feat: 添加 gitea 构建脚本

fix: 修复接口响应
feat: 添加 blocklist 接口
2025-09-01 01:24:04 +08:00 · 2025-09-01 01:23:43 +08:00 · 2025-09-01 00:26:26 +08:00 · 2025-07-15 23:13:27 +08:00 · 2025-06-19 22:45:10 +08:00 · 2025-06-19 01:12:19 +08:00
63 changed files with 6252 additions and 862 deletions
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -0,0 +1,68 @@
+name: Build and Push Docker Image
+
+on:
+  push:
+    branches:
+      - dev
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    env:
+      CGO_ENABLED: 1
+    steps:
+      - name: Checkout codebase
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Pre Setup NodeJS
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18.x'
+      - name: For act to work
+        run: npm -g install yarn
+      - name: Setup NodeJS
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18.x'
+          cache: 'yarn'
+          cache-dependency-path: frontend
+      - name: Build Frontend
+        run: |
+          make assets
+          rm -rf /host/${{ gitea.workspace }} && mkdir -p /host/${{ gitea.workspace }}
+          cp -a . /host/${{ gitea.workspace }}/
+      - name: Build Yggdrasil Server
+        uses: crazy-max/ghaction-xgo@v2
+        with:
+          xgo_version: latest
+          go_version: 1.24
+          dest: build
+          prefix: yggdrasil
+          targets: linux/amd64,linux/arm64
+          v: true
+          x: false
+          race: false
+          ldflags: -s -w -buildid=
+          tags: nomsgpack sqlite mysql
+          trimpath: true
+      - name: Store Back Binaries
+        run: |
+          cp -a /host/${{ gitea.workspace }}/build/. build
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: docker.sunxinao.cn
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: docker.sunxinao.cn/gardel/yggdrasil-go:latest
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,12 +18,20 @@ jobs:
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
-
+      - name: Setup NodeJS
+        uses: actions/setup-node@v3
+        with:
+          node-version: '18.x'
+          cache: 'yarn'
+          cache-dependency-path: frontend
+      - name: Build Frontend
+        run: |
+          make assets
      - name: Build Yggdrasil Server
        uses: crazy-max/ghaction-xgo@v2
        with:
          xgo_version: latest
-          go_version: 1.19
+          go_version: 1.24
          dest: build
          prefix: yggdrasil
          targets: windows/amd64,linux/amd64,linux/arm64,darwin/amd64,darwin/arm64
@@ -37,14 +45,14 @@ jobs:
      - name: Create ZIP archive
        if: startsWith(github.ref, 'refs/tags/')
        run: |
-          cp -v ./config_example.ini ./build || exit 1
+          cp -rv ./config_example.ini ./assets ./build/ || exit 1
          pushd build || exit 1
          ls -1 yggdrasil-* | while read LINE; do
          PREFIX="${LINE%.*}"
          SUFFIX="$(echo "$LINE" | grep -osE '\.\w+' || printf '')"
          cp -v "$LINE" "yggdrasil$SUFFIX"
          FILE="../$PREFIX.zip"
-          zip -9v "$FILE" "yggdrasil$SUFFIX" *.ini
+          zip -9rv "$FILE" "yggdrasil$SUFFIX" *.ini assets
          DGST="$FILE.dgst"
          openssl dgst -md5    "$FILE" | sed 's/([^)]*)//g' >>"$DGST"
          openssl dgst -sha1   "$FILE" | sed 's/([^)]*)//g' >>"$DGST"
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,7 @@
 # Dependency directories (remove the comment below to include it)
 # vendor/

+assets
 yggdrasil
 /*.pem
 /*.db
--- a/5
+++ b/5
@@ -1,8 +1,10 @@
-FROM alpine:latest
+FROM debian:12-slim

 LABEL maintainer="Gardel <sunxinao@hotmail.com>"
 LABEL "Description"="Go Yggdrasil Server"

+RUN apt-get update && apt-get install -y ca-certificates
+RUN update-ca-certificates
 ARG TARGETOS
 ARG TARGETARCH
 RUN mkdir -p /app
@@ -10,6 +12,7 @@ COPY "build/yggdrasil-${TARGETOS}-${TARGETARCH}" /app/yggdrasil

 EXPOSE 8080
 VOLUME /app/data
+COPY assets /app/data/assets/

 WORKDIR /app/data
 ENTRYPOINT ["/app/yggdrasil"]
--- a/10
+++ b/10
@@ -10,14 +10,20 @@ PACKAGE_NAME = yggdrasil.tar.gz

 default: $(BINARY)

-$(BINARY):
+$(BINARY):assets
 	$(GO_BUILD) -tags='nomsgpack,sqlite,mysql' -o $(BINARY)

 get:
 	$(GO_GET)

+assets:
+	mkdir -p assets
+	yarn --cwd frontend install --frozen-lockfile --non-interactive
+	yarn --cwd frontend build
+	cp -r frontend/dist/. assets/
+
 package:$(BINARY)
-	tar -zcf $(PACKAGE_NAME) $(BINARY) config_example.ini
+	tar -zcf $(PACKAGE_NAME) $(BINARY) config_example.ini assets

 clean:
 	-$(GO_CLEAN)
--- a/README.md
+++ b/README.md
@@ -16,6 +16,12 @@

 禁止其他违反 [EULA](https://account.mojang.com/documents/minecraft_eula) 的行为。

+## 准备
+
+ 运行 Linux, Windows 或 MacOS 的主机
+ SMTP 服务器和账号用于发送密码找回邮件
+ MySQL 数据库（如果使用 sqlite 则不需要）
+
 ## 用法

 下载或编译得到可执行文件并运行，将会自动生成所需的配置文件和数据库文件。
@@ -24,7 +30,7 @@

 启动成功后在启动器（请使用第三方启动器）外置登录选项上填写运行的 URL 的根路径，比如 `http://localhost:8080`。

-注册地址在 `/profile/index.html`。
+注册地址在 `/profile/`。

 ## Docker

@@ -33,3 +39,11 @@
 ```shell
 docker run -d --name yggdrasil-go -v $(pwd)/data:/app/data -p 8080:8080 gardel/yggdrasil-go:latest
 ```
+
+## 计划
+
+- [x] 支持密码重置
+- [ ] 支持不同的数据库如 PostgreSQL 等
+- [ ] 添加选项以支持完全离线模式（不检查 Mojang 接口）
+- [ ] 添加选项以禁用邮箱验证
+- [ ] 令牌持久化防止升级和重启时令牌生效
--- a/assets/index.html
+++ b/assets/index.html
@@ -1,86 +0,0 @@
-<!--
-  ~ Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
-  ~
-  ~ This program is free software: you can redistribute it and/or modify
-  ~ it under the terms of the GNU Affero General Public License as published by
-  ~ the Free Software Foundation, either version 3 of the License, or
-  ~ (at your option) any later version.
-  ~
-  ~ This program is distributed in the hope that it will be useful,
-  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
-  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  ~ GNU Affero General Public License for more details.
-  ~
-  ~ You should have received a copy of the GNU Affero General Public License
-  ~ along with this program.  If not, see <https://www.gnu.org/licenses/>.
-  -->
-
-<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>注册</title>
-  <link rel="stylesheet" href="https://cdn.bootcss.com/normalize/8.0.0/normalize.min.css">
-  <!-- <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,400,500,700"> -->
-  <link href="https://cdn.bootcss.com/material-components-web/5.1.0/material-components-web.min.css" rel="stylesheet">
-  <script src="https://cdn.bootcss.com/material-components-web/5.1.0/material-components-web.min.js"></script>
-  <link rel="stylesheet" href="login.css">
-</head>
-<body >
-  <noscript>You need to enable JavaScript to run this app.</noscript>
-  <section class="header">
-    <h1>简陋注册页</h1>
-  </section>
-
-  <form id="reg-form" action="#">
-    <div class="mdc-text-field username">
-      <input type="email" class="mdc-text-field__input" id="username-input" name="username" required>
-      <label class="mdc-floating-label" for="username-input">邮箱</label>
-      <div class="mdc-line-ripple"></div>
-    </div>
-	<div class="mdc-text-field profileName">
-	  <input type="text" class="mdc-text-field__input" id="profileName-input" name="profileName" required minlength="2">
-	  <label class="mdc-floating-label" for="profileName-input">角色名</label>
-	  <div class="mdc-line-ripple"></div>
-	</div>
-    <div class="mdc-text-field-helper-line profileName-helper">
-      <div class="mdc-text-field-helper-text" aria-hidden="true">字母，数字或下划线</div>
-    </div>
-    <div class="mdc-text-field password">
-      <input type="password" class="mdc-text-field__input" id="password-input" name="password" required minlength="6">
-      <label class="mdc-floating-label" for="password-input">密码</label>
-      <div class="mdc-line-ripple"></div>
-    </div>
-	<div class="mdc-text-field-helper-line password-helper">
-	  <div class="mdc-text-field-helper-text" aria-hidden="true">警告: 暂无重置密码接口，请妥善保管密码</div>
-	</div>
-    <div class="button-container">
-      <button class="mdc-button mdc-button--raised login">
-        <div class="mdc-button__ripple"></div>
-        <span class="mdc-button__label">
-          已有账号登录
-        </span>
-      </button>
-      <button type="submit" class="mdc-button mdc-button--raised next">
-        <div class="mdc-button__ripple"></div>
-        <span class="mdc-button__label">
-          下一步
-        </span>
-      </button>
-    </div>
-  </form>
-  <div class="mdc-snackbar">
-    <div class="mdc-snackbar__surface">
-      <div class="mdc-snackbar__label"
-           role="status"
-           aria-live="polite">
-        注册失败
-      </div>
-    </div>
-  </div>
-
-  <script src="https://cdn.bootcss.com/jquery/3.5.0/jquery.min.js"></script>
-  <script src="login.js" async></script>
-</body>
-</html>
--- a/assets/login.js
+++ b/assets/login.js
@@ -1,129 +0,0 @@
-/*
- * Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-const MDCSnackbar = mdc.snackbar.MDCSnackbar;
-const MDCTextField = mdc.textField.MDCTextField;
-const MDCRipple = mdc.ripple.MDCRipple;
-
-const snackbar = new MDCSnackbar(document.querySelector(".mdc-snackbar"));
-const username = new MDCTextField(document.querySelector(".username"));
-const password = new MDCTextField(document.querySelector(".password"));
-const profileName = new MDCTextField(document.querySelector(".profileName"));
-
-new MDCRipple(document.querySelector(".next"));
-
-snackbar.close();
-
-var login = false;
-
-$(".login").click(function (btn) {
-    login = true;
-    $(".profileName").hide();
-    $("#profileName-input").removeAttr("required");
-    $(".next").children(".mdc-button__label").text("登录");
-    $(this).hide();
-});
-
-$("#reg-form").submit(function (e) {
-    if (!login) {
-        $.ajax({
-            url: "/authserver/register",
-            type: "POST",
-            dataType: "JSON",
-            contentType: "application/json",
-            data: JSON.stringify({
-                username: username.value,
-                password: password.value,
-                profileName: profileName.value
-            }),
-            success: function (data) {
-                if (!data.id) {
-                    if (data.errorMessage) snackbar.labelText = data.errorMessage;
-                    snackbar.open();
-                } else {
-                    login = true;
-                    $(".profileName").hide();
-                    $(".login").hide();
-                    $(".next").children(".mdc-button__label").text("登录");
-                    snackbar.timeoutMs = 10000;
-                    snackbar.labelText = "注册成功，uid:" + data.id;
-                    snackbar.open();
-                    localStorage.uuid = data.id;
-                }
-            },
-            error: function (e) {
-                let response = JSON.parse(e.responseText);
-                if (response.errorMessage === "profileName exist") {
-                    snackbar.labelText = "注册失败: 角色名已存在";
-                } else if (response.errorMessage === "profileName duplicate") {
-                    snackbar.labelText = "注册失败: 角色名与正版用户冲突";
-                } else {
-                    snackbar.labelText = "注册失败: " + response.errorMessage;
-                }
-                snackbar.open();
-            }
-        });
-    } else {
-        $.ajax({
-            url: "/authserver/authenticate",
-            type: "POST",
-            dataType: "JSON",
-            contentType: "application/json",
-            data: JSON.stringify({
-                username: username.value,
-                password: password.value
-            }),
-            success: function (data) {
-                if (!data.accessToken) {
-                    snackbar.labelText = "登录失败:";
-                    if (data.errorMessage) snackbar.labelText += data.errorMessage;
-                    snackbar.open();
-                } else {
-                    snackbar.timeoutMs = 5000;
-                    snackbar.labelText = "登录成功，accessToken:" + data.accessToken;
-                    snackbar.open();
-                    localStorage.accessToken = data.accessToken;
-                    localStorage.loginTime = new Date().getTime();
-                    localStorage.profileName = data.selectedProfile.name;
-                    if (data.selectedProfile) {
-                        localStorage.profileName = data.selectedProfile.name;
-                        localStorage.uuid = data.selectedProfile.id;
-                    }
-                    // localStorage.username = username.value;
-                    // localStorage.password = password.value;
-                    setTimeout(function () {
-                        window.location = "user.html";
-                    }, 3000);
-                }
-            },
-            error: function (e) {
-                let response = JSON.parse(e.responseText);
-                snackbar.labelText = "登录失败: " + response.errorMessage;
-                snackbar.open();
-            }
-        });
-    }
-
-    e.preventDefault();
-});
-
-$(document).ready(function () {
-    if (!localStorage.accessToken && localStorage.loginTime !== undefined &&
-        (new Date().getTime() - localStorage.loginTime) < 30 * 86400 * 1000) {
-        window.location = "user.html";
-    }
-});
--- a/assets/user.html
+++ b/assets/user.html
@@ -1,154 +0,0 @@
-<!--
-  ~ Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
-  ~
-  ~ This program is free software: you can redistribute it and/or modify
-  ~ it under the terms of the GNU Affero General Public License as published by
-  ~ the Free Software Foundation, either version 3 of the License, or
-  ~ (at your option) any later version.
-  ~
-  ~ This program is distributed in the hope that it will be useful,
-  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
-  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  ~ GNU Affero General Public License for more details.
-  ~
-  ~ You should have received a copy of the GNU Affero General Public License
-  ~ along with this program.  If not, see <https://www.gnu.org/licenses/>.
-  -->
-
-<!doctype html>
-<html lang="en">
-<head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>角色信息</title>
-    <link rel="stylesheet" href="https://cdn.bootcss.com/normalize/8.0.0/normalize.min.css">
-    <link rel="stylesheet" href="https://fonts.googleapis.com/icon?family=Material+Icons">
-    <link href="https://cdn.bootcss.com/material-components-web/5.1.0/material-components-web.min.css" rel="stylesheet">
-    <script src="https://cdn.bootcss.com/material-components-web/5.1.0/material-components-web.min.js"></script>
-    <link rel="stylesheet" href="user.css">
-</head>
-<body>
-<noscript>You need to enable JavaScript to run this app.</noscript>
-<section class="header">
-    <h1>简陋信息页</h1>
-</section>
-
-<section class="header">
-    <h3>上传材质</h3>
-</section>
-
-<form id="upload-form" action="#" enctype="multipart/form-data">
-    <div class="mdc-form-field textureType">
-        <label>材质类别: </label>
-        <div id="radio-skin" class="mdc-radio">
-            <input class="mdc-radio__native-control" type="radio" id="radio-3" name="type" value="skin" checked>
-            <div class="mdc-radio__background">
-                <div class="mdc-radio__outer-circle"></div>
-                <div class="mdc-radio__inner-circle"></div>
-            </div>
-            <div class="mdc-radio__ripple"></div>
-        </div>
-        <label for="radio-3">皮肤</label>
-        <div id="radio-cape" class="mdc-radio">
-            <input class="mdc-radio__native-control" type="radio" id="radio-4" name="type" value="cape">
-            <div class="mdc-radio__background">
-                <div class="mdc-radio__outer-circle"></div>
-                <div class="mdc-radio__inner-circle"></div>
-            </div>
-            <div class="mdc-radio__ripple"></div>
-        </div>
-        <label for="radio-3">披风</label>
-    </div>
-    <div class="mdc-form-field model">
-        <label>材质模型: </label>
-        <div id="radio-steve" class="mdc-radio">
-            <input class="mdc-radio__native-control" type="radio" id="radio-1" name="model" value="default" checked>
-            <div class="mdc-radio__background">
-                <div class="mdc-radio__outer-circle"></div>
-                <div class="mdc-radio__inner-circle"></div>
-            </div>
-            <div class="mdc-radio__ripple"></div>
-        </div>
-        <label for="radio-1">Steve</label>
-        <div id="radio-alex" class="mdc-radio">
-            <input class="mdc-radio__native-control" type="radio" id="radio-2" name="model" value="slim">
-            <div class="mdc-radio__background">
-                <div class="mdc-radio__outer-circle"></div>
-                <div class="mdc-radio__inner-circle"></div>
-            </div>
-            <div class="mdc-radio__ripple"></div>
-        </div>
-        <label for="radio-2">Alex</label>
-    </div>
-    <div class="mdc-text-field url">
-        <input type="url" class="mdc-text-field__input" id="url-input" name="url">
-        <label class="mdc-floating-label" for="url-input">材质url</label>
-        <div class="mdc-line-ripple"></div>
-    </div>
-    <label class="mdc-text-field mdc-text-field--outlined mdc-text-field--with-trailing-icon file">
-        <input type="file" style="display: none;" accept="image/*" class="mdc-text-field__input" id="file-input"
-               name="file" aria-label="Label">
-
-        <i class="material-icons mdc-text-field__icon mdc-text-field__icon--trailing" tabindex="0" role="button"
-           onclick="$('#file-input').val('').change();">delete</i>
-        <div class="mdc-notched-outline">
-            <div class="mdc-notched-outline__leading"></div>
-            <div class="mdc-notched-outline__notch">
-                <label id="file-path" for="file-input" class="mdc-floating-label">或者选择一个图片</label>
-            </div>
-            <div class="mdc-notched-outline__trailing"></div>
-        </div>
-    </label>
-    <div class="button-container">
-        <button type="submit" class="mdc-button mdc-button--raised upload">
-            <div class="mdc-button__ripple"></div>
-            <span class="mdc-button__label">
-          上传
-        </span>
-        </button>
-        <button type="button" id="delete-btn" class="mdc-button mdc-button--raised upload">
-            <div class="mdc-button__ripple"></div>
-            <span class="mdc-button__label">
-          重置为默认
-        </span>
-        </button>
-    </div>
-</form>
-
-<section class="header">
-    <h3>更改游戏标签</h3>
-</section>
-
-<form id="change-form" action="#">
-    <div class="mdc-text-field changeTo">
-        <input type="text" class="mdc-text-field__input" id="changeTo-input" name="changeTo" required minlength="2"
-               maxlength="16">
-        <script>
-            if (localStorage.profileName) document.getElementById("changeTo-input").value = localStorage.profileName;
-        </script>
-        <label class="mdc-floating-label" for="changeTo-input">游戏标签</label>
-        <div class="mdc-line-ripple"></div>
-    </div>
-    <div class="button-container">
-        <button type="submit" class="mdc-button mdc-button--raised submit">
-            <div class="mdc-button__ripple"></div>
-            <span class="mdc-button__label">
-            更改
-          </span>
-        </button>
-    </div>
-</form>
-<div class="mdc-snackbar">
-    <div class="mdc-snackbar__surface">
-        <div class="mdc-snackbar__label"
-             role="status"
-             aria-live="polite">
-            上传失败
-        </div>
-    </div>
-</div>
-
-<script src="https://cdn.bootcss.com/jquery/3.5.0/jquery.min.js"></script>
-<script src="user.js" async></script>
-</body>
-</html>
--- a/assets/user.js
+++ b/assets/user.js
@@ -1,242 +0,0 @@
-/*
- * Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-const MDCSnackbar = mdc.snackbar.MDCSnackbar;
-const MDCTextField = mdc.textField.MDCTextField;
-const MDCFormField = mdc.formField.MDCFormField;
-const MDCRadio = mdc.radio.MDCRadio;
-//const MDCRipple = mdc.ripple.MDCRipple;
-
-const snackbar = new MDCSnackbar(document.querySelector('.mdc-snackbar'));
-const modelField = new MDCFormField(document.querySelector('.model'));
-const radio1 = new MDCRadio(document.querySelector('#radio-steve'));
-const radio2 = new MDCRadio(document.querySelector('#radio-alex'));
-const radio3 = new MDCRadio(document.querySelector('#radio-skin'));
-const radio4 = new MDCRadio(document.querySelector('#radio-cape'));
-modelField.input = {radio1, radio2};
-const url = new MDCTextField(document.querySelector('.url'));
-const file = new MDCTextField(document.querySelector('.file'));
-const changeTo = new MDCTextField(document.querySelector('.changeTo'));
-
-const modelTypeForm = document.querySelector('.mdc-form-field.model');
-
-snackbar.close()
-
-$("#file-input").change(function() {
-    const path = this.value;
-    if (!path) {
-        $("#file-path").text("或选择一张图片");
-        $(".url").show();
-    } else {
-        $("#file-path").text(path);
-        url.value = '';
-        $(".url").hide();
-    }
-});
-
-const modelTypeChange = function () {
-    if (radio3.checked) {
-        $(modelTypeForm).show();
-    } else {
-        $(modelTypeForm).hide();
-    }
-}
-$("#radio-3").change(modelTypeChange)
-$("#radio-4").change(modelTypeChange)
-
-$("#url-input").on("input", function() {
-    const url = this.value;
-    if (!url) {
-        $(".file").show();
-    } else {
-        file.value = '';
-        $(".file").hide();
-    }
-});
-
-$(document).ready(function() {
-    if (!localStorage.accessToken) {
-        localStorage.loginTime = 1;
-        window.location = "index.html";
-    }
-    $.ajax({
-        url: '/authserver/validate',
-        type: 'POST',
-        dataType: "JSON",
-        contentType: "application/json",
-        data: JSON.stringify({
-            accessToken: localStorage.accessToken,
-        }),
-        success: function(data) {
-            //有效，啥也不整
-        },
-        error: function(e) {
-            if (e.status == 403) {
-                // 持续套娃
-                $.ajax({
-                    url: '/authserver/refresh',
-                    type: 'POST',
-                    dataType: "JSON",
-                    contentType: "application/json",
-                    data: JSON.stringify({
-                        accessToken: localStorage.accessToken,
-                    }),
-                    success: function(data) {
-                        if (!data.accessToken) {
-                            localStorage.loginTime = 1;
-                            window.location = "index.html";
-                        } else {
-                            snackbar.timeoutMs = 5000;
-                            snackbar.labelText = "刷新token成功，accessToken:" + data.accessToken;
-                            snackbar.open();
-                            localStorage.accessToken = data.accessToken;
-                            localStorage.loginTime = new Date().getTime();
-                            if(data.selectedProfile) {
-                                localStorage.profileName = data.selectedProfile.name;
-                                localStorage.uuid = data.selectedProfile.id;
-                            }
-                        }
-                    },
-                    error: function(e) {
-                        if (e.status == 403) {
-                            localStorage.loginTime = 1;
-                            window.location = "index.html";
-                        }
-                    }
-                });
-            }
-        }
-    });
-});
-
-$("#upload-form").submit(function(e) {
-    e.preventDefault();
-    if (!url.value && !$("#file-input").val()) {
-        snackbar.timeoutMs = 5000;
-        snackbar.labelText = "没填信息";
-        snackbar.open();
-        return;
-    }
-    let textureType = 'skin'
-    if (radio3.checked) {
-        textureType = 'skin'
-    } else if (radio4.checked) {
-        textureType = 'cape'
-    }
-    if (!url.value) {
-        const formData = new FormData();
-        formData.append("model", radio1.checked ? radio1.value : radio2.value);
-        formData.append("file", $("#file-input")[0].files[0]);
-        //formData.contentType = "multipart/form-data";
-        $.ajax({
-            url: `/api/user/profile/${localStorage.uuid}/${textureType}`,
-            type: 'PUT',
-            processData: false,
-            contentType: false,
-            headers: {'Authorization':'Bearer ' + localStorage.accessToken},
-            data: formData,
-            success: function(data) {
-                snackbar.timeoutMs = 5000;
-                snackbar.labelText = "材质上传成功";
-                snackbar.open();
-            },
-            error: function(e) {
-                snackbar.timeoutMs = 5000;
-                snackbar.labelText = "材质上传失败";
-                snackbar.open();
-            }
-        });
-    } else if (url.value) {
-        $.ajax({
-            url: `/api/user/profile/${localStorage.uuid}/${textureType}`,
-            type: 'POST',
-            dataType: "JSON",
-            contentType: "application/json",
-            headers: {'Authorization':'Bearer ' + localStorage.accessToken},
-            data: JSON.stringify({
-                model: radio1.checked ? radio1.value : radio2.value,
-                url: url.value
-            }),
-            success: function(data) {
-                snackbar.timeoutMs = 5000;
-                snackbar.labelText = "材质上传成功";
-                snackbar.open();
-            },
-            error: function(e) {
-                snackbar.timeoutMs = 5000;
-                snackbar.labelText = "材质上传失败";
-                snackbar.open();
-            }
-        });
-    }
-});
-
-$("#change-form").submit(function(e) {
-    e.preventDefault();
-    if (changeTo.value.length <= 1) {
-        snackbar.timeoutMs = 5000;
-        snackbar.labelText = "更改失败, 角色名格式不正确";
-        snackbar.open();
-        return;
-    }
-    $.ajax({
-        url: '/authserver/change',
-        type: 'POST',
-        dataType: "JSON",
-        contentType: "application/json",
-        data: JSON.stringify({
-            accessToken: localStorage.accessToken,
-            changeTo: changeTo.value
-        }),
-        success: function(data) {
-            snackbar.timeoutMs = 5000;
-            snackbar.labelText = "更改成功";
-            snackbar.open();
-            localStorage.profileName = changeTo.value;
-        },
-        error: function(e) {
-            snackbar.timeoutMs = 5000;
-            snackbar.labelText = "更改失败, 可能是角色名已存在";
-            snackbar.open();
-        }
-    });
-});
-
-$('#delete-btn').click(function () {
-    let textureType = 'skin'
-    if (radio3.checked) {
-        textureType = 'skin'
-    } else if (radio4.checked) {
-        textureType = 'cape'
-    }
-    $.ajax({
-        url: `/api/user/profile/${localStorage.uuid}/${textureType}`,
-        type: 'DELETE',
-        headers: {'Authorization':'Bearer ' + localStorage.accessToken},
-        success: function(data) {
-            snackbar.timeoutMs = 5000;
-            snackbar.labelText = "恢复成功";
-            snackbar.open();
-            localStorage.profileName = changeTo.value;
-        },
-        error: function(e) {
-            snackbar.timeoutMs = 5000;
-            snackbar.labelText = "重置失败";
-            snackbar.open();
-        }
-    });
-})
--- a/config_example.ini
+++ b/config_example.ini
@@ -6,7 +6,7 @@ server_name            = A Mojang Yggdrasil Server
 implementation_name    = go-yggdrasil-server

