dmg/minecraft-account-manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 28 Wiki Activity

feat(platform): add Discord onboarding and Velocity gate

Browse Source
This commit is contained in:
dmg
2026-08-01 13:45:18 -04:00
parent 9d305e5dc9
commit c5de0a1810
80 changed files with 4840 additions and 1572 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture.md
+2 -2
View File
@@ -10,7 +10,7 @@ User authentication begins with an opaque, short-lived, single-use token created
### Discord bot
The bot creates private login links in response to `/register` and `/account`. Discord user IDs are the canonical Discord identity; mutable usernames are snapshots only. Nickname updates target the guild selected in admin settings.
The bot creates private login links in response to `/register` and `/account`. Discord user IDs are the canonical Discord identity; mutable usernames are snapshots only. Nickname updates target the deployment guild configured by `DISCORD_GUILD_ID`; the public join button uses `DISCORD_INVITE_URL`.
### Velocity plugin
@@ -23,7 +23,7 @@ The decision is fail closed. Unknown players, invalid responses, expired request
- Browser input is untrusted. Minecraft profile resolution occurs on the server.
- Forwarded IP headers are accepted only from configured reverse proxies.
- Discord IDs come from bot-authenticated requests or one-time-code records, not browser fields.
- Velocity requests will use per-server credentials, timestamps, and request IDs to support authentication and replay prevention.
- Velocity requests use hashed per-server bearer credentials, timestamps, and database-unique request IDs for authentication and replay prevention.
- Session and one-time-code values are random and stored only as hashes.
- Exact IP addresses are sensitive data and require an explicit retention policy before production deployment.