Validate legacy standalone login envelopes

[BenCodez]

Summary

• Validate every legacy login against an authority independent of the envelope.
• On player-facing proxies, require the player to be online on the claimed/current backend and require the envelope UUID to match the proxy's live UUID in online mode.
• On dedicated voting proxies, require an exact modern presence match for the claimed player, UUID, and destination server.
• Continue requiring standalone MQTT, Redis, MySQL, and socket envelopes to name a configured backend.
• Preserve the existing generation-fenced extended-presence path unchanged.

Security impact

This closes the validated Codex Security finding “Legacy login envelopes bypass presence validation”:
https://chatgpt.com/codex/cloud/security/findings/67ce1cfbc0c08191842d0918ce0c9cb8?sev=critical%2Chigh

Legacy envelopes can no longer select a destination or cached-vote UUID merely by supplying those values. Player-facing proxies derive authority from their native live session. Dedicated proxies fail closed unless modern presence independently confirms the destination.

Review follow-up

The modern-source to legacy-destination race is handled without a delayed pending claim: the player-facing proxy's current route takes precedence over stale backend presence, so a legitimate transfer is accepted immediately once the proxy shows the destination. A queued spoofed destination cannot become valid merely because the old source later logs out.

Regression coverage

• PLUGINMESSAGING uses the proxy-authoritative server and UUID.
• PLUGINMESSAGING rejects a mismatched UUID.
• Standalone legacy login accepts a configured server matching the live proxy route.
• Unknown configured-server claims are rejected.
• A modern-source to legacy-destination transfer succeeds while tracker state still names the old source.
• A claimed server that differs from the live proxy route is rejected.
• Player-name/UUID mismatches are rejected.
• Dedicated proxies reject unconfirmed destinations and unknown identities, while accepting exact confirmed presence.
• Existing extended generation-fenced presence behavior remains unchanged.

Validation

• mvn -B -f VotingPlugin/pom.xml package passed on the final tree before the single clean commit was published.
• Java CI with Maven Bug Fixes & Dependency Injection Improvements #407 passed on final head 7dadd1d812.

AI disclosure: This pull request was created with assistance from ChatGPT.

[BenCodez]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a352ac5477

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex address that feedback

[BenCodez]

Additional security requirement for the P1 fix: do not accept a queued legacy claim solely because the old tracked source later disappears. An internal publisher could pre-seed a spoofed destination and wait for logout. On re-evaluation, require independent destination authority: on a normal player-facing proxy, the proxy's current player server and actual UUID must match the claim; on a dedicated voting proxy, require confirmed destination presence (otherwise leave the cached work pending). A competing or unconfirmed legacy claim must never become valid just from absence of the source.

[chatgpt-codex-connector]

Summary

• Classified legacy login claims as consistent, validated cross-backend handoffs, or permanent rejections. Name/UUID mismatches remain rejected rather than deferred. VotingPlugin/src/main/java/com/bencodez/votingplugin/proxy/presence/BackendPlayerPresenceTracker.javaL718-L756
• Added bounded pending handling for legacy handoffs. The first destination claim wins, so competing legacy publishers cannot replace an existing destination, and claims are revalidated before delivery. VotingPlugin/src/main/java/com/bencodez/votingplugin/proxy/VotingPluginProxy.javaL1638-L1692
• Re-evaluated deferred legacy logins only after an authoritative modern logout is accepted, while leaving the existing generation-fenced extended-login path intact. VotingPlugin/src/main/java/com/bencodez/votingplugin/proxy/VotingPluginProxy.javaL1592-L1606 VotingPlugin/src/main/java/com/bencodez/votingplugin/proxy/VotingPluginProxy.javaL1619-L1635
• Added regression coverage for a modern-source-to-legacy-destination transfer where the destination login arrives before the source logout. VotingPlugin/src/test/java/com/bencodez/votingplugin/tests/VotingPluginProxyTest.javaL184-L205
• Committed the changes as 415e7bf (Defer validated legacy presence handoffs).
• Prepared the follow-up PR metadata titled “Defer validated legacy login handoffs.” The environment’s bundled make_pr MCP server could not start because its installed MCP package lacks mcp.server.fastmcp.

Testing

• ✅ git diff --check
• ✅ git status --short --branch
• ⚠️ mvn -B -f VotingPlugin/pom.xml -Dtest=VotingPluginProxyTest,BackendPlayerPresenceTrackerTest test (Maven Central returned HTTP 403 while resolving maven-resources-plugin:3.3.1)
• ⚠️ mvn -o -B -f VotingPlugin/pom.xml -Dtest=VotingPluginProxyTest,BackendPlayerPresenceTrackerTest test (the required Maven plugin was not available in the local cache)

View task →

[BenCodez]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 7dadd1d812

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".