Class ServerAuthManager

java.lang.Object
com.hypixel.hytale.server.core.auth.ServerAuthManager
public class ServerAuthManager extends Object
Manages the server's authentication credentials for mutual authentication.

Supports multiple authentication modes:

  • Singleplayer: Child session tokens from client via CLI, server manages refresh
  • External Session: Hosting provider manages tokens externally, server auto-refreshes
  • OAuth Browser: Local browser-based PKCE flow for self-hosted servers
  • OAuth Device: Device authorization flow for headless/remote servers
  • OAuth Store: Refresh/Access token being provided through a programmatically registered store

  • Method Details

    • getInstance

      public static ServerAuthManager getInstance()
      Gets the singleton instance.

    • getProfileServiceClient

      @Nonnull public ProfileServiceClient getProfileServiceClient()
      Gets the Profile Service client, initializing it lazily if needed.
      Returns:
      The Profile Service client

    • initialize

      public void initialize()
      Initializes the server auth manager with CLI options and environment. Called after Options.parse() completes.

      Note: Credential store is NOT initialized here - call initializeCredentialStore() after plugins have had a chance to register custom providers.

    • checkPendingFatalError

      public void checkPendingFatalError()
      Checks for pending fatal errors from token validation. If tokens failed validation at startup, shuts down with AUTH_FAILED.

    • initializeCredentialStore

      public void initializeCredentialStore()
      Initializes the credential store from config. Called after plugins have had a chance to register custom providers. If the store contains saved credentials, attempts to restore the session.

    • shutdown

      public void shutdown()

    • logout

      public void logout()

    • getGameSession

      @Nullable public SessionServiceClient.GameSessionResponse getGameSession()

    • setGameSession

      public void setGameSession(@Nonnull SessionServiceClient.GameSessionResponse session)

    • getIdentityToken

      @Nullable public String getIdentityToken()

    • getSessionToken

      @Nullable public String getSessionToken()

    • hasIdentityToken

      public boolean hasIdentityToken()

    • hasSessionToken

      public boolean hasSessionToken()

    • getOAuthAccessToken

      @Nullable public String getOAuthAccessToken()
      Gets the OAuth access token, refreshing if necessary. This token can be used to authenticate with services that accept OAuth bearer tokens (e.g., account-data service for game-assets).

    • setServerCertificate

      public void setServerCertificate(@Nonnull X509Certificate certificate)

    • getServerCertificate

      @Nullable public X509Certificate getServerCertificate()

    • getServerCertificateFingerprint

      @Nullable public String getServerCertificateFingerprint()

    • getServerSessionId

      @Nonnull public UUID getServerSessionId()
      Gets the server's unique session ID, generated at boot. Used as the JWT audience for player auth tokens to ensure tokens are scoped to this server instance.

    • getAuthMode

      public ServerAuthManager.AuthMode getAuthMode()

    • isSingleplayer

      public boolean isSingleplayer()

    • isOwner

      public boolean isOwner(@Nullable UUID playerUuid)

    • getSelectedProfile

      @Nullable public SessionServiceClient.GameProfile getSelectedProfile()

    • getTokenExpiry

      @Nullable public Instant getTokenExpiry()

    • getAuthStatus

      public String getAuthStatus()

    • startFlowAsync

      public CompletableFuture<ServerAuthManager.AuthResult> startFlowAsync(@Nonnull OAuthBrowserFlow flow)

    • startFlowAsync

      public CompletableFuture<ServerAuthManager.AuthResult> startFlowAsync(OAuthDeviceFlow flow)

    • registerCredentialStore

      public CompletableFuture<ServerAuthManager.AuthResult> registerCredentialStore(IAuthCredentialStore store)

    • swapCredentialStoreProvider

      public void swapCredentialStoreProvider(@Nonnull AuthCredentialStoreProvider provider)
      Swaps the credential store to one created by the given provider. Migrates any existing tokens to the new store.
      Parameters:
      provider - The provider to create the new store from

    • cancelActiveFlow

      public boolean cancelActiveFlow()
      Cancels any pending OAuth authentication flow.
      Returns:
      true if a flow was cancelled, false if none was active

    • getPendingProfiles

      @Nullable public SessionServiceClient.GameProfile[] getPendingProfiles()
      Returns the pending profiles awaiting selection, or null if none.

    • hasPendingProfiles

      public boolean hasPendingProfiles()
      Returns true if there are pending profiles awaiting selection.

    • selectPendingProfile

      public boolean selectPendingProfile(int index)
      Selects a pending profile by index (1-based).
      Parameters:
      index - 1-based index of the profile to select
      Returns:
      true if selection succeeded, false otherwise

    • selectPendingProfileByUsername

      public boolean selectPendingProfileByUsername(String username)
      Selects a pending profile by username.
      Parameters:
      username - The username to select
      Returns:
      true if selection succeeded, false otherwise

    • clearPendingProfiles

      public void clearPendingProfiles()
      Clears pending profile selection.