🆙 Bump version to 4.1.16 [skip ci]

Dev

Database Updates/010_Wired_Update.sql

@@ -1,989 +0,0 @@
-UPDATE emulator_settings SET `value` = '1' WHERE (`key` = 'wired.engine.enabled');
-UPDATE emulator_settings SET `value` = '1' WHERE (`key` = 'wired.engine.exclusive');
-
-ALTER TABLE emulator_settings
-ADD COLUMN IF NOT EXISTS `comment` VARCHAR(255) NOT NULL AFTER `value`;
-
-
-CREATE TABLE IF NOT EXISTS `catalog_items_bc` (
-  `id` int(11) NOT NULL AUTO_INCREMENT,
-  `item_ids` varchar(666) NOT NULL,
-  `page_id` int(11) NOT NULL,
-  `catalog_name` varchar(100) NOT NULL,
-  `order_number` int(11) NOT NULL DEFAULT 1,
-  `extradata` varchar(500) NOT NULL DEFAULT '',
-  PRIMARY KEY (`id`) USING BTREE
-) ENGINE=InnoDB AUTO_INCREMENT=21 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci ROW_FORMAT=DYNAMIC;
-
-CREATE TABLE IF NOT EXISTS `catalog_pages_bc` (
-  `id` int(11) NOT NULL AUTO_INCREMENT,
-  `parent_id` int(11) NOT NULL DEFAULT -1,
-  `caption` varchar(128) NOT NULL,
-  `page_layout` enum(
-    'default_3x3','club_buy','club_gift','frontpage','spaces','recycler',
-    'recycler_info','recycler_prizes','trophies','plasto','marketplace',
-    'marketplace_own_items','spaces_new','soundmachine','guilds','guild_furni',
-    'info_duckets','info_rentables','info_pets','roomads','single_bundle',
-    'sold_ltd_items','badge_display','bots','pets','pets2','pets3',
-    'productpage1','room_bundle','recent_purchases',
-    'default_3x3_color_grouping','guild_forum','vip_buy','info_loyalty',
-    'loyalty_vip_buy','collectibles','petcustomization','frontpage_featured'
-  ) NOT NULL DEFAULT 'default_3x3',
-  `icon_color` int(11) NOT NULL DEFAULT 1,
-  `icon_image` int(11) NOT NULL DEFAULT 1,
-  `order_num` int(11) NOT NULL DEFAULT 1,
-  `visible` enum('0','1') NOT NULL DEFAULT '1',
-  `enabled` enum('0','1') NOT NULL DEFAULT '1',
-  `page_headline` varchar(1024) NOT NULL DEFAULT '',
-  `page_teaser` varchar(64) NOT NULL DEFAULT '',
-  `page_special` varchar(2048) DEFAULT '' COMMENT 'Gold Bubble: catalog_special_txtbg1 // Speech Bubble: catalog_special_txtbg2 // Place normal text in page_text_teaser',
-  `page_text1` text DEFAULT NULL,
-  `page_text2` text DEFAULT NULL,
-  `page_text_details` text DEFAULT NULL,
-  `page_text_teaser` text DEFAULT NULL,
-  PRIMARY KEY (`id`) USING BTREE
-) ENGINE=MyISAM AUTO_INCREMENT=9 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci ROW_FORMAT=DYNAMIC;
-
-ALTER TABLE `catalog_club_offers`
-MODIFY COLUMN `type` ENUM('HC','VIP','BUILDERS_CLUB','BUILDERS_CLUB_ADDON') NOT NULL DEFAULT 'HC';
-
-ALTER TABLE `catalog_pages`
-  MODIFY COLUMN `page_layout` ENUM(
-    'default_3x3',
-    'club_buy',
-    'club_gift',
-    'frontpage',
-    'spaces',
-    'recycler',
-    'recycler_info',
-    'recycler_prizes',
-    'trophies',
-    'plasto',
-    'marketplace',
-    'marketplace_own_items',
-    'spaces_new',
-    'soundmachine',
-    'guilds',
-    'guild_furni',
-    'info_duckets',
-    'info_rentables',
-    'info_pets',
-    'roomads',
-    'single_bundle',
-    'sold_ltd_items',
-    'badge_display',
-    'bots',
-    'pets',
-    'pets2',
-    'pets3',
-    'productpage1',
-    'room_bundle',
-    'recent_purchases',
-    'default_3x3_color_grouping',
-    'guild_forum',
-    'vip_buy',
-    'info_loyalty',
-    'loyalty_vip_buy',
-    'collectibles',
-    'petcustomization',
-    'frontpage_featured',
-    'builders_club_frontpage',
-    'builders_club_addons',
-    'builders_club_loyalty'
-  ) NOT NULL DEFAULT 'default_3x3';
-
-ALTER TABLE `catalog_pages`
-ADD COLUMN IF NOT EXISTS `catalog_mode` ENUM('NORMAL','BUILDER','BOTH') NOT NULL DEFAULT 'NORMAL'
-AFTER `club_only`;
-
-ALTER TABLE `catalog_pages_bc`
-  MODIFY COLUMN `page_layout` ENUM(
-    'default_3x3',
-    'club_buy',
-    'club_gift',
-    'frontpage',
-    'spaces',
-    'recycler',
-    'recycler_info',
-    'recycler_prizes',
-    'trophies',
-    'plasto',
-    'marketplace',
-    'marketplace_own_items',
-    'spaces_new',
-    'soundmachine',
-    'guilds',
-    'guild_furni',
-    'info_duckets',
-    'info_rentables',
-    'info_pets',
-    'roomads',
-    'single_bundle',
-    'sold_ltd_items',
-    'badge_display',
-    'bots',
-    'pets',
-    'pets2',
-    'pets3',
-    'productpage1',
-    'room_bundle',
-    'recent_purchases',
-    'default_3x3_color_grouping',
-    'guild_forum',
-    'vip_buy',
-    'info_loyalty',
-    'loyalty_vip_buy',
-    'collectibles',
-    'petcustomization',
-    'frontpage_featured',
-    'builders_club_frontpage',
-    'builders_club_addons',
-    'builders_club_loyalty'
-  ) NOT NULL DEFAULT 'default_3x3';
-
-SET @col_exists := (
-  SELECT COUNT(*) FROM information_schema.COLUMNS
-  WHERE TABLE_SCHEMA = DATABASE()
-  AND TABLE_NAME = 'users_settings'
-  AND COLUMN_NAME = 'builders_club_bonus_furni'
-);
-SET @sql := IF(@col_exists = 0,
-  'ALTER TABLE `users_settings` ADD COLUMN `builders_club_bonus_furni` INT NOT NULL DEFAULT 0;',
-  'SELECT "exists";'
-);
-PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
-
-CREATE TABLE IF NOT EXISTS `wired_emulator_settings` (
-  `key` varchar(191) NOT NULL,
-  `value` text NOT NULL,
-  `comment` text NOT NULL,
-  PRIMARY KEY (`key`)
-) ENGINE=InnoDB DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;
-
-INSERT INTO `wired_emulator_settings` (`key`, `value`, `comment`)
-SELECT 'wired.engine.enabled', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.engine.enabled' LIMIT 1), '1'), 'Compatibility flag kept for older configs. The runtime now always uses the new wired engine.'
-UNION ALL
-SELECT 'wired.engine.exclusive', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.engine.exclusive' LIMIT 1), '1'), 'Compatibility flag kept for older configs. The runtime now always uses the new wired engine.'
-UNION ALL
-SELECT 'wired.engine.maxStepsPerStack', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.engine.maxStepsPerStack' LIMIT 1), '100'), 'Maximum amount of internal processing steps allowed for a single wired stack execution.'
-UNION ALL
-SELECT 'wired.engine.debug', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.engine.debug' LIMIT 1), '0'), 'Enable verbose debug logging for the new wired engine.'
-UNION ALL
-SELECT 'wired.custom.enabled', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.custom.enabled' LIMIT 1), '0'), 'Enable custom legacy wired behaviour such as user-based cooldown exceptions and compatibility logic.'
-UNION ALL
-SELECT 'hotel.wired.furni.selection.count', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'hotel.wired.furni.selection.count' LIMIT 1), '5'), 'Maximum number of furni that a wired box can store or select.'
-UNION ALL
-SELECT 'hotel.wired.max_delay', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'hotel.wired.max_delay' LIMIT 1), '20'), 'Maximum delay value accepted by wired effects that support delayed execution.'
-UNION ALL
-SELECT 'hotel.wired.message.max_length', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'hotel.wired.message.max_length' LIMIT 1), '100'), 'Maximum length of text fields used by wired messages and bot text effects.'
-UNION ALL
-SELECT 'wired.effect.teleport.delay', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.effect.teleport.delay' LIMIT 1), '500'), 'Delay in milliseconds used by wired teleport movement.'
-UNION ALL
-SELECT 'wired.place.under', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.place.under' LIMIT 1), '0'), 'Allow placing wired furniture underneath other items when room rules permit it.'
-UNION ALL
-SELECT 'wired.tick.interval.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.tick.interval.ms' LIMIT 1), '50'), 'Global wired tick interval in milliseconds used by repeaters and other tick-driven wired items.'
-UNION ALL
-SELECT 'wired.tick.resolution', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.tick.resolution' LIMIT 1), '100'), 'Legacy wired tick resolution value kept for compatibility with older wired timing setups.'
-UNION ALL
-SELECT 'wired.tick.debug', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.tick.debug' LIMIT 1), '0'), 'Enable verbose logging for the wired tick service.'
-UNION ALL
-SELECT 'wired.tick.thread.priority', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.tick.thread.priority' LIMIT 1), '6'), 'Java thread priority used by the wired tick service.'
-UNION ALL
-SELECT 'wired.highscores.displaycount', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.highscores.displaycount' LIMIT 1), '25'), 'Maximum number of wired highscore entries shown to users when a highscore is displayed.'
-UNION ALL
-SELECT 'wired.abuse.max.recursion.depth', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.abuse.max.recursion.depth' LIMIT 1), '10'), 'Maximum recursive wired depth allowed before execution is stopped.'
-UNION ALL
-SELECT 'wired.abuse.max.events.per.window', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.abuse.max.events.per.window' LIMIT 1), '100'), 'Maximum amount of identical wired events allowed inside the abuse rate-limit window before a room ban is applied.'
-UNION ALL
-SELECT 'wired.abuse.rate.limit.window.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.abuse.rate.limit.window.ms' LIMIT 1), '10000'), 'Time window in milliseconds used by the wired abuse rate limiter.'
-UNION ALL
-SELECT 'wired.abuse.ban.duration.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.abuse.ban.duration.ms' LIMIT 1), '600000'), 'Duration in milliseconds of the temporary wired ban after abuse detection.'
-UNION ALL
-SELECT 'wired.monitor.usage.window.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.usage.window.ms' LIMIT 1), '1000'), 'Rolling window size in milliseconds used to calculate wired usage in the :wired monitor.'
-UNION ALL
-SELECT 'wired.monitor.usage.limit', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.usage.limit' LIMIT 1), '1000'), 'Maximum wired usage budget allowed in one monitor window before EXECUTION_CAP is raised.'
-UNION ALL
-SELECT 'wired.monitor.delayed.events.limit', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.delayed.events.limit' LIMIT 1), '100'), 'Maximum number of delayed wired events that can be queued in one room at the same time.'
-UNION ALL
-SELECT 'wired.monitor.overload.average.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.overload.average.ms' LIMIT 1), '50'), 'Average execution time threshold in milliseconds that starts overload tracking.'
-UNION ALL
-SELECT 'wired.monitor.overload.peak.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.overload.peak.ms' LIMIT 1), '150'), 'Peak single execution time threshold in milliseconds that starts overload tracking.'
-UNION ALL
-SELECT 'wired.monitor.overload.consecutive.windows', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.overload.consecutive.windows' LIMIT 1), '2'), 'Number of consecutive overloaded monitor windows required before logging EXECUTOR_OVERLOAD.'
-UNION ALL
-SELECT 'wired.monitor.heavy.usage.percent', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.heavy.usage.percent' LIMIT 1), '70'), 'Usage percentage threshold that contributes to marking a room as heavy in the :wired monitor.'
-UNION ALL
-SELECT 'wired.monitor.heavy.consecutive.windows', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.heavy.consecutive.windows' LIMIT 1), '5'), 'Number of consecutive windows above the heavy usage threshold required before the room is marked as heavy.'
-UNION ALL
-SELECT 'wired.monitor.heavy.delayed.percent', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.heavy.delayed.percent' LIMIT 1), '60'), 'Delayed queue percentage threshold that also contributes to the heavy-room calculation.'
-ON DUPLICATE KEY UPDATE
-  `value` = VALUES(`value`),
-  `comment` = VALUES(`comment`);
-
-DELETE FROM `emulator_settings`
-WHERE `key` IN (
-  'wired.engine.enabled',
-  'wired.engine.exclusive',
-  'wired.engine.maxStepsPerStack',
-  'wired.engine.debug',
-  'wired.custom.enabled',
-  'hotel.wired.furni.selection.count',
-  'hotel.wired.max_delay',
-  'hotel.wired.message.max_length',
-  'wired.effect.teleport.delay',
-  'wired.place.under',
-  'wired.tick.interval.ms',
-  'wired.tick.resolution',
-  'wired.tick.debug',
-  'wired.tick.thread.priority',
-  'wired.highscores.displaycount',
-  'wired.abuse.max.recursion.depth',
-  'wired.abuse.max.events.per.window',
-  'wired.abuse.rate.limit.window.ms',
-  'wired.abuse.ban.duration.ms',
-  'wired.monitor.usage.window.ms',
-  'wired.monitor.usage.limit',
-  'wired.monitor.delayed.events.limit',
-  'wired.monitor.overload.average.ms',
-  'wired.monitor.overload.peak.ms',
-  'wired.monitor.overload.consecutive.windows',
-  'wired.monitor.heavy.usage.percent',
-  'wired.monitor.heavy.consecutive.windows',
-  'wired.monitor.heavy.delayed.percent'
-);
-
-UPDATE `emulator_settings` SET `comment` = 'Allow whispering while a user stands inside a mute area.' WHERE `key` = 'room.chat.mutearea.allow_whisper';
-UPDATE `emulator_settings` SET `comment` = 'HTML or text format used for room chat prefixes.' WHERE `key` = 'room.chat.prefix.format';
-UPDATE `emulator_settings` SET `comment` = 'Badge code displayed on promoted rooms.' WHERE `key` = 'room.promotion.badge';
-UPDATE `emulator_settings` SET `comment` = 'Image used by Rosie bubble notifications.' WHERE `key` = 'rosie.bubble.image.url';
-UPDATE `emulator_settings` SET `comment` = 'Currency type used by Rosie when buying a room or room package.' WHERE `key` = 'rosie.buyroom.currency.type';
-UPDATE `emulator_settings` SET `comment` = 'Configuration value used by `runtime.threads`.' WHERE `key` = 'runtime.threads';
-UPDATE `emulator_settings` SET `comment` = 'Configuration value used by `save.private.chats`.' WHERE `key` = 'save.private.chats';
-UPDATE `emulator_settings` SET `comment` = 'Configuration value used by `save.room.chats`.' WHERE `key` = 'save.room.chats';
-UPDATE `emulator_settings` SET `comment` = 'Expose moderation tickets to the scripter or automation tooling.' WHERE `key` = 'scripter.modtool.tickets';
-UPDATE `emulator_settings` SET `comment` = 'Currency type ID used for diamonds.' WHERE `key` = 'seasonal.currency.diamond';
-UPDATE `emulator_settings` SET `comment` = 'Currency type ID used for duckets.' WHERE `key` = 'seasonal.currency.ducket';
-UPDATE `emulator_settings` SET `comment` = 'Semicolon-separated display names for seasonal currency types.' WHERE `key` = 'seasonal.currency.names';
-UPDATE `emulator_settings` SET `comment` = 'Currency type ID used for pixels.' WHERE `key` = 'seasonal.currency.pixel';
-UPDATE `emulator_settings` SET `comment` = 'Currency type ID used for shells.' WHERE `key` = 'seasonal.currency.shell';
-UPDATE `emulator_settings` SET `comment` = 'Primary seasonal currency type ID.' WHERE `key` = 'seasonal.primary.type';
-UPDATE `emulator_settings` SET `comment` = 'Semicolon-separated list of currency type IDs treated as seasonal currencies.' WHERE `key` = 'seasonal.types';
-UPDATE `emulator_settings` SET `comment` = 'Achievement code granted for the HC subscription tier.' WHERE `key` = 'subscriptions.hc.achievement';
-UPDATE `emulator_settings` SET `comment` = 'Number of days before expiry when HC discount offers become available.' WHERE `key` = 'subscriptions.hc.discount.days_before_end';
-UPDATE `emulator_settings` SET `comment` = 'Enable discounted HC renewal offers.' WHERE `key` = 'subscriptions.hc.discount.enabled';
-UPDATE `emulator_settings` SET `comment` = 'Reset tracked credits spent when the HC subscription expires.' WHERE `key` = 'subscriptions.hc.payday.creditsspent_reset_on_expire';
-UPDATE `emulator_settings` SET `comment` = 'Currency rewarded by the HC payday system.' WHERE `key` = 'subscriptions.hc.payday.currency';
-UPDATE `emulator_settings` SET `comment` = 'Enable the HC payday reward system.' WHERE `key` = 'subscriptions.hc.payday.enabled';
-UPDATE `emulator_settings` SET `comment` = 'Date interval used between HC payday reward runs.' WHERE `key` = 'subscriptions.hc.payday.interval';
-UPDATE `emulator_settings` SET `comment` = 'Next scheduled execution date for HC payday rewards.' WHERE `key` = 'subscriptions.hc.payday.next_date';
-UPDATE `emulator_settings` SET `comment` = 'Percentage of eligible spending returned by HC payday.' WHERE `key` = 'subscriptions.hc.payday.percentage';
-UPDATE `emulator_settings` SET `comment` = 'Semicolon-separated streak thresholds and rewards for HC payday.' WHERE `key` = 'subscriptions.hc.payday.streak';
-UPDATE `emulator_settings` SET `comment` = 'Enable the subscription background scheduler.' WHERE `key` = 'subscriptions.scheduler.enabled';
-UPDATE `emulator_settings` SET `comment` = 'Interval in minutes between subscription scheduler runs.' WHERE `key` = 'subscriptions.scheduler.interval';
-UPDATE `emulator_settings` SET `comment` = 'Compatibility marker used by the custom team wired implementation. Do not remove.' WHERE `key` = 'team.wired.update.rc-1';
-UPDATE `emulator_settings` SET `comment` = 'API key used by the YouTube integration.' WHERE `key` = 'youtube.apikey';
-
-DROP VIEW IF EXISTS `permissions_matrix_view`;
-DROP PROCEDURE IF EXISTS `refresh_permissions_matrix_view`;
-DROP TABLE IF EXISTS `permission_rank_values`;
-DROP TABLE IF EXISTS `permission_nodes`;
-
-CREATE TABLE IF NOT EXISTS `permission_ranks` (
-  `id` int(11) NOT NULL,
-  `rank_name` varchar(25) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NOT NULL,
-  `hidden_rank` tinyint(1) NOT NULL DEFAULT 0,
-  `badge` varchar(12) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NOT NULL DEFAULT '',
-  `job_description` varchar(255) NOT NULL DEFAULT 'Here to help',
-  `staff_color` varchar(8) NOT NULL DEFAULT '#327fa8',
-  `staff_background` varchar(255) NOT NULL DEFAULT 'staff-bg.png',
-  `level` int(11) NOT NULL DEFAULT 1,
-  `room_effect` int(11) NOT NULL DEFAULT 0,
-  `log_commands` enum('0','1') CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NOT NULL DEFAULT '0',
-  `prefix` varchar(5) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NOT NULL DEFAULT '',
-  `prefix_color` varchar(7) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NOT NULL DEFAULT '',
-  `auto_credits_amount` int(11) DEFAULT 0,
-  `auto_pixels_amount` int(11) DEFAULT 0,
-  `auto_gotw_amount` int(11) DEFAULT 0,
-  `auto_points_amount` int(11) DEFAULT 0,
-  PRIMARY KEY (`id`) USING BTREE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_uca1400_ai_ci ROW_FORMAT=DYNAMIC;
-
-CREATE TABLE IF NOT EXISTS `permission_definitions` (
-  `permission_key` varchar(64) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NOT NULL,
-  `max_value` tinyint(3) unsigned NOT NULL DEFAULT 1,
-  `comment` text NOT NULL,
-  PRIMARY KEY (`permission_key`) USING BTREE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_uca1400_ai_ci ROW_FORMAT=DYNAMIC;
-
-ALTER TABLE `permission_definitions`
-  DROP COLUMN IF EXISTS `category`,
-  DROP COLUMN IF EXISTS `value_type`,
-  DROP COLUMN IF EXISTS `sort_order`;
-
-INSERT INTO `permission_ranks` (
-  `id`,
-  `rank_name`,
-  `hidden_rank`,
-  `badge`,
-  `job_description`,
-  `staff_color`,
-  `staff_background`,
-  `level`,
-  `room_effect`,
-  `log_commands`,
-  `prefix`,
-  `prefix_color`,
-  `auto_credits_amount`,
-  `auto_pixels_amount`,
-  `auto_gotw_amount`,
-  `auto_points_amount`
-)
-SELECT
-  `id`,
-  `rank_name`,
-  `hidden_rank`,
-  `badge`,
-  `job_description`,
-  `staff_color`,
-  `staff_background`,
-  `level`,
-  `room_effect`,
-  `log_commands`,
-  `prefix`,
-  `prefix_color`,
-  `auto_credits_amount`,
-  `auto_pixels_amount`,
-  `auto_gotw_amount`,
-  `auto_points_amount`
-FROM `permissions`
-ON DUPLICATE KEY UPDATE
-  `rank_name` = VALUES(`rank_name`),
-  `hidden_rank` = VALUES(`hidden_rank`),
-  `badge` = VALUES(`badge`),
-  `job_description` = VALUES(`job_description`),
-  `staff_color` = VALUES(`staff_color`),
-  `staff_background` = VALUES(`staff_background`),
-  `level` = VALUES(`level`),
-  `room_effect` = VALUES(`room_effect`),
-  `log_commands` = VALUES(`log_commands`),
-  `prefix` = VALUES(`prefix`),
-  `prefix_color` = VALUES(`prefix_color`),
-  `auto_credits_amount` = VALUES(`auto_credits_amount`),
-  `auto_pixels_amount` = VALUES(`auto_pixels_amount`),
-  `auto_gotw_amount` = VALUES(`auto_gotw_amount`),
-  `auto_points_amount` = VALUES(`auto_points_amount`);
-
-DROP PROCEDURE IF EXISTS `refresh_permission_definition_rank_columns`;
-
-DELIMITER $$
-CREATE PROCEDURE `refresh_permission_definition_rank_columns`()
-BEGIN
-  DECLARE done INT DEFAULT 0;
-  DECLARE current_rank_id INT;
-  DECLARE current_column_name VARCHAR(32);
-  DECLARE column_exists INT DEFAULT 0;
-  DECLARE rank_cursor CURSOR FOR SELECT `id` FROM `permission_ranks` ORDER BY `id` ASC;
-  DECLARE CONTINUE HANDLER FOR NOT FOUND SET done = 1;
-
-  OPEN rank_cursor;
-
-  rank_loop: LOOP
-    FETCH rank_cursor INTO current_rank_id;
-
-    IF done = 1 THEN
-      LEAVE rank_loop;
-    END IF;
-
-    SET current_column_name = CONCAT('rank_', current_rank_id);
-
-    SELECT COUNT(*)
-      INTO column_exists
-    FROM `information_schema`.`columns`
-    WHERE `table_schema` = DATABASE()
-      AND `table_name` = 'permission_definitions'
-      AND `column_name` = current_column_name;
-
-    IF column_exists = 0 THEN
-      SET @alter_permissions_column_sql = CONCAT(
-        'ALTER TABLE `permission_definitions` ADD COLUMN `',
-        current_column_name,
-        '` tinyint(3) unsigned NOT NULL DEFAULT 0'
-      );
-
-      PREPARE alter_permissions_column_stmt FROM @alter_permissions_column_sql;
-      EXECUTE alter_permissions_column_stmt;
-      DEALLOCATE PREPARE alter_permissions_column_stmt;
-    END IF;
-  END LOOP;
-
-  CLOSE rank_cursor;
-END$$
-DELIMITER ;
-
-CALL `refresh_permission_definition_rank_columns`();
-
-INSERT INTO `permission_definitions` (
-  `permission_key`,
-  `max_value`,
-  `comment`
-)
-SELECT
-  `column_name` AS `permission_key`,
-  CASE
-    WHEN `column_type` LIKE '%''2''%' THEN 2
-    ELSE 1
-  END AS `max_value`,
-  CASE
-    WHEN COALESCE(`column_comment`, '') <> '' THEN `column_comment`
-    WHEN `column_name` LIKE 'cmd\_%' AND `column_type` LIKE '%''2''%' THEN CONCAT(
-      'Controls access to the :',
-      REPLACE(SUBSTRING(`column_name`, 5), '_', ' '),
-      ' command. Values: 0 = disabled, 1 = allowed, 2 = allowed only when room-owner rights may be used.'
-    )
-    WHEN `column_name` LIKE 'cmd\_%' THEN CONCAT(
-      'Controls access to the :',
-      REPLACE(SUBSTRING(`column_name`, 5), '_', ' '),
-      ' command. Values: 0 = disabled, 1 = allowed.'
-    )
-    WHEN `column_name` LIKE 'acc\_%' AND `column_type` LIKE '%''2''%' THEN CONCAT(
-      'Controls the ',
-      REPLACE(SUBSTRING(`column_name`, 5), '_', ' '),
-      ' capability for this rank. Values: 0 = disabled, 1 = enabled, 2 = enabled only when room-owner rights may be used.'
-    )
-    WHEN `column_name` LIKE 'acc\_%' THEN CONCAT(
-      'Controls the ',
-      REPLACE(SUBSTRING(`column_name`, 5), '_', ' '),
-      ' capability for this rank. Values: 0 = disabled, 1 = enabled.'
-    )
-    ELSE CONCAT(
-      'Legacy permission-related value migrated from the old permissions table for ',
-      `column_name`,
-      '.'
-    )
-  END AS `comment`
-FROM `information_schema`.`columns`
-WHERE `table_schema` = DATABASE()
-  AND `table_name` = 'permissions'
-  AND `column_name` NOT IN (
-    'id',
-    'rank_name',
-    'hidden_rank',
-    'badge',
-    'job_description',
-    'staff_color',
-    'staff_background',
-    'level',
-    'room_effect',
-    'log_commands',
-    'prefix',
-    'prefix_color',
-    'auto_credits_amount',
-    'auto_pixels_amount',
-    'auto_gotw_amount',
-    'auto_points_amount'
-  )
-ON DUPLICATE KEY UPDATE
-  `max_value` = VALUES(`max_value`),
-  `comment` = VALUES(`comment`);
-
-DROP TEMPORARY TABLE IF EXISTS `tmp_permission_comments`;
-
-CREATE TEMPORARY TABLE `tmp_permission_comments` (
-  `permission_key` varchar(64) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NOT NULL,
-  `comment` text NOT NULL,
-  PRIMARY KEY (`permission_key`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_uca1400_ai_ci;
-
-INSERT INTO `tmp_permission_comments` (`permission_key`, `comment`) VALUES
-('cmd_about', 'Allows using :about to display emulator, revision, or hotel information exposed by the command.'),
-('cmd_alert', 'Allows using :alert to send a hotel alert popup to a specific user.'),
-('cmd_allow_trading', 'Allows using the trading-toggle command to enable or disable trading for a target user.'),
-('cmd_badge', 'Allows granting a badge code to a target user through a command.'),
-('cmd_ban', 'Allows banning users from the hotel.'),
-('cmd_blockalert', 'Allows sending the block-alert style moderation message.'),
-('cmd_bots', 'Allows using :bots to list the bots currently placed in the room.'),
-('cmd_bundle', 'Allows using :bundle / :roombundle to create a catalog room-bundle offer for the current room.'),
-('cmd_calendar', 'Allows using the hotel calendar command and any calendar actions wired to that command entry.'),
-('cmd_changename', 'Allows forcing a user-name change through the change-name command flow.'),
-('cmd_chatcolor', 'Allows changing the active chat bubble color through the chat-color command.'),
-('cmd_commands', 'Allows using :commands to list the command keys available to the current user.'),
-('cmd_connect_camera', 'Allows using the command that links the in-room camera feature to the current room session.'),
-('cmd_control', 'Allows using :control to take over another in-room user and stop controlling them later.'),
-('cmd_coords', 'Allows using :coords to inspect room coordinates for tiles, users, or furniture.'),
-('cmd_credits', 'Allows giving or removing credits from a user through the staff currency command.'),
-('cmd_subscription', 'Allows granting or editing subscription time through the subscription command.'),
-('cmd_danceall', 'Allows forcing every Habbo currently in the room to dance.'),
-('cmd_diagonal', 'Allows toggling diagonal walking for the current room.'),
-('cmd_disconnect', 'Allows disconnecting a user from the hotel immediately.'),
-('cmd_duckets', 'Allows giving or removing duckets from a user through the staff currency command.'),
-('cmd_ejectall', 'Allows ejecting all users from the current room.'),
-('cmd_empty', 'Allows clearing the current user furniture inventory through the empty-inventory command.'),
-('cmd_empty_bots', 'Allows clearing the current user bot inventory through the empty-bots command.'),
-('cmd_empty_pets', 'Allows clearing the current user pet inventory through the empty-pets command.'),
-('cmd_enable', 'Allows applying an avatar effect to yourself, or to another user when acc_enable_others is also granted.'),
