DonutOrders is a standalone buy-order marketplace plugin for Paper and Folia servers running Minecraft 1.20+. Players can post orders for items they want to buy, escrow the required funds automatically, and let other players fulfill those orders for instant payment. No chest shops and no admin-created marketplace are required — everything is handled through a clean GUI with Vault-compatible economy integration.
Features
| Feature | Description |
|---|---|
| Player Buy Orders | Players can create public buy orders for allowed materials with custom quantities and prices |
| Escrow System | Funds are withdrawn when an order is created so buyers cannot spend money already committed to an order |
| Marketplace Browser | Sellers can browse active orders through a clean paginated GUI |
| Instant Seller Payments | Sellers receive payment immediately when valid items are delivered |
| Partial Order Fills | Orders can be fulfilled gradually by one or multiple deliveries |
| Virtual Stash | Purchased items are stored safely until the buyer is ready to collect them |
| Vault Economy Support | Works with Vault-compatible economy plugins such as EssentialsX, CMI, and other supported providers |
| Configurable Tax | Optional seller payout tax can be used as an economy sink |
| SQLite & HikariCP | Persistent local SQLite storage with HikariCP connection management |
| Paper & Folia Support | Designed for modern Paper and Folia servers with region-aware scheduling |
| Async Database Operations | Database reads and writes are handled asynchronously to avoid blocking server threads |
| Customizable Experience | Configure order limits, expiry duration, allowed materials, messages, colors, and marketplace behavior |
How It Works
DonutOrders creates a player-driven marketplace centered around buy orders rather than traditional chest shops or item listings.
The process is simple:
- Buyer opens
/orders, selects New Order, chooses an item, and enters the quantity and price-per-unit through chat prompts. - The required funds are immediately placed into escrow.
- Sellers browse active orders, select one, and deliver matching items through the delivery GUI.
- Sellers are paid instantly for accepted items.
- Purchased items are stored in the buyer's personal stash until collected.
- Unfilled orders expire automatically after the configured duration, refunding any remaining escrow balance.
Buyer Experience
Buyers can create and manage orders directly through the GUI.
Buyer Features
- Post buy orders for materials allowed by the server
- Choose the desired quantity
- Set a price per item
- Track Active, Completed, Expired, and Cancelled orders
- View order progress and remaining quantity
- Cancel active orders
- Receive exact refunds for unspent escrow funds
- Collect delivered items from a personal virtual stash
- Keep delivered items safe even when the player's inventory is full
When collecting stash items, anything that cannot fit in the player's inventory is safely dropped at their feet.
Seller Experience
Sellers can browse active demand across the server and fulfill orders without creating their own shop.
Seller Features
- Browse all active orders in a paginated marketplace
- Select an order to view its requirements
- Deliver items through a dedicated 45-slot input GUI
- Receive payment per accepted item
- Partially fulfill orders
- Deliver only as much as they want
- Automatically receive excess items back
- Receive immediate feedback when an incompatible item is inserted
The delivery interface only accepts the material requested by the selected order.
Escrow & Economy
DonutOrders integrates with Vault and a compatible economy provider.
When a buyer creates an order, the required funds are withdrawn immediately and reserved for that order.
This provides:
- Reliable seller payouts
- Protection against buyers spending committed funds
- Exact cancellation refunds
- Exact expiry refunds
- Per-item seller payments
- Optional configurable seller tax
- Support for common Vault-compatible economy providers
The optional tax is disabled by default and can be used as an economy sink when enabled.
Order Management
Orders move through several states during their lifecycle.
Order States
- Active — Available for sellers to fulfill
- Completed — Requested quantity has been fully delivered
- Expired — Order reached its configured expiry time
- Cancelled — Buyer manually cancelled the order
Buyers can view order details, progress, price, expiry information, and stash status from the GUI.
Virtual Stash
Delivered items do not require the buyer to be online or have free inventory space.
Instead, DonutOrders stores purchased items in a personal virtual stash.
