From 69220387a3982864ba9aec319e8a8aac064cd225 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 20 Jun 2026 03:22:30 +0200
Subject: [PATCH 01/31] update default gradleJvm version

---
 .idea/gradle.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.idea/gradle.xml b/.idea/gradle.xml
index 728dbe2e..5be346f6 100644
--- a/.idea/gradle.xml
+++ b/.idea/gradle.xml
@@ -5,7 +5,7 @@
     <option name="linkedExternalProjectsSettings">
       <GradleProjectSettings>
         <option name="externalProjectPath" value="$PROJECT_DIR$" />
-        <option name="gradleJvm" value="#JAVA_HOME" />
+        <option name="gradleJvm" value="21" />
         <option name="modules">
           <set>
             <option value="$PROJECT_DIR$" />

From 6b37355a74fcfba88c7ed1a09482d7cf12061546 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 20 Jun 2026 03:24:15 +0200
Subject: [PATCH 02/31] common: move CredentialsHasher interface from infra to
 domain

---
 .../credentials/CredentialsHasher.kt          | 29 +++++++++++++++++++
 .../credentials/CredentialsHasherFactory.kt   |  6 ++--
 .../crypto/hasher/Argon2CredentialsHasher.kt  |  1 +
 .../crypto/hasher/BCryptCredentialsHasher.kt  |  1 +
 .../hasher/LibreLoginSHACredentialsHasher.kt  |  1 +
 .../crypto/hasher/SHACredentialsHasher.kt     |  1 +
 6 files changed, 37 insertions(+), 2 deletions(-)
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasher.kt

diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasher.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasher.kt
new file mode 100644
index 00000000..4fec4ebf
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasher.kt
@@ -0,0 +1,29 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.application.credentials
+
+import pl.spcode.navauth.common.infra.crypto.HashedPassword
+import pl.spcode.navauth.common.infra.crypto.PasswordHash
+
+interface CredentialsHasher {
+
+  fun hash(password: String): HashedPassword
+
+  fun verify(password: String, passwordHash: PasswordHash): Boolean
+}
\ No newline at end of file
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasherFactory.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasherFactory.kt
index 89558d8e..3ba900b0 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasherFactory.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasherFactory.kt
@@ -23,7 +23,6 @@ import pl.spcode.navauth.common.config.PasswordsConfig
 import pl.spcode.navauth.common.domain.credentials.HashingAlgorithm
 import pl.spcode.navauth.common.infra.crypto.hasher.Argon2CredentialsHasher
 import pl.spcode.navauth.common.infra.crypto.hasher.BCryptCredentialsHasher
-import pl.spcode.navauth.common.infra.crypto.hasher.CredentialsHasher
 import pl.spcode.navauth.common.infra.crypto.hasher.LibreLoginSHACredentialsHasher
 import pl.spcode.navauth.common.infra.crypto.hasher.SHACredentialsHasher
 
@@ -33,7 +32,10 @@ class CredentialsHasherFactory @Inject constructor(val passwordsConfig: Password
     return when (passwordsConfig.hashingAlgorithm) {
       HashingAlgorithm.BCRYPT -> BCryptCredentialsHasher()
       HashingAlgorithm.ARGON2 -> Argon2CredentialsHasher()
-      else -> throw IllegalArgumentException()
+      else ->
+        throw IllegalArgumentException(
+          "Hashing algorithm not supported: ${passwordsConfig.hashingAlgorithm}! Supported hashing algorithms: ${HashingAlgorithm.entries.joinToString(", ")}"
+        )
     }
   }
 
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/Argon2CredentialsHasher.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/Argon2CredentialsHasher.kt
index e6f0e19e..2059725c 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/Argon2CredentialsHasher.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/Argon2CredentialsHasher.kt
@@ -23,6 +23,7 @@ import java.security.MessageDigest
 import java.security.SecureRandom
 import org.bouncycastle.crypto.generators.Argon2BytesGenerator
 import org.bouncycastle.crypto.params.Argon2Parameters
+import pl.spcode.navauth.common.application.credentials.CredentialsHasher
 import pl.spcode.navauth.common.domain.credentials.HashingAlgorithm
 import pl.spcode.navauth.common.infra.crypto.CryptoUtils
 import pl.spcode.navauth.common.infra.crypto.HashedPassword
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/BCryptCredentialsHasher.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/BCryptCredentialsHasher.kt
index cab05783..15224082 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/BCryptCredentialsHasher.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/BCryptCredentialsHasher.kt
@@ -19,6 +19,7 @@
 package pl.spcode.navauth.common.infra.crypto.hasher
 
 import at.favre.lib.crypto.bcrypt.BCrypt
+import pl.spcode.navauth.common.application.credentials.CredentialsHasher
 import pl.spcode.navauth.common.domain.credentials.HashingAlgorithm
 import pl.spcode.navauth.common.infra.crypto.HashedPassword
 import pl.spcode.navauth.common.infra.crypto.PasswordHash
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/LibreLoginSHACredentialsHasher.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/LibreLoginSHACredentialsHasher.kt
index 8b041ba4..653524da 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/LibreLoginSHACredentialsHasher.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/LibreLoginSHACredentialsHasher.kt
@@ -22,6 +22,7 @@ import java.math.BigInteger
 import java.security.MessageDigest
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
+import pl.spcode.navauth.common.application.credentials.CredentialsHasher
 import pl.spcode.navauth.common.domain.credentials.HashingAlgorithm
 import pl.spcode.navauth.common.infra.crypto.HashedPassword
 import pl.spcode.navauth.common.infra.crypto.PasswordHash
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/SHACredentialsHasher.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/SHACredentialsHasher.kt
index c0d15e37..9490fe54 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/SHACredentialsHasher.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/SHACredentialsHasher.kt
@@ -24,6 +24,7 @@ import org.bouncycastle.crypto.digests.SHA256Digest
 import org.bouncycastle.crypto.digests.SHA512Digest
 import org.bouncycastle.crypto.generators.PKCS5S2ParametersGenerator
 import org.bouncycastle.crypto.params.KeyParameter
+import pl.spcode.navauth.common.application.credentials.CredentialsHasher
 import pl.spcode.navauth.common.domain.credentials.HashingAlgorithm
 import pl.spcode.navauth.common.infra.crypto.CryptoUtils
 import pl.spcode.navauth.common.infra.crypto.HashedPassword

From 5a5e93e39e0720e541645dca33f2098c1baa12bb Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 20 Jun 2026 03:29:53 +0200
Subject: [PATCH 03/31] velocity: fix register command always using BCrypt
 instead of the selected algo

---
 CHANGELOG.md                                                | 3 +++
 .../spcode/navauth/velocity/command/user/RegisterCommand.kt | 6 ++++--
 2 files changed, 7 insertions(+), 2 deletions(-)
 create mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 00000000..0f0c4129
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,3 @@
+
+## 0.2.0
+- fix register command always using BCrypt instead of the selected algo
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt
index 0760f16b..cd451a36 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt
@@ -29,13 +29,13 @@ import dev.rollczi.litecommands.annotations.execute.Execute
 import pl.spcode.navauth.api.domain.auth.AuthSessionType
 import pl.spcode.navauth.common.annotation.Description
 import pl.spcode.navauth.common.application.auth.session.AuthSessionService
+import pl.spcode.navauth.common.application.credentials.UserCredentialsService
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.application.validator.PasswordValidator
 import pl.spcode.navauth.common.command.exception.MissingPermissionException
 import pl.spcode.navauth.common.domain.user.User
 import pl.spcode.navauth.common.domain.user.UserUuid
 import pl.spcode.navauth.common.domain.user.Username
-import pl.spcode.navauth.common.infra.crypto.hasher.BCryptCredentialsHasher
 import pl.spcode.navauth.velocity.command.Permissions
 import pl.spcode.navauth.velocity.infra.auth.VelocityUniqueSessionId
 import pl.spcode.navauth.velocity.infra.player.VelocityPlayerAdapter
@@ -48,6 +48,7 @@ class RegisterCommand
 constructor(
   val authSessionService: AuthSessionService<VelocityPlayerAdapter>,
   val userService: UserService,
+  val userCredentialsService: UserCredentialsService,
   val passwordValidator: PasswordValidator,
   val multification: VelocityMultification,
 ) {
@@ -86,9 +87,10 @@ constructor(
       return
     }
 
+    val hashedPassword = userCredentialsService.hashPassword(password)
     userService.createAndStoreUserWithNewCredentials(
       User.nonPremium(UserUuid(sender.uniqueId), Username(sender.username)),
-      BCryptCredentialsHasher().hash(password),
+      hashedPassword,
     )
     // register session will send success message
     session.authenticate()

From 82ba3bb0bdc0c69782cb0a79d2c559bd635db77c Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 20 Jun 2026 04:53:41 +0200
Subject: [PATCH 04/31] common & velocity: add encryption queue & integrate
 with password verification

---
 CHANGELOG.md                                  |  15 +++
 .../credentials/CredentialsHasher.kt          |   2 +-
 .../credentials/UserCredentialsService.kt     |  38 ++++++-
 .../queue/EncryptionQueueService.kt           |  31 ++++++
 .../credentials/queue/EncryptionTask.kt}      |  17 +--
 .../EncryptionTaskAlreadyQueuedException.kt   |  21 ++++
 .../common/config/EncryptionQueueConfig.kt    |  39 +++++++
 .../navauth/common/config/GeneralConfig.kt    |   5 +
 .../navauth/common/config/MessagesConfig.kt   |   9 ++
 .../common/infra/auth/LoginAuthSession.kt     |  73 ++++++++++---
 .../queue/EncryptionQueueServiceImpl.kt       | 102 ++++++++++++++++++
 .../navauth/common/module/ServicesModule.kt   |   4 +
 .../command/user/ChangePasswordCommand.kt     |  26 +++--
 .../velocity/command/user/LoginCommand.kt     |  24 ++++-
 .../command/user/TwoFactorSetupCommand.kt     |  54 ++++++----
 .../infra/auth/VelocityLoginAuthSession.kt    |   6 +-
 .../listener/velocity/ConnectionListeners.kt  |   3 +
 17 files changed, 408 insertions(+), 61 deletions(-)
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionQueueService.kt
 rename navauth-common/src/main/kotlin/pl/spcode/navauth/common/{infra/crypto/hasher/CredentialsHasher.kt => application/credentials/queue/EncryptionTask.kt} (65%)
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTaskAlreadyQueuedException.kt
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/EncryptionQueueConfig.kt
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/queue/EncryptionQueueServiceImpl.kt

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f0c4129..06f1ff0a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,18 @@
 
 ## 0.2.0
+
+### Fixes
 - fix register command always using BCrypt instead of the selected algo
+
+### Config
+**General** config:
+```diff
++encryptionQueueConfig
+```
+
+**Messages** config:
+```diff
++ unexpectedErrorOccurred
++ processAlreadyInProgressError
++ alreadyTryingToLoginError
+```
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasher.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasher.kt
index 4fec4ebf..6357081f 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasher.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasher.kt
@@ -26,4 +26,4 @@ interface CredentialsHasher {
   fun hash(password: String): HashedPassword
 
   fun verify(password: String, passwordHash: PasswordHash): Boolean
-}
\ No newline at end of file
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt
index b86ab1e4..10d14adb 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt
@@ -20,6 +20,11 @@ package pl.spcode.navauth.common.application.credentials
 
 import com.google.inject.Inject
 import com.google.inject.Singleton
+import java.util.UUID
+import java.util.concurrent.CompletableFuture
+import org.slf4j.Logger
+import org.slf4j.LoggerFactory
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionQueueService
 import pl.spcode.navauth.common.domain.common.TransactionService
 import pl.spcode.navauth.common.domain.credentials.UserCredentials
 import pl.spcode.navauth.common.domain.credentials.UserCredentialsRepository
@@ -34,8 +39,11 @@ constructor(
   val credentialsRepository: UserCredentialsRepository,
   val transactionService: TransactionService,
   val credentialsHasherFactory: CredentialsHasherFactory,
+  val encryptionQueueService: EncryptionQueueService,
 ) {
 
+  private val logger: Logger = LoggerFactory.getLogger(javaClass)
+
   fun findCredentials(user: User): UserCredentials? {
     return credentialsRepository.findByUser(user)
   }
@@ -72,14 +80,36 @@ constructor(
     credentialsRepository.deleteByUser(user)
   }
 
-  /** @param password the raw (not hashed) password */
-  fun verifyPassword(credentials: UserCredentials, password: String): Boolean {
-    require(credentials.hashedPassword != null) { "credentials do not have a password hash" }
+  /**
+   * @param password the raw (not hashed) password
+   * @throws
+   *   pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
+   *   if task is already queued
+   */
+  fun enqueueVerifyPassword(
+    credentials: UserCredentials,
+    password: String,
+    playerId: UUID,
+  ): CompletableFuture<Boolean> {
+    require(credentials.hashedPassword != null) { "credentials must have password hash" }
 
     val passwordHash = credentials.hashedPassword.passwordHash
     val hasher = credentialsHasherFactory.createHasher(credentials.hashedPassword.algo)
 
-    return hasher.verify(password, passwordHash)
+    val future = CompletableFuture<Boolean>()
+    encryptionQueueService.submitTask(playerId) {
+      try {
+        val result = hasher.verify(password, passwordHash)
+        future.complete(result)
+      } catch (ex: Exception) {
+        logger.error(
+          "Unexpected error occurred while trying to verify user id='${playerId}' password",
+          ex,
+        )
+        future.completeExceptionally(ex)
+      }
+    }
+    return future
   }
 
   fun hashPassword(password: String): HashedPassword {
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionQueueService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionQueueService.kt
new file mode 100644
index 00000000..f88c4466
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionQueueService.kt
@@ -0,0 +1,31 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.application.credentials.queue
+
+import java.util.UUID
+
+interface EncryptionQueueService {
+
+  /** @throws EncryptionTaskAlreadyQueuedException if player has existing task queued */
+  fun submitTask(playerId: UUID, operation: () -> Unit)
+
+  fun dequeueTask(playerId: UUID): Boolean
+
+  fun isTaskQueued(playerId: UUID): Boolean
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/CredentialsHasher.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTask.kt
similarity index 65%
rename from navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/CredentialsHasher.kt
rename to navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTask.kt
index 96cb7a9b..1c1b21bf 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/CredentialsHasher.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTask.kt
@@ -1,6 +1,6 @@
 /*
  * NavAuth
- * Copyright © 2025 Oliwier Fijas (Navio1430)
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
  *
  * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
  * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
@@ -16,14 +16,17 @@
  *
  */
 
-package pl.spcode.navauth.common.infra.crypto.hasher
+package pl.spcode.navauth.common.application.credentials.queue
 
-import pl.spcode.navauth.common.infra.crypto.HashedPassword
-import pl.spcode.navauth.common.infra.crypto.PasswordHash
+import java.util.UUID
 
-interface CredentialsHasher {
+class EncryptionTask(val playerId: UUID?, private val operation: () -> Unit) : Runnable {
 
-  fun hash(password: String): HashedPassword
+  @Volatile var cancelled = false
 
-  fun verify(password: String, passwordHash: PasswordHash): Boolean
+  override fun run() {
+    if (cancelled) return
+
+    operation()
+  }
 }
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTaskAlreadyQueuedException.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTaskAlreadyQueuedException.kt
new file mode 100644
index 00000000..326c9b8a
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTaskAlreadyQueuedException.kt
@@ -0,0 +1,21 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.application.credentials.queue
+
+class EncryptionTaskAlreadyQueuedException : Exception()
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/EncryptionQueueConfig.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/EncryptionQueueConfig.kt
new file mode 100644
index 00000000..cfd094fa
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/EncryptionQueueConfig.kt
@@ -0,0 +1,39 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.config
+
+import eu.okaeri.configs.OkaeriConfig
+import eu.okaeri.configs.annotation.Comment
+
+class EncryptionQueueConfig : OkaeriConfig() {
+
+  @Comment(
+    "Minimum (core) number of threads kept alive in the encryption thread pool even when idle.",
+    "These threads handle password hashing and verification.",
+    "(Bcrypt and Argon2 are very memory-intensive. 2-4 is a safe range.)",
+  )
+  var encryptionQueueMinThreads: Int = 2
+
+  @Comment(
+    "Maximum number of threads the encryption pool can grow to under load.",
+    "Extra threads are created only when the work queue is full.",
+    "Set higher if you have a powerful server with many concurrent registrations/logins.",
+  )
+  var encryptionQueueMaxThreads: Int = 4
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/GeneralConfig.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/GeneralConfig.kt
index a9c70b87..905bec7e 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/GeneralConfig.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/GeneralConfig.kt
@@ -70,6 +70,11 @@ open class GeneralConfig : OkaeriConfig() {
 
   @Comment("Passwords config") var passwordsConfig: PasswordsConfig = PasswordsConfig()
 
+  @Comment(
+    "Encryption queue config - limits concurrent encryption operations (especially bcrypt/argon2) to prevent OOM"
+  )
+  var encryptionQueueConfig: EncryptionQueueConfig = EncryptionQueueConfig()
+
   @Comment(
     "When a non-premium user tries to join with a premium nickname,",
     "an 'invalid session' error occurs. This is default Minecraft behavior.",
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
index 20611a33..56937c0f 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
@@ -87,6 +87,10 @@ open class MessagesConfig : OkaeriConfig() {
 
   class NoticesConfig : OkaeriConfig() {
 
+    val unexpectedErrorOccurred: Notice = Notice.chat("<red>An unexpected error occurred.")
+    var processAlreadyInProgressError: Notice =
+      Notice.chat("<red>Process is already in progress. Please wait...")
+
     var passwordRequiredError: Notice = Notice.chat("<red>Please provide your current password.")
     var twoFactorAlreadyEnabledError: Notice =
       Notice.chat("<red>Your account has 2FA enabled already!")
@@ -107,6 +111,11 @@ open class MessagesConfig : OkaeriConfig() {
     var accountAlreadyPremiumError: Notice =
       Notice.chat("<red>Account is already set as a premium one.")
 
+    var alreadyTryingToLoginError: Notice =
+      Notice.chat(
+        "<red>You're already trying to login, please wait for login result before next retry."
+      )
+
     var registerPasswordInvalidError: Notice =
       Notice.chat(
         "<red>The password is invalid. It must be at least 5 characters long and contain at least one uppercase letter and one digit."
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt
index 15d38797..4a76a33f 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt
@@ -18,9 +18,11 @@
 
 package pl.spcode.navauth.common.infra.auth
 
+import java.util.concurrent.CompletableFuture
 import pl.spcode.navauth.api.domain.auth.AuthSessionType
 import pl.spcode.navauth.api.event.NavAuthEventBus
 import pl.spcode.navauth.common.application.credentials.UserCredentialsService
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
 import pl.spcode.navauth.common.domain.auth.session.AuthSession
 import pl.spcode.navauth.common.domain.credentials.UserCredentials
 import pl.spcode.navauth.common.domain.player.DisconnectReason
@@ -29,7 +31,7 @@ import pl.spcode.navauth.common.domain.player.PlayerAdapter
 open class LoginAuthSession<T : PlayerAdapter>(
   playerAdapter: T,
   val userCredentials: UserCredentials,
-  val userCredentialsService: UserCredentialsService,
+  private val userCredentialsService: UserCredentialsService,
   maxLoginAttempts: Int,
   eventBus: NavAuthEventBus,
 ) : AuthSession<T>(playerAdapter, eventBus) {
@@ -53,37 +55,78 @@ open class LoginAuthSession<T : PlayerAdapter>(
    * @param password the raw (not hashed) password to authenticate the user, can be null if not
    *   required
    * @param twoFactorCode the two-factor authentication code, can be null if 2FA is not enabled
-   * @return true if the authentication is successful, otherwise false
+   * @return CompletableFuture with AuthTaskResult
    * @throws IllegalArgumentException if `password` or `twoFactorCode` is required by the user
    *   credentials but not provided
    */
-  fun auth(password: String?, twoFactorCode: String?): Boolean {
-    val result = tryAuth(password, twoFactorCode)
-    if (!result) {
-      attemptsLeft -= 1
-      if (attemptsLeft <= 0) {
-        onTooManyLoginAttempts()
+  fun enqueueAuthTask(
+    password: String?,
+    twoFactorCode: String?,
+  ): CompletableFuture<AuthTaskResult> {
+    return tryAuth(password, twoFactorCode).thenApply { result ->
+      when (result) {
+        AuthTaskResult.WrongCredentials -> {
+          attemptsLeft -= 1
+          if (attemptsLeft <= 0) {
+            onTooManyLoginAttempts()
+            return@thenApply AuthTaskResult.FailedTooManyAttempts
+          }
+        }
+        AuthTaskResult.Success -> {
+          authenticate()
+        }
+        else -> {}
       }
+      return@thenApply result
     }
-    return result
   }
 
-  private fun tryAuth(password: String?, twoFactorCode: String?): Boolean {
+  private fun tryAuth(
+    password: String?,
+    twoFactorCode: String?,
+  ): CompletableFuture<AuthTaskResult> {
     if (userCredentials.isTwoFactorEnabled) {
       require(twoFactorCode != null) { "twoFactorCode parameter is required by user credentials" }
       if (!userCredentialsService.verifyCode(userCredentials, twoFactorCode)) {
-        return false
+        return CompletableFuture.completedFuture(AuthTaskResult.WrongCredentials)
       }
     }
 
     if (userCredentials.isPasswordRequired) {
+      val future = CompletableFuture<AuthTaskResult>()
       require(password != null) { "password parameter is required by user credentials" }
-      if (!userCredentialsService.verifyPassword(userCredentials, password)) {
-        return false
+      try {
+        userCredentialsService
+          .enqueueVerifyPassword(userCredentials, password, playerAdapter.identifier)
+          .whenComplete { isCorrect, throwable ->
+            if (throwable != null) {
+              future.completeExceptionally(throwable)
+              return@whenComplete
+            }
+            if (isCorrect) {
+              future.complete(AuthTaskResult.Success)
+            } else {
+              future.complete(AuthTaskResult.WrongCredentials)
+            }
+          }
+      } catch (ex: EncryptionTaskAlreadyQueuedException) {
+        future.complete(AuthTaskResult.AlreadyQueued)
       }
+
+      return future
     }
 