-('cmd_event', 'Allows marking the current room as an event room through the event command.'),
-('cmd_faceless', 'Allows toggling the faceless avatar visual state on the executing room unit.'),
-('cmd_fastwalk', 'Allows toggling fast-walk mode for yourself or another in-room user.'),
-('cmd_filterword', 'Allows adding or removing entries from the configured word filter through command usage.'),
-('cmd_freeze', 'Allows freezing a target user in place.'),
-('cmd_freeze_bots', 'Allows freezing bots that are placed in the room.'),
-('cmd_gift', 'Allows sending a gift to a target user through the gift command.'),
-('cmd_give_rank', 'Allows setting another user rank through the give-rank command.'),
-('cmd_ha', 'Allows sending a hotel-wide alert.'),
-('acc_can_stalk', 'Allows following users even when they have disabled stalking.'),
-('cmd_hal', 'Allows sending a hotel-wide alert with a clickable link or extended content.'),
-('cmd_invisible', 'Allows toggling invisible staff mode.'),
-('cmd_ip_ban', 'Allows banning a user by IP address.'),
-('cmd_machine_ban', 'Allows banning a user by machine identifier.'),
-('cmd_hand_item', 'Allows spawning or changing the hand item currently held by a user.'),
-('cmd_happyhour', 'Allows starting or stopping the happy-hour event flow exposed by the happyhour command.'),
-('cmd_hidewired', 'Allows toggling whether wired furniture is visually hidden in the current room.'),
-('cmd_kickall', 'Allows kicking every user from the current room.'),
-('cmd_softkick', 'Allows soft-kicking a user back to the hotel view without a full sanction.'),
-('cmd_massbadge', 'Allows giving the same badge to many users at once.'),
-('cmd_roombadge', 'Allows setting or overriding the room badge shown to users.'),
-('cmd_masscredits', 'Allows giving credits to many users at once through the mass-credits command.'),
-('cmd_massduckets', 'Allows giving duckets to many users at once through the mass-duckets command.'),
-('cmd_massgift', 'Allows sending the same gift to many users at once.'),
-('cmd_masspoints', 'Allows giving activity points to many users at once through the mass-points command.'),
-('cmd_moonwalk', 'Allows toggling the moonwalk avatar effect for yourself while you are inside a room.'),
-('cmd_mimic', 'Allows copying another user appearance or presence state through the mimic command.'),
-('cmd_multi', 'Allows executing multiple chat commands from the special sticky/post-it scripting payload.'),
-('cmd_mute', 'Allows muting a target user.'),
-('cmd_pet_info', 'Allows opening the detailed pet-information view for a pet.'),
-('cmd_pickall', 'Allows picking up every furniture item from the current room.'),
-('cmd_plugins', 'Legacy key for the :plugins command, which currently lists loaded plugins without enforcing this dedicated permission node in code.'),
-('cmd_points', 'Allows giving or removing activity points from a user through the points command.'),
-('cmd_promote_offer', 'Allows using :promoteoffer to list active target offers or switch the globally promoted target offer.'),
-('cmd_pull', 'Allows pulling a nearby user onto the tile directly in front of you.'),
-('cmd_push', 'Allows pushing the user standing in front of you one tile farther in the direction you are facing.'),
-('cmd_redeem', 'Allows redeeming redeemable inventory items through the redeem command flow.'),
-('cmd_reload_room', 'Allows unloading and reloading the current room, then forwarding the occupants back into the fresh room instance.'),
-('cmd_roomalert', 'Allows sending the same alert message to everyone in the current room.'),
-('cmd_roomcredits', 'Allows giving credits to every Habbo currently in the room.'),
-('cmd_roomeffect', 'Allows applying the same avatar effect id to every Habbo currently in the room.'),
-('cmd_roomgift', 'Allows sending the same gift to every Habbo currently in the room.'),
-('cmd_roomitem', 'Allows setting the same hand-item id for every Habbo in the room; using 0 clears the hand item.'),
-('cmd_roommute', 'Allows muting every Habbo currently in the room.'),
-('cmd_roompixels', 'Allows giving duckets or pixels to every Habbo currently in the room.'),
-('cmd_roompoints', 'Allows giving activity points to every Habbo currently in the room.'),
-('cmd_say', 'Allows forcing another online user to say a custom message in their current room.'),
-('cmd_say_all', 'Allows making everyone in the room say a message.'),
-('cmd_setmax', 'Allows using :setmax to change the maximum user capacity of the current room.'),
-('cmd_set_poll', 'Allows using :setpoll to attach or remove a poll on the current room.'),
-('cmd_setpublic', 'Allows using :setpublic to change the room public/private visibility state.'),
-('cmd_setspeed', 'Allows using :setspeed to change the room walking speed setting.'),
-('cmd_shout', 'Allows forcing another online user to shout a custom message in their current room.'),
-('cmd_shout_all', 'Allows making everyone in the room shout a message.'),
-('cmd_shutdown', 'Allows using the shutdown command to stop the emulator process.'),
-('cmd_sitdown', 'Allows forcing users to sit down through the sitdown command.'),
-('cmd_staffalert', 'Allows sending an alert that is visible only to staff members.'),
-('cmd_staffonline', 'Allows viewing the current list of online staff members.'),
-('cmd_summon', 'Allows summoning a target user into the room where the staff member currently is.'),
-('cmd_summonrank', 'Allows summoning all online users of a given rank into the current room.'),
-('cmd_super_ban', 'Allows issuing the strongest ban command variant exposed by the super-ban command.'),
-('cmd_stalk', 'Allows following another user to their room.'),
-('cmd_superpull', 'Allows pulling a user to the tile in front of you without the short-range reach check used by :pull.'),
-('cmd_take_badge', 'Allows removing a badge code from a target user.'),
-('cmd_talk', 'Allows using the legacy :talk command to make another user speak a command-provided message.'),
-('cmd_teleport', 'Allows toggling the room-unit teleport mode used by the :teleport command.'),
-('cmd_trash', 'Allows deleting or trashing furniture/items through the trash command flow.'),
-('cmd_transform', 'Allows transforming your room unit into a chosen pet type, race, and color.'),
-('cmd_unban', 'Allows removing active bans.'),
-('cmd_unload', 'Allows disposing the current room instance immediately through :unload / :crash.'),
-('cmd_unmute', 'Allows removing an active mute from a target user.'),
-('cmd_update_achievements', 'Allows using :update_achievements to reload achievements configuration.'),
-('cmd_update_bots', 'Allows using :update_bots to reload bot data and bot configuration.'),
-('cmd_update_catalogue', 'Allows using :update_catalogue to reload catalogue pages and offers.'),
-('cmd_update_config', 'Allows using :update_config to reload emulator configuration settings.'),
-('cmd_update_guildparts', 'Allows using :update_guildparts to reload guild badge parts and guild configuration.'),
-('cmd_update_hotel_view', 'Allows using :update_hotel_view to reload hotel-view assets or settings.'),
-('cmd_update_items', 'Allows using :update_items to reload item data and furniture definitions.'),
-('cmd_update_navigator', 'Allows using :update_navigator to reload navigator configuration and listings.'),
-('cmd_update_permissions', 'Allows using :update_permissions to reload ranks and permissions from the database.'),
-('cmd_update_pet_data', 'Allows using :update_pet_data to reload pet types and pet races.'),
-('cmd_update_plugins', 'Allows using :update_plugins to reload plugin data or plugin metadata.'),
-('cmd_update_polls', 'Allows using :update_polls to reload poll and questionnaire data.'),
-('cmd_update_texts', 'Allows using :update_texts to reload external texts and localizations.'),
-('cmd_update_wordfilter', 'Allows using :update_wordfilter to reload the word-filter list.'),
-('cmd_userinfo', 'Allows opening the detailed user-information view used by staff tools.'),
-('cmd_word_quiz', 'Allows starting a room word-quiz event with a custom question and optional duration.'),
-('cmd_warp', 'Allows instantly warping your room unit to a target tile.'),
-('acc_anychatcolor', 'Allows selecting any chat bubble color, including normally restricted colors.'),
-('acc_anyroomowner', 'Treats the rank as room owner for owner-only checks such as room settings, wired saving, rights management, floorplan editing, and similar room-owner gates.'),
-('acc_empty_others', 'Allows :empty, :empty_bots, and :empty_pets to target another user inventory instead of only your own.'),
-('acc_enable_others', 'Allows :enable to apply avatar effects to another user instead of only to yourself.'),
-('acc_see_whispers', 'Allows seeing whispers sent between other users in the room.'),
-('acc_see_tentchat', 'Allows seeing tent chat or similar hidden chat channels that are normally not visible to everyone.'),
-('acc_superwired', 'Allows saving advanced wired data without the normal wordfilter and reward payload restrictions applied to regular users.'),
-('acc_supporttool', 'Allows opening and using the support/moderation tool interface.'),
-('acc_unkickable', 'Prevents the user from being kicked by normal moderation or room commands.'),
-('acc_guildgate', 'Allows bypassing guild gate access restrictions.'),
-('acc_moverotate', 'Allows moving, rotating, and saving wired furniture without the usual room-owner restriction checks.'),
-('acc_placefurni', 'Allows placing furniture, opening :wired, and passing room-right checks that normally require owner or controller rights.'),
-('acc_unlimited_bots', 'Removes both the bot inventory cap and the per-room bot placement cap for this rank.'),
-('acc_unlimited_pets', 'Removes both the pet inventory cap and the per-room pet placement cap for this rank.'),
-('acc_hide_ip', 'Hides the user IP address in staff tools and other staff-facing views.'),
-('acc_hide_mail', 'Hides the user email address in moderation tools and staff views.'),
-('acc_not_mimiced', 'Prevents other users from mimicking this account.'),
-('acc_chat_no_flood', 'Exempts the user from flood protection limits.'),
-('acc_staff_chat', 'Allows accessing staff-only chat channels and staff broadcasts.'),
-('acc_staff_pick', 'Allows using staff item pick-up actions that bypass normal room ownership restrictions.'),
-('acc_enteranyroom', 'Allows entering rooms regardless of door mode, bans, or normal access restrictions.'),
-('acc_fullrooms', 'Allows entering rooms even when they are at maximum user capacity.'),
-('acc_infinite_credits', 'Prevents credits from being consumed when a command or purchase checks credit balance.'),
-('acc_infinite_pixels', 'Prevents duckets or pixels from being consumed when the balance is checked.'),
-('acc_infinite_points', 'Prevents activity points from being consumed when the balance is checked.'),
-('acc_ambassador', 'Marks the rank as an ambassador for ambassador-only tools and visuals.'),
-('acc_debug', 'Allows using debug-only features, commands, or internal tooling.'),
-('acc_chat_no_limit', 'Lets the user hear and be heard regardless of room hearing distance limits.'),
-('acc_chat_no_filter', 'Bypasses the word filter for chat and staff-generated messages.'),
-('acc_nomute', 'Prevents the user from being muted by normal mute checks.'),
-('acc_guild_admin', 'Allows bypassing guild admin restrictions when managing guilds.'),
-('acc_catalog_ids', 'Allows seeing internal catalogue page ids, offer ids, or related technical catalogue identifiers.'),
-('acc_modtool_ticket_q', 'Allows seeing and handling the moderation ticket queue.'),
-('acc_modtool_user_logs', 'Allows reading user chat logs in the moderation tool.'),
-('acc_modtool_user_alert', 'Allows sending moderation alerts or cautions to users.'),
-('acc_modtool_user_kick', 'Allows kicking users from the moderation tool.'),
-('acc_modtool_user_ban', 'Allows banning users from the moderation tool.'),
-('acc_modtool_room_info', 'Allows viewing room information in the moderation tool.'),
-('acc_modtool_room_logs', 'Allows viewing room chat logs in the moderation tool.'),
-('acc_trade_anywhere', 'Allows starting trades outside the normal trade-enabled areas.'),
-('acc_update_notifications', 'Allows receiving update notifications emitted by the emulator.'),
-('acc_helper_use_guide_tool', 'Allows opening the helper guide tool.'),
-('acc_helper_give_guide_tours', 'Allows accepting and handling guide tour requests.'),
-('acc_helper_judge_chat_reviews', 'Allows reviewing helper or chat review tickets.'),
-('acc_floorplan_editor', 'Allows opening and saving the floorplan editor.'),
-('acc_camera', 'Allows using the in-room camera feature and related camera UI actions.'),
-('acc_ads_background', 'Allows editing room advertisement backgrounds.'),
-('cmd_wordquiz', 'Legacy alias of cmd_word_quiz for starting a room word-quiz event.'),
-('acc_room_staff_tags', 'Shows staff tags or markers above the user while inside rooms.'),
-('acc_infinite_friends', 'Removes the normal friend-list size limit.'),
-('acc_mimic_unredeemed', 'Allows mimicking looks even when they contain unreleased or restricted clothing.'),
-('cmd_update_youtube_playlists', 'Allows reloading YouTube playlist configuration for furniture integrations.'),
-('cmd_add_youtube_playlist', 'Allows adding a new YouTube playlist entry.'),
-('acc_mention', 'Allows using mention-related chat features beyond the normal rank restriction.'),
-('cmd_setstate', 'Legacy room-editor permission for :setstate / :ss, used to change the selected furni state or extradata value.'),
-('cmd_buildheight', 'Legacy room-editor permission for :buildheight / :bh, used to change the room build-height override.'),
-('cmd_setrotation', 'Legacy room-editor permission for :setrotation / :rot, used to change the rotation of the selected furni.'),
-('cmd_sellroom', 'Allows putting the current room up for sale through the sell-room command.'),
-('cmd_buyroom', 'Allows purchasing a room that is marked as for sale through the buy-room command.'),
-('cmd_pay', 'Allows transferring currency to another user through the pay command.'),
-('cmd_kill', 'Allows using the kill command effect exposed by the current command set.'),
-('cmd_hoverboard', 'Allows toggling the hoverboard effect or hoverboard movement mode.'),
-('cmd_kiss', 'Allows using the kiss interaction command on another user.'),
-('cmd_hug', 'Allows using the hug interaction command on another user.'),
-('cmd_welcome', 'Allows triggering the welcome command behavior defined by the current command set.'),
-('cmd_disable_effects', 'Allows disabling active avatar effects through the disable-effects command.'),
-('cmd_brb', 'Allows toggling the be-right-back status command.'),
-('cmd_nuke', 'Allows using the nuke command exposed by the current command set.'),
-('cmd_slime', 'Allows applying the slime command/effect exposed by the current command set.'),
-('cmd_explain', 'Allows using the explain command to send the predefined explanation/help flow to users.'),
-('cmd_closedice', 'Legacy essentials permission for :closedice, used to close dice items in the room or all dice at once.'),
-('acc_closedice_room', 'Legacy companion permission used by older closed-dice room checks.'),
-('cmd_set', 'Legacy essentials permission for :set / :changefurni, the generic furni editing command documented by :set info.'),
-('cmd_furnidata', 'Allows viewing technical furnidata information in-game for selected furniture.'),
-('kiss_cmd', 'Legacy alias used for the kiss command permission.'),
-('acc_calendar_force', 'Allows claiming calendar rewards even when the normal day-difference timing check would block the claim.'),
-('cmd_update_calendar', 'Allows using :update_calendar to reload calendar definitions and rewards.'),
-('cmd_update_all', 'Allows using :update_all to reload all supported runtime data sets in one command.'),
-('cms_dance', 'Legacy CMS-side permission kept for website integrations; no direct in-emulator command handler was found in the current tree.'),
-('acc_catalogfurni', 'Allows using catalogue administration features related to furniture pages and offers.'),
-('acc_unignorable', 'Prevents the account from being ignored by other users through the ignore system.'),
-('cmd_update_chat_bubbles', 'Allows using :update_chat_bubbles to reload chat-bubble definitions and assets.'),
-('cmd_calendar_staff', 'Allows the staff-only actions exposed by the calendar command flow.');
-
-UPDATE `permission_definitions` pd
-INNER JOIN `tmp_permission_comments` tc ON tc.`permission_key` = pd.`permission_key`
-SET pd.`comment` = tc.`comment`;
-
-DROP TEMPORARY TABLE IF EXISTS `tmp_permission_comments`;
-
-DROP PROCEDURE IF EXISTS `refresh_permission_definition_values`;
-
-DELIMITER $$
-CREATE PROCEDURE `refresh_permission_definition_values`()
-BEGIN
-  DECLARE done INT DEFAULT 0;
-  DECLARE current_rank_id INT;
-  DECLARE current_column_name VARCHAR(32);
-  DECLARE rank_cursor CURSOR FOR SELECT `id` FROM `permission_ranks` ORDER BY `id` ASC;
-  DECLARE CONTINUE HANDLER FOR NOT FOUND SET done = 1;
-
-  OPEN rank_cursor;
-
-  rank_loop: LOOP
-    FETCH rank_cursor INTO current_rank_id;
-
-    IF done = 1 THEN
-      LEAVE rank_loop;
-    END IF;
-
-    SET current_column_name = CONCAT('rank_', current_rank_id);
-
-    SELECT GROUP_CONCAT(
-      CONCAT(
-        'SELECT ''',
-        REPLACE(`column_name`, '''', ''''''),
-        ''' AS permission_key, CAST(COALESCE(`',
-        REPLACE(`column_name`, '`', '``'),
-        '`, ''0'') AS UNSIGNED) AS permission_value FROM `permissions` WHERE `id` = ',
-        current_rank_id
-      )
-      ORDER BY `ordinal_position`
-      SEPARATOR ' UNION ALL '
-    ) INTO @permission_rank_source_sql
-    FROM `information_schema`.`columns`
-    WHERE `table_schema` = DATABASE()
-      AND `table_name` = 'permissions'
-      AND `column_name` NOT IN (
-        'id',
-        'rank_name',
-        'hidden_rank',
-        'badge',
-        'job_description',
-        'staff_color',
-        'staff_background',
-        'level',
-        'room_effect',
-        'log_commands',
-        'prefix',
-        'prefix_color',
-        'auto_credits_amount',
-        'auto_pixels_amount',
-        'auto_gotw_amount',
-        'auto_points_amount'
-      );
-
-    SET @permission_rank_update_sql = CONCAT(
-      'UPDATE `permission_definitions` pd ',
-      'INNER JOIN (',
-      @permission_rank_source_sql,
-      ') src ON src.permission_key = pd.permission_key ',
-      'SET pd.`',
-      current_column_name,
-      '` = src.permission_value'
-    );
-
-    PREPARE permission_rank_update_stmt FROM @permission_rank_update_sql;
-    EXECUTE permission_rank_update_stmt;
-    DEALLOCATE PREPARE permission_rank_update_stmt;
-  END LOOP;
-
-  CLOSE rank_cursor;
-END$$
-DELIMITER ;
-
-CALL `refresh_permission_definition_values`();
-
-
-CREATE TABLE IF NOT EXISTS `room_wired_settings` (
-  `room_id` int(11) NOT NULL,
-  `inspect_mask` int(11) NOT NULL DEFAULT 0 COMMENT 'Bitmask for who can open and inspect Wired in the room. 1=everyone, 2=users with rights, 4=group members, 8=group admins.',
-  `modify_mask` int(11) NOT NULL DEFAULT 0 COMMENT 'Bitmask for who can modify Wired in the room. 2=users with rights, 4=group members, 8=group admins.',
-  PRIMARY KEY (`room_id`),
-  CONSTRAINT `fk_room_wired_settings_room_id` FOREIGN KEY (`room_id`) REFERENCES `rooms` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
-CREATE TABLE IF NOT EXISTS `room_user_wired_variables` (
-    `room_id` int(11) NOT NULL,
-    `user_id` int(11) NOT NULL,
-    `variable_item_id` int(11) NOT NULL,
-    `value` int(11) DEFAULT NULL,
-    `created_at` int(11) NOT NULL DEFAULT 0,
-    `updated_at` int(11) NOT NULL DEFAULT 0,
-    PRIMARY KEY (`room_id`, `user_id`, `variable_item_id`),
-    KEY `idx_room_user_wired_variables_room_item` (`room_id`, `variable_item_id`),
-    KEY `idx_room_user_wired_variables_user` (`user_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
-CREATE TABLE IF NOT EXISTS `room_furni_wired_variables` (
-    `room_id` int(11) NOT NULL,
-    `furni_id` int(11) NOT NULL,
-    `variable_item_id` int(11) NOT NULL,
-    `value` int(11) DEFAULT NULL,
-    `created_at` int(11) NOT NULL DEFAULT 0,
-    `updated_at` int(11) NOT NULL DEFAULT 0,
-    PRIMARY KEY (`room_id`, `furni_id`, `variable_item_id`),
-    KEY `idx_room_furni_wired_variables_room_item` (`room_id`, `variable_item_id`),
-    KEY `idx_room_furni_wired_variables_furni` (`furni_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
-CREATE TABLE IF NOT EXISTS `room_wired_variables` (
-    `room_id` int(11) NOT NULL,
-    `variable_item_id` int(11) NOT NULL,
-    `value` int(11) NOT NULL DEFAULT 0,
-    `created_at` int(11) NOT NULL DEFAULT 0,
-    `updated_at` int(11) NOT NULL DEFAULT 0,
-    PRIMARY KEY (`room_id`, `variable_item_id`),
-    KEY `idx_room_wired_variables_room_item` (`room_id`, `variable_item_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
-
-ALTER TABLE `room_user_wired_variables`
-    ADD COLUMN IF NOT EXISTS `created_at` int(11) NOT NULL DEFAULT 0 AFTER `value`;
-
-ALTER TABLE `room_user_wired_variables`
-    ADD COLUMN IF NOT EXISTS `updated_at` int(11) NOT NULL DEFAULT 0 AFTER `created_at`;
-
-UPDATE `room_user_wired_variables`
-SET
-    `created_at` = IF(`created_at` > 0, `created_at`, UNIX_TIMESTAMP()),
-    `updated_at` = IF(`updated_at` > 0, `updated_at`, IF(`created_at` > 0, `created_at`, UNIX_TIMESTAMP()));
-
-ALTER TABLE `room_furni_wired_variables`
-    ADD COLUMN IF NOT EXISTS `created_at` int(11) NOT NULL DEFAULT 0 AFTER `value`;
-
-ALTER TABLE `room_furni_wired_variables`
-    ADD COLUMN IF NOT EXISTS `updated_at` int(11) NOT NULL DEFAULT 0 AFTER `created_at`;
-
-UPDATE `room_furni_wired_variables`
-SET
-    `created_at` = IF(`created_at` > 0, `created_at`, UNIX_TIMESTAMP()),
-    `updated_at` = IF(`updated_at` > 0, `updated_at`, IF(`created_at` > 0, `created_at`, UNIX_TIMESTAMP()));
-
-ALTER TABLE `room_wired_variables`
-    ADD COLUMN IF NOT EXISTS `created_at` int(11) NOT NULL DEFAULT 0 AFTER `value`;
-
-ALTER TABLE `room_wired_variables`
-    ADD COLUMN IF NOT EXISTS `updated_at` int(11) NOT NULL DEFAULT 0 AFTER `created_at`;
-
-UPDATE `room_wired_variables`
-SET
-    `created_at` = 0,
-    `updated_at` = IF(`updated_at` > 0, `updated_at`, UNIX_TIMESTAMP());
-
-INSERT INTO `chat_bubbles` (`type`, `name`, `permission`, `overridable`, `triggers_talking_furniture`) VALUES
-(200, 'SHOW_MESSAGE_RED', '', 1, 0),
-(201, 'SHOW_MESSAGE_GREEN', '', 1, 0),
-(202, 'SHOW_MESSAGE_BLUE', '', 1, 0),
-(210, 'SHOW_MESSAGE_ALERT', '', 1, 0),
-(211, 'SHOW_MESSAGE_INFO', '', 1, 0),
-(212, 'SHOW_MESSAGE_WARNING', '', 1, 0),
-(220, 'SHOW_MESSAGE_WRONG', '', 1, 0),
-(221, 'SHOW_MESSAGE_WRONG_CIRCLED', '', 1, 0),
-(222, 'SHOW_MESSAGE_CORRECT', '', 1, 0),
-(223, 'SHOW_MESSAGE_CORRECT_CIRCLED', '', 1, 0),
-(224, 'SHOW_MESSAGE_QUESTION', '', 1, 0),
-(225, 'SHOW_MESSAGE_QUESTION_CIRCLED', '', 1, 0),
-(226, 'SHOW_MESSAGE_ARROW_UP', '', 1, 0),
-(227, 'SHOW_MESSAGE_ARROW_UP_CIRCLED', '', 1, 0),
-(228, 'SHOW_MESSAGE_ARROW_DOWN', '', 1, 0),
-(229, 'SHOW_MESSAGE_ARROW_DOWN_CIRCLED', '', 1, 0),
-(250, 'SHOW_MESSAGE_SKULL', '', 1, 0),
-(251, 'SHOW_MESSAGE_SKULL_ALT', '', 1, 0),
-(252, 'SHOW_MESSAGE_MAGNIFIER', '', 1, 0)
-ON DUPLICATE KEY UPDATE
-    `name` = VALUES(`name`),
-    `permission` = VALUES(`permission`),
-    `overridable` = VALUES(`overridable`),
-    `triggers_talking_furniture` = VALUES(`triggers_talking_furniture`);
-
-ALTER TABLE `catalog_club_offers`
-MODIFY COLUMN `type` ENUM('HC', 'VIP', 'BUILDERS_CLUB', 'BUILDERS_CLUB_ADDON') NOT NULL DEFAULT 'HC';
-
-ALTER TABLE `catalog_pages`
-    MODIFY COLUMN `page_layout` ENUM(
-        'default_3x3',
-        'club_buy',
-        'club_gift',
-        'frontpage',
-        'spaces',
-        'recycler',
-        'recycler_info',
-        'recycler_prizes',
-        'trophies',
-        'plasto',
-        'marketplace',
-        'marketplace_own_items',
-        'spaces_new',
-        'soundmachine',
-        'guilds',
-        'guild_furni',
-        'info_duckets',
-        'info_rentables',
-        'info_pets',
-        'roomads',
-        'single_bundle',
-        'sold_ltd_items',
-        'badge_display',
-        'bots',
-        'pets',
-        'pets2',
-        'pets3',
-        'productpage1',
-        'room_bundle',
-        'recent_purchases',
-        'default_3x3_color_grouping',
-        'guild_forum',
-        'vip_buy',
-        'info_loyalty',
-        'loyalty_vip_buy',
-        'collectibles',
-        'petcustomization',
-        'frontpage_featured',
-        'builders_club_frontpage',
-        'builders_club_addons',
-        'builders_club_loyalty'
-    ) NOT NULL DEFAULT 'default_3x3';
-
-ALTER TABLE `catalog_pages`
-ADD COLUMN IF NOT EXISTS `catalog_mode` ENUM('NORMAL', 'BUILDER', 'BOTH') NOT NULL DEFAULT 'NORMAL' AFTER `club_only`;
-
-ALTER TABLE `rooms`
-    ADD COLUMN IF NOT EXISTS `builders_club_trial_locked` TINYINT(1) NOT NULL DEFAULT 0 AFTER `allow_underpass`,
-    ADD COLUMN IF NOT EXISTS `builders_club_original_state` VARCHAR(16) NOT NULL DEFAULT 'open' AFTER `builders_club_trial_locked`;
-
-CREATE TABLE IF NOT EXISTS `builders_club_items` (
-    `item_id` INT(11) NOT NULL,
-    `user_id` INT(11) NOT NULL,
-    `room_id` INT(11) NOT NULL DEFAULT 0,
-    PRIMARY KEY (`item_id`),
-    KEY `idx_builders_club_items_user_id` (`user_id`),
-    KEY `idx_builders_club_items_room_id` (`room_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;
-
-ALTER TABLE `catalog_pages_bc`
-    MODIFY COLUMN `page_layout` ENUM(
-        'default_3x3',
-        'club_buy',
-        'club_gift',
-        'frontpage',
-        'spaces',
-        'recycler',
-        'recycler_info',
-        'recycler_prizes',
-        'trophies',
-        'plasto',
-        'marketplace',
-        'marketplace_own_items',
-        'spaces_new',
-        'soundmachine',
-        'guilds',
-        'guild_furni',
-        'info_duckets',
-        'info_rentables',
-        'info_pets',
-        'roomads',
-        'single_bundle',
-        'sold_ltd_items',
-        'badge_display',
-        'bots',
-        'pets',
-        'pets2',
-        'pets3',
-        'productpage1',
-        'room_bundle',
-        'recent_purchases',
-        'default_3x3_color_grouping',
-        'guild_forum',
-        'vip_buy',
-        'info_loyalty',
-        'loyalty_vip_buy',
-        'collectibles',
-        'petcustomization',
-        'frontpage_featured',
-        'builders_club_frontpage',
-        'builders_club_addons',
-        'builders_club_loyalty'
-    ) NOT NULL DEFAULT 'default_3x3';