The stash system provides:
- Safe server-side item storage
- Collection at the buyer's convenience
- Protection when the player's inventory is full
- Overflow handling during collection
- Persistent access to items from completed or partially fulfilled orders
Marketplace GUI
DonutOrders uses inventory-based interfaces to keep marketplace interaction simple.
| Screen | Purpose |
|---|---|
| Your Orders | View personal buy orders, status, stash, and cancellation options |
| New Order | Choose an item and begin creating a new buy order |
| Browse Market | Browse active orders posted by players |
| Deliver Items | Place requested items into a 45-slot delivery grid |
| Confirm Delivery | Review items before completing a delivery |
| Order Detail | View progress, price, expiry, and collection options |
| Collect Stash | Collect delivered items stored for the buyer |
Performance & Safety
DonutOrders is designed around modern server performance and safe marketplace transactions.
The plugin includes:
- Asynchronous database reads and writes
- Region-aware Folia scheduling
- Main-thread-safe Paper operation
- Server-side delivery serialization
- Anti-duplication protection
- Safe excess-item returns
- Escrow-backed transactions
- Persistent SQLite storage
- HikariCP connection management
- Shaded and relocated dependencies to reduce plugin conflicts
Concurrent delivery attempts against the same order are serialized server-side to help prevent duplication and transaction conflicts.
Configuration
DonutOrders can be customized for different server economies and marketplace styles.
Configurable options include:
- Maximum active orders per player
- Default order expiry duration
- Seller tax percentage
- SQLite database filename
- Allowed materials
- Player-facing messages
- GUI text
- Color formatting
All player-facing strings are stored in messages.yml and support traditional & color codes as well as #RRGGBB hex colors.
Example configuration:
orders:
max-per-player: 10
default-expiry-days: 7
tax-percent: 0.0
database:
filename: donutorders.db
allowed-materials:
- DIAMOND
- EMERALD
- GOLD_INGOT
- IRON_INGOT
- NETHERITE_INGOT
- COAL
- LAPIS_LAZULI
- REDSTONE
- QUARTZ
- AMETHYST_SHARD
- GLOWSTONE_DUST
- BLAZE_ROD
- ENDER_PEARL
- GHAST_TEAR
- NETHER_STAR
- ELYTRA
- TOTEM_OF_UNDYING
- SHULKER_SHELL
- HEART_OF_THE_SEA
- TRIDENT
- OAK_LOG
Commands
| Command | Description | Permission |
|---|---|---|
/orders |
Open the orders interface. Aliases: /order, /market |
donutorders.use |
/orders admin reload |
Reload config.yml and messages.yml without restarting the server |
donutorders.admin |
Permissions
| Permission | Default | Description |
|---|---|---|
donutorders.use |
Everyone | Access /orders and the marketplace GUI |
donutorders.admin |
OP | Access DonutOrders administrative commands |
Installation
- Place
DonutOrders-1.0.0.jarinside your server'splugins/directory. - Install Vault and a compatible economy plugin.
- Start the server.
- DonutOrders automatically generates
config.ymlandmessages.yml. - Configure your allowed materials, limits, expiry duration, and other options.
- Run
/orders admin reloadafter making configuration changes.
Why Choose DonutOrders?
- Player-Driven Economy — Players create real demand by posting exactly what they want to purchase.
- No Chest Shops — The entire marketplace works through clean inventory interfaces.
- Secure Escrow — Money is reserved when an order is created, providing reliable payments and refunds.
- Flexible Fulfillment — Sellers can completely or partially fill orders and receive payment immediately.
- Safe Item Storage — The virtual stash keeps delivered items secure until buyers collect them.
- Modern Performance — Async storage and Folia-aware scheduling help keep marketplace activity away from critical server threads.
- Highly Configurable — Server owners control tradeable materials, order limits, expiry, taxes, and messages.
Compatibility
- Paper 1.20+
- Folia 1.20+
- Java 17+
- Vault
- Vault-compatible economy providers
- EssentialsX Economy
- CMI Economy
- SQLite
- Standard Paper servers
- Folia regionized servers
Requirements
DonutOrders requires a supported Paper or Folia Minecraft server running version 1.20 or newer.