 ;版本
-implementation_version = v0.1
+implementation_version = v0.0.1

 ;皮肤、披风材质白名单
 skin_domains           = .example.com, localhost
@@ -18,6 +18,9 @@ skin_root_url          = http://localhost:8080
 ;服务监听地址
 server_address  = :8080

+;反向代理信任地址
+trusted_proxies = 127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12
+
 [database]
 ; Database driver type, mysql or sqlite
 database_driver = sqlite
@@ -34,3 +37,127 @@ private_key_file = private.pem

 ;公钥存储路径
 public_key_file  = public.pem
+
+[smtp]
+; 发件服务器地址
+smtp_server             = localhost
+
+; 发件服务器端口
+smtp_port               = 25
+
+; 服务器使用 SSL (StartTLS 填否)
+smtp_ssl                = false
+
+; 发件人
+email_from              = Go Yggdrasil Server <mc@example.com>
+
+; 服务器认证用户名
+smtp_user               = mc@example.com
+
+; 服务器认证密码
+smtp_password           = 123456
+
+; 邮件标题前缀
+title_prefix            = [A Mojang Yggdrasil Server]
+
+; 注册邮件模板
+register_template       = """<!DOCTYPE html>
+    <html>
+    <head>
+        <meta charset="UTF-8">
+        <style>
+            .email-container {
+                font-family: Arial, sans-serif;
+                padding: 10px;
+                border: 1px solid #ccc;
+                border-radius: 5px;
+            }
+            .email-header {
+                font-weight: bold;
+                color: #333;
+                margin-bottom: 10px;
+            }
+            .email-body {
+                margin-bottom: 20px;
+                color: #555;
+            }
+            .email-footer {
+                font-style: italic;
+                color: #777;
+            }
+            .reset-link {
+                background-color: #007bff;
+                color: white;
+                text-decoration: none;
+                padding: 10px 15px;
+                border-radius: 3px;
+            }
+        </style>
+    </head>
+    <body>
+    <div class="email-container">
+        <div class="email-header">验证邮箱地址</div>
+        <div class="email-body">
+            你好！你刚才在 A Mojang Yggdrasil Server 申请创建账户。如果你没有发起请求，请忽视此邮件。
+            <br><br>
+            若要继续，请点击下面的链接进行安全验证：
+            <br><br>
+            <a href="http://localhost:8080/profile/#emailVerifyToken={{.AccessToken}}" class="reset-link">安全验证</a>
+            <pre>http://localhost:8080/profile/#emailVerifyToken={{.AccessToken}}</pre>
+        </div>
+        <div class="email-footer">如果链接无法点击，请复制并粘贴到浏览器地址栏中访问。</div>
+    </div>
+    </body>
+    </html>
+    """
+
+; 重置密码邮件模板
+reset_password_template = """<!DOCTYPE html>
+    <html>
+    <head>
+        <meta charset="UTF-8">
+        <style>
+            .email-container {
+                font-family: Arial, sans-serif;
+                padding: 10px;
+                border: 1px solid #ccc;
+                border-radius: 5px;
+            }
+            .email-header {
+                font-weight: bold;
+                color: #333;
+                margin-bottom: 10px;
+            }
+            .email-body {
+                margin-bottom: 20px;
+                color: #555;
+            }
+            .email-footer {
+                font-style: italic;
+                color: #777;
+            }
+            .reset-link {
+                background-color: #007bff;
+                color: white;
+                text-decoration: none;
+                padding: 10px 15px;
+                border-radius: 3px;
+            }
+        </style>
+    </head>
+    <body>
+    <div class="email-container">
+        <div class="email-header">密码重置</div>
+        <div class="email-body">
+            你好！有人请求重置你的 A Mojang Yggdrasil Server 账户密码。如果你没有发起请求，请忽视此邮件。
+            <br><br>
+            若要继续，请点击下面的链接进行安全验证：
+            <br><br>
+            <a href="http://localhost:8080/profile/resetPassword#passwordResetToken={{.AccessToken}}" class="reset-link">重置密码</a>
+            <pre>http://localhost:8080/profile/resetPassword#passwordResetToken={{.AccessToken}}</pre>
+        </div>
+        <div class="email-footer">如果链接无法点击，请复制并粘贴到浏览器地址栏中访问。</div>
+    </div>
+    </body>
+    </html>
+    """
--- a/frontend/.gitignore
+++ b/frontend/.gitignore
@@ -0,0 +1,24 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -0,0 +1,31 @@
+<!--
+  ~ Copyright (C) 2023. Gardel <sunxinao@hotmail.com> and contributors
+  ~
+  ~ This program is free software: you can redistribute it and/or modify
+  ~ it under the terms of the GNU Affero General Public License as published by
+  ~ the Free Software Foundation, either version 3 of the License, or
+  ~ (at your option) any later version.
+  ~
+  ~ This program is distributed in the hope that it will be useful,
+  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
+  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  ~ GNU Affero General Public License for more details.
+  ~
+  ~ You should have received a copy of the GNU Affero General Public License
+  ~ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+  -->
+
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8"/>
+<!--    <link rel="icon" type="image/svg+xml" href="/vite.svg"/>-->
+    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
+    <title>Yggdrasil Go</title>
+</head>
+<body>
+<noscript>You need to enable JavaScript to run this app.</noscript>
+<div id="root"></div>
+<script type="module" src="src/main.tsx"></script>
+</body>
+</html>
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -0,0 +1,38 @@
+{
+  "name": "yggdrasil-go",
+  "private": true,
+  "version": "0.0.1",
+  "type": "module",
+  "scripts": {
+    "dev": "vite --host",
+    "build": "tsc && vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@emotion/react": "^11.14.0",
+    "@emotion/styled": "^11.14.0",
+    "@fontsource/roboto": "^5.2.5",
+    "@mui/icons-material": "^7.0.1",
+    "@mui/material": "^7.0.1",
+    "@react-three/drei": "^10.0.5",
+    "@react-three/fiber": "^9.1.0",
+    "@react-three/postprocessing": "^3.0.4",
+    "axios": "^1.8.4",
+    "notistack": "^3.0.2",
+    "postprocessing": "^6.37.2",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
+    "react-hook-form": "^7.55.0",
+    "three": "^0.175.0",
+    "three-stdlib": "^2.35.14"
+  },
+  "devDependencies": {
+    "@types/react": "^19.0.12",
+    "@types/react-dom": "^19.0.4",
+    "@types/three": "^0.175.0",
+    "@vitejs/plugin-react": "^4.3.4",
+    "typescript": "^5.8.2",
+    "vite": "^6.2.3",
+    "vite-plugin-mock-dev-server": "^1.8.4"
+  }
+}
--- a/frontend/public/player/slim/alex.png
+++ b/frontend/public/player/slim/alex.png
--- a/frontend/public/player/slim/ari.png
+++ b/frontend/public/player/slim/ari.png
--- a/frontend/public/player/slim/efe.png
+++ b/frontend/public/player/slim/efe.png
--- a/frontend/public/player/slim/kai.png
+++ b/frontend/public/player/slim/kai.png
--- a/frontend/public/player/slim/makena.png
+++ b/frontend/public/player/slim/makena.png
--- a/frontend/public/player/slim/noor.png
+++ b/frontend/public/player/slim/noor.png
--- a/frontend/public/player/slim/steve.png
+++ b/frontend/public/player/slim/steve.png
--- a/frontend/public/player/slim/sunny.png
+++ b/frontend/public/player/slim/sunny.png
--- a/frontend/public/player/slim/zuri.png
+++ b/frontend/public/player/slim/zuri.png
--- a/frontend/public/player/wide/alex.png
+++ b/frontend/public/player/wide/alex.png
--- a/frontend/public/player/wide/ari.png
+++ b/frontend/public/player/wide/ari.png
--- a/frontend/public/player/wide/efe.png
+++ b/frontend/public/player/wide/efe.png
--- a/frontend/public/player/wide/kai.png
+++ b/frontend/public/player/wide/kai.png
--- a/frontend/public/player/wide/makena.png
+++ b/frontend/public/player/wide/makena.png
--- a/frontend/public/player/wide/noor.png
+++ b/frontend/public/player/wide/noor.png
--- a/frontend/public/player/wide/steve.png
+++ b/frontend/public/player/wide/steve.png
--- a/frontend/public/player/wide/sunny.png
+++ b/frontend/public/player/wide/sunny.png
--- a/frontend/public/player/wide/zuri.png
+++ b/frontend/public/player/wide/zuri.png
--- a/frontend/src/app.css
+++ b/frontend/src/app.css
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2023. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#root {
+  width: 100%;
+  margin: 0 auto;
+  padding: 2rem;
+  text-align: center;
+}
--- a/frontend/src/app.tsx
+++ b/frontend/src/app.tsx
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2023-2025. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import React from 'react';
+import './app.css';
+import Login from './login';
+import PasswordReset from './reset';
+import {Container} from '@mui/material';
+import {AppState} from './types';
+import User from './user';
+import axios from 'axios';
+import {useSnackbar} from 'notistack';
+
+function App() {
+    const {enqueueSnackbar} = useSnackbar();
+    const [appData, setAppData] = React.useState(() => {
+        const saved = localStorage.getItem('appData');
+        return (saved ? JSON.parse(saved) : {
+            login: 'register',
+            accessToken: '',
+            tokenValid: false,
+            loginTime: 0,
+            profileName: '',
+            uuid: '',
+            passwordReset: false
+        }) as AppState;
+    });
+
+    React.useEffect(() => {
+        localStorage.setItem('appData', JSON.stringify(appData));
+    }, [appData]);
+
+    const setTokenValid = (tokenValid: boolean) => appData.tokenValid != tokenValid && setAppData((oldData: AppState) => {
+        return tokenValid ? {
+            ...oldData,
+            tokenValid: true
+        } : {
+            ...oldData,
+            tokenValid: false,
+            accessToken: '',
+            loginTime: 0
+        };
+    });
+
+    setTokenValid((appData.accessToken && Date.now() - appData.loginTime < 30 * 86400 * 1000) as boolean)
+
+    if (appData.tokenValid) {
+        let postData = {
+            accessToken: appData.accessToken,
+        };
+        axios.post('/authserver/validate', postData)
+            .catch(e => {
+            const response = e.response;
+            if (response && response.status == 403) {
+                axios.post('/authserver/refresh', postData)
+                    .then(response => {
+                        const data = response.data;
+                        if (data && data.accessToken) {
+                            setAppData({
+                                ...appData,
+                                accessToken: data.accessToken,
+                                loginTime: Date.now(),
+                                profileName: data.selectedProfile?.name,
+                                uuid: data.selectedProfile?.id
+                            });
+                            enqueueSnackbar('刷新token成功，accessToken:' + data.accessToken, {variant: 'success'});
+                        } else {
+                            setTokenValid(false);
+                        }
+                    })
+                    .catch(e => {
+                        const response = e.response;
+                        if (response && response.status == 403) {
+                            enqueueSnackbar('登录已过期', {variant: 'warning'});
+                            setTokenValid(false);
+                        } else {
+                            enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+                        }
+                    });
+            } else {
+                enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+            }
+        });
+    }
+
+    const path = window.location.pathname;
+    const hash = window.location.hash;
+    if (hash && hash.length > 1) {
+        const params = new URLSearchParams(hash.substring(1));
+        if (params.has('emailVerifyToken')) {
+            const token = params.get('emailVerifyToken');
+            axios.get('/authserver/verifyEmail?access_token=' + token)
+                .then(() => {
+                    window.location.replace('/profile/')
+                    enqueueSnackbar('邮箱验证通过', {variant: 'success'});
+                })
+                .catch(e => {
+                    const response = e.response;
+                    if (response && response.status >= 400 && response.status < 500) {
+                        let errorMessage = response.data.errorMessage ?? response.data;
+                        enqueueSnackbar('邮箱验证失败: ' + errorMessage, {variant: 'error'});
+                    } else {
+                        enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+                    }
+                });
+        }
+    }
+    if (path === '/profile/resetPassword' || path === '/resetPassword') {
+        appData.passwordReset = true;
+        // setAppData(appData);
+    }
+
+    if (appData.tokenValid) {
+        return (
+            <Container maxWidth={'lg'}>
+                <User appData={appData} setAppData={setAppData}/>
+            </Container>
+        );
+    } else if (appData.passwordReset) {
+        return (
+            <Container maxWidth={'lg'}>
+                <PasswordReset appData={appData} setAppData={setAppData}/>
+            </Container>
+        )
+    } else {
+        return (
+            <Container maxWidth={'lg'}>
+                <Login appData={appData} setAppData={setAppData}/>
+            </Container>
+        );
+    }
+}
+
+export default App;
--- a/frontend/src/components.tsx
+++ b/frontend/src/components.tsx
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2023. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {Collapse, FormHelperText, FormHelperTextProps, useFormControl} from '@mui/material';
+
+export function FocusedShowHelperText(props: FormHelperTextProps) {
+    const {focused} = useFormControl() || {};
+
+    return <Collapse in={focused}><FormHelperText id={props.id}>{props.children}</FormHelperText></Collapse>;
+}
--- a/frontend/src/index.css
+++ b/frontend/src/index.css
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2023. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+body {
+  margin: 0;
+  display: flex;
+  place-items: center;
+  min-width: 320px;
+  min-height: 100vh;
+}
--- a/frontend/src/login.css
+++ b/frontend/src/login.css
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
+ * Copyright (C) 2023. Gardel <sunxinao@hotmail.com> and contributors
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
@@ -15,34 +15,30 @@
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