Database Updates/Own_Database_RunFirst/000_all_database_updates.sql

@@ -121,6 +121,12 @@ INSERT IGNORE INTO `emulator_settings` (`key`, `value`) VALUES
 INSERT IGNORE INTO `emulator_settings` (`key`, `value`) VALUES
 ('camera.extradata', '{"t":"%timestamp%","u":"%id%","m":"","s":"%room_id%","w":"%url%"}');
 
+INSERT INTO emulator_settings (`key`, `value`) VALUES 
+('session.reconnect.grace.seconds', '5');
+
+INSERT INTO emulator_settings (`key`, `value`) VALUES 
+('session.reconnect.effect.id', '188');
+
 -- Camera emulator texts
 INSERT IGNORE INTO `emulator_texts` (`key`, `value`) VALUES
 ('camera.permission', 'You do not have permission to use the camera.');

Database Updates/Own_Database_RunFirst/004_furni_editor.sql

@@ -1,6 +1,6 @@
 INSERT IGNORE INTO `emulator_settings` (`key`, `value`) VALUES
-  ('furni.editor.renderer.config.path', '/var/www/Gamedata/config/renderer-config.json'),
-  ('furni.editor.asset.base.path', '/var/www/Gamedata/furniture/nitro-assets/');
+  ('furni.editor.renderer.config.path', '/var/www/Nitro-V3/dist/configuration/renderer-config.json'),
+  ('furni.editor.asset.base.path', '/var/www/gamedata/furniture/');
   
 ALTER TABLE permissions
 ADD COLUMN `acc_catalogfurni` ENUM('0','1') NOT NULL DEFAULT '0' AFTER `acc_catalog_ids`;

Database Updates/Own_Database_RunFirst/005_normalize_permissions_schema.sql

@@ -1,15 +1,31 @@
 -- Normalizes the legacy `permissions` table into:
 -- 1. `permission_ranks`       -> one row per rank with rank metadata.
--- 2. `permission_definitions` -> one row per permission key with comments and one `rank_<id>` column per rank.
+-- 2. `permission_definitions` -> one row per permission key with comments
+--                               and one `rank_<id>` column per rank.
 --
--- This migration keeps the old `permissions` table untouched so the emulator can safely fall back to it.
--- It also cleans up the older experimental normalized objects if they were already created.
+-- This version uses NO stored procedures and NO DELIMITER directives, so it
+-- works in any MySQL/MariaDB client (HeidiSQL, DBeaver, mysql CLI, phpMyAdmin)
+-- regardless of how that client handles delimiters.
+--
+-- It builds two large dynamic SQL strings via GROUP_CONCAT and executes each
+-- with PREPARE / EXECUTE. That replaces both stored procedures from the
+-- original migration.
 
+SET SESSION group_concat_max_len = 1048576;
+
+-- --------------------------------------------------------------------------
+-- Clean up older experimental objects from previous attempts.
+-- --------------------------------------------------------------------------
 DROP VIEW IF EXISTS `permissions_matrix_view`;
 DROP PROCEDURE IF EXISTS `refresh_permissions_matrix_view`;
+DROP PROCEDURE IF EXISTS `refresh_permission_definition_rank_columns`;
+DROP PROCEDURE IF EXISTS `refresh_permission_definition_values`;
 DROP TABLE IF EXISTS `permission_rank_values`;
 DROP TABLE IF EXISTS `permission_nodes`;
 
+-- --------------------------------------------------------------------------
+-- Target tables.
+-- --------------------------------------------------------------------------
 CREATE TABLE IF NOT EXISTS `permission_ranks` (
   `id` int(11) NOT NULL,
   `rank_name` varchar(25) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NOT NULL,
@@ -42,41 +58,30 @@ ALTER TABLE `permission_definitions`
   DROP COLUMN IF EXISTS `value_type`,
   DROP COLUMN IF EXISTS `sort_order`;
 
+-- --------------------------------------------------------------------------
+-- Make sure the legacy `permissions` table has the rank-metadata columns
+-- the migration reads from it.
+-- --------------------------------------------------------------------------
+ALTER TABLE `permissions`
+  ADD COLUMN IF NOT EXISTS `hidden_rank` tinyint(1) NOT NULL DEFAULT 0 AFTER `rank_name`,
+  ADD COLUMN IF NOT EXISTS `job_description` varchar(255) NOT NULL DEFAULT 'Here to help' AFTER `badge`,
+  ADD COLUMN IF NOT EXISTS `staff_color` varchar(8) NOT NULL DEFAULT '#327fa8' AFTER `job_description`,
+  ADD COLUMN IF NOT EXISTS `staff_background` varchar(255) NOT NULL DEFAULT 'staff-bg.png' AFTER `staff_color`;
+
+-- --------------------------------------------------------------------------
+-- Copy rank metadata into `permission_ranks`.
+-- --------------------------------------------------------------------------
 INSERT INTO `permission_ranks` (
-  `id`,
-  `rank_name`,
-  `hidden_rank`,
-  `badge`,
-  `job_description`,
-  `staff_color`,
-  `staff_background`,
-  `level`,
-  `room_effect`,
-  `log_commands`,
-  `prefix`,
-  `prefix_color`,
-  `auto_credits_amount`,
-  `auto_pixels_amount`,
-  `auto_gotw_amount`,
-  `auto_points_amount`
+  `id`, `rank_name`, `hidden_rank`, `badge`, `job_description`,
+  `staff_color`, `staff_background`, `level`, `room_effect`, `log_commands`,
+  `prefix`, `prefix_color`,
+  `auto_credits_amount`, `auto_pixels_amount`, `auto_gotw_amount`, `auto_points_amount`
 )
 SELECT
-  `id`,
-  `rank_name`,
-  `hidden_rank`,
-  `badge`,
-  `job_description`,
-  `staff_color`,
-  `staff_background`,
-  `level`,
-  `room_effect`,
-  `log_commands`,
-  `prefix`,
-  `prefix_color`,
-  `auto_credits_amount`,
-  `auto_pixels_amount`,
-  `auto_gotw_amount`,
-  `auto_points_amount`
+  `id`, `rank_name`, `hidden_rank`, `badge`, `job_description`,
+  `staff_color`, `staff_background`, `level`, `room_effect`, `log_commands`,
+  `prefix`, `prefix_color`,
+  `auto_credits_amount`, `auto_pixels_amount`, `auto_gotw_amount`, `auto_points_amount`
 FROM `permissions`
 ON DUPLICATE KEY UPDATE
   `rank_name` = VALUES(`rank_name`),
@@ -95,55 +100,30 @@ ON DUPLICATE KEY UPDATE
   `auto_gotw_amount` = VALUES(`auto_gotw_amount`),
   `auto_points_amount` = VALUES(`auto_points_amount`);
 
-DROP PROCEDURE IF EXISTS `refresh_permission_definition_rank_columns`;
+-- --------------------------------------------------------------------------
+-- Add a `rank_<id>` column to `permission_definitions` for every rank,
+-- in one dynamic ALTER TABLE statement.
+-- (Replaces the refresh_permission_definition_rank_columns procedure.)
+-- --------------------------------------------------------------------------
+SET @add_rank_columns_sql = NULL;
 
-DELIMITER $$
-CREATE PROCEDURE `refresh_permission_definition_rank_columns`()
-BEGIN
-  DECLARE done INT DEFAULT 0;
-  DECLARE current_rank_id INT;
-  DECLARE current_column_name VARCHAR(32);
-  DECLARE column_exists INT DEFAULT 0;
-  DECLARE rank_cursor CURSOR FOR SELECT `id` FROM `permission_ranks` ORDER BY `id` ASC;
-  DECLARE CONTINUE HANDLER FOR NOT FOUND SET done = 1;
+SELECT GROUP_CONCAT(
+         CONCAT('ADD COLUMN IF NOT EXISTS `rank_', `id`, '` tinyint(3) unsigned NOT NULL DEFAULT 0')
+         ORDER BY `id` ASC
+         SEPARATOR ', '
+       )
+  INTO @add_rank_columns_sql
+FROM `permission_ranks`;
 
-  OPEN rank_cursor;
+SET @add_rank_columns_sql = CONCAT('ALTER TABLE `permission_definitions` ', @add_rank_columns_sql);
 
-  rank_loop: LOOP
-    FETCH rank_cursor INTO current_rank_id;
-
-    IF done = 1 THEN
-      LEAVE rank_loop;
-    END IF;
-
-    SET current_column_name = CONCAT('rank_', current_rank_id);
-
-    SELECT COUNT(*)
-      INTO column_exists
-    FROM `information_schema`.`columns`
-    WHERE `table_schema` = DATABASE()
-      AND `table_name` = 'permission_definitions'
-      AND `column_name` = current_column_name;
-
-    IF column_exists = 0 THEN
-      SET @alter_permissions_column_sql = CONCAT(
-        'ALTER TABLE `permission_definitions` ADD COLUMN `',
-        current_column_name,
-        '` tinyint(3) unsigned NOT NULL DEFAULT 0'
-      );
-
-      PREPARE alter_permissions_column_stmt FROM @alter_permissions_column_sql;
-      EXECUTE alter_permissions_column_stmt;
-      DEALLOCATE PREPARE alter_permissions_column_stmt;
-    END IF;
-  END LOOP;
-
-  CLOSE rank_cursor;
-END$$
-DELIMITER ;
-
-CALL `refresh_permission_definition_rank_columns`();
+PREPARE add_rank_columns_stmt FROM @add_rank_columns_sql;
+EXECUTE add_rank_columns_stmt;
+DEALLOCATE PREPARE add_rank_columns_stmt;
 
+-- --------------------------------------------------------------------------
+-- Seed `permission_definitions` from the columns of the legacy table.
+-- --------------------------------------------------------------------------
 INSERT INTO `permission_definitions` (
   `permission_key`,
   `max_value`,
@@ -187,27 +167,18 @@ FROM `information_schema`.`columns`
 WHERE `table_schema` = DATABASE()
   AND `table_name` = 'permissions'
   AND `column_name` NOT IN (
-    'id',
-    'rank_name',
-    'hidden_rank',
-    'badge',
-    'job_description',
-    'staff_color',
-    'staff_background',
-    'level',
-    'room_effect',
-    'log_commands',
-    'prefix',
-    'prefix_color',
-    'auto_credits_amount',
-    'auto_pixels_amount',
-    'auto_gotw_amount',
-    'auto_points_amount'
+    'id', 'rank_name', 'hidden_rank', 'badge', 'job_description',
+    'staff_color', 'staff_background', 'level', 'room_effect', 'log_commands',
+    'prefix', 'prefix_color',
+    'auto_credits_amount', 'auto_pixels_amount', 'auto_gotw_amount', 'auto_points_amount'
   )
 ON DUPLICATE KEY UPDATE
   `max_value` = VALUES(`max_value`),
-  `comment` = VALUES(`comment`);
+  `comment`   = VALUES(`comment`);
 
+-- --------------------------------------------------------------------------
+-- Override generated comments with curated text where we have it.
+-- --------------------------------------------------------------------------
 DROP TEMPORARY TABLE IF EXISTS `tmp_permission_comments`;
 
 CREATE TEMPORARY TABLE `tmp_permission_comments` (
@@ -421,79 +392,107 @@ SET pd.`comment` = tc.`comment`;
 
 DROP TEMPORARY TABLE IF EXISTS `tmp_permission_comments`;
 
-DROP PROCEDURE IF EXISTS `refresh_permission_definition_values`;
+-- --------------------------------------------------------------------------
+-- Copy values from the wide `permissions` table into each `rank_<id>` column
+-- of `permission_definitions`, one rank at a time, via dynamic SQL.
+-- (Replaces the refresh_permission_definition_values procedure.)
+--
+-- Strategy: build a single UPDATE per rank that joins `permission_definitions`
+-- against a derived table whose rows are (permission_key, value) for that
+-- rank — one row per permission column in `permissions`.
+-- --------------------------------------------------------------------------
 
-DELIMITER $$
-CREATE PROCEDURE `refresh_permission_definition_values`()
-BEGIN
-  DECLARE done INT DEFAULT 0;
-  DECLARE current_rank_id INT;
-  DECLARE current_column_name VARCHAR(32);
-  DECLARE rank_cursor CURSOR FOR SELECT `id` FROM `permission_ranks` ORDER BY `id` ASC;
-  DECLARE CONTINUE HANDLER FOR NOT FOUND SET done = 1;
+-- We need to loop over rank ids without a stored procedure. We do that by
+-- selecting all rank ids into a comma-separated string and then iterating
+-- with substring math using a CTE-driven counter. Simpler: build one giant
+-- UPDATE per rank by hand using GROUP_CONCAT and then EXECUTE each in turn.
+--
+-- To avoid a procedural loop entirely, we instead emit a *single* UPDATE
+-- that uses CASE expressions to set every `rank_<id>` column from a single
+-- derived table containing all ranks' values. This is one PREPARE / EXECUTE.
 
