MeowMC

/meow panel

/meow panel on
/meow panel off
/meow panel status

Permission: bukkit.command.meowmc.panel.

panel is the on/off switch for MeowMC's web admin surface. Turning it on starts a loopback-only HTTP service on this server and prints, in the console, the one URL an operator opens in a browser.

The pairing flow

The panel uses two-factor pairing — something the operator sees (the console-printed path), something the console proves (an 8-digit code):

  1. /meow panel on prints the URL — a random 26-character path under the service, case-sensitive, and a deadline: the panel stays open for six hours, then turns itself off. It also prints the bind (127.0.0.1:31972 by default) and the current state.
  2. Open the URL (on this machine, behind the web panel's gateway) and press Confirm. The console answers with the request and a 2-minute, single-use 8-digit code, printed only there — never on the web side.
  3. Type the code into the page. A matching code issues a session cookie + a CSRF token, valid for 30 minutes, absolute (it does not slide on activity — when it ends, you pair again).
  4. /meow panel off revokes every session and unbinds the listener the same second. Nothing remains listening.
Panel opened for 6h at https://meowmc.org/panel/5GFBGQF5BH6GBAWWBPNZZSCCQW
Open that URL in a browser, press Confirm, then enter the code shown here.
Panel auto-closes after 6h. Run /meow panel off to close it now.
/meow panel on — the console is the only channel the URL is printed to. After Confirm, the same console answers:
[MeowMC] Panel pairing code: 6078 8871
The eight digits are printed only on the console, only after a browser has pressed Confirm — the web side never sees them.

/meow panel on again resets the six-hour clock and leaves the current path alone. A restart always turns the panel off — nothing about its state is written to disk.

Default off

The panel ships off. Nothing binds a port, writes a log or runs a thread until an operator runs /meow panel on from the console — and off means the listener is not bound at all, not "listening but refusing". The audit log is created lazily, at the first panel on.

Every state transition — on, confirm requested, code issued, login failure (with the attempt count), login, revocation, expiry, auto-off — is written to logs/panel-audit.log one line each. The pairing code itself never reaches the audit log.

What is in the jar, and what is not

/meow panel on|off|status, the loopback HTTP service, the pairing flow, the session store, CSRF issue and verify, the attempt caps, the 30-minute absolute session, the 6-hour auto-off and the audit log are in the jar. The browser UI behind them is not — the gateway, the console, the config editor, the players and worlds tabs (see the web panel page). The keys meowmc.panel.port, meowmc.panel.bind and meowmc.panel.allow-remote are proposed constants, not config keys yet.

Rules worth knowing

  • Loopback only. The service binds 127.0.0.1 by default; remote binds are off and gated on the same key as the port. The browser-facing URL comes through the panel's gateway on the domain, not from the jar.
  • Wrong answers are cheap, and they are capped. Five bad codes on one pairing path burn it; Confirm is rate-limited to three per minute per path; oversized bodies are refused before parsing; every answer is a fixed string — no error repeats your input back to you.
  • One session, one role. v1 has the one operator role; no tiers, no per-tab permissions.
  • A code answers once. Replaying a consumed code is refused even with the correct digits; the failed-attempt counter is per pairing path.