-
 .header {
    text-align: center;
 }

-.model,
-.textureType,
-.url,
-.changeTo {
-  display: block;
-  width: 300px;
-  margin: 20px auto;
+.login-card {
+    padding: 14px 24px;
+    margin: auto;
 }

-.file {
-    display: flex;
-    width: 300px;
+.username,
+.profileName,
+.password {
+    display: block;
+    width: 87%;
    margin: 20px auto;
 }

 .button-container {
    display: flex;
    justify-content: flex-end;
-  width: 300px;
+    width: 87%;
    margin: auto;
 }

 .button-container button {
    margin: 3px;
 }
-
--- a/frontend/src/login.tsx
+++ b/frontend/src/login.tsx
@@ -0,0 +1,262 @@
+/*
+ * Copyright (C) 2023-2025. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import React from 'react';
+import Button from '@mui/material/Button';
+import {
+    Box,
+    Collapse,
+    Container,
+    FilledInput,
+    FormControl,
+    IconButton,
+    InputAdornment,
+    InputLabel,
+    Paper,
+    TextField
+} from '@mui/material';
+import {Visibility, VisibilityOff} from '@mui/icons-material';
+import {AppState} from './types';
+import './login.css';
+import {SubmitHandler, useForm} from 'react-hook-form';
+import axios from 'axios';
+import {useSnackbar} from 'notistack';
+import {FocusedShowHelperText} from './components';
+
+type Inputs = {
+    username: string,
+    profileName: string,
+    password: string
+};
+
+function Login(props: { appData: AppState, setAppData: React.Dispatch<React.SetStateAction<AppState>> }) {
+    const {appData, setAppData} = props;
+    const {enqueueSnackbar} = useSnackbar();
+    const {register, handleSubmit, formState: {errors}} = useForm<Inputs>();
+    const [submitting, setSubmitting] = React.useState(false);
+    const [submitText, setSubmitText] = React.useState('提交');
+    React.useEffect(() => {
+        if (submitting) {
+            return
+        }
+        switch (appData.login) {
+            case 'login':
+                setSubmitText('登录');
+                break;
+            case 'register':
+                setSubmitText('注册');
+                break;
+            case 'reset':
+                setSubmitText('重置');
+                break;
+            default:
+                setSubmitText('提交');
+                break;
+        }
+    }, [appData, submitting])
+    const onSubmit: SubmitHandler<Inputs> = data => {
+        setSubmitting(true);
+        if (appData.login === 'login') {
+            axios.post('/authserver/authenticate', {
+                username: data.username,
+                password: data.password
+            })
+                .then(response => {
+                    let data = response.data
+                    if (data && data.accessToken) {
+                        enqueueSnackbar("登录成功，accessToken:" + data.accessToken, {variant: 'success'});
+                        setAppData({
+                            ...appData,
+                            accessToken: data.accessToken,
+                            tokenValid: true,
+                            loginTime: Date.now(),
+                            profileName: data.selectedProfile?.name,
+                            uuid: data.selectedProfile?.id
+                        });
+                    } else {
+                        enqueueSnackbar(data && data.errorMessage ? "登录失败: " + data.errorMessage: "登陆失败", {variant: 'error'});
+                    }
+                })
+                .catch(e => {
+                    const response = e.response;
+                    if (response && response.status == 403) {
+                        enqueueSnackbar('登录失败: ' + response.data.errorMessage, {variant: 'error'});
+                    } else {
+                        enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+                    }
+                })
+                .finally(() => setSubmitting(false))
+        } else if (appData.login === 'register') {
+            axios.post('/authserver/register', {
+                username: data.username,
+                password: data.password,
+                profileName: data.profileName
+            })
+                .then(response => {
+                    let data = response.data
+                    if (data && data.id) {
+                        enqueueSnackbar("注册成功，uuid:" + data.id, {variant: 'success'});
+                        setLogin('login')
+                    } else {
+                        enqueueSnackbar(data && data.errorMessage ? "注册失败: " + data.errorMessage: "注册失败", {variant: 'error'});
+                    }
+                })
+                .catch(e => {
+                    const response = e.response;
+                    if (response && response.data) {
+                        let errorMessage = response.data.errorMessage ?? response.data;
+                        let message =  "注册失败: " + errorMessage;
+                        if (errorMessage === "profileName exist") {
+                            message = "注册失败: 角色名已存在";
+                        } else if (errorMessage === "profileName duplicate") {
+                            message = "注册失败: 角色名与正版用户冲突";
+                        }
+                        enqueueSnackbar(message, {variant: 'error'});
+                    } else {
+                        enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+                    }
+                })
+                .finally(() => setSubmitting(false))
+        } else if (appData.login === 'reset') {
+            const countdown = {
+                timeout: 60,
+            }
+            setSubmitText(`${countdown.timeout}`);
+            const timer = setInterval(() => {
+                countdown.timeout = countdown.timeout - 1;
+                if (countdown.timeout <= 0) {
+                    clearInterval(timer);
+                    setSubmitting(false);
+                    return
+                }
+                setSubmitting(true);
+                setSubmitText(`${countdown.timeout}`);
+            }, 1000);
+            axios.post('/authserver/sendEmail', {
+                email: data.username,
+                emailType: "resetPassword"
+            })
+                .then(() => {
+                    enqueueSnackbar("重置链接发送成功，请检查垃圾邮箱", {variant: 'success'});
+                })
+                .catch(e => {
+                    const response = e.response;
+                    if (response && response.data) {
+                        let errorMessage = response.data.errorMessage ?? response.data;
+                        enqueueSnackbar("发送失败: " + errorMessage, {variant: 'error'});
+                    } else {
+                        enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+                    }
+                    countdown.timeout = 0;
+                });
+        }
+    };
+
+    const [showPassword, setShowPassword] = React.useState(false);
+
+    const handleClickShowPassword = () => setShowPassword((show) => !show);
+
+    const handleMouseDownPassword = (event: React.MouseEvent<HTMLButtonElement>) => {
+        event.preventDefault();
+    };
+
+    const setLogin = (login: string) => setAppData((oldData: AppState) => {
+        return {
+            ...oldData,
+            login
+        };
+    });
+
+    return (
+        <Container maxWidth={'sm'}>
+            <Paper className={'login-card'}>
+                <section className="header">
+                    <h1>简陋注册页</h1>
+                </section>
+                <Box component="form" autoComplete="off" onSubmit={handleSubmit(onSubmit)}>
+                    <div className='username'>
+                        <TextField
+                            id="username-input"
+                            name='username'
+                            fullWidth
+                            label="邮箱"
+                            variant="filled"
+                            required
+                            error={errors.username && true}
+                            type='email'
+                            slotProps={{
+                                htmlInput: {
+                                    ...register('username', {required: true})
+                                }
+                            }}
+                        />
+                    </div>
+                    <Collapse in={appData.login === 'register'} className='profileName'>
+                        <FormControl fullWidth variant="filled" required={appData.login === 'register'} error={errors.profileName && true}>
+                            <InputLabel htmlFor="profileName-input">角色名</InputLabel>
+                            <FilledInput
+                                id="profileName-input"
+                                name="profileName"
+                                required={appData.login === 'register'}
+                                inputProps={appData.login !== 'register' ? {} : {
+                                    minLength: '2', maxLength: 16,
+                                    ...register('profileName', {required: true, minLength: 2, pattern: /^[a-zA-Z0-9_]{1,16}$/, maxLength: 16})
+                                }}
+                            />
+                            <FocusedShowHelperText id="profileName-input-helper-text">字母，数字或下划线</FocusedShowHelperText>
+                        </FormControl>
+                    </Collapse>
+                    <Collapse in={appData.login !== 'reset'} className='password'>
+                        <FormControl fullWidth variant="filled" required={appData.login !== 'reset'} error={errors.password && true}>
+                            <InputLabel htmlFor="password-input">密码</InputLabel>
+                            <FilledInput
+                                id="password-input"
+                                name="password"
+                                required={appData.login !== 'reset'}
+                                type={showPassword ? 'text' : 'password'}
+                                endAdornment={
+                                    <InputAdornment position="end">
+                                        <IconButton
+                                            aria-label="显示密码"
+                                            onClick={handleClickShowPassword}
+                                            onMouseDown={handleMouseDownPassword}
+                                            edge="end">
+                                            {showPassword ? <VisibilityOff/> : <Visibility/>}
+                                        </IconButton>
+                                    </InputAdornment>
+                                }
+                                inputProps={appData.login === 'reset' ? {} : {
+                                    minLength: '6',
+                                    ...register('password', {required: true, minLength: 6})
+                                }}
+                            />
+                            <FocusedShowHelperText id="password-input-helper-text">请妥善保管密码</FocusedShowHelperText>
+                        </FormControl>
+                    </Collapse>
+                    <div className='button-container'>
+                        {appData.login !== 'reset' && <Button variant='contained' onClick={() => setLogin('reset')}>忘记密码</Button>}
+                        {appData.login !== 'login' && <Button variant='contained' onClick={() => setLogin('login')}>已有账号登录</Button>}
+                        {appData.login !== 'register' && <Button variant='contained' onClick={() => setLogin('register')}>注册</Button>}
+                        <Button variant='contained' type='submit' disabled={submitting}>{submitText}</Button>
+                    </div>
+                </Box>
+            </Paper>
+        </Container>
+    );
+}
+
+export default Login;
--- a/frontend/src/main.tsx
+++ b/frontend/src/main.tsx
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2023. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import React from 'react';
+import ReactDOM from 'react-dom/client';
+import './index.css';
+import '@fontsource/roboto/300.css';
+import '@fontsource/roboto/400.css';
+import '@fontsource/roboto/500.css';
+import '@fontsource/roboto/700.css';
+import { SnackbarProvider } from 'notistack';
+import {CssBaseline} from '@mui/material';
+import App from './app';
+
+ReactDOM.createRoot(document.getElementById('root') as HTMLElement).render(
+    <React.StrictMode>
+        <CssBaseline/>
+        <SnackbarProvider maxSnack={3} anchorOrigin={{ horizontal: 'right', vertical: 'bottom' }}>
+            <App/>
+        </SnackbarProvider>
+    </React.StrictMode>,
+);
--- a/frontend/src/reset.css
+++ b/frontend/src/reset.css
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
+ * Copyright (C) 2023-2025. Gardel <sunxinao@hotmail.com> and contributors
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
@@ -15,34 +15,26 @@
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

-html, body {
-  height: 100%;
-}
-
-body {
-  font-family: 'Roboto';
-  margin: 0;
-  padding-top: 0.1px;
-}
-
 .header {
    text-align: center;
 }

+.reset-card {
+    padding: 14px 24px;
+    margin: auto;
+}
+
 .username,
-.profileName,
-.password,
-.profileName-helper,
-.password-helper {
+.password {
    display: block;
-  width: 300px;
+    width: 87%;
    margin: 20px auto;
 }

 .button-container {
    display: flex;
    justify-content: flex-end;
-  width: 300px;
+    width: 87%;
    margin: auto;
 }