Required dependencies:
- Java 17+
- Vault
- A Vault-compatible economy plugin
No external database is required because SQLite is supported out of the box.
Community & Support
- Discord: https://discord.gg/TJc3CxR4jK
- GitHub: https://github.com/MeherBenSalem
- Website: https://nightbeam.dev
- Store: https://nightbeam.dev/store
- CurseForge: https://www.curseforge.com/members/nightbeamstudio/projects
- Modrinth: https://modrinth.com/organization/nightbeam
If you encounter a bug or have a feature request, please join the Discord community or report it through the appropriate project page.
License
DonutOrders is licensed under the Apache License 2.0.
You are free to use, modify, and redistribute DonutOrders in accordance with the terms of the Apache License 2.0.
All Versions
+ Add Version## 1.9.2
- Added Minecraft **26.3** support (Paper / Folia / Spigot / Purpur); existing 1.20.6, 1.21.x, 26.1.x, and 26.2 support is unchanged
- Compiled against Paper API
26.3.build.49-alpha(latest published 26.3 API jar);plugin.ymlapi-versionstays1.20so older servers still load - Tested against Paper 26.3 build #133 (ALPHA), Paper 26.2 build #129, and Paper 1.20.6 build #151
## 1.9.1
- Fixed delivery item duplication when cancelling after proceeding from the deliver-items box (GitHub #5): cancel and GUI close no longer both return the same snapshot
- Delivery items are returned exactly once on cancel, ESC-close, disconnect, death, and plugin disable; double-click confirm/cancel cannot duplicate or lose the box contents
## 1.9.0
- Split commands:
/order(your active orders),/order history,/orders(public market),/orderadmin(reload, history, simulate) - Order history GUI for completed, expired, cancelled, and claimed orders
/orderadmin reloadworks from console; admin history view for any player
## 1.8.1
- New-order chat input (amount, price, cancel keyword) now reads Paper's Adventure chat event so integers are accepted on 1.20.1–26.2
- Amount/price parsing ignores color codes and commas; whole values like
64.0work - Folia no longer treats a retired entity callback as cancel while you are typing a number
## 1.8.0
- Added bStats metrics (plugin ID **33559**)
- Hardened Modrinth update check for [donut-orders](https://modrinth.com/plugin/donut-orders): pick newest release by date, strip version suffixes, warn in console, notify
donutorders.adminon join (update-check.notify-ops-on-join) - Confirmed support matrix: Bukkit / Spigot / Paper / Purpur / Folia on Minecraft **1.20.1–26.2**
- Relicensed to Apache-2.0; added OSS contributor docs; removed committed build/AI clutter
## 1.7.0
- New-order chat broadcast to other online players (
orders.broadcast-on-create,order-created-broadcast) - Folia-safe: recipients messaged on their entity thread
## 1.6.1
- Fixed empty enchanted-book Select Enchant picker on modern Paper
- Enchant list cache clears on
/orders admin reload
## 1.6.0
- MySQL storage backend and cross-server order sync
updated_attracking and optimistic updates to reduce duplicate payouts
## 1.5.1
- Folia enable crash fix (
runAsync/ scheduler hardening)
## 1.5.0
- Enchanted book orders, VIP order limits, New Order item search
## 1.3.1
- Fixed New Order picker Previous page always returning to page 1
## 1.9.1
- Fixed delivery item duplication when cancelling after proceeding from the deliver-items box (GitHub #5): cancel and GUI close no longer both return the same snapshot
- Delivery items are returned exactly once on cancel, ESC-close, disconnect, death, and plugin disable; double-click confirm/cancel cannot duplicate or lose the box contents
## 1.9.0
- Split commands:
/order(your active orders),/order history,/orders(public market),/orderadmin(reload, history, simulate) - Order history GUI for completed, expired, cancelled, and claimed orders
/orderadmin reloadworks from console; admin history view for any player
## 1.8.1
- New-order chat input (amount, price, cancel keyword) now reads Paper's Adventure chat event so integers are accepted on 1.20.1–26.2
- Amount/price parsing ignores color codes and commas; whole values like