-    authenticate()
-    return true
+    // 2fa was the only one required and it passed successfully
+    return CompletableFuture.completedFuture(AuthTaskResult.Success)
+  }
+
+  sealed class AuthTaskResult {
+    object AlreadyQueued : AuthTaskResult()
+
+    object WrongCredentials : AuthTaskResult()
+
+    object Success : AuthTaskResult()
+
+    object FailedTooManyAttempts : AuthTaskResult()
   }
 }
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/queue/EncryptionQueueServiceImpl.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/queue/EncryptionQueueServiceImpl.kt
new file mode 100644
index 00000000..6962fce5
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/queue/EncryptionQueueServiceImpl.kt
@@ -0,0 +1,102 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.infra.crypto.queue
+
+import com.google.inject.Inject
+import com.google.inject.Singleton
+import java.util.UUID
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.Executors
+import java.util.concurrent.LinkedBlockingQueue
+import java.util.concurrent.RejectedExecutionException
+import java.util.concurrent.ThreadPoolExecutor
+import java.util.concurrent.TimeUnit
+import org.slf4j.Logger
+import org.slf4j.LoggerFactory
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionQueueService
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionTask
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
+import pl.spcode.navauth.common.config.EncryptionQueueConfig
+
+@Singleton
+class EncryptionQueueServiceImpl @Inject constructor(private val config: EncryptionQueueConfig) :
+  EncryptionQueueService {
+
+  private val logger: Logger = LoggerFactory.getLogger(javaClass)
+
+  private val workQueue = LinkedBlockingQueue<Runnable>()
+  private val activeTasks = ConcurrentHashMap<UUID, EncryptionTask>()
+
+  private val executor: ThreadPoolExecutor =
+    ThreadPoolExecutor(
+      config.encryptionQueueMinThreads,
+      config.encryptionQueueMaxThreads,
+      60,
+      TimeUnit.SECONDS,
+      workQueue,
+      Executors.defaultThreadFactory(),
+    ) { task, _ ->
+      task as EncryptionTask
+      try {
+        workQueue.put(task)
+      } catch (e: InterruptedException) {
+        activeTasks.remove(task.playerId)
+        Thread.currentThread().interrupt()
+        throw RejectedExecutionException("Interrupted while waiting for queue slot", e)
+      }
+    }
+
+  init {
+    executor.allowCoreThreadTimeOut(true)
+  }
+
+  /** @throws EncryptionTaskAlreadyQueuedException if task is already queued */
+  override fun submitTask(playerId: UUID, operation: () -> Unit) {
+    val task = EncryptionTask(playerId, operation)
+
+    if (activeTasks.containsKey(playerId)) {
+      throw EncryptionTaskAlreadyQueuedException()
+    }
+    activeTasks[playerId] = task
+
+    executor.execute {
+      val result = runCatching { task.run() }
+      if (result.isFailure) {
+        logger.warn("Player id='${playerId}' EncryptionTask failed", result.exceptionOrNull())
+      }
+      activeTasks.remove(playerId)
+    }
+  }
+
+  override fun isTaskQueued(playerId: UUID): Boolean {
+    return activeTasks.containsKey(playerId)
+  }
+
+  override fun dequeueTask(playerId: UUID): Boolean {
+    workQueue.removeIf { it is EncryptionTask && it.playerId == playerId }
+
+    val task = activeTasks.remove(playerId)
+    if (task != null) {
+      task.cancelled = true
+      return true
+    }
+
+    return false
+  }
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/ServicesModule.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/ServicesModule.kt
index c0b33957..2f9df827 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/ServicesModule.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/ServicesModule.kt
@@ -23,15 +23,19 @@ import pl.spcode.navauth.common.application.auth.handshake.AuthHandshakeSessionS
 import pl.spcode.navauth.common.application.auth.session.AuthSessionService
 import pl.spcode.navauth.common.application.auth.username.UsernameResolutionService
 import pl.spcode.navauth.common.application.credentials.UserCredentialsService
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionQueueService
 import pl.spcode.navauth.common.application.mojang.MojangProfileService
 import pl.spcode.navauth.common.application.user.UserActivitySessionService
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.domain.common.TransactionService
+import pl.spcode.navauth.common.infra.crypto.queue.EncryptionQueueServiceImpl
 import pl.spcode.navauth.common.infra.persistence.ormlite.TransactionServiceImpl
 
 class ServicesModule : AbstractModule() {
 
   override fun configure() {
+    bind(EncryptionQueueService::class.java).to(EncryptionQueueServiceImpl::class.java)
+
     bind(TransactionService::class.java).to(TransactionServiceImpl::class.java)
 
     bind(UsernameResolutionService::class.java)
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/ChangePasswordCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/ChangePasswordCommand.kt
index a9fde534..9c3804bd 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/ChangePasswordCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/ChangePasswordCommand.kt
@@ -28,6 +28,7 @@ import dev.rollczi.litecommands.annotations.execute.Execute
 import dev.rollczi.litecommands.annotations.permission.Permission
 import pl.spcode.navauth.common.annotation.Description
 import pl.spcode.navauth.common.application.credentials.UserCredentialsService
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.velocity.command.Permissions
 import pl.spcode.navauth.velocity.multification.VelocityMultification
@@ -58,13 +59,24 @@ constructor(
       return
     }
 
-    val isCorrectPassword = userCredentialsService.verifyPassword(credentials, currentPassword)
-    if (!isCorrectPassword) {
-      multification.send(sender) { it.multification.wrongCredentialsError }
-      return
-    }
+    try {
+      userCredentialsService
+        .enqueueVerifyPassword(credentials, currentPassword, sender.uniqueId)
+        .whenComplete { isCorrect, throwable ->
+          if (throwable != null) {
+            multification.send(sender) { it.multification.unexpectedErrorOccurred }
+            return@whenComplete
+          }
+          if (!isCorrect) {
+            multification.send(sender) { it.multification.wrongCredentialsError }
+            return@whenComplete
+          }
 
-    userCredentialsService.updatePassword(user, newPassword)
-    multification.send(sender) { it.multification.newPasswordSetSuccess }
+          userCredentialsService.updatePassword(user, newPassword)
+          multification.send(sender) { it.multification.newPasswordSetSuccess }
+        }
+    } catch (_: EncryptionTaskAlreadyQueuedException) {
+      multification.send(sender) { it.multification.processAlreadyInProgressError }
+    }
   }
 }
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt
index 7fa402c6..568974ec 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt
@@ -32,6 +32,7 @@ import pl.spcode.navauth.api.domain.auth.AuthSessionType
 import pl.spcode.navauth.common.annotation.Description
 import pl.spcode.navauth.common.application.auth.session.AuthSessionService
 import pl.spcode.navauth.common.command.exception.MissingPermissionException
+import pl.spcode.navauth.common.infra.auth.LoginAuthSession
 import pl.spcode.navauth.velocity.command.Permissions
 import pl.spcode.navauth.velocity.infra.auth.VelocityLoginAuthSession
 import pl.spcode.navauth.velocity.infra.auth.VelocityUniqueSessionId
@@ -121,10 +122,25 @@ constructor(
     password: String?,
     code: String?,
   ) {
-    if (session.auth(password, code)) {
-      return
+    session.enqueueAuthTask(password, code).whenComplete { result, throwable ->
+      if (throwable != null) {
+        multification.send(sender) { it.multification.unexpectedErrorOccurred }
+        return@whenComplete
+      }
+      when (result) {
+        LoginAuthSession.AuthTaskResult.AlreadyQueued -> {
+          multification.send(sender) { it.multification.alreadyTryingToLoginError }
+        }
+        LoginAuthSession.AuthTaskResult.WrongCredentials -> {
+          multification.send(sender) { it.multification.wrongCredentialsError }
+        }
+        LoginAuthSession.AuthTaskResult.FailedTooManyAttempts -> {
+          // handled by VelocityLoginAuthSession.onTooManyLoginAttempts
+        }
+        LoginAuthSession.AuthTaskResult.Success -> {
+          // handled by VelocityLoginAuthSession.onAuthenticated
+        }
+      }
     }
-
-    multification.send(sender) { it.multification.wrongCredentialsError }
   }
 }
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/TwoFactorSetupCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/TwoFactorSetupCommand.kt
index 8aa7f6fc..e923b7e6 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/TwoFactorSetupCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/TwoFactorSetupCommand.kt
@@ -27,9 +27,11 @@ import dev.rollczi.litecommands.annotations.command.RootCommand
 import dev.rollczi.litecommands.annotations.context.Context
 import dev.rollczi.litecommands.annotations.execute.Execute
 import java.util.Optional
+import java.util.concurrent.CompletableFuture
 import net.kyori.adventure.text.minimessage.MiniMessage
 import pl.spcode.navauth.common.annotation.Description
 import pl.spcode.navauth.common.application.credentials.UserCredentialsService
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.command.exception.MissingPermissionException
 import pl.spcode.navauth.common.config.MessagesConfig
@@ -83,28 +85,40 @@ constructor(
         return
       }
 
-      val isCorrectPassword =
-        userCredentialsService.verifyPassword(credentials, currentPassword.get())
-      if (!isCorrectPassword) {
-        multification.send(sender) { it.multification.wrongCredentialsError }
-        return
+      try {
+        userCredentialsService
+          .enqueueVerifyPassword(credentials, currentPassword.get(), sender.uniqueId)
+          .whenComplete { isCorrect, throwable ->
+            CompletableFuture.supplyAsync {
+              if (throwable != null) {
+                multification.send(sender) { it.multification.unexpectedErrorOccurred }
+                return@supplyAsync
+              }
+              if (!isCorrect) {
+                multification.send(sender) { it.multification.wrongCredentialsError }
+                return@supplyAsync
+              }
+
+              val secret = TOTP2FA().generateSecret()
+              val session =
+                totpSetupSessionFactory.createSession(VelocityPlayerAdapter(sender), secret)
+              totpSetupSessionService.registerSession(UserUuid(sender.uniqueId), session)
+
+              val remainingSeconds = TotpSetupSessionService.SESSION_LIFETIME_SECONDS
+              multification
+                .create()
+                .player(sender.uniqueId)
+                .notice(messages.multification.twoFactorSetupInstruction)
+                .placeholder("%SECRET%", secret.value)
+                .placeholder("%REMAINING_SECONDS%", remainingSeconds.toString())
+                .send()
+            }
+          }
+      } catch (_: EncryptionTaskAlreadyQueuedException) {
+        multification.send(sender) { it.multification.processAlreadyInProgressError }
       }
+      return
     }
-
-    val secret = TOTP2FA().generateSecret()
-    val session = totpSetupSessionFactory.createSession(VelocityPlayerAdapter(sender), secret)
-    totpSetupSessionService.registerSession(UserUuid(sender.uniqueId), session)
-
-    val remainingSeconds = TotpSetupSessionService.SESSION_LIFETIME_SECONDS
-    multification
-      .create()
-      .player(sender.uniqueId)
-      .notice(messages.multification.twoFactorSetupInstruction)
-      .placeholder("%SECRET%", secret.value)
-      .placeholder("%REMAINING_SECONDS%", remainingSeconds.toString())
-      .send()
-
-    return
   }
 
   @Async
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/infra/auth/VelocityLoginAuthSession.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/infra/auth/VelocityLoginAuthSession.kt
index 5a0893f7..f557f641 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/infra/auth/VelocityLoginAuthSession.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/infra/auth/VelocityLoginAuthSession.kt
@@ -38,10 +38,10 @@ class VelocityLoginAuthSession(
   userCredentials: UserCredentials,
   userCredentialsService: UserCredentialsService,
   scheduler: NavAuthScheduler,
-  val velocityEventDispatcher: VelocityEventDispatcher,
-  val multification: VelocityMultification,
+  private val velocityEventDispatcher: VelocityEventDispatcher,
+  private val multification: VelocityMultification,
   generalConfig: GeneralConfig,
-  val messagesConfig: MessagesConfig,
+  private val messagesConfig: MessagesConfig,
   eventBus: NavAuthEventBus,
 ) :
   LoginAuthSession<VelocityPlayerAdapter>(
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/ConnectionListeners.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/ConnectionListeners.kt
index a5714e48..f7b15caa 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/ConnectionListeners.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/ConnectionListeners.kt
@@ -29,6 +29,7 @@ import net.kyori.adventure.text.Component
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
 import pl.spcode.navauth.common.application.auth.session.AuthSessionService
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionQueueService
 import pl.spcode.navauth.common.application.user.UserActivitySessionService
 import pl.spcode.navauth.common.component.TextColors
 import pl.spcode.navauth.common.config.GeneralConfig
@@ -43,6 +44,7 @@ class ConnectionListeners
 @Inject
 constructor(
   val authSessionService: AuthSessionService<VelocityPlayerAdapter>,
+  val encryptionQueueService: EncryptionQueueService,
   val serverSelectionService: VelocityServerSelectionService,
   val userActivitySessionService: UserActivitySessionService,
   val generalConfig: GeneralConfig,
@@ -53,6 +55,7 @@ constructor(
   @Subscribe
   fun onDisconnect(event: DisconnectEvent) {
     authSessionService.closeSession(VelocityUniqueSessionId(event.player))
+    encryptionQueueService.dequeueTask(event.player.uniqueId)
     userActivitySessionService.storePlayerSessionOnLeave(VelocityPlayerAdapter(event.player))
   }
 

From 5df997a47313d97304ba61dfce0bb419d7e1f1bf Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 20 Jun 2026 04:54:00 +0200
Subject: [PATCH 05/31] remove unused vars and statements

---
 .../pl/spcode/navauth/common/application/user/UserService.kt | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
index 2d2c9711..abd8e7e3 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
@@ -105,10 +105,7 @@ constructor(
         val requireCredentials = credentials.isTwoFactorEnabled
         val premiumUser = User.premium(user.uuid, user.username, mojangId, requireCredentials)
 
-        val status = userRepository.save(premiumUser)
-        status.isCreated
-        status.isUpdated
-        status.numLinesChanged
+        userRepository.save(premiumUser)
         if (requireCredentials) {
           val newCredentials = credentials.withoutPassword()
           userCredentialsService.storeUserCredentials(premiumUser, newCredentials)

From 792aa8e788c684fc54bf002e187a235e9dff9fdb Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 20 Jun 2026 17:16:47 +0200
Subject: [PATCH 06/31] update changelog

---
 CHANGELOG.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 06f1ff0a..15b79d9e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,13 +1,18 @@
 
 ## 0.2.0
 
+### Changes
+```diff
++ Encryption queue (backpressure especially for Argon2 and BCrypt hashing methods which can lead to OOM killer)
+```
+
 ### Fixes
 - fix register command always using BCrypt instead of the selected algo
 
 ### Config
 **General** config:
 ```diff
-+encryptionQueueConfig
++ encryptionQueueConfig
 ```
 
 **Messages** config:

From 3f60b05418fb3487d60ea454d09fe21adbb85020 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 20 Jun 2026 19:37:16 +0200
Subject: [PATCH 07/31] add Argon2 settings

---
 CHANGELOG.md                                  |  1 +
 .../credentials/CredentialsHasherFactory.kt   | 12 +++++--
 .../navauth/common/config/PasswordsConfig.kt  | 19 +++++++++++
 .../crypto/hasher/Argon2CredentialsHasher.kt  | 33 ++++++++++---------
 4 files changed, 47 insertions(+), 18 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 15b79d9e..4ea0b587 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 ### Changes
 ```diff
 + Encryption queue (backpressure especially for Argon2 and BCrypt hashing methods which can lead to OOM killer)
++ Argon2 configuration settings
 ```
 
 ### Fixes
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasherFactory.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasherFactory.kt
index 3ba900b0..843036cc 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasherFactory.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/CredentialsHasherFactory.kt
@@ -31,7 +31,7 @@ class CredentialsHasherFactory @Inject constructor(val passwordsConfig: Password
   fun createDefaultHasher(): CredentialsHasher {
     return when (passwordsConfig.hashingAlgorithm) {
       HashingAlgorithm.BCRYPT -> BCryptCredentialsHasher()
-      HashingAlgorithm.ARGON2 -> Argon2CredentialsHasher()
+      HashingAlgorithm.ARGON2 -> argon2Hasher()
       else ->
         throw IllegalArgumentException(
           "Hashing algorithm not supported: ${passwordsConfig.hashingAlgorithm}! Supported hashing algorithms: ${HashingAlgorithm.entries.joinToString(", ")}"
@@ -42,11 +42,19 @@ class CredentialsHasherFactory @Inject constructor(val passwordsConfig: Password
   fun createHasher(algo: HashingAlgorithm): CredentialsHasher {
     return when (algo) {
       HashingAlgorithm.BCRYPT -> BCryptCredentialsHasher()
-      HashingAlgorithm.ARGON2 -> Argon2CredentialsHasher()
+      HashingAlgorithm.ARGON2 -> argon2Hasher()
       HashingAlgorithm.SHA256,
       HashingAlgorithm.SHA512 -> SHACredentialsHasher()
       HashingAlgorithm.LIBRELOGIN_SHA256,
       HashingAlgorithm.LIBRELOGIN_SHA512 -> LibreLoginSHACredentialsHasher()
     }
   }
+
+  private fun argon2Hasher() =
+    Argon2CredentialsHasher(
+      hashLength = passwordsConfig.argon2.hashLength,
+      memoryKb = passwordsConfig.argon2.memoryKb,
+      iterations = passwordsConfig.argon2.iterations,
+      parallelism = passwordsConfig.argon2.parallelism,
+    )
 }
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/PasswordsConfig.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/PasswordsConfig.kt
index 63781c68..316d6a8e 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/PasswordsConfig.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/PasswordsConfig.kt
@@ -31,6 +31,25 @@ class PasswordsConfig : OkaeriConfig() {
   )
   var hashingAlgorithm: HashingAlgorithm = HashingAlgorithm.BCRYPT
 
+  @Comment(
+    "Argon2 settings — used only when hashingAlgorithm is set to ARGON2.",
+    "Leave these unchanged unless you know what you're doing.",
+    "Changing any of these properties can significantly increase CPU usage or reduce security.",
+    "Default Argon version: Argon2ID",
+    "Default salt bytes: 16",
+  )
+  var argon2: Argon2Config = Argon2Config()
+
+  class Argon2Config : OkaeriConfig() {
+    @Comment("Hash length in bytes", "default: 16") var hashLength: Int = 16
+
+    @Comment("Memory cost in KB", "default: 65536 = 64 MiB") var memoryKb: Int = 65536
+
+    @Comment("Time cost (iterations)", "default: 3") var iterations: Int = 3
+
+    @Comment("Parallelism (threads)", "default: 4") var parallelism: Int = 4
+  }
+
   @Comment("Minimum length") var minLength: Int = 5
 
   @Comment("Require uppercase letters?") var requireUppercase: Boolean = false
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/Argon2CredentialsHasher.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/Argon2CredentialsHasher.kt
index 2059725c..ad9e6839 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/Argon2CredentialsHasher.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/hasher/Argon2CredentialsHasher.kt
@@ -20,7 +20,6 @@ package pl.spcode.navauth.common.infra.crypto.hasher
 
 import java.nio.charset.StandardCharsets
 import java.security.MessageDigest
-import java.security.SecureRandom
 import org.bouncycastle.crypto.generators.Argon2BytesGenerator
 import org.bouncycastle.crypto.params.Argon2Parameters
 import pl.spcode.navauth.common.application.credentials.CredentialsHasher
@@ -29,15 +28,15 @@ import pl.spcode.navauth.common.infra.crypto.CryptoUtils
 import pl.spcode.navauth.common.infra.crypto.HashedPassword
 import pl.spcode.navauth.common.infra.crypto.PasswordHash
 
-class Argon2CredentialsHasher : CredentialsHasher {
+class Argon2CredentialsHasher(
+  private val hashLength: Int = 16,
+  private val memoryKb: Int = 65536,
+  private val iterations: Int = 3,
+  private val parallelism: Int = 4,
+) : CredentialsHasher {
 
   companion object {
-    private val random = SecureRandom()
-    private const val SALT_LENGTH = 16
-    private const val HASH_LENGTH = 16
-    private const val MEMORY_KB = 65536 // 64MiB
-    private const val ITERATIONS = 3
-    private const val PARALLELISM = 4
+    private const val SALT_LENGTH: Int = 16
   }
 
   override fun hash(password: String): HashedPassword {
@@ -45,16 +44,18 @@ class Argon2CredentialsHasher : CredentialsHasher {
     val params =
       Argon2Parameters.Builder(Argon2Parameters.ARGON2_id)
         .withSalt(salt)
-        .withIterations(ITERATIONS)
-        .withMemoryAsKB(MEMORY_KB)
-        .withParallelism(PARALLELISM)
+        .withIterations(iterations)
+        .withMemoryAsKB(memoryKb)
+        .withParallelism(parallelism)
         .build()
 
+    val version = params.version
+
     val generator = Argon2BytesGenerator()
     generator.init(params)
 
     val passwordBytes = password.toByteArray(StandardCharsets.UTF_8)
-    val hash = ByteArray(HASH_LENGTH)
+    val hash = ByteArray(hashLength)
     generator.generateBytes(passwordBytes, hash)
 
     val saltB64 = CryptoUtils.base64EncodeToString(salt)
@@ -63,10 +64,10 @@ class Argon2CredentialsHasher : CredentialsHasher {
     // PHC-style: $argon2id$v=19$m=65536,t=3,p=4$<salt_b64>$<hash_b64>
     val encoded = buildString {
       append($$"$argon2id")
-      append($$"$v=19")
-      append($$"$m=").append(MEMORY_KB)
-      append(",t=").append(ITERATIONS)
-      append(",p=").append(PARALLELISM)
+      append($$"$v=").append(version)
+      append($$"$m=").append(memoryKb)
+      append(",t=").append(iterations)
+      append(",p=").append(parallelism)
       append("$").append(saltB64)
       append("$").append(hashB64)
     }

From 713a98ec95dfc14b1170138f75611fe8ae50ff6a Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 20 Jun 2026 20:06:23 +0200
Subject: [PATCH 08/31] add more Argon2 tests

---
 .../crypto/Argon2CredentialsHasherTests.kt    | 46 ++++++++++++++++---
 1 file changed, 39 insertions(+), 7 deletions(-)

diff --git a/navauth-common/src/test/kotlin/unit/crypto/Argon2CredentialsHasherTests.kt b/navauth-common/src/test/kotlin/unit/crypto/Argon2CredentialsHasherTests.kt
index 62d08ad2..effeb6d6 100644
--- a/navauth-common/src/test/kotlin/unit/crypto/Argon2CredentialsHasherTests.kt
+++ b/navauth-common/src/test/kotlin/unit/crypto/Argon2CredentialsHasherTests.kt
@@ -23,26 +23,58 @@ import kotlin.test.assertFalse
 import kotlin.test.assertTrue
 import pl.spcode.navauth.common.infra.crypto.PasswordHash
 import pl.spcode.navauth.common.infra.crypto.hasher.Argon2CredentialsHasher
+import kotlin.test.assertEquals
 
 class Argon2CredentialsHasherTests {
 
-  private val hasher = Argon2CredentialsHasher()
+  @Test
+  fun `default hasher produces PHC with correct properties`() {
+    val hasher = Argon2CredentialsHasher()
+    val phc = hasher.hash("TestPassword123!").passwordHash.value
+
+    val parts = phc.split("$")
+    assertEquals(parts[1], "argon2id")
+    assertEquals(parts[2], "v=19")
+    assertEquals(parts[3], "m=65536,t=3,p=4")
+  }
 
   @Test
-  fun `hash and verify match`() {
+  fun `custom hasher produces PHC with matching properties`() {
+    val hasher = Argon2CredentialsHasher(hashLength = 32, memoryKb = 128, iterations = 5, parallelism = 2)
+    val phc = hasher.hash("TestPassword123!").passwordHash.value
+
+    val parts = phc.split("$")
+    assertEquals(parts[1], "argon2id")
+    assertEquals(parts[2], "v=19")
+    assertEquals(parts[3], "m=128,t=5,p=2")
+  }
+
+  @Test
+  fun `hash and verify round-trip with default hasher`() {
+    val hasher = Argon2CredentialsHasher()
     val password = "TestPassword123!"
 
     val hashed = hasher.hash(password)
 
-    val result = hasher.verify(password, hashed.passwordHash)
+    assertTrue(hasher.verify(password, hashed.passwordHash))
+    assertFalse(hasher.verify("wrongPassword", hashed.passwordHash))
+  }
+
+  @Test
+  fun `hash and verify round-trip with custom hasher`() {
+    val hasher = Argon2CredentialsHasher(hashLength = 32, memoryKb = 128, iterations = 5, parallelism = 2)
+    val password = "TestPassword123!"
+
+    val hashed = hasher.hash(password)
 