--- a/frontend/src/reset.tsx
+++ b/frontend/src/reset.tsx
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2023-2025. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import React from 'react';
+import Button from '@mui/material/Button';
+import {
+    Box,
+    Container,
+    FilledInput,
+    FormControl,
+    IconButton,
+    InputAdornment,
+    InputLabel,
+    Paper,
+    TextField
+} from '@mui/material';
+import {Visibility, VisibilityOff} from '@mui/icons-material';
+import {AppState} from './types';
+import './reset.css';
+import {SubmitHandler, useForm} from 'react-hook-form';
+import axios from 'axios';
+import {useSnackbar} from 'notistack';
+
+type Inputs = {
+    username: string,
+    profileName: string,
+    password: string
+};
+
+function PasswordReset(props: { appData: AppState, setAppData: React.Dispatch<React.SetStateAction<AppState>> }) {
+    const {appData, setAppData} = props;
+    const {enqueueSnackbar} = useSnackbar();
+    const {register, handleSubmit, formState: {errors}} = useForm<Inputs>();
+    const [submitting, setSubmitting] = React.useState(false);
+    const onSubmit: SubmitHandler<Inputs> = data => {
+        setSubmitting(true);
+        const hash = window.location.hash;
+        if (!hash) {
+            setSubmitting(false);
+            enqueueSnackbar('链接失效，请重新打开', {variant: 'error'});
+            return;
+        }
+        const params = new URLSearchParams(hash.substring(1));
+        axios.post('/authserver/resetPassword', {
+            email: data.username,
+            password: data.password,
+            accessToken: params.get('passwordResetToken'),
+        })
+            .then(() => {
+                toLogin();
+                window.location.replace('/profile/')
+                enqueueSnackbar("重置成功", {variant: 'success'});
+            })
+            .catch(e => {
+                const response = e.response;
+                if (response && response.status >= 400 && response.status < 500) {
+                    let errorMessage = response.data.errorMessage ?? response.data;
+                    enqueueSnackbar('重置失败: ' + errorMessage, {variant: 'error'});
+                } else {
+                    enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+                }
+            })
+            .finally(() => setSubmitting(false))
+    };
+
+    const [showPassword, setShowPassword] = React.useState(false);
+
+    const handleClickShowPassword = () => setShowPassword((show) => !show);
+
+    const handleMouseDownPassword = (event: React.MouseEvent<HTMLButtonElement>) => {
+        event.preventDefault();
+    };
+
+    const toLogin = () => {
+        setAppData({
+            ...appData,
+            passwordReset: false
+        });
+    }
+
+    return (
+        <Container maxWidth={'sm'}>
+            <Paper className={'reset-card'}>
+                <section className="header">
+                    <h1>简陋重置密码页</h1>
+                </section>
+                <Box component="form" autoComplete="off" onSubmit={handleSubmit(onSubmit)}>
+                    <div className='username'>
+                        <TextField
+                            id="username-input"
+                            name='username'
+                            fullWidth
+                            label="邮箱"
+                            variant="filled"
+                            required
+                            error={errors.username && true}
+                            type='email'
+                            slotProps={{
+                                htmlInput: {
+                                    ...register('username', {required: true})
+                                }
+                            }}
+                        />
+                    </div>
+                    <div className='password'>
+                        <FormControl fullWidth variant="filled" required error={errors.password && true}>
+                            <InputLabel htmlFor="password-input">新密码</InputLabel>
+                            <FilledInput
+                                id="password-input"
+                                name="password"
+                                required
+                                type={showPassword ? 'text' : 'password'}
+                                endAdornment={
+                                    <InputAdornment position="end">
+                                        <IconButton
+                                            aria-label="显示密码"
+                                            onClick={handleClickShowPassword}
+                                            onMouseDown={handleMouseDownPassword}
+                                            edge="end">
+                                            {showPassword ? <VisibilityOff/> : <Visibility/>}
+                                        </IconButton>
+                                    </InputAdornment>
+                                }
+                                inputProps={{
+                                    minLength: '6',
+                                    ...register('password', {required: true, minLength: 6})
+                                }}
+                            />
+                        </FormControl>
+                    </div>
+                    <div className='button-container'>
+                        <Button variant='contained' onClick={toLogin}>登录</Button>
+                        <Button variant='contained' type='submit' disabled={submitting}>重置</Button>
+                    </div>
+                </Box>
+            </Paper>
+        </Container>
+    );
+}
+
+export default PasswordReset;
--- a/frontend/src/skinrender/skin-render.tsx
+++ b/frontend/src/skinrender/skin-render.tsx
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2023-2025. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {Box} from '@mui/material';
+import * as THREE from 'three';
+import {Canvas, RootState, useFrame, useLoader} from '@react-three/fiber';
+import React from 'react';
+import createPlayerModel from './utils';
+import {OrbitControls} from '@react-three/drei';
+import {EffectComposer, SSAO} from '@react-three/postprocessing';
+import {BlendFunction} from 'postprocessing';
+
+function PlayerModel(props: { skinUrl: string, capeUrl?: string, slim?: boolean }) {
+    const {skinUrl, capeUrl, slim} = props;
+    console.log(props);
+    const skinTexture: THREE.Texture = useLoader(THREE.TextureLoader, skinUrl);
+    skinTexture.magFilter = THREE.NearestFilter;
+    skinTexture.minFilter = THREE.NearestFilter;
+    skinTexture.anisotropy = 0;
+    skinTexture.needsUpdate = true;
+    let version = 0;
+    if (skinTexture.image.height > 32) {
+        version = 1;
+    }
+    let capeTexture: THREE.Texture | undefined = undefined;
+    if (capeUrl) {
+        capeTexture = useLoader(THREE.TextureLoader, capeUrl);
+        if (capeTexture) {
+            capeTexture.magFilter = THREE.NearestFilter;
+            capeTexture.minFilter = THREE.NearestFilter;
+            capeTexture.anisotropy = 0;
+            capeTexture.needsUpdate = true;
+        }
+    }
+    let playerModel = createPlayerModel(skinTexture, capeTexture, version, slim);
+    useFrame((state, delta) => {
+        playerModel.rotation.y += delta * 0.7;
+    });
+    return (
+        <primitive object={playerModel} position={[0, -10, 0]}/>
+    );
+}
+
+function SkinRender(props: { skinUrl: string, capeUrl?: string, slim?: boolean }) {
+    const onCanvasCreate = (state: RootState) => {
+        state.gl.shadowMap.enabled = true;
+        state.gl.shadowMap.type = THREE.PCFSoftShadowMap;
+    };
+    return (
+        <Box component="div" height="600px">
+            <section className="header">
+                <h3>预览</h3>
+            </section>
+
+            <Canvas
+                camera={{position: [0, 15, 35], near: 5}}
+                gl={{antialias: true, alpha: true, preserveDrawingBuffer: true}}
+                onCreated={onCanvasCreate}>
+                <ambientLight color={0xa0a0a0}/>
+                <PlayerModel {...props}/>
+                <OrbitControls makeDefault/>
+                <EffectComposer>
+                    <SSAO
+                        blendFunction={BlendFunction.OVERLAY}
+                        samples={30}
+                        rings={4}
+                        distanceThreshold={1.0}
+                        distanceFalloff={0.0}
+                        rangeThreshold={0.5}
+                        rangeFalloff={0.1}
+                        luminanceInfluence={0.9}
+                        radius={20}
+                        resolutionScale={0.5}
+                        bias={0.5}
+                    />
+                </EffectComposer>
+            </Canvas>
+        </Box>
+    );
+}
+
+export default SkinRender;
--- a/frontend/src/skinrender/texture-positions.ts
+++ b/frontend/src/skinrender/texture-positions.ts
--- a/frontend/src/skinrender/utils.ts
+++ b/frontend/src/skinrender/utils.ts
@@ -0,0 +1,314 @@
+/*
+ * Copyright (C) 2023-2025. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import * as THREE from 'three';
+import {texturePositions} from './texture-positions';
+import {BufferAttribute} from 'three';
+
+function createCube(texture: THREE.Texture, width: number, height: number, depth: number, textures: any, slim: boolean, name: string, transparent: boolean = false) {
+    let textureWidth: number = texture.image.width;
+    let textureHeight: number = texture.image.height;
+
+    let geometry = new THREE.BoxGeometry(width, height, depth);
+    let material = new THREE.MeshStandardMaterial({
+        /*color: 0x00ff00,*/
+        map: texture,
+        transparent: transparent || false,
+        alphaTest: 0.1,
+        side: transparent ? THREE.DoubleSide : THREE.FrontSide
+    });
+
+    geometry.computeBoundingBox();
+
+    const uvAttribute = geometry.getAttribute('uv') as BufferAttribute;
+
+    let faceNames = ['right', 'left', 'top', 'bottom', 'front', 'back'];
+    let faceUvs = [];
+    for (let i = 0; i < faceNames.length; i++) {
+        let face = textures[faceNames[i]];
+        // if (faceNames[i] === 'back') {
+            //     console.log(face)
+            // console.log("X: " + (slim && face.sx ? face.sx : face.x))
+            // console.log("W: " + (slim && face.sw ? face.sw : face.w))
+        // }
+        let w = textureWidth;
+        let h = textureHeight;
+        let tx1 = ((slim && face.sx ? face.sx : face.x) / w);
+        let ty1 = (face.y / h);
+        let tx2 = (((slim && face.sx ? face.sx : face.x) + (slim && face.sw ? face.sw : face.w)) / w);
+        let ty2 = ((face.y + face.h) / h);
+
+        faceUvs[i] = [
+            new THREE.Vector2(tx1, ty2),
+            new THREE.Vector2(tx1, ty1),
+            new THREE.Vector2(tx2, ty1),
+            new THREE.Vector2(tx2, ty2)
+        ];
+        // console.log(faceUvs[i])
+
+        let flipX = face.flipX;
+        let flipY = face.flipY;
+
+        let temp;
+        if (flipY) {
+            temp = faceUvs[i].slice(0);
+            faceUvs[i][0] = temp[2];
+            faceUvs[i][1] = temp[3];
+            faceUvs[i][2] = temp[0];
+            faceUvs[i][3] = temp[1];
+        }
+        if (flipX) {//flip x
+            temp = faceUvs[i].slice(0);
+            faceUvs[i][0] = temp[3];
+            faceUvs[i][1] = temp[2];
+            faceUvs[i][2] = temp[1];
+            faceUvs[i][3] = temp[0];
+        }
+    }
+
+    let j = 0;
+    for (let i = 0; i < faceUvs.length; i++) {
+        uvAttribute.setXY(j++, faceUvs[i][0].x, faceUvs[i][0].y);
+        uvAttribute.setXY(j++, faceUvs[i][3].x, faceUvs[i][3].y);
+        uvAttribute.setXY(j++, faceUvs[i][1].x, faceUvs[i][1].y);
+        uvAttribute.setXY(j++, faceUvs[i][2].x, faceUvs[i][2].y);
+    }
+    uvAttribute.needsUpdate = true;
+
+    let cube = new THREE.Mesh(geometry, material);
+    cube.name = name;
+    // cube.position.set(x, y, z);
+    cube.castShadow = true;
+    cube.receiveShadow = false;
+
+    return cube;
+}
+
+
+export default function createPlayerModel(skinTexture: THREE.Texture, capeTexture: THREE.Texture | null | undefined, v: number, slim: boolean = false, capeType?: string): THREE.Object3D<THREE.Object3DEventMap> {
+    let headGroup = new THREE.Object3D();
+    headGroup.name = 'headGroup';
+    headGroup.position.x = 0;
+    headGroup.position.y = 28;
+    headGroup.position.z = 0;
+    headGroup.translateOnAxis(new THREE.Vector3(0, 1, 0), -4);
+    let head = createCube(skinTexture,
+        8, 8, 8,
+        texturePositions.head[v],
+        slim,
+        'head'
+    );
+    head.translateOnAxis(new THREE.Vector3(0, 1, 0), 4);
+    headGroup.add(head);
+    let hat = createCube(skinTexture,
+        8.667, 8.667, 8.667,
+        texturePositions.hat[v],
+        slim,
+        'hat',
+        true
+    );
+    hat.translateOnAxis(new THREE.Vector3(0, 1, 0), 4);
+    headGroup.add(hat);
+
+    let bodyGroup = new THREE.Object3D();
+    bodyGroup.name = 'bodyGroup';
+    bodyGroup.position.x = 0;
+    bodyGroup.position.y = 18;
+    bodyGroup.position.z = 0;
+    let body = createCube(skinTexture,
+        8, 12, 4,
+        texturePositions.body[v],
+        slim,
+        'body'
+    );
+    bodyGroup.add(body);
+    if (v >= 1) {
+        let jacket = createCube(skinTexture,
+            8.667, 12.667, 4.667,
+            texturePositions.jacket,
+            slim,
+            'jacket',
+            true
+        );
+        bodyGroup.add(jacket);
+    }
+
+    let leftArmGroup = new THREE.Object3D();
+    leftArmGroup.name = 'leftArmGroup';
+    leftArmGroup.position.x = slim ? -5.5 : -6;
+    leftArmGroup.position.y = 18;
+    leftArmGroup.position.z = 0;
+    leftArmGroup.translateOnAxis(new THREE.Vector3(0, 1, 0), 4);
+    let leftArm = createCube(skinTexture,
+        slim ? 3 : 4, 12, 4,
+        texturePositions.leftArm[v],
+        slim,
+        'leftArm'
+    );
+    leftArm.translateOnAxis(new THREE.Vector3(0, 1, 0), -4);
+    leftArmGroup.add(leftArm);
+    if (v >= 1) {
+        let leftSleeve = createCube(skinTexture,
+            slim ? 3.667 : 4.667, 12.667, 4.667,
+            texturePositions.leftSleeve,
+            slim,
+            'leftSleeve',
+            true
+        );
+        leftSleeve.translateOnAxis(new THREE.Vector3(0, 1, 0), -4);
+        leftArmGroup.add(leftSleeve);
+    }
+
+    let rightArmGroup = new THREE.Object3D();
+    rightArmGroup.name = 'rightArmGroup';
+    rightArmGroup.position.x = slim ? 5.5 : 6;
+    rightArmGroup.position.y = 18;
+    rightArmGroup.position.z = 0;
+    rightArmGroup.translateOnAxis(new THREE.Vector3(0, 1, 0), 4);
+    let rightArm = createCube(skinTexture,
+        slim ? 3 : 4, 12, 4,
+        texturePositions.rightArm[v],
+        slim,
+        'rightArm'
+    );
+    rightArm.translateOnAxis(new THREE.Vector3(0, 1, 0), -4);
+    rightArmGroup.add(rightArm);
+    if (v >= 1) {
+        let rightSleeve = createCube(skinTexture,
+            slim ? 3.667 : 4.667, 12.667, 4.667,
+            texturePositions.rightSleeve,
+            slim,
+            'rightSleeve',
+            true
+        );
+        rightSleeve.translateOnAxis(new THREE.Vector3(0, 1, 0), -4);
+        rightArmGroup.add(rightSleeve);
+    }
+
+    let leftLegGroup = new THREE.Object3D();
+    leftLegGroup.name = 'leftLegGroup';
+    leftLegGroup.position.x = -2;
+    leftLegGroup.position.y = 6;
+    leftLegGroup.position.z = 0;
+    leftLegGroup.translateOnAxis(new THREE.Vector3(0, 1, 0), 4);
+    let leftLeg = createCube(skinTexture,
+        4, 12, 4,
+        texturePositions.leftLeg[v],
+        slim,
+        'leftLeg'
+    );
+    leftLeg.translateOnAxis(new THREE.Vector3(0, 1, 0), -4);
+    leftLegGroup.add(leftLeg);
+    if (v >= 1) {
+        let leftTrousers = createCube(skinTexture,
+            4.667, 12.667, 4.667,
+            texturePositions.leftTrousers,
+            slim,
+            'leftTrousers',
+            true
+        );
+        leftTrousers.translateOnAxis(new THREE.Vector3(0, 1, 0), -4);
+        leftLegGroup.add(leftTrousers);
+    }
+
+    let rightLegGroup = new THREE.Object3D();
+    rightLegGroup.name = 'rightLegGroup';
+    rightLegGroup.position.x = 2;
+    rightLegGroup.position.y = 6;
+    rightLegGroup.position.z = 0;
+    rightLegGroup.translateOnAxis(new THREE.Vector3(0, 1, 0), 4);
+    let rightLeg = createCube(skinTexture,
+        4, 12, 4,
+        texturePositions.rightLeg[v],
+        slim,
+        'rightLeg'
+    );
+    rightLeg.translateOnAxis(new THREE.Vector3(0, 1, 0), -4);
+    rightLegGroup.add(rightLeg);
+    if (v >= 1) {
+        let rightTrousers = createCube(skinTexture,
+            4.667, 12.667, 4.667,
+            texturePositions.rightTrousers,
+            slim,
+            'rightTrousers',
+            true
+        );
+        rightTrousers.translateOnAxis(new THREE.Vector3(0, 1, 0), -4);
+        rightLegGroup.add(rightTrousers);
+    }
+
+    let playerGroup = new THREE.Object3D();
+    playerGroup.add(headGroup);
+    playerGroup.add(bodyGroup);
+    playerGroup.add(leftArmGroup);
+    playerGroup.add(rightArmGroup);
+    playerGroup.add(leftLegGroup);
+    playerGroup.add(rightLegGroup);
+
+    if (capeTexture) {
+        console.log(texturePositions);
+        let capeTextureCoordinates = texturePositions.capeRelative;
+        if (capeType === 'optifine') {
+            capeTextureCoordinates = texturePositions.capeOptifineRelative;
+        }
+        if (capeType === 'labymod') {
+            capeTextureCoordinates = texturePositions.capeLabymodRelative;
+        }
+        capeTextureCoordinates = JSON.parse(JSON.stringify(capeTextureCoordinates)); // bad clone to keep the below scaling from affecting everything
+
+        console.log(capeTextureCoordinates);
+
+        type CubeTextureKey = 'left' | 'right' | 'front' | 'back' | 'top' | 'bottom'
+        // Multiply coordinates by image dimensions
+        for (let cord in capeTextureCoordinates) {
+            let key = cord as CubeTextureKey;
+            capeTextureCoordinates[key].x *= capeTexture.image.width;
+            capeTextureCoordinates[key].w *= capeTexture.image.width;
+            capeTextureCoordinates[key].y *= capeTexture.image.height;
+            capeTextureCoordinates[key].h *= capeTexture.image.height;
+        }
+
+        console.log(capeTextureCoordinates);
+
+        let capeGroup = new THREE.Object3D();
+        capeGroup.name = 'capeGroup';
+        capeGroup.position.x = 0;
+        capeGroup.position.y = 16;
+        capeGroup.position.z = -2.5;
+        capeGroup.translateOnAxis(new THREE.Vector3(0, 1, 0), 8);
+        capeGroup.translateOnAxis(new THREE.Vector3(0, 0, 1), 0.5);
+        let cape = createCube(capeTexture,
+            10, 16, 1,
+            capeTextureCoordinates,
+            false,
+            'cape');
+        cape.rotation.x = toRadians(10); // slight backward angle
+        cape.translateOnAxis(new THREE.Vector3(0, 1, 0), -8);
+        cape.translateOnAxis(new THREE.Vector3(0, 0, 1), -0.5);
+        cape.rotation.y = toRadians(180); // flip front&back to be correct
+        capeGroup.add(cape);
+
+        playerGroup.add(capeGroup);
+    }
+
+    return playerGroup;
+}
+
+
+function toRadians(angle: number) {
+    return angle * (Math.PI / 180);
+}
--- a/frontend/src/types.d.ts
+++ b/frontend/src/types.d.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2023-2025. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export type AppState = {
+    login: string
+    accessToken: string
+    tokenValid: boolean
+    loginTime: number
+    profileName: string
+    uuid: string
+    passwordReset: boolean
+}
--- a/frontend/src/user.css
+++ b/frontend/src/user.css
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2023. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+
+.header {
+    text-align: center;
+}
+
+.user-card {
+    padding: 14px 24px;
+    margin: auto;
+}
+
+.model,
+.textureType,
+.url,
+.changeTo {
+    display: block;
+    width: 87%;
+    margin: 20px auto;
+}
+
+.file {
+    display: flex;
+    width: 87%;
+    margin: 20px auto;
+}
+
+.button-container {
+    display: flex;
+    justify-content: flex-end;
+    width: 87%;
+    margin: auto;
+}
+
+.button-container button {
+    margin: 3px;
+}
+
--- a/frontend/src/user.tsx
+++ b/frontend/src/user.tsx
@@ -0,0 +1,474 @@
