fix(premium): send authoritative premium list to proxy when disabled or empty

The proxy.started handler queried stored premium usernames without
checking settings.enablePremium and skipped the send entirely when the
list was empty, so the proxy kept a stale premium_names.cache and went
on verifying enrolled players after the feature was disabled on the
backend.

Gate the DB query on enablePremium and always send the list: an empty
list is authoritative and makes the proxy replace and persist an empty
cache. Both proxies already handle a zero-name chunked list.

Fixes #3127

Author: strobil

authme-core/src/main/java/fr/xephi/authme/service/bungeecord/BungeeReceiver.java

@@ -14,6 +14,7 @@
 import fr.xephi.authme.service.ProxyLoginRequestValidator;
 import fr.xephi.authme.settings.Settings;
 import fr.xephi.authme.settings.properties.HooksSettings;
+import fr.xephi.authme.settings.properties.PremiumSettings;
 import fr.xephi.authme.util.UuidUtils;
 import org.bukkit.entity.Player;
 import org.bukkit.plugin.messaging.Messenger;
@@ -42,6 +43,7 @@ public class BungeeReceiver implements PluginMessageListener, SettingsDependent
     private static final long MAX_AGE_MILLIS = 30_000L;
 
     private boolean isEnabled;
+    private boolean premiumEnabled;
     private String proxySharedSecret;
     private boolean channelRegistered;
 
@@ -63,6 +65,7 @@ public class BungeeReceiver implements PluginMessageListener, SettingsDependent
     public void reload(Settings settings) {
         this.proxySharedSecret = settings.getProperty(HooksSettings.PROXY_SHARED_SECRET);
         this.isEnabled = settings.getProperty(HooksSettings.BUNGEECORD);
+        this.premiumEnabled = settings.getProperty(PremiumSettings.ENABLE_PREMIUM);
         final Messenger messenger = plugin.getServer().getMessenger();
         if (messenger == null) {
             return;
@@ -112,22 +115,23 @@ public void onPluginMessageReceived(String channel, Player player, byte[] data)
             logger.info("Proxy plugin '" + argument + "' has started and registered the authme:main channel");
             final String proxyName = argument;
             bukkitService.runTaskAsynchronously(() -> {
-                List<String> premiumNames = dataSource.getPremiumUsernames();
-                if (!premiumNames.isEmpty()) {
-                    bukkitService.scheduleSyncTaskFromOptionallyAsyncTask(() -> {
-                        // Re-fetch a carrier at send-time: the original player may have gone offline
-                        // during the async DB query.
-                        Player freshCarrier = bukkitService.getOnlinePlayers().stream()
-                            .findFirst().orElse(null);
-                        if (freshCarrier != null) {
-                            bungeeSender.sendPremiumList(freshCarrier, premiumNames);
-                            logger.info("Sent premium list (" + premiumNames.size() + " player(s)) to proxy '" + proxyName + "'");
-                        } else {
-                            logger.warning("Cannot send premium list to proxy '" + proxyName
-                                + "': no online player available as carrier.");
-                        }
-                    });
-                }
+                // Always send the list, even when it is empty: an empty list is authoritative and
+                // lets the proxy replace a stale premium cache. With premium disabled, stored
+                // premium names must not reach the proxy, or it keeps verifying those players.
+                List<String> premiumNames = premiumEnabled ? dataSource.getPremiumUsernames() : List.of();
+                bukkitService.scheduleSyncTaskFromOptionallyAsyncTask(() -> {
+                    // Re-fetch a carrier at send-time: the original player may have gone offline
+                    // during the async DB query.
+                    Player freshCarrier = bukkitService.getOnlinePlayers().stream()
+                        .findFirst().orElse(null);
+                    if (freshCarrier != null) {
+                        bungeeSender.sendPremiumList(freshCarrier, premiumNames);
+                        logger.info("Sent premium list (" + premiumNames.size() + " player(s)) to proxy '" + proxyName + "'");
+                    } else {
+                        logger.warning("Cannot send premium list to proxy '" + proxyName
+                            + "': no online player available as carrier.");
+                    }
+                });
             });
             return;
         }

authme-core/src/test/java/fr/xephi/authme/service/bungeecord/BungeeReceiverTest.java