-    assertTrue(result)
+    assertTrue(hasher.verify(password, hashed.passwordHash))
+    assertFalse(hasher.verify("wrongPassword", hashed.passwordHash))
   }
 
   @Test
   fun `verify with manually crafted argon2id PHC works`() {
+    val hasher = Argon2CredentialsHasher()
     val phc = $$"$argon2id$v=19$m=65536,t=3,p=4$cz7sQK/RvBYgFpiBqQxM3w$6fo3usNp7CdtjYZxbfT0OA"
-
     val passwordHash = PasswordHash(phc)
 
     assertTrue(hasher.verify("TestPassword123!", passwordHash))
@@ -51,8 +83,8 @@ class Argon2CredentialsHasherTests {
 
   @Test
   fun `verify with manually crafted argon2i PHC works`() {
+    val hasher = Argon2CredentialsHasher()
     val phc = $$"$argon2i$v=19$m=16,t=2,p=1$VklGNXdOeU9KaDZrNkoybQ$Jx2+0wy31xNwJCHDNB19YQ"
-
     val passwordHash = PasswordHash(phc)
 
     assertTrue(hasher.verify("TestPassword123!", passwordHash))
@@ -61,8 +93,8 @@ class Argon2CredentialsHasherTests {
 
   @Test
   fun `verify with manually crafted argon2d PHC works`() {
+    val hasher = Argon2CredentialsHasher()
     val phc = $$"$argon2d$v=19$m=16,t=2,p=1$VklGNXdOeU9KaDZrNkoybQ$xWb4I3lKxryS2fVn11QgSQ"
-
     val passwordHash = PasswordHash(phc)
 
     assertTrue(hasher.verify("TestPassword123!", passwordHash))

From c3a5c38b620c0e5a2ed81f7d0ad150d8687c5389 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sun, 21 Jun 2026 00:18:59 +0200
Subject: [PATCH 09/31] add mojang profile API order (fallback), add minetools
 as preferred first API

---
 .../username/UsernameResolutionService.kt     |   7 +-
 .../application/mojang/ProfileService.kt      |  26 +++
 .../common/application/user/UserService.kt    |   4 +-
 .../navauth/common/config/GeneralConfig.kt    |   3 +
 .../navauth/common/config/MojangAPIConfig.kt  |  39 +++++
 .../common/domain/mojang/MojangProfile.kt     |   5 +
 .../infra/mojang/CompositeProfileService.kt   |  66 ++++++++
 .../infra/mojang/MineToolsProfileService.kt   |  56 +++++++
 .../mojang/MojangProfileServiceImpl.kt}       |  17 +-
 .../common/infra/mojang/ProfileCache.kt       |  46 ++++++
 .../navauth/common/module/GsonModule.kt       |  31 ++++
 .../navauth/common/module/ServicesModule.kt   |  12 +-
 .../service/MojangProfileServiceTests.kt      |   4 +-
 .../auth/UsernameResolutionServiceTests.kt    |   4 +-
 .../crypto/Argon2CredentialsHasherTests.kt    |   8 +-
 .../mojang/CompositeProfileServiceTest.kt     | 156 ++++++++++++++++++
 .../mojang/MineToolsProfileServiceTest.kt     |  97 +++++++++++
 .../mojang/MojangProfileServiceImplTest.kt    |  79 +++++++++
 .../kotlin/unit/mojang/ProfileCacheTest.kt    |  75 +++++++++
 .../navauth/velocity/NavAuthVelocity.kt       |   1 +
 .../command/admin/ForcePremiumAdminCommand.kt |   4 +-
 .../admin/MigrateUserDataAdminCommand.kt      |   4 +-
 .../command/user/PremiumAccountCommand.kt     |   4 +-
 23 files changed, 719 insertions(+), 29 deletions(-)
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/mojang/ProfileService.kt
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MojangAPIConfig.kt
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/CompositeProfileService.kt
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/MineToolsProfileService.kt
 rename navauth-common/src/main/kotlin/pl/spcode/navauth/common/{application/mojang/MojangProfileService.kt => infra/mojang/MojangProfileServiceImpl.kt} (78%)
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/ProfileCache.kt
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/GsonModule.kt
 create mode 100644 navauth-common/src/test/kotlin/unit/mojang/CompositeProfileServiceTest.kt
 create mode 100644 navauth-common/src/test/kotlin/unit/mojang/MineToolsProfileServiceTest.kt
 create mode 100644 navauth-common/src/test/kotlin/unit/mojang/MojangProfileServiceImplTest.kt
 create mode 100644 navauth-common/src/test/kotlin/unit/mojang/ProfileCacheTest.kt

diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/auth/username/UsernameResolutionService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/auth/username/UsernameResolutionService.kt
index 6d200dc9..6a0043e8 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/auth/username/UsernameResolutionService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/auth/username/UsernameResolutionService.kt
@@ -19,7 +19,7 @@
 package pl.spcode.navauth.common.application.auth.username
 
 import com.google.inject.Inject
-import pl.spcode.navauth.common.application.mojang.MojangProfileService
+import pl.spcode.navauth.common.application.mojang.ProfileService
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.application.user.UsernameAlreadyTakenException
 import pl.spcode.navauth.common.domain.auth.handshake.EncryptionType
@@ -28,10 +28,7 @@ import pl.spcode.navauth.common.domain.user.Username
 
 class UsernameResolutionService
 @Inject
-constructor(
-  private val userService: UserService,
-  private val profileService: MojangProfileService,
-) {
+constructor(private val userService: UserService, private val profileService: ProfileService) {
 
   fun resolveUsernameConflicts(
     connUsername: Username,
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/mojang/ProfileService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/mojang/ProfileService.kt
new file mode 100644
index 00000000..ad27cca4
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/mojang/ProfileService.kt
@@ -0,0 +1,26 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.application.mojang
+
+import pl.spcode.navauth.common.domain.mojang.MojangProfile
+import pl.spcode.navauth.common.domain.user.Username
+
+interface ProfileService {
+  fun fetchProfileInfo(usernameCaseIgnored: Username): MojangProfile?
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
index abd8e7e3..1b5d1f76 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
@@ -25,7 +25,7 @@ import pl.spcode.navauth.api.event.user.UserNonPremiumMigrationEvent
 import pl.spcode.navauth.api.event.user.UserPremiumMigrationEvent
 import pl.spcode.navauth.api.event.user.UserUsernameMigrationEvent
 import pl.spcode.navauth.common.application.credentials.UserCredentialsService
-import pl.spcode.navauth.common.application.mojang.MojangProfileService
+import pl.spcode.navauth.common.application.mojang.ProfileService
 import pl.spcode.navauth.common.domain.common.TransactionService
 import pl.spcode.navauth.common.domain.credentials.TOTPSecret
 import pl.spcode.navauth.common.domain.credentials.UserCredentials
@@ -43,7 +43,7 @@ class UserService
 constructor(
   val userRepository: UserRepository,
   val userCredentialsService: UserCredentialsService,
-  val profileService: MojangProfileService,
+  val profileService: ProfileService,
   val txService: TransactionService,
   val eventBus: NavAuthEventBus,
 ) {
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/GeneralConfig.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/GeneralConfig.kt
index 905bec7e..6336db34 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/GeneralConfig.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/GeneralConfig.kt
@@ -91,6 +91,9 @@ open class GeneralConfig : OkaeriConfig() {
   )
   var descriptiveInvalidSessionCacheTimeMs = 8000
 
+  @Comment("Mojang API and profile resolution config")
+  var mojangAPIConfig: MojangAPIConfig = MojangAPIConfig()
+
   var sessionsConfig = SessionsConfig()
 
   @Variable("CONFIG_VERSION")
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MojangAPIConfig.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MojangAPIConfig.kt
new file mode 100644
index 00000000..6ccbb71d
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MojangAPIConfig.kt
@@ -0,0 +1,39 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.config
+
+import eu.okaeri.configs.OkaeriConfig
+import eu.okaeri.configs.annotation.Comment
+import java.time.Duration
+import pl.spcode.navauth.common.domain.mojang.MojangProfileApi
+
+class MojangAPIConfig : OkaeriConfig() {
+
+  @Comment("How long to cache resolved Mojang profiles before re-fetching")
+  var profileCacheTTL: Duration = Duration.ofMinutes(5)
+
+  @Comment(
+    "Order of API providers to use when resolving a Mojang profile.",
+    "Available providers: MINETOOLS, MOJANG",
+    "The first provider in this list that returns a result will be used.",
+  )
+  var apiOrder: List<MojangProfileApi> = listOf(MojangProfileApi.MINETOOLS, MojangProfileApi.MOJANG)
+
+  @Comment("Timeout for each individual API call") var apiTimeout: Duration = Duration.ofSeconds(5)
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/mojang/MojangProfile.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/mojang/MojangProfile.kt
index 747f4726..93f23bbb 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/mojang/MojangProfile.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/mojang/MojangProfile.kt
@@ -22,3 +22,8 @@ import pl.spcode.navauth.common.domain.user.MojangId
 import pl.spcode.navauth.common.domain.user.Username
 
 data class MojangProfile(val uuid: MojangId, val name: Username)
+
+enum class MojangProfileApi {
+  MINETOOLS,
+  MOJANG,
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/CompositeProfileService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/CompositeProfileService.kt
new file mode 100644
index 00000000..fb224a52
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/CompositeProfileService.kt
@@ -0,0 +1,66 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.infra.mojang
+
+import com.google.inject.Inject
+import com.google.inject.Singleton
+import pl.spcode.navauth.common.application.mojang.ProfileService
+import pl.spcode.navauth.common.config.MojangAPIConfig
+import pl.spcode.navauth.common.domain.mojang.MojangProfile
+import pl.spcode.navauth.common.domain.mojang.MojangProfileApi
+import pl.spcode.navauth.common.domain.user.Username
+
+@Singleton
+class CompositeProfileService
+@Inject
+constructor(
+  private val config: MojangAPIConfig,
+  private val mojangProfileService: ProfileService,
+  private val mineToolsProfileService: MineToolsProfileService,
+  private val profileCache: ProfileCache,
+) : ProfileService {
+
+  override fun fetchProfileInfo(usernameCaseIgnored: Username): MojangProfile? {
+    profileCache.get(usernameCaseIgnored)?.let {
+      return it
+    }
+
+    var lastError: Exception? = null
+
+    for (api in config.apiOrder) {
+      try {
+        val profile =
+          when (api) {
+            MojangProfileApi.MINETOOLS ->
+              mineToolsProfileService.fetchProfileInfo(usernameCaseIgnored)
+            MojangProfileApi.MOJANG -> mojangProfileService.fetchProfileInfo(usernameCaseIgnored)
+          }
+        if (profile != null) {
+          profileCache.put(usernameCaseIgnored, profile)
+          return profile
+        }
+      } catch (e: Exception) {
+        lastError = e
+      }
+    }
+
+    if (lastError != null) throw lastError
+    return null
+  }
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/MineToolsProfileService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/MineToolsProfileService.kt
new file mode 100644
index 00000000..ed556fe5
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/MineToolsProfileService.kt
@@ -0,0 +1,56 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.infra.mojang
+
+import com.google.gson.Gson
+import com.google.inject.Inject
+import com.google.inject.Singleton
+import java.net.URI
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+import pl.spcode.navauth.common.application.mojang.ProfileService
+import pl.spcode.navauth.common.config.MojangAPIConfig
+import pl.spcode.navauth.common.domain.mojang.MojangProfile
+import pl.spcode.navauth.common.domain.user.MojangId
+import pl.spcode.navauth.common.domain.user.Username
+import pl.spcode.navauth.common.shared.utils.UuidUtils
+
+@Singleton
+class MineToolsProfileService
+@Inject
+constructor(val httpClient: HttpClient, val gson: Gson, val config: MojangAPIConfig) :
+  ProfileService {
+
+  private data class MineToolsProfileDto(val id: String?, val name: String?, val status: String?)
+
+  override fun fetchProfileInfo(usernameCaseIgnored: Username): MojangProfile? {
+    val requestUri = URI.create("https://api.minetools.eu/uuid/${usernameCaseIgnored.value}")
+    val request = HttpRequest.newBuilder(requestUri).timeout(config.apiTimeout).GET().build()
+    val response = httpClient.send(request, HttpResponse.BodyHandlers.ofString())
+
+    val dto = gson.fromJson(response.body(), MineToolsProfileDto::class.java)
+
+    if (dto.status != "OK" || dto.id == null || dto.name == null) {
+      return null
+    }
+
+    return MojangProfile(MojangId(UuidUtils.from32(dto.id)), Username(dto.name))
+  }
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/mojang/MojangProfileService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/MojangProfileServiceImpl.kt
similarity index 78%
rename from navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/mojang/MojangProfileService.kt
rename to navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/MojangProfileServiceImpl.kt
index 39ae6657..85ecfbf2 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/mojang/MojangProfileService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/MojangProfileServiceImpl.kt
@@ -1,6 +1,6 @@
 /*
  * NavAuth
- * Copyright © 2025 Oliwier Fijas (Navio1430)
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
  *
  * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
  * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
@@ -16,7 +16,7 @@
  *
  */
 
-package pl.spcode.navauth.common.application.mojang
+package pl.spcode.navauth.common.infra.mojang
 
 import com.google.gson.Gson
 import com.google.gson.annotations.SerializedName
@@ -26,6 +26,8 @@ import java.net.URI
 import java.net.http.HttpClient
 import java.net.http.HttpRequest
 import java.net.http.HttpResponse
+import pl.spcode.navauth.common.application.mojang.ProfileService
+import pl.spcode.navauth.common.config.MojangAPIConfig
 import pl.spcode.navauth.common.domain.mojang.MojangProfile
 import pl.spcode.navauth.common.domain.user.MojangId
 import pl.spcode.navauth.common.domain.user.Username
@@ -33,9 +35,10 @@ import pl.spcode.navauth.common.shared.http.HttpStatusCodes
 import pl.spcode.navauth.common.shared.utils.UuidUtils
 
 @Singleton
-class MojangProfileService @Inject constructor(val httpClient: HttpClient) {
-
-  val gson: Gson = Gson()
+class MojangProfileServiceImpl
+@Inject
+constructor(val httpClient: HttpClient, val gson: Gson, val config: MojangAPIConfig) :
+  ProfileService {
 
   data class MojangProfileDto(
     @SerializedName(value = "id") val uuidWithoutDashes: String,
@@ -47,12 +50,12 @@ class MojangProfileService @Inject constructor(val httpClient: HttpClient) {
     }
   }
 
-  fun fetchProfileInfo(usernameCaseIgnored: Username): MojangProfile? {
+  override fun fetchProfileInfo(usernameCaseIgnored: Username): MojangProfile? {
     val requestUri =
       URI.create(
         "https://api.minecraftservices.com/minecraft/profile/lookup/name/${usernameCaseIgnored.value}"
       )
-    val request = HttpRequest.newBuilder(requestUri).GET().build()
+    val request = HttpRequest.newBuilder(requestUri).timeout(config.apiTimeout).GET().build()
 
     val response = httpClient.send(request, HttpResponse.BodyHandlers.ofString())
 
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/ProfileCache.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/ProfileCache.kt
new file mode 100644
index 00000000..72665a10
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/ProfileCache.kt
@@ -0,0 +1,46 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.infra.mojang
+
+import com.google.common.cache.Cache
+import com.google.common.cache.CacheBuilder
+import com.google.inject.Inject
+import com.google.inject.Singleton
+import pl.spcode.navauth.common.config.MojangAPIConfig
+import pl.spcode.navauth.common.domain.mojang.MojangProfile
+import pl.spcode.navauth.common.domain.user.Username
+
+@Singleton
+class ProfileCache @Inject constructor(config: MojangAPIConfig) {
+
+  private val cache: Cache<String, MojangProfile> =
+    CacheBuilder.newBuilder().expireAfterWrite(config.profileCacheTTL).build()
+
+  fun get(username: Username): MojangProfile? {
+    return cache.getIfPresent(username.value)
+  }
+
+  fun put(username: Username, profile: MojangProfile) {
+    cache.put(username.value, profile)
+  }
+
+  fun invalidate(username: Username) {
+    cache.invalidate(username.value)
+  }
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/GsonModule.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/GsonModule.kt
new file mode 100644
index 00000000..df29843a
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/GsonModule.kt
@@ -0,0 +1,31 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.common.module
+
+import com.google.gson.Gson
+import com.google.inject.AbstractModule
+import com.google.inject.Provides
+
+class GsonModule : AbstractModule() {
+
+  @Provides
+  fun provideGson(): Gson {
+    return Gson()
+  }
+}
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/ServicesModule.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/ServicesModule.kt
index 2f9df827..df755370 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/ServicesModule.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/module/ServicesModule.kt
@@ -24,11 +24,15 @@ import pl.spcode.navauth.common.application.auth.session.AuthSessionService
 import pl.spcode.navauth.common.application.auth.username.UsernameResolutionService
 import pl.spcode.navauth.common.application.credentials.UserCredentialsService
 import pl.spcode.navauth.common.application.credentials.queue.EncryptionQueueService
-import pl.spcode.navauth.common.application.mojang.MojangProfileService
+import pl.spcode.navauth.common.application.mojang.ProfileService
 import pl.spcode.navauth.common.application.user.UserActivitySessionService
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.domain.common.TransactionService
 import pl.spcode.navauth.common.infra.crypto.queue.EncryptionQueueServiceImpl
+import pl.spcode.navauth.common.infra.mojang.CompositeProfileService
+import pl.spcode.navauth.common.infra.mojang.MineToolsProfileService
+import pl.spcode.navauth.common.infra.mojang.MojangProfileServiceImpl
+import pl.spcode.navauth.common.infra.mojang.ProfileCache
 import pl.spcode.navauth.common.infra.persistence.ormlite.TransactionServiceImpl
 
 class ServicesModule : AbstractModule() {
@@ -40,7 +44,11 @@ class ServicesModule : AbstractModule() {
 
     bind(UsernameResolutionService::class.java)
 
-    bind(MojangProfileService::class.java)
+    bind(ProfileCache::class.java)
+    bind(MojangProfileServiceImpl::class.java)
+    bind(MineToolsProfileService::class.java)
+    bind(ProfileService::class.java).to(CompositeProfileService::class.java)
+
     bind(AuthHandshakeSessionService::class.java)
 
     bind(UserCredentialsService::class.java)
diff --git a/navauth-common/src/test/kotlin/integration/service/MojangProfileServiceTests.kt b/navauth-common/src/test/kotlin/integration/service/MojangProfileServiceTests.kt
index cf2b556c..af1450e2 100644
--- a/navauth-common/src/test/kotlin/integration/service/MojangProfileServiceTests.kt
+++ b/navauth-common/src/test/kotlin/integration/service/MojangProfileServiceTests.kt
@@ -28,15 +28,15 @@ import kotlin.test.assertEquals
 import kotlin.test.assertNotNull
 import kotlin.test.assertNull
 import org.junit.jupiter.api.extension.ExtendWith
-import pl.spcode.navauth.common.application.mojang.MojangProfileService
 import pl.spcode.navauth.common.domain.user.MojangId
 import pl.spcode.navauth.common.domain.user.Username
+import pl.spcode.navauth.common.infra.mojang.MojangProfileServiceImpl
 import utils.generateRandomString
 
 @ExtendWith(ApplicationTestExtension::class)
 class MojangProfileServiceTests {
 
-  @Inject lateinit var mojangProfileService: MojangProfileService
+  @Inject lateinit var mojangProfileService: MojangProfileServiceImpl
 
   @Test
   fun `test mojang profile fetch`() {
diff --git a/navauth-common/src/test/kotlin/unit/auth/UsernameResolutionServiceTests.kt b/navauth-common/src/test/kotlin/unit/auth/UsernameResolutionServiceTests.kt
index 3afe8a80..b09c20e8 100644
--- a/navauth-common/src/test/kotlin/unit/auth/UsernameResolutionServiceTests.kt
+++ b/navauth-common/src/test/kotlin/unit/auth/UsernameResolutionServiceTests.kt
@@ -28,7 +28,6 @@ import pl.spcode.navauth.common.application.auth.username.PostUsernameResolution
 import pl.spcode.navauth.common.application.auth.username.UsernameResFailureReason
 import pl.spcode.navauth.common.application.auth.username.UsernameResResult
 import pl.spcode.navauth.common.application.auth.username.UsernameResolutionService
-import pl.spcode.navauth.common.application.mojang.MojangProfileService
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.domain.auth.handshake.EncryptionType
 import pl.spcode.navauth.common.domain.mojang.MojangProfile
@@ -36,13 +35,14 @@ import pl.spcode.navauth.common.domain.user.MojangId
 import pl.spcode.navauth.common.domain.user.User
 import pl.spcode.navauth.common.domain.user.UserUuid
 import pl.spcode.navauth.common.domain.user.Username
+import pl.spcode.navauth.common.infra.mojang.MojangProfileServiceImpl
 import utils.generateRandomString
 import utils.invertCase
 
 class UsernameResolutionServiceTests :
   FunSpec({
     lateinit var mockUserService: UserService
-    lateinit var mockProfileService: MojangProfileService
+    lateinit var mockProfileService: MojangProfileServiceImpl
     lateinit var service: UsernameResolutionService
 
     beforeTest {
diff --git a/navauth-common/src/test/kotlin/unit/crypto/Argon2CredentialsHasherTests.kt b/navauth-common/src/test/kotlin/unit/crypto/Argon2CredentialsHasherTests.kt
index effeb6d6..2b20e8cd 100644
--- a/navauth-common/src/test/kotlin/unit/crypto/Argon2CredentialsHasherTests.kt
+++ b/navauth-common/src/test/kotlin/unit/crypto/Argon2CredentialsHasherTests.kt
@@ -19,11 +19,11 @@
 package unit.crypto
 
 import kotlin.test.Test
+import kotlin.test.assertEquals
 import kotlin.test.assertFalse
 import kotlin.test.assertTrue
 import pl.spcode.navauth.common.infra.crypto.PasswordHash
 import pl.spcode.navauth.common.infra.crypto.hasher.Argon2CredentialsHasher
-import kotlin.test.assertEquals
 
 class Argon2CredentialsHasherTests {
 
@@ -40,7 +40,8 @@ class Argon2CredentialsHasherTests {
 
   @Test
   fun `custom hasher produces PHC with matching properties`() {
-    val hasher = Argon2CredentialsHasher(hashLength = 32, memoryKb = 128, iterations = 5, parallelism = 2)
+    val hasher =
+      Argon2CredentialsHasher(hashLength = 32, memoryKb = 128, iterations = 5, parallelism = 2)
     val phc = hasher.hash("TestPassword123!").passwordHash.value
 
     val parts = phc.split("$")
@@ -62,7 +63,8 @@ class Argon2CredentialsHasherTests {
 
   @Test
   fun `hash and verify round-trip with custom hasher`() {
-    val hasher = Argon2CredentialsHasher(hashLength = 32, memoryKb = 128, iterations = 5, parallelism = 2)
+    val hasher =
+      Argon2CredentialsHasher(hashLength = 32, memoryKb = 128, iterations = 5, parallelism = 2)
     val password = "TestPassword123!"
 
