumIsDisabled() {
+        UUID forwardedUuid = UUID.randomUUID();
+        given(player.getName()).willReturn("Bobby");
+        given(settings.getProperty(PremiumSettings.ENABLE_PREMIUM)).willReturn(false);
+
+        assertFalse(validator.validate(player, forwardedUuid));
+        verify(bungeeSender).sendPremiumUnset("Bobby");
+        verify(messages, never()).send(player, MessageKey.PREMIUM_PENDING_FAIL);
+        verifyNoInteractions(playerCache, dataSource, pendingPremiumCache, premiumService);
+    }
 }