64.0work - Folia no longer treats a retired entity callback as cancel while you are typing a number
## 1.8.0
- Added bStats metrics (plugin ID **33559**)
- Hardened Modrinth update check for [donut-orders](https://modrinth.com/plugin/donut-orders): pick newest release by date, strip version suffixes, warn in console, notify
donutorders.adminon join (update-check.notify-ops-on-join) - Confirmed support matrix: Bukkit / Spigot / Paper / Purpur / Folia on Minecraft **1.20.1–26.2**
- Relicensed to Apache-2.0; added OSS contributor docs; removed committed build/AI clutter
## 1.7.0
- New-order chat broadcast to other online players (
orders.broadcast-on-create,order-created-broadcast) - Folia-safe: recipients messaged on their entity thread
## 1.6.1
- Fixed empty enchanted-book Select Enchant picker on modern Paper
- Enchant list cache clears on
/orders admin reload
## 1.6.0
- MySQL storage backend and cross-server order sync
updated_attracking and optimistic updates to reduce duplicate payouts
## 1.5.1
- Folia enable crash fix (
runAsync/ scheduler hardening)
## 1.5.0
- Enchanted book orders, VIP order limits, New Order item search
## 1.3.1
- Fixed New Order picker Previous page always returning to page 1
- Split commands:
/order(your active orders),/order history,/orders(public market),/orderadmin(reload, history, simulate) - Order history GUI for completed, expired, cancelled, and claimed orders
/orderadmin reloadworks from console; admin history view for any player
### New Features
- None.
### Improvements
- Order creation chat input uses Paper Adventure
AsyncChatEvent(legacy Bukkit chat still used when that event is absent). - Amount and price parsing accepts trimmed values, commas, and whole decimals such as
64.0. - The
chat-cancel-keywordfrommessages.ymlis matched after stripping color codes.
### Bug Fixes
- Typing an amount or price (or the cancel keyword) while creating an order is no longer ignored on modern Paper/Folia.
### Configuration
- No config schema change. Existing
chat-cancel-keywordstill applies.
### Compatibility
- Paper and Folia, Minecraft 1.20.1 through 26.2, Java 17.
### Upgrade Notes
1. Replace the jar. Keep
plugins/DonutOrders/ config and data.2. Restart, open
/orders, create an order, type a whole number for amount then a price.## 1.8.0
- Added bStats metrics (plugin ID **33559**)
- Hardened Modrinth update check for [donut-orders](https://modrinth.com/plugin/donut-orders): pick newest release by date, strip version suffixes, warn in console, notify
donutorders.adminon join (update-check.notify-ops-on-join) - Confirmed support matrix: Bukkit / Spigot / Paper / Purpur / Folia on Minecraft **1.20.1–26.2**
- Relicensed to Apache-2.0; added OSS contributor docs; removed committed build/AI clutter
## 1.7.0
- New-order chat broadcast to other online players (
orders.broadcast-on-create,order-created-broadcast) - Folia-safe: recipients messaged on their entity thread
## 1.6.1
- Fixed empty enchanted-book Select Enchant picker on modern Paper
- Enchant list cache clears on
/orders admin reload
## 1.6.0
- MySQL storage backend and cross-server order sync
updated_attracking and optimistic updates to reduce duplicate payouts
## 1.5.1
- Folia enable crash fix (
runAsync/ scheduler hardening)
## 1.5.0
- Enchanted book orders, VIP order limits, New Order item search
## 1.3.1
- Fixed New Order picker Previous page always returning to page 1
### New Features
- New-order chat broadcast** — when a player creates a buy order, all other online players see a chat announce (item, amount, price). The creator still gets the private
order-createdconfirmation only.
### Configuration
orders.broadcast-on-create(defaulttrue) — set tofalseto disable the public announce.order-created-broadcastinmessages.yml—{0}buyer,{1}item,{2}amount,{3}price per item. Missing keys fall back to jar defaults on/orders admin reload.
### Compatibility
- Same loaders as 1.6.1 (Paper / Folia / Purpur family). Folia-safe: each recipient is messaged on their entity thread.