-  OPEN rank_cursor;
+SET @permission_columns_sql = NULL;
 
-  rank_loop: LOOP
-    FETCH rank_cursor INTO current_rank_id;
+-- All the permission columns from the legacy table, comma separated and quoted.
+SELECT GROUP_CONCAT(
+         CONCAT('`', REPLACE(`column_name`, '`', '``'), '`')
+         ORDER BY `ordinal_position`
+         SEPARATOR ', '
+       )
+  INTO @permission_columns_sql
+FROM `information_schema`.`columns`
+WHERE `table_schema` = DATABASE()
+  AND `table_name` = 'permissions'
+  AND `column_name` NOT IN (
+    'id', 'rank_name', 'hidden_rank', 'badge', 'job_description',
+    'staff_color', 'staff_background', 'level', 'room_effect', 'log_commands',
+    'prefix', 'prefix_color',
+    'auto_credits_amount', 'auto_pixels_amount', 'auto_gotw_amount', 'auto_points_amount'
+  );
 
-    IF done = 1 THEN
-      LEAVE rank_loop;
-    END IF;
+-- Build the UNPIVOT body: one "SELECT id, 'col' AS k, `col` AS v FROM permissions UNION ALL ..." per column.
+SET @unpivot_sql = NULL;
 
-    SET current_column_name = CONCAT('rank_', current_rank_id);
+SELECT GROUP_CONCAT(
+         CONCAT(
+           'SELECT `id` AS rank_id, ''',
+           REPLACE(`column_name`, '''', ''''''),
+           ''' AS permission_key, CAST(COALESCE(`',
+           REPLACE(`column_name`, '`', '``'),
+           '`, ''0'') AS UNSIGNED) AS permission_value FROM `permissions`'
+         )
+         ORDER BY `ordinal_position`
+         SEPARATOR ' UNION ALL '
+       )
+  INTO @unpivot_sql
+FROM `information_schema`.`columns`
+WHERE `table_schema` = DATABASE()
+  AND `table_name` = 'permissions'
+  AND `column_name` NOT IN (
+    'id', 'rank_name', 'hidden_rank', 'badge', 'job_description',
+    'staff_color', 'staff_background', 'level', 'room_effect', 'log_commands',
+    'prefix', 'prefix_color',
+    'auto_credits_amount', 'auto_pixels_amount', 'auto_gotw_amount', 'auto_points_amount'
+  );
 
-    SELECT GROUP_CONCAT(
-      CONCAT(
-        'SELECT ''',
-        REPLACE(`column_name`, '''', ''''''),
-        ''' AS permission_key, CAST(COALESCE(`',
-        REPLACE(`column_name`, '`', '``'),
-        '`, ''0'') AS UNSIGNED) AS permission_value FROM `permissions` WHERE `id` = ',
-        current_rank_id
-      )
-      ORDER BY `ordinal_position`
-      SEPARATOR ' UNION ALL '
-    ) INTO @permission_rank_source_sql
-    FROM `information_schema`.`columns`
-    WHERE `table_schema` = DATABASE()
-      AND `table_name` = 'permissions'
-      AND `column_name` NOT IN (
-        'id',
-        'rank_name',
-        'hidden_rank',
-        'badge',
-        'job_description',
-        'staff_color',
-        'staff_background',
-        'level',
-        'room_effect',
-        'log_commands',
-        'prefix',
-        'prefix_color',
-        'auto_credits_amount',
-        'auto_pixels_amount',
-        'auto_gotw_amount',
-        'auto_points_amount'
-      );
+-- Build the SET clause: `rank_<id>` = MAX(CASE WHEN rank_id = <id> THEN permission_value END) for each rank.
+SET @set_clause_sql = NULL;
 
-    SET @permission_rank_update_sql = CONCAT(
-      'UPDATE `permission_definitions` pd ',
-      'INNER JOIN (',
-      @permission_rank_source_sql,
-      ') src ON src.permission_key = pd.permission_key ',
-      'SET pd.`',
-      current_column_name,
-      '` = src.permission_value'
-    );
+SELECT GROUP_CONCAT(
+         CONCAT(
+           'pd.`rank_', `id`,
+           '` = COALESCE(src.`rank_', `id`, '`, pd.`rank_', `id`, '`)'
+         )
+         ORDER BY `id` ASC
+         SEPARATOR ', '
+       )
+  INTO @set_clause_sql
+FROM `permission_ranks`;
 
-    PREPARE permission_rank_update_stmt FROM @permission_rank_update_sql;
-    EXECUTE permission_rank_update_stmt;
-    DEALLOCATE PREPARE permission_rank_update_stmt;
-  END LOOP;
+-- Pivot subquery: one row per permission_key, one column per rank_<id>.
+SET @pivot_sql = NULL;
 
-  CLOSE rank_cursor;
-END$$
-DELIMITER ;
+SELECT GROUP_CONCAT(
+         CONCAT(
+           'MAX(CASE WHEN rank_id = ', `id`,
+           ' THEN permission_value END) AS `rank_', `id`, '`'
+         )
+         ORDER BY `id` ASC
+         SEPARATOR ', '
+       )
+  INTO @pivot_sql
+FROM `permission_ranks`;
 
-CALL `refresh_permission_definition_values`();
+SET @final_update_sql = CONCAT(
+  'UPDATE `permission_definitions` pd ',
+  'INNER JOIN ( ',
+    'SELECT permission_key, ', @pivot_sql, ' ',
+    'FROM ( ', @unpivot_sql, ' ) u ',
+    'GROUP BY permission_key ',
+  ') src ON src.permission_key = pd.`permission_key` ',
+  'SET ', @set_clause_sql
+);
+
+PREPARE final_update_stmt FROM @final_update_sql;
+EXECUTE final_update_stmt;
+DEALLOCATE PREPARE final_update_stmt;

Database Updates/Own_Database_RunFirst/010_Wired_Update.sql

@@ -0,0 +1,500 @@
+UPDATE emulator_settings SET `value` = '1' WHERE (`key` = 'wired.engine.enabled');
+UPDATE emulator_settings SET `value` = '1' WHERE (`key` = 'wired.engine.exclusive');
+
+ALTER TABLE emulator_settings
+ADD COLUMN IF NOT EXISTS `comment` VARCHAR(255) NOT NULL AFTER `value`;
+
+
+CREATE TABLE IF NOT EXISTS `catalog_items_bc` (
+  `id` int(11) NOT NULL AUTO_INCREMENT,
+  `item_ids` varchar(666) NOT NULL,
+  `page_id` int(11) NOT NULL,
+  `catalog_name` varchar(100) NOT NULL,
+  `order_number` int(11) NOT NULL DEFAULT 1,
+  `extradata` varchar(500) NOT NULL DEFAULT '',
+  PRIMARY KEY (`id`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=21 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci ROW_FORMAT=DYNAMIC;
+
+CREATE TABLE IF NOT EXISTS `catalog_pages_bc` (
+  `id` int(11) NOT NULL AUTO_INCREMENT,
+  `parent_id` int(11) NOT NULL DEFAULT -1,
+  `caption` varchar(128) NOT NULL,
+  `page_layout` enum(
+    'default_3x3','club_buy','club_gift','frontpage','spaces','recycler',
+    'recycler_info','recycler_prizes','trophies','plasto','marketplace',
+    'marketplace_own_items','spaces_new','soundmachine','guilds','guild_furni',
+    'info_duckets','info_rentables','info_pets','roomads','single_bundle',
+    'sold_ltd_items','badge_display','bots','pets','pets2','pets3',
+    'productpage1','room_bundle','recent_purchases',
+    'default_3x3_color_grouping','guild_forum','vip_buy','info_loyalty',
+    'loyalty_vip_buy','collectibles','petcustomization','frontpage_featured'
+  ) NOT NULL DEFAULT 'default_3x3',
+  `icon_color` int(11) NOT NULL DEFAULT 1,
+  `icon_image` int(11) NOT NULL DEFAULT 1,
+  `order_num` int(11) NOT NULL DEFAULT 1,
+  `visible` enum('0','1') NOT NULL DEFAULT '1',
+  `enabled` enum('0','1') NOT NULL DEFAULT '1',
+  `page_headline` varchar(1024) NOT NULL DEFAULT '',
+  `page_teaser` varchar(64) NOT NULL DEFAULT '',
+  `page_special` varchar(2048) DEFAULT '' COMMENT 'Gold Bubble: catalog_special_txtbg1 // Speech Bubble: catalog_special_txtbg2 // Place normal text in page_text_teaser',
+  `page_text1` text DEFAULT NULL,
+  `page_text2` text DEFAULT NULL,
+  `page_text_details` text DEFAULT NULL,
+  `page_text_teaser` text DEFAULT NULL,
+  PRIMARY KEY (`id`) USING BTREE
+) ENGINE=MyISAM AUTO_INCREMENT=9 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci ROW_FORMAT=DYNAMIC;
+
+ALTER TABLE `catalog_club_offers`
+MODIFY COLUMN `type` ENUM('HC','VIP','BUILDERS_CLUB','BUILDERS_CLUB_ADDON') NOT NULL DEFAULT 'HC';
+
+ALTER TABLE `catalog_pages`
+  MODIFY COLUMN `page_layout` ENUM(
+    'default_3x3',
+    'club_buy',
+    'club_gift',
+    'frontpage',
+    'spaces',
+    'recycler',
+    'recycler_info',
+    'recycler_prizes',
+    'trophies',
+    'plasto',
+    'marketplace',
+    'marketplace_own_items',
+    'spaces_new',
+    'soundmachine',
+    'guilds',
+    'guild_furni',
+    'info_duckets',
+    'info_rentables',
+    'info_pets',
+    'roomads',
+    'single_bundle',
+    'sold_ltd_items',
+    'badge_display',
+    'bots',
+    'pets',
+    'pets2',
+    'pets3',
+    'productpage1',
+    'room_bundle',
+    'recent_purchases',
+    'default_3x3_color_grouping',
+    'guild_forum',
+    'vip_buy',
+    'info_loyalty',
+    'loyalty_vip_buy',
+    'collectibles',
+    'petcustomization',
+    'frontpage_featured',
+    'builders_club_frontpage',
+    'builders_club_addons',
+    'builders_club_loyalty'
+  ) NOT NULL DEFAULT 'default_3x3';
+
+ALTER TABLE `catalog_pages`
+ADD COLUMN IF NOT EXISTS `catalog_mode` ENUM('NORMAL','BUILDER','BOTH') NOT NULL DEFAULT 'NORMAL'
+AFTER `club_only`;
+
+ALTER TABLE `catalog_pages_bc`
+  MODIFY COLUMN `page_layout` ENUM(
+    'default_3x3',
+    'club_buy',
+    'club_gift',
+    'frontpage',
+    'spaces',
+    'recycler',
+    'recycler_info',
+    'recycler_prizes',
+    'trophies',
+    'plasto',
+    'marketplace',
+    'marketplace_own_items',
+    'spaces_new',
+    'soundmachine',
+    'guilds',
+    'guild_furni',
+    'info_duckets',
+    'info_rentables',
+    'info_pets',
+    'roomads',
+    'single_bundle',
+    'sold_ltd_items',
+    'badge_display',
+    'bots',
+    'pets',
+    'pets2',
+    'pets3',
+    'productpage1',
+    'room_bundle',
+    'recent_purchases',
+    'default_3x3_color_grouping',
+    'guild_forum',
+    'vip_buy',
+    'info_loyalty',
+    'loyalty_vip_buy',
+    'collectibles',
+    'petcustomization',
+    'frontpage_featured',
+    'builders_club_frontpage',
+    'builders_club_addons',
+    'builders_club_loyalty'
+  ) NOT NULL DEFAULT 'default_3x3';
+
+SET @col_exists := (
+  SELECT COUNT(*) FROM information_schema.COLUMNS
+  WHERE TABLE_SCHEMA = DATABASE()
+  AND TABLE_NAME = 'users_settings'
+  AND COLUMN_NAME = 'builders_club_bonus_furni'
+);
+SET @sql := IF(@col_exists = 0,
+  'ALTER TABLE `users_settings` ADD COLUMN `builders_club_bonus_furni` INT NOT NULL DEFAULT 0;',
+  'SELECT "exists";'
+);
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+CREATE TABLE IF NOT EXISTS `wired_emulator_settings` (
+  `key` varchar(191) NOT NULL,
+  `value` text NOT NULL,
+  `comment` text NOT NULL,
+  PRIMARY KEY (`key`)
+) ENGINE=InnoDB DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;
+
+INSERT INTO `wired_emulator_settings` (`key`, `value`, `comment`)
+SELECT 'wired.engine.enabled', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.engine.enabled' LIMIT 1), '1'), 'Compatibility flag kept for older configs. The runtime now always uses the new wired engine.'
+UNION ALL
+SELECT 'wired.engine.exclusive', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.engine.exclusive' LIMIT 1), '1'), 'Compatibility flag kept for older configs. The runtime now always uses the new wired engine.'
+UNION ALL
+SELECT 'wired.engine.maxStepsPerStack', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.engine.maxStepsPerStack' LIMIT 1), '100'), 'Maximum amount of internal processing steps allowed for a single wired stack execution.'
+UNION ALL
+SELECT 'wired.engine.debug', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.engine.debug' LIMIT 1), '0'), 'Enable verbose debug logging for the new wired engine.'
+UNION ALL
+SELECT 'wired.custom.enabled', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.custom.enabled' LIMIT 1), '0'), 'Enable custom legacy wired behaviour such as user-based cooldown exceptions and compatibility logic.'
+UNION ALL
+SELECT 'hotel.wired.furni.selection.count', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'hotel.wired.furni.selection.count' LIMIT 1), '5'), 'Maximum number of furni that a wired box can store or select.'
+UNION ALL
+SELECT 'hotel.wired.max_delay', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'hotel.wired.max_delay' LIMIT 1), '20'), 'Maximum delay value accepted by wired effects that support delayed execution.'
+UNION ALL
+SELECT 'hotel.wired.message.max_length', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'hotel.wired.message.max_length' LIMIT 1), '100'), 'Maximum length of text fields used by wired messages and bot text effects.'
+UNION ALL
+SELECT 'wired.effect.teleport.delay', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.effect.teleport.delay' LIMIT 1), '500'), 'Delay in milliseconds used by wired teleport movement.'
+UNION ALL
+SELECT 'wired.place.under', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.place.under' LIMIT 1), '0'), 'Allow placing wired furniture underneath other items when room rules permit it.'
+UNION ALL
+SELECT 'wired.tick.interval.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.tick.interval.ms' LIMIT 1), '50'), 'Global wired tick interval in milliseconds used by repeaters and other tick-driven wired items.'
+UNION ALL
+SELECT 'wired.tick.resolution', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.tick.resolution' LIMIT 1), '100'), 'Legacy wired tick resolution value kept for compatibility with older wired timing setups.'
+UNION ALL
+SELECT 'wired.tick.debug', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.tick.debug' LIMIT 1), '0'), 'Enable verbose logging for the wired tick service.'
+UNION ALL
+SELECT 'wired.tick.thread.priority', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.tick.thread.priority' LIMIT 1), '6'), 'Java thread priority used by the wired tick service.'
+UNION ALL
+SELECT 'wired.highscores.displaycount', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.highscores.displaycount' LIMIT 1), '25'), 'Maximum number of wired highscore entries shown to users when a highscore is displayed.'
+UNION ALL
+SELECT 'wired.abuse.max.recursion.depth', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.abuse.max.recursion.depth' LIMIT 1), '10'), 'Maximum recursive wired depth allowed before execution is stopped.'
+UNION ALL
+SELECT 'wired.abuse.max.events.per.window', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.abuse.max.events.per.window' LIMIT 1), '100'), 'Maximum amount of identical wired events allowed inside the abuse rate-limit window before a room ban is applied.'
+UNION ALL
+SELECT 'wired.abuse.rate.limit.window.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.abuse.rate.limit.window.ms' LIMIT 1), '10000'), 'Time window in milliseconds used by the wired abuse rate limiter.'
+UNION ALL
+SELECT 'wired.abuse.ban.duration.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.abuse.ban.duration.ms' LIMIT 1), '600000'), 'Duration in milliseconds of the temporary wired ban after abuse detection.'
+UNION ALL
+SELECT 'wired.monitor.usage.window.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.usage.window.ms' LIMIT 1), '1000'), 'Rolling window size in milliseconds used to calculate wired usage in the :wired monitor.'
+UNION ALL
+SELECT 'wired.monitor.usage.limit', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.usage.limit' LIMIT 1), '1000'), 'Maximum wired usage budget allowed in one monitor window before EXECUTION_CAP is raised.'
+UNION ALL
+SELECT 'wired.monitor.delayed.events.limit', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.delayed.events.limit' LIMIT 1), '100'), 'Maximum number of delayed wired events that can be queued in one room at the same time.'
+UNION ALL
+SELECT 'wired.monitor.overload.average.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.overload.average.ms' LIMIT 1), '50'), 'Average execution time threshold in milliseconds that starts overload tracking.'
+UNION ALL
+SELECT 'wired.monitor.overload.peak.ms', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.overload.peak.ms' LIMIT 1), '150'), 'Peak single execution time threshold in milliseconds that starts overload tracking.'
+UNION ALL
+SELECT 'wired.monitor.overload.consecutive.windows', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.overload.consecutive.windows' LIMIT 1), '2'), 'Number of consecutive overloaded monitor windows required before logging EXECUTOR_OVERLOAD.'
+UNION ALL
+SELECT 'wired.monitor.heavy.usage.percent', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.heavy.usage.percent' LIMIT 1), '70'), 'Usage percentage threshold that contributes to marking a room as heavy in the :wired monitor.'
+UNION ALL
+SELECT 'wired.monitor.heavy.consecutive.windows', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.heavy.consecutive.windows' LIMIT 1), '5'), 'Number of consecutive windows above the heavy usage threshold required before the room is marked as heavy.'
+UNION ALL
+SELECT 'wired.monitor.heavy.delayed.percent', COALESCE((SELECT `value` FROM `emulator_settings` WHERE `key` = 'wired.monitor.heavy.delayed.percent' LIMIT 1), '60'), 'Delayed queue percentage threshold that also contributes to the heavy-room calculation.'
+ON DUPLICATE KEY UPDATE
+  `value` = VALUES(`value`),
+  `comment` = VALUES(`comment`);
+
+DELETE FROM `emulator_settings`
+WHERE `key` IN (
+  'wired.engine.enabled',
+  'wired.engine.exclusive',
+  'wired.engine.maxStepsPerStack',
+  'wired.engine.debug',
+  'wired.custom.enabled',
+  'hotel.wired.furni.selection.count',
+  'hotel.wired.max_delay',
+  'hotel.wired.message.max_length',
+  'wired.effect.teleport.delay',
+  'wired.place.under',
+  'wired.tick.interval.ms',
+  'wired.tick.resolution',
+  'wired.tick.debug',
+  'wired.tick.thread.priority',
+  'wired.highscores.displaycount',
+  'wired.abuse.max.recursion.depth',
+  'wired.abuse.max.events.per.window',
+  'wired.abuse.rate.limit.window.ms',
+  'wired.abuse.ban.duration.ms',
+  'wired.monitor.usage.window.ms',
+  'wired.monitor.usage.limit',
+  'wired.monitor.delayed.events.limit',
+  'wired.monitor.overload.average.ms',
+  'wired.monitor.overload.peak.ms',
+  'wired.monitor.overload.consecutive.windows',
+  'wired.monitor.heavy.usage.percent',
+  'wired.monitor.heavy.consecutive.windows',
+  'wired.monitor.heavy.delayed.percent'
+);
+
+UPDATE `emulator_settings` SET `comment` = 'Allow whispering while a user stands inside a mute area.' WHERE `key` = 'room.chat.mutearea.allow_whisper';
+UPDATE `emulator_settings` SET `comment` = 'HTML or text format used for room chat prefixes.' WHERE `key` = 'room.chat.prefix.format';
+UPDATE `emulator_settings` SET `comment` = 'Badge code displayed on promoted rooms.' WHERE `key` = 'room.promotion.badge';
+UPDATE `emulator_settings` SET `comment` = 'Image used by Rosie bubble notifications.' WHERE `key` = 'rosie.bubble.image.url';
+UPDATE `emulator_settings` SET `comment` = 'Currency type used by Rosie when buying a room or room package.' WHERE `key` = 'rosie.buyroom.currency.type';
+UPDATE `emulator_settings` SET `comment` = 'Configuration value used by `runtime.threads`.' WHERE `key` = 'runtime.threads';
+UPDATE `emulator_settings` SET `comment` = 'Configuration value used by `save.private.chats`.' WHERE `key` = 'save.private.chats';
+UPDATE `emulator_settings` SET `comment` = 'Configuration value used by `save.room.chats`.' WHERE `key` = 'save.room.chats';
+UPDATE `emulator_settings` SET `comment` = 'Expose moderation tickets to the scripter or automation tooling.' WHERE `key` = 'scripter.modtool.tickets';
+UPDATE `emulator_settings` SET `comment` = 'Currency type ID used for diamonds.' WHERE `key` = 'seasonal.currency.diamond';
+UPDATE `emulator_settings` SET `comment` = 'Currency type ID used for duckets.' WHERE `key` = 'seasonal.currency.ducket';
+UPDATE `emulator_settings` SET `comment` = 'Semicolon-separated display names for seasonal currency types.' WHERE `key` = 'seasonal.currency.names';
+UPDATE `emulator_settings` SET `comment` = 'Currency type ID used for pixels.' WHERE `key` = 'seasonal.currency.pixel';
+UPDATE `emulator_settings` SET `comment` = 'Currency type ID used for shells.' WHERE `key` = 'seasonal.currency.shell';
+UPDATE `emulator_settings` SET `comment` = 'Primary seasonal currency type ID.' WHERE `key` = 'seasonal.primary.type';
+UPDATE `emulator_settings` SET `comment` = 'Semicolon-separated list of currency type IDs treated as seasonal currencies.' WHERE `key` = 'seasonal.types';
+UPDATE `emulator_settings` SET `comment` = 'Achievement code granted for the HC subscription tier.' WHERE `key` = 'subscriptions.hc.achievement';
+UPDATE `emulator_settings` SET `comment` = 'Number of days before expiry when HC discount offers become available.' WHERE `key` = 'subscriptions.hc.discount.days_before_end';
+UPDATE `emulator_settings` SET `comment` = 'Enable discounted HC renewal offers.' WHERE `key` = 'subscriptions.hc.discount.enabled';
+UPDATE `emulator_settings` SET `comment` = 'Reset tracked credits spent when the HC subscription expires.' WHERE `key` = 'subscriptions.hc.payday.creditsspent_reset_on_expire';
+UPDATE `emulator_settings` SET `comment` = 'Currency rewarded by the HC payday system.' WHERE `key` = 'subscriptions.hc.payday.currency';
+UPDATE `emulator_settings` SET `comment` = 'Enable the HC payday reward system.' WHERE `key` = 'subscriptions.hc.payday.enabled';
+UPDATE `emulator_settings` SET `comment` = 'Date interval used between HC payday reward runs.' WHERE `key` = 'subscriptions.hc.payday.interval';
+UPDATE `emulator_settings` SET `comment` = 'Next scheduled execution date for HC payday rewards.' WHERE `key` = 'subscriptions.hc.payday.next_date';
+UPDATE `emulator_settings` SET `comment` = 'Percentage of eligible spending returned by HC payday.' WHERE `key` = 'subscriptions.hc.payday.percentage';
+UPDATE `emulator_settings` SET `comment` = 'Semicolon-separated streak thresholds and rewards for HC payday.' WHERE `key` = 'subscriptions.hc.payday.streak';
+UPDATE `emulator_settings` SET `comment` = 'Enable the subscription background scheduler.' WHERE `key` = 'subscriptions.scheduler.enabled';
+UPDATE `emulator_settings` SET `comment` = 'Interval in minutes between subscription scheduler runs.' WHERE `key` = 'subscriptions.scheduler.interval';
+UPDATE `emulator_settings` SET `comment` = 'Compatibility marker used by the custom team wired implementation. Do not remove.' WHERE `key` = 'team.wired.update.rc-1';
+UPDATE `emulator_settings` SET `comment` = 'API key used by the YouTube integration.' WHERE `key` = 'youtube.apikey';
+
+-- =============================================================
+-- Permissions normalization is handled by 005_normalize_permissions_schema.sql
+-- (Removed from this file to avoid DELIMITER issues in HeidiSQL.)
+-- =============================================================
+
+CREATE TABLE IF NOT EXISTS `room_wired_settings` (
+  `room_id` int(11) NOT NULL,
+  `inspect_mask` int(11) NOT NULL DEFAULT 0 COMMENT 'Bitmask for who can open and inspect Wired in the room. 1=everyone, 2=users with rights, 4=group members, 8=group admins.',
+  `modify_mask` int(11) NOT NULL DEFAULT 0 COMMENT 'Bitmask for who can modify Wired in the room. 2=users with rights, 4=group members, 8=group admins.',
+  PRIMARY KEY (`room_id`),
+  CONSTRAINT `fk_room_wired_settings_room_id` FOREIGN KEY (`room_id`) REFERENCES `rooms` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `room_user_wired_variables` (
+    `room_id` int(11) NOT NULL,
+    `user_id` int(11) NOT NULL,
+    `variable_item_id` int(11) NOT NULL,
+    `value` int(11) DEFAULT NULL,
+    `created_at` int(11) NOT NULL DEFAULT 0,
+    `updated_at` int(11) NOT NULL DEFAULT 0,
+    PRIMARY KEY (`room_id`, `user_id`, `variable_item_id`),
+    KEY `idx_room_user_wired_variables_room_item` (`room_id`, `variable_item_id`),
+    KEY `idx_room_user_wired_variables_user` (`user_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `room_furni_wired_variables` (
+    `room_id` int(11) NOT NULL,
+    `furni_id` int(11) NOT NULL,
+    `variable_item_id` int(11) NOT NULL,
+    `value` int(11) DEFAULT NULL,
+    `created_at` int(11) NOT NULL DEFAULT 0,
+    `updated_at` int(11) NOT NULL DEFAULT 0,
+    PRIMARY KEY (`room_id`, `furni_id`, `variable_item_id`),
+    KEY `idx_room_furni_wired_variables_room_item` (`room_id`, `variable_item_id`),
+    KEY `idx_room_furni_wired_variables_furni` (`furni_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `room_wired_variables` (
+    `room_id` int(11) NOT NULL,
+    `variable_item_id` int(11) NOT NULL,
+    `value` int(11) NOT NULL DEFAULT 0,
+    `created_at` int(11) NOT NULL DEFAULT 0,
+    `updated_at` int(11) NOT NULL DEFAULT 0,
+    PRIMARY KEY (`room_id`, `variable_item_id`),
+    KEY `idx_room_wired_variables_room_item` (`room_id`, `variable_item_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+
+ALTER TABLE `room_user_wired_variables`
+    ADD COLUMN IF NOT EXISTS `created_at` int(11) NOT NULL DEFAULT 0 AFTER `value`;
+
+ALTER TABLE `room_user_wired_variables`
+    ADD COLUMN IF NOT EXISTS `updated_at` int(11) NOT NULL DEFAULT 0 AFTER `created_at`;
+
+UPDATE `room_user_wired_variables`
+SET
+    `created_at` = IF(`created_at` > 0, `created_at`, UNIX_TIMESTAMP()),
+    `updated_at` = IF(`updated_at` > 0, `updated_at`, IF(`created_at` > 0, `created_at`, UNIX_TIMESTAMP()));
+
+ALTER TABLE `room_furni_wired_variables`
+    ADD COLUMN IF NOT EXISTS `created_at` int(11) NOT NULL DEFAULT 0 AFTER `value`;
+
+ALTER TABLE `room_furni_wired_variables`
+    ADD COLUMN IF NOT EXISTS `updated_at` int(11) NOT NULL DEFAULT 0 AFTER `created_at`;
+
+UPDATE `room_furni_wired_variables`
+SET
+    `created_at` = IF(`created_at` > 0, `created_at`, UNIX_TIMESTAMP()),
+    `updated_at` = IF(`updated_at` > 0, `updated_at`, IF(`created_at` > 0, `created_at`, UNIX_TIMESTAMP()));
+
+ALTER TABLE `room_wired_variables`
+    ADD COLUMN IF NOT EXISTS `created_at` int(11) NOT NULL DEFAULT 0 AFTER `value`;
+
+ALTER TABLE `room_wired_variables`
+    ADD COLUMN IF NOT EXISTS `updated_at` int(11) NOT NULL DEFAULT 0 AFTER `created_at`;
+
+UPDATE `room_wired_variables`
+SET
+    `created_at` = 0,
+    `updated_at` = IF(`updated_at` > 0, `updated_at`, UNIX_TIMESTAMP());
+
+INSERT INTO `chat_bubbles` (`type`, `name`, `permission`, `overridable`, `triggers_talking_furniture`) VALUES
+(200, 'SHOW_MESSAGE_RED', '', 1, 0),
+(201, 'SHOW_MESSAGE_GREEN', '', 1, 0),
+(202, 'SHOW_MESSAGE_BLUE', '', 1, 0),
+(210, 'SHOW_MESSAGE_ALERT', '', 1, 0),
+(211, 'SHOW_MESSAGE_INFO', '', 1, 0),
+(212, 'SHOW_MESSAGE_WARNING', '', 1, 0),
+(220, 'SHOW_MESSAGE_WRONG', '', 1, 0),
+(221, 'SHOW_MESSAGE_WRONG_CIRCLED', '', 1, 0),
+(222, 'SHOW_MESSAGE_CORRECT', '', 1, 0),
+(223, 'SHOW_MESSAGE_CORRECT_CIRCLED', '', 1, 0),
+(224, 'SHOW_MESSAGE_QUESTION', '', 1, 0),
+(225, 'SHOW_MESSAGE_QUESTION_CIRCLED', '', 1, 0),
+(226, 'SHOW_MESSAGE_ARROW_UP', '', 1, 0),
+(227, 'SHOW_MESSAGE_ARROW_UP_CIRCLED', '', 1, 0),
+(228, 'SHOW_MESSAGE_ARROW_DOWN', '', 1, 0),
+(229, 'SHOW_MESSAGE_ARROW_DOWN_CIRCLED', '', 1, 0),
+(250, 'SHOW_MESSAGE_SKULL', '', 1, 0),
+(251, 'SHOW_MESSAGE_SKULL_ALT', '', 1, 0),
+(252, 'SHOW_MESSAGE_MAGNIFIER', '', 1, 0)
+ON DUPLICATE KEY UPDATE
+    `name` = VALUES(`name`),
+    `permission` = VALUES(`permission`),
+    `overridable` = VALUES(`overridable`),
+    `triggers_talking_furniture` = VALUES(`triggers_talking_furniture`);
+
+ALTER TABLE `catalog_club_offers`
+MODIFY COLUMN `type` ENUM('HC', 'VIP', 'BUILDERS_CLUB', 'BUILDERS_CLUB_ADDON') NOT NULL DEFAULT 'HC';
+
+ALTER TABLE `catalog_pages`
+    MODIFY COLUMN `page_layout` ENUM(
+        'default_3x3',
+        'club_buy',
+        'club_gift',
+        'frontpage',
+        'spaces',
+        'recycler',
+        'recycler_info',
+        'recycler_prizes',
+        'trophies',
+        'plasto',
+        'marketplace',
+        'marketplace_own_items',
+        'spaces_new',
+        'soundmachine',
+        'guilds',
+        'guild_furni',
+        'info_duckets',
+        'info_rentables',
+        'info_pets',
+        'roomads',
+        'single_bundle',
+        'sold_ltd_items',
+        'badge_display',
+        'bots',
+        'pets',
+        'pets2',
+        'pets3',
+        'productpage1',
+        'room_bundle',
+        'recent_purchases',
+        'default_3x3_color_grouping',
+        'guild_forum',
+        'vip_buy',
+        'info_loyalty',
+        'loyalty_vip_buy',
+        'collectibles',
+        'petcustomization',
+        'frontpage_featured',
+        'builders_club_frontpage',
+        'builders_club_addons',
+        'builders_club_loyalty'
+    ) NOT NULL DEFAULT 'default_3x3';
+
+ALTER TABLE `catalog_pages`
+ADD COLUMN IF NOT EXISTS `catalog_mode` ENUM('NORMAL', 'BUILDER', 'BOTH') NOT NULL DEFAULT 'NORMAL' AFTER `club_only`;
+
+ALTER TABLE `rooms`
+    ADD COLUMN IF NOT EXISTS `builders_club_trial_locked` TINYINT(1) NOT NULL DEFAULT 0 AFTER `allow_underpass`,
+    ADD COLUMN IF NOT EXISTS `builders_club_original_state` VARCHAR(16) NOT NULL DEFAULT 'open' AFTER `builders_club_trial_locked`;
+
+CREATE TABLE IF NOT EXISTS `builders_club_items` (
+    `item_id` INT(11) NOT NULL,
+    `user_id` INT(11) NOT NULL,
+    `room_id` INT(11) NOT NULL DEFAULT 0,
+    PRIMARY KEY (`item_id`),
+    KEY `idx_builders_club_items_user_id` (`user_id`),
+    KEY `idx_builders_club_items_room_id` (`room_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;
+
+ALTER TABLE `catalog_pages_bc`
+    MODIFY COLUMN `page_layout` ENUM(
+        'default_3x3',
+        'club_buy',
+        'club_gift',
+        'frontpage',
+        'spaces',
+        'recycler',
+        'recycler_info',
+        'recycler_prizes',
+        'trophies',
+        'plasto',
+        'marketplace',
+        'marketplace_own_items',
+        'spaces_new',
+        'soundmachine',
+        'guilds',
+        'guild_furni',
+        'info_duckets',
+        'info_rentables',
+        'info_pets',
+        'roomads',
+        'single_bundle',
+        'sold_ltd_items',
+        'badge_display',
+        'bots',
+        'pets',
+        'pets2',
+        'pets3',
+        'productpage1',
+        'room_bundle',
+        'recent_purchases',
+        'default_3x3_color_grouping',
+        'guild_forum',
+        'vip_buy',
+        'info_loyalty',
+        'loyalty_vip_buy',
+        'collectibles',
+        'petcustomization',
+        'frontpage_featured',
+        'builders_club_frontpage',
+        'builders_club_addons',
+        'builders_club_loyalty'
+    ) NOT NULL DEFAULT 'default_3x3';

