Using only the currently logged in nodebb user and minecraft player.
Two routes needed:
Server-only route: POST route. Requires a unique key parameter. Only the forum and the minecraft server know the key. e.g. /mc/link?key=key User route: GET route. Used to link accounts, requires a UUID and a unique player key. e.g. /mc/link/:uuid/:keyMinimum two DB keys need:
{uuid}:key String key, stores the unique player key for the UUID. (Could also be a hash to store additional data.) user:{uid}:uuid String key, stores the UUID linked to the user. (Could also be stored on the user hash, or made into a set for multiple linkings.) Process: Minecraft player types a command. Server users server-only route to tell the forum it needs a registration link. Sending the unique key to verify the request is valid. Forum creates a unique player key and stores it in the DB, then sends the player key to the server. Server gives a link to the player, using the unique player key and the players' UUID. User visits link, if the user is logged in, and the uuid-key pair matches what is already in the DB, then the accounts are linked, using additional DB entries. The player key is deleted. Concerns: The player key should expire relatively quickly, like 5 minutes. Invalid requests to the user route should be monitored and blocked after a low threshold, like 3 tries. NodeBB middleware already validates the logged in user, which is why we do no additional checks. Note:On the last line in the diagram, I send a confirmation message, but we can't actually do this because we have not established a persistent connection. You could solve this by either having an http server on the server, or creating a socket connection to the forum.
Or you could use Minecraft-Integration 😉