     val hashed = hasher.hash(password)
diff --git a/navauth-common/src/test/kotlin/unit/mojang/CompositeProfileServiceTest.kt b/navauth-common/src/test/kotlin/unit/mojang/CompositeProfileServiceTest.kt
new file mode 100644
index 00000000..e98daf92
--- /dev/null
+++ b/navauth-common/src/test/kotlin/unit/mojang/CompositeProfileServiceTest.kt
@@ -0,0 +1,156 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package unit.mojang
+
+import io.kotest.assertions.throwables.shouldThrow
+import io.kotest.core.spec.style.FunSpec
+import io.kotest.matchers.nulls.shouldBeNull
+import io.kotest.matchers.shouldBe
+import io.mockk.every
+import io.mockk.just
+import io.mockk.mockk
+import io.mockk.runs
+import java.util.UUID
+import pl.spcode.navauth.common.config.MojangAPIConfig
+import pl.spcode.navauth.common.domain.mojang.MojangProfile
+import pl.spcode.navauth.common.domain.mojang.MojangProfileApi
+import pl.spcode.navauth.common.domain.user.MojangId
+import pl.spcode.navauth.common.domain.user.Username
+import pl.spcode.navauth.common.infra.mojang.CompositeProfileService
+import pl.spcode.navauth.common.infra.mojang.MineToolsProfileService
+import pl.spcode.navauth.common.infra.mojang.MojangProfileServiceImpl
+import pl.spcode.navauth.common.infra.mojang.ProfileCache
+
+class CompositeProfileServiceTest :
+  FunSpec({
+    lateinit var config: MojangAPIConfig
+    lateinit var mineTools: MineToolsProfileService
+    lateinit var mojang: MojangProfileServiceImpl
+    lateinit var cache: ProfileCache
+    lateinit var service: CompositeProfileService
+
+    val username = Username("test")
+    val minetoolsProfile = MojangProfile(MojangId(UUID.randomUUID()), Username("MinetoolsPlayer"))
+    val mojangProfile = MojangProfile(MojangId(UUID.randomUUID()), Username("MojangPlayer"))
+
+    beforeTest {
+      config = MojangAPIConfig()
+      mineTools = mockk()
+      mojang = mockk()
+      cache = mockk()
+      every { cache.put(any(), any()) } just runs
+      service = CompositeProfileService(config, mojang, mineTools, cache)
+    }
+
+    test("returns cached profile without calling APIs") {
+      every { cache.get(username) } returns minetoolsProfile
+
+      val result = service.fetchProfileInfo(username)
+
+      result shouldBe minetoolsProfile
+    }
+
+    test("queries minetools first (default order) and returns its result") {
+      every { cache.get(username) } returns null
+      every { mineTools.fetchProfileInfo(username) } returns minetoolsProfile
+
+      val result = service.fetchProfileInfo(username)
+
+      result shouldBe minetoolsProfile
+    }
+
+    test("falls back to mojang when minetools returns null") {
+      every { cache.get(username) } returns null
+      every { mineTools.fetchProfileInfo(username) } returns null
+      every { mojang.fetchProfileInfo(username) } returns mojangProfile
+
+      val result = service.fetchProfileInfo(username)
+
+      result shouldBe mojangProfile
+    }
+
+    test("falls back to mojang when minetools throws") {
+      every { cache.get(username) } returns null
+      every { mineTools.fetchProfileInfo(username) } throws RuntimeException("minetools error")
+      every { mojang.fetchProfileInfo(username) } returns mojangProfile
+
+      val result = service.fetchProfileInfo(username)
+
+      result shouldBe mojangProfile
+    }
+
+    test("returns null when all APIs return null") {
+      every { cache.get(username) } returns null
+      every { mineTools.fetchProfileInfo(username) } returns null
+      every { mojang.fetchProfileInfo(username) } returns null
+
+      val result = service.fetchProfileInfo(username)
+
+      result.shouldBeNull()
+    }
+
+    test("throws when all APIs throw") {
+      every { cache.get(username) } returns null
+      every { mineTools.fetchProfileInfo(username) } throws RuntimeException("minetools error")
+      every { mojang.fetchProfileInfo(username) } throws RuntimeException("mojang error")
+
+      shouldThrow<RuntimeException> { service.fetchProfileInfo(username) }
+    }
+
+    test("returns minetools result and caches it") {
+      every { cache.get(username) } returns null
+      every { mineTools.fetchProfileInfo(username) } returns minetoolsProfile
+      every { cache.put(username, minetoolsProfile) } returns Unit
+
+      val result = service.fetchProfileInfo(username)
+
+      result shouldBe minetoolsProfile
+    }
+
+    test("falls back when minetools throws, returns mojang result and caches it") {
+      every { cache.get(username) } returns null
+      every { mineTools.fetchProfileInfo(username) } throws RuntimeException("minetools error")
+      every { mojang.fetchProfileInfo(username) } returns mojangProfile
+      every { cache.put(username, mojangProfile) } returns Unit
+
+      val result = service.fetchProfileInfo(username)
+
+      result shouldBe mojangProfile
+    }
+
+    test("uses configured order: MOJANG first then MINETOOLS") {
+      config.apiOrder = listOf(MojangProfileApi.MOJANG, MojangProfileApi.MINETOOLS)
+      every { cache.get(username) } returns null
+      every { mojang.fetchProfileInfo(username) } returns mojangProfile
+
+      val result = service.fetchProfileInfo(username)
+
+      result shouldBe mojangProfile
+    }
+
+    test("returns first result from configured order with single API") {
+      config.apiOrder = listOf(MojangProfileApi.MOJANG)
+      every { cache.get(username) } returns null
+      every { mojang.fetchProfileInfo(username) } returns mojangProfile
+
+      val result = service.fetchProfileInfo(username)
+
+      result shouldBe mojangProfile
+    }
+  })
diff --git a/navauth-common/src/test/kotlin/unit/mojang/MineToolsProfileServiceTest.kt b/navauth-common/src/test/kotlin/unit/mojang/MineToolsProfileServiceTest.kt
new file mode 100644
index 00000000..354bf170
--- /dev/null
+++ b/navauth-common/src/test/kotlin/unit/mojang/MineToolsProfileServiceTest.kt
@@ -0,0 +1,97 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package unit.mojang
+
+import com.google.gson.Gson
+import io.kotest.assertions.throwables.shouldThrow
+import io.kotest.core.spec.style.FunSpec
+import io.kotest.matchers.nulls.shouldBeNull
+import io.kotest.matchers.nulls.shouldNotBeNull
+import io.kotest.matchers.shouldBe
+import io.mockk.every
+import io.mockk.mockk
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+import java.net.http.HttpResponse.BodyHandler
+import java.util.UUID
+import pl.spcode.navauth.common.config.MojangAPIConfig
+import pl.spcode.navauth.common.domain.user.MojangId
+import pl.spcode.navauth.common.domain.user.Username
+import pl.spcode.navauth.common.infra.mojang.MineToolsProfileService
+
+class MineToolsProfileServiceTest :
+  FunSpec({
+    lateinit var httpClient: HttpClient
+    lateinit var response: HttpResponse<String>
+    lateinit var service: MineToolsProfileService
+
+    beforeTest {
+      httpClient = mockk()
+      response = mockk()
+      service = MineToolsProfileService(httpClient, Gson(), MojangAPIConfig())
+    }
+
+    test("returns profile on successful response with status OK") {
+      every { response.body() } returns
+        """{"id":"853c80ef3c3749fdaa49938b674adae6","name":"Notch","status":"OK"}"""
+      every { httpClient.send(any<HttpRequest>(), any<BodyHandler<String>>()) } returns response
+
+      val profile = service.fetchProfileInfo(Username("notch"))
+
+      profile.shouldNotBeNull()
+      profile!!.uuid shouldBe MojangId(UUID.fromString("853c80ef-3c37-49fd-aa49-938b674adae6"))
+      profile.name shouldBe Username("Notch")
+    }
+
+    test("returns null when status is ERR") {
+      every { response.body() } returns """{"status":"ERR"}"""
+      every { httpClient.send(any<HttpRequest>(), any<BodyHandler<String>>()) } returns response
+
+      val profile = service.fetchProfileInfo(Username("nonexistent"))
+
+      profile.shouldBeNull()
+    }
+
+    test("returns null when status is OK but id is null") {
+      every { response.body() } returns """{"id":null,"name":"test","status":"OK"}"""
+      every { httpClient.send(any<HttpRequest>(), any<BodyHandler<String>>()) } returns response
+
+      val profile = service.fetchProfileInfo(Username("test"))
+
+      profile.shouldBeNull()
+    }
+
+    test("returns null when status is OK but name is null") {
+      every { response.body() } returns
+        """{"id":"853c80ef3c3749fdaa49938b674adae6","name":null,"status":"OK"}"""
+      every { httpClient.send(any<HttpRequest>(), any<BodyHandler<String>>()) } returns response
+
+      val profile = service.fetchProfileInfo(Username("test"))
+
+      profile.shouldBeNull()
+    }
+
+    test("throws on network error") {
+      every { httpClient.send(any<HttpRequest>(), any<BodyHandler<String>>()) } throws
+        RuntimeException("timeout")
+
+      shouldThrow<RuntimeException> { service.fetchProfileInfo(Username("notch")) }
+    }
+  })
diff --git a/navauth-common/src/test/kotlin/unit/mojang/MojangProfileServiceImplTest.kt b/navauth-common/src/test/kotlin/unit/mojang/MojangProfileServiceImplTest.kt
new file mode 100644
index 00000000..34f44cd6
--- /dev/null
+++ b/navauth-common/src/test/kotlin/unit/mojang/MojangProfileServiceImplTest.kt
@@ -0,0 +1,79 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package unit.mojang
+
+import com.google.gson.Gson
+import io.kotest.assertions.throwables.shouldThrow
+import io.kotest.core.spec.style.FunSpec
+import io.kotest.matchers.nulls.shouldBeNull
+import io.kotest.matchers.nulls.shouldNotBeNull
+import io.kotest.matchers.shouldBe
+import io.mockk.every
+import io.mockk.mockk
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+import java.net.http.HttpResponse.BodyHandler
+import java.util.UUID
+import pl.spcode.navauth.common.config.MojangAPIConfig
+import pl.spcode.navauth.common.domain.user.MojangId
+import pl.spcode.navauth.common.domain.user.Username
+import pl.spcode.navauth.common.infra.mojang.MojangProfileServiceImpl
+
+class MojangProfileServiceImplTest :
+  FunSpec({
+    lateinit var httpClient: HttpClient
+    lateinit var response: HttpResponse<String>
+    lateinit var service: MojangProfileServiceImpl
+
+    beforeTest {
+      httpClient = mockk()
+      response = mockk()
+      service = MojangProfileServiceImpl(httpClient, Gson(), MojangAPIConfig())
+    }
+
+    test("returns profile on successful response") {
+      every { response.statusCode() } returns 200
+      every { response.body() } returns
+        """{"id":"853c80ef3c3749fdaa49938b674adae6","name":"Notch"}"""
+      every { httpClient.send(any<HttpRequest>(), any<BodyHandler<String>>()) } returns response
+
+      val profile = service.fetchProfileInfo(Username("notch"))
+
+      profile.shouldNotBeNull()
+      profile!!.uuid shouldBe MojangId(UUID.fromString("853c80ef-3c37-49fd-aa49-938b674adae6"))
+      profile.name shouldBe Username("Notch")
+    }
+
+    test("returns null on 404") {
+      every { response.statusCode() } returns 404
+      every { httpClient.send(any<HttpRequest>(), any<BodyHandler<String>>()) } returns response
+
+      val profile = service.fetchProfileInfo(Username("nonexistent"))
+
+      profile.shouldBeNull()
+    }
+
+    test("throws on network error") {
+      every { httpClient.send(any<HttpRequest>(), any<BodyHandler<String>>()) } throws
+        RuntimeException("connection refused")
+
+      shouldThrow<RuntimeException> { service.fetchProfileInfo(Username("notch")) }
+    }
+  })
diff --git a/navauth-common/src/test/kotlin/unit/mojang/ProfileCacheTest.kt b/navauth-common/src/test/kotlin/unit/mojang/ProfileCacheTest.kt
new file mode 100644
index 00000000..74f96d22
--- /dev/null
+++ b/navauth-common/src/test/kotlin/unit/mojang/ProfileCacheTest.kt
@@ -0,0 +1,75 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package unit.mojang
+
+import io.kotest.core.spec.style.FunSpec
+import io.kotest.matchers.nulls.shouldBeNull
+import io.kotest.matchers.shouldBe
+import java.util.UUID
+import pl.spcode.navauth.common.config.MojangAPIConfig
+import pl.spcode.navauth.common.domain.mojang.MojangProfile
+import pl.spcode.navauth.common.domain.user.MojangId
+import pl.spcode.navauth.common.domain.user.Username
+import pl.spcode.navauth.common.infra.mojang.ProfileCache
+
+class ProfileCacheTest :
+  FunSpec({
+    lateinit var cache: ProfileCache
+    val username = Username("test")
+    val profile = MojangProfile(MojangId(UUID.randomUUID()), username)
+
+    beforeTest { cache = ProfileCache(MojangAPIConfig()) }
+
+    test("get returns null for uncached username") { cache.get(username).shouldBeNull() }
+
+    test("get returns profile after put") {
+      cache.put(username, profile)
+      cache.get(username) shouldBe profile
+    }
+
+    test("put overwrites existing entry") {
+      val newProfile = MojangProfile(MojangId(UUID.randomUUID()), username)
+      cache.put(username, profile)
+      cache.put(username, newProfile)
+      cache.get(username) shouldBe newProfile
+    }
+
+    test("invalidate removes entry") {
+      cache.put(username, profile)
+      cache.invalidate(username)
+      cache.get(username).shouldBeNull()
+    }
+
+    test("invalidate does not throw for missing key") { cache.invalidate(Username("nonexistent")) }
+
+    test("get returns null for different usernames") {
+      val other = Username("other")
+      cache.put(username, profile)
+      cache.get(other).shouldBeNull()
+    }
+
+    test("get returns cached entry when TTL has not expired") {
+      val config = MojangAPIConfig()
+      config.profileCacheTTL = java.time.Duration.ofHours(1)
+      val longTtlCache = ProfileCache(config)
+
+      longTtlCache.put(username, profile)
+      longTtlCache.get(username) shouldBe profile
+    }
+  })
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt
index f6817eb2..7b45b6b0 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt
@@ -106,6 +106,7 @@ constructor(
           VelocityMultificationsModule(velocityViewerProvider),
           VelocityCommandsModule(),
           SchedulerModule(this, proxyServer.scheduler),
+          GsonModule(),
           HttpClientModule(),
           DataPersistenceModule(),
           ServicesModule(),
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForcePremiumAdminCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForcePremiumAdminCommand.kt
index 9edb9973..f0865f25 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForcePremiumAdminCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForcePremiumAdminCommand.kt
@@ -27,7 +27,7 @@ import dev.rollczi.litecommands.annotations.context.Context
 import dev.rollczi.litecommands.annotations.execute.Execute
 import dev.rollczi.litecommands.annotations.permission.Permission
 import pl.spcode.navauth.common.annotation.Description
-import pl.spcode.navauth.common.application.mojang.MojangProfileService
+import pl.spcode.navauth.common.application.mojang.ProfileService
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.command.user.UserArgumentResolver
 import pl.spcode.navauth.common.command.user.UsernameOrUuidRaw
@@ -40,7 +40,7 @@ class ForcePremiumAdminCommand
 @Inject
 constructor(
   val userService: UserService,
-  val profileService: MojangProfileService,
+  val profileService: ProfileService,
   val userArgumentResolver: UserArgumentResolver,
   val multification: VelocityMultification,
 ) {
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/MigrateUserDataAdminCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/MigrateUserDataAdminCommand.kt
index ef0ab454..6e9f1de8 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/MigrateUserDataAdminCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/MigrateUserDataAdminCommand.kt
@@ -28,7 +28,7 @@ import dev.rollczi.litecommands.annotations.context.Context
 import dev.rollczi.litecommands.annotations.execute.Execute
 import dev.rollczi.litecommands.annotations.permission.Permission
 import pl.spcode.navauth.common.annotation.Description
-import pl.spcode.navauth.common.application.mojang.MojangProfileService
+import pl.spcode.navauth.common.application.mojang.ProfileService
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.application.user.UsernameAlreadyTakenException
 import pl.spcode.navauth.common.application.validator.UsernameValidator
@@ -45,7 +45,7 @@ class MigrateUserDataAdminCommand
 constructor(
   val proxyServer: ProxyServer,
   val userService: UserService,
-  val profileService: MojangProfileService,
+  val profileService: ProfileService,
   val userArgumentResolver: UserArgumentResolver,
   val usernameValidator: UsernameValidator,
   val multification: VelocityMultification,
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/PremiumAccountCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/PremiumAccountCommand.kt
index 46edf00b..581ee9ef 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/PremiumAccountCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/PremiumAccountCommand.kt
@@ -26,7 +26,7 @@ import dev.rollczi.litecommands.annotations.command.Command
 import dev.rollczi.litecommands.annotations.context.Context
 import dev.rollczi.litecommands.annotations.execute.Execute
 import pl.spcode.navauth.common.annotation.Description
-import pl.spcode.navauth.common.application.mojang.MojangProfileService
+import pl.spcode.navauth.common.application.mojang.ProfileService
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.command.exception.MissingPermissionException
 import pl.spcode.navauth.common.domain.user.Username
@@ -39,7 +39,7 @@ class PremiumAccountCommand
 @Inject
 constructor(
   val userService: UserService,
-  val mojangProfileService: MojangProfileService,
+  val mojangProfileService: ProfileService,
   val multification: VelocityMultification,
 ) {
 

From 13b09094238e9f9b8d1de73f72029fbea87efebc Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sun, 21 Jun 2026 00:24:59 +0200
Subject: [PATCH 10/31] update changelog

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ea0b587..316797c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,8 @@
 ```diff
 + Encryption queue (backpressure especially for Argon2 and BCrypt hashing methods which can lead to OOM killer)
 + Argon2 configuration settings
++ Mojang profile API order (API fallback)
++ MineTools profile API support (preferred one by default)
 ```
 
 ### Fixes
@@ -14,6 +16,8 @@
 **General** config:
 ```diff
 + encryptionQueueConfig
++ mojangAPIConfig
++ Argon2 settings
 ```
 
 **Messages** config:

From 1b343da71d836137c494b741625276c88533e06c Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sun, 21 Jun 2026 01:13:59 +0200
Subject: [PATCH 11/31] fix: bind subconfigs recursively in TestsConfigModule

---
 .../test/kotlin/module/TestsConfigModule.kt   | 24 ++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/navauth-common/src/test/kotlin/module/TestsConfigModule.kt b/navauth-common/src/test/kotlin/module/TestsConfigModule.kt
index 8c3ec367..fa0cf94a 100644
--- a/navauth-common/src/test/kotlin/module/TestsConfigModule.kt
+++ b/navauth-common/src/test/kotlin/module/TestsConfigModule.kt
@@ -20,6 +20,7 @@ package module
 
 import com.google.inject.AbstractModule
 import config.TestConfig
+import eu.okaeri.configs.OkaeriConfig
 import kotlin.io.path.Path
 import pl.spcode.navauth.common.config.GeneralConfig
 import pl.spcode.navauth.common.module.PluginDirectoryModule
@@ -27,8 +28,29 @@ import pl.spcode.navauth.common.module.PluginDirectoryModule
 class TestsConfigModule : AbstractModule() {
 
   override fun configure() {
-    bind(GeneralConfig::class.java).toInstance(TestConfig())
+    val testConfig = TestConfig()
+
+    bind(GeneralConfig::class.java).toInstance(testConfig)
+    bindSubconfigsRecursively(testConfig)
 
     install(PluginDirectoryModule(Path("")))
   }
+
+  private fun bindSubconfigsRecursively(parentConfig: Any) {
+    val fields = mutableListOf<java.lang.reflect.Field>()
+    var clazz: Class<*>? = parentConfig.javaClass
+    while (clazz != null && clazz != Any::class.java) {
+      clazz.declaredFields.forEach { fields.add(it) }
+      clazz = clazz.superclass
+    }
+
+    fields.forEach { field ->
+      field.isAccessible = true
+      val value = field.get(parentConfig)
+      if (value is OkaeriConfig && value != parentConfig) {
+        @Suppress("UNCHECKED_CAST") bind(field.type as Class<OkaeriConfig>).toInstance(value)
+        bindSubconfigsRecursively(value)
+      }
+    }
+  }
 }

From 25dd31bd20898fe0f5f0d9a4f5c95d7ebac7d425 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Fri, 26 Jun 2026 04:39:01 +0200
Subject: [PATCH 12/31] integrate password hashing with encryption queue;
 improve queue with cancellation callback

---
 CHANGELOG.md                                  |   1 +
 .../credentials/UserCredentialsService.kt     |  66 +++--
 .../queue/EncryptionQueueService.kt           |   7 +-
 .../credentials/queue/EncryptionTask.kt       |  11 +-
 .../navauth/common/config/MessagesConfig.kt   |   1 +
 .../queue/EncryptionQueueServiceImpl.kt       |  41 ++--
 .../unit/queue/EncryptionQueueServiceTests.kt | 227 ++++++++++++++++++
 .../command/admin/ForceCrackedAdminCommand.kt |  35 +--
 .../velocity/command/user/RegisterCommand.kt  |  23 +-
 9 files changed, 358 insertions(+), 54 deletions(-)
 create mode 100644 navauth-common/src/test/kotlin/unit/queue/EncryptionQueueServiceTests.kt

