feat(core): support trusted Bedrock identity sessions

api/src/main/java/com/minekube/connect/api/ConnectApi.java

@@ -26,7 +26,9 @@
 package com.minekube.connect.api;
 
 import com.minekube.connect.api.player.ConnectPlayer;
+import com.minekube.connect.api.player.bedrock.BedrockIdentityClaims;
 import java.util.Collection;
+import java.util.Optional;
 import java.util.UUID;
 
 public interface ConnectApi {
@@ -48,7 +50,7 @@ static ConnectApi getInstance() {
     int getPlayerCount();
 
     /**
-     * Method to determine if the given <b>online</b> player is a bedrock player
+     * Determines whether the given <b>online</b> player is tunneled by Connect.
      *
      * @param uuid The uuid of the <b>online</b> player
      * @return true if the given <b>online</b> player is tunneled by Connect
@@ -62,4 +64,17 @@ static ConnectApi getInstance() {
      * @return ConnectPlayer if the given uuid is a player tunneled by Connect
      */
     ConnectPlayer getPlayer(UUID uuid);
+
+    /**
+     * Returns claims from a Moxy-signed Bedrock identity envelope that Connect verified for the
+     * player's current session. Java, disabled, warn-failed, rejected, and disconnected sessions
+     * return empty. The claims' XUID accessor is sensitive trusted identity material intended only
+     * for in-process authorization; callers must not log, serialize, forward, or expose it.
+     *
+     * @param player a player object returned by this API for the currently connected session
+     * @return immutable verified claims, or empty when no verified claims exist for the session
+     */
+    default Optional<BedrockIdentityClaims> getVerifiedBedrockIdentity(ConnectPlayer player) {
+        return Optional.empty();
+    }
 }

api/src/main/java/com/minekube/connect/api/player/bedrock/BedrockIdentityClaims.java

@@ -3,6 +3,11 @@
 import java.time.Instant;
 import lombok.Value;
 
+/**
+ * Immutable claims decoded from a signed Bedrock identity envelope. Claims returned by
+ * {@code ConnectApi#getVerifiedBedrockIdentity} have passed Connect's admission checks and are
+ * bound to the current Connect session.
+ */
 @Value
 public class BedrockIdentityClaims {
     String issuer;
@@ -13,12 +18,155 @@ public class BedrockIdentityClaims {
     String protocol;
     String bedrockAuthPolicy;
     String principalType;
-    String bedrockXuid;
+    transient String bedrockXuid;
     String bedrockUsername;
     String bedrockDerivedUuid;
     String linkedJavaUuid;
     String linkedJavaName;
     Instant issuedAt;
     Instant expiresAt;
-    String nonce;
+
+    /**
+     * Creates an immutable Bedrock identity claim set.
+     *
+     * @param issuer signed envelope issuer
+     * @param endpointId signed Connect endpoint ID
+     * @param endpointName signed Connect endpoint name
+     * @param orgId signed Connect organization ID
+     * @param sessionId signed Connect session ID
+     * @param protocol signed client protocol
+     * @param bedrockAuthPolicy signed Bedrock authentication policy
+     * @param principalType signed principal type
+     * @param bedrockXuid canonical Bedrock XUID
+     * @param bedrockUsername Bedrock username
+     * @param bedrockDerivedUuid deterministic UUID derived from the XUID
+     * @param linkedJavaUuid linked Java UUID, or {@code null} for an unlinked principal
+     * @param linkedJavaName linked Java name, or {@code null} for an unlinked principal
+     * @param issuedAt envelope issue time
+     * @param expiresAt envelope expiration time
+     */
+    public BedrockIdentityClaims(
+            String issuer,
+            String endpointId,
+            String endpointName,
+            String orgId,
+            String sessionId,
+            String protocol,
+            String bedrockAuthPolicy,
+            String principalType,
+            String bedrockXuid,
+            String bedrockUsername,
+            String bedrockDerivedUuid,
+            String linkedJavaUuid,
+            String linkedJavaName,
+            Instant issuedAt,
+            Instant expiresAt) {
+        this.issuer = issuer;
+        this.endpointId = endpointId;
+        this.endpointName = endpointName;
+        this.orgId = orgId;
+        this.sessionId = sessionId;
+        this.protocol = protocol;
+        this.bedrockAuthPolicy = bedrockAuthPolicy;
+        this.principalType = principalType;
+        this.bedrockXuid = bedrockXuid;
+        this.bedrockUsername = bedrockUsername;
+        this.bedrockDerivedUuid = bedrockDerivedUuid;
+        this.linkedJavaUuid = linkedJavaUuid;
+        this.linkedJavaName = linkedJavaName;
+        this.issuedAt = issuedAt;
+        this.expiresAt = expiresAt;
+    }
+
+    /**
+     * @deprecated The nonce is private replay-protection data and is deliberately not retained.
+     *     This constructor remains only for source compatibility; {@code ignoredNonce} is ignored.
+     *
+     * @param issuer signed envelope issuer
+     * @param endpointId signed Connect endpoint ID
+     * @param endpointName signed Connect endpoint name
+     * @param orgId signed Connect organization ID
+     * @param sessionId signed Connect session ID
+     * @param protocol signed client protocol
+     * @param bedrockAuthPolicy signed Bedrock authentication policy
+     * @param principalType signed principal type
+     * @param bedrockXuid canonical Bedrock XUID
+     * @param bedrockUsername Bedrock username
+     * @param bedrockDerivedUuid deterministic UUID derived from the XUID
+     * @param linkedJavaUuid linked Java UUID, or {@code null} for an unlinked principal
+     * @param linkedJavaName linked Java name, or {@code null} for an unlinked principal
+     * @param issuedAt envelope issue time
+     * @param expiresAt envelope expiration time
+     * @param ignoredNonce ignored legacy nonce
+     */
+    @Deprecated
+    public BedrockIdentityClaims(
+            String issuer,
+            String endpointId,
+            String endpointName,
+            String orgId,
+            String sessionId,
+            String protocol,
+            String bedrockAuthPolicy,
+            String principalType,
+            String bedrockXuid,
+            String bedrockUsername,
+            String bedrockDerivedUuid,
+            String linkedJavaUuid,
+            String linkedJavaName,
+            Instant issuedAt,
+            Instant expiresAt,
+            String ignoredNonce) {
+        this(
+                issuer,
+                endpointId,
+                endpointName,
+                orgId,
+                sessionId,
+                protocol,
+                bedrockAuthPolicy,
+                principalType,
+                bedrockXuid,
+                bedrockUsername,
+                bedrockDerivedUuid,
+                linkedJavaUuid,
+                linkedJavaName,
+                issuedAt,
+                expiresAt);
+    }
+
+    /**
+     * @deprecated The nonce is private replay-protection data and is no longer exposed.
+     *
+     * @return always {@code null}
+     */
+    @Deprecated
+    public String getNonce() {
+        return null;
+    }
+
+    /**
+     * Returns the sensitive, trusted Bedrock XUID for in-process plugin authorization only.
+     * Do not log, serialize, forward, or expose this value to untrusted consumers.
+     *
+     * @return canonical XUID from the verified signed envelope
+     */
+    @java.beans.Transient
+    public String getBedrockXuid() {
+        return bedrockXuid;
+    }
+
+    @Override
+    public String toString() {
+        return "BedrockIdentityClaims(issuer=" + issuer
+                + ", endpointId=" + endpointId
+                + ", orgId=" + orgId
+                + ", sessionId=" + sessionId
+                + ", protocol=" + protocol
+                + ", bedrockAuthPolicy=" + bedrockAuthPolicy
+                + ", principalType=" + principalType
+                + ", issuedAt=" + issuedAt
+                + ", expiresAt=" + expiresAt
+                + ")";
+    }
 }

