fix: fixed /link command was possible spam

Author: duruer

Pano/src/main/kotlin/com/panomc/platform/server/event/GenerateLinkCodeEvent.kt

@@ -6,26 +6,51 @@ import com.panomc.platform.db.model.Server
 import com.panomc.platform.server.ServerEvent
 import com.panomc.platform.server.event.request.GenerateLinkCodeEventRequest
 import com.panomc.platform.server.event.response.GenerateLinkCodeEventResponse
-import java.util.Random
+import com.panomc.platform.server.event.response.GenerateLinkCodeStatus
+import java.security.SecureRandom
 
 @Event
-class GenerateLinkCodeEvent(private val databaseManager: DatabaseManager) : 
+class GenerateLinkCodeEvent(private val databaseManager: DatabaseManager) :
     ServerEvent<GenerateLinkCodeEventRequest, GenerateLinkCodeEventResponse>() {
 
-    override suspend fun handle(request: GenerateLinkCodeEventRequest, server: Server): GenerateLinkCodeEventResponse? {
+    companion object {
+        // Lifetime of a generated link code in milliseconds. Must stay in sync with
+        // VerifyLinkCodeAPI's expiry check (Calendar.SECOND, 30).
+        private const val LINK_CODE_TTL_MS = 30_000L
+    }
+
+    private val secureRandom = SecureRandom()
+
+    override suspend fun handle(request: GenerateLinkCodeEventRequest, server: Server): GenerateLinkCodeEventResponse {
         val username = request.username
         val sqlClient = databaseManager.getSqlClient()
 
-        val user = databaseManager.userDao.getByUsername(username, sqlClient) ?: return null 
-        // If user not found, return null (no response). Or strictly speaking, we could return error response if protocol allows.
-        // But for now, silence is fine, or simple error string in code.
-        // Or create user? No, they should join first.
+        val user = databaseManager.userDao.getByUsername(username, sqlClient)
+            ?: return GenerateLinkCodeEventResponse(status = GenerateLinkCodeStatus.USER_NOT_FOUND)
+
+        // Mirror LoginAPI's LinkCodeRequired condition: /link only makes sense for users
+        // that have neither password nor email set. Any other state means the user can
+        // log in via the regular flow and shouldn't be issued a new link code.
+        val hasPassword = databaseManager.userDao.hasPassword(user.id, sqlClient)
+        val hasEmail = !user.email.isNullOrEmpty()
+        if (hasPassword || hasEmail) {
+            return GenerateLinkCodeEventResponse(status = GenerateLinkCodeStatus.ALREADY_REGISTERED)
+        }
+
+        val now = System.currentTimeMillis()
 
-        val code = String.format("%06d", Random().nextInt(999999))
-        val createdAt = System.currentTimeMillis()
+        // Reuse an existing code while it is still valid so spamming /link does not
+        // rotate the code that the user is currently trying to enter on the website.
+        val existing = databaseManager.userDao.getLinkCode(username, sqlClient)
+        val existingCode = existing?.first
+        val existingCreatedAt = existing?.second ?: 0L
+        if (!existingCode.isNullOrEmpty() && now - existingCreatedAt < LINK_CODE_TTL_MS) {
+            return GenerateLinkCodeEventResponse(code = existingCode)
+        }
 
-        databaseManager.userDao.setLinkCode(username, code, createdAt, sqlClient)
+        val code = String.format("%06d", secureRandom.nextInt(1_000_000))
+        databaseManager.userDao.setLinkCode(username, code, now, sqlClient)
 
-        return GenerateLinkCodeEventResponse(code)
+        return GenerateLinkCodeEventResponse(code = code)
     }
 }

Pano/src/main/kotlin/com/panomc/platform/server/event/response/GenerateLinkCodeEventResponse.kt

@@ -2,4 +2,19 @@ package com.panomc.platform.server.event.response
 
 import com.panomc.platform.server.ServerEventResponse
 
-data class GenerateLinkCodeEventResponse(val code: String) : ServerEventResponse()
+enum class GenerateLinkCodeStatus {
+    // Code generated (or reused) successfully.
+    SUCCESS,
+
+    // The Minecraft user already has credentials (password or email) on the website,
+    // therefore /link is not needed.
+    ALREADY_REGISTERED,
+
+    // No user with the requested username exists in the database yet.
+    USER_NOT_FOUND
+}
+
+data class GenerateLinkCodeEventResponse(
+    val code: String? = null,
+    val status: GenerateLinkCodeStatus = GenerateLinkCodeStatus.SUCCESS
+) : ServerEventResponse()

Pano/src/main/resources/locales/mcplugin/en-US.json

@@ -7,7 +7,10 @@
     "link": {
       "code-message": "&aYour link code is: &e{{code}}\n&aIt is valid for 30 seconds.",
       "failed": "&cFailed to generate link code. Please try again later.",
-      "only-players": "&cOnly players can use this command."
+      "only-players": "&cOnly players can use this command.",
+      "already-registered": "&cYou are already registered. There is no need to use /link.",
+      "user-not-found": "&cYour account could not be found. Please rejoin the server and try again.",
+      "cooldown": "&ePlease wait &6{{seconds}}&e seconds before using /link again."
     }
   }
-}
+}

Pano/src/main/resources/locales/mcplugin/ru.json

@@ -7,7 +7,10 @@
         "link": {
             "code-message": "&aВаш код привязки: &e{{code}}\n&aОн действителен 30 секунд.",
             "failed": "&cНе удалось создать код привязки. Пожалуйста, попробуйте позже.",
-            "only-players": "&cЭту команду могут использовать только игроки."
+            "only-players": "&cЭту команду могут использовать только игроки.",
+            "already-registered": "&cВы уже зарегистрированы. Использовать /link не нужно.",
+            "user-not-found": "&cВаш аккаунт не найден. Пожалуйста, перезайдите на сервер и попробуйте снова.",
+            "cooldown": "&eПодождите &6{{seconds}}&e секунд перед повторным использованием /link."
         }
     }
-}
+}

Pano/src/main/resources/locales/mcplugin/tr.json

@@ -7,7 +7,10 @@
     "link": {
       "code-message": "&aBağlantı kodunuz: &e{{code}}\n&aBu kod 30 saniye geçerlidir.",
       "failed": "&cBağlantı kodu oluşturulamadı. Lütfen daha sonra tekrar deneyin.",
-      "only-players": "&cBu komutu sadece oyuncular kullanabilir."
+      "only-players": "&cBu komutu sadece oyuncular kullanabilir.",
+      "already-registered": "&cZaten kayıtlısınız. /link komutunu kullanmanıza gerek yok.",
+      "user-not-found": "&cHesabınız bulunamadı. Lütfen sunucuya tekrar giriş yapıp deneyin.",
+      "cooldown": "&e/link komutunu tekrar kullanmadan önce &6{{seconds}}&e saniye bekleyin."
     }
   }
-}
+}