Preserve MMOItems and MythicMobs identities in audit lookups

[ryanbarlow97]

MMOItems pickups and MythicMobs kills currently appear under vanilla material/entity labels. Preserve MMOItems type/ID and saved names in lookup labels, and capture MythicMobs internal IDs on new kills so custom identities remain distinguishable from renamed vanilla items.

Uses existing metadata storage and preserves rollback entity payloads. Historical named mobs remain explicitly labelled as names; no schema migration or history rewrite. Optional integration keeps the plugins optional.

Validation: 17 Java tests and Maven verification passed. Dev smoke on Paper verified a real MMOItems Mythril Ingot, a renamed vanilla ingot, and a spawned/killed MythicMobs rat through persisted rows and /co lookups, including after restart. Tested runtime package: 25.3.0-audit.1. Release packaging must use the existing tag-derived numeric version, not main-SNAPSHOT.

Part of the coordinated Main release; no independent Main deployment.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 80a62753-d5af-4b34-b9b3-26fcd11289ed

📥 Commits

Reviewing files that changed from the base of the PR and between aae186f and a9f4091.

📒 Files selected for processing (16)

• README.md
• src/main/java/net/tfminecraft/coreprotect/command/lookup/StandardLookupThread.java
• src/main/java/net/tfminecraft/coreprotect/consumer/Queue.java
• src/main/java/net/tfminecraft/coreprotect/consumer/process/EntityKillProcess.java
• src/main/java/net/tfminecraft/coreprotect/database/logger/EntityKillLogger.java
• src/main/java/net/tfminecraft/coreprotect/database/lookup/ChestTransactionLookup.java
• src/main/java/net/tfminecraft/coreprotect/listener/ListenerHandler.java
• src/main/java/net/tfminecraft/coreprotect/listener/entity/EntityDeathListener.java
• src/main/java/net/tfminecraft/coreprotect/listener/entity/MythicMobListener.java
• src/main/java/net/tfminecraft/coreprotect/model/action/MythicIdentity.java
• src/main/java/net/tfminecraft/coreprotect/utility/AuditLabels.java
• src/main/resources/plugin.yml
• src/test/java/net/tfminecraft/coreprotect/database/logger/EntityKillLoggerTest.java
• src/test/java/net/tfminecraft/coreprotect/listener/entity/MythicMobListenerTest.java
• src/test/java/net/tfminecraft/coreprotect/model/action/MythicIdentityTest.java
• src/test/java/net/tfminecraft/coreprotect/utility/AuditLabelsTest.java

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• New Features
  • Audit logs and lookup results now show saved custom names for renamed items and entities.
  • When available, item labels include MMOItems names and IDs, and MythicMobs labels include mob names and IDs.
  • New MythicMobs deaths record the mob identity for clearer audit history.
  • Vanilla item and entity labels remain available when custom identity data is missing.
• Documentation
  • Updated feature notes to clarify metadata requirements and integration behaviour. Removed outdated staff investigation and settings descriptions.

Walkthrough

The change records MythicMobs internal identities with entity-kill data and adds custom item and mob labels to lookup output. It also updates the README with label behaviour, integration requirements, and limits.

Changes

Custom audit labels

Layer / File(s)	Summary
Capture MythicMobs identities src/main/java/net/tfminecraft/coreprotect/model/action/MythicIdentity.java, src/main/java/net/tfminecraft/coreprotect/listener/entity/MythicMobListener.java, src/main/java/net/tfminecraft/coreprotect/listener/entity/EntityDeathListener.java, src/main/java/net/tfminecraft/coreprotect/listener/ListenerHandler.java, src/main/resources/plugin.yml, src/test/java/net/tfminecraft/coreprotect/model/action/MythicIdentityTest.java, src/test/java/net/tfminecraft/coreprotect/listener/entity/MythicMobListenerTest.java	Adds a validated identity representation and optional reflective MythicMobs death-event handling. Non-player death handling consumes the captured identity.
Persist identities with entity kills src/main/java/net/tfminecraft/coreprotect/consumer/Queue.java, src/main/java/net/tfminecraft/coreprotect/consumer/process/EntityKillProcess.java, src/main/java/net/tfminecraft/coreprotect/database/logger/EntityKillLogger.java, src/test/java/net/tfminecraft/coreprotect/database/logger/EntityKillLoggerTest.java	Passes an optional identity through the entity-kill queue and stores its metadata with the kill record. The test covers logging with and without an identity.
Build and display audit labels src/main/java/net/tfminecraft/coreprotect/utility/AuditLabels.java, src/main/java/net/tfminecraft/coreprotect/command/lookup/StandardLookupThread.java, src/main/java/net/tfminecraft/coreprotect/database/lookup/ChestTransactionLookup.java, src/test/java/net/tfminecraft/coreprotect/utility/AuditLabelsTest.java, README.md	Builds bounded, sanitised item and mob labels from saved metadata. Lookup output uses those labels, and the README describes integration requirements, fallback behaviour, and limits.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant MythicMobsDeathEvent
  participant MythicMobListener
  participant EntityDeathListener
  participant Queue
  participant EntityKillProcess
  participant EntityKillLogger
  MythicMobsDeathEvent->>MythicMobListener: Read internal name and attach metadata
  EntityDeathListener->>MythicMobListener: Take entity identity
  MythicMobListener-->>EntityDeathListener: Return MythicIdentity or null
  EntityDeathListener->>Queue: Queue entity kill with identity
  Queue->>EntityKillProcess: Pass queued payload
  EntityKillProcess->>EntityKillLogger: Log entity kill with identity

Loading

Merge Risk: ⚪ Minimal · up to a9f40

The custom labels and optional identity capture appear mergeable after normal checks. Confirm MythicMobs event ordering for the supported version if that integration requires an additional compatibility guarantee.

Security Architecture Review

Security architecture risk: 🔵 Low · up to a9f40

Custom identities enrich audit records without changing lookup permissions or entity recovery behavior. No introduced security vulnerability was established. Remaining uncertainty concerns whether custom identities are consistently captured across supported plugin versions, event ordering and reload conditions.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The evidenced exposure is audit-record enrichment and lookup display for the server's recorded items and mobs. Players who can choose recorded names can influence displayed text, but the inspected consumers do not turn that text into command authority. Existing lookup and give-item permission checks remain relevant controls.

Trust Boundaries and Controls

• observed — Identity consumption accepts only metadata owned by the current CoreProtect plugin. IDs are restricted to a bounded character set; display-name cleaning removes color codes, control and formatting characters, angle brackets and pipes. Give-item click commands use a separately constructed numeric item ID rather than the displayed label.

Resilience and Maintainability Implications

• observed — Malformed historical item reconstruction or optional NBT access can fall back to vanilla or renamed labels. Identity metadata uses the existing serializers and batch path rather than an independent write. Legacy object-stream readers remain part of the persistence trust boundary; identity-shape validation occurs after decoding and does not authenticate stored bytes.

Hardening Proposals

• proposed — Before treating custom-ID capture as a security-sensitive audit completeness guarantee, validate its handoff across supported event ordering, repeated delivery, region-threaded execution and plugin reload states. Keep unavailable enrichment distinguishable from proven custom identity.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}