+/*
+ * Copyright (C) 2023. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import React from 'react';
+import {
+    Box,
+    Collapse,
+    Container,
+    Fade,
+    FilledInput,
+    FormControl,
+    FormControlLabel,
+    FormLabel,
+    IconButton,
+    InputAdornment,
+    InputLabel,
+    Paper,
+    Radio,
+    RadioGroup,
+    TextField
+} from '@mui/material';
+import './user.css';
+import {AppState} from './types';
+import {Delete} from '@mui/icons-material';
+import Button from '@mui/material/Button';
+import {useSnackbar} from 'notistack';
+import {FocusedShowHelperText} from './components';
+import {SubmitHandler, useForm} from 'react-hook-form';
+import axios from 'axios';
+import SkinRender from './skinrender/skin-render';
+
+function handleMouseDown(event: React.MouseEvent<HTMLButtonElement>) {
+    event.preventDefault();
+}
+
+function UploadTextureForm(props: {
+    appData: AppState,
+    setAppData: React.Dispatch<React.SetStateAction<AppState>>,
+    skinData: SkinData | null,
+    setSkinData: React.Dispatch<React.SetStateAction<SkinData | null>>
+}) {
+    const {appData, skinData, setSkinData} = props;
+    const [submitting, setSubmitting] = React.useState(false);
+
+    const {enqueueSnackbar} = useSnackbar();
+
+    const fileInputElem = React.useRef<HTMLInputElement>(null);
+    const [filePath, setFilePath] = React.useState('');
+    const handleFilePathChange = (event: React.ChangeEvent<HTMLInputElement>) => {
+        setFilePath(event.target.value);
+
+        if (skinData) {
+            if (type == 'cape' && skinData.capeUrl?.startsWith('blob:')) {
+                URL.revokeObjectURL(skinData.capeUrl);
+            } else if (skinData.skinUrl.startsWith('blob:')) {
+                URL.revokeObjectURL(skinData.skinUrl);
+            }
+        }
+
+        const fileInput = event.target;
+        const fileBlob = fileInput.files?.length ? fileInput.files[0] : null;
+        if (fileBlob && skinData) {
+            let data: SkinData = {
+                ...skinData
+            }
+            const fakeUrl = URL.createObjectURL(fileBlob);
+            if (type == 'cape') {
+                data.capeUrl = fakeUrl;
+            } else {
+                data.slim = model == 'slim';
+                data.skinUrl = fakeUrl;
+            }
+            setSkinData(data);
+        }
+    };
+
+    const [url, setUrl] = React.useState('');
+    const handleUrlChange = (event: React.ChangeEvent<HTMLInputElement>) => {
+        setUrl(event.target.value);
+    };
+
+    const [type, setType] = React.useState('skin');
+    const handleTypeChange = (event: React.ChangeEvent<HTMLInputElement>) => {
+        setType(event.target.value);
+    };
+
+    const [model, setModel] = React.useState('default');
+    const handleModelChange = (event: React.ChangeEvent<HTMLInputElement>) => {
+        setModel(event.target.value);
+
+        if (skinData) {
+            setSkinData({
+                ...skinData,
+                slim: event.target.value == 'slim'
+            })
+        }
+    };
+
+    const uploadTexture = (event: React.FormEvent) => {
+        event.preventDefault();
+        const fileInput = fileInputElem.current;
+        if (fileInput == null) {
+            console.error('#file-input-real is not a valid element');
+            return;
+        }
+        setSubmitting(true);
+        const fileBlob = fileInput.files?.length ? fileInput.files[0] : null;
+        if (filePath && fileBlob) {
+            const formData = new FormData();
+            formData.append('model', model);
+            formData.append('file', fileBlob);
+            axios.put(`/api/user/profile/${appData.uuid}/${type}`, formData, {
+                headers: {
+                    'Authorization': 'Bearer ' + appData.accessToken
+                }
+            }).then(() => {
+                enqueueSnackbar('上传成功', {variant: 'success'});
+            }).catch(e => {
+                const response = e.response;
+                if (response && response.data) {
+                    enqueueSnackbar(response.data.errorMessage, {variant: 'error'});
+                } else {
+                    enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+                }
+            }).finally(() => setSubmitting(false));
+        } else if (url) {
+            axios.post(`/api/user/profile/${appData.uuid}/${type}`, {model, url}, {
+                headers: {
+                    'Authorization': 'Bearer ' + appData.accessToken
+                }
+            }).then(() => {
+                enqueueSnackbar('上传成功', {variant: 'success'});
+                axios.get('/sessionserver/session/minecraft/profile/' + appData.uuid).then(response => {
+                    let texturesProp = response.data.properties.find((v: any) => v.name == 'textures');
+                    let profile: any = {};
+                    if (texturesProp) {
+                        profile = JSON.parse(window.atob(texturesProp.value));
+                    }
+                    if (profile.textures) {
+                        let data: SkinData = {
+                            skinUrl: ''
+                        };
+                        if (profile.textures.SKIN) {
+                            data.skinUrl = profile.textures.SKIN.url;
+                            data.slim = profile.textures.SKIN.metadata ? profile.textures.SKIN.metadata.model == 'slim' : false;
+                        } else {
+                            let index = getUUIDHashCode(appData.uuid) % DEFAULT_SKINS.length;
+                            data.skinUrl = DEFAULT_SKINS[index].skinUrl;
+                            data.slim = DEFAULT_SKINS[index].slim;
+                        }
+                        if (profile.textures.CAPE) {
+                           data.capeUrl = profile.textures.CAPE.url;
+                        }
+                        setSkinData(data);
+                    }
+                });
+            }).catch(e => {
+                const response = e.response;
+                if (response && response.data) {
+                    enqueueSnackbar(response.data.errorMessage, {variant: 'error'});
+                } else {
+                    enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+                }
+            }).finally(() => setSubmitting(false));
+        } else {
+            enqueueSnackbar('未选择文件', {variant: 'warning'});
+            setSubmitting(false);
+        }
+    };
+
+    const deleteTexture = () => {
+        setSubmitting(true);
+        axios.delete(`/api/user/profile/${appData.uuid}/${type}`, {
+            headers: {
+                'Authorization': 'Bearer ' + appData.accessToken
+            }
+        }).then(() => {
+            enqueueSnackbar('删除成功', {variant: 'success'});
+            if (skinData != null) {
+                if (type == 'cape') {
+                    setSkinData({
+                        ...skinData,
+                        capeUrl: undefined
+                    });
+                } else {
+                    // 显示默认材质
+                    let index = getUUIDHashCode(appData.uuid) % DEFAULT_SKINS.length;
+                    setSkinData({
+                        ...DEFAULT_SKINS[index],
+                        capeUrl: skinData.capeUrl
+                    });
+                }
+            }
+        }).catch(e => {
+            const response = e.response;
+            if (response && response.data) {
+                enqueueSnackbar(response.data.errorMessage, {variant: 'error'});
+            } else {
+                enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+            }
+        }).finally(() => setSubmitting(false));
+    };
+
+    // noinspection JSUnusedGlobalSymbols
+    return (
+        <>
+            <section className="header">
+                <h3>上传材质</h3>
+            </section>
+
+            <Box component="form" autoComplete="off" onSubmit={uploadTexture}>
+                <Box component="div" width="50%" boxSizing="border-box" display="inline-block">
+                    <FormControl>
+                        <FormLabel id="texture-type-group-label">材质类别: </FormLabel>
+                        <RadioGroup
+                            row
+                            aria-labelledby="texture-type-group-label"
+                            value={type}
+                            onChange={handleTypeChange}
+                            name="type">
+                            <FormControlLabel value="skin" control={<Radio/>} label="皮肤"/>
+                            <FormControlLabel value="cape" control={<Radio/>} label="披风"/>
+                        </RadioGroup>
+                    </FormControl>
+                </Box>
+                <Fade in={type == 'skin'}>
+                    <Box component="div" width="50%" boxSizing="border-box" display="inline-block">
+                        <FormControl>
+                            <FormLabel id="texture-model-group-label">材质模型: </FormLabel>
+                            <RadioGroup
+                                row
+                                aria-labelledby="texture-model-group-label"
+                                value={model}
+                                onChange={handleModelChange}
+                                name="model">
+                                <FormControlLabel value="default" control={<Radio/>} label="Steve"/>
+                                <FormControlLabel value="slim" control={<Radio/>} label="Alex"/>
+                            </RadioGroup>
+                        </FormControl>
+                    </Box>
+                </Fade>
+                <Collapse in={!filePath} className="url">
+                    <TextField
+                        id="url-input"
+                        name="url"
+                        fullWidth
+                        label="材质 URL"
+                        variant="filled"
+                        required={!filePath}
+                        type="url"
+                        value={url}
+                        onChange={handleUrlChange}
+                    />
+                </Collapse>
+                <Collapse in={!url} className="file">
+                    <FormControl fullWidth variant="filled" required={!url}>
+                        <InputLabel htmlFor="file-input">或者选择一个图片</InputLabel>
+                        <FilledInput
+                            id="file-input"
+                            required={!url}
+                            endAdornment={
+                                <InputAdornment position="end">
+                                    <IconButton
+                                        aria-label="清空选择"
+                                        edge="end"
+                                        onMouseDown={handleMouseDown}
+                                        onClick={() => setFilePath('')}>
+                                        <Delete/>
+                                    </IconButton>
+                                </InputAdornment>
+                            }
+                            value={filePath}
+                            inputProps={{
+                                onClick: () => fileInputElem.current?.click()
+                            }}
+                        />
+                        <input id="file-input-real" type="file" name="file" hidden ref={fileInputElem} accept="image/*" value={filePath} onChange={handleFilePathChange}/>
+                    </FormControl>
+                </Collapse>
+                <div className="button-container">
+                    <Button variant="contained" type="submit" disabled={submitting}>上传</Button>
+                    <Button variant="contained" onClick={deleteTexture} disabled={submitting}>删除材质</Button>
+                </div>
+            </Box>
+        </>
+    );
+}
+
+type ChangeProfileInputs = {
+    changeTo: string
+};
+
+function ChangeProfileForm(props: { appData: AppState, setAppData: React.Dispatch<React.SetStateAction<AppState>> }) {
+    const {appData, setAppData} = props;
+    const setProfileName = (profileName: string) => {
+        if (appData.profileName != profileName) {
+            setAppData(oldData => {
+                return {
+                    ...oldData,
+                    profileName
+                };
+            });
+        }
+    };
+
+    const [submitting, setSubmitting] = React.useState(false);
+
+    const {enqueueSnackbar} = useSnackbar();
+    const {register, handleSubmit, formState: {errors}} = useForm<ChangeProfileInputs>();
+    const onSubmit: SubmitHandler<ChangeProfileInputs> = data => {
+        setSubmitting(true);
+        axios.post('/authserver/change', {
+            accessToken: appData.accessToken,
+            changeTo: data.changeTo
+        }).then(() => {
+            enqueueSnackbar('更改成功', {variant: 'success'});
+            setProfileName(data.changeTo);
+        }).catch(e => {
+            const response = e.response;
+            if (response && response.data) {
+                let errorMessage = response.data.errorMessage;
+                let message = '更改失败: ' + errorMessage;
+                if (errorMessage === 'profileName exist') {
+                    message = '更改失败: 角色名已存在';
+                } else if (errorMessage === 'profileName duplicate') {
+                    message = '更改失败: 角色名与正版用户冲突';
+                }
+                enqueueSnackbar(message, {variant: 'error'});
+            } else {
+                enqueueSnackbar('网络错误:' + e.message, {variant: 'error'});
+            }
+        }).finally(() => setSubmitting(false));
+    };
+
+    return (
+        <>
+            <section className="header">
+                <h3>更改角色名</h3>
+            </section>
+
+            <Box component="form" autoComplete="off" onSubmit={handleSubmit(onSubmit)}>
+                <div className="changeTo">
+                    <FormControl fullWidth variant="filled" required error={errors.changeTo != null}>
+                        <InputLabel htmlFor="changeTo-input">角色名</InputLabel>
+                        <FilledInput
+                            id="changeTo-input"
+                            name="changeTo"
+                            defaultValue={appData.profileName}
+                            required
+                            inputProps={{
+                                minLength: '2', maxLength: 16,
+                                ...register('changeTo', {required: true, minLength: 2, pattern: /^[a-zA-Z0-9_]{1,16}$/, maxLength: 16})
+                            }}
+                        />
+                        <FocusedShowHelperText id="profileName-input-helper-text">字母，数字或下划线</FocusedShowHelperText>
+                    </FormControl>
+                </div>
+                <div className="button-container">
+                    <Button variant="contained" type="submit" disabled={submitting}>更改</Button>
+                </div>
+            </Box>
+        </>
+    );
+}
+
+type SkinData = {
+    skinUrl: string
+    capeUrl?: string
+    slim?: boolean
+}
+
+const DEFAULT_SKINS: SkinData[] = [
+    {skinUrl: 'player/slim/alex.png', slim: true},
+    {skinUrl: 'player/slim/ari.png', slim: true},
+    {skinUrl: 'player/slim/efe.png', slim: true},
+    {skinUrl: 'player/slim/kai.png', slim: true},
+    {skinUrl: 'player/slim/makena.png', slim: true},
+    {skinUrl: 'player/slim/noor.png', slim: true},
+    {skinUrl: 'player/slim/steve.png', slim: true},
+    {skinUrl: 'player/slim/sunny.png', slim: true},
+    {skinUrl: 'player/slim/zuri.png', slim: true},
+
+    {skinUrl: 'player/wide/alex.png'},
+    {skinUrl: 'player/wide/ari.png'},
+    {skinUrl: 'player/wide/efe.png'},
+    {skinUrl: 'player/wide/kai.png'},
+    {skinUrl: 'player/wide/makena.png'},
+    {skinUrl: 'player/wide/noor.png'},
+    {skinUrl: 'player/wide/steve.png'},
+    {skinUrl: 'player/wide/sunny.png'},
+    {skinUrl: 'player/wide/zuri.png'},
+];
+
+function User(props: { appData: AppState, setAppData: React.Dispatch<React.SetStateAction<AppState>> }) {
+    const {appData, setAppData} = props;
+
+    const [skinData, setSkinData] = React.useState<SkinData | null>(null);
+
+    React.useEffect(() => {
+        setSkinData(null);
+        axios.get('/sessionserver/session/minecraft/profile/' + appData.uuid).then(response => {
+            let texturesProp = response.data.properties.find((v: any) => v.name == 'textures');
+            let profile: any = {};
+            if (texturesProp) {
+                profile = JSON.parse(window.atob(texturesProp.value));
+            }
+            if (profile.textures && profile.textures.SKIN) {
+                let skinUrl = profile.textures.SKIN.url;
+                let slim = profile.textures.SKIN.metadata ? profile.textures.SKIN.metadata.model == 'slim' : false;
+                let capeUrl = undefined;
+                if (profile.textures.CAPE) {
+                    capeUrl = profile.textures.CAPE.url;
+                }
+                setSkinData({
+                    skinUrl,
+                    capeUrl,
+                    slim
+                });
+            } else if (profile.textures && profile.textures.CAPE) {
+                // 显示默认材质
+                let index = getUUIDHashCode(appData.uuid) % DEFAULT_SKINS.length;
+                setSkinData({
+                    ...DEFAULT_SKINS[index],
+                    capeUrl: profile.textures.CAPE.url
+                });
+            } else {
+                // 显示默认材质
+                let index = getUUIDHashCode(appData.uuid) % DEFAULT_SKINS.length;
+                setSkinData(DEFAULT_SKINS[index]);
+            }
+        });
+    }, [appData]);
+
+    return (
+        <Container maxWidth={'sm'}>
+            <Paper className={'user-card'}>
+                <section className="header">
+                    <h1>简陋信息页</h1>
+                </section>
+
+                <UploadTextureForm appData={appData} setAppData={setAppData} skinData={skinData} setSkinData={setSkinData}/>
+
+                {skinData && <SkinRender skinUrl={skinData.skinUrl} capeUrl={skinData.capeUrl} slim={skinData.slim}/>}
+
+                <ChangeProfileForm appData={appData} setAppData={setAppData}/>
+            </Paper>
+        </Container>
+    );
+}
+
+function getUUIDHashCode(uuid: string) {
+    const uuidNoDash = uuid.replace(/-/g, '');
+    const mostMost = parseInt(uuidNoDash.substring(0, 8), 16);
+    const mostLeast = parseInt(uuidNoDash.substring(8, 16), 16);
+    const leastMost = parseInt(uuidNoDash.substring(16, 24), 16);
+    const leastLeast = parseInt(uuidNoDash.substring(24, 32), 16);
+    return mostMost ^ mostLeast ^ leastMost ^ leastLeast;
+}
+
+export default User;
--- a/frontend/src/vite-env.d.ts
+++ b/frontend/src/vite-env.d.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) 2023. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/// <reference types="vite/client" />
--- a/frontend/tsconfig.json
+++ b/frontend/tsconfig.json
@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "useDefineForClassFields": true,
+    "lib": ["DOM", "DOM.Iterable", "ESNext"],
+    "allowJs": false,
+    "skipLibCheck": true,
+    "esModuleInterop": false,
+    "allowSyntheticDefaultImports": true,
+    "strict": true,
+    "forceConsistentCasingInFileNames": true,
+    "module": "ESNext",
+    "moduleResolution": "Node",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx"
+  },
+  "include": ["src"],
+  "references": [{ "path": "./tsconfig.node.json" }]
+}
--- a/frontend/tsconfig.node.json
+++ b/frontend/tsconfig.node.json
@@ -0,0 +1,9 @@
+{
+  "compilerOptions": {
+    "composite": true,
+    "module": "ESNext",
+    "moduleResolution": "Node",
+    "allowSyntheticDefaultImports": true
+  },
+  "include": ["vite.config.ts"]
+}
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2023. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+import mockDevServerPlugin from 'vite-plugin-mock-dev-server'
+
+// https://vitejs.dev/config/
+export default defineConfig({
+  plugins: [react(), mockDevServerPlugin()],
+  server: {
+    proxy: {
+      '^/(authserver|users|sessionserver|textures|api|minecraftservices)': {
+        target: 'http://localhost:8080'
+      }
+    }
+  },
+  base: ''
+})
--- a/frontend/yarn.lock
+++ b/frontend/yarn.lock
--- a/go.mod
+++ b/go.mod
@@ -1,40 +1,51 @@
 module yggdrasil-go

