SnUserTransfer changelog

Changes

• First stable release. Migrates all of a player's saved plugin data from one account to another across every plugin on the server (SQLite, H2, MySQL, YAML/JSON and per-player files), with preview, automatic backups, undo and a restart queue for stores that cannot be written while the server runs.
• Hardened bundle license client (request-bound startup, asynchronous revalidation with bounded grace). The key stays in the shared plugins/.Sn-License/license.yml.
• Runtime-key string protection on the transfer orchestrator, the command tree and the startup-queue staff notifier: their string literals are decrypted only with the per-build key the license backend delivers after authentication.
• No command, permission, configuration or behavior change from 0.13.0.
• Documentation: the SnUserTransfer section of the Sn GitBook.

Fix round from the first live smoke test on Gens-Dev. Chasing a LuckPerms failure uncovered a much larger defect than the one reported.

H2 support never worked in 0.12.0

H2 was shaded and relocated. An MVStore file stores the fully-qualified org.h2.* DataType class names inside the file and resolves them with Class.forName, so a relocated driver dies with ClassNotFoundException: org.h2.mvstore.tx.VersionedValueType$Factory on the first page read. Reproduced against the shipped 0.12.0 jar: it cannot read a single foreign H2 store, of either format. The names come from data, so no shade configuration can fix it. Nothing caught it because our own tests only ever opened stores our own relocated driver had created.

Both H2 2.1.214 and 2.3.232 now ship unrelocated as drivers/ resources, each loaded in a private URLClassLoader parented to the platform loader, routed by the store's own MVStore header. Two versions are required: the format changed between H2 2.1 (format:2, what LuckPerms writes) and 2.2+ (format:3), and neither reads the other's files. Verified through the built obfuscated jar against a real 16 MB LuckPerms store: 49578 rows.

Engine

• A composite-key collision (snbans_logins PRIMARY KEY(uuid, ip), both accounts seen from one IP) no longer fails the whole store. The table runs in a savepoint and, on a duplicate-key violation only, retries row by row. A colliding row is left entirely under the old identity, never as a hybrid with the old uuid and the new name.
• FOREIGN KEY / CHECK / NOT NULL still fail the store loudly. Routing them into the row retry made a store commit having transferred nothing while reporting success.
• The row-by-row pass decides matches in SQL, under the store's collation, not in Java. On an accent- or padding-insensitive collation the two disagree and a cell was silently left behind, counted in nothing and reported in nothing.
• A half-read primary key no longer promotes a component to a single-column row identifier, where it could drive the overwrite DELETE and destroy third parties' rows.
• Nick writes preserve the stored case, in the DB engine, the file content rewriter and per-player file renames. LuckPerms keeps usernames lowercase and looks them up lowercased.
• A per-player file rename resolves its destination case-insensitively, so an existing file differing only in case is backed up and replaced rather than orphaned alongside a second file.

Discovery

• address / db-name / user-name vocabulary, address: host:port split, storage-method as a backend selector.
• Inherited boolean dormancy toggles (enabled / use / active: false), so a disabled MySQL block is no longer connected to and timed out on.
• A document-root selector no longer silently suppresses a live store when the file also selects MySQL elsewhere (LuckPerms split-storage).
• Language files are skipped for credential sniffing only; they remain normal rewrite targets.
• YAML failures say which one they are, with the parser's own message, instead of one merged "too large or unparseable" line.

Reporting

• The report no longer prints every omission twice: 20 of the 50 bullet lines in the live report were exact duplicates.
• The queue path logs failure and omission text to console and names the report file. In 0.12.0 the reason a boot-time store failed was unreachable.

Upgrading

scan.excluded-plugins will not pick up its new defaults on an existing install: key auto-merge only adds missing keys and must never overwrite a chosen value, and 0.12.0 wrote excluded-plugins: []. Delete that line from plugins/SnUserTransfer/config.yml or set it to [".paper-remapped", ".Sn-License"].

SHA-256 706ec92f73927a55d2145bed63d9d5d5a03da2db4555e895abf10a6682504b35

Development release. Not v1.0.0, and not recommended for a production migration yet.

Output of a full safety audit of the transfer and undo paths: 59 findings fixed across four rounds, with independent blind verification of every fix.

Highlights

• The undo now takes its own backup before overwriting anything, so a mistaken or stale undo is itself reversible. It previously took none.
• Backup-before-write now holds on every path, including the queue replay that runs at server start.
• The overwrite DELETE is confined to columns that identify a row on their own, so a reference column such as friend_uuid can no longer remove other players' rows.
• The login gate closes the window where a player could join during the write.
• Files and database tables are size- and row-bounded, so a very large foreign store is reported and skipped instead of exhausting the heap during startup.
• Rows replaced by a transfer are now reported in chat, the report file and transfers.log.
• Discovery reports what it decided not to touch: dormant credential blocks, settings in key names it cannot parse, and stores two plugins both claim.

Upgrading

• BREAKING (since 0.9.0): the permission tree is now snusertransfer.* instead of sntransfer.*. The command and its aliases (/sntransfer, /snt) are unchanged. Re-grant any rank that previously had sntransfer.*.
• NEW: optional --uuid on preview and apply. On an online-mode server, a target account the server has never seen is now refused rather than migrated to a UUID derived from its name, which would have belonged to no account. Pass the real UUID, or let the account log in once. Offline-mode servers are unaffected.

Operator notes

• Backup and queue files under the plugin's data folder contain the connection settings of the plugins being migrated, including database passwords. Treat that folder as a secret and do not attach it to a public bug report.
• Always run preview before apply, and read the omission lines: they list every store the tool decided not to touch and why.
• This release has not yet been runtime-confirmed on a production server.