Premium impersonation fix: premium auto-login and /premium claims now require the client to present the real Mojang UUID at login (JPremium-style handshake detection).
What was broken
Anyone joining with a premium-flagged name was auto-logged-in, and any first-joiner could /premium-claim an unregistered premium name. In offline mode the server never verifies identity with Mojang, so a cracked launcher could use someone else's premium name.
How it works now
Premium launchers send their genuine Mojang UUID in the Login Start packet; cracked launchers send an offline-derived (or absent) UUID. The plugin now:
- /premium: resolves the Mojang UUID for the name and requires the claimant's presented UUID to match - stock cracked launchers are rejected with a clear message
- Join with a premium-flagged name: auto-login only on UUID match; a mismatching (cracked) client is told to join with the premium launcher and is frozen until timeout
Limitations
Offline mode never cryptographically authenticates the presented UUID, so a custom-modified client that knows the victim's Mojang UUID could still spoof it. This defeats stock launchers (the practical cracked-server threat); full protection requires online-mode or a proxy like JPremium.
Install
Replace the wasm and restart. Existing premium accounts keep working (their stored premium_id is now also UUID-verified at join). Two new [messages] keys: premium.uuid_mismatch, premium.uuid_wrong.