-go 1.17
+go 1.24

 require (
-	github.com/gin-contrib/cors v1.4.0
-	github.com/gin-gonic/gin v1.8.1
-	github.com/google/uuid v1.3.0
-	github.com/hashicorp/golang-lru v0.5.4
-	golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90
-	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9
+	github.com/gin-contrib/cors v1.7.4
+	github.com/gin-gonic/gin v1.10.0
+	github.com/google/uuid v1.6.0
+	github.com/hashicorp/golang-lru v1.0.2
+	golang.org/x/crypto v0.36.0
+	golang.org/x/time v0.11.0
 	gopkg.in/ini.v1 v1.67.0
-	gorm.io/driver/mysql v1.3.6
-	gorm.io/driver/sqlite v1.3.6
-	gorm.io/gorm v1.23.9
+	gorm.io/driver/mysql v1.5.7
+	gorm.io/driver/sqlite v1.5.7
+	gorm.io/gorm v1.25.12
 )

 require (
-	github.com/gin-contrib/sse v0.1.0 // indirect
-	github.com/go-playground/locales v0.14.0 // indirect
-	github.com/go-playground/universal-translator v0.18.0 // indirect
-	github.com/go-playground/validator/v10 v10.11.1 // indirect
-	github.com/go-sql-driver/mysql v1.6.0 // indirect
-	github.com/goccy/go-json v0.9.11 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/bytedance/sonic v1.13.2 // indirect
+	github.com/bytedance/sonic/loader v0.2.4 // indirect
+	github.com/cloudwego/base64x v0.1.5 // indirect
+	github.com/cloudwego/iasm v0.2.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
+	github.com/gin-contrib/sse v1.0.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-playground/validator/v10 v10.26.0 // indirect
+	github.com/go-sql-driver/mysql v1.9.1 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/leodido/go-urn v1.2.1 // indirect
-	github.com/mattn/go-isatty v0.0.16 // indirect
-	github.com/mattn/go-sqlite3 v1.14.15 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-sqlite3 v1.14.24 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
-	github.com/ugorji/go/codec v1.2.7 // indirect
-	golang.org/x/net v0.0.0-20220909164309-bea034e7d591 // indirect
-	golang.org/x/sys v0.0.0-20220915200043-7b5979e65e41 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.2.12 // indirect
+	github.com/wneessen/go-mail v0.6.2 // indirect
+	golang.org/x/arch v0.15.0 // indirect
+	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -1,52 +1,81 @@
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/bytedance/sonic v1.13.2 h1:8/H1FempDZqC4VqjptGo14QQlJx8VdZJegxs6wwfqpQ=
+github.com/bytedance/sonic v1.13.2/go.mod h1:o68xyaF9u2gvVBuGHPlUVCy+ZfmNNO5ETf1+KgkJhz4=
+github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
+github.com/bytedance/sonic/loader v0.2.4 h1:ZWCw4stuXUsn1/+zQDqeE7JKP+QO47tz7QCNan80NzY=
+github.com/bytedance/sonic/loader v0.2.4/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFosQU6FxH2JmUe6VI=
+github.com/cloudwego/base64x v0.1.5 h1:XPciSp1xaq2VCSt6lF0phncD4koWyULpl5bUxbfCyP4=
+github.com/cloudwego/base64x v0.1.5/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
+github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
+github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/gin-contrib/cors v1.3.1 h1:doAsuITavI4IOcd0Y19U4B+O0dNWihRyX//nn4sEmgA=
-github.com/gin-contrib/cors v1.3.1/go.mod h1:jjEJ4268OPZUcU7k9Pm653S7lXUGcqMADzFA61xsmDk=
+github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
+github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
 github.com/gin-contrib/cors v1.4.0 h1:oJ6gwtUl3lqV0WEIwM/LxPF1QZ5qe2lGWdY2+bz7y0g=
 github.com/gin-contrib/cors v1.4.0/go.mod h1:bs9pNM0x/UsmHPBWT2xZz9ROh8xYjYkiURUfmBoMlcs=
+github.com/gin-contrib/cors v1.7.4 h1:/fC6/wk7rCRtqKqki8lLr2Xq+hnV49aXDLIuSek9g4k=
+github.com/gin-contrib/cors v1.7.4/go.mod h1:vGc/APSgLMlQfEJV5NAzkrAHb0C8DetL3K6QZuvGii0=
 github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
-github.com/gin-gonic/gin v1.5.0/go.mod h1:Nd6IXA8m5kNZdNEHMBd93KT+mdY3+bewLgRvmCsR2Do=
+github.com/gin-contrib/sse v1.0.0 h1:y3bT1mUWUxDpW4JLQg/HnTqV4rozuW4tC9eFKTxYI9E=
+github.com/gin-contrib/sse v1.0.0/go.mod h1:zNuFdwarAygJBht0NTKiSi3jRf6RbqeILZ9Sp6Slhe0=
 github.com/gin-gonic/gin v1.8.1 h1:4+fr/el88TOO3ewCmQr8cx/CtZ/umlIRIs5M4NTNjf8=
 github.com/gin-gonic/gin v1.8.1/go.mod h1:ji8BvRH1azfM+SYow9zQ6SZMvR8qOMZHmsCuWR9tTTk=
+github.com/gin-gonic/gin v1.10.0 h1:nTuyha1TYqgedzytsKYqna+DfLos46nTv2ygFy86HFU=
+github.com/gin-gonic/gin v1.10.0/go.mod h1:4PMNQiOhvDRa013RKVbsiNwoyezlm2rm0uX/T7kzp5Y=
 github.com/go-playground/assert/v2 v2.0.1 h1:MsBgLAaY856+nPRTKrp3/OZK38U/wa0CcBYNjji3q3A=
 github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
-github.com/go-playground/locales v0.12.1/go.mod h1:IUMDtCfWo/w/mtMfIE/IG2K+Ey3ygWanZIBtBW0W2TM=
 github.com/go-playground/locales v0.14.0 h1:u50s323jtVGugKlcYeyzC0etD1HifMjqmJqb8WugfUU=
 github.com/go-playground/locales v0.14.0/go.mod h1:sawfccIbzZTqEDETgFXqTho0QybSa7l++s0DH+LDiLs=
-github.com/go-playground/universal-translator v0.16.0/go.mod h1:1AnU7NaIRDWWzGEKwgtJRd2xk99HeFyHw3yid4rvQIY=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.0 h1:82dyy6p4OuJq4/CByFNOn/jYrnRPArHwAcmLoJZxyho=
 github.com/go-playground/universal-translator v0.18.0/go.mod h1:UvRDBj+xPUEGrFYl+lu/H90nyDXpg0fqeB/AQUGNTVA=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
 github.com/go-playground/validator/v10 v10.10.0/go.mod h1:74x4gJWsvQexRdW8Pn3dXSGrTK4nAUsbPlLADvpJkos=
-github.com/go-playground/validator/v10 v10.11.0 h1:0W+xRM511GY47Yy3bZUbJVitCNg2BOGlCyvTqsp/xIw=
-github.com/go-playground/validator/v10 v10.11.0/go.mod h1:i+3WkQ1FvaUjjxh1kSvIA4dMGDBiPU55YFDl0WbKdWU=
 github.com/go-playground/validator/v10 v10.11.1 h1:prmOlTVv+YjZjmRmNSF3VmspqJIxJWXmqUsHwfTRRkQ=
 github.com/go-playground/validator/v10 v10.11.1/go.mod h1:i+3WkQ1FvaUjjxh1kSvIA4dMGDBiPU55YFDl0WbKdWU=
+github.com/go-playground/validator/v10 v10.26.0 h1:SP05Nqhjcvz81uJaRfEV0YBSSSGMc/iMaVtFbr3Sw2k=
+github.com/go-playground/validator/v10 v10.26.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/goccy/go-json v0.9.7 h1:IcB+Aqpx/iMHu5Yooh7jEzJk1JZ7Pjtmys2ukPr7EeM=
+github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-sql-driver/mysql v1.9.1 h1:FrjNGn/BsJQjVRuSa8CBrM5BWA9BWoXXat3KrtSb/iI=
+github.com/go-sql-driver/mysql v1.9.1/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/goccy/go-json v0.9.7/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/goccy/go-json v0.9.11 h1:/pAaQDLHEoCq/5FFmSKBswWmK6H0e8g4159Kc/X/nqk=
 github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
+github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.4/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
-github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
+github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
@@ -55,30 +84,30 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/leodido/go-urn v1.1.0/go.mod h1:+cyI34gQWZcE1eQU7NVgKkkzdXDQHr1dBMtdAPozLkw=
 github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
 github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
-github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
-github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-sqlite3 v1.14.12/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/mattn/go-sqlite3 v1.14.13 h1:1tj15ngiFfcZzii7yd82foL+ks+ouQcj8j/TPq3fk1I=
-github.com/mattn/go-sqlite3 v1.14.13/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/mattn/go-sqlite3 v1.14.15 h1:vfoHhTN1af61xCRSWzFIWzx2YskyMTwHLrExkBOjvxI=
 github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mattn/go-sqlite3 v1.14.24 h1:tpSp2G2KyMnnQu99ngJ47EIkWVmliIizyZBfPrBWDRM=
+github.com/mattn/go-sqlite3 v1.14.24/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/pelletier/go-toml/v2 v2.0.1/go.mod h1:r9LEWfGN8R5k0VXJ+0BkIe7MYkRdwZOjgMj2KwnJFUo=
-github.com/pelletier/go-toml/v2 v2.0.2 h1:+jQXlF3scKIcSEKkdHzXhCTDLPFi5r1wnK6yPS+49Gw=
-github.com/pelletier/go-toml/v2 v2.0.2/go.mod h1:MovirKjgVRESsAvNZlAjtFwV867yGuwRkXbG66OzopI=
 github.com/pelletier/go-toml/v2 v2.0.5 h1:ipoSadvV8oGUjnUbMub59IDPPwfxF694nG/jwbMiyQg=
 github.com/pelletier/go-toml/v2 v2.0.5/go.mod h1:OMHamSCAODeSsVrwwvcJOaoN0LIUIaFVNZzmWyNfXas=
+github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
+github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -87,93 +116,156 @@ github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUA
 github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.2 h1:4jaiDzPyXQvSd7D0EjG45355tLlV3VOECpq10pLC+8s=
-github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go v1.2.7 h1:qYhyWUUd6WbiM+C6JZAUkIJt/1WrjzNHY9+KCIjVqTo=
 github.com/ugorji/go v1.2.7/go.mod h1:nF9osbDWLy6bDVv/Rtoh6QgnvNDpmCalQV5urGCCS6M=
-github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
 github.com/ugorji/go/codec v1.2.7 h1:YPXUKf7fYbp/y8xloBqZOw2qaVggbfwMlI8WM3wZUJ0=
 github.com/ugorji/go/codec v1.2.7/go.mod h1:WGN1fab3R1fzQlVQTkfxVtIBhWDRqOviHU95kRgeqEY=
+github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
+github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/wneessen/go-mail v0.6.2 h1:c6V7c8D2mz868z9WJ+8zDKtUyLfZ1++uAZmo2GRFji8=
+github.com/wneessen/go-mail v0.6.2/go.mod h1:L/PYjPK3/2ZlNb2/FjEBIn9n1rUWjW+Toy531oVmeb4=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+golang.org/x/arch v0.15.0 h1:QtOrQd0bTUnhNVNndMpLHNWrDmYzZ2KDqSrEymqInZw=
+golang.org/x/arch v0.15.0/go.mod h1:JmwW7aLIoRUKgaTzhkiEFxvcEiQGyOg9BMonBJUS7EE=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e h1:T8NU3HyQ8ClP4SEE+KbFlg6n0NhuTsN4MyznaarGsZM=
-golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90 h1:Y/gsMcFOcR+6S6f3YeMKl5g+dZMEWqcz5Czj/GWYbkM=
 golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220607020251-c690dde0001d h1:4SFsTMi4UahlKoloni7L4eYzhFRifURQLw+yv0QDCx8=
-golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220909164309-bea034e7d591 h1:D0B/7al0LLrVC8aWF4+oxpv/m8bc7ViFfVS8/gXGdqI=
 golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d h1:Zu/JngovGLVi6t2J3nmAf3AoTDwuzw85YZ3b9o4yU7s=
-golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220915200043-7b5979e65e41 h1:ohgcoMbSofXygzo6AD2I1kz3BFmW1QArPYTtwEM3UXc=
 golang.org/x/sys v0.0.0-20220915200043-7b5979e65e41/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/time v0.0.0-20220609170525-579cf78fd858 h1:Dpdu/EMxGMFgq0CeYMh4fazTD2vtlZRYE7wyynxJb9U=
-golang.org/x/time v0.0.0-20220609170525-579cf78fd858/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 h1:ftMN5LMiBFjbzleLqtoBZk7KdJwhuybIU+FckUHgoyQ=
 golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
-gopkg.in/go-playground/validator.v9 v9.29.1/go.mod h1:+c9/zcJMFNgbLvly1L1V+PpxWdVbfP1avr/N00E2vyQ=
-gopkg.in/ini.v1 v1.66.6 h1:LATuAqN/shcYAOkv3wl2L4rkaKqkcgTBQjOyYDvcPKI=
-gopkg.in/ini.v1 v1.66.6/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gorm.io/driver/mysql v1.3.5 h1:iWBTVW/8Ij5AG4e0G/zqzaJblYkBI1VIL1LG2HUGsvY=
-gorm.io/driver/mysql v1.3.5/go.mod h1:sSIebwZAVPiT+27jK9HIwvsqOGKx3YMPmrA3mBJR10c=
 gorm.io/driver/mysql v1.3.6 h1:BhX1Y/RyALb+T9bZ3t07wLnPZBukt+IRkMn8UZSNbGM=
 gorm.io/driver/mysql v1.3.6/go.mod h1:sSIebwZAVPiT+27jK9HIwvsqOGKx3YMPmrA3mBJR10c=
-gorm.io/driver/sqlite v1.3.4 h1:NnFOPVfzi4CPsJPH4wXr6rMkPb4ElHEqKMvrsx9c9Fk=
-gorm.io/driver/sqlite v1.3.4/go.mod h1:B+8GyC9K7VgzJAcrcXMRPdnMcck+8FgJynEehEPM16U=
+gorm.io/driver/mysql v1.5.7 h1:MndhOPYOfEp2rHKgkZIhJ16eVUIRf2HmzgoPmh7FCWo=
+gorm.io/driver/mysql v1.5.7/go.mod h1:sEtPWMiqiN1N1cMXoXmBbd8C6/l+TESwriotuRRpkDM=
 gorm.io/driver/sqlite v1.3.6 h1:Fi8xNYCUplOqWiPa3/GuCeowRNBRGTf62DEmhMDHeQQ=
 gorm.io/driver/sqlite v1.3.6/go.mod h1:Sg1/pvnKtbQ7jLXxfZa+jSHvoX8hoZA8cn4xllOMTgE=
+gorm.io/driver/sqlite v1.5.7 h1:8NvsrhP0ifM7LX9G4zPB97NwovUakUxc+2V2uuf3Z1I=
+gorm.io/driver/sqlite v1.5.7/go.mod h1:U+J8craQU6Fzkcvu8oLeAQmi50TkwPEhHDEjQZXDah4=
 gorm.io/gorm v1.23.4/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
-gorm.io/gorm v1.23.6 h1:KFLdNgri4ExFFGTRGGFWON2P1ZN28+9SJRN8voOoYe0=
-gorm.io/gorm v1.23.6/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
-gorm.io/gorm v1.23.8 h1:h8sGJ+biDgBA1AD1Ha9gFCx7h8npU7AsLdlkX0n2TpE=
 gorm.io/gorm v1.23.8/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
 gorm.io/gorm v1.23.9 h1:NSHG021i+MCznokeXR3udGaNyFyBQJW8MbjrJMVCfGw=
 gorm.io/gorm v1.23.9/go.mod h1:DVrVomtaYTbqs7gB/x2uVvqnXzv0nqjB396B8cG4dBA=
+gorm.io/gorm v1.25.7/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8=
+gorm.io/gorm v1.25.12 h1:I0u8i2hWQItBq1WfE0o2+WuL9+8L21K9e2HHSTE/0f8=
+gorm.io/gorm v1.25.12/go.mod h1:xh7N7RHfYlNc5EmcI/El95gXusucDrQnHXe0+CgWcLQ=
+nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=
--- a/main.go
+++ b/main.go
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
+ * Copyright (C) 2022-2025. Gardel <sunxinao@hotmail.com> and contributors
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
@@ -22,28 +22,24 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
-	"embed"
 	"encoding/pem"
 	"errors"
 	"github.com/gin-gonic/gin"
 	"gopkg.in/ini.v1"
 	"gorm.io/gorm"
-	"io/fs"
-	"io/ioutil"
 	"log"
 	"net/http"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 	"yggdrasil-go/model"
 	"yggdrasil-go/router"
+	"yggdrasil-go/service"
 	"yggdrasil-go/util"
 )

-//go:embed assets/*
-var f embed.FS
-
 type MetaCfg struct {
 	ServerName            string   `ini:"server_name"`
 	ImplementationName    string   `ini:"implementation_name"`
@@ -52,6 +48,23 @@ type MetaCfg struct {
 	SkinRootUrl           string   `ini:"skin_root_url"`
 }

+type ServerCfg struct {
+	ServerAddress  string   `ini:"server_address"`
+	TrustedProxies []string `ini:"trusted_proxies"`
+}
+
+type SmtpCfg struct {
+	SmtpServer            string `ini:"smtp_server"`
+	SmtpPort              int    `ini:"smtp_port"`
+	SmtpSsl               bool   `ini:"smtp_ssl"`
+	EmailFrom             string `ini:"email_from"`
+	SmtpUser              string `ini:"smtp_user"`
+	SmtpPassword          string `ini:"smtp_password"`
+	TitlePrefix           string `ini:"title_prefix"`
+	RegisterTemplate      string `ini:"register_template"`
+	ResetPasswordTemplate string `ini:"reset_password_template"`
+}
+
 func main() {
 	configFilePath := "config.ini"
 	cfg, err := ini.LooseLoad(configFilePath)
@@ -61,7 +74,7 @@ func main() {
 	meta := MetaCfg{
 		ServerName:            "A Mojang Yggdrasil Server",
 		ImplementationName:    "go-yggdrasil-server",
-		ImplementationVersion: "v0.1",
+		ImplementationVersion: "v0.0.1",
 		SkinDomains:           []string{".example.com", "localhost"},
 		SkinRootUrl:           "http://localhost:8080",
 	}
@@ -80,19 +93,45 @@ func main() {
 	pathSection := cfg.Section("paths")
 	privateKeyPath := pathSection.Key("private_key_file").MustString("private.pem")
 	publicKeyPath := pathSection.Key("public_key_file").MustString("public.pem")
-	address := cfg.Section("server").Key("server_address").MustString(":8080")
+	serverCfg := ServerCfg{
+		ServerAddress: ":8080",
+		TrustedProxies: []string{
+			"127.0.0.0/8",
+			"10.0.0.0/8",
+			"192.168.0.0/16",
+			"172.16.0.0/12",
+		},
+	}
+	err = cfg.Section("server").MapTo(&serverCfg)
+	if err != nil {
+		log.Fatal("无法读取配置文件", err)
+	}
+	smtpCfg := SmtpCfg{
+		SmtpServer:            "localhost",
+		SmtpPort:              25,
+		SmtpSsl:               false,
+		EmailFrom:             "Go Yggdrasil Server <mc@example.com>",
+		SmtpUser:              "mc@example.com",
+		SmtpPassword:          "123456",
+		TitlePrefix:           "[A Mojang Yggdrasil Server]",
+		RegisterTemplate:      "请访问下面的链接进行验证: <pre>" + meta.SkinRootUrl + "/profile/#emailVerifyToken={{.AccessToken}}</pre>",
+		ResetPasswordTemplate: "请访问下面的链接进行密码重置: <pre>" + meta.SkinRootUrl + "/profile/resetPassword#passwordResetToken={{.AccessToken}}</pre>",
+	}
+	err = cfg.Section("smtp").MapTo(&smtpCfg)
 	_, err = os.Stat(configFilePath)
 	if err != nil && os.IsNotExist(err) {
 		log.Println("配置文件不存在，已使用默认配置")
 		_ = cfg.Section("meta").ReflectFrom(&meta)
 		_ = cfg.Section("database").ReflectFrom(&dbCfg)
+		_ = cfg.Section("server").ReflectFrom(&serverCfg)
+		_ = cfg.Section("smtp").ReflectFrom(&smtpCfg)
 		err = cfg.SaveToIndent(configFilePath, " ")
 		if err != nil {
 			log.Println("警告: 无法保存配置文件", err)
 		}
 	}
 	checkRsaKeyFile(privateKeyPath, publicKeyPath)
-	publicKeyContent, err := ioutil.ReadFile(publicKeyPath)
+	publicKeyContent, err := os.ReadFile(publicKeyPath)
 	if err != nil {
 		log.Fatal("无法读取公钥内容", err)
 	}
@@ -112,19 +151,36 @@ func main() {
 	serverMeta.Meta.ImplementationVersion = meta.ImplementationVersion
 	serverMeta.Meta.FeatureNoMojangNamespace = true
 	serverMeta.Meta.FeatureEnableProfileKey = true
-	serverMeta.Meta.Links.Homepage = meta.SkinRootUrl + "/profile/user.html"
-	serverMeta.Meta.Links.Register = meta.SkinRootUrl + "/profile/index.html"
+	serverMeta.Meta.FeatureEnableMojangAntiFeatures = true
+	serverMeta.Meta.Links.Homepage = meta.SkinRootUrl + "/profile/"
+	serverMeta.Meta.Links.Register = meta.SkinRootUrl + "/profile/"
 	serverMeta.SkinDomains = meta.SkinDomains
 	serverMeta.SignaturePublickey = string(publicKeyContent)
 	r := gin.Default()
-	router.InitRouters(r, db, &serverMeta, meta.SkinRootUrl)
-	assetsFs, err := fs.Sub(f, "assets")
+	err = r.SetTrustedProxies(serverCfg.TrustedProxies)
 	if err != nil {
 		log.Fatal(err)
 	}
-	r.StaticFS("/profile", http.FS(assetsFs))
+	smtpConfig := service.SmtpConfig{
+		SmtpServer:            smtpCfg.SmtpServer,
+		SmtpPort:              smtpCfg.SmtpPort,
+		SmtpSsl:               smtpCfg.SmtpSsl,
+		EmailFrom:             smtpCfg.EmailFrom,
+		SmtpUser:              smtpCfg.SmtpUser,
+		SmtpPassword:          smtpCfg.SmtpPassword,
+		TitlePrefix:           smtpCfg.TitlePrefix,
+		RegisterTemplate:      smtpCfg.RegisterTemplate,
+		ResetPasswordTemplate: smtpCfg.ResetPasswordTemplate,
+	}
+	router.InitRouters(r, db, &serverMeta, &smtpConfig, meta.SkinRootUrl)
+	r.Static("/profile", "assets")
+	r.NoRoute(func(c *gin.Context) {
+		if strings.HasPrefix(c.Request.URL.Path, "/profile/") {
+			c.File("assets/index.html")
+		}
+	})
 	srv := &http.Server{
-		Addr:    address,
+		Addr:    serverCfg.ServerAddress,
 		Handler: r,
 	}
 	go func() {
--- a/model/reg_token.go
+++ b/model/reg_token.go
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2025. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package model
+
+import (
+	"time"
+	"yggdrasil-go/util"
+)
+
+type RegToken struct {
+	createAt    int64
+	AccessToken string
+	Email       string
+}
+
+func NewRegToken(email string) (this RegToken) {
+	this.Email = email
+	this.AccessToken = util.RandomUUID()
+	this.createAt = time.Now().UnixMilli()
+	return this
+}
+
+func (t *RegToken) IsValid() bool {
+	d := time.Now().Sub(time.UnixMilli(t.createAt))
+	return d < 10*time.Minute
+}
--- a/model/user.go
+++ b/model/user.go
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
+ * Copyright (C) 2022-2025. Gardel <sunxinao@hotmail.com> and contributors
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
@@ -30,6 +30,7 @@ type User struct {
 	UpdatedAt          time.Time
 	Email              string   `gorm:"size:64;uniqueIndex:email_idx"`
 	Password           string   `gorm:"size:255"`
+	EmailVerified      bool     `gorm:"default:false"`
 	ProfileName        string   `gorm:"size:64;uniqueIndex:profile_name_idx"`
 	ProfileModelType   string   `gorm:"size:8;default:STEVE"`
 	SerializedTextures string   `gorm:"type:TEXT NULL"`
--- a/router/home_router.go
+++ b/router/home_router.go
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
+ * Copyright (C) 2022-2025. Gardel <sunxinao@hotmail.com> and contributors
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
@@ -18,8 +18,11 @@
 package router

 import (
+	"encoding/base64"
+	"encoding/pem"
 	"github.com/gin-gonic/gin"
 	"net/http"
+	"yggdrasil-go/util"
 )

 type MetaInfo struct {
@@ -34,6 +37,7 @@ type MetaInfo struct {
 	FeatureLegacySkinApi            bool `json:"feature.legacy_skin_api,omitempty"`
 	FeatureNoMojangNamespace        bool `json:"feature.no_mojang_namespace,omitempty"`
 	FeatureEnableProfileKey         bool `json:"feature.enable_profile_key,omitempty"`
+	FeatureEnableMojangAntiFeatures bool `json:"feature.enable_mojang_anti_features,omitempty"`
 }

 type ServerMeta struct {
@@ -42,17 +46,32 @@ type ServerMeta struct {
 	SignaturePublickey string   `json:"signaturePublickey"`
 }