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 316797c2..f23b4533 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,4 +25,5 @@
 + unexpectedErrorOccurred
 + processAlreadyInProgressError
 + alreadyTryingToLoginError
++ registeringInfo
 ```
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt
index 10d14adb..a1632650 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/UserCredentialsService.kt
@@ -21,6 +21,7 @@ package pl.spcode.navauth.common.application.credentials
 import com.google.inject.Inject
 import com.google.inject.Singleton
 import java.util.UUID
+import java.util.concurrent.CancellationException
 import java.util.concurrent.CompletableFuture
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
@@ -97,23 +98,58 @@ constructor(
     val hasher = credentialsHasherFactory.createHasher(credentials.hashedPassword.algo)
 
     val future = CompletableFuture<Boolean>()
-    encryptionQueueService.submitTask(playerId) {
-      try {
-        val result = hasher.verify(password, passwordHash)
-        future.complete(result)
-      } catch (ex: Exception) {
-        logger.error(
-          "Unexpected error occurred while trying to verify user id='${playerId}' password",
-          ex,
+    encryptionQueueService.submitTask(
+      playerId = playerId,
+      operation = {
+        try {
+          val result = hasher.verify(password, passwordHash)
+          future.complete(result)
+        } catch (ex: Exception) {
+          logger.error(
+            "Unexpected error occurred while trying to verify user id='${playerId}' password",
+            ex,
+          )
+          future.completeExceptionally(ex)
+        }
+      },
+      onCancelled = {
+        future.completeExceptionally(
+          CancellationException("Password verification task was cancelled")
         )
-        future.completeExceptionally(ex)
-      }
-    }
+      },
+    )
     return future
   }
 
-  fun hashPassword(password: String): HashedPassword {
-    return credentialsHasherFactory.createDefaultHasher().hash(password)
+  /**
+   * @param password the raw (not hashed) password
+   * @param playerId the id of the player for queue tracking
+   * @throws
+   *   pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
+   *   if task is already queued
+   */
+  fun enqueueHashPassword(password: String, playerId: UUID): CompletableFuture<HashedPassword> {
+    val hasher = credentialsHasherFactory.createDefaultHasher()
+    val future = CompletableFuture<HashedPassword>()
+    encryptionQueueService.submitTask(
+      playerId = playerId,
+      operation = {
+        try {
+          val result = hasher.hash(password)
+          future.complete(result)
+        } catch (ex: Exception) {
+          logger.error(
+            "Unexpected error occurred while trying to hash password for player id='${playerId}'",
+            ex,
+          )
+          future.completeExceptionally(ex)
+        }
+      },
+      onCancelled = {
+        future.completeExceptionally(CancellationException("Password hash task was cancelled"))
+      },
+    )
+    return future
   }
 
   fun verifyCode(credentials: UserCredentials, code: String): Boolean {
@@ -129,12 +165,12 @@ constructor(
    * @param newPassword the new raw password to be hashed and stored
    */
   fun updatePassword(user: User, newPassword: String) {
+    val hashedPassword = enqueueHashPassword(newPassword, user.uuid.value).join()
+
     transactionService.inTransaction {
       val credentials = findCredentials(user)
       require(credentials != null) { "user does not have credentials" }
 
-      val hasher = credentialsHasherFactory.createDefaultHasher()
-      val hashedPassword = hasher.hash(newPassword)
       val newCredentials = credentials.withNewPassword(hashedPassword)
       storeUserCredentials(user, newCredentials)
     }
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionQueueService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionQueueService.kt
index f88c4466..a6c2d906 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionQueueService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionQueueService.kt
@@ -22,8 +22,11 @@ import java.util.UUID
 
 interface EncryptionQueueService {
 
-  /** @throws EncryptionTaskAlreadyQueuedException if player has existing task queued */
-  fun submitTask(playerId: UUID, operation: () -> Unit)
+  /**
+   * @param onCancelled called when the task is dequeued before execution
+   * @throws EncryptionTaskAlreadyQueuedException if player has existing task queued
+   */
+  fun submitTask(playerId: UUID, operation: () -> Unit, onCancelled: () -> Unit)
 
   fun dequeueTask(playerId: UUID): Boolean
 
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTask.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTask.kt
index 1c1b21bf..9e65a717 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTask.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/credentials/queue/EncryptionTask.kt
@@ -20,12 +20,19 @@ package pl.spcode.navauth.common.application.credentials.queue
 
 import java.util.UUID
 
-class EncryptionTask(val playerId: UUID?, private val operation: () -> Unit) : Runnable {
+class EncryptionTask(
+  val playerId: UUID?,
+  private val operation: () -> Unit,
+  val onCancelled: () -> Unit,
+) : Runnable {
 
   @Volatile var cancelled = false
 
   override fun run() {
-    if (cancelled) return
+    if (cancelled) {
+      onCancelled.invoke()
+      return
+    }
 
     operation()
   }
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
index 56937c0f..15dc179c 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
@@ -131,6 +131,7 @@ open class MessagesConfig : OkaeriConfig() {
 
     var registerInstruction: Notice =
       Notice.chat("<green>Please register using /register command.</green>")
+    var registeringInfo: Notice = Notice.chat("<yellow>Registering, please wait...</yellow>")
 
     var loginSuccess: Notice =
       Notice.chat("<green>You have been authenticated successfully.</green>")
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/queue/EncryptionQueueServiceImpl.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/queue/EncryptionQueueServiceImpl.kt
index 6962fce5..75992055 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/queue/EncryptionQueueServiceImpl.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/crypto/queue/EncryptionQueueServiceImpl.kt
@@ -51,12 +51,12 @@ class EncryptionQueueServiceImpl @Inject constructor(private val config: Encrypt
       TimeUnit.SECONDS,
       workQueue,
       Executors.defaultThreadFactory(),
-    ) { task, _ ->
-      task as EncryptionTask
+    ) { runnable, _ ->
+      val runner = runnable as EncryptionTaskRunner
       try {
-        workQueue.put(task)
+        workQueue.put(runner)
       } catch (e: InterruptedException) {
-        activeTasks.remove(task.playerId)
+        activeTasks.remove(runner.task.playerId)
         Thread.currentThread().interrupt()
         throw RejectedExecutionException("Interrupted while waiting for queue slot", e)
       }
@@ -67,21 +67,15 @@ class EncryptionQueueServiceImpl @Inject constructor(private val config: Encrypt
   }
 
   /** @throws EncryptionTaskAlreadyQueuedException if task is already queued */
-  override fun submitTask(playerId: UUID, operation: () -> Unit) {
-    val task = EncryptionTask(playerId, operation)
+  override fun submitTask(playerId: UUID, operation: () -> Unit, onCancelled: () -> Unit) {
+    val task = EncryptionTask(playerId, operation, onCancelled)
 
     if (activeTasks.containsKey(playerId)) {
       throw EncryptionTaskAlreadyQueuedException()
     }
     activeTasks[playerId] = task
 
-    executor.execute {
-      val result = runCatching { task.run() }
-      if (result.isFailure) {
-        logger.warn("Player id='${playerId}' EncryptionTask failed", result.exceptionOrNull())
-      }
-      activeTasks.remove(playerId)
-    }
+    executor.execute(EncryptionTaskRunner(playerId, task, activeTasks, logger))
   }
 
   override fun isTaskQueued(playerId: UUID): Boolean {
@@ -89,14 +83,33 @@ class EncryptionQueueServiceImpl @Inject constructor(private val config: Encrypt
   }
 
   override fun dequeueTask(playerId: UUID): Boolean {
-    workQueue.removeIf { it is EncryptionTask && it.playerId == playerId }
+    val cancelledFromQueue =
+      workQueue.removeIf { it is EncryptionTaskRunner && it.playerId == playerId }
 
     val task = activeTasks.remove(playerId)
     if (task != null) {
       task.cancelled = true
+      if (cancelledFromQueue) {
+        task.onCancelled.invoke()
+      }
       return true
     }
 
     return false
   }
+
+  private class EncryptionTaskRunner(
+    val playerId: UUID,
+    val task: EncryptionTask,
+    private val activeTasks: ConcurrentHashMap<UUID, EncryptionTask>,
+    private val logger: Logger,
+  ) : Runnable {
+    override fun run() {
+      val result = runCatching { task.run() }
+      if (result.isFailure) {
+        logger.warn("Player id='${playerId}' EncryptionTask failed", result.exceptionOrNull())
+      }
+      activeTasks.remove(playerId)
+    }
+  }
 }
diff --git a/navauth-common/src/test/kotlin/unit/queue/EncryptionQueueServiceTests.kt b/navauth-common/src/test/kotlin/unit/queue/EncryptionQueueServiceTests.kt
new file mode 100644
index 00000000..dd797495
--- /dev/null
+++ b/navauth-common/src/test/kotlin/unit/queue/EncryptionQueueServiceTests.kt
@@ -0,0 +1,227 @@
+package unit.queue
+
+import io.kotest.assertions.throwables.shouldThrow
+import io.kotest.core.spec.style.FunSpec
+import io.kotest.matchers.shouldBe
+import io.mockk.mockk
+import io.mockk.verify
+import java.util.UUID
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
+import pl.spcode.navauth.common.config.EncryptionQueueConfig
+import pl.spcode.navauth.common.infra.crypto.queue.EncryptionQueueServiceImpl
+
+class EncryptionQueueServiceTests :
+  FunSpec({
+    val config =
+      EncryptionQueueConfig().apply {
+        encryptionQueueMinThreads = 2
+        encryptionQueueMaxThreads = 4
+      }
+
+    fun createService(): EncryptionQueueServiceImpl = EncryptionQueueServiceImpl(config)
+
+    test("submitTask executes the operation") {
+      val service = createService()
+      val playerId = UUID.randomUUID()
+      var executed = false
+      val latch = CountDownLatch(1)
+
+      service.submitTask(
+        playerId = playerId,
+        operation = {
+          executed = true
+          latch.countDown()
+        },
+        onCancelled = mockk(relaxed = true),
+      )
+
+      latch.await(5, TimeUnit.SECONDS) shouldBe true
+      executed shouldBe true
+    }
+
+    test("submitTask throws EncryptionTaskAlreadyQueuedException for duplicate playerId") {
+      val service = createService()
+      val playerId = UUID.randomUUID()
+      val blocker = CountDownLatch(1)
+
+      service.submitTask(
+        playerId = playerId,
+        operation = { blocker.await() },
+        onCancelled = mockk(relaxed = true),
+      )
+
+      shouldThrow<EncryptionTaskAlreadyQueuedException> {
+        service.submitTask(playerId = playerId, operation = {}, onCancelled = mockk(relaxed = true))
+      }
+
+      blocker.countDown()
+    }
+
+    test("submitTask allows different playerIds") {
+      val service = createService()
+      val latch1 = CountDownLatch(1)
+      val latch2 = CountDownLatch(1)
+
+      service.submitTask(
+        playerId = UUID.randomUUID(),
+        operation = { latch1.countDown() },
+        onCancelled = mockk(relaxed = true),
+      )
+      service.submitTask(
+        playerId = UUID.randomUUID(),
+        operation = { latch2.countDown() },
+        onCancelled = mockk(relaxed = true),
+      )
+
+      latch1.await(5, TimeUnit.SECONDS) shouldBe true
+      latch2.await(5, TimeUnit.SECONDS) shouldBe true
+    }
+
+    test("dequeueTask returns false when no task exists") {
+      val service = createService()
+      service.dequeueTask(UUID.randomUUID()) shouldBe false
+    }
+
+    test("dequeueTask removes queued task and invokes onCancelled") {
+      val config =
+        EncryptionQueueConfig().apply {
+          encryptionQueueMinThreads = 1
+          encryptionQueueMaxThreads = 1
+        }
+      val service = EncryptionQueueServiceImpl(config)
+      val blockerStarted = CountDownLatch(1)
+      val blockerRelease = CountDownLatch(1)
+      val blockerId = UUID.randomUUID()
+
+      service.submitTask(
+        playerId = blockerId,
+        operation = {
+          blockerStarted.countDown()
+          blockerRelease.await()
+        },
+        onCancelled = mockk(relaxed = true),
+      )
+
+      blockerStarted.await(5, TimeUnit.SECONDS) shouldBe true
+
+      val targetId = UUID.randomUUID()
+      val opLatch = CountDownLatch(1)
+      val onCancelled = mockk<() -> Unit>(relaxed = true)
+
+      service.submitTask(
+        playerId = targetId,
+        operation = { opLatch.countDown() },
+        onCancelled = onCancelled,
+      )
+
+      service.dequeueTask(targetId) shouldBe true
+      verify { onCancelled.invoke() }
+
+      opLatch.await(1, TimeUnit.SECONDS) shouldBe false
+      service.isTaskQueued(targetId) shouldBe false
+
+      blockerRelease.countDown()
+    }
+
+    test("dequeueTask returns true and sets cancelled for executing task") {
+      val service = createService()
+      val opStarted = CountDownLatch(1)
+      val opRelease = CountDownLatch(1)
+      val playerId = UUID.randomUUID()
+
+      service.submitTask(
+        playerId = playerId,
+        operation = {
+          opStarted.countDown()
+          opRelease.await()
+        },
+        onCancelled = mockk(relaxed = true),
+      )
+
+      opStarted.await(5, TimeUnit.SECONDS) shouldBe true
+
+      service.dequeueTask(playerId) shouldBe true
+      service.isTaskQueued(playerId) shouldBe false
+
+      opRelease.countDown()
+    }
+
+    test("onCancelled is not called when task executes normally") {
+      val service = createService()
+      val playerId = UUID.randomUUID()
+      val latch = CountDownLatch(1)
+      val onCancelled = mockk<() -> Unit>(relaxed = true)
+
+      service.submitTask(
+        playerId = playerId,
+        operation = { latch.countDown() },
+        onCancelled = onCancelled,
+      )
+
+      latch.await(5, TimeUnit.SECONDS) shouldBe true
+      verify(inverse = true) { onCancelled.invoke() }
+    }
+
+    test("isTaskQueued reflects current state") {
+      val service = createService()
+      val playerId = UUID.randomUUID()
+      val blocker = CountDownLatch(1)
+      val done = CountDownLatch(1)
+
+      service.isTaskQueued(playerId) shouldBe false
+
+      service.submitTask(
+        playerId = playerId,
+        operation = {
+          blocker.await()
+          done.countDown()
+        },
+        onCancelled = mockk(relaxed = true),
+      )
+
+      service.isTaskQueued(playerId) shouldBe true
+
+      blocker.countDown()
+      done.await(5, TimeUnit.SECONDS) shouldBe true
+
+      Thread.sleep(100)
+      service.isTaskQueued(playerId) shouldBe false
+    }
+
+    test("EncryptionTaskAlreadyQueuedException is thrown and caught correctly") {
+      val service = createService()
+      val playerId = UUID.randomUUID()
+      val blocker = CountDownLatch(1)
+
+      service.submitTask(
+        playerId = playerId,
+        operation = { blocker.await() },
+        onCancelled = mockk(relaxed = true),
+      )
+
+      shouldThrow<EncryptionTaskAlreadyQueuedException> {
+        service.submitTask(playerId = playerId, operation = {}, onCancelled = mockk(relaxed = true))
+      }
+
+      blocker.countDown()
+    }
+
+    test("dequeueTask after task already completed returns false") {
+      val service = createService()
+      val playerId = UUID.randomUUID()
+      val latch = CountDownLatch(1)
+
+      service.submitTask(
+        playerId = playerId,
+        operation = { latch.countDown() },
+        onCancelled = mockk(relaxed = true),
+      )
+
+      latch.await(5, TimeUnit.SECONDS) shouldBe true
+
+      Thread.sleep(200)
+      service.dequeueTask(playerId) shouldBe false
+    }
+  })
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceCrackedAdminCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceCrackedAdminCommand.kt
index fc43b522..51cea2f3 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceCrackedAdminCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/admin/ForceCrackedAdminCommand.kt
@@ -29,6 +29,7 @@ import dev.rollczi.litecommands.annotations.permission.Permission
 import java.util.Optional
 import pl.spcode.navauth.common.annotation.Description
 import pl.spcode.navauth.common.application.credentials.UserCredentialsService
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.command.user.UserArgumentResolver
 import pl.spcode.navauth.common.command.user.UsernameOrUuidRaw
@@ -72,21 +73,27 @@ constructor(
 
     val newPassword = newPasswordOpt.orElseGet { generateRandomString(8) }
 
-    val hashedPassword = userCredentialsService.hashPassword(newPassword)
-    userService.migrateToNonPremium(user, hashedPassword)
+    try {
+      userCredentialsService.enqueueHashPassword(newPassword, user.uuid.value).thenAccept {
+        hashedPassword ->
+        userService.migrateToNonPremium(user, hashedPassword)
 
-    val passwordText =
-      if (CommandSourceUtils.isConsoleOrRcon(sender)) {
-        "$newPassword"
-      } else {
-        val placeholders = mapOf(Pair("PASSWORD", newPassword))
-        multification.config.adminCopyPasswordText.applyPlaceholders(placeholders)
-      }
+        val passwordText =
+          if (CommandSourceUtils.isConsoleOrRcon(sender)) {
+            "$newPassword"
+          } else {
+            val placeholders = mapOf(Pair("PASSWORD", newPassword))
+            multification.config.adminCopyPasswordText.applyPlaceholders(placeholders)
+          }
 
-    multification
-      .create(sender) { it.multification.adminCmdAccountMigratedToNonPremiumSuccess }
-      .placeholder("%USERNAME%", user.username.value)
-      .placeholder("%PASSWORD_TEXT%", passwordText)
-      .send()
+        multification
+          .create(sender) { it.multification.adminCmdAccountMigratedToNonPremiumSuccess }
+          .placeholder("%USERNAME%", user.username.value)
+          .placeholder("%PASSWORD_TEXT%", passwordText)
+          .send()
+      }
+    } catch (_: EncryptionTaskAlreadyQueuedException) {
+      multification.create(sender) { it.multification.processAlreadyInProgressError }.send()
+    }
   }
 }
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt
index cd451a36..47aadbf0 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt
@@ -30,6 +30,7 @@ import pl.spcode.navauth.api.domain.auth.AuthSessionType
 import pl.spcode.navauth.common.annotation.Description
 import pl.spcode.navauth.common.application.auth.session.AuthSessionService
 import pl.spcode.navauth.common.application.credentials.UserCredentialsService
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.application.validator.PasswordValidator
 import pl.spcode.navauth.common.command.exception.MissingPermissionException
@@ -87,12 +88,20 @@ constructor(
       return
     }
 
-    val hashedPassword = userCredentialsService.hashPassword(password)
-    userService.createAndStoreUserWithNewCredentials(
-      User.nonPremium(UserUuid(sender.uniqueId), Username(sender.username)),
-      hashedPassword,
-    )
-    // register session will send success message
-    session.authenticate()
+    multification.send(sender) { it.multification.registeringInfo }
+
+    try {
+      userCredentialsService.enqueueHashPassword(password, sender.uniqueId).thenAccept {
+        hashedPassword ->
+        userService.createAndStoreUserWithNewCredentials(
+          User.nonPremium(UserUuid(sender.uniqueId), Username(sender.username)),
+          hashedPassword,
+        )
+        // register session will send success message
+        session.authenticate()
+      }
+    } catch (_: EncryptionTaskAlreadyQueuedException) {
+      multification.send(sender) { it.multification.processAlreadyInProgressError }
+    }
   }
 }

From e2785104f211f90c3230d6f021e9ac2ee62c62aa Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Fri, 26 Jun 2026 05:28:19 +0200
Subject: [PATCH 13/31] add logging-in message

---
 CHANGELOG.md                                  |  1 +
 .../navauth/common/config/MessagesConfig.kt   |  1 +
 .../common/infra/auth/LoginAuthSession.kt     | 44 ++++++++++---------
 .../velocity/command/user/LoginCommand.kt     | 35 ++++++++-------
 4 files changed, 45 insertions(+), 36 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f23b4533..12ae6e79 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,4 +26,5 @@
 + processAlreadyInProgressError
 + alreadyTryingToLoginError
 + registeringInfo
++ loggingInInfo
 ```
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
index 15dc179c..68695ea2 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
@@ -111,6 +111,7 @@ open class MessagesConfig : OkaeriConfig() {
     var accountAlreadyPremiumError: Notice =
       Notice.chat("<red>Account is already set as a premium one.")
 
+    var loggingInInfo: Notice = Notice.chat("<yellow>Logging in, please wait...</yellow>")
     var alreadyTryingToLoginError: Notice =
       Notice.chat(
         "<red>You're already trying to login, please wait for login result before next retry."
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt
index 4a76a33f..557c8bbd 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/auth/LoginAuthSession.kt
@@ -49,8 +49,8 @@ open class LoginAuthSession<T : PlayerAdapter>(
   }
 
   /**
-   * Authenticates a user using a combination of password and two-factor authentication code if
-   * required.
+   * Authenticates the session owner using a combination of password and two-factor authentication
+   * code if required.
    *
    * @param password the raw (not hashed) password to authenticate the user, can be null if not
    *   required
@@ -58,6 +58,7 @@ open class LoginAuthSession<T : PlayerAdapter>(
    * @return CompletableFuture with AuthTaskResult
    * @throws IllegalArgumentException if `password` or `twoFactorCode` is required by the user
    *   credentials but not provided
+   * @throws EncryptionTaskAlreadyQueuedException if an encryption task is already queued
    */
   fun enqueueAuthTask(
     password: String?,
@@ -81,6 +82,15 @@ open class LoginAuthSession<T : PlayerAdapter>(
     }
   }
 
+  /**
+   * Validates credentials and enqueues password verification if required.
+   *
+   * @param password the raw password, can be null if not required
+   * @param twoFactorCode the 2FA code, can be null if not required
+   * @return CompletableFuture with AuthTaskResult
+   * @throws IllegalArgumentException if `password` or `twoFactorCode` is required but not provided
+   * @throws EncryptionTaskAlreadyQueuedException if an encryption task is already queued
+   */
   private fun tryAuth(
     password: String?,
     twoFactorCode: String?,
@@ -95,23 +105,19 @@ open class LoginAuthSession<T : PlayerAdapter>(
     if (userCredentials.isPasswordRequired) {
       val future = CompletableFuture<AuthTaskResult>()
       require(password != null) { "password parameter is required by user credentials" }
-      try {
-        userCredentialsService
-          .enqueueVerifyPassword(userCredentials, password, playerAdapter.identifier)
-          .whenComplete { isCorrect, throwable ->
-            if (throwable != null) {
-              future.completeExceptionally(throwable)
-              return@whenComplete
-            }
-            if (isCorrect) {
-              future.complete(AuthTaskResult.Success)
-            } else {
-              future.complete(AuthTaskResult.WrongCredentials)
-            }
+      userCredentialsService
+        .enqueueVerifyPassword(userCredentials, password, playerAdapter.identifier)
+        .whenComplete { isCorrect, throwable ->
+          if (throwable != null) {
+            future.completeExceptionally(throwable)
+            return@whenComplete
           }
-      } catch (ex: EncryptionTaskAlreadyQueuedException) {
-        future.complete(AuthTaskResult.AlreadyQueued)
-      }
+          if (isCorrect) {
+            future.complete(AuthTaskResult.Success)
+          } else {
+            future.complete(AuthTaskResult.WrongCredentials)
+          }
+        }
 
       return future
     }
@@ -121,8 +127,6 @@ open class LoginAuthSession<T : PlayerAdapter>(
   }
 
   sealed class AuthTaskResult {
-    object AlreadyQueued : AuthTaskResult()
-
     object WrongCredentials : AuthTaskResult()
 
     object Success : AuthTaskResult()
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt
index 568974ec..9b164024 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/LoginCommand.kt
@@ -31,6 +31,7 @@ import kotlin.jvm.optionals.getOrNull
 import pl.spcode.navauth.api.domain.auth.AuthSessionType
 import pl.spcode.navauth.common.annotation.Description
 import pl.spcode.navauth.common.application.auth.session.AuthSessionService
+import pl.spcode.navauth.common.application.credentials.queue.EncryptionTaskAlreadyQueuedException
 import pl.spcode.navauth.common.command.exception.MissingPermissionException
 import pl.spcode.navauth.common.infra.auth.LoginAuthSession
 import pl.spcode.navauth.velocity.command.Permissions
@@ -122,25 +123,27 @@ constructor(
     password: String?,
     code: String?,
   ) {
-    session.enqueueAuthTask(password, code).whenComplete { result, throwable ->
-      if (throwable != null) {
-        multification.send(sender) { it.multification.unexpectedErrorOccurred }
-        return@whenComplete
-      }
-      when (result) {
-        LoginAuthSession.AuthTaskResult.AlreadyQueued -> {
-          multification.send(sender) { it.multification.alreadyTryingToLoginError }
-        }
-        LoginAuthSession.AuthTaskResult.WrongCredentials -> {
-          multification.send(sender) { it.multification.wrongCredentialsError }
-        }
-        LoginAuthSession.AuthTaskResult.FailedTooManyAttempts -> {
-          // handled by VelocityLoginAuthSession.onTooManyLoginAttempts
+    try {
+      session.enqueueAuthTask(password, code).whenComplete { result, throwable ->
+        if (throwable != null) {
+          multification.send(sender) { it.multification.unexpectedErrorOccurred }
+          return@whenComplete
         }
-        LoginAuthSession.AuthTaskResult.Success -> {
-          // handled by VelocityLoginAuthSession.onAuthenticated
+        when (result) {
+          LoginAuthSession.AuthTaskResult.WrongCredentials -> {
+            multification.send(sender) { it.multification.wrongCredentialsError }
+          }
+          LoginAuthSession.AuthTaskResult.FailedTooManyAttempts -> {
+            // handled by VelocityLoginAuthSession.onTooManyLoginAttempts
+          }
+          LoginAuthSession.AuthTaskResult.Success -> {
+            // handled by VelocityLoginAuthSession.onAuthenticated
+          }
         }
       }
+      multification.send(sender) { it.multification.loggingInInfo }
+    } catch (_: EncryptionTaskAlreadyQueuedException) {
+      multification.send(sender) { it.multification.alreadyTryingToLoginError }
     }
   }
 }

From 687b0470594d4140721a25a68e1fce4f05cda624 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Fri, 26 Jun 2026 06:07:50 +0200
Subject: [PATCH 14/31] update /register cmd - send registeringInfo message
 only if there's no encryption task in progress

---
 .../pl/spcode/navauth/velocity/command/user/RegisterCommand.kt | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt
index 47aadbf0..3dedf14b 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/command/user/RegisterCommand.kt
@@ -88,8 +88,6 @@ constructor(
       return
     }
 
-    multification.send(sender) { it.multification.registeringInfo }
-
     try {
       userCredentialsService.enqueueHashPassword(password, sender.uniqueId).thenAccept {
         hashedPassword ->
@@ -100,6 +98,7 @@ constructor(
         // register session will send success message
         session.authenticate()
       }
+      multification.send(sender) { it.multification.registeringInfo }
     } catch (_: EncryptionTaskAlreadyQueuedException) {
       multification.send(sender) { it.multification.processAlreadyInProgressError }
     }

From b4931f9b443213c0b27b9886ae7fe1d7171373f4 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Fri, 26 Jun 2026 06:09:05 +0200
Subject: [PATCH 15/31] update messages config - move loggingInInfo property

---
 .../kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
index 68695ea2..021898c6 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/config/MessagesConfig.kt
@@ -111,7 +111,6 @@ open class MessagesConfig : OkaeriConfig() {
     var accountAlreadyPremiumError: Notice =
       Notice.chat("<red>Account is already set as a premium one.")
 