Database Updates/Own_Database_RunFirst/018_Last_Username_Change.sql

@@ -0,0 +1,6 @@
+ALTER TABLE users
+ADD COLUMN `last_username_change` INT(11) NOT NULL DEFAULT 0;
+
+
+INSERT INTO emulator_settings (`key`, `value`, `comment`)
+VALUES ('rename.cooldown_days', '30', 'Days between username changes');

Database Updates/Own_Database_RunFirst/019_custom_nick_login_tokens_wired_message.sql

@@ -34,3 +34,18 @@ INSERT IGNORE INTO `custom_nick_icons_catalog` (`icon_key`, `display_name`, `poi
     ('6', 'Icon 6', 10, 0, 1, 6);
 ALTER TABLE `custom_nick_icons_catalog`
     ADD COLUMN IF NOT EXISTS `display_name` VARCHAR(100) NOT NULL DEFAULT '' AFTER `icon_key`;
+	
+ALTER TABLE `users`
+    ADD COLUMN IF NOT EXISTS `remember_token_hash` VARCHAR(64) NOT NULL DEFAULT '' AFTER `auth_ticket`;
+
+ALTER TABLE `users`
+    ADD COLUMN IF NOT EXISTS `remember_token_expires_at` INT(11) UNSIGNED NOT NULL DEFAULT 0 AFTER `remember_token_hash`;
+
+ALTER TABLE `users`
+    ADD INDEX IF NOT EXISTS `idx_users_remember_token_hash` (`remember_token_hash`);
+
+
+INSERT INTO `wired_emulator_settings` (`key`, `value`, `comment`)
+VALUES ('hotel.wired.message.max_length', '512', 'Maximum length of text fields used by wired messages and bot text effects.')
+ON DUPLICATE KEY UPDATE `value` = '512';
+

Database Updates/remember_login_tokens.sql

@@ -1,8 +0,0 @@
-ALTER TABLE `users`
-    ADD COLUMN IF NOT EXISTS `remember_token_hash` VARCHAR(64) NOT NULL DEFAULT '' AFTER `auth_ticket`;
-
-ALTER TABLE `users`
-    ADD COLUMN IF NOT EXISTS `remember_token_expires_at` INT(11) UNSIGNED NOT NULL DEFAULT 0 AFTER `remember_token_hash`;
-
-ALTER TABLE `users`
-    ADD INDEX IF NOT EXISTS `idx_users_remember_token_hash` (`remember_token_hash`);

Database Updates/wired_message_length_512.sql

@@ -1,3 +0,0 @@
-INSERT INTO `wired_emulator_settings` (`key`, `value`, `comment`)
-VALUES ('hotel.wired.message.max_length', '512', 'Maximum length of text fields used by wired messages and bot text effects.')
-ON DUPLICATE KEY UPDATE `value` = '512';

Emulator/pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>com.eu.habbo</groupId>
     <artifactId>Habbo</artifactId>
-    <version>4.1.14</version>
+    <version>4.1.16</version>
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/AboutCommand.java

@@ -3,9 +3,7 @@ package com.eu.habbo.habbohotel.commands;
 import com.eu.habbo.Emulator;
 import com.eu.habbo.habbohotel.catalog.CatalogManager;
 import com.eu.habbo.habbohotel.gameclients.GameClient;
-import com.eu.habbo.messages.outgoing.generic.alerts.MessagesForYouComposer;
 
-import java.util.Collections;
 import java.util.concurrent.TimeUnit;
 
 
@@ -13,9 +11,10 @@ public class AboutCommand extends Command {
     public AboutCommand() {
         super(null, new String[]{"about", "info", "online", "server"});
     }
-    public static String credits = "Arcturus Morningstar is an opensource project based on Arcturus By TheGeneral \n" +
-            "The Following people have all contributed to this emulator:\n" +
-            "TheGeneral\n Beny\n Alejandro\n Capheus\n Skeletor\n Harmonic\n Mike\n Remco\n zGrav \n Quadral \n Harmony\n Swirny\n ArpyAge\n Mikkel\n Rodolfo\n Rasmus\n Kitt Mustang\n Snaiker\n nttzx\n necmi\n Dome\n Jose Flores\n Cam\n Oliver\n Narzo\n Tenshie\n MartenM\n Ridge\n SenpaiDipper\n Snaiker\n Thijmen\n DuckieTM\n simoleo89\n Medievalshell\n Lorenzo (the wired master)";
+
+    public static final String NITRO_INFO_SENTINEL = "[NITRO_INFO_V1]";
+    public static final String REPORT_ISSUES_URL = "https://github.com/duckietm/Nitro-V3/issues";
+
     @Override
     public boolean handle(GameClient gameClient, String[] params) {
 
@@ -27,28 +26,31 @@ public class AboutCommand extends Command {
         long minute = TimeUnit.SECONDS.toMinutes(seconds) - (TimeUnit.SECONDS.toHours(seconds) * 60);
         long second = TimeUnit.SECONDS.toSeconds(seconds) - (TimeUnit.SECONDS.toMinutes(seconds) * 60);
 
-        String message = "<b>" + Emulator.version + "</b>\r\n";
+        StringBuilder message = new StringBuilder();
+        message.append(NITRO_INFO_SENTINEL).append("\r");
+        message.append("<b>").append(Emulator.version).append("</b>\r\n");
 
         if (Emulator.getConfig().getBoolean("info.shown", true)) {
-            message += "<b>Hotel Statistics</b>\r" +
-                    "- Online Users: " + Emulator.getGameEnvironment().getHabboManager().getOnlineCount() + "\r" +
-                    "- Active Rooms: " + Emulator.getGameEnvironment().getRoomManager().getActiveRooms().size() + "\r" +
-                    "- Shop:  " + Emulator.getGameEnvironment().getCatalogManager().catalogPages.size() + " pages and " + CatalogManager.catalogItemAmount + " items. \r" +
-                    "- Furni: " + Emulator.getGameEnvironment().getItemManager().getItems().size() + " item definitions" + "\r" +
-                    "\n" +
-                    "<b>Server Statistics</b>\r" +
-                    "- Uptime: " + day + (day > 1 ? " days, " : " day, ") + hours + (hours > 1 ? " hours, " : " hour, ") + minute + (minute > 1 ? " minutes, " : " minute, ") + second + (second > 1 ? " seconds!" : " second!") + "\r" +
-                    "- RAM Usage: " + (Emulator.getRuntime().totalMemory() - Emulator.getRuntime().freeMemory()) / (1024 * 1024) + "/" + (Emulator.getRuntime().freeMemory()) / (1024 * 1024) + "MB\r" +
-                    "- CPU Cores: " + Emulator.getRuntime().availableProcessors() + "\r" +
-                    "- Total Memory: " + Emulator.getRuntime().maxMemory() / (1024 * 1024) + "MB" + "\r\n";
+            message.append("<b>Hotel Statistics</b>\r")
+                    .append("- Online Users: ").append(Emulator.getGameEnvironment().getHabboManager().getOnlineCount()).append("\r")
+                    .append("- Active Rooms: ").append(Emulator.getGameEnvironment().getRoomManager().getActiveRooms().size()).append("\r")
+                    .append("- Shop: ").append(Emulator.getGameEnvironment().getCatalogManager().catalogPages.size()).append(" pages and ").append(CatalogManager.catalogItemAmount).append(" items.\r")
+                    .append("- Furni: ").append(Emulator.getGameEnvironment().getItemManager().getItems().size()).append(" item definitions\r")
+                    .append("\n")
+                    .append("<b>Server Statistics</b>\r")
+                    .append("- Uptime: ").append(day).append(day == 1 ? " day, " : " days, ").append(hours).append(hours == 1 ? " hour, " : " hours, ").append(minute).append(minute == 1 ? " minute, " : " minutes, ").append(second).append(second == 1 ? " second!" : " seconds!").append("\r")
+                    .append("- RAM Usage: ").append((Emulator.getRuntime().totalMemory() - Emulator.getRuntime().freeMemory()) / (1024 * 1024)).append("/").append((Emulator.getRuntime().freeMemory()) / (1024 * 1024)).append("MB\r")
+                    .append("- CPU Cores: ").append(Emulator.getRuntime().availableProcessors()).append("\r")
+                    .append("- Total Memory: ").append(Emulator.getRuntime().maxMemory() / (1024 * 1024)).append("MB\r\n");
         }
 
-        message += "\r" +
+        message.append("<b>Credits</b>\r")
+                .append("- The General\r")
+                .append("- Krews Team\r")
+                .append("- DuckieTM, simoleo89, Medievalshell, Lorenzo (the wired master), Remco\r\n")
+                .append("Report issues at: ").append(REPORT_ISSUES_URL);
 
-                "<b>Thanks for using Arcturus. Report issues on the forums. http://arcturus.wf \r\r" +
-                "    - The General";
-        gameClient.getHabbo().alert(message);
-        gameClient.sendResponse(new MessagesForYouComposer(Collections.singletonList(credits)));
+        gameClient.getHabbo().alert(message.toString());
         return true;
     }
 }

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/ChangeNameCommand.java

@@ -1,18 +0,0 @@
-package com.eu.habbo.habbohotel.commands;
-
-import com.eu.habbo.Emulator;
-import com.eu.habbo.habbohotel.gameclients.GameClient;
-import com.eu.habbo.messages.outgoing.users.UserDataComposer;
-
-public class ChangeNameCommand extends Command {
-    public ChangeNameCommand() {
-        super("cmd_changename", Emulator.getTexts().getValue("commands.keys.cmd_changename").split(";"));
-    }
-
-    @Override
-    public boolean handle(GameClient gameClient, String[] params) throws Exception {
-        gameClient.getHabbo().getHabboStats().allowNameChange = !gameClient.getHabbo().getHabboStats().allowNameChange;
-        gameClient.sendResponse(new UserDataComposer(gameClient.getHabbo()));
-        return true;
-    }
-}

Emulator/src/main/java/com/eu/habbo/habbohotel/commands/CommandHandler.java

@@ -184,7 +184,6 @@ public class CommandHandler {
         addCommand(new BlockAlertCommand());
         addCommand(new BotsCommand());
         addCommand(new CalendarCommand());
-        addCommand(new ChangeNameCommand());
         addCommand(new ChatTypeCommand());
         addCommand(new CommandsCommand());
         addCommand(new ControlCommand());

Emulator/src/main/java/com/eu/habbo/habbohotel/guilds/GuildManager.java

@@ -2,11 +2,13 @@ package com.eu.habbo.habbohotel.guilds;
 
 import com.eu.habbo.Emulator;
 import com.eu.habbo.habbohotel.gameclients.GameClient;
+import com.eu.habbo.habbohotel.guilds.forums.ForumThread;
 import com.eu.habbo.habbohotel.guilds.forums.ForumView;
 import com.eu.habbo.habbohotel.items.interactions.InteractionGuildFurni;
 import com.eu.habbo.habbohotel.rooms.Room;
 import com.eu.habbo.habbohotel.users.Habbo;
 import com.eu.habbo.messages.outgoing.guilds.GuildJoinErrorComposer;
+import com.eu.habbo.messages.outgoing.guilds.forums.GuildForumDataComposer;
 import gnu.trove.TCollections;
 import gnu.trove.iterator.TIntObjectIterator;
 import gnu.trove.map.TIntObjectMap;
@@ -142,12 +144,36 @@ public class GuildManager {
                 deleteFavourite.execute();
             }
 
+            try (PreparedStatement statement = connection.prepareStatement("DELETE FROM guild_forum_views WHERE guild_id = ?")) {
+                statement.setInt(1, guild.getId());
+                statement.execute();
+            }
+
+            try (PreparedStatement statement = connection.prepareStatement("DELETE c FROM guilds_forums_comments c INNER JOIN guilds_forums_threads t ON c.thread_id = t.id WHERE t.guild_id = ?")) {
+                statement.setInt(1, guild.getId());
+                statement.execute();
+            }
+
+            try (PreparedStatement statement = connection.prepareStatement("DELETE FROM guilds_forums_threads WHERE guild_id = ?")) {
+                statement.setInt(1, guild.getId());
+                statement.execute();
+            }
 
             try (PreparedStatement statement = connection.prepareStatement("DELETE FROM guilds_members WHERE guild_id = ?")) {
                 statement.setInt(1, guild.getId());
                 statement.execute();
             }
 
+            try (PreparedStatement statement = connection.prepareStatement("UPDATE rooms SET guild_id = 0 WHERE guild_id = ?")) {
+                statement.setInt(1, guild.getId());
+                statement.execute();
+            }
+
+            try (PreparedStatement statement = connection.prepareStatement("UPDATE items SET guild_id = 0 WHERE guild_id = ?")) {
+                statement.setInt(1, guild.getId());
+                statement.execute();
+            }
+
             try (PreparedStatement statement = connection.prepareStatement("DELETE FROM guilds WHERE id = ?")) {
                 statement.setInt(1, guild.getId());
                 statement.execute();
@@ -161,6 +187,10 @@ public class GuildManager {
         } catch (SQLException e) {
             LOGGER.error("Caught SQL exception", e);
         }
+
+        this.guilds.remove(guild.getId());
+        ForumThread.clearCacheForGuild(guild.getId());
+        GuildForumDataComposer.invalidateUnreadCache(guild.getId());
     }
 
 

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/GuildAcceptMembershipEvent.java

@@ -29,7 +29,9 @@ public class GuildAcceptMembershipEvent extends MessageHandler {
 
         if (guild != null) {
             GuildMember groupMember = Emulator.getGameEnvironment().getGuildManager().getGuildMember(guild, this.client.getHabbo());
-            if (userId == this.client.getHabbo().getHabboInfo().getId() || guild.getOwnerId() == this.client.getHabbo().getHabboInfo().getId() || groupMember.getRank().equals(GuildRank.ADMIN) || groupMember.getRank().equals(GuildRank.OWNER) || this.client.getHabbo().hasPermission(Permission.ACC_GUILD_ADMIN)) {
+            if (guild.getOwnerId() == this.client.getHabbo().getHabboInfo().getId()
+                || this.client.getHabbo().hasPermission(Permission.ACC_GUILD_ADMIN)
+                || (groupMember != null && (groupMember.getRank().equals(GuildRank.ADMIN) || groupMember.getRank().equals(GuildRank.OWNER)))) {
                 if (habbo != null) {
                     if (habbo.getHabboStats().hasGuild(guild.getId())) {
                         this.client.sendResponse(new GuildAcceptMemberErrorComposer(guild.getId(), GuildAcceptMemberErrorComposer.ALREADY_ACCEPTED));