+type KeyPair struct {
+	PrivateKey string `json:"privateKey,omitempty"`
+	PublicKey  string `json:"publicKey,omitempty"`
+}
+
+type PublicKeys struct {
+	ProfilePropertyKeys   []KeyPair `json:"profilePropertyKeys,omitempty"`
+	PlayerCertificateKeys []KeyPair `json:"playerCertificateKeys,omitempty"`
+}
+
 type HomeRouter interface {
 	Home(c *gin.Context)
+	PublicKeys(c *gin.Context)
 }

 type homeRouterImpl struct {
 	serverMeta   ServerMeta
+	myPubKey     KeyPair
+	cachedPubKey *PublicKeys
 }

 func NewHomeRouter(meta *ServerMeta) HomeRouter {
+	signaturePubKey, _ := pem.Decode([]byte(meta.SignaturePublickey))
 	homeRouter := homeRouterImpl{
 		serverMeta: *meta,
+		myPubKey:   KeyPair{PublicKey: base64.StdEncoding.EncodeToString(signaturePubKey.Bytes)},
 	}
 	return &homeRouter
 }
@@ -61,3 +80,20 @@ func NewHomeRouter(meta *ServerMeta) HomeRouter {
 func (h *homeRouterImpl) Home(c *gin.Context) {
 	c.JSON(http.StatusOK, h.serverMeta)
 }
+
+func (h *homeRouterImpl) PublicKeys(c *gin.Context) {
+	if h.cachedPubKey != nil {
+		c.JSON(http.StatusOK, h.cachedPubKey)
+		return
+	}
+	publicKeys := PublicKeys{}
+	err := util.GetObject("https://api.minecraftservices.com/publickeys", &publicKeys)
+	if err != nil {
+		util.HandleError(c, err)
+		return
+	}
+	publicKeys.ProfilePropertyKeys = append(publicKeys.ProfilePropertyKeys, h.myPubKey)
+	publicKeys.PlayerCertificateKeys = append(publicKeys.PlayerCertificateKeys, h.myPubKey)
+	c.JSON(http.StatusOK, publicKeys)
+	h.cachedPubKey = &publicKeys
+}
--- a/router/init.go
+++ b/router/init.go
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
+ * Copyright (C) 2022-2025. Gardel <sunxinao@hotmail.com> and contributors
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
@@ -25,11 +25,7 @@ import (
 	"yggdrasil-go/service"
 )

-func InitRouters(router *gin.Engine, db *gorm.DB, meta *ServerMeta, skinRootUrl string) {
-	err := router.SetTrustedProxies([]string{"127.0.0.1"})
-	if err != nil {
-		panic(err)
-	}
+func InitRouters(router *gin.Engine, db *gorm.DB, meta *ServerMeta, smtpCfg *service.SmtpConfig, skinRootUrl string) {
 	router.Use(cors.New(cors.Config{
 		AllowAllOrigins:  true,
 		AllowMethods:     []string{"GET", "POST", "PUT", "DELETE", "HEAD"},
@@ -40,7 +36,8 @@ func InitRouters(router *gin.Engine, db *gorm.DB, meta *ServerMeta, skinRootUrl
 	}))

 	tokenService := service.NewTokenService()
-	userService := service.NewUserService(tokenService, db)
+	regTokenService := service.NewRegTokenService(smtpCfg)
+	userService := service.NewUserService(tokenService, regTokenService, db)
 	sessionService := service.NewSessionService(tokenService)
 	textureService := service.NewTextureService(tokenService, db)
 	homeRouter := NewHomeRouter(meta)
@@ -50,6 +47,7 @@ func InitRouters(router *gin.Engine, db *gorm.DB, meta *ServerMeta, skinRootUrl

 	router.GET("/", homeRouter.Home)
 	router.HEAD("/", homeRouter.Home)
+	router.GET("/yggdrasil", homeRouter.Home)
 	authserver := router.Group("/authserver")
 	{
 		authserver.POST("/register", userRouter.Register)
@@ -59,6 +57,9 @@ func InitRouters(router *gin.Engine, db *gorm.DB, meta *ServerMeta, skinRootUrl
 		authserver.POST("/validate", userRouter.Validate)
 		authserver.POST("/invalidate", userRouter.Invalidate)
 		authserver.POST("/signout", userRouter.Signout)
+		authserver.POST("/sendEmail", userRouter.SendEmail)
+		authserver.GET("/verifyEmail", userRouter.VerifyEmail)
+		authserver.POST("/resetPassword", userRouter.ResetPassword)
 	}
 	router.GET("/users/profiles/minecraft/:username", userRouter.UsernameToUUID)
 	sessionserver := router.Group("/sessionserver/session/minecraft")
@@ -76,5 +77,14 @@ func InitRouters(router *gin.Engine, db *gorm.DB, meta *ServerMeta, skinRootUrl
 		api.DELETE("/user/profile/:uuid/:textureType", textureRouter.DeleteTexture)
 		api.GET("/users/profiles/minecraft/:username", userRouter.UsernameToUUID)
 	}
-	router.POST("/minecraftservices/player/certificates", userRouter.ProfileKey)
+	minecraftservices := router.Group("/minecraftservices")
+	{
+		minecraftservices.GET("/player/attributes", userRouter.PlayerAttributes)
+		minecraftservices.GET("/privacy/blocklist", userRouter.PlayerBlockList)
+		minecraftservices.POST("/player/certificates", userRouter.ProfileKey)
+		minecraftservices.GET("/publickeys", homeRouter.PublicKeys)
+		minecraftservices.GET("/minecraft/profile/lookup/:uuid", userRouter.UUIDToUUID)
+		minecraftservices.GET("/minecraft/profile/lookup/name/:username", userRouter.UsernameToUUID)
+		minecraftservices.POST("/minecraft/profile/lookup/bulk/byname", userRouter.QueryUUIDs)
+	}
 }
--- a/router/user_router.go
+++ b/router/user_router.go
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
+ * Copyright (C) 2022-2025. Gardel <sunxinao@hotmail.com> and contributors
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
@@ -35,9 +35,15 @@ type UserRouter interface {
 	Invalidate(c *gin.Context)
 	Signout(c *gin.Context)
 	UsernameToUUID(c *gin.Context)
+	UUIDToUUID(c *gin.Context)
 	QueryUUIDs(c *gin.Context)
 	QueryProfile(c *gin.Context)
+	PlayerAttributes(c *gin.Context)
+	PlayerBlockList(c *gin.Context)
 	ProfileKey(c *gin.Context)
+	SendEmail(c *gin.Context)
+	VerifyEmail(c *gin.Context)
+	ResetPassword(c *gin.Context)
 }

 type userRouterImpl struct {
@@ -109,6 +115,17 @@ type SignoutRequest struct {
 	Password string `json:"password" binding:"required"`
 }

+type SendEmailRequest struct {
+	Email     string `json:"email" binding:"required,email"`
+	EmailType string `json:"emailType" binding:"required"`
+}
+
+type PasswordResetRequest struct {
+	Email       string `json:"email" binding:"required,email"`
+	Password    string `json:"password" binding:"required"`
+	AccessToken string `json:"accessToken" binding:"required"`
+}
+
 func (u *userRouterImpl) Register(c *gin.Context) {
 	request := RegRequest{}
 	err := c.ShouldBindJSON(&request)
@@ -116,7 +133,7 @@ func (u *userRouterImpl) Register(c *gin.Context) {
 		c.AbortWithStatusJSON(http.StatusForbidden, util.NewForbiddenOperationError(err.Error()))
 		return
 	}
-	response, err := u.userService.Register(request.Username, request.Password, request.ProfileName)
+	response, err := u.userService.Register(request.Username, request.Password, request.ProfileName, c.ClientIP())
 	if err != nil {
 		util.HandleError(c, err)
 		return
@@ -228,6 +245,25 @@ func (u *userRouterImpl) UsernameToUUID(c *gin.Context) {
 	}
 }

+func (u *userRouterImpl) UUIDToUUID(c *gin.Context) {
+	profileIdStr := c.Param("uuid")
+	profileId, err := util.ToUUID(profileIdStr)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, util.NewIllegalArgumentError(err.Error()))
+		return
+	}
+	response, err := u.userService.UUIDToUUID(profileId)
+	if err != nil {
+		util.HandleError(c, err)
+		return
+	}
+	if response != nil {
+		c.JSON(http.StatusOK, response)
+	} else {
+		c.Status(http.StatusNoContent)
+	}
+}
+
 func (u *userRouterImpl) QueryUUIDs(c *gin.Context) {
 	var request []string
 	err := c.ShouldBindJSON(&request)
@@ -265,6 +301,37 @@ func (u *userRouterImpl) QueryProfile(c *gin.Context) {
 	c.JSON(http.StatusOK, response)
 }

+func (u *userRouterImpl) PlayerAttributes(c *gin.Context) {
+	c.JSON(http.StatusOK, gin.H{
+		"privileges": gin.H{
+			"onlineChat": gin.H{
+				"enabled": true,
+			},
+			"multiplayerServer": gin.H{
+				"enabled": true,
+			},
+			"multiplayerRealms": gin.H{
+				"enabled": false,
+			},
+			"telemetry": gin.H{
+				"enabled": false,
+			},
+			"optionalTelemetry": gin.H{
+				"enabled": false,
+			},
+		},
+		"profanityFilterPreferences": gin.H{
+			"profanityFilterOn": false,
+		},
+	})
+}
+
+func (u *userRouterImpl) PlayerBlockList(c *gin.Context) {
+	c.JSON(http.StatusOK, gin.H{
+		"blockedProfiles": []string{},
+	})
+}
+
 func (u *userRouterImpl) ProfileKey(c *gin.Context) {
 	bearerToken := c.GetHeader("Authorization")
 	if len(bearerToken) < 8 {
@@ -279,3 +346,54 @@ func (u *userRouterImpl) ProfileKey(c *gin.Context) {
 	}
 	c.JSON(http.StatusOK, response)
 }
+
+func (u *userRouterImpl) SendEmail(c *gin.Context) {
+	var request SendEmailRequest
+	err := c.ShouldBindJSON(&request)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, util.NewForbiddenOperationError(err.Error()))
+		return
+	}
+	var tokenType service.RegTokenType
+	switch request.EmailType {
+	case "register":
+		tokenType = service.RegisterToken
+	case "resetPassword":
+		tokenType = service.ResetPasswordToken
+	}
+	err = u.userService.SendEmail(request.Email, tokenType, c.ClientIP())
+	if err != nil {
+		util.HandleError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func (u *userRouterImpl) VerifyEmail(c *gin.Context) {
+	token, ok := c.GetQuery("access_token")
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusBadRequest, util.NewIllegalArgumentError("access_token is required"))
+		return
+	}
+	err := u.userService.VerifyEmail(token)
+	if err != nil {
+		util.HandleError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func (u *userRouterImpl) ResetPassword(c *gin.Context) {
+	var request PasswordResetRequest
+	err := c.ShouldBindJSON(&request)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, util.NewForbiddenOperationError(err.Error()))
+		return
+	}
+	err = u.userService.ResetPassword(request.Email, request.Password, request.AccessToken)
+	if err != nil {
+		util.HandleError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
--- a/service/reg_token_service.go
+++ b/service/reg_token_service.go
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2025. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package service
+
+import (
+	"bytes"
+	"fmt"
+	lru "github.com/hashicorp/golang-lru"
+	"github.com/wneessen/go-mail"
+	"text/template"
+	"yggdrasil-go/model"
+	"yggdrasil-go/util"
+)
+
+type RegTokenService interface {
+	SendTokenEmail(tokenType RegTokenType, email string) error
+	VerifyToken(accessToken string) (string, error)
+}
+
+type RegTokenType uint
+
+const (
+	RegisterToken RegTokenType = iota
+	ResetPasswordToken
+)
+
+type SmtpConfig struct {
+	SmtpServer            string
+	SmtpPort              int
+	SmtpSsl               bool
+	EmailFrom             string
+	SmtpUser              string
+	SmtpPassword          string
+	TitlePrefix           string
+	RegisterTemplate      string
+	ResetPasswordTemplate string
+}
+
+type regTokenServiceImpl struct {
+	tokenCache            *lru.Cache
+	smtpServer            string
+	smtpPort              int
+	smtpSsl               bool
+	smtpUser              string
+	smtpPassword          string
+	emailFrom             string
+	titlePrefix           string
+	registerTemplate      *template.Template
+	resetPasswordTemplate *template.Template
+}
+
+func NewRegTokenService(smtpCfg *SmtpConfig) RegTokenService {
+	cache, _ := lru.New(10000000)
+	impl := &regTokenServiceImpl{
+		tokenCache:            cache,
+		smtpServer:            smtpCfg.SmtpServer,
+		smtpPort:              smtpCfg.SmtpPort,
+		smtpSsl:               smtpCfg.SmtpSsl,
+		smtpUser:              smtpCfg.SmtpUser,
+		smtpPassword:          smtpCfg.SmtpPassword,
+		emailFrom:             smtpCfg.EmailFrom,
+		titlePrefix:           smtpCfg.TitlePrefix,
+		registerTemplate:      template.Must(template.New("register").Parse(smtpCfg.RegisterTemplate)),
+		resetPasswordTemplate: template.Must(template.New("resetPassword").Parse(smtpCfg.ResetPasswordTemplate)),
+	}
+	return impl
+}
+
+func (r *regTokenServiceImpl) SendTokenEmail(tokenType RegTokenType, email string) error {
+	token := model.NewRegToken(email)
+	r.tokenCache.Add(token.AccessToken, token)
+
+	var subject, body string
+	buf := bytes.Buffer{}
+	switch tokenType {
+	case RegisterToken:
+		subject = fmt.Sprintf("%s 注册验证码", r.titlePrefix)
+		if err := r.registerTemplate.Execute(&buf, token); err != nil {
+			return fmt.Errorf("execute registerTemplate error: %v", err)
+		}
+		body = buf.String()
+	case ResetPasswordToken:
+		subject = fmt.Sprintf("%s 重置密码验证码", r.titlePrefix)
+		if err := r.resetPasswordTemplate.Execute(&buf, token); err != nil {
+			return fmt.Errorf("execute resetPasswordTemplate error: %v", err)
+		}
+		body = buf.String()
+	default:
+		return fmt.Errorf("unknown token type")
+	}
+
+	message := mail.NewMsg()
+	if err := message.From(r.emailFrom); err != nil {
+		return fmt.Errorf("failed to set From address: %s", err)
+	}
+	if err := message.To(email); err != nil {
+		return fmt.Errorf("failed to set To address: %s", err)
+	}
+	message.Subject(subject)
+	message.SetBodyString(mail.TypeTextHTML, body)
+	client, err := mail.NewClient(r.smtpServer, mail.WithPort(r.smtpPort), mail.WithSMTPAuth(mail.SMTPAuthPlain),
+		mail.WithUsername(r.smtpUser), mail.WithPassword(r.smtpPassword))
+	if err != nil {
+		return fmt.Errorf("failed to create mail client: %s", err)
+	}
+	if r.smtpSsl {
+		client.SetSSL(true)
+	}
+	if err := client.DialAndSend(message); err != nil {
+		return fmt.Errorf("failed to send mail: %s", err)
+	}
+	return nil
+}
+
+func (r *regTokenServiceImpl) VerifyToken(accessToken string) (string, error) {
+	token, ok := r.tokenCache.Get(accessToken)
+	if !ok {
+		return "", util.NewIllegalArgumentError(util.MessageInvalidToken)
+	}
+
+	if regToken, ok := token.(model.RegToken); ok {
+		if regToken.IsValid() {
+			r.tokenCache.Remove(accessToken)
+			return regToken.Email, nil
+		}
+	}
+
+	return "", util.NewIllegalArgumentError("wrong access token or email")
+}
--- a/service/user_service.go
+++ b/service/user_service.go
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022. Gardel <sunxinao@hotmail.com> and contributors
+ * Copyright (C) 2022-2025. Gardel <sunxinao@hotmail.com> and contributors
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
@@ -39,7 +39,7 @@ import (
 )

 type UserService interface {
-	Register(username string, password string, profileName string) (*model.UserResponse, error)
+	Register(username, password, profileName, ip string) (*model.UserResponse, error)
 	Login(username string, password string, clientToken *string, requestUser bool) (*LoginResponse, error)
 	ChangeProfile(accessToken string, clientToken *string, changeTo string) error
 	Refresh(accessToken string, clientToken *string, requestUser bool, selectedProfile *model.ProfileResponse) (*LoginResponse, error)
@@ -47,9 +47,13 @@ type UserService interface {
 	Invalidate(accessToken string) error
 	Signout(username string, password string) error
 	UsernameToUUID(username string) (*model.ProfileResponse, error)
+	UUIDToUUID(profileId uuid.UUID) (*model.ProfileResponse, error)
 	QueryUUIDs(usernames []string) ([]model.ProfileResponse, error)
 	QueryProfile(profileId uuid.UUID, unsigned bool, textureBaseUrl string) (map[string]interface{}, error)
 	ProfileKey(accessToken string) (*ProfileKeyResponse, error)
+	SendEmail(email string, tokenType RegTokenType, ip string) error
+	VerifyEmail(accessToken string) error
+	ResetPassword(email string, password string, accessToken string) error
 }

 type LoginResponse struct {
@@ -75,18 +79,20 @@ type ProfileKeyPair struct {

 type userServiceImpl struct {
 	tokenService    TokenService
+	regTokenService RegTokenService
 	db              *gorm.DB
 	limitLruCache   *lru.Cache
 	profileKeyCache *lru.Cache
 	keyPairCh       chan ProfileKeyPair
 }