-    var loggingInInfo: Notice = Notice.chat("<yellow>Logging in, please wait...</yellow>")
     var alreadyTryingToLoginError: Notice =
       Notice.chat(
         "<red>You're already trying to login, please wait for login result before next retry."
@@ -129,6 +128,7 @@ open class MessagesConfig : OkaeriConfig() {
       Notice.chat("<green>Please login using \"/2fa <code>\" command.</green>")
     var loginPasswordAndTwoFactorInstruction: Notice =
       Notice.chat("<green>Please login using \"/login <password> <2fa_code>\" command.</green>")
+    var loggingInInfo: Notice = Notice.chat("<yellow>Logging in, please wait...</yellow>")
 
     var registerInstruction: Notice =
       Notice.chat("<green>Please register using /register command.</green>")

From c0baeda4d790540118ecfc027909a037ed4df8a9 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Wed, 8 Jul 2026 22:55:01 +0200
Subject: [PATCH 16/31] bump version to 0.2.0

---
 build.gradle.kts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.gradle.kts b/build.gradle.kts
index 47ca1fb2..8d479c78 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -11,7 +11,7 @@ repositories {
 
 allprojects {
   group = "pl.spcode.navauth"
-  version = "0.1.6-SNAPSHOT"
+  version = "0.2.0-SNAPSHOT"
 }
 
 tasks.register("formatAll") {

From 011af0c1379fce42f001e4767768fe7baabf8e2b Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 11 Jul 2026 04:46:42 +0200
Subject: [PATCH 17/31] add navauth-shadow convention plugin; init ajqueue
 integration plugin

---
 .idea/gradle.xml                              | 14 ++++
 buildSrc/build.gradle.kts                     | 13 ++++
 .../src/main/kotlin/navauth-shadow.gradle.kts | 50 ++++++++++++++
 integration/ajqueue/build.gradle.kts          | 44 ++++++++++++
 .../BuildParameters.kt.peb                    |  7 ++
 .../ajqueue/AjQueueIntegrationPlugin.kt       | 68 +++++++++++++++++++
 .../ajqueue/config/GeneralConfig.kt           | 35 ++++++++++
 .../ajqueue/listener/NavAuthListeners.kt      | 61 +++++++++++++++++
 navauth-velocity/build.gradle.kts             | 45 +-----------
 settings.gradle.kts                           |  4 +-
 10 files changed, 297 insertions(+), 44 deletions(-)
 create mode 100644 buildSrc/build.gradle.kts
 create mode 100644 buildSrc/src/main/kotlin/navauth-shadow.gradle.kts
 create mode 100644 integration/ajqueue/build.gradle.kts
 create mode 100644 integration/ajqueue/src/main/kotlin-templates/pl/spcode/navauth.integration.ajqueue/BuildParameters.kt.peb
 create mode 100644 integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt
 create mode 100644 integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/config/GeneralConfig.kt
 create mode 100644 integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/listener/NavAuthListeners.kt

diff --git a/.idea/gradle.xml b/.idea/gradle.xml
index 5be346f6..25956e96 100644
--- a/.idea/gradle.xml
+++ b/.idea/gradle.xml
@@ -4,11 +4,25 @@
   <component name="GradleSettings">
     <option name="linkedExternalProjectsSettings">
       <GradleProjectSettings>
+        <compositeConfiguration>
+          <compositeBuild compositeDefinitionSource="SCRIPT">
+            <builds>
+              <build path="$PROJECT_DIR$/buildSrc" name="buildSrc">
+                <projects>
+                  <project path="$PROJECT_DIR$/buildSrc" />
+                </projects>
+              </build>
+            </builds>
+          </compositeBuild>
+        </compositeConfiguration>
         <option name="externalProjectPath" value="$PROJECT_DIR$" />
         <option name="gradleJvm" value="21" />
         <option name="modules">
           <set>
             <option value="$PROJECT_DIR$" />
+            <option value="$PROJECT_DIR$/buildSrc" />
+            <option value="$PROJECT_DIR$/integration" />
+            <option value="$PROJECT_DIR$/integration/ajqueue" />
             <option value="$PROJECT_DIR$/navauth-api" />
             <option value="$PROJECT_DIR$/navauth-api-examples" />
             <option value="$PROJECT_DIR$/navauth-common" />
diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
new file mode 100644
index 00000000..25a82b5a
--- /dev/null
+++ b/buildSrc/build.gradle.kts
@@ -0,0 +1,13 @@
+plugins {
+  `kotlin-dsl`
+  `java-library`
+}
+
+repositories {
+  gradlePluginPortal()
+  mavenCentral()
+}
+
+dependencies {
+  implementation("com.gradleup.shadow:shadow-gradle-plugin:9.2.0")
+}
diff --git a/buildSrc/src/main/kotlin/navauth-shadow.gradle.kts b/buildSrc/src/main/kotlin/navauth-shadow.gradle.kts
new file mode 100644
index 00000000..975abaa9
--- /dev/null
+++ b/buildSrc/src/main/kotlin/navauth-shadow.gradle.kts
@@ -0,0 +1,50 @@
+package buildsrc
+
+import com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar
+
+plugins {
+  id("com.gradleup.shadow")
+}
+
+val relocatePrefix = "pl.spcode.navauth.lib"
+
+tasks.named<ShadowJar>("shadowJar") {
+  duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+
+  fun relocatePrefixed(pkg: String) {
+    relocate(pkg, "$relocatePrefix.$pkg")
+  }
+
+  relocate("com.google", "$relocatePrefix.com.google") {
+    exclude("com/google/inject/**")
+    exclude("com/google/gson/**")
+  }
+
+  exclude("com/google/inject/**")
+  exclude("com/google/gson/**")
+
+  exclude("org/slf4j/**")
+
+  relocatePrefixed("kotlin")
+  relocatePrefixed("org.bstats")
+  relocatePrefixed("at.favre")
+  relocatePrefixed("com.eternalcode")
+  relocatePrefixed("com.j256")
+  relocatePrefixed("com.mysql")
+  relocatePrefixed("com.zaxxer")
+  relocatePrefixed("dev.rollczi")
+  relocatePrefixed("eu.okaeri")
+  relocatePrefixed("google.protobuf")
+  relocatePrefixed("jakarta.inject")
+  relocatePrefixed("javax.annotation")
+  relocatePrefixed("org.aopalliance")
+  relocatePrefixed("org.bouncycastle")
+  relocatePrefixed("org.checkerframework")
+  relocatePrefixed("org.h2")
+  relocatePrefixed("org.intellij")
+  relocatePrefixed("org.jetbrains")
+  relocatePrefixed("org.postgresql")
+  // todo make sure we relocate this or something
+//  relocatePrefixed("org.sqlite")
+  relocatePrefixed("org.yaml")
+}
diff --git a/integration/ajqueue/build.gradle.kts b/integration/ajqueue/build.gradle.kts
new file mode 100644
index 00000000..5e495800
--- /dev/null
+++ b/integration/ajqueue/build.gradle.kts
@@ -0,0 +1,44 @@
+plugins {
+  id("buildsrc.navauth-shadow")
+  id("net.kyori.blossom") version "2.2.0"
+  kotlin("jvm")
+  kotlin("kapt")
+}
+
+val projectName = "navauth-ajqueue-integration"
+
+group = "pl.spcode.navauth"
+version = "1.0.0-SNAPSHOT"
+
+sourceSets {
+  main {
+    blossom {
+      kotlinSources {
+        property("version", project.version.toString())
+      }
+    }
+  }
+}
+
+tasks.shadowJar {
+  destinationDirectory.set(file("../../target"))
+
+  archiveBaseName.set(projectName)
+  archiveClassifier = null
+
+  exclude("kotlin/**")
+  exclude("META-INF/**")
+  exclude("org/jetbrains/**")
+  exclude("org/intellij/**")
+}
+
+repositories {
+  maven { url = uri("https://repo.ajg0702.us/releases") }
+}
+
+dependencies {
+  compileOnly(project(":navauth-common"))
+  compileOnly(libs.velocitypowered.velocity.api)
+  kapt(libs.velocitypowered.velocity.api)
+  compileOnly("us.ajg0702.queue.api:api:2.9.1")
+}
diff --git a/integration/ajqueue/src/main/kotlin-templates/pl/spcode/navauth.integration.ajqueue/BuildParameters.kt.peb b/integration/ajqueue/src/main/kotlin-templates/pl/spcode/navauth.integration.ajqueue/BuildParameters.kt.peb
new file mode 100644
index 00000000..df695aaa
--- /dev/null
+++ b/integration/ajqueue/src/main/kotlin-templates/pl/spcode/navauth.integration.ajqueue/BuildParameters.kt.peb
@@ -0,0 +1,7 @@
+package pl.spcode.navauth.integration.ajqueue
+
+class BuildParameters {
+  companion object {
+    const val VERSION = "{{ version }}"
+  }
+}
diff --git a/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt
new file mode 100644
index 00000000..57a6ba50
--- /dev/null
+++ b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt
@@ -0,0 +1,68 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.integration.ajqueue
+
+import com.google.inject.Inject
+import com.google.inject.Injector
+import com.velocitypowered.api.event.Subscribe
+import com.velocitypowered.api.event.proxy.ProxyInitializeEvent
+import com.velocitypowered.api.plugin.Dependency
+import com.velocitypowered.api.plugin.Plugin
+import com.velocitypowered.api.plugin.annotation.DataDirectory
+import java.nio.file.Path
+import org.slf4j.Logger
+import pl.spcode.navauth.api.NavAuthAPI
+import pl.spcode.navauth.common.module.YamlConfigModule
+import pl.spcode.navauth.integration.ajqueue.config.GeneralConfig
+import pl.spcode.navauth.integration.ajqueue.listener.NavAuthListeners
+
+@Plugin(
+  id = "navauth-ajqueue",
+  name = "NavAuth AJQueue Integration",
+  version = BuildParameters.VERSION,
+  dependencies = [Dependency(id = "navauth"), Dependency(id = "ajqueue")],
+  authors = ["Navio1430"],
+)
+class AjQueueIntegrationPlugin
+@Inject
+constructor(
+  val parentInjector: Injector,
+  @param:DataDirectory val dataDirectory: Path,
+  val logger: Logger,
+) {
+
+  @Subscribe
+  fun onProxyInitializeEvent(event: ProxyInitializeEvent) {
+    try {
+      logger.info("Initializing NavAuth AJQueue integration...")
+
+      val configModule =
+        YamlConfigModule(GeneralConfig::class, dataDirectory.resolve("config.yml").toFile())
+
+      val childInjector = parentInjector.createChildInjector(configModule)
+
+      val eventBus = NavAuthAPI.getInstance().eventBus
+      eventBus.register(childInjector.getInstance(NavAuthListeners::class.java))
+
+      logger.info("NavAuth AJQueue integration initialized successfully")
+    } catch (ex: Exception) {
+      logger.error("Failed to initialize NavAuth AJQueue integration", ex)
+    }
+  }
+}
diff --git a/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/config/GeneralConfig.kt b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/config/GeneralConfig.kt
new file mode 100644
index 00000000..ed10f6f5
--- /dev/null
+++ b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/config/GeneralConfig.kt
@@ -0,0 +1,35 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.integration.ajqueue.config
+
+import eu.okaeri.configs.OkaeriConfig
+import eu.okaeri.configs.annotation.Comment
+import pl.spcode.navauth.common.component.TextComponent
+
+class GeneralConfig : OkaeriConfig() {
+
+  @Comment("Name of the ajQueue queue to send authenticated players to")
+  var queueName: String = "lobby"
+
+  @Comment("Message sent when adding player to queue fails")
+  var queueAddFailMessage: TextComponent = TextComponent("<red>Failed to add you to the queue!")
+
+  @Comment("Whether to kick the player if adding them to the queue fails")
+  var kickOnQueueAddFail: Boolean = false
+}
diff --git a/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/listener/NavAuthListeners.kt b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/listener/NavAuthListeners.kt
new file mode 100644
index 00000000..8dcc8b72
--- /dev/null
+++ b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/listener/NavAuthListeners.kt
@@ -0,0 +1,61 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.integration.ajqueue.listener
+
+import com.google.inject.Inject
+import com.velocitypowered.api.proxy.ProxyServer
+import org.slf4j.Logger
+import org.slf4j.LoggerFactory
+import pl.spcode.navauth.api.event.NavAuthEventListener
+import pl.spcode.navauth.api.event.Subscribe
+import pl.spcode.navauth.api.event.user.UserAuthenticatedEvent
+import pl.spcode.navauth.integration.ajqueue.config.GeneralConfig
+import us.ajg0702.queue.api.AjQueueAPI
+
+class NavAuthListeners
+@Inject
+constructor(val config: GeneralConfig, val proxyServer: ProxyServer) : NavAuthEventListener {
+
+  private val logger: Logger = LoggerFactory.getLogger(javaClass)
+
+  @Subscribe
+  fun onUserAuthenticatedEvent(event: UserAuthenticatedEvent) {
+    val authPlayer = event.player
+    val player = proxyServer.getPlayer(authPlayer.identifier).get()
+    val queueName = config.queueName
+
+    if (queueName.isBlank()) {
+      return
+    }
+
+    val api = AjQueueAPI.getInstance()
+    val adaptedPlayer = api.platformMethods.getPlayer(authPlayer.identifier)
+
+    val added = api.queueManager.addToQueue(adaptedPlayer, queueName)
+
+    if (!added) {
+      logger.warn("Failed to add player {} to queue {}", player, queueName)
+      player.sendMessage(config.queueAddFailMessage.toComponent())
+
+      if (config.kickOnQueueAddFail) {
+        player.disconnect(config.queueAddFailMessage.toComponent())
+      }
+    }
+  }
+}
diff --git a/navauth-velocity/build.gradle.kts b/navauth-velocity/build.gradle.kts
index 77100333..b386a60d 100644
--- a/navauth-velocity/build.gradle.kts
+++ b/navauth-velocity/build.gradle.kts
@@ -1,55 +1,16 @@
-
 plugins {
   alias(libs.plugins.blossom)
-  alias(libs.plugins.shadow)
+  id("buildsrc.navauth-shadow")
 }
 
 val projectName = "navauth"
 
-var prefix = "pl.spcode.${projectName.lowercase()}.lib";
-fun com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar.relocatePrefixed(pkg: String) {
-  relocate(pkg, "${prefix}.$pkg")
-}
-
 tasks.shadowJar {
   destinationDirectory.set(file("../target"))
 
   archiveBaseName.set("${projectName}-velocity")
   archiveClassifier = null
 
-  relocate("com.google", "$prefix.com.google") {
-    exclude("com/google/inject/**")
-    exclude("com/google/gson/**")
-  }
-
-  exclude("com/google/inject/**")
-  exclude("com/google/gson/**")
-
-  exclude("org/slf4j/**")
-
-  relocatePrefixed("kotlin")
-  relocatePrefixed("org.bstats")
-  relocatePrefixed("at.favre")
-  relocatePrefixed("com.eternalcode")
-  relocatePrefixed("com.j256")
-  relocatePrefixed("com.mysql")
-  relocatePrefixed("com.zaxxer")
-  relocatePrefixed("dev.rollczi")
-  relocatePrefixed("eu.okaeri")
-  relocatePrefixed("google.protobuf")
-  relocatePrefixed("jakarta.inject")
-  relocatePrefixed("javax.annotation")
-  relocatePrefixed("org.aopalliance")
-  relocatePrefixed("org.bouncycastle")
-  relocatePrefixed("org.checkerframework")
-  relocatePrefixed("org.h2")
-  relocatePrefixed("org.intellij")
-  relocatePrefixed("org.jetbrains")
-  relocatePrefixed("org.postgresql")
-  // todo make sure we relocate this or something
-//  relocatePrefixed("org.sqlite")
-  relocatePrefixed("org.yaml")
-
   doLast {
     val pluginsDir = file("./run/velocity/plugins")
     if (pluginsDir.exists() && pluginsDir.isDirectory) {
@@ -79,7 +40,6 @@ repositories {
 }
 
 dependencies {
-
   implementation(project(":navauth-common"))
 
   implementation(libs.litecommands.velocity)
@@ -90,7 +50,7 @@ dependencies {
   // bstats
   implementation("org.bstats:bstats-velocity:3.1.0")
 
-  // Tribufu-Rcon used for containers
+  // Tribufu-Rcon used in itzg containers
   compileOnly("com.tribufu:Tribufu-VelocityRcon:1.2.0")
 }
 
@@ -103,4 +63,3 @@ tasks.withType<org.jetbrains.kotlin.gradle.tasks.KotlinCompile> {
     freeCompilerArgs.add("-java-parameters")
   }
 }
-
diff --git a/settings.gradle.kts b/settings.gradle.kts
index 18703120..7387b9c7 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -4,4 +4,6 @@ include("navauth-common")
 include("navauth-velocity")
 include("navauth-docs-gen")
 include("navauth-api")
-include("navauth-api-examples")
\ No newline at end of file
+include("navauth-api-examples")
+include("integration")
+include("integration:ajqueue")
\ No newline at end of file

From df460016b402a61ded18cea511baf41149b686d8 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 11 Jul 2026 04:54:09 +0200
Subject: [PATCH 18/31] do not authenticate if player not online

---
 .../pl/spcode/navauth/common/domain/auth/session/AuthSession.kt  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/auth/session/AuthSession.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/auth/session/AuthSession.kt
index 50a625a5..73b445b5 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/auth/session/AuthSession.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/domain/auth/session/AuthSession.kt
@@ -40,6 +40,7 @@ abstract class AuthSession<T : PlayerAdapter>(val playerAdapter: T, val eventBus
     private set
 
   fun authenticate() {
+    if (!playerAdapter.isOnline()) return
     isAuthenticated = true
     state = AuthSessionState.AUTHENTICATED
     eventBus as NavAuthEventBusInternal

From 8f0a8080343915a8ccf95cea267c977586c70e6f Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 11 Jul 2026 22:06:16 +0200
Subject: [PATCH 19/31] add NavAuthAPI#isAuthenticated(UUID); impl
 cancelQueueJoinEventIfNotAuth AjQueue integration property

---
 .../ajqueue/AjQueueIntegrationPlugin.kt       |  4 ++
 .../ajqueue/config/GeneralConfig.kt           |  3 ++
 .../ajqueue/listener/AjQueueListeners.kt      | 47 +++++++++++++++++++
 .../pl/spcode/navauth/api/NavAuthAPI.java     |  3 ++
 .../spcode/navauth/velocity/NavAuthApiImpl.kt | 20 +++++++-
 5 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/listener/AjQueueListeners.kt

diff --git a/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt
index 57a6ba50..5a510461 100644
--- a/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt
+++ b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt
@@ -30,6 +30,7 @@ import org.slf4j.Logger
 import pl.spcode.navauth.api.NavAuthAPI
 import pl.spcode.navauth.common.module.YamlConfigModule
 import pl.spcode.navauth.integration.ajqueue.config.GeneralConfig
+import pl.spcode.navauth.integration.ajqueue.listener.AjQueueListeners
 import pl.spcode.navauth.integration.ajqueue.listener.NavAuthListeners
 
 @Plugin(
@@ -60,6 +61,9 @@ constructor(
       val eventBus = NavAuthAPI.getInstance().eventBus
       eventBus.register(childInjector.getInstance(NavAuthListeners::class.java))
 
+      val ajQueueListeners = childInjector.getInstance(AjQueueListeners::class.java)
+      ajQueueListeners.registerAll()
+
       logger.info("NavAuth AJQueue integration initialized successfully")
     } catch (ex: Exception) {
       logger.error("Failed to initialize NavAuth AJQueue integration", ex)
diff --git a/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/config/GeneralConfig.kt b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/config/GeneralConfig.kt
index ed10f6f5..8b034fd4 100644
--- a/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/config/GeneralConfig.kt
+++ b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/config/GeneralConfig.kt
@@ -32,4 +32,7 @@ class GeneralConfig : OkaeriConfig() {
 
   @Comment("Whether to kick the player if adding them to the queue fails")
   var kickOnQueueAddFail: Boolean = false
+
+  @Comment("Whether to cancel the AjQueue PreQueueEvent if the player is not authenticated yet")
+  var cancelQueueJoinEventIfNotAuth: Boolean = false
 }
diff --git a/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/listener/AjQueueListeners.kt b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/listener/AjQueueListeners.kt
new file mode 100644
index 00000000..622f3cfb
--- /dev/null
+++ b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/listener/AjQueueListeners.kt
@@ -0,0 +1,47 @@
+/*
+ * NavAuth
+ * Copyright © 2026 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package pl.spcode.navauth.integration.ajqueue.listener
+
+import com.google.inject.Inject
+import org.slf4j.Logger
+import org.slf4j.LoggerFactory
+import pl.spcode.navauth.api.NavAuthAPI
+import pl.spcode.navauth.integration.ajqueue.config.GeneralConfig
+import us.ajg0702.queue.api.AjQueueAPI
+import us.ajg0702.queue.api.events.PreQueueEvent
+
+class AjQueueListeners @Inject constructor(val config: GeneralConfig) {
+
+  private val logger: Logger = LoggerFactory.getLogger(javaClass)
+
+  fun registerAll() {
+    registerAjQueuePreQueueListener()
+  }
+
+  private fun registerAjQueuePreQueueListener() {
+    AjQueueAPI.getInstance().listen(PreQueueEvent::class.java) { event ->
+      if (!config.cancelQueueJoinEventIfNotAuth) return@listen
+
+      if (!NavAuthAPI.getInstance().isAuthenticated(event.player.uniqueId)) {
+        event.isCancelled = true
+        logger.debug("Cancelled PreQueueEvent for unauthenticated player {}", event.player.name)
+      }
+    }
+  }
+}
diff --git a/navauth-api/src/main/java/pl/spcode/navauth/api/NavAuthAPI.java b/navauth-api/src/main/java/pl/spcode/navauth/api/NavAuthAPI.java
index c90d3638..8d4f5db5 100644
--- a/navauth-api/src/main/java/pl/spcode/navauth/api/NavAuthAPI.java
+++ b/navauth-api/src/main/java/pl/spcode/navauth/api/NavAuthAPI.java
@@ -18,6 +18,7 @@
 
 package pl.spcode.navauth.api;
 