### Upgrade Notes
1. Replace the DonutOrders jar with **1.7.0**. Keep your existing
plugins/DonutOrders/ folder.2. Optional: add
broadcast-on-create: true under orders: in config.yml, and order-created-broadcast to messages.yml, then /orders admin reload. If you skip this, in-code / jar defaults still enable the announce.3. Confirm by creating an order on one account and checking chat on another.
### Bug Fixes
- Empty enchant picker** — New Order → Enchanted Book no longer opens an empty Select Enchant GUI. Modern Paper returns
falsefromEnchantment#canEnchantItemfor enchanted books; the picker now builds the list via stored-enchant checks so vanilla (and storeable) enchants appear again.
### Improvements
- Enchant list cache clears on
/orders admin reload.
### Compatibility
- Same loaders as 1.6.0 (Paper / Folia / Purpur family). Drop-in jar replace.
### Upgrade Notes
1. Replace the DonutOrders jar with **1.6.1**.
2. Restart or use your preferred hot-swap flow, then open New Order → Enchanted Book to confirm the enchant list populates.
### Bug Fixes
- Empty enchant picker** — New Order → Enchanted Book no longer opens an empty Select Enchant GUI. Modern Paper returns
falsefromEnchantment#canEnchantItemfor enchanted books; the picker now builds the list via stored-enchant checks so vanilla (and storeable) enchants appear again.
### Improvements
- Enchant list cache clears on
/orders admin reload.
### Compatibility
- Same loaders as 1.6.0 (Paper / Folia / Purpur family). Drop-in jar replace.
### Upgrade Notes
1. Replace the DonutOrders jar with **1.6.1**.
2. Restart or use your preferred hot-swap flow, then open New Order → Enchanted Book to confirm the enchant list populates.
### New Features
- MySQL storage backend** — set
database.type: mysqlinconfig.ymlso multiple servers share one database - Cross-server order sync** — orders created or fulfilled on one server appear on all servers sharing the MySQL database (polls every
database.sync-interval-seconds, default 5)
### Improvements
updated_atcolumn on orders for change tracking and safe multi-server merges- Optimistic DB updates on fulfill/collect prevent duplicate payouts when two servers race
- Critical paths refresh the order from the database before mutating
### Bug Fixes
- None
### Configuration
``
yaml
database:
type: mysql # sqlite (default) or mysql
sync-interval-seconds: 5
mysql:
host: localhost
port: 3306
database: donutorders
username: donutorders
password: ""
pool-size: 10
`
### Compatibility
- SQLite remains the default — no config change required for single-server setups
- Existing SQLite databases auto-migrate (
updated_at column added on startup)Drop-in jar replacement; restart all network servers after switching to MySQL
### Upgrade Notes
1. For cross-server: create a MySQL database, grant access, set database.type: mysql on every server
2. Replace the jar with DonutOrders-1.6.0.jar on all servers
3. Restart servers — console should show (MySQL backend) when configured correctly
4. Verify an order placed on server A appears in /orders` on server B within a few seconds### New Features
- None
### Improvements
- Folia async scheduling hardened —
runAsyncalways uses Paper'sAsyncScheduleron regionalised servers; legacyBukkitSchedulerasync calls are never used on Folia - Startup load falls back to synchronous DB read if async scheduling is unavailable, then continues enable on the global thread
- Scheduled task failures are logged instead of crashing the server thread
### Bug Fixes
- Fixed **Folia enable crash** (
UnsupportedOperationExceptionfromCraftScheduler.runTaskAsynchronouslyduringStorageManager.loadAll) on Folia 1.21.x - All scheduler entry points (
runAtEntity,runGlobal,runGlobalRepeating,runAsync, etc.) now catchUnsupportedOperationExceptionand route to the correct Paper/Folia scheduler as a safety net
### Configuration
- None
### Compatibility
- Drop-in update from 1.5.0 (and older 1.3.x / 1.4.x builds still on broken Folia async scheduling)
folia-supported: trueunchanged inplugin.yml- No database migration required
- Tested build target: Paper/Folia 1.20.6+ API; runtime tested on JDK 21