-func NewUserService(tokenService TokenService, db *gorm.DB) UserService {
+func NewUserService(tokenService TokenService, regTokenService RegTokenService, db *gorm.DB) UserService {
 	cache0, _ := lru.New(10000)
 	cache1, _ := lru.New(10000)
 	ch := make(chan ProfileKeyPair, 100)
 	userService := userServiceImpl{
 		tokenService:    tokenService,
+		regTokenService: regTokenService,
 		db:              db,
 		limitLruCache:   cache0,
 		profileKeyCache: cache1,
@@ -96,7 +102,7 @@ func NewUserService(tokenService TokenService, db *gorm.DB) UserService {
 	return &userService
 }

-func (u *userServiceImpl) Register(username string, password string, profileName string) (*model.UserResponse, error) {
+func (u *userServiceImpl) Register(username, password, profileName, ip string) (*model.UserResponse, error) {
 	var count int64
 	if err := u.db.Table("users").Where("email = ?", username).Count(&count).Error; err != nil {
 		return nil, err
@@ -112,7 +118,7 @@ func (u *userServiceImpl) Register(username string, password string, profileName
 	} else if _, err := mojangUsernameToUUID(profileName); err == nil {
 		return nil, util.NewForbiddenOperationError("profileName duplicate")
 	}
-	matched, err := regexp.MatchString("^(\\w){3,}(\\.\\w+)*@(\\w){2,}((\\.\\w+)+)$", username)
+	matched, err := regexp.MatchString("^\\w+@(\\w){2,}((\\.\\w+)+)$", username)
 	if err != nil {
 		return nil, err
 	}
@@ -134,6 +140,7 @@ func (u *userServiceImpl) Register(username string, password string, profileName
 	if err := u.db.Create(&user).Error; err != nil {
 		return nil, err
 	}
+	_ = u.SendEmail(user.Email, RegisterToken, ip)
 	response := user.ToResponse()
 	return &response, nil
 }
@@ -155,6 +162,9 @@ func (u *userServiceImpl) Login(username string, password string, clientToken *s
 	user := model.User{}
 	if err := u.db.Where("email = ?", username).First(&user).Error; err == nil {
 		if bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)) == nil {
+			if !user.EmailVerified {
+				return nil, util.NewForbiddenOperationError("Email not verified")
+			}
 			var useClientToken string
 			if clientToken == nil || *clientToken == "" {
 				useClientToken = util.RandomUUID()
@@ -178,29 +188,11 @@ func (u *userServiceImpl) Login(username string, password string, clientToken *s
 				response.User = &userResponse
 			}
 			return &response, nil
-		} else {
+		}
+	}
+
 	return nil, util.NewForbiddenOperationError(util.MessageInvalidCredentials)
 }
-	} else {
-		data := map[string]interface{}{
-			"agent": map[string]interface{}{
-				"name":    "Minecraft",
-				"version": 1,
-			},
-			"username":    username,
-			"password":    password,
-			"clientToken": password,
-			"requestUser": requestUser,
-		}
-		loginResponse := LoginResponse{}
-		err := util.PostObject("https://authserver.mojang.com/authenticate", data, &loginResponse)
-		if err != nil {
-			return nil, err
-		} else {
-			return &loginResponse, nil
-		}
-	}
-}

 func (u *userServiceImpl) ChangeProfile(accessToken string, clientToken *string, changeTo string) error {
 	if u.tokenService.VerifyToken(accessToken, clientToken) != model.Valid {
@@ -270,57 +262,25 @@ func (u *userServiceImpl) Refresh(accessToken string, clientToken *string, reque
 		}
 		return &response, nil
 	} else {
-		data := map[string]interface{}{
-			"accessToken":     accessToken,
-			"clientToken":     clientToken,
-			"requestUser":     requestUser,
-			"selectedProfile": selectedProfile,
-		}
-		loginResponse := LoginResponse{}
-		err := util.PostObject("https://authserver.mojang.com/refresh", data, &loginResponse)
-		if err != nil {
-			return nil, err
-		} else {
-			return &loginResponse, nil
-		}
+		return nil, util.NewForbiddenOperationError(util.MessageInvalidToken)
 	}
 }

 func (u *userServiceImpl) Validate(accessToken string, clientToken *string) error {
-	if len(accessToken) <= 36 {
-		if u.tokenService.VerifyToken(accessToken, clientToken) != model.Valid {
+	if len(accessToken) <= 36 && u.tokenService.VerifyToken(accessToken, clientToken) == model.Valid {
+		return nil
+	} else {
 		return util.NewForbiddenOperationError(util.MessageInvalidToken)
-		} else {
-			return nil
-		}
-	} else {
-		data := map[string]interface{}{
-			"accessToken": accessToken,
-			"clientToken": clientToken,
-		}
-		err := util.PostObjectForError("https://authserver.mojang.com/validate", data)
-		if err != nil {
-			return err
-		} else {
-			return nil
-		}
 	}
 }

 func (u *userServiceImpl) Invalidate(accessToken string) error {
 	if len(accessToken) <= 36 {
 		u.tokenService.RemoveAccessToken(accessToken)
-	} else {
-		data := map[string]interface{}{
-			"accessToken": accessToken,
-		}
-		err := util.PostObjectForError("https://authserver.mojang.com/invalidate", data)
-		if err != nil {
-			return err
-		}
-	}
 		return nil
 	}
+	return util.NewForbiddenOperationError(util.MessageInvalidToken)
+}

 func (u *userServiceImpl) Signout(username string, password string) error {
 	if !u.allowUser(username) {
@@ -335,22 +295,10 @@ func (u *userServiceImpl) Signout(username string, password string) error {
 		if bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)) == nil {
 			u.tokenService.RemoveAll(user.ID)
 			return nil
-		} else {
+		}
+	}
 	return util.NewForbiddenOperationError(util.MessageInvalidCredentials)
 }
-	} else {
-		data := map[string]interface{}{
-			"username": username,
-			"password": password,
-		}
-		err := util.PostObjectForError("https://authserver.mojang.com/signout", data)
-		if err != nil {
-			return err
-		} else {
-			return nil
-		}
-	}
-}

 func (u *userServiceImpl) UsernameToUUID(username string) (*model.ProfileResponse, error) {
 	user := model.User{}
@@ -369,6 +317,23 @@ func (u *userServiceImpl) UsernameToUUID(username string) (*model.ProfileRespons
 	}
 }

+func (u *userServiceImpl) UUIDToUUID(profileId uuid.UUID) (*model.ProfileResponse, error) {
+	user := model.User{}
+	if result := u.db.First(&user, profileId); result.Error == nil {
+		return &model.ProfileResponse{
+			Name: user.ProfileName,
+			Id:   util.UnsignedString(user.ID),
+		}, nil
+	} else {
+		response, err := mojangUUIDToUUID(util.UnsignedString(profileId))
+		if err != nil {
+			return nil, nil
+		} else {
+			return &response, nil
+		}
+	}
+}
+
 func (u *userServiceImpl) QueryUUIDs(usernames []string) ([]model.ProfileResponse, error) {
 	var users []model.User
 	var names []string
@@ -377,13 +342,27 @@ func (u *userServiceImpl) QueryUUIDs(usernames []string) ([]model.ProfileRespons
 	} else {
 		names = usernames
 	}
-	var responses = make([]model.ProfileResponse, 0)
+	responses := make([]model.ProfileResponse, 0)
+	notFoundUsers := make([]string, 0)
+	foundUsernames := make(map[string]bool)
 	if err := u.db.Table("users").Where("profile_name in ?", names).Find(&users).Error; err == nil {
 		for _, user := range users {
 			responses = append(responses, model.ProfileResponse{
 				Name: user.ProfileName,
 				Id:   util.UnsignedString(user.ID),
 			})
+			foundUsernames[user.ProfileName] = true
+		}
+		for _, name := range names {
+			if !foundUsernames[name] {
+				notFoundUsers = append(notFoundUsers, name)
+			}
+		}
+	}
+	if len(notFoundUsers) > 0 {
+		mojangResponses, _ := mojangUsernamesToUUIDs(notFoundUsers)
+		for _, resp := range mojangResponses {
+			responses = append(responses, resp)
 		}
 	}
 	return responses, nil
@@ -415,12 +394,24 @@ func (u *userServiceImpl) QueryProfile(profileId uuid.UUID, unsigned bool, textu

 func (u *userServiceImpl) ProfileKey(accessToken string) (resp *ProfileKeyResponse, err error) {
 	token, ok := u.tokenService.GetToken(accessToken)
+	var profileId uuid.UUID
 	if ok && token.GetAvailableLevel() == model.Valid {
+		profileId = token.SelectedProfile.Id
+	} else {
+		id, _, err := util.ParseOfficialToken(accessToken)
+		if err != nil {
+			return nil, err
+		}
+		profileId, err = util.ToUUID(id)
+		if err != nil {
+			return nil, err
+		}
+	}
 	resp = new(ProfileKeyResponse)
 	now := time.Now().UTC()
 	resp.RefreshedAfter = now
-		resp.ExpiresAt = now.Add(time.Hour * 24 * 90)
-		keyPair, err := u.getProfileKey(token.SelectedProfile.Id)
+	resp.ExpiresAt = now.Add(90 * 24 * time.Hour)
+	keyPair, err := u.getProfileKey(profileId)
 	if err != nil {
 		return nil, err
 	}
@@ -432,15 +423,69 @@ func (u *userServiceImpl) ProfileKey(accessToken string) (resp *ProfileKeyRespon
 	}
 	resp.PublicKeySignature = sign
 	resp.PublicKeySignatureV2 = sign
-	} else {
-		err = util.PostForString("https://api.minecraftservices.com/player/certificates", accessToken, []byte(""), resp)
-		if err != nil {
-			return nil, err
-		}
-	}
 	return resp, nil
 }

+func (u *userServiceImpl) SendEmail(email string, tokenType RegTokenType, ip string) error {
+	if !u.allowEmail("ip:"+ip) || !u.allowEmail("email:"+email) {
+		return util.YggdrasilError{
+			Status:       http.StatusTooManyRequests,
+			ErrorCode:    "ForbiddenOperationException",
+			ErrorMessage: "Forbidden",
+		}
+	}
+	var count int64
+	if err := u.db.Table("users").Where("email = ?", email).Count(&count).Error; err != nil {
+		return util.NewIllegalArgumentError(err.Error())
+	}
+	if count == 0 {
+		return util.NewForbiddenOperationError("user not found")
+	}
+	return u.regTokenService.SendTokenEmail(tokenType, email)
+}
+
+func (u *userServiceImpl) VerifyEmail(accessToken string) error {
+	email, err := u.regTokenService.VerifyToken(accessToken)
+	if err != nil {
+		return err
+	}
+
+	user := model.User{}
+	err = u.db.Where("email = ?", email).First(&user).Error
+	if err != nil {
+		return util.NewIllegalArgumentError("user not found")
+	}
+
+	user.EmailVerified = true
+	return u.db.Model(&user).Update("email_verified", user.EmailVerified).Error
+}
+
+func (u *userServiceImpl) ResetPassword(email string, password string, accessToken string) error {
+	user := model.User{}
+	err := u.db.Where("email = ?", email).First(&user).Error
+	if err != nil {
+		return util.NewIllegalArgumentError("user not found")
+	}
+	tokenEmail, err := u.regTokenService.VerifyToken(accessToken)
+	if err != nil {
+		return err
+	}
+	if tokenEmail != email {
+		return util.NewIllegalArgumentError("email invalid")
+	}
+
+	if len(password) < 6 {
+		return util.NewIllegalArgumentError("bad format(password longer than 5)")
+	}
+	hashedPass, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	user.Password = string(hashedPass)
+	user.EmailVerified = true
+	return u.db.Model(&user).Updates(model.User{
+		EmailVerified: user.EmailVerified,
+		Password:      user.Password,
+	}).Error
+}
+
 func (u *userServiceImpl) allowUser(username string) bool {
 	if value, ok := u.limitLruCache.Get(username); ok {
 		if limiter, ok := value.(*rate.Limiter); ok {
@@ -455,6 +500,20 @@ func (u *userServiceImpl) allowUser(username string) bool {
 	return true
 }

+func (u *userServiceImpl) allowEmail(key string) bool {
+	if value, ok := u.limitLruCache.Get(key); ok {
+		if limiter, ok := value.(*rate.Limiter); ok {
+			return limiter.Allow()
+		} else {
+			u.limitLruCache.Remove(key)
+		}
+	} else {
+		limiter := rate.NewLimiter(0.02, 1)
+		u.limitLruCache.Add(key, limiter)
+	}
+	return true
+}
+
 func (u *userServiceImpl) getProfileKey(profileId uuid.UUID) (*ProfileKeyPair, error) {
 	if value, ok := u.profileKeyCache.Get(profileId); ok {
 		if keyPair, ok := value.(*ProfileKeyPair); ok {
@@ -501,7 +560,7 @@ func (u *userServiceImpl) genKeyPair() {

 func mojangUsernameToUUID(username string) (model.ProfileResponse, error) {
 	response := model.ProfileResponse{}
-	reqUrl := fmt.Sprintf("https://api.mojang.com/users/profiles/minecraft/%s", url.PathEscape(username))
+	reqUrl := fmt.Sprintf("https://api.minecraftservices.com/minecraft/profile/lookup/name/%s", url.PathEscape(username))
 	err := util.GetObject(reqUrl, &response)
 	if err != nil {
 		return response, err
@@ -509,3 +568,24 @@ func mojangUsernameToUUID(username string) (model.ProfileResponse, error) {
 		return response, nil
 	}
 }
+
+func mojangUUIDToUUID(uid string) (model.ProfileResponse, error) {
+	response := model.ProfileResponse{}
+	reqUrl := fmt.Sprintf("https://api.minecraftservices.com/minecraft/profile/lookup/%s", uid)
+	err := util.GetObject(reqUrl, &response)
+	if err != nil {
+		return response, err
+	} else {
+		return response, nil
+	}
+}
+
+func mojangUsernamesToUUIDs(username []string) ([]model.ProfileResponse, error) {
+	response := make([]model.ProfileResponse, 0)
+	err := util.PostObject("https://api.minecraftservices.com/minecraft/profile/lookup/bulk/byname", username, &response)
+	if err != nil {
+		return response, err
+	} else {
+		return response, nil
+	}
+}
--- a/util/token_utils.go
+++ b/util/token_utils.go
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2025. Gardel <sunxinao@hotmail.com> and contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package util
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"strings"
+)
+
+type officialTokenPayload struct {
+	Xuid     string        `json:"xuid"`
+	Agg      string        `json:"agg"`
+	Sub      string        `json:"sub"`
+	Auth     string        `json:"auth"`
+	Ns       string        `json:"ns"`
+	Roles    []interface{} `json:"roles"`
+	Iss      string        `json:"iss"`
+	Flags    []string      `json:"flags"`
+	Profiles struct {
+		Mc string `json:"mc"`
+	} `json:"profiles"`
+	Platform string `json:"platform"`
+	Pfd      []struct {
+		Type string `json:"type"`
+		Id   string `json:"id"`
+		Name string `json:"name"`
+	} `json:"pfd"`
+	Nbf int `json:"nbf"`
+	Exp int `json:"exp"`
+	Iat int `json:"iat"`
+}
+
+func ParseOfficialToken(token string) (id, name string, err error) {
+	firstDot := strings.IndexRune(token, '.')
+	if firstDot == -1 {
+		return id, name, errors.New("invalid token")
+	}
+	secondDot := 1 + firstDot + strings.IndexRune(token[firstDot+1:], '.')
+	if secondDot == -1 {
+		return id, name, errors.New("invalid token")
+	}
+	jsonBase64 := token[firstDot+1 : secondDot]
+	jsonDecoded, err := base64.RawURLEncoding.DecodeString(jsonBase64)
+	if err != nil {
+		return id, name, err
+	}
+	payload := officialTokenPayload{}
+	err = json.Unmarshal(jsonDecoded, &payload)
+	if err != nil {
+		return id, name, err
+	}
+	if payload.Pfd == nil || len(payload.Pfd) == 0 {
+		return id, name, errors.New("invalid token")
+	}
+	id = payload.Pfd[0].Id
+	name = payload.Pfd[0].Name
+	return id, name, nil
+}
Author	SHA1	Message	Date
Gardel	26ad821bc0	feat: 添加 gitea 构建脚本 All checks were successful Build and Push Docker Image / build-and-push (push) Successful in 4m56s Details	2025-09-01 01:24:04 +08:00
Gardel	9f0ebe81e3	fix: 修复接口响应	2025-09-01 01:23:43 +08:00
Gardel	67cd6cb3cf	feat: 添加 blocklist 接口	2025-09-01 00:26:26 +08:00
Gardel	22fd87a07a	fix: 调整邮箱正则	2025-07-15 23:13:27 +08:00
Gardel	1d825c97f3	feat: 调整过期时间	2025-06-19 22:45:10 +08:00
Gardel	044cd3082e	feat: 代理全部类型账户的 ProfileKey	2025-06-19 01:12:19 +08:00
Gardel	e7c4dc58b7	feat: 添加公钥缓存功能	2025-06-05 02:25:03 +08:00
Gardel	2722e85a6a	fix: 修复证书问题	2025-06-01 20:51:06 +08:00
Gardel	dcec80c184	fix: 修复 docker 无法启动	2025-06-01 19:30:42 +08:00
Gardel	016dfaf14d	fix: 修复聊天签名验证失败问题	2025-06-01 16:56:41 +08:00
Gardel	b8487b766b	fix: 修复前端资源丢失问题	2025-05-15 19:23:34 +08:00
Gardel	a537906a17	feat: 添加 anti-feature 功能	2025-04-26 14:26:48 +08:00
Gardel	81d81b8a03	doc: 添加依赖说明和下一步计划	2025-03-30 23:30:11 +08:00
Gardel	f6ac467265	feat: password reset support Some checks failed Release / build (push) Failing after 3m38s Details	2025-03-30 22:22:24 +08:00
Gardel	128cdcee52	feat: support additional /publickeys endpoint	2023-10-06 16:11:57 +08:00
Gardel	5a9e73d4f2	add missing assets	2023-09-27 23:41:34 +08:00
Gardel	a77942621e	分离静态文件	2023-09-27 23:41:18 +08:00
Gardel	e032f86503	升级版本 Some checks failed Release / build (push) Has been cancelled Details	2023-02-03 02:05:09 +08:00
Gardel	3c6d8df6d6	前端重构	2023-02-03 02:02:11 +08:00
Gardel	2fdff3cb33	Remove proxy login support	2023-02-03 01:35:50 +08:00
Gardel	13b303ea3f	Support reverse proxy's real IP header	2023-02-03 01:35:39 +08:00