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/GuildSetAdminEvent.java

@@ -11,6 +11,11 @@ import com.eu.habbo.messages.outgoing.guilds.GuildMemberUpdateComposer;
 import com.eu.habbo.plugin.events.guilds.GuildGivenAdminEvent;
 
 public class GuildSetAdminEvent extends MessageHandler {
+    @Override
+    public int getRatelimit() {
+        return 500;
+    }
+
     @Override
     public void handle() throws Exception {
         int guildId = this.packet.readInt();

Emulator/src/main/java/com/eu/habbo/messages/incoming/guilds/forums/GuildForumPostThreadEvent.java

@@ -48,7 +48,7 @@ public class GuildForumPostThreadEvent extends MessageHandler {
 
         if (threadId == 0) {
             if (!((guild.canPostThreads().state == 0)
-                    || (guild.canPostThreads().state == 1 && member != null)
+                    || (guild.canPostThreads().state == 1 && member != null && member.getRank().type <= GuildRank.MEMBER.type)
                     || (guild.canPostThreads().state == 2 && member != null && (member.getRank().type < GuildRank.MEMBER.type))
                     || (guild.canPostThreads().state == 3 && guild.getOwnerId() == this.client.getHabbo().getHabboInfo().getId())
                     || isStaff)) {
@@ -87,7 +87,7 @@ public class GuildForumPostThreadEvent extends MessageHandler {
         }
 
         if (!((guild.canPostMessages().state == 0)
-                || (guild.canPostMessages().state == 1 && member != null)
+                || (guild.canPostMessages().state == 1 && member != null && member.getRank().type <= GuildRank.MEMBER.type)
                 || (guild.canPostMessages().state == 2 && member != null && (member.getRank().type < GuildRank.MEMBER.type))
                 || (guild.canPostMessages().state == 3 && guild.getOwnerId() == this.client.getHabbo().getHabboInfo().getId())
                 || isStaff)) {

Emulator/src/main/java/com/eu/habbo/networking/gameserver/WebSocketChannelInitializer.java

@@ -18,6 +18,7 @@ import io.netty.channel.ChannelInitializer;
 import io.netty.channel.socket.SocketChannel;
 import io.netty.handler.codec.http.HttpObjectAggregator;
 import io.netty.handler.codec.http.HttpServerCodec;
+import io.netty.handler.codec.http.websocketx.WebSocketFrameAggregator;
 import io.netty.handler.codec.http.websocketx.WebSocketServerProtocolConfig;
 import io.netty.handler.codec.http.websocketx.WebSocketServerProtocolHandler;
 import io.netty.handler.logging.LoggingHandler;
@@ -60,6 +61,7 @@ public class WebSocketChannelInitializer extends ChannelInitializer<SocketChanne
         ch.pipeline().addLast("authHttpHandler", new AuthHttpHandler());
         ch.pipeline().addLast("badgeHttpHandler", new BadgeHttpHandler());
         ch.pipeline().addLast("wsProtocolHandler", new WebSocketServerProtocolHandler(this.wsConfig));
+        ch.pipeline().addLast("wsFrameAggregator", new WebSocketFrameAggregator(MAX_FRAME_SIZE));
         ch.pipeline().addLast("wsCodec", new WebSocketCodec());
 
         if (Emulator.getConfig().getBoolean("crypto.ws.enabled", false)) {

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/AccountChangeEndpoints.java

@@ -0,0 +1,503 @@
+package com.eu.habbo.networking.gameserver.auth;
+
+import com.eu.habbo.Emulator;
+import com.google.gson.JsonObject;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.HttpHeaderNames;
+import io.netty.handler.codec.http.HttpResponseStatus;
+import org.mindrot.jbcrypt.BCrypt;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.EMAIL_RE;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.USERNAME_RE;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.checkPassword;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.errorPayload;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.readString;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.sendJson;
+
+final class AccountChangeEndpoints {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(AccountChangeEndpoints.class);
+
+    private AccountChangeEndpoints() {
+    }
+
+    static void handleChangePassword(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        int userId = verifyBearer(req, ip, ctx);
+        if (userId <= 0) return;
+
+        String currentPassword = readString(body, "currentPassword");
+        String newPassword     = readString(body, "newPassword");
+        String confirmPassword = readString(body, "confirmPassword");
+
+        if (currentPassword.isEmpty() || newPassword.isEmpty() || confirmPassword.isEmpty()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("All fields are required."));
+            return;
+        }
+
+        if (currentPassword.length() > 256 || newPassword.length() > 256) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("Password too long."));
+            return;
+        }
+
+        if (!newPassword.equals(confirmPassword)) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("New passwords do not match."));
+            return;
+        }
+
+        if (newPassword.length() < 8) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("Password must be at least 8 characters."));
+            return;
+        }
+
+        if (newPassword.equals(currentPassword)) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("New password must be different from the current password."));
+            return;
+        }
+
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection()) {
+            String storedHash = null;
+            String username = null;
+            try (PreparedStatement lookup = conn.prepareStatement(
+                    "SELECT username, password FROM users WHERE id = ? LIMIT 1")) {
+                lookup.setInt(1, userId);
+                try (ResultSet rs = lookup.executeQuery()) {
+                    if (rs.next()) {
+                        username = rs.getString("username");
+                        storedHash = rs.getString("password");
+                    }
+                }
+            }
+
+            if (storedHash == null || storedHash.isEmpty()) {
+                AuthRateLimiter.recordFailure(ip);
+                sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED, errorPayload("Account not found."));
+                return;
+            }
+
+            if (!checkPassword(currentPassword, storedHash)) {
+                AuthRateLimiter.recordFailure(ip);
+                LOGGER.info("[auth/change-password] current password mismatch for user id={} username='{}'", userId, username);
+                sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED,
+                        errorPayload("Current password is incorrect."));
+                return;
+            }
+
+            String hashed = BCrypt.hashpw(newPassword, BCrypt.gensalt(12));
+            try (PreparedStatement upd = conn.prepareStatement(
+                    "UPDATE users SET password = ? WHERE id = ? LIMIT 1")) {
+                upd.setString(1, hashed);
+                upd.setInt(2, userId);
+                upd.executeUpdate();
+            }
+
+            AuthRateLimiter.recordSuccess(ip);
+            LOGGER.info("[auth/change-password] password updated for user id={} username='{}' ip='{}'", userId, username, ip);
+
+            JsonObject ok = new JsonObject();
+            ok.addProperty("message", "Password updated successfully.");
+            sendJson(ctx, req, HttpResponseStatus.OK, ok);
+        } catch (Exception e) {
+            LOGGER.error("[auth/change-password] failed for user id=" + userId, e);
+            sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+        }
+    }
+
+    static void handleChangeEmail(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        int userId = verifyBearer(req, ip, ctx);
+        if (userId <= 0) return;
+
+        String currentPassword = readString(body, "currentPassword");
+        String newEmail        = readString(body, "newEmail").trim();
+
+        if (currentPassword.isEmpty() || newEmail.isEmpty()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("All fields are required."));
+            return;
+        }
+
+        if (currentPassword.length() > 256 || newEmail.length() > 254) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("Field too long."));
+            return;
+        }
+
+        if (!EMAIL_RE.matcher(newEmail).matches()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("Invalid email address."));
+            return;
+        }
+
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection()) {
+            String storedHash = null;
+            String username = null;
+            String currentEmail = null;
+            try (PreparedStatement lookup = conn.prepareStatement(
+                    "SELECT username, password, mail FROM users WHERE id = ? LIMIT 1")) {
+                lookup.setInt(1, userId);
+                try (ResultSet rs = lookup.executeQuery()) {
+                    if (rs.next()) {
+                        username = rs.getString("username");
+                        storedHash = rs.getString("password");
+                        currentEmail = rs.getString("mail");
+                    }
+                }
+            }
+
+            if (storedHash == null || storedHash.isEmpty()) {
+                AuthRateLimiter.recordFailure(ip);
+                sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED, errorPayload("Account not found."));
+                return;
+            }
+
+            if (!checkPassword(currentPassword, storedHash)) {
+                AuthRateLimiter.recordFailure(ip);
+                LOGGER.info("[auth/change-email] password mismatch for user id={} username='{}'", userId, username);
+                sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED,
+                        errorPayload("Current password is incorrect."));
+                return;
+            }
+
+            if (currentEmail != null && currentEmail.equalsIgnoreCase(newEmail)) {
+                sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                        errorPayload("New email must be different from the current email."));
+                return;
+            }
+
+            try (PreparedStatement check = conn.prepareStatement(
+                    "SELECT id FROM users WHERE mail = ? AND id <> ? LIMIT 1")) {
+                check.setString(1, newEmail);
+                check.setInt(2, userId);
+                try (ResultSet rs = check.executeQuery()) {
+                    if (rs.next()) {
+                        sendJson(ctx, req, HttpResponseStatus.CONFLICT,
+                                errorPayload("That email address is already in use."));
+                        return;
+                    }
+                }
+            }
+
+            try (PreparedStatement upd = conn.prepareStatement(
+                    "UPDATE users SET mail = ? WHERE id = ? LIMIT 1")) {
+                upd.setString(1, newEmail);
+                upd.setInt(2, userId);
+                upd.executeUpdate();
+            }
+
+            if (currentEmail != null && !currentEmail.isEmpty()) AvailabilityCache.invalidateEmail(currentEmail);
+            AvailabilityCache.invalidateEmail(newEmail);
+
+            AuthRateLimiter.recordSuccess(ip);
+            LOGGER.info("[auth/change-email] email updated for user id={} username='{}' ip='{}'", userId, username, ip);
+
+            JsonObject ok = new JsonObject();
+            ok.addProperty("message", "Email updated successfully.");
+            ok.addProperty("email", newEmail);
+            sendJson(ctx, req, HttpResponseStatus.OK, ok);
+        } catch (Exception e) {
+            LOGGER.error("[auth/change-email] failed for user id=" + userId, e);
+            sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+        }
+    }
+
+    static void handleChangeUsername(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        int userId = verifyBearer(req, ip, ctx);
+        if (userId <= 0) return;
+
+        String currentPassword = readString(body, "currentPassword");
+        String newUsername     = readString(body, "newUsername").trim();
+
+        if (currentPassword.isEmpty() || newUsername.isEmpty()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("All fields are required."));
+            return;
+        }
+
+        if (currentPassword.length() > 256) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("Field too long."));
+            return;
+        }
+
+        if (newUsername.length() > 25) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("Username can be at most 25 characters."));
+            return;
+        }
+
+        if (!USERNAME_RE.matcher(newUsername).matches()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("Username must be 3-25 characters (letters, numbers, . _ -)."));
+            return;
+        }
+
+        long cooldownDays = Math.max(0, Emulator.getConfig().getInt("rename.cooldown_days", 30));
+        long cooldownSeconds = cooldownDays * 86400L;
+
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection()) {
+            String storedHash = null;
+            String currentUsername = null;
+            int lastChange = 0;
+            boolean cooldownColumnExists = true;
+
+            try (PreparedStatement lookup = conn.prepareStatement(
+                    "SELECT username, password, last_username_change FROM users WHERE id = ? LIMIT 1")) {
+                lookup.setInt(1, userId);
+                try (ResultSet rs = lookup.executeQuery()) {
+                    if (rs.next()) {
+                        currentUsername = rs.getString("username");
+                        storedHash = rs.getString("password");
+                        lastChange = rs.getInt("last_username_change");
+                    }
+                }
+            } catch (SQLException missingColumn) {
+                cooldownColumnExists = false;
+                LOGGER.warn("[auth/change-username] users.last_username_change column missing — cooldown disabled. Run the migration in config/Database.sql.");
+                try (PreparedStatement lookup = conn.prepareStatement(
+                        "SELECT username, password FROM users WHERE id = ? LIMIT 1")) {
+                    lookup.setInt(1, userId);
+                    try (ResultSet rs = lookup.executeQuery()) {
+                        if (rs.next()) {
+                            currentUsername = rs.getString("username");
+                            storedHash = rs.getString("password");
+                        }
+                    }
+                }
+            }
+
+            if (storedHash == null || storedHash.isEmpty()) {
+                AuthRateLimiter.recordFailure(ip);
+                sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED, errorPayload("Account not found."));
+                return;
+            }
+
+            if (!checkPassword(currentPassword, storedHash)) {
+                AuthRateLimiter.recordFailure(ip);
+                LOGGER.info("[auth/change-username] password mismatch for user id={} username='{}'", userId, currentUsername);
+                sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED,
+                        errorPayload("Current password is incorrect."));
+                return;
+            }
+
+            if (currentUsername != null && currentUsername.equals(newUsername)) {
+                sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                        errorPayload("New username must be different from the current username."));
+                return;
+            }
+
+            int now = Emulator.getIntUnixTimestamp();
+            if (cooldownColumnExists && cooldownSeconds > 0 && lastChange > 0) {
+                long allowedAt = (long) lastChange + cooldownSeconds;
+                if (now < allowedAt) {
+                    long remaining = allowedAt - now;
+                    long days = remaining / 86400L;
+                    long hours = (remaining % 86400L) / 3600L;
+                    String wait = days > 0 ? (days + " day" + (days == 1 ? "" : "s")) : (hours + " hour" + (hours == 1 ? "" : "s"));
+                    sendJson(ctx, req, HttpResponseStatus.TOO_MANY_REQUESTS,
+                            errorPayload("You can rename again in " + wait + "."));
+                    return;
+                }
+            }
+
+            try (PreparedStatement banned = conn.prepareStatement(
+                    "SELECT 1 FROM banned_usernames WHERE LOWER(username) = LOWER(?) LIMIT 1")) {
+                banned.setString(1, newUsername);
+                try (ResultSet rs = banned.executeQuery()) {
+                    if (rs.next()) {
+                        sendJson(ctx, req, HttpResponseStatus.CONFLICT,
+                                errorPayload("That username is not allowed."));
+                        return;
+                    }
+                }
+            } catch (SQLException bannedTableError) {
+                if (bannedTableError.getErrorCode() != 1146
+                        && !"42S02".equals(bannedTableError.getSQLState())) {
+                    throw bannedTableError;
+                }
+            }
+
+            try (PreparedStatement check = conn.prepareStatement(
+                    "SELECT id FROM users WHERE LOWER(username) = LOWER(?) AND id <> ? LIMIT 1")) {
+                check.setString(1, newUsername);
+                check.setInt(2, userId);
+                try (ResultSet rs = check.executeQuery()) {
+                    if (rs.next()) {
+                        sendJson(ctx, req, HttpResponseStatus.CONFLICT,
+                                errorPayload("That username is already taken."));
+                        return;
+                    }
+                }
+            }
+
+            boolean previousAutoCommit = conn.getAutoCommit();
+            conn.setAutoCommit(false);
+
+            boolean cooldownRace = false;
+            boolean duplicateName = false;
+
+            try {
+                int rowsUpdated = 0;
+
+                try (PreparedStatement upd = conn.prepareStatement(
+                        cooldownColumnExists
+                                ? "UPDATE users SET username = ?, last_username_change = ? "
+                                + "WHERE id = ? "
+                                + "  AND (last_username_change = 0 OR last_username_change + ? <= ?) "
+                                + "LIMIT 1"
+                                : "UPDATE users SET username = ? WHERE id = ? LIMIT 1")) {
+                    upd.setString(1, newUsername);
+                    if (cooldownColumnExists) {
+                        upd.setInt(2, now);
+                        upd.setInt(3, userId);
+                        upd.setLong(4, cooldownSeconds);
+                        upd.setInt(5, now);
+                    } else {
+                        upd.setInt(2, userId);
+                    }
+                    try {
+                        rowsUpdated = upd.executeUpdate();
+                    } catch (SQLException dup) {
+                        if (dup.getErrorCode() == 1062 || "23000".equals(dup.getSQLState())) {
+                            duplicateName = true;
+                        } else {
+                            throw dup;
+                        }
+                    }
+                }
+
+                if (duplicateName || (cooldownColumnExists && rowsUpdated == 0)) {
+                    if (!duplicateName) cooldownRace = true;
+                    conn.rollback();
+                } else {
+                    try (PreparedStatement upd = conn.prepareStatement(
+                            "UPDATE rooms SET owner_name = ? WHERE owner_id = ?")) {
+                        upd.setString(1, newUsername);
+                        upd.setInt(2, userId);
+                        upd.executeUpdate();
+                    }
+
+                    try (PreparedStatement upd = conn.prepareStatement(
+                            "UPDATE rooms_for_sale SET owner_name = ? WHERE user_id = ?")) {
+                        upd.setString(1, newUsername);
+                        upd.setInt(2, userId);
+                        upd.executeUpdate();
+                    } catch (SQLException roomsForSale) {
+                        if (roomsForSale.getErrorCode() != 1146
+                                && !"42S02".equals(roomsForSale.getSQLState())) {
+                            throw roomsForSale;
+                        }
+                    }
+
+                    conn.commit();
+                }
+            } catch (SQLException txError) {
+                try { conn.rollback(); } catch (SQLException ignore) {}
+                throw txError;
+            } finally {
+                conn.setAutoCommit(previousAutoCommit);
+            }
+
+            if (duplicateName) {
+                LOGGER.info("[auth/change-username] dup-entry race for user id={} wanted='{}'", userId, newUsername);
+                sendJson(ctx, req, HttpResponseStatus.CONFLICT,
+                        errorPayload("That username is already taken."));
+                return;
+            }
+
+            if (cooldownRace) {
+                LOGGER.info("[auth/change-username] cooldown race for user id={} (concurrent rename rejected)", userId);
+                sendJson(ctx, req, HttpResponseStatus.TOO_MANY_REQUESTS,
+                        errorPayload("Rename already in progress — please wait."));
+                return;
+            }
+
+            try {
+                if (Emulator.getGameServer() != null && Emulator.getGameServer().getGameClientManager() != null
+                        && Emulator.getGameEnvironment() != null && Emulator.getGameEnvironment().getHabboManager() != null) {
+                    com.eu.habbo.habbohotel.users.Habbo habbo =
+                            Emulator.getGameServer().getGameClientManager().getHabbo(userId);
+                    if (habbo != null) {
+                        Emulator.getGameEnvironment().getHabboManager().removeHabbo(habbo);
+                        habbo.getHabboInfo().setUsername(newUsername);
+                        Emulator.getGameEnvironment().getHabboManager().addHabbo(habbo);
+                    }
+                }
+            } catch (Exception cacheError) {
+                LOGGER.warn("[auth/change-username] failed to refresh HabboManager cache", cacheError);
+            }
+
+            try {
+                if (Emulator.getGameEnvironment() != null && Emulator.getGameEnvironment().getRoomManager() != null) {
+                    for (com.eu.habbo.habbohotel.rooms.Room room : Emulator.getGameEnvironment().getRoomManager().getActiveRooms()) {
+                        if (room.getOwnerId() == userId) {
+                            room.setOwnerName(newUsername);
+                        }
+                    }
+                }
+            } catch (Exception cacheError) {
+                LOGGER.warn("[auth/change-username] failed to refresh Room.ownerName cache", cacheError);
+            }
+
+            try {
+                com.eu.habbo.messages.incoming.catalog.marketplace.RequestOffersEvent.cachedResults.clear();
+            } catch (Exception cacheError) {
+                LOGGER.warn("[auth/change-username] failed to clear marketplace cache", cacheError);
+            }
+
+            try (PreparedStatement clear = conn.prepareStatement(
+                    "UPDATE users SET auth_ticket = '', online = '0' WHERE id = ? LIMIT 1")) {
+                clear.setInt(1, userId);
+                clear.executeUpdate();
+            }
+
+            if (Emulator.getGameServer() != null
+                    && Emulator.getGameServer().getGameClientManager() != null) {
+                com.eu.habbo.habbohotel.users.Habbo habbo =
+                        Emulator.getGameServer().getGameClientManager().getHabbo(userId);
+                if (habbo != null && habbo.getClient() != null) {
+                    Emulator.getGameServer().getGameClientManager().disposeClient(habbo.getClient());
+                }
+            }
+
+            AuthRateLimiter.recordSuccess(ip);
+            LOGGER.info("[auth/change-username] '{}' -> '{}' (user id={}, ip='{}')",
+                    currentUsername, newUsername, userId, ip);
+
+            JsonObject ok = new JsonObject();
+            ok.addProperty("message", "Username updated. Please log in again with your new name.");
+            ok.addProperty("username", newUsername);
+            ok.addProperty("relogin", true);
+            sendJson(ctx, req, HttpResponseStatus.OK, ok);
+        } catch (Exception e) {
+            LOGGER.error("[auth/change-username] failed for user id=" + userId, e);
+            sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+        }
+    }
+
+    private static int verifyBearer(FullHttpRequest req, String ip, ChannelHandlerContext ctx) {
+        String authHeader = req.headers().get(HttpHeaderNames.AUTHORIZATION);
+        String bearer = "";
+        if (authHeader != null && authHeader.regionMatches(true, 0, "Bearer ", 0, 7)) {
+            bearer = authHeader.substring(7).trim();
+        }
+
+        int userId = AccessTokenService.verify(bearer);
+        if (userId <= 0) {
+            AuthRateLimiter.recordFailure(ip);
+            sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED, errorPayload("Not authenticated."));
+        }
+        return userId;
+    }
+}

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/AccountCheckEndpoints.java

@@ -0,0 +1,106 @@
+package com.eu.habbo.networking.gameserver.auth;
+
+import com.eu.habbo.Emulator;
+import com.google.gson.JsonObject;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.HttpResponseStatus;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.EMAIL_RE;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.USERNAME_RE;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.errorPayload;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.readString;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.sendJson;
+
+final class AccountCheckEndpoints {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(AccountCheckEndpoints.class);
+
+    private AccountCheckEndpoints() {
+    }
+
+    static void handleCheckEmail(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        if (!AuthRateLimiter.tryProbe(ip)) {
+            long secs = AuthRateLimiter.secondsUntilProbeReset(ip);
+            sendJson(ctx, req, HttpResponseStatus.TOO_MANY_REQUESTS,
+                    errorPayload("Too many requests. Try again in " + secs + "s."));
+            return;
+        }
+        String email = readString(body, "email").trim();
+        if (email.isEmpty() || email.length() > 254 || !EMAIL_RE.matcher(email).matches()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST, errorPayload("Invalid email address."));
+            return;
+        }
+
+        Boolean cached = AvailabilityCache.lookupEmail(email);
+        boolean taken;
+        if (cached != null) {
+            taken = !cached;
+        } else {
+            try (Connection conn = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement stmt = conn.prepareStatement(
+                         "SELECT 1 FROM users WHERE mail = ? LIMIT 1")) {
+                stmt.setString(1, email);
+                try (ResultSet rs = stmt.executeQuery()) {
+                    taken = rs.next();
+                }
+            } catch (Exception e) {
+                LOGGER.error("check-email failed", e);
+                sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+                return;
+            }
+            AvailabilityCache.storeEmail(email, !taken);
+        }
+
+        JsonObject res = new JsonObject();
+        res.addProperty("available", !taken);
+        if (taken) res.addProperty("error", "This email is already in use.");
+        sendJson(ctx, req, HttpResponseStatus.OK, res);
+    }
+
+    static void handleCheckUsername(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        if (!AuthRateLimiter.tryProbe(ip)) {
+            long secs = AuthRateLimiter.secondsUntilProbeReset(ip);
+            sendJson(ctx, req, HttpResponseStatus.TOO_MANY_REQUESTS,
+                    errorPayload("Too many requests. Try again in " + secs + "s."));
+            return;
+        }
+        String username = readString(body, "username").trim();
+        if (!USERNAME_RE.matcher(username).matches()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("Username must be 3-32 chars (letters, numbers, . _ -)."));
+            return;
+        }
+
+        Boolean cached = AvailabilityCache.lookupUsername(username);
+        boolean taken;
+        if (cached != null) {
+            taken = !cached;
+        } else {
+            try (Connection conn = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement stmt = conn.prepareStatement(
+                         "SELECT 1 FROM users WHERE username = ? LIMIT 1")) {
+                stmt.setString(1, username);
+                try (ResultSet rs = stmt.executeQuery()) {
+                    taken = rs.next();
+                }
+            } catch (Exception e) {
+                LOGGER.error("check-username failed", e);
+                sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+                return;
+            }
+            AvailabilityCache.storeUsername(username, !taken);
+        }
+
+        JsonObject res = new JsonObject();
+        res.addProperty("available", !taken);
+        if (taken) res.addProperty("error", "This Habbo name is already taken.");
+        sendJson(ctx, req, HttpResponseStatus.OK, res);
+    }
+}

