fix(auth): bind FastLoginPlus pre-login facade to native Connection and AES setter

[Namnarak]

Production regression

Java Premium players are disconnected while FastLoginPlus is verifying Mojang sessions (Player ... disconnected during session verification, aborting), and the client gets io.netty.handler.codec.DecoderException: Received unknown packet id 49 after ProtocolLib2PacketEvents v1.0.8. Two separate users reproduced.

Root cause

P2P's TemporaryPlayerAdapter.create(User) made a ProtocolLib pre-login Player facade with its injector set to null. FastLoginPlus ProtocolLibCompat.getInjector() calls TemporaryPlayerFactory.getInjectorFromPlayer(); with no injector, it incorrectly treats the connection as offline during session verification. Also P2P's NettyChannelInjector always had networkManager=null, even though FastLoginPlus requires the genuine NMS net.minecraft.network.Connection to enable AES. Its legacy FuzzyReflection.getMethodByParameters("a", SecretKey.class) failed to find setEncryptionKey(SecretKey) on remapped Leaf/Paper 1.21.11.

Fix

• Associate the generated temporary facade with its PacketEvents User Netty channel via the existing P2P InjectionFactory; never cast it to CraftPlayer.
• Resolve the native Connection from the channel's existing packet_handler by exact class-hierarchy identity, and refresh late-installed handlers; reject unavailable/non-active connections rather than making up an injector.
• Permit the unique void method with one SecretKey parameter as a fallback for FastLoginPlus's legacy a(SecretKey) lookup. Ambiguous methods are rejected.
• Preserve FastLoginPlus's premium verification and v1.0.7/v1.0.8 packet transport/constructor fixes.

Validation

• v1.0.9, local Maven build succeeds with 29 tests, zero errors/failures, 1 skipped.
• Adds tests for late native packet_handler attachment, rejection of unrelated handler, exact SecretKey method lookup and rejection of ambiguous candidates. Test-only NMS stand-in is under src/test/ and excluded from production JAR.
• Requires CI passing and controlled production restart. Verify with a real Java Premium account before claiming login success.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T18:19:21.346525Z	8488511	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.