Update ALTITUDE_VERSION to 26.2 in constant.ts

WIP

.gitignore

@@ -90,3 +90,7 @@ frontend/src/api
 generated
 
 liquibase*.properties
+node
+
+.env
+virtual_view/*

backend/build.gradle.kts

@@ -2,7 +2,6 @@ plugins {
     java
     id("org.springframework.boot") version "3.4.4"
     id("io.spring.dependency-management") version "1.1.7"
-//    id("com.github.johnrengelman.shadow") version "8.1.1"
 }
 
 group = "com.alttd.altitudeweb"
@@ -27,14 +26,24 @@ repositories {
 dependencies {
     implementation(project(":open_api"))
     implementation(project(":database"))
-    implementation("org.springframework.boot:spring-boot-starter-web")
+    implementation(project(":frontend"))
+    implementation(project(":discord"))
     annotationProcessor("org.projectlombok:lombok")
-    testImplementation("org.springframework.boot:spring-boot-starter-test")
     implementation("com.mysql:mysql-connector-j:8.0.32")
     implementation("org.mybatis:mybatis:3.5.13")
-    testRuntimeOnly("org.junit.platform:junit-platform-launcher")
+    implementation("org.springframework.boot:spring-boot-starter-web")
     implementation("org.springframework.boot:spring-boot-configuration-processor")
     implementation("org.springframework.boot:spring-boot-starter-hateoas")
+    implementation("org.springframework.boot:spring-boot-starter-security")
+    implementation("org.springframework.security:spring-security-oauth2-resource-server")
+    implementation("org.springframework.security:spring-security-oauth2-jose")
+    implementation("org.springframework.boot:spring-boot-starter-mail:3.1.5")
+    implementation("org.springframework.boot:spring-boot-starter-thymeleaf")
+
+    //Open API
+    implementation("io.swagger.core.v3:swagger-annotations:2.2.37")
+    implementation("io.swagger.core.v3:swagger-models:2.2.37")
+    implementation("org.springframework.boot:spring-boot-starter-actuator")
 
     //AOP
     implementation("org.aspectj:aspectjrt:1.9.19")
@@ -42,6 +51,12 @@ dependencies {
     implementation("org.springframework:spring-aop")
     implementation("org.springframework:spring-aspects")
 
+    testRuntimeOnly("org.junit.platform:junit-platform-launcher")
+    testImplementation("org.springframework.boot:spring-boot-starter-test")
+}
+
+tasks.compileJava {
+    dependsOn(":frontend:npmBuild")
 }
 
 tasks.withType<Test> {
@@ -54,42 +69,14 @@ tasks.bootJar {
     archiveClassifier.set("")
 }
 
+tasks.processResources {
+    dependsOn("includeFrontend")
+}
 
-//tasks.withType<com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar> {
-//    mergeServiceFiles()
-//    dependencies {
-//        include(dependency("com.mysql:mysql-connector-j"))
-//    }
-//}
-
-//tasks.withType<com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar> {
-//    manifest {
-//        attributes["Main-Class"] = "com.alttd.altitudeweb.AltitudeWebApplication"
-//    }
-//    archiveBaseName.set("altitudeweb")
-//    archiveClassifier.set("")
-//    mergeServiceFiles()
-//
-//    // Include everything
-//    from(sourceSets.main.get().output)
-//
-//    // Include all project dependencies
-//    configurations = listOf(project.configurations.runtimeClasspath.get())
-//
-//    // Ensure MySQL is included (even though it should be part of runtimeClasspath already)
-//    dependencies {
-//        include(dependency("com.mysql:mysql-connector-j"))
-//    }
-//
-//    // Enable zip64 mode for large JARs
-//    isZip64 = true
-//}
-//
-//// Make the shadowJar task the default jar task
-//tasks.named("jar") {
-//    enabled = false
-//}
-//
-//tasks.named("assemble") {
-//    dependsOn("shadowJar")
-//}
+tasks.register<Copy>("includeFrontend") {
+    description = "Copy the built frontend to the Spring Boot static resources directory"
+    dependsOn(":frontend:npmBuild")
+    from("${project.rootDir}/frontend/dist")
+    into(layout.buildDirectory.dir("resources/main/static"))
+    doNotTrackState("Cannot reliably track state in the static directory")
+}

backend/src/main/java/com/alttd/altitudeweb/AltitudeWebApplication.java

@@ -4,14 +4,16 @@ import com.alttd.altitudeweb.setup.Connection;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.context.annotation.EnableAspectJAutoProxy;
+import org.springframework.scheduling.annotation.EnableScheduling;
 
-@SpringBootApplication
+@SpringBootApplication(scanBasePackages = {"com.alttd.altitudeweb"})
 @EnableAspectJAutoProxy
+@EnableScheduling
 public class AltitudeWebApplication {
 
     public static void main(String[] args) {
-        SpringApplication.run(AltitudeWebApplication.class, args);
         Connection.initDatabases();
+        SpringApplication.run(AltitudeWebApplication.class, args);
     }
 
 }

backend/src/main/java/com/alttd/altitudeweb/config/SecurityAuthFailureHandler.java

@@ -0,0 +1,36 @@
+package com.alttd.altitudeweb.config;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.access.AccessDeniedHandler;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+
+@Slf4j
+@Component
+public class SecurityAuthFailureHandler implements AccessDeniedHandler, AuthenticationEntryPoint {
+    
+    @Override
+    public void handle(HttpServletRequest request, HttpServletResponse response, 
+                      AccessDeniedException accessDeniedException) throws IOException {
+        log.warn("Access denied: User '{}' attempted to access '{}' without proper permissions",
+                  request.getUserPrincipal() != null ? request.getUserPrincipal().getName() : "unknown", 
+                  request.getRequestURI());
+        
+        response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied");
+    }
+    
+    @Override
+    public void commence(HttpServletRequest request, HttpServletResponse response, 
+                        AuthenticationException authException) throws IOException {
+        log.warn("Authentication failure: Unauthenticated user attempted to access secured endpoint '{}'",
+                  request.getRequestURI());
+        
+        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Authentication Required");
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/config/SecurityConfig.java

