T

selimaj-devandclaude 56f511d5f6 Require authentication for RPCs and rate-limit fan-out methods

- Every method except auth_challenge/auth_verify now requires a verified
  session (auth::require) and answers "Not authenticated" otherwise.
  Before, an unauthenticated connection could send emote_event
  notifications to any connected player and probe who is online with
  get_player.
- Rate-limit per connection the methods that fan out to other players:
  emote (burst 5, +1/s) and send_player (burst 10, +1/s).
- Cap emote/send_player targets at 256 and de-duplicate them.
- Default SUPPORTED_VERSIONS to 0.1.1-beta.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-09-25 19:56:44 +02:00

src

Require authentication for RPCs and rate-limit fan-out methods

2026-09-25 19:56:44 +02:00

.dockerignore

Make server deployable with Docker Compose on Coolify

2026-09-25 05:00:32 +02:00

.gitignore

Gitignore db

2026-02-23 03:19:38 +01:00

Cargo.lock

Authenticate through Mojang's session server; add version manifest