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/AuthHttpUtil.java

@@ -0,0 +1,237 @@
+package com.eu.habbo.networking.gameserver.auth;
+
+import com.eu.habbo.Emulator;
+import com.eu.habbo.networking.gameserver.GameServerAttributes;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import io.netty.buffer.Unpooled;
+import io.netty.channel.ChannelFutureListener;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.handler.codec.http.DefaultFullHttpResponse;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.FullHttpResponse;
+import io.netty.handler.codec.http.HttpHeaderNames;
+import io.netty.handler.codec.http.HttpHeaderValues;
+import io.netty.handler.codec.http.HttpResponseStatus;
+import io.netty.handler.codec.http.HttpVersion;
+import org.mindrot.jbcrypt.BCrypt;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.security.SecureRandom;
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.Base64;
+import java.util.regex.Pattern;
+
+final class AuthHttpUtil {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(AuthHttpUtil.class);
+
+    static final Pattern USERNAME_RE = Pattern.compile("^[A-Za-z0-9._-]{3,32}$");
+    static final Pattern EMAIL_RE    = Pattern.compile("^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$");
+    static final Pattern FIGURE_RE   = Pattern.compile("^[A-Za-z0-9.\\-]{1,200}$");
+
+    static final SecureRandom RNG = new SecureRandom();
+    static final int MAX_BODY_BYTES = 8 * 1024;
+
+    private static final long PERMANENT_BAN_THRESHOLD_SECONDS = 30L * 365L * 24L * 60L * 60L;
+
+    private AuthHttpUtil() {
+    }
+
+    static String readString(JsonObject obj, String key) {
+        if (obj == null || !obj.has(key) || obj.get(key).isJsonNull()) return "";
+        try {
+            return obj.get(key).getAsString();
+        } catch (Exception e) {
+            return "";
+        }
+    }
+
+    static int readInt(JsonObject obj, String key, int defaultValue) {
+        if (obj == null || !obj.has(key) || obj.get(key).isJsonNull()) return defaultValue;
+        try {
+            return obj.get(key).getAsInt();
+        } catch (Exception e) {
+            return defaultValue;
+        }
+    }
+
+    static boolean readBoolean(JsonObject obj, String key, boolean defaultValue) {
+        if (obj == null || !obj.has(key) || obj.get(key).isJsonNull()) return defaultValue;
+        try {
+            JsonElement el = obj.get(key);
+            if (el.getAsJsonPrimitive().isBoolean()) return el.getAsBoolean();
+            String s = el.getAsString();
+            return "1".equals(s) || "true".equalsIgnoreCase(s);
+        } catch (Exception e) {
+            return defaultValue;
+        }
+    }
+
+    static JsonObject errorPayload(String message) {
+        JsonObject obj = new JsonObject();
+        obj.addProperty("error", message);
+        return obj;
+    }
+
+    static void sendJson(ChannelHandlerContext ctx, FullHttpRequest req,
+                         HttpResponseStatus status, JsonObject body) {
+        byte[] bytes = body.toString().getBytes(StandardCharsets.UTF_8);
+        FullHttpResponse response = new DefaultFullHttpResponse(
+                HttpVersion.HTTP_1_1, status, Unpooled.wrappedBuffer(bytes));
+        response.headers().set(HttpHeaderNames.CONTENT_TYPE, "application/json; charset=utf-8");
+        response.headers().setInt(HttpHeaderNames.CONTENT_LENGTH, bytes.length);
+        applyCors(req, response);
+        boolean keepAlive = isKeepAlive(req);
+        if (keepAlive) response.headers().set(HttpHeaderNames.CONNECTION, HttpHeaderValues.KEEP_ALIVE);
+        var future = ctx.writeAndFlush(response);
+        if (!keepAlive) future.addListener(ChannelFutureListener.CLOSE);
+    }
+
+    static void sendCors(ChannelHandlerContext ctx, FullHttpRequest req) {
+        FullHttpResponse response = new DefaultFullHttpResponse(
+                HttpVersion.HTTP_1_1, HttpResponseStatus.NO_CONTENT);
+        applyCors(req, response);
+        ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE);
+    }
+
+    static void applyCors(FullHttpRequest req, FullHttpResponse response) {
+        String origin = req.headers().get(HttpHeaderNames.ORIGIN);
+
+        if (origin != null && !origin.isEmpty() && CorsOriginGate.isAllowed(req)) {
+            response.headers().set("Access-Control-Allow-Origin", origin);
+            response.headers().set("Access-Control-Allow-Credentials", "true");
+        }
+        response.headers().set("Access-Control-Allow-Methods", "GET, HEAD, POST, OPTIONS");
+
+        String requestedHeaders = req.headers().get("Access-Control-Request-Headers");
+        if (requestedHeaders != null && !requestedHeaders.isEmpty()) {
+            response.headers().set("Access-Control-Allow-Headers", requestedHeaders);
+        } else {
+            response.headers().set("Access-Control-Allow-Headers",
+                    "Authorization, Content-Type, X-Requested-With, X-Nitro-Key, X-Nitro-Api");
+        }
+
+        response.headers().set("Vary", "Origin, Access-Control-Request-Headers, Access-Control-Request-Method");
+        response.headers().set("Access-Control-Max-Age", "600");
+        response.headers().set("Access-Control-Expose-Headers", "X-Nitro-Sec, X-Nitro-Key-Fp, X-Nitro-Derive-Fp");
+    }
+
+    static boolean isKeepAlive(FullHttpRequest req) {
+        String connection = req.headers().get(HttpHeaderNames.CONNECTION);
+        return connection == null || !"close".equalsIgnoreCase(connection);
+    }
+
+    static String resolveClientIp(ChannelHandlerContext ctx, FullHttpRequest req) {
+        String ipHeader = Emulator.getConfig() != null
+                ? Emulator.getConfig().getValue("ws.ip.header", "")
+                : "";
+        if (!ipHeader.isEmpty() && req.headers().contains(ipHeader)) {
+            String hv = req.headers().get(ipHeader);
+            if (hv != null && !hv.isEmpty()) {
+                int comma = hv.indexOf(',');
+                return (comma > 0 ? hv.substring(0, comma) : hv).trim();
+            }
+        }
+        if (ctx.channel().attr(GameServerAttributes.WS_IP).get() != null) {
+            return ctx.channel().attr(GameServerAttributes.WS_IP).get();
+        }
+        if (ctx.channel().remoteAddress() instanceof InetSocketAddress addr) {
+            return addr.getAddress().getHostAddress();
+        }
+        return "";
+    }
+
+    static boolean checkPassword(String plain, String stored) {
+        String compatible = stored.startsWith("$2y$") ? "$2a$" + stored.substring(4) : stored;
+        try {
+            return BCrypt.checkpw(plain, compatible);
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+    }
+
+    static String mintSsoTicket() {
+        byte[] buf = new byte[32];
+        RNG.nextBytes(buf);
+        return "nitro-" + Base64.getUrlEncoder().withoutPadding().encodeToString(buf);
+    }
+
+    static String mintResetToken() {
+        byte[] buf = new byte[32];
+        RNG.nextBytes(buf);
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(buf);
+    }
+
+    static final class BanInfo {
+        final String type;
+        final String reason;
+        final int expiresAt;
+
+        BanInfo(String type, String reason, int expiresAt) {
+            this.type = type == null ? "account" : type;
+            this.reason = reason == null ? "" : reason;
+            this.expiresAt = expiresAt;
+        }
+
+        boolean isPermanent() {
+            return (long) expiresAt - Emulator.getIntUnixTimestamp() > PERMANENT_BAN_THRESHOLD_SECONDS;
+        }
+    }
+
+    static BanInfo lookupAccountBan(Connection conn, int userId) throws SQLException {
+        try (PreparedStatement stmt = conn.prepareStatement(
+                "SELECT ban_expire, ban_reason, type FROM bans " +
+                        "WHERE user_id = ? AND ban_expire >= ? AND (type = 'account' OR type = 'super') " +
+                        "ORDER BY ban_expire DESC LIMIT 1")) {
+            stmt.setInt(1, userId);
+            stmt.setInt(2, Emulator.getIntUnixTimestamp());
+            try (ResultSet rs = stmt.executeQuery()) {
+                if (rs.next()) {
+                    return new BanInfo(rs.getString("type"), rs.getString("ban_reason"), rs.getInt("ban_expire"));
+                }
+            }
+        }
+        return null;
+    }
+
+    static BanInfo lookupIpBan(Connection conn, String ip) throws SQLException {
+        try (PreparedStatement stmt = conn.prepareStatement(
+                "SELECT ban_expire, ban_reason, type FROM bans " +
+                        "WHERE ip = ? AND ban_expire >= ? AND (type = 'ip' OR type = 'super') " +
+                        "ORDER BY ban_expire DESC LIMIT 1")) {
+            stmt.setString(1, ip);
+            stmt.setInt(2, Emulator.getIntUnixTimestamp());
+            try (ResultSet rs = stmt.executeQuery()) {
+                if (rs.next()) {
+                    return new BanInfo(rs.getString("type"), rs.getString("ban_reason"), rs.getInt("ban_expire"));
+                }
+            }
+        }
+        return null;
+    }
+
+    static JsonObject bannedPayload(BanInfo ban) {
+        boolean permanent = ban.isPermanent();
+        String message = permanent
+                ? "Your account has been permanently banned."
+                : "Your account is temporarily banned.";
+
+        JsonObject details = new JsonObject();
+        details.addProperty("type", ban.type);
+        details.addProperty("reason", ban.reason);
+        details.addProperty("permanent", permanent);
+        if (!permanent) details.addProperty("expiresAt", ban.expiresAt);
+
+        JsonObject obj = new JsonObject();
+        obj.addProperty("error", message);
+        obj.add("ban", details);
+        return obj;
+    }
+}

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/CorsOriginGate.java

@@ -0,0 +1,53 @@
+package com.eu.habbo.networking.gameserver.auth;
+
+import com.eu.habbo.Emulator;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.HttpHeaderNames;
+
+import java.net.URI;
+
+public final class CorsOriginGate {
+
+    private static final String CONFIG_KEY    = "ws.whitelist";
+    private static final String CONFIG_DEFAULT = "localhost";
+
+    private CorsOriginGate() {
+    }
+
+    public static boolean isAllowed(FullHttpRequest req) {
+        if (req == null) return false;
+        String origin = req.headers().get(HttpHeaderNames.ORIGIN);
+        if (origin == null || origin.isEmpty()) return false;
+
+        String host;
+        try {
+            URI uri = new URI(origin);
+            host = uri.getHost();
+        } catch (Exception ignored) {
+            return false;
+        }
+        if (host == null || host.isEmpty()) return false;
+        if (host.startsWith("www.")) host = host.substring(4);
+
+        String configured = Emulator.getConfig().getValue(CONFIG_KEY, CONFIG_DEFAULT);
+        if (configured == null || configured.isEmpty()) return false;
+
+        for (String entry : configured.split(",")) {
+            String trimmed = entry.trim();
+            if (trimmed.isEmpty()) continue;
+
+            if ("*".equals(trimmed)) {
+                return true;
+            }
+            if (trimmed.startsWith("*")) {
+                String suffix = trimmed.substring(1);
+                if (host.endsWith(suffix) || ("." + host).equals(suffix)) {
+                    return true;
+                }
+            } else if (host.equals(trimmed)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/NitroSecureApiHandler.java

@@ -265,13 +265,23 @@ public class NitroSecureApiHandler extends ChannelDuplexHandler {
 
     private static void applyCors(FullHttpRequest req, FullHttpResponse response) {
         String origin = req.headers().get(HttpHeaderNames.ORIGIN);
-        if (origin != null && !origin.isEmpty()) {
+
+        if (origin != null && !origin.isEmpty() && CorsOriginGate.isAllowed(req)) {
             response.headers().set("Access-Control-Allow-Origin", origin);
-            response.headers().set("Vary", "Origin");
             response.headers().set("Access-Control-Allow-Credentials", "true");
         }
         response.headers().set("Access-Control-Allow-Methods", "GET, HEAD, POST, OPTIONS");
-        response.headers().set("Access-Control-Allow-Headers", "Content-Type, X-Requested-With, X-Nitro-Key, X-Nitro-Api");
+
+        String requestedHeaders = req.headers().get("Access-Control-Request-Headers");
+        if (requestedHeaders != null && !requestedHeaders.isEmpty()) {
+            response.headers().set("Access-Control-Allow-Headers", requestedHeaders);
+        } else {
+            response.headers().set("Access-Control-Allow-Headers",
+                    "Authorization, Content-Type, X-Requested-With, X-Nitro-Key, X-Nitro-Api");
+        }
+
+        response.headers().set("Vary", "Origin, Access-Control-Request-Headers, Access-Control-Request-Method");
+        response.headers().set("Access-Control-Max-Age", "600");
         response.headers().set("Access-Control-Expose-Headers", "X-Nitro-Sec, X-Nitro-Key-Fp, X-Nitro-Derive-Fp");
     }
 

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/NitroSecureAssetHandler.java

@@ -297,12 +297,21 @@ public class NitroSecureAssetHandler extends ChannelInboundHandlerAdapter {
 
     private static void applyCors(FullHttpRequest req, FullHttpResponse response) {
         String origin = req.headers().get(HttpHeaderNames.ORIGIN);
-        if (origin != null && !origin.isEmpty()) {
+
+        if (origin != null && !origin.isEmpty() && CorsOriginGate.isAllowed(req)) {
             response.headers().set("Access-Control-Allow-Origin", origin);
-            response.headers().set("Vary", "Origin");
         }
         response.headers().set("Access-Control-Allow-Methods", "GET, HEAD, POST, OPTIONS");
-        response.headers().set("Access-Control-Allow-Headers", "Content-Type, X-Nitro-Key");
+
+        String requestedHeaders = req.headers().get("Access-Control-Request-Headers");
+        if (requestedHeaders != null && !requestedHeaders.isEmpty()) {
+            response.headers().set("Access-Control-Allow-Headers", requestedHeaders);
+        } else {
+            response.headers().set("Access-Control-Allow-Headers", "Authorization, Content-Type, X-Nitro-Key");
+        }
+
+        response.headers().set("Vary", "Origin, Access-Control-Request-Headers, Access-Control-Request-Method");
+        response.headers().set("Access-Control-Max-Age", "600");
         response.headers().set("Access-Control-Expose-Headers", "X-Nitro-Sec, X-Nitro-Key-Fp, X-Nitro-Derive-Fp");
     }
 

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/RegistrationSupport.java

@@ -0,0 +1,175 @@
+package com.eu.habbo.networking.gameserver.auth;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+
+final class RegistrationSupport {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(RegistrationSupport.class);
+
+    private RegistrationSupport() {
+    }
+
+    static void materializeCustomLayout(Connection conn, int templateId, int newRoomId) {
+        String overrideModel = "0";
+        String heightmap = "";
+        int doorX = 0, doorY = 0, doorDir = 2;
+        try (PreparedStatement sel = conn.prepareStatement(
+                "SELECT override_model, heightmap, door_x, door_y, door_dir " +
+                        "FROM room_templates WHERE template_id = ? LIMIT 1")) {
+            sel.setInt(1, templateId);
+            try (ResultSet rs = sel.executeQuery()) {
+                if (rs.next()) {
+                    overrideModel = rs.getString("override_model");
+                    heightmap = rs.getString("heightmap");
+                    doorX = rs.getInt("door_x");
+                    doorY = rs.getInt("door_y");
+                    doorDir = rs.getInt("door_dir");
+                }
+            }
+        } catch (SQLException e) {
+            LOGGER.error("[auth/register] reading template layout failed templateId=" + templateId, e);
+            return;
+        }
+
+        if (!"1".equals(overrideModel) || heightmap == null || heightmap.isEmpty()) {
+            return;
+        }
+
+        String customName = "custom_" + newRoomId;
+
+        try (PreparedStatement ins = conn.prepareStatement(
+                "INSERT INTO room_models_custom (id, name, door_x, door_y, door_dir, heightmap) " +
+                        "VALUES (?, ?, ?, ?, ?, ?) " +
+                        "ON DUPLICATE KEY UPDATE name = VALUES(name), door_x = VALUES(door_x), " +
+                        "door_y = VALUES(door_y), door_dir = VALUES(door_dir), heightmap = VALUES(heightmap)")) {
+            ins.setInt(1, newRoomId);
+            ins.setString(2, customName);
+            ins.setInt(3, doorX);
+            ins.setInt(4, doorY);
+            ins.setInt(5, doorDir);
+            ins.setString(6, heightmap);
+            ins.executeUpdate();
+        } catch (SQLException e) {
+            LOGGER.error("[auth/register] room_models_custom insert failed roomId=" + newRoomId, e);
+            return;
+        }
+
+        try (PreparedStatement upd = conn.prepareStatement(
+                "UPDATE rooms SET model = ? WHERE id = ? LIMIT 1")) {
+            upd.setString(1, customName);
+            upd.setInt(2, newRoomId);
+            upd.executeUpdate();
+        } catch (SQLException e) {
+            LOGGER.error("[auth/register] rooms.model rename failed roomId=" + newRoomId, e);
+        }
+
+        LOGGER.info("[auth/register] materialized custom layout '{}' for roomId={}", customName, newRoomId);
+    }
+
+    static void seedUserCurrencies(Connection conn, int userId, int duckets, int diamonds) {
+        try (PreparedStatement ins = conn.prepareStatement(
+                "INSERT INTO users_currency (user_id, type, amount) VALUES (?, ?, ?) " +
+                        "ON DUPLICATE KEY UPDATE amount = VALUES(amount)")) {
+            if (duckets > 0) {
+                ins.setInt(1, userId);
+                ins.setInt(2, 0);
+                ins.setInt(3, duckets);
+                ins.addBatch();
+            }
+            if (diamonds > 0) {
+                ins.setInt(1, userId);
+                ins.setInt(2, 5);
+                ins.setInt(3, diamonds);
+                ins.addBatch();
+            }
+            ins.executeBatch();
+        } catch (SQLException e) {
+            LOGGER.error("[auth/register] seeding users_currency failed userId=" + userId
+                    + " duckets=" + duckets + " diamonds=" + diamonds, e);
+        }
+    }
+
+    static void cloneTemplateForUser(Connection conn, int templateId, int userId, String userName) {
+        LOGGER.info("[auth/register] cloning template id={} for user id={} name='{}'", templateId, userId, userName);
+
+        try (PreparedStatement check = conn.prepareStatement(
+                "SELECT 1 FROM room_templates WHERE template_id = ? AND enabled = '1' LIMIT 1")) {
+            check.setInt(1, templateId);
+            try (ResultSet rs = check.executeQuery()) {
+                if (!rs.next()) {
+                    LOGGER.warn("[auth/register] unknown/disabled room template id={} for user id={}", templateId, userId);
+                    return;
+                }
+            }
+        } catch (SQLException e) {
+            LOGGER.error("[auth/register] template lookup failed for templateId=" + templateId, e);
+            return;
+        }
+
+        int newRoomId = 0;
+        int roomsInserted = 0;
+        try (PreparedStatement ins = conn.prepareStatement(
+                "INSERT INTO rooms (owner_id, owner_name, name, description, model, password, state, " +
+                        "users_max, category, paper_floor, paper_wall, paper_landscape, thickness_wall, " +
+                        "thickness_floor, moodlight_data, override_model, trade_mode) " +
+                        "(SELECT ?, ?, name, room_description, model, password, state, " +
+                        "users_max, category, paper_floor, paper_wall, paper_landscape, thickness_wall, " +
+                        "thickness_floor, moodlight_data, override_model, trade_mode " +
+                        "FROM room_templates WHERE template_id = ?)",
+                Statement.RETURN_GENERATED_KEYS)) {
+            ins.setInt(1, userId);
+            ins.setString(2, userName);
+            ins.setInt(3, templateId);
+            roomsInserted = ins.executeUpdate();
+            try (ResultSet keys = ins.getGeneratedKeys()) {
+                if (keys.next()) newRoomId = keys.getInt(1);
+            }
+        } catch (SQLException e) {
+            LOGGER.error("[auth/register] clone rooms failed templateId=" + templateId + " userId=" + userId, e);
+            return;
+        }
+
+        LOGGER.info("[auth/register] rooms insert: rowsAffected={} newRoomId={}", roomsInserted, newRoomId);
+
+        if (newRoomId <= 0) {
+            LOGGER.warn("[auth/register] clone aborted - no roomId returned (templateId={}, userId={})", templateId, userId);
+            return;
+        }
+
+        materializeCustomLayout(conn, templateId, newRoomId);
+
+        int itemsInserted = 0;
+        try (PreparedStatement ins = conn.prepareStatement(
+                "INSERT INTO items (user_id, room_id, item_id, wall_pos, x, y, z, rot, " +
+                        "extra_data, wired_data, limited_data, guild_id) " +
+                        "(SELECT ?, ?, item_id, wall_pos, x, y, z, rot, extra_data, wired_data, '0:0', 0 " +
+                        "FROM room_templates_items WHERE template_id = ?)")) {
+            ins.setInt(1, userId);
+            ins.setInt(2, newRoomId);
+            ins.setInt(3, templateId);
+            itemsInserted = ins.executeUpdate();
+        } catch (SQLException e) {
+            LOGGER.error("[auth/register] clone items failed templateId=" + templateId
+                    + " roomId=" + newRoomId + " userId=" + userId, e);
+        }
+
+        LOGGER.info("[auth/register] items insert: rowsAffected={} roomId={}", itemsInserted, newRoomId);
+
+        try (PreparedStatement upd = conn.prepareStatement(
+                "UPDATE users SET home_room = ? WHERE id = ? LIMIT 1")) {
+            upd.setInt(1, newRoomId);
+            upd.setInt(2, userId);
+            int rows = upd.executeUpdate();
+            LOGGER.info("[auth/register] home_room update: rowsAffected={} userId={} roomId={}", rows, userId, newRoomId);
+        } catch (SQLException e) {
+            LOGGER.error("[auth/register] setting home_room failed userId=" + userId + " roomId=" + newRoomId, e);
+        }
+    }
+}

