Replace `auth` (which received the player's Minecraft access token) with
the vanilla online-mode flow, so the token never reaches this server:
- auth_challenge: validate the username and return a random one-time
server id
- the client calls Mojang's session `join` with its token and that id
- auth_verify: confirm the join with Mojang's `hasJoined` and log the
player in
Add GET /versions returning {"supported": [...], "deprecated": [...]}
from the SUPPORTED_VERSIONS / DEPRECATED_VERSIONS env vars (defaults:
0.1.0-beta3 supported), exposed in compose.yaml.
Refs saturnclientmc/saturnclient#7
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Picks up the fix that releases session handlers on close, so closed
connections no longer leak their Session and handler state.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Serve the session WebSocket on `/` through axum
(`Session::from_axum`) with a 1 MiB message limit
- Add `/health` (checks the database) and a `server healthcheck`
subcommand used by the Dockerfile HEALTHCHECK
- Shut down on SIGTERM/Ctrl+C so container stops are immediate
- Move per-connection handler registration into `register_handlers`
Co-Authored-By: Claude Opus 5.5 <[email protected]>
selimaj-devandclaude