BakeryAuth

BakeryAuth is a required client-and-server NeoForge security and moderation mod for private Minecraft servers. It combines Discord account linking, login confirmation, role checks, and manual client mod/resource-pack review.

Players remain connected inside an isolated authentication limbo while completing the required steps. The limbo displays an End Portal inspired background and the current requirement. Successful players enter the main world automatically without reconnecting.

Features

• Discord account linking with one-time /link codes
• Required Discord guild membership and player role
• Login approval or denial through Discord DMs
• Isolated in-server limbo with a live requirement display
• Mandatory one-time client report for every connection
• Mod identification through Modrinth and optional CurseForge lookups
• One compact Discord log card per report
• Full unabridged report delivered privately to authorized administrators
• Configurable English and Russian server messages

Unknown mods are reported for manual review. Mods that could not be checked because every provider was unavailable are listed separately and are not misclassified as unknown. Reports never automatically prove or punish a violation.

Requirements

• Minecraft Java Edition 1.21.1
• NeoForge 21.1.172 or newer
• Java 21
• The same BakeryAuth version installed on the server and every client
• A Discord bot with the Server Members Intent enabled

Use bakeryauth-1.0.0-all.jar.

Discord Review Flow

After receiving a client report, BakeryAuth posts one compact card through bakery.webhookUrl. It shows the player, total mods, known mods, suspicious mods, unchecked mods, resource packs, total size, and a short suspicious-file preview. The bot posts a small review button directly below the webhook card.

Administrators with the Discord Manage Server or Administrator permission can click Send full report in DM. BakeryAuth sends that administrator a complete text file containing every reported mod, hash, fingerprint, provider result, and resource pack. Full reports are kept in memory for 24 hours and are never posted publicly.

The bot needs View Channel, Send Messages, Read Message History, and Embed Links in the webhook channel so it can attach the review button. Administrators must allow DMs from server members to receive report files.

Connection Security

• A fresh cryptographically random one-time challenge is created for every connection.
• Reports are mandatory for every BakeryAuth connection, regardless of the address used by the client. A local IP tunnel cannot skip reporting.
• Reports are bound to their challenge and cannot be replayed on another connection.
• Duplicate, malformed, mismatched, or late reports are rejected.
• Disconnects are enforced by the server, so a modified client cannot ignore a kick.
• Packet sizes and untrusted report fields are strictly limited and validated.
• Players cannot interact with the main world before all checks succeed.

A client mod runs on a machine controlled by the player. A sufficiently modified client can still lie about local files or reproduce the public protocol. Preventing that requires a trusted launcher or an external anti-cheat/attestation system.

Data And Privacy

The client reports:

• Installed .jar file names, sizes, SHA-1 hashes, and CurseForge fingerprints
• Resource-pack names, types, sizes, metadata presence, and top-level entries

The server sends SHA-1 hashes to Modrinth and, if configured, fingerprints to CurseForge for identification. Discord and CurseForge credentials never leave the server. Players see a consent screen before the report is collected.

Installation

1. Place bakeryauth-1.0.0-all.jar in the server and every client's mods folder.
2. Start the server once to create config/bakeryauth.properties.
3. Configure Discord credentials, channel IDs, language, and security timeouts.
4. Optionally configure a CurseForge API key.
5. Restart the server.

Server Configuration

server.language=en

discord.token=BOT_TOKEN_HERE
discord.guildId=123456789012345678
discord.playerRoleId=987654321098765432
discord.linkChannelId=111122223333444455
discord.logChannelId=555566667777888899

bakery.webhookUrl=https://discord.com/api/webhooks/YOUR_WEBHOOK_URL
curseforge.apiKey=

security.loginExpireMinutes=5
security.handshakeTimeoutSeconds=30
security.reportTimeoutSeconds=30

If the webhook is missing or unavailable, BakeryAuth falls back to discord.logChannelId. If that ID is omitted, it uses discord.linkChannelId. bakery.serverIps is deprecated and ignored because reports are mandatory for every connection.

Administrator Commands

Command	Description
/bakeryauth info <player>	Shows authentication information
/bakeryauth unlink <player>	Removes the Discord link
/bakeryauth reload	Reloads supported server settings

Building

.\gradlew.bat clean check shadowJar

License

BakeryAuth is licensed under GPL-3.0-only.