+import java.util.UUID;
 import pl.spcode.navauth.api.event.NavAuthEventBus;
 
 public abstract class NavAuthAPI {
@@ -30,6 +31,8 @@ public NavAuthEventBus getEventBus() {
     return provideEventBus();
   }
 
+  public abstract boolean isAuthenticated(UUID playerUuid);
+
   public static NavAuthAPI getInstance() {
     return instance;
   }
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthApiImpl.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthApiImpl.kt
index f5a9de16..287c178e 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthApiImpl.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthApiImpl.kt
@@ -19,12 +19,30 @@
 package pl.spcode.navauth.velocity
 
 import com.google.inject.Inject
+import com.velocitypowered.api.proxy.ProxyServer
+import java.util.UUID
 import pl.spcode.navauth.api.NavAuthAPI
 import pl.spcode.navauth.api.event.NavAuthEventBus
+import pl.spcode.navauth.common.application.auth.session.AuthSessionService
+import pl.spcode.navauth.velocity.infra.auth.VelocityUniqueSessionId
+import pl.spcode.navauth.velocity.infra.player.VelocityPlayerAdapter
 
-class NavAuthApiImpl @Inject constructor(val eventBusInstance: NavAuthEventBus) : NavAuthAPI() {
+class NavAuthApiImpl
+@Inject
+constructor(
+  val eventBusInstance: NavAuthEventBus,
+  val authSessionService: AuthSessionService<VelocityPlayerAdapter>,
+  val proxyServer: ProxyServer,
+) : NavAuthAPI() {
 
   override fun provideEventBus(): NavAuthEventBus {
     return eventBusInstance
   }
+
+  override fun isAuthenticated(playerUuid: UUID): Boolean {
+    val player = proxyServer.getPlayer(playerUuid).orElse(null) ?: return false
+    val sessionId = VelocityUniqueSessionId(player)
+    val session = authSessionService.findSession(sessionId)
+    return session?.isAuthenticated == true
+  }
 }

From babb4fd98f2c71cb0a3426eac2b963197e005e84 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sat, 11 Jul 2026 22:06:25 +0200
Subject: [PATCH 20/31] update CHANGELOG.md

---
 CHANGELOG.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 12ae6e79..3682bfce 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,11 +7,18 @@
 + Argon2 configuration settings
 + Mojang profile API order (API fallback)
 + MineTools profile API support (preferred one by default)
++ NavAuthAPI.isAuthenticated(UUID) method for checking player auth state
++ AjQueue integration plugin
 ```
 
 ### Fixes
 - fix register command always using BCrypt instead of the selected algo
 
+### API
+```diff
++ NavAuthAPI#isAuthenticated(UUID)
+```
+
 ### Config
 **General** config:
 ```diff
@@ -28,3 +35,7 @@
 + registeringInfo
 + loggingInInfo
 ```
+
+### New integration for AjQueue (as a separate plugin)
+- Automatically adds authenticated players to a configurable AjQueue queue
+- Optionally cancel AjQueue `PreQueueEvent` for unauthenticated players

From 7e4166b231e3e54b04612a9ff4ac674cdc864743 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sun, 12 Jul 2026 01:47:39 +0200
Subject: [PATCH 21/31] migrate to new blossom plugin version

---
 gradle/libs.versions.toml                     |  2 +-
 navauth-velocity/build.gradle.kts             | 18 ++++---
 .../pl/spcode/navauth/velocity/Bootstrap.java | 51 -------------------
 .../navauth/velocity/BuildParameters.kt.peb   |  7 +++
 .../navauth/velocity/NavAuthVelocity.kt       | 36 ++++++-------
 .../velocity/VelocityPluginProvider.kt        |  2 +-
 6 files changed, 37 insertions(+), 79 deletions(-)
 delete mode 100644 navauth-velocity/src/main/java/pl/spcode/navauth/velocity/Bootstrap.java
 create mode 100644 navauth-velocity/src/main/kotlin-templates/pl/spcode/navauth/velocity/BuildParameters.kt.peb

diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index c7297a4d..5a63b546 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -3,7 +3,7 @@
 velocity-api = "3.4.0-SNAPSHOT"
 # plugins
 shadow = "9.2.0"
-blossom = "1.2.0"
+blossom = "2.2.0"
 spotless = "8.0.0"
 litecommands = "3.10.6"
 
diff --git a/navauth-velocity/build.gradle.kts b/navauth-velocity/build.gradle.kts
index b386a60d..b691b1c2 100644
--- a/navauth-velocity/build.gradle.kts
+++ b/navauth-velocity/build.gradle.kts
@@ -1,6 +1,7 @@
 plugins {
   alias(libs.plugins.blossom)
   id("buildsrc.navauth-shadow")
+  kotlin("kapt")
 }
 
 val projectName = "navauth"
@@ -29,9 +30,14 @@ tasks.shadowJar {
   }
 }
 
-blossom {
-  replaceTokenIn("pl/spcode/$projectName/velocity/Bootstrap.java")
-  replaceToken("@version@", rootProject.version.toString())
+sourceSets {
+  main {
+    blossom {
+      kotlinSources {
+        property("version", rootProject.version.toString())
+      }
+    }
+  }
 }
 
 repositories {
@@ -45,7 +51,7 @@ dependencies {
   implementation(libs.litecommands.velocity)
 
   compileOnly(libs.velocitypowered.velocity.api)
-  annotationProcessor(libs.velocitypowered.velocity.api)
+  kapt(libs.velocitypowered.velocity.api)
 
   // bstats
   implementation("org.bstats:bstats-velocity:3.1.0")
@@ -54,10 +60,6 @@ dependencies {
   compileOnly("com.tribufu:Tribufu-VelocityRcon:1.2.0")
 }
 
-tasks.compileJava {
-  options.compilerArgs.add("-parameters")
-}
-
 tasks.withType<org.jetbrains.kotlin.gradle.tasks.KotlinCompile> {
   compilerOptions {
     freeCompilerArgs.add("-java-parameters")
diff --git a/navauth-velocity/src/main/java/pl/spcode/navauth/velocity/Bootstrap.java b/navauth-velocity/src/main/java/pl/spcode/navauth/velocity/Bootstrap.java
deleted file mode 100644
index 83275e8e..00000000
--- a/navauth-velocity/src/main/java/pl/spcode/navauth/velocity/Bootstrap.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * NavAuth
- * Copyright © 2025 Oliwier Fijas (Navio1430)
- *
- * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
- * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
- *
- * NavAuth is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
- * and navigate to version 3 of the GNU Affero General Public License.
- *
- */
-
-package pl.spcode.navauth.velocity;
-
-import com.google.inject.Inject;
-import com.google.inject.Injector;
-import com.velocitypowered.api.event.Subscribe;
-import com.velocitypowered.api.event.proxy.ProxyInitializeEvent;
-import com.velocitypowered.api.plugin.Plugin;
-import org.slf4j.Logger;
-
-@Plugin(
-    id = "navauth",
-    name = "NavAuth",
-    version = "@version@",
-    url = "https://spcode.pl/navauth",
-    description =
-        "Minecraft login plugin built for speed, security, and seamless player authentication.",
-    authors = {"Navio1430"})
-public class Bootstrap {
-
-  private static NavAuthVelocity instance;
-
-  @Inject
-  private Bootstrap(Logger logger, Injector injector) {
-    logger.info("Bootstrapping velocity plugin...");
-    instance = injector.getInstance(NavAuthVelocity.class);
-    instance.init();
-  }
-
-  @Subscribe
-  private void onProxyInitializeEvent(ProxyInitializeEvent event) {
-    instance.onProxyInitializeEvent(this);
-  }
-}
diff --git a/navauth-velocity/src/main/kotlin-templates/pl/spcode/navauth/velocity/BuildParameters.kt.peb b/navauth-velocity/src/main/kotlin-templates/pl/spcode/navauth/velocity/BuildParameters.kt.peb
new file mode 100644
index 00000000..0936e910
--- /dev/null
+++ b/navauth-velocity/src/main/kotlin-templates/pl/spcode/navauth/velocity/BuildParameters.kt.peb
@@ -0,0 +1,7 @@
+package pl.spcode.navauth.velocity
+
+class BuildParameters {
+  companion object {
+    const val VERSION = "{{ version }}"
+  }
+}
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt
index 7b45b6b0..8c795d90 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt
@@ -24,7 +24,9 @@ import com.google.inject.Key
 import com.google.inject.Singleton
 import com.velocitypowered.api.command.CommandSource
 import com.velocitypowered.api.event.Subscribe
+import com.velocitypowered.api.event.proxy.ProxyInitializeEvent
 import com.velocitypowered.api.event.proxy.ProxyShutdownEvent
+import com.velocitypowered.api.plugin.Plugin
 import com.velocitypowered.api.plugin.annotation.DataDirectory
 import com.velocitypowered.api.proxy.ProxyServer
 import dev.rollczi.litecommands.LiteCommands
@@ -59,6 +61,15 @@ import pl.spcode.navauth.velocity.module.VelocityMultificationsModule
 import pl.spcode.navauth.velocity.module.VelocityServicesModule
 import pl.spcode.navauth.velocity.multification.VelocityViewerProvider
 
+@Plugin(
+  id = "navauth",
+  name = "NavAuth",
+  version = BuildParameters.VERSION,
+  url = "https://spcode.pl/navauth",
+  description =
+    "Minecraft login plugin built for speed, security, and seamless player authentication.",
+  authors = ["Navio1430"],
+)
 @Singleton
 class NavAuthVelocity
 @Inject
@@ -71,13 +82,12 @@ constructor(
 
   private val logger: Logger = LoggerFactory.getLogger(NavAuthVelocity::class.java)
 
-  // chicken or egg problem, unfortunately
-  var pluginInstance: Bootstrap? = null
   lateinit var injector: Injector
 
   lateinit var liteCommands: LiteCommands<CommandSource>
 
-  fun init() {
+  @Subscribe
+  fun onProxyInitializeEvent(event: ProxyInitializeEvent) {
     try {
       logger.info("Initializing NavAuth plugin...")
 
@@ -121,19 +131,10 @@ constructor(
 
       val apiImpl = injector.getInstance(NavAuthApiImpl::class.java)
       NavAuthAPI.setAPIInstance(apiImpl)
-    } catch (ex: Exception) {
-      logger.error("Could not initialize NavAuth plugin, shutting down the server...", ex)
-      proxyServer.shutdown(Component.text("NavAuth initialization failure"))
-    }
-  }
-
-  fun onProxyInitializeEvent(pluginInstance: Bootstrap) {
-    try {
-      this.pluginInstance = pluginInstance
 
       // initialize bstats
       val pluginId = 28777
-      metricsFactory.make(pluginInstance, pluginId)
+      metricsFactory.make(this, pluginId)
 
       registerListeners(injector)
       registerCommands(injector)
@@ -172,10 +173,10 @@ constructor(
 
   fun registerListeners(injector: Injector) {
     // register self as listener because of the shutdown event
-    proxyServer.eventManager.register(pluginInstance, this)
+    proxyServer.eventManager.register(this, this)
 
     val listeners = VelocityListenersRegistry.getWithInjection(injector)
-    listeners.forEach { proxyServer.eventManager.register(pluginInstance, it) }
+    listeners.forEach { proxyServer.eventManager.register(this, it) }
   }
 
   @Suppress("UNNECESSARY_SAFE_CALL")
@@ -187,8 +188,7 @@ constructor(
     logger.info("Goodbye!")
   }
 
-  override fun provideInstance(): Bootstrap {
-    require(pluginInstance != null) { "plugin was not initialized yet" }
-    return pluginInstance!!
+  override fun provideInstance(): NavAuthVelocity {
+    return this
   }
 }
diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/VelocityPluginProvider.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/VelocityPluginProvider.kt
index 980db744..9080b522 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/VelocityPluginProvider.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/VelocityPluginProvider.kt
@@ -19,5 +19,5 @@
 package pl.spcode.navauth.velocity
 
 interface VelocityPluginProvider {
-  fun provideInstance(): Bootstrap
+  fun provideInstance(): NavAuthVelocity
 }

From 071701a2005261246e3cd9c4e82be39e714ae4e0 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sun, 12 Jul 2026 01:49:56 +0200
Subject: [PATCH 22/31] fix: use MojangProfileService instead of ProfileService
 in CompositeProfileService

---
 .../navauth/common/infra/mojang/CompositeProfileService.kt      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/CompositeProfileService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/CompositeProfileService.kt
index fb224a52..c3efad7c 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/CompositeProfileService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/infra/mojang/CompositeProfileService.kt
@@ -31,7 +31,7 @@ class CompositeProfileService
 @Inject
 constructor(
   private val config: MojangAPIConfig,
-  private val mojangProfileService: ProfileService,
+  private val mojangProfileService: MojangProfileServiceImpl,
   private val mineToolsProfileService: MineToolsProfileService,
   private val profileCache: ProfileCache,
 ) : ProfileService {

From 25fc1deb9dcf2d70cd43f93d1443dba5cb75256b Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Sun, 12 Jul 2026 22:55:17 +0200
Subject: [PATCH 23/31] fix: don't self register velocity main class (already
 registered)

---
 .../main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt  | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt
index 8c795d90..ed447432 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/NavAuthVelocity.kt
@@ -172,9 +172,6 @@ constructor(
   }
 
   fun registerListeners(injector: Injector) {
-    // register self as listener because of the shutdown event
-    proxyServer.eventManager.register(this, this)
-
     val listeners = VelocityListenersRegistry.getWithInjection(injector)
     listeners.forEach { proxyServer.eventManager.register(this, it) }
   }

From 9b9bf48a9fe58b1920718d83e9fc0d4ef2b13e21 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Mon, 13 Jul 2026 08:01:47 +0200
Subject: [PATCH 24/31] fix same letter case username migration

---
 CHANGELOG.md                                                   | 1 +
 .../pl/spcode/navauth/common/application/user/UserService.kt   | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3682bfce..aa607d3b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@
 
 ### Fixes
 - fix register command always using BCrypt instead of the selected algo
+- fix same letter case username migration
 
 ### API
 ```diff
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
index 1b5d1f76..fe86d18f 100644
--- a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/application/user/UserService.kt
@@ -217,7 +217,8 @@ constructor(
     if (user.username == newUsername) throw IllegalArgumentException("username cannot be the same")
 
     val conflictingUser = userRepository.findByUsernameIgnoreCase(newUsername.value)
-    if (conflictingUser != null) throw UsernameAlreadyTakenException("username already taken")
+    if (conflictingUser != null && conflictingUser.uuid != user.uuid)
+      throw UsernameAlreadyTakenException("username already taken")
 
     val newUser = user.withNewUsername(newUsername)
     userRepository.save(newUser)

From 64d11741cdcb7540f9cbbf170fde9a4bee1e7c3a Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Mon, 13 Jul 2026 22:03:17 +0200
Subject: [PATCH 25/31] add UsernameResolutionServiceIntegrationTests

---
 .../app/UsernameResolutionTestExtension.kt    |  67 +++++
 .../test/kotlin/fake/FakeProfileService.kt    |  39 +++
 ...ernameResolutionServiceIntegrationTests.kt | 271 ++++++++++++++++++
 3 files changed, 377 insertions(+)
 create mode 100644 navauth-common/src/test/kotlin/extension/app/UsernameResolutionTestExtension.kt
 create mode 100644 navauth-common/src/test/kotlin/fake/FakeProfileService.kt
 create mode 100644 navauth-common/src/test/kotlin/integration/auth/UsernameResolutionServiceIntegrationTests.kt