api/src/main/java/com/minekube/connect/api/player/bedrock/BedrockIdentityProfiles.java

@@ -0,0 +1,47 @@
+package com.minekube.connect.api.player.bedrock;
+
+import com.minekube.connect.api.player.GameProfile;
+import java.util.Collections;
+import java.util.List;
+import java.util.Objects;
+import java.util.stream.Collectors;
+
+/** Utilities for removing private Bedrock identity admission properties from public profiles. */
+public final class BedrockIdentityProfiles {
+    /** Private transport property carrying endpoint and organization scope for legacy Watch. */
+    public static final String SCOPE_PROPERTY_NAME = "minekube:bedrock_identity_scope";
+
+    private BedrockIdentityProfiles() {
+    }
+
+    /**
+     * Returns a profile without the signed identity envelope or transport scope property.
+     *
+     * @param profile the profile to sanitize
+     * @return {@code profile} when it contains no private properties, otherwise a sanitized copy
+     */
+    public static GameProfile withoutEnvelope(GameProfile profile) {
+        Objects.requireNonNull(profile, "profile");
+        List<GameProfile.Property> properties = profile.getProperties().stream()
+                .filter(BedrockIdentityProfiles::isPublic)
+                .collect(Collectors.toList());
+        if (properties.size() == profile.getProperties().size()) {
+            return profile;
+        }
+        return new GameProfile(
+                profile.getUsername(),
+                profile.getUniqueId(),
+                Collections.unmodifiableList(properties));
+    }
+
+    /**
+     * Determines whether a profile property may be exposed outside identity admission.
+     *
+     * @param property the property to classify
+     * @return true unless the property is reserved for Bedrock identity admission
+     */
+    public static boolean isPublic(GameProfile.Property property) {
+        return !BedrockIdentityVerifier.PROPERTY_NAME.equals(property.getName()) &&
+                !SCOPE_PROPERTY_NAME.equals(property.getName());
+    }
+}