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/SessionEndpoints.java

@@ -0,0 +1,466 @@
+package com.eu.habbo.networking.gameserver.auth;
+
+import com.eu.habbo.Emulator;
+import com.google.gson.JsonObject;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.HttpResponseStatus;
+import org.mindrot.jbcrypt.BCrypt;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+import java.sql.Timestamp;
+import java.time.Instant;
+
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.EMAIL_RE;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.FIGURE_RE;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.USERNAME_RE;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.bannedPayload;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.checkPassword;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.errorPayload;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.lookupAccountBan;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.lookupIpBan;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.mintResetToken;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.mintSsoTicket;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.readBoolean;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.readInt;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.readString;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.sendJson;
+
+final class SessionEndpoints {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(SessionEndpoints.class);
+
+    private SessionEndpoints() {
+    }
+
+    static void handleLogout(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body) {
+        String ssoTicket = readString(body, "ssoTicket");
+        String rememberToken = readString(body, "rememberToken").trim();
+        JsonObject ok = new JsonObject();
+        ok.addProperty("message", "Logged out.");
+
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection()) {
+            int userId = 0;
+
+            if (ssoTicket != null && !ssoTicket.isEmpty()) {
+                try (PreparedStatement lookup = conn.prepareStatement(
+                        "SELECT id FROM users WHERE auth_ticket = ? LIMIT 1")) {
+                    lookup.setString(1, ssoTicket);
+                    try (ResultSet rs = lookup.executeQuery()) {
+                        if (rs.next()) userId = rs.getInt("id");
+                    }
+                }
+
+                if (userId > 0) {
+                    try (PreparedStatement clear = conn.prepareStatement(
+                            "UPDATE users SET auth_ticket = '', online = '0' WHERE id = ? LIMIT 1")) {
+                        clear.setInt(1, userId);
+                        clear.executeUpdate();
+                    }
+
+                    if (Emulator.getGameServer() != null
+                            && Emulator.getGameServer().getGameClientManager() != null) {
+                        com.eu.habbo.habbohotel.users.Habbo habbo =
+                                Emulator.getGameServer().getGameClientManager().getHabbo(userId);
+                        if (habbo != null && habbo.getClient() != null) {
+                            Emulator.getGameServer().getGameClientManager().disposeClient(habbo.getClient());
+                        }
+                    }
+                }
+            }
+
+            if (!rememberToken.isEmpty()) {
+                RememberJwtService.revokeFromToken(conn, rememberToken);
+            }
+        } catch (Exception e) {
+            LOGGER.error("Logout cleanup failed", e);
+        }
+
+        sendJson(ctx, req, HttpResponseStatus.OK, ok);
+    }
+
+    static void handleRemember(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        String jwt = readString(body, "rememberToken").trim();
+        if (jwt.isEmpty()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST, errorPayload("Missing rememberToken."));
+            return;
+        }
+
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection()) {
+            RememberJwtService.RotationResult rot = RememberJwtService.rotate(conn, jwt, ip);
+            if (rot == null) {
+                sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED, errorPayload("Remember token invalid or expired."));
+                return;
+            }
+
+            String ssoTicket = mintSsoTicket();
+            try (PreparedStatement upd = conn.prepareStatement(
+                    "UPDATE users SET auth_ticket = ?, ip_current = ? WHERE id = ? LIMIT 1")) {
+                upd.setString(1, ssoTicket);
+                upd.setString(2, ip == null ? "" : ip);
+                upd.setInt(3, rot.userId);
+                upd.executeUpdate();
+            }
+
+            JsonObject ok = new JsonObject();
+            ok.addProperty("ssoTicket", ssoTicket);
+            ok.addProperty("username", rot.username);
+            ok.addProperty("rememberToken", rot.jwt);
+            ok.addProperty("expiresAt", rot.expiresAt);
+            ok.addProperty("rememberExpiresAt", rot.expiresAt);
+            AccessTokenService.Issued access = AccessTokenService.issue(rot.userId);
+            ok.addProperty("accessToken", access.token);
+            ok.addProperty("accessTokenExpiresAt", access.expiresAt);
+            sendJson(ctx, req, HttpResponseStatus.OK, ok);
+        } catch (Exception e) {
+            LOGGER.error("Remember login failed", e);
+            sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+        }
+    }
+
+    static void handleSsoToken(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        String ssoTicket = readString(body, "ssoTicket").trim();
+        if (ssoTicket.isEmpty() || ssoTicket.length() > 128) {
+            AuthRateLimiter.recordFailure(ip);
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST, errorPayload("Missing or invalid ssoTicket."));
+            return;
+        }
+
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection();
+             PreparedStatement lookup = conn.prepareStatement(
+                     "SELECT id, username FROM users WHERE auth_ticket = ? LIMIT 1")) {
+            lookup.setString(1, ssoTicket);
+            try (ResultSet rs = lookup.executeQuery()) {
+                if (!rs.next()) {
+                    AuthRateLimiter.recordFailure(ip);
+                    sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED, errorPayload("SSO ticket not recognised."));
+                    return;
+                }
+                int userId = rs.getInt("id");
+                String username = rs.getString("username");
+
+                AuthRateLimiter.recordSuccess(ip);
+
+                AccessTokenService.Issued access = AccessTokenService.issue(userId);
+                JsonObject ok = new JsonObject();
+                ok.addProperty("username", username);
+                ok.addProperty("accessToken", access.token);
+                ok.addProperty("accessTokenExpiresAt", access.expiresAt);
+                sendJson(ctx, req, HttpResponseStatus.OK, ok);
+            }
+        } catch (Exception e) {
+            LOGGER.error("[auth/sso-token] lookup failed", e);
+            sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+        }
+    }
+
+    static void handleRefresh(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        String jwt = readString(body, "rememberToken").trim();
+        if (jwt.isEmpty()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST, errorPayload("Missing rememberToken."));
+            return;
+        }
+
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection()) {
+            RememberJwtService.RotationResult rot = RememberJwtService.rotate(conn, jwt, ip);
+            if (rot == null) {
+                sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED, errorPayload("Remember token invalid or expired."));
+                return;
+            }
+            JsonObject ok = new JsonObject();
+            ok.addProperty("rememberToken", rot.jwt);
+            ok.addProperty("expiresAt", rot.expiresAt);
+            ok.addProperty("rememberExpiresAt", rot.expiresAt);
+            AccessTokenService.Issued access = AccessTokenService.issue(rot.userId);
+            ok.addProperty("accessToken", access.token);
+            ok.addProperty("accessTokenExpiresAt", access.expiresAt);
+            sendJson(ctx, req, HttpResponseStatus.OK, ok);
+        } catch (Exception e) {
+            LOGGER.error("Refresh failed", e);
+            sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+        }
+    }
+
+    static void handleLogin(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        String username = readString(body, "username").trim();
+        String password = readString(body, "password");
+        boolean rememberMe = readBoolean(body, "remember", false) || readBoolean(body, "rememberMe", false);
+
+        if (username.isEmpty() || password.isEmpty()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST, errorPayload("Missing credentials."));
+            return;
+        }
+
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection()) {
+            if (ip != null && !ip.isEmpty()) {
+                AuthHttpUtil.BanInfo ipBan = lookupIpBan(conn, ip);
+                if (ipBan != null) {
+                    LOGGER.info("[auth/login] ip ban hit ip={} type={} expires={}",
+                            ip, ipBan.type, ipBan.expiresAt);
+                    sendJson(ctx, req, HttpResponseStatus.FORBIDDEN, bannedPayload(ipBan));
+                    return;
+                }
+            }
+
+            try (PreparedStatement stmt = conn.prepareStatement(
+                    "SELECT id, username, password FROM users WHERE username = ? LIMIT 1")) {
+                stmt.setString(1, username);
+                try (ResultSet rs = stmt.executeQuery()) {
+                    if (!rs.next()) {
+                        LOGGER.info("[auth/login] user not found username='{}' ip={}", username, ip);
+                        AuthRateLimiter.recordFailure(ip);
+                        sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED,
+                                errorPayload("Invalid Habbo name or password."));
+                        return;
+                    }
+
+                    int userId = rs.getInt("id");
+                    String stored = rs.getString("password");
+                    String storedPreview = stored == null
+                            ? "<null>"
+                            : (stored.isEmpty() ? "<empty>" : stored.substring(0, Math.min(7, stored.length())) + "…(" + stored.length() + " chars)");
+
+                    if (stored == null || stored.isEmpty() || !checkPassword(password, stored)) {
+                        LOGGER.info("[auth/login] password mismatch for user id={} username='{}' stored='{}'",
+                                userId, username, storedPreview);
+                        AuthRateLimiter.recordFailure(ip);
+                        sendJson(ctx, req, HttpResponseStatus.UNAUTHORIZED,
+                                errorPayload("Invalid Habbo name or password."));
+                        return;
+                    }
+
+                    AuthHttpUtil.BanInfo accountBan = lookupAccountBan(conn, userId);
+                    if (accountBan != null) {
+                        LOGGER.info("[auth/login] account ban hit userId={} type={} expires={}",
+                                userId, accountBan.type, accountBan.expiresAt);
+                        AuthRateLimiter.recordSuccess(ip);
+                        sendJson(ctx, req, HttpResponseStatus.FORBIDDEN, bannedPayload(accountBan));
+                        return;
+                    }
+
+                    String ssoTicket = mintSsoTicket();
+
+                    try (PreparedStatement upd = conn.prepareStatement(
+                            "UPDATE users SET auth_ticket = ?, ip_current = ? WHERE id = ? LIMIT 1")) {
+                        upd.setString(1, ssoTicket);
+                        upd.setString(2, ip == null ? "" : ip);
+                        upd.setInt(3, userId);
+                        upd.executeUpdate();
+                    }
+
+                    String rememberToken = null;
+                    if (rememberMe) {
+                        try {
+                            RememberJwtService.RotationResult issued = RememberJwtService.issueForNewFamily(
+                                    conn, userId, rs.getString("username"), ip);
+                            rememberToken = issued.jwt;
+                        } catch (SQLException e) {
+                            LOGGER.error("Failed to issue remember-me JWT for userId=" + userId, e);
+                        }
+                    }
+
+                    AuthRateLimiter.recordSuccess(ip);
+
+                    JsonObject ok = new JsonObject();
+                    ok.addProperty("ssoTicket", ssoTicket);
+                    ok.addProperty("username", rs.getString("username"));
+                    if (rememberToken != null) ok.addProperty("rememberToken", rememberToken);
+                    AccessTokenService.Issued access = AccessTokenService.issue(userId);
+                    ok.addProperty("accessToken", access.token);
+                    ok.addProperty("accessTokenExpiresAt", access.expiresAt);
+                    sendJson(ctx, req, HttpResponseStatus.OK, ok);
+                }
+            }
+        } catch (Exception e) {
+            LOGGER.error("Login query failed for username=" + username, e);
+            sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+        }
+    }
+
+    static void handleRegister(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        if (!Emulator.getConfig().getBoolean("login.register.enabled", true)) {
+            sendJson(ctx, req, HttpResponseStatus.FORBIDDEN, errorPayload("Registration is closed."));
+            return;
+        }
+
+        String username = readString(body, "username").trim();
+        String email    = readString(body, "email").trim();
+        String password = readString(body, "password");
+        String figure   = readString(body, "figure").trim();
+        String gender   = readString(body, "gender").trim().toUpperCase();
+        int templateId  = readInt(body, "templateId", 0);
+
+        if (!USERNAME_RE.matcher(username).matches()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("Username must be 3-32 chars (letters, numbers, . _ -)."));
+            return;
+        }
+        if (!EMAIL_RE.matcher(email).matches()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST, errorPayload("Invalid email address."));
+            return;
+        }
+        if (password.length() < 8) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST,
+                    errorPayload("Password must be at least 8 characters."));
+            return;
+        }
+
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection()) {
+            int maxPerIp = Emulator.getConfig().getInt("register.max_per_ip", 5);
+            if (maxPerIp > 0 && ip != null && !ip.isEmpty()) {
+                try (PreparedStatement quota = conn.prepareStatement(
+                        "SELECT COUNT(*) FROM users WHERE ip_register = ?")) {
+                    quota.setString(1, ip);
+                    try (ResultSet rs = quota.executeQuery()) {
+                        if (rs.next() && rs.getInt(1) >= maxPerIp) {
+                            sendJson(ctx, req, HttpResponseStatus.TOO_MANY_REQUESTS,
+                                    errorPayload("This IP has reached the maximum of "
+                                            + maxPerIp + " registered accounts."));
+                            return;
+                        }
+                    }
+                }
+            }
+
+            try (PreparedStatement check = conn.prepareStatement(
+                    "SELECT username, mail FROM users WHERE username = ? OR mail = ? LIMIT 1")) {
+                check.setString(1, username);
+                check.setString(2, email);
+                try (ResultSet rs = check.executeQuery()) {
+                    if (rs.next()) {
+                        String existingUser = rs.getString("username");
+                        String existingMail = rs.getString("mail");
+                        boolean userTaken = existingUser != null && existingUser.equalsIgnoreCase(username);
+                        boolean mailTaken = existingMail != null && existingMail.equalsIgnoreCase(email);
+                        String message;
+                        if (userTaken && mailTaken)      message = "That Habbo name and email are already in use.";
+                        else if (userTaken)              message = "That Habbo name is already in use.";
+                        else                             message = "That email address is already in use.";
+                        sendJson(ctx, req, HttpResponseStatus.CONFLICT, errorPayload(message));
+                        return;
+                    }
+                }
+            }
+
+            String hashed = BCrypt.hashpw(password, BCrypt.gensalt(12));
+            String defaultLook = Emulator.getConfig().getValue("register.default.look",
+                    "hr-100-7.hd-180-1.ch-210-66.lg-270-82.sh-290-80");
+            String defaultMotto = Emulator.getConfig().getValue("register.default.motto", "I love Habbo!");
+            int now = Emulator.getIntUnixTimestamp();
+
+            String finalLook = (figure.isEmpty() || !FIGURE_RE.matcher(figure).matches()) ? defaultLook : figure;
+            String finalGender = (gender.equals("M") || gender.equals("F")) ? gender : "M";
+
+            int startingCredits  = Math.max(0, Emulator.getConfig().getInt("new_user_credits", 0));
+            int startingDuckets  = Math.max(0, Emulator.getConfig().getInt("new_user_duckets", 0));
+            int startingDiamonds = Math.max(0, Emulator.getConfig().getInt("new_user_diamonds", 0));
+
+            int newUserId = 0;
+            try (PreparedStatement ins = conn.prepareStatement(
+                    "INSERT INTO users (username, password, mail, account_created, " +
+                            "ip_register, ip_current, last_online, last_login, motto, look, gender, " +
+                            "credits, `rank`, home_room, machine_id, auth_ticket, online) " +
+                            "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 0, '', '', '0')",
+                    Statement.RETURN_GENERATED_KEYS)) {
+                ins.setString(1, username);
+                ins.setString(2, hashed);
+                ins.setString(3, email);
+                ins.setInt(4, now);
+                ins.setString(5, ip == null ? "" : ip);
+                ins.setString(6, ip == null ? "" : ip);
+                ins.setInt(7, now);
+                ins.setInt(8, now);
+                ins.setString(9, defaultMotto);
+                ins.setString(10, finalLook);
+                ins.setString(11, finalGender);
+                ins.setInt(12, startingCredits);
+                ins.executeUpdate();
+                try (ResultSet keys = ins.getGeneratedKeys()) {
+                    if (keys.next()) newUserId = keys.getInt(1);
+                }
+            }
+
+            if (newUserId > 0 && (startingDuckets > 0 || startingDiamonds > 0)) {
+                RegistrationSupport.seedUserCurrencies(conn, newUserId, startingDuckets, startingDiamonds);
+            }
+
+            LOGGER.info("[auth/register] user created id={} username='{}' templateId={} credits={} duckets={} diamonds={}",
+                    newUserId, username, templateId, startingCredits, startingDuckets, startingDiamonds);
+
+            if (newUserId > 0 && templateId > 0) {
+                RegistrationSupport.cloneTemplateForUser(conn, templateId, newUserId, username);
+            } else if (templateId > 0) {
+                LOGGER.warn("[auth/register] skipping template clone: user insert did not return an id (username='{}')", username);
+            }
+
+            AvailabilityCache.invalidateEmail(email);
+            AvailabilityCache.invalidateUsername(username);
+
+            JsonObject ok = new JsonObject();
+            ok.addProperty("message", "Welcome aboard, " + username + "! Your account is ready — log in below with the password you just chose.");
+            sendJson(ctx, req, HttpResponseStatus.OK, ok);
+        } catch (Exception e) {
+            LOGGER.error("Register query failed for username=" + username, e);
+            sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+        }
+    }
+
+    static void handleForgot(ChannelHandlerContext ctx, FullHttpRequest req, JsonObject body, String ip) {
+        String email = readString(body, "email").trim();
+
+        if (!EMAIL_RE.matcher(email).matches()) {
+            sendJson(ctx, req, HttpResponseStatus.BAD_REQUEST, errorPayload("Invalid email address."));
+            return;
+        }
+
+        JsonObject ok = new JsonObject();
+        ok.addProperty("message", "Email sent! If an account matches that address you'll find a reset link in your inbox shortly (check spam if it doesn't show up within a minute).");
+
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection();
+             PreparedStatement stmt = conn.prepareStatement(
+                     "SELECT id, username FROM users WHERE mail = ? LIMIT 1")) {
+            stmt.setString(1, email);
+            try (ResultSet rs = stmt.executeQuery()) {
+                if (rs.next()) {
+                    int userId = rs.getInt("id");
+                    String username = rs.getString("username");
+                    String token = mintResetToken();
+                    long expiresAt = Instant.now().getEpochSecond() + 60L * 60L; // 1h
+
+                    try (PreparedStatement ins = conn.prepareStatement(
+                            "INSERT INTO password_resets (user_id, token, expires_at, created_ip) " +
+                                    "VALUES (?, ?, ?, ?) ON DUPLICATE KEY UPDATE " +
+                                    "token = VALUES(token), expires_at = VALUES(expires_at), created_ip = VALUES(created_ip)")) {
+                        ins.setInt(1, userId);
+                        ins.setString(2, token);
+                        ins.setTimestamp(3, Timestamp.from(Instant.ofEpochSecond(expiresAt)));
+                        ins.setString(4, ip == null ? "" : ip);
+                        ins.executeUpdate();
+                    }
+
+                    String resetUrlBase = Emulator.getConfig().getValue("password.reset.url",
+                            "http://localhost/reset-password");
+                    String fullUrl = resetUrlBase + (resetUrlBase.contains("?") ? "&" : "?") + "token=" + token;
+                    String subject = "Reset your Habbo password";
+                    String message = "Hi " + username + ",\n\n" +
+                            "Someone (hopefully you) requested a password reset for your Habbo account.\n" +
+                            "Click the link below within the next hour to choose a new password:\n\n" +
+                            fullUrl + "\n\n" +
+                            "If you didn't request this you can safely ignore this email.";
+
+                    Emulator.getThreading().getService().submit((Runnable) () -> SmtpMailService.send(email, subject, message));
+                }
+            }
+        } catch (Exception e) {
+            LOGGER.error("Forgot-password query failed for email=" + email, e);
+        }
+
+        sendJson(ctx, req, HttpResponseStatus.OK, ok);
+    }
+}

Emulator/src/main/java/com/eu/habbo/networking/gameserver/auth/StaticContentEndpoints.java

@@ -0,0 +1,148 @@
+package com.eu.habbo.networking.gameserver.auth;
+
+import com.eu.habbo.Emulator;
+import com.google.gson.JsonArray;
+import com.google.gson.JsonObject;
+import io.netty.buffer.Unpooled;
+import io.netty.channel.ChannelFutureListener;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.handler.codec.http.DefaultFullHttpResponse;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.FullHttpResponse;
+import io.netty.handler.codec.http.HttpHeaderNames;
+import io.netty.handler.codec.http.HttpHeaderValues;
+import io.netty.handler.codec.http.HttpResponseStatus;
+import io.netty.handler.codec.http.HttpVersion;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.nio.charset.StandardCharsets;
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.applyCors;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.errorPayload;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.isKeepAlive;
+import static com.eu.habbo.networking.gameserver.auth.AuthHttpUtil.sendJson;
+
+final class StaticContentEndpoints {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(StaticContentEndpoints.class);
+
+    private static final long NEWS_CACHE_TTL_MS = 30_000L;
+    private static final int NEWS_IMAGE_MAX_BYTES = 512 * 1024;
+    private static volatile NewsCacheEntry NEWS_CACHE = null;
+
+    private static final class NewsCacheEntry {
+        final byte[] jsonBytes;
+        final long expiresAt;
+
+        NewsCacheEntry(byte[] j, long e) {
+            jsonBytes = j;
+            expiresAt = e;
+        }
+    }
+
+    private StaticContentEndpoints() {
+    }
+
+    static void handleRoomTemplates(ChannelHandlerContext ctx, FullHttpRequest req) {
+        JsonArray templates = new JsonArray();
+        try (Connection conn = Emulator.getDatabase().getDataSource().getConnection();
+             PreparedStatement stmt = conn.prepareStatement(
+                     "SELECT template_id, title, description, thumbnail " +
+                             "FROM room_templates WHERE enabled = '1' " +
+                             "ORDER BY sort_order ASC, template_id ASC")) {
+            try (ResultSet rs = stmt.executeQuery()) {
+                while (rs.next()) {
+                    JsonObject t = new JsonObject();
+                    t.addProperty("templateId", rs.getInt("template_id"));
+                    t.addProperty("title", rs.getString("title"));
+                    t.addProperty("description", rs.getString("description"));
+                    t.addProperty("thumbnail", rs.getString("thumbnail"));
+                    templates.add(t);
+                }
+            }
+        } catch (Exception e) {
+            LOGGER.error("room-templates list failed", e);
+            sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+            return;
+        }
+        JsonObject res = new JsonObject();
+        res.add("templates", templates);
+        sendJson(ctx, req, HttpResponseStatus.OK, res);
+    }
+
+    static void handleNews(ChannelHandlerContext ctx, FullHttpRequest req) {
+        long now = System.currentTimeMillis();
+        NewsCacheEntry cached = NEWS_CACHE;
+
+        if (cached == null || cached.expiresAt < now) {
+            JsonArray items = new JsonArray();
+            int limit = Math.max(1, Math.min(20, Emulator.getConfig().getInt("login.news.limit", 5)));
+            try (Connection conn = Emulator.getDatabase().getDataSource().getConnection();
+                 PreparedStatement stmt = conn.prepareStatement(
+                         "SELECT id, title, body, image, link_text, link_url " +
+                                 "FROM ui_news WHERE enabled = 1 " +
+                                 "ORDER BY sort_order ASC, id DESC LIMIT ?")) {
+                stmt.setInt(1, limit);
+                try (ResultSet rs = stmt.executeQuery()) {
+                    while (rs.next()) {
+                        int id = rs.getInt("id");
+                        JsonObject n = new JsonObject();
+                        n.addProperty("id", id);
+                        n.addProperty("title", rs.getString("title"));
+                        n.addProperty("body", rs.getString("body"));
+
+                        String image = rs.getString("image");
+                        if (image != null && image.length() > NEWS_IMAGE_MAX_BYTES) {
+                            LOGGER.warn("ui_news id={} image is {} bytes (>{}KB cap), omitting in response",
+                                    id, image.length(), NEWS_IMAGE_MAX_BYTES / 1024);
+                            image = null;
+                        }
+                        n.addProperty("image", image);
+
+                        n.addProperty("linkText", rs.getString("link_text"));
+                        n.addProperty("linkUrl", rs.getString("link_url"));
+                        items.add(n);
+                    }
+                }
+            } catch (Exception e) {
+                LOGGER.error("ui_news list failed", e);
+                sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+                return;
+            }
+
+            JsonObject res = new JsonObject();
+            res.add("news", items);
+            byte[] bytes = res.toString().getBytes(StandardCharsets.UTF_8);
+            cached = new NewsCacheEntry(bytes, now + NEWS_CACHE_TTL_MS);
+            NEWS_CACHE = cached;
+        }
+
+        FullHttpResponse response = new DefaultFullHttpResponse(
+                HttpVersion.HTTP_1_1, HttpResponseStatus.OK,
+                Unpooled.wrappedBuffer(cached.jsonBytes));
+        response.headers().set(HttpHeaderNames.CONTENT_TYPE, "application/json; charset=utf-8");
+        response.headers().setInt(HttpHeaderNames.CONTENT_LENGTH, cached.jsonBytes.length);
+        response.headers().set(HttpHeaderNames.CACHE_CONTROL, "public, max-age=30");
+        applyCors(req, response);
+        boolean keepAlive = isKeepAlive(req);
+        if (keepAlive) response.headers().set(HttpHeaderNames.CONNECTION, HttpHeaderValues.KEEP_ALIVE);
+        var future = ctx.writeAndFlush(response);
+        if (!keepAlive) future.addListener(ChannelFutureListener.CLOSE);
+    }
+
+    static void handleServerKey(ChannelHandlerContext ctx, FullHttpRequest req) {
+        try {
+            JsonObject ok = new JsonObject();
+            ok.addProperty("publicKey", com.eu.habbo.networking.gameserver.crypto.CryptoSigningKeyManager.publicKeyBase64());
+            ok.addProperty("algorithm", "ECDSA-P256-SHA256");
+            sendJson(ctx, req, HttpResponseStatus.OK, ok);
+        } catch (Exception e) {
+            LOGGER.error("server-key fetch failed", e);
+            sendJson(ctx, req, HttpResponseStatus.INTERNAL_SERVER_ERROR, errorPayload("Server error."));
+        }
+    }
+}