diff --git a/navauth-common/src/test/kotlin/extension/app/UsernameResolutionTestExtension.kt b/navauth-common/src/test/kotlin/extension/app/UsernameResolutionTestExtension.kt
new file mode 100644
index 00000000..4f1cde2d
--- /dev/null
+++ b/navauth-common/src/test/kotlin/extension/app/UsernameResolutionTestExtension.kt
@@ -0,0 +1,67 @@
+/*
+ * NavAuth
+ * Copyright © 2025 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package extension.app
+
+import com.google.inject.AbstractModule
+import com.google.inject.Guice
+import com.google.inject.Injector
+import com.google.inject.util.Modules
+import fake.FakeProfileService
+import module.TestsConfigModule
+import org.junit.jupiter.api.extension.ExtensionContext
+import org.junit.jupiter.api.extension.TestInstancePostProcessor
+import pl.spcode.navauth.common.application.mojang.ProfileService
+import pl.spcode.navauth.common.infra.database.DatabaseManager
+import pl.spcode.navauth.common.module.DataPersistenceModule
+import pl.spcode.navauth.common.module.EventsModule
+import pl.spcode.navauth.common.module.HttpClientModule
+import pl.spcode.navauth.common.module.ServicesModule
+import utils.GuiceUtils
+
+class UsernameResolutionTestExtension : TestInstancePostProcessor {
+
+  private val fakeProfileService = FakeProfileService()
+
+  var injector: Injector =
+    Guice.createInjector(
+      Modules.override(
+          EventsModule(),
+          TestsConfigModule(),
+          HttpClientModule(),
+          DataPersistenceModule(),
+          ServicesModule(),
+        )
+        .with(
+          object : AbstractModule() {
+            override fun configure() {
+              bind(FakeProfileService::class.java).toInstance(fakeProfileService)
+              bind(ProfileService::class.java).toInstance(fakeProfileService)
+            }
+          }
+        )
+    )
+
+  init {
+    injector.getInstance(DatabaseManager::class.java).connectAndInit()
+  }
+
+  override fun postProcessTestInstance(testInstance: Any, context: ExtensionContext) {
+    GuiceUtils.Companion.injectToDeclaredFields(testInstance, injector)
+  }
+}
diff --git a/navauth-common/src/test/kotlin/fake/FakeProfileService.kt b/navauth-common/src/test/kotlin/fake/FakeProfileService.kt
new file mode 100644
index 00000000..1099f3e1
--- /dev/null
+++ b/navauth-common/src/test/kotlin/fake/FakeProfileService.kt
@@ -0,0 +1,39 @@
+/*
+ * NavAuth
+ * Copyright © 2025 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package fake
+
+import pl.spcode.navauth.common.application.mojang.ProfileService
+import pl.spcode.navauth.common.domain.mojang.MojangProfile
+import pl.spcode.navauth.common.domain.user.Username
+
+class FakeProfileService : ProfileService {
+  private val profiles = mutableMapOf<Username, MojangProfile>()
+
+  fun addProfile(username: Username, profile: MojangProfile) {
+    profiles[username] = profile
+  }
+
+  override fun fetchProfileInfo(usernameCaseIgnored: Username): MojangProfile? {
+    return profiles[usernameCaseIgnored]
+  }
+
+  fun reset() {
+    profiles.clear()
+  }
+}
diff --git a/navauth-common/src/test/kotlin/integration/auth/UsernameResolutionServiceIntegrationTests.kt b/navauth-common/src/test/kotlin/integration/auth/UsernameResolutionServiceIntegrationTests.kt
new file mode 100644
index 00000000..0e886dd1
--- /dev/null
+++ b/navauth-common/src/test/kotlin/integration/auth/UsernameResolutionServiceIntegrationTests.kt
@@ -0,0 +1,271 @@
+/*
+ * NavAuth
+ * Copyright © 2025 Oliwier Fijas (Navio1430)
+ *
+ * NavAuth is free software; You can redistribute it and/or modify it under the terms of:
+ * the GNU Affero General Public License version 3 as published by the Free Software Foundation.
+ *
+ * NavAuth is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with NavAuth. If not, see <https://www.gnu.org/licenses/>
+ * and navigate to version 3 of the GNU Affero General Public License.
+ *
+ */
+
+package integration.auth
+
+import com.google.inject.Inject
+import extension.app.UsernameResolutionTestExtension
+import fake.FakeProfileService
+import java.util.UUID
+import kotlin.test.assertEquals
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.extension.ExtendWith
+import pl.spcode.navauth.common.application.auth.username.PostUsernameResolutionState
+import pl.spcode.navauth.common.application.auth.username.UsernameResFailureReason
+import pl.spcode.navauth.common.application.auth.username.UsernameResResult
+import pl.spcode.navauth.common.application.auth.username.UsernameResolutionService
+import pl.spcode.navauth.common.application.user.UserService
+import pl.spcode.navauth.common.domain.auth.handshake.EncryptionType
+import pl.spcode.navauth.common.domain.mojang.MojangProfile
+import pl.spcode.navauth.common.domain.user.MojangId
+import pl.spcode.navauth.common.domain.user.User
+import pl.spcode.navauth.common.domain.user.UserRepository
+import pl.spcode.navauth.common.domain.user.UserUuid
+import pl.spcode.navauth.common.domain.user.Username
+import utils.generateRandomString
+import utils.invertCase
+
+@ExtendWith(UsernameResolutionTestExtension::class)
+class UsernameResolutionServiceIntegrationTests {
+
+  @Inject private lateinit var fakeProfileService: FakeProfileService
+  @Inject private lateinit var usernameResolutionService: UsernameResolutionService
+  @Inject private lateinit var userService: UserService
+  @Inject private lateinit var userRepository: UserRepository
+
+  @BeforeEach
+  fun setUp() {
+    fakeProfileService.reset()
+  }
+
+  @Test
+  fun `new premium user returns success premium encryption type`() {
+    val username = Username(generateRandomString(10))
+    fakeProfileService.addProfile(username, MojangProfile(MojangId(UUID.randomUUID()), username))
+
+    val result = usernameResolutionService.resolveUsernameConflicts(username, null)
+
+    assertEquals(
+      UsernameResResult.Success(
+        EncryptionType.ENFORCE_PREMIUM,
+        PostUsernameResolutionState.NEW_ACCOUNT,
+      ),
+      result,
+    )
+  }
+
+  @Test
+  fun `new nonpremium user returns success none encryption type`() {
+    val username = Username(generateRandomString(10))
+
+    val result = usernameResolutionService.resolveUsernameConflicts(username, null)
+
+    assertEquals(
+      UsernameResResult.Success(EncryptionType.NONE, PostUsernameResolutionState.NEW_ACCOUNT),
+      result,
+    )
+  }
+
+  @Test
+  fun `existing premium user same connection username returns success premium encryption`() {
+    val username = Username(generateRandomString(10))
+    val mojangId = MojangId(UUID.randomUUID())
+    val userUuid = UserUuid(UUID.randomUUID())
+    userRepository.save(User.premium(userUuid, username, mojangId))
+    fakeProfileService.addProfile(username, MojangProfile(mojangId, username))
+
+    val existingUser = userService.findUserByUsernameIgnoreCase(username.value)!!
+    val result = usernameResolutionService.resolveUsernameConflicts(username, existingUser)
+
+    assertEquals(
+      UsernameResResult.Success(
+        EncryptionType.ENFORCE_PREMIUM,
+        PostUsernameResolutionState.NO_CHANGE,
+      ),
+      result,
+    )
+  }
+
+  @Test
+  fun `existing nonpremium user same connection username returns success none encryption`() {
+    val username = Username(generateRandomString(10))
+    userRepository.save(User.nonPremium(UserUuid(UUID.randomUUID()), username))
+
+    val existingUser = userService.findUserByUsernameIgnoreCase(username.value)!!
+    val result = usernameResolutionService.resolveUsernameConflicts(username, existingUser)
+
+    assertEquals(
+      UsernameResResult.Success(EncryptionType.NONE, PostUsernameResolutionState.NO_CHANGE),
+      result,
+    )
+  }
+
+  @Test
+  fun `existing nonpremium user conflict with different case premium username returns failure`() {
+    val username = Username(generateRandomString(10))
+    val premiumUsername = Username(invertCase(username.value))
+    val premiumProfile = MojangProfile(MojangId(UUID.randomUUID()), premiumUsername)
+    fakeProfileService.addProfile(username, premiumProfile)
+    userRepository.save(User.nonPremium(UserUuid(UUID.randomUUID()), username))
+
+    val existingUser = userService.findUserByUsernameIgnoreCase(username.value)!!
+    val result = usernameResolutionService.resolveUsernameConflicts(username, existingUser)
+
+    assertEquals(
+      UsernameResResult.Failure(
+        UsernameResFailureReason.NonPremiumWithPremiumConflict(premiumUsername.value)
+      ),
+      result,
+    )
+  }
+
+  @Test
+  fun `premium username with existing nonpremium user and same username returns success`() {
+    val username = Username(generateRandomString(10))
+    fakeProfileService.addProfile(username, MojangProfile(MojangId(UUID.randomUUID()), username))
+    userRepository.save(User.nonPremium(UserUuid(UUID.randomUUID()), username))
+
+    val existingUser = userService.findUserByUsernameIgnoreCase(username.value)!!
+    val result = usernameResolutionService.resolveUsernameConflicts(username, existingUser)
+
+    assertEquals(
+      UsernameResResult.Success(
+        EncryptionType.NONE,
+        PostUsernameResolutionState.NONPREMIUM_WITH_SAME_PREMIUM_NICKNAME,
+      ),
+      result,
+    )
+  }
+
+  @Test
+  fun `existing nonpremium user different connection username failure`() {
+    val username = Username(generateRandomString(10))
+    val connUsername = Username(generateRandomString(10))
+    userRepository.save(User.nonPremium(UserUuid(UUID.randomUUID()), username))
+
+    val existingUser = userService.findUserByUsernameIgnoreCase(username.value)!!
+    val result = usernameResolutionService.resolveUsernameConflicts(connUsername, existingUser)
+
+    assertEquals(
+      UsernameResResult.Failure(
+        UsernameResFailureReason.NonPremiumUsernameNotIdentical(username.value)
+      ),
+      result,
+    )
+  }
+
+  @Test
+  fun `existing premium user different connection username failure`() {
+    val username = Username(generateRandomString(10))
+    val connUsername = Username(generateRandomString(10))
+    val mojangId = MojangId(UUID.randomUUID())
+    userRepository.save(User.premium(UserUuid(UUID.randomUUID()), username, mojangId))
+    fakeProfileService.addProfile(
+      connUsername,
+      MojangProfile(MojangId(UUID.randomUUID()), connUsername),
+    )
+
+    val existingUser = userService.findUserByUsernameIgnoreCase(username.value)!!
+    val result = usernameResolutionService.resolveUsernameConflicts(connUsername, existingUser)
+
+    assertEquals(
+      UsernameResResult.Failure(
+        UsernameResFailureReason.PremiumUsernameNotIdentical(username.value)
+      ),
+      result,
+    )
+  }
+
+  @Test
+  fun `migrates successfully with existing premium user and different mojang username`() {
+    val mojangId = MojangId(UUID.randomUUID())
+    val existingUsername = Username(generateRandomString(10))
+    val newUsername = Username(generateRandomString(10))
+    userRepository.save(User.premium(UserUuid(UUID.randomUUID()), existingUsername, mojangId))
+    fakeProfileService.addProfile(newUsername, MojangProfile(mojangId, newUsername))
+
+    val result = usernameResolutionService.resolveUsernameConflicts(newUsername, null)
+
+    assertEquals(
+      UsernameResResult.Success(
+        EncryptionType.ENFORCE_PREMIUM,
+        PostUsernameResolutionState.PREMIUM_USERNAME_MIGRATED,
+      ),
+      result,
+    )
+  }
+
+  @Test
+  fun `migrates successfully with existing premium user and different letter case mojang username`() {
+    val mojangId = MojangId(UUID.randomUUID())
+    val existingUsername = Username(generateRandomString(10))
+    val newUsername = Username(invertCase(existingUsername.value))
+    userRepository.save(User.premium(UserUuid(UUID.randomUUID()), existingUsername, mojangId))
+    fakeProfileService.addProfile(newUsername, MojangProfile(mojangId, newUsername))
+
+    val result = usernameResolutionService.resolveUsernameConflicts(newUsername, null)
+
+    assertEquals(
+      UsernameResResult.Success(
+        EncryptionType.ENFORCE_PREMIUM,
+        PostUsernameResolutionState.PREMIUM_USERNAME_MIGRATED,
+      ),
+      result,
+    )
+  }
+
+  @Test
+  fun `existing nonpremium user with premium player who renamed to same name`() {
+    val nonPremiumUuid = UserUuid(UUID.randomUUID())
+    val username = Username(generateRandomString(10))
+    fakeProfileService.addProfile(username, MojangProfile(MojangId(UUID.randomUUID()), username))
+    userRepository.save(User.nonPremium(nonPremiumUuid, username))
+
+    val existingUser = userService.findUserByUsernameIgnoreCase(username.value)!!
+    val result = usernameResolutionService.resolveUsernameConflicts(username, existingUser)
+
+    assertEquals(
+      UsernameResResult.Success(
+        EncryptionType.NONE,
+        PostUsernameResolutionState.NONPREMIUM_WITH_SAME_PREMIUM_NICKNAME,
+      ),
+      result,
+    )
+  }
+
+  @Test
+  fun `existing premium user with different case mojang username found by case-insensitive lookup migrates successfully`() {
+    val mojangId = MojangId(UUID.randomUUID())
+    val existingUsername = Username(generateRandomString(10))
+    val newUsername = Username(invertCase(existingUsername.value))
+    userRepository.save(User.premium(UserUuid(UUID.randomUUID()), existingUsername, mojangId))
+    fakeProfileService.addProfile(newUsername, MojangProfile(mojangId, newUsername))
+
+    val existingUser = userService.findUserByUsernameIgnoreCase(newUsername.value)!!
+    val result = usernameResolutionService.resolveUsernameConflicts(newUsername, existingUser)
+
+    assertEquals(
+      UsernameResResult.Success(
+        EncryptionType.ENFORCE_PREMIUM,
+        PostUsernameResolutionState.PREMIUM_USERNAME_MIGRATED,
+      ),
+      result,
+    )
+  }
+}

From 6ab7ea19597f9e7c67e544ac563acfc69482cb61 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Wed, 22 Jul 2026 19:46:28 +0200
Subject: [PATCH 26/31] changelog typo

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index aa607d3b..a657a9c1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,7 +13,7 @@
 
 ### Fixes
 - fix register command always using BCrypt instead of the selected algo
-- fix same letter case username migration
+- fix different letter case same username migration
 
 ### API
 ```diff

From 909fb38165bc74ead3dee637c2a1d707c4d12e2c Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Wed, 22 Jul 2026 20:02:32 +0200
Subject: [PATCH 27/31] fix: re-fetch user for handshake session after username
 resolution changes

---
 .../velocity/listener/velocity/LoginListeners.kt  | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/LoginListeners.kt b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/LoginListeners.kt
index c881c490..366ff91a 100644
--- a/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/LoginListeners.kt
+++ b/navauth-velocity/src/main/kotlin/pl/spcode/navauth/velocity/listener/velocity/LoginListeners.kt
@@ -30,13 +30,13 @@ import net.kyori.adventure.text.Component
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
 import pl.spcode.navauth.common.application.auth.handshake.AuthHandshakeSessionService
+import pl.spcode.navauth.common.application.auth.username.PostUsernameResolutionState
 import pl.spcode.navauth.common.application.auth.username.UsernameResFailureReason
 import pl.spcode.navauth.common.application.auth.username.UsernameResResult
 import pl.spcode.navauth.common.application.auth.username.UsernameResolutionService
 import pl.spcode.navauth.common.application.user.UserService
 import pl.spcode.navauth.common.application.validator.UsernameValidator
 import pl.spcode.navauth.common.component.TextColors
-import pl.spcode.navauth.common.component.TextComponent
 import pl.spcode.navauth.common.config.GeneralConfig
 import pl.spcode.navauth.common.config.MessagesConfig
 import pl.spcode.navauth.common.domain.auth.handshake.AuthHandshakeSession
@@ -131,9 +131,20 @@ constructor(
       return
     }
 
+    val sessionUser =
+      if (
+        res is UsernameResResult.Success &&
+          res.postResolutionState != PostUsernameResolutionState.NO_CHANGE
+      ) {
+        // re-fetch if any change occurred
+        userService.findUserByUsernameIgnoreCase(connUsername)
+      } else {
+        existingUser
+      }
+
     authHandshakeSessionService.createSession(
       VelocityUniqueSessionId(connUsername, event.connection.remoteAddress),
-      existingUser,
+      sessionUser,
       connUsername,
       res,
     )

From 1ee363f27036877b4ff54e5417899ff67503bf68 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Wed, 22 Jul 2026 20:12:15 +0200
Subject: [PATCH 28/31] update readme

---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 3689492a..849e5af6 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,11 @@ We are working on additional configuration options and other improvements to pre
 - **[Multification](https://navio1430.github.io/NavAuth/docs/configuration/multification.html)**
 - [Migration from other plugins](https://navio1430.github.io/NavAuth/docs/migration/migration.html)
 - [Database type migrations](https://navio1430.github.io/NavAuth/docs/migration/database-type-migration.html)
+- Configurable encryption queue
+- Configurable external Mojang profile API usage
+
+### 🧩 Integrations
+- AjQueue integration 
 
 ### 🔒 In NavAuth password cracking takes more than TWELVE TRILLION (1.2 × 10^13) times longer than in the worst login plugins.
 Cracking the whole database of a bad plugin takes less than a **FEW MINUTES**.

From fb4fb0e187b82cef549ec35abe3dba29b4aa61ed Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Thu, 23 Jul 2026 03:07:50 +0200
Subject: [PATCH 29/31] ajqueue: add navauth version check

---
 integration/ajqueue/build.gradle.kts          |  3 +
 .../BuildParameters.kt.peb                    |  1 +
 .../ajqueue/AjQueueIntegrationPlugin.kt       | 30 +++++++++
 .../common/shared/utils/VersionUtils.kt       | 24 +++++++
 .../kotlin/unit/shared/VersionUtilsTests.kt   | 63 +++++++++++++++++++
 .../src/test/kotlin/utils/StringUtils.kt      |  5 +-
 6 files changed, 124 insertions(+), 2 deletions(-)
 create mode 100644 navauth-common/src/main/kotlin/pl/spcode/navauth/common/shared/utils/VersionUtils.kt
 create mode 100644 navauth-common/src/test/kotlin/unit/shared/VersionUtilsTests.kt

diff --git a/integration/ajqueue/build.gradle.kts b/integration/ajqueue/build.gradle.kts
index 5e495800..8b5da775 100644
--- a/integration/ajqueue/build.gradle.kts
+++ b/integration/ajqueue/build.gradle.kts
@@ -10,11 +10,14 @@ val projectName = "navauth-ajqueue-integration"
 group = "pl.spcode.navauth"
 version = "1.0.0-SNAPSHOT"
 
+val requiredMinNavAuthVersion = "0.2.0" // always X.Y.Z format
+
 sourceSets {
   main {
     blossom {
       kotlinSources {
         property("version", project.version.toString())
+        property("requiredMinNavAuthVersion", requiredMinNavAuthVersion)
       }
     }
   }
diff --git a/integration/ajqueue/src/main/kotlin-templates/pl/spcode/navauth.integration.ajqueue/BuildParameters.kt.peb b/integration/ajqueue/src/main/kotlin-templates/pl/spcode/navauth.integration.ajqueue/BuildParameters.kt.peb
index df695aaa..f19e87b4 100644
--- a/integration/ajqueue/src/main/kotlin-templates/pl/spcode/navauth.integration.ajqueue/BuildParameters.kt.peb
+++ b/integration/ajqueue/src/main/kotlin-templates/pl/spcode/navauth.integration.ajqueue/BuildParameters.kt.peb
@@ -3,5 +3,6 @@ package pl.spcode.navauth.integration.ajqueue
 class BuildParameters {
   companion object {
     const val VERSION = "{{ version }}"
+    const val REQUIRED_MIN_NAVAUTH_VERSION = "{{ requiredMinNavAuthVersion }}"
   }
 }
diff --git a/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt
index 5a510461..8e28365f 100644
--- a/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt
+++ b/integration/ajqueue/src/main/kotlin/pl/spcode/navauth/integration/ajqueue/AjQueueIntegrationPlugin.kt
@@ -25,10 +25,13 @@ import com.velocitypowered.api.event.proxy.ProxyInitializeEvent
 import com.velocitypowered.api.plugin.Dependency
 import com.velocitypowered.api.plugin.Plugin
 import com.velocitypowered.api.plugin.annotation.DataDirectory
+import com.velocitypowered.api.proxy.ProxyServer
 import java.nio.file.Path
+import net.kyori.adventure.text.Component
 import org.slf4j.Logger
 import pl.spcode.navauth.api.NavAuthAPI
 import pl.spcode.navauth.common.module.YamlConfigModule
+import pl.spcode.navauth.common.shared.utils.VersionUtils
 import pl.spcode.navauth.integration.ajqueue.config.GeneralConfig
 import pl.spcode.navauth.integration.ajqueue.listener.AjQueueListeners
 import pl.spcode.navauth.integration.ajqueue.listener.NavAuthListeners
@@ -46,6 +49,7 @@ constructor(
   val parentInjector: Injector,
   @param:DataDirectory val dataDirectory: Path,
   val logger: Logger,
+  val proxyServer: ProxyServer,
 ) {
 
   @Subscribe
@@ -53,6 +57,31 @@ constructor(
     try {
       logger.info("Initializing NavAuth AJQueue integration...")
 
+      val navAuthVersion =
+        VersionUtils.parseVersion(
+          proxyServer.pluginManager
+            .getPlugin("navauth")
+            .orElseThrow { RuntimeException("NavAuth plugin not found") }
+            .description
+            .version
+            .get()
+        )
+      val requiredVersion = VersionUtils.parseVersion(BuildParameters.REQUIRED_MIN_NAVAUTH_VERSION)
+
+      if (VersionUtils.isVersionOlderThan(navAuthVersion, requiredVersion)) {
+        logger.error(
+          """
+          |NavAuth version {} is too old. Required minimum version is {}.
+          |Please update NavAuth to at least version {}.
+          |Download the latest version from: https://github.com/Navio1430/NavAuth"""
+            .trimMargin(),
+          navAuthVersion,
+          requiredVersion,
+          requiredVersion,
+        )
+        return
+      }
+
       val configModule =
         YamlConfigModule(GeneralConfig::class, dataDirectory.resolve("config.yml").toFile())
 
@@ -67,6 +96,7 @@ constructor(
       logger.info("NavAuth AJQueue integration initialized successfully")
     } catch (ex: Exception) {
       logger.error("Failed to initialize NavAuth AJQueue integration", ex)
+      proxyServer.shutdown(Component.text("Failed to initialize NavAuth AJQueue integration"))
     }
   }
 }
diff --git a/navauth-common/src/main/kotlin/pl/spcode/navauth/common/shared/utils/VersionUtils.kt b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/shared/utils/VersionUtils.kt
new file mode 100644
index 00000000..edce9f9d
--- /dev/null
+++ b/navauth-common/src/main/kotlin/pl/spcode/navauth/common/shared/utils/VersionUtils.kt
@@ -0,0 +1,24 @@
+package pl.spcode.navauth.common.shared.utils
+
+class VersionUtils {
+
+  companion object {
+    private val semverRegex = Regex("""(\d+\.\d+\.\d+)""")
+
+    fun parseVersion(version: String): String {
+      return semverRegex.find(version)?.value ?: version
+    }
+
+    fun isVersionOlderThan(version: String, minimum: String): Boolean {
+      val versionParts = parseVersion(version).split(".").map { it.toIntOrNull() ?: 0 }
+      val minParts = parseVersion(minimum).split(".").map { it.toIntOrNull() ?: 0 }
+
+      if (versionParts.size < 3 || minParts.size < 3) return true
+      if (versionParts[0] < minParts[0]) return true
+      if (versionParts[0] == minParts[0] && versionParts[1] < minParts[1]) return true
+      return versionParts[0] == minParts[0] &&
+        versionParts[1] == minParts[1] &&
+        versionParts[2] < minParts[2]
+    }
+  }
+}
diff --git a/navauth-common/src/test/kotlin/unit/shared/VersionUtilsTests.kt b/navauth-common/src/test/kotlin/unit/shared/VersionUtilsTests.kt
new file mode 100644
index 00000000..639249b2
--- /dev/null
+++ b/navauth-common/src/test/kotlin/unit/shared/VersionUtilsTests.kt
@@ -0,0 +1,63 @@
+package unit.shared
+
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFalse
+import kotlin.test.assertTrue
+import pl.spcode.navauth.common.shared.utils.VersionUtils
+import utils.generateRandomString
+
+class VersionUtilsTests {
+
+  @Test
+  fun `parseVersion strips prefix and suffix`() {
+    val suffix = generateRandomString(5).dropWhile { it.digitToIntOrNull() != null }
+    val prefix = generateRandomString(5).dropLastWhile { it.digitToIntOrNull() != null }
+    assertEquals("0.2.0", VersionUtils.parseVersion("${prefix}0.2.0$suffix"))
+  }
+
+  @Test
+  fun `parseVersion returns plain version as-is`() {
+    assertEquals("0.2.0", VersionUtils.parseVersion("0.2.0"))
+  }
+
+  @Test
+  fun `isVersionOlderThan returns true when version is older`() {
+    assertTrue(VersionUtils.isVersionOlderThan("0.1.9", "0.2.0"))
+  }
+
+  @Test
+  fun `isVersionOlderThan returns true when major is older`() {
+    assertTrue(VersionUtils.isVersionOlderThan("0.2.0", "1.0.0"))
+  }
+
+  @Test
+  fun `isVersionOlderThan returns false when version equals minimum`() {
+    assertFalse(VersionUtils.isVersionOlderThan("0.2.0", "0.2.0"))
+  }
+
+  @Test
+  fun `isVersionOlderThan returns false when version is newer`() {
+    assertFalse(VersionUtils.isVersionOlderThan("0.2.1", "0.2.0"))
+  }
+
+  @Test
+  fun `isVersionOlderThan returns false when version is newer on minor`() {
+    assertFalse(VersionUtils.isVersionOlderThan("0.3.0", "0.2.0"))
+  }
+
+  @Test
+  fun `isVersionOlderThan handles SNAPSHOT versions correctly`() {
+    assertFalse(VersionUtils.isVersionOlderThan("0.2.0-SNAPSHOT", "0.2.0"))
+  }
+
+  @Test
+  fun `isVersionOlderThan handles newer SNAPSHOT correctly`() {
+    assertFalse(VersionUtils.isVersionOlderThan("0.2.1-SNAPSHOT", "0.2.0"))
+  }
+
+  @Test
+  fun `isVersionOlderThan handles older SNAPSHOT correctly`() {
+    assertTrue(VersionUtils.isVersionOlderThan("0.1.9-SNAPSHOT", "0.2.0"))
+  }
+}
diff --git a/navauth-common/src/test/kotlin/utils/StringUtils.kt b/navauth-common/src/test/kotlin/utils/StringUtils.kt
index 21e54404..82e85e9d 100644
--- a/navauth-common/src/test/kotlin/utils/StringUtils.kt
+++ b/navauth-common/src/test/kotlin/utils/StringUtils.kt
@@ -18,8 +18,9 @@
 
 package utils
 
-fun generateRandomString(length: Int): String {
-  val allowedChars = ('A'..'Z') + ('a'..'z') + ('0'..'9')
+fun generateRandomString(length: Int, withNumbers: Boolean = true): String {
+  val allowedChars =
+    if (withNumbers) ('A'..'Z') + ('a'..'z') + ('0'..'9') else ('A'..'Z') + ('a'..'z')
   return (1..length).map { allowedChars.random() }.joinToString("")
 }
 

From 47437adb06790c4fea6584d9a5671379c5f04c27 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Thu, 23 Jul 2026 03:08:02 +0200
Subject: [PATCH 30/31] docs: add AjQueue integration info

---
 docs/docs/integrations/ajqueue.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 docs/docs/integrations/ajqueue.md

diff --git a/docs/docs/integrations/ajqueue.md b/docs/docs/integrations/ajqueue.md
new file mode 100644
index 00000000..b8eca615
--- /dev/null
+++ b/docs/docs/integrations/ajqueue.md
@@ -0,0 +1,25 @@
+# AjQueue Integration
+
+NavAuth provides a separate plugin that integrates with [AjQueue](https://www.spigotmc.org/resources/ajqueue.99086/), a popular queue management system for Velocity proxy.
+
+## How it Works
+
+The integration plugin listens for NavAuth's `UserAuthenticatedEvent`. When a player successfully authenticates, the plugin automatically adds them to a configurable AjQueue queue.
+
+Additionally, it can optionally cancel AjQueue's `PreQueueEvent` for players who are **not yet authenticated**, preventing unauthenticated players from joining a server through the queue.
+
+## Features
+
+- Automatically adds authenticated players to a specified AjQueue queue
+- Optionally block queue join for unauthenticated players
+- Configurable failure handling (message + optional kick)
+
+## Download
+
+The integration plugin jar is available on the [GitHub releases page](https://github.com/Navio1430/NavAuth).
+
+## Installation
+
+1. Place the `navauth-ajqueue-integration-XXX.jar` in your Velocity server's `plugins/` directory
+2. Ensure both **NavAuth** and **AjQueue** are installed
+3. Restart your proxy

From 9afd76d844a6733f99d32e52095ca54b4fe3ce29 Mon Sep 17 00:00:00 2001
From: Navio1430 <naviodev@gmail.com>
Date: Thu, 23 Jul 2026 03:08:43 +0200
Subject: [PATCH 31/31] update changelog

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a657a9c1..49eb1daa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -40,3 +40,6 @@
 ### New integration for AjQueue (as a separate plugin)
 - Automatically adds authenticated players to a configurable AjQueue queue
 - Optionally cancel AjQueue `PreQueueEvent` for unauthenticated players
+
+### Docs
+- AjQueue integration info