add auth

README.md

@@ -1,4 +1,4 @@
-# Lobby Systems v1.6.1 — Fabric 26.2
+# Lobby Systems v1.7.0 — Fabric 26.2
 
 Server-side lobby routing dan dimension policy untuk Minecraft 26.2/Fabric. v1.6.0 menambahkan Starter Kit per-dimension dengan active assignment dan recipient history, sambil mempertahankan initial Lobby placement pre-login, gamemode authoritative, gamerule per-dimension, portal, dan position persistence.
 
@@ -463,3 +463,17 @@ Lobby Systems is **proprietary software — All Rights Reserved**. Public access
 - Managed `minecraft:nether_portal` surfaces are now explicitly intercepted so Lobby Systems exclusively owns their destination.
 - Reduced the creator-side post-create trigger suppression from the old 100-tick window to the configured portal check interval.
 - Added the Lobby Systems mod icon to Fabric metadata.
+
+## v1.7.0 - Lobby Systems Auth
+
+- Hybrid authentication while keeping `online-mode=true`.
+- Premium usernames stay on vanilla/Mojang authentication and auto-login after successful verification.
+- Non-premium usernames may join through a deterministic vanilla offline profile and must `/register` once, then `/login` on every connection.
+- Premium usernames are protected: a cracked client using a premium name remains on vanilla authentication and is rejected when it cannot prove the official session.
+- Registration/login guidance is shown both as title/subtitle and chat.
+- Unauthenticated players are frozen in Lobby, cannot walk into Lobby Systems portals, and are disconnected after the configured timeout.
+- Passwords are stored as salted PBKDF2-HMAC-SHA256 hashes; plaintext passwords are never persisted.
+- New files: `config/lobby/auth/config.json` and `config/lobby/auth/accounts.json`.
+- EasyAuth is intentionally marked incompatible while native Lobby Systems Auth is enabled.
+
+For the intended hybrid mode, keep `online-mode=true` in `server.properties` and remove EasyAuth before testing.