### Upgrade Notes
1. Replace the jar with
DonutOrders-1.5.1.jar2. Restart the server (recommended over hot-reload for scheduler changes)
3. Confirm console shows
Folia detected — using regionised schedulers. followed by Enabled successfully with no UnsupportedOperationException4. Run
/orders on a Folia 1.21.4 server to verify the marketplace opens### New Features
- Enchanted book orders** — New Order → Enchanted Book opens an enchant picker, then a level picker (Sharpness, Efficiency, Unbreaking, and other vanilla book enchants). Listings show names like
Sharpness V Enchanted Book; sellers must deliver the exact enchanted book - VIP order limits** — per-rank and per-permission active order caps via
OrderLimitManager(wired into order creation, join/quit cache, LuckPerms updates, and PlaceholderAPI) - Item search in New Order picker** — compass button opens a chat search; filter persists across pagination; clear-search button when a filter is active
### Improvements
/orders admin reloadrefreshes cached order limits for all online players- New Order GUI title shows the active search filter when filtering
- Order list / delivery / wrong-item messages use enchant-aware item names
### Configuration
ENCHANTED_BOOKadded to defaultitems.ymlallowed listorders.default-limit— default active order cap (default:2)orders.max-per-player— legacy alias kept in sync withdefault-limitrank-limits— per-LuckPerms-group caps (e.g.default: 2,vip: 5)- Optional permission override:
donutorders.limit.<n>(highest wins) - New
messages.ymlkeys for enchant picker and New Order search UI
### Compatibility
- Drop-in update from 1.3.x / 1.4.x
- Folia-supported unchanged
- No database migration required
- Soft-depends on **LuckPerms** and **PlaceholderAPI** (optional; features degrade gracefully when absent)
- Placeholder:
%donutorders_order_limit%
### Upgrade Notes
1. Replace the jar with
DonutOrders-1.5.0.jar2. Restart the server (or reload after reviewing config)
3. If upgrading an existing install, add
ENCHANTED_BOOK under allowed-items in items.yml, then /orders admin reload4. Review
config.yml — add or adjust rank-limits if you use VIP ranks:``
yaml
rank-limits:
default: 2
vip: 5
`
Or grant LuckPerms permission donutorders.limit.5 instead of/in addition to rank limits.
5. Ensure VIP players have LuckPerms group vip (maps to group.vip) or the permission node above.
6. Test /orders` → New Order → Enchanted Book + Search (compass), and confirm VIP players can hold more active orders than default.- New Order item picker Previous/Next now share the same Folia-safe open path
### Bug Fixes
- Fixed **Previous** in the New Order item picker always returning to page 1 instead of the previous page
- Full translation support for the entire player-facing interface via
messages.yml. - GUI titles, buttons, item names, lore, status labels, pagination text, chat prompts, success/error messages, and order expiry formatting are all configurable without recompiling.
- New
MessageHelpersystem with color codes (&and#RRGGBB), positional placeholders ({0},{1}, …), and named placeholders ({item},{buyer},{price}, etc.). - Translable chat cancel keyword via
chat-cancel-keyword(default:cancel).
### Improvements
- Missing translation keys safely fall back to English defaults shipped in the jar.
/orders admin reloadreloadsmessages.yml(and config) so translations update without a full restart.- Order cancel refund message now shows the correct refund amount.
### Configuration
- Expanded
plugins/DonutOrders/messages.ymlwith organized sections: general, chat, orders, delivery, collect, status, time, buttons, and all GUI screens. - Existing servers keep their current
messages.yml; new keys fall back to jar defaults until added or the file is regenerated.
- Fixed plugin failing to enable on Folia and Folia-based servers (e.g. Canvas) with
UnsupportedOperationExceptionduring async database load. - Async database I/O and network tasks now use Paper's
AsyncScheduleron Folia instead of the deprecated Bukkit async scheduler.
- Added Shulker Box delivery support — matching items inside shulkers count toward order fulfillment.