@@ -12,6 +12,7 @@
 import fr.xephi.authme.service.ProxyLoginRequestValidator;
 import fr.xephi.authme.settings.Settings;
 import fr.xephi.authme.settings.properties.HooksSettings;
+import fr.xephi.authme.settings.properties.PremiumSettings;
 import org.bukkit.Server;
 import org.bukkit.entity.Player;
 import org.bukkit.plugin.messaging.Messenger;
@@ -24,10 +25,12 @@
 import org.mockito.junit.jupiter.MockitoSettings;
 import org.mockito.quality.Strictness;
 
+import java.util.List;
 import java.util.UUID;
 
 import static fr.xephi.authme.service.BukkitServiceTestHelper.setBukkitServiceToRunTaskAsynchronously;
 import static fr.xephi.authme.service.BukkitServiceTestHelper.setBukkitServiceToScheduleSyncEntityTaskFromOptionallyAsyncTask;
+import static fr.xephi.authme.service.BukkitServiceTestHelper.setBukkitServiceToScheduleSyncTaskFromOptionallyAsyncTask;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.nullValue;
@@ -81,6 +84,7 @@ static void initLogger() {
     void setUp() {
         given(plugin.getServer()).willReturn(server);
         given(server.getMessenger()).willReturn(messenger);
+        given(settings.getProperty(PremiumSettings.ENABLE_PREMIUM)).willReturn(true);
     }
 
     @Test
@@ -288,6 +292,58 @@ void shouldRejectConfigPhasePerformLoginWithInvalidHmac() {
         verify(proxySessionManager, never()).processProxySessionMessage(any(), any());
     }
 
+    @Test
+    void shouldSendEmptyPremiumListOnProxyStartedWhenPremiumIsDisabled() {
+        // given
+        given(settings.getProperty(HooksSettings.BUNGEECORD)).willReturn(true);
+        given(settings.getProperty(PremiumSettings.ENABLE_PREMIUM)).willReturn(false);
+        setBukkitServiceToRunTaskAsynchronously(bukkitService);
+        setBukkitServiceToScheduleSyncTaskFromOptionallyAsyncTask(bukkitService);
+
+        Player carrier = mock(Player.class);
+        given(bukkitService.getOnlinePlayers()).willReturn(List.of(carrier));
+
+        BungeeReceiver receiver =
+            new BungeeReceiver(plugin, bukkitService, proxySessionManager, management, bungeeSender, dataSource,
+                proxyLoginRequestValidator, settings);
+
+        // when
+        receiver.onPluginMessageReceived("authme:main", carrier, buildProxyStartedPayload("velocity"));
+
+        // then
+        verify(dataSource, never()).getPremiumUsernames();
+        verify(bungeeSender).sendPremiumList(carrier, List.of());
+    }
+
+    @Test
+    void shouldSendEmptyPremiumListOnProxyStartedWhenNoPremiumUsersAreStored() {
+        // given
+        given(settings.getProperty(HooksSettings.BUNGEECORD)).willReturn(true);
+        given(dataSource.getPremiumUsernames()).willReturn(List.of());
+        setBukkitServiceToRunTaskAsynchronously(bukkitService);
+        setBukkitServiceToScheduleSyncTaskFromOptionallyAsyncTask(bukkitService);
+
+        Player carrier = mock(Player.class);
+        given(bukkitService.getOnlinePlayers()).willReturn(List.of(carrier));
+
+        BungeeReceiver receiver =
+            new BungeeReceiver(plugin, bukkitService, proxySessionManager, management, bungeeSender, dataSource,
+                proxyLoginRequestValidator, settings);
+
+        // when
+        receiver.onPluginMessageReceived("authme:main", carrier, buildProxyStartedPayload("velocity"));
+
+        // then
+        verify(bungeeSender).sendPremiumList(carrier, List.of());
+    }
+
+    private static byte[] buildProxyStartedPayload(String proxyName) {
+        ByteArrayDataOutput out = ByteStreams.newDataOutput();
+        out.writeUTF(MessageType.PROXY_STARTED.getId());
+        out.writeUTF(proxyName);
+        return out.toByteArray();
+    }
+
     private static byte[] buildPerformLoginPayload(String playerName, long timestamp, String hmac) {
         return buildPerformLoginPayload(playerName, timestamp, "", hmac);
     }