Hotfix some issues with online-mode-need-auth-strict

src/main/java/net/elytrium/limboauth/LimboAuth.java

@@ -240,6 +240,12 @@ public void onProxyInitialization(ProxyInitializeEvent event) {
   public void reload() {
     Settings.IMP.reload(this.configFile, Settings.IMP.PREFIX);
 
+    if (!Settings.IMP.MAIN.ONLINE_MODE_NEED_AUTH_STRICT && !Settings.IMP.MAIN.SAVE_PREMIUM_ACCOUNTS) {
+      Settings.IMP.MAIN.SAVE_PREMIUM_ACCOUNTS = true;
+      LOGGER.error("As you have online-mode-need-auth-strict disabled, save-premium-accounts "
+          + "was forcibly enabled to prevent online-mode accounts hijacking.");
+    }
+
     if (this.floodgateApi == null && !Settings.IMP.MAIN.FLOODGATE_NEED_AUTH) {
       throw new IllegalStateException("If you want floodgate players to automatically pass auth (floodgate-need-auth: false),"
           + " please install floodgate plugin.");
@@ -832,7 +838,9 @@ private boolean checkIsPremiumAndCache(String nickname, Function<String, Premium
 
     if (unknown) {
       if (uuid != null && this.isPremiumUuid(uuid)) {
-        return this.setPremium(lowercaseNickname, true).isPremium();
+        CachedPremiumUser premiumUser = this.setPremium(lowercaseNickname, true);
+        premiumUser.setForcePremium(true);
+        return premiumUser.isPremium();
       }
 
       if (Settings.IMP.MAIN.ONLINE_MODE_NEED_AUTH) {

src/main/java/net/elytrium/limboauth/listener/AuthListener.java

@@ -39,6 +39,7 @@
 import net.elytrium.limboapi.api.event.LoginLimboRegisterEvent;
 import net.elytrium.limboauth.LimboAuth;
 import net.elytrium.limboauth.LimboAuth.CachedPremiumUser;
+import net.elytrium.limboauth.LimboAuth.PremiumState;
 import net.elytrium.limboauth.Settings;
 import net.elytrium.limboauth.floodgate.FloodgateApiHolder;
 import net.elytrium.limboauth.handler.AuthSessionHandler;
@@ -72,7 +73,8 @@ public void onPreLoginEvent(PreLoginEvent event) {
           if (!Settings.IMP.MAIN.ONLINE_MODE_NEED_AUTH_STRICT) {
             CachedPremiumUser premiumUser = this.plugin.getPremiumCache(username);
             MinecraftConnection connection = this.getConnection(event.getConnection());
-            if (!connection.isClosed() && premiumUser != null && !premiumUser.isForcePremium()) {
+            if (!connection.isClosed() && premiumUser != null && !premiumUser.isForcePremium()
+                && this.plugin.isPremiumInternal(username).getState() != PremiumState.PREMIUM) {
               this.plugin.getPendingLogins().add(username);
 
               // As Velocity doesnt have any events for our usecase, just inject into netty
@@ -152,6 +154,11 @@ public void onPostLogin(PostLoginEvent event) {
   public void onLoginLimboRegister(LoginLimboRegisterEvent event) {
     // Player has completed online-mode authentication, can be sure that the player has premium account
     if (event.getPlayer().isOnlineMode()) {
+      CachedPremiumUser premiumUser = this.plugin.getPremiumCache(event.getPlayer().getUsername());
+      if (premiumUser != null) {
+        premiumUser.setForcePremium(true);
+      }
+
       this.plugin.getPendingLogins().remove(event.getPlayer().getUsername());
     }