- Shulker contents are scanned from shulkers placed in the delivery GUI and from shulkers anywhere in the seller's inventory.
- Added
items.ymlfor configuring allowed order materials separately fromconfig.yml. - Added Modrinth update check on plugin startup (
update-check.enabledinconfig.yml). - Added
donutordersas a command alias for/orders.
### Improvements
- Allowed materials are validated server-side when creating orders (prevents GUI bypass).
- Invalid material names in
items.ymllog warnings instead of crashing the plugin. /orders admin reloadnow reloadsconfig.yml,messages.yml, anditems.yml.
- Added permission-based order limits via
donutorders.limit.<n>nodes (e.g.donutorders.limit.5,donutorders.limit.10). - Added support for rank-specific maximum active orders through optional
rank-limitsconfiguration. - Added PlaceholderAPI support:
%donutorders_order_limit%returns the player's currently applied limit. - Added
/orders limit <player>admin command (alias:/donutorders limit <player>).
### Improvements
- Added a caching system for permission-based limit lookups to avoid scanning permissions on every order creation.
- Limit cache refreshes automatically on player join, config reload, and LuckPerms permission recalculation.
- Order limit reached messages are now configurable via
messages.yml.
### Configuration
- Added
orders.default-limitas an optional config key (takes priority over legacyorders.max-per-playerwhen set). - Added optional
rank-limitsconfiguration section for group-based fallback limits. - Added
messages.order-limit-reachedwith%limit%and%active_orders%placeholders.
### Permissions
donutorders.admin.limit— allows use of/orders limit <player>.donutorders.limit.<n>— grants a custom maximum active order count.
- Fixed Fill Order GUI item movement issue
- Players can now manually move items into order fill slots
- Improved Bedrock / Pocket Edition compatibility
- Shift-click is no longer required to fill orders
- Protected GUI slots still block invalid interactions
- Kept server-side validation and anti-dupe protections intact
## Critical Security Patch
- Item Duplication Exploit Fixed**: Completely resolved a critical exploit where delayed or replayed
ClickSlotinventory packets could trigger order collection multiple times before the server-side database state could update. - WaterTight Concurrency Protections**:
- Implemented an atomic, in-memory compare-and-set claim lock (
tryLockClaim/unlockClaim) to guarantee that concurrent stash claims from replayed/spam packets fail immediately. - Added a state-based collection lifecycle: orders now transition to
PENDINGupon completion/cancellation/expiration and toCLAIMEDimmediately when collection starts in-memory, ensuring absolute claim idempotency. - Implemented automatic SQLite database schema migration (
claimed_byandclaimed_atcolumns) to persist claiming information and protect against exploits across server restarts or hot reloads. - Added tick-based packet rate-limiting at the listener level to reject rapid click spam (max 2 clicks per tick) and click replays targeting the exact same slot in a single tick.
## Improvements & Lifecycle Hardening
- Safe Expiry Flow**: Redesigned the order expiration checker to safely transition orders to
PENDING(pending collection) rather than performing immediate, unsafe synchronous refunds. Players can now safely retrieve their expired order refunds from their personal stash GUI at any time. - Thread-Safety & Folia Compatibility**: Guaranteed thread-safe SQLite operations by usingHikariCP WAL-mode queries dispatched asynchronously and synchronizing on player entity threads for Vault deposits and item insertions.
## Admin & Testing Command
- Concurrency Simulator**: Registered the
/orders admin simulatecommand (requiresdonutorders.adminpermission). This executes a live high-latency packet replay and concurrent race simulation in SQLite, spawning 10 concurrent threads racing to collect the exact same stash at the exact same millisecond. Reports back in chat showing exactly 1 successful claim and 9 rejections.
- Fixed a critical issue where items could duplicate when placing them in order slots
- Resolved a bug causing items to return to the sender while still being delivered to the receiver
- Improved inventory handling to prevent unintended item cloning
- Fixed items being silently lost when clicking Cancel in the delivery confirmation screen
- Fixed items being lost when pressing ESC to close the delivery confirmation screen
- init release