@@ -0,0 +1,159 @@
+package com.alttd.altitudeweb.config;
+
+import com.alttd.altitudeweb.controllers.login.KeyPairService;
+import com.alttd.altitudeweb.model.PermissionClaimDto;
+import com.nimbusds.jose.jwk.JWK;
+import com.nimbusds.jose.jwk.JWKSet;
+import com.nimbusds.jose.jwk.RSAKey;
+import com.nimbusds.jose.jwk.source.ImmutableJWKSet;
+import com.nimbusds.jose.jwk.source.JWKSource;
+import com.nimbusds.jose.proc.SecurityContext;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.oauth2.jwt.JwtDecoder;
+import org.springframework.security.oauth2.jwt.JwtEncoder;
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
+import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.access.expression.WebExpressionAuthorizationManager;
+
+import java.security.KeyPair;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.interfaces.RSAPublicKey;
+import java.util.*;
+import java.util.stream.Collectors;
+
+@Slf4j
+@Configuration
+@EnableWebSecurity
+@RequiredArgsConstructor
+public class SecurityConfig {
+
+    private final KeyPairService keyPairService;
+    private final SecurityAuthFailureHandler securityAuthFailureHandler;
+
+    @Value("${chat.allowed-ip}")
+    private String allowedIp;
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        WebExpressionAuthorizationManager allowedIpCheck = new WebExpressionAuthorizationManager(
+                "hasIpAddress('%s')".formatted(allowedIp));
+        return http
+                .authorizeHttpRequests(
+                        auth -> auth
+                                .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
+                                .requestMatchers("/api/chat/send/**").access(allowedIpCheck)
+                                .requestMatchers("/actuator/mappings").access(allowedIpCheck)
+                                .requestMatchers("/api/form/**").authenticated()
+                                .requestMatchers("/api/login/getUsername").authenticated()
+                                .requestMatchers("/api/mail/**").authenticated()
+                                .requestMatchers("/api/site/vote").authenticated()
+                                .requestMatchers("/api/appeal").authenticated()
+                                .requestMatchers(HttpMethod.POST, "/api/chat/hide").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
+                                .requestMatchers(HttpMethod.POST, "/api/chat/show").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
+                                .requestMatchers(HttpMethod.GET, "/api/chat/visibility").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
+                                .requestMatchers("/api/chat/read/**").hasAnyAuthority(PermissionClaimDto.HEAD_MOD.getValue(), PermissionClaimDto.MOD.getValue())
+                                .requestMatchers("/api/site/get-staff-playtime/**").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
+                                .requestMatchers("/api/head_mod/**").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
+                                .requestMatchers("/api/particles/**").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
+                                .requestMatchers("/api/files/save/**").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
+                                //TODO allow users access to their own folder
+                                .requestMatchers("/api/files/download/**").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
+                                .requestMatchers("/api/history/admin/**").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
+                                .requestMatchers("/api/login/userLogin/**").permitAll()
+                                .requestMatchers("/api/site/chat/**").authenticated()
+                                .requestMatchers("/api/site/chat/send-admin-chat/**").hasAnyAuthority(PermissionClaimDto.HEAD_MOD.getValue(), PermissionClaimDto.MOD.getValue())
+                                .requestMatchers("/api/site/chat/punish/**").hasAnyAuthority(PermissionClaimDto.HEAD_MOD.getValue(), PermissionClaimDto.MOD.getValue())
+                                .requestMatchers("/api/chat/server/send/**").permitAll()
+                                .anyRequest().permitAll()
+                )
+                .csrf(AbstractHttpConfigurer::disable)
+                .oauth2ResourceServer(
+                        oauth2 -> oauth2
+                                .jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthenticationConverter()))
+                                .authenticationEntryPoint(securityAuthFailureHandler)
+                                .accessDeniedHandler(securityAuthFailureHandler)
+                )
+                .exceptionHandling(
+                        ex -> ex
+                                .authenticationEntryPoint(securityAuthFailureHandler)
+                                .accessDeniedHandler(securityAuthFailureHandler)
+                )
+                .sessionManagement(
+                        session -> session
+                                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+                )
+                .build();
+    }
+
+    @Bean
+    public JwtEncoder jwtEncoder() {
+        KeyPair keyPair = keyPairService.getJwtSigningKeyPair();
+        JWK jwk = new RSAKey.Builder((RSAPublicKey) keyPair.getPublic())
+                .privateKey((RSAPrivateKey) keyPair.getPrivate())
+                .build();
+        JWKSource<SecurityContext> jwkSource = new ImmutableJWKSet<>(new JWKSet(jwk));
+        return new NimbusJwtEncoder(jwkSource);
+    }
+
+    @Bean
+    public JwtDecoder jwtDecoder() {
+        KeyPair keyPair = keyPairService.getJwtSigningKeyPair();
+        return NimbusJwtDecoder.withPublicKey((RSAPublicKey) keyPair.getPublic()).build();
+    }
+
+
+
+    @Bean
+    public JwtAuthenticationConverter jwtAuthenticationConverter() {
+        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
+        converter.setJwtGrantedAuthoritiesConverter(jwt -> {
+            Map<String, Object> claims = jwt.getClaims();
+
+            Object authoritiesClaim = claims.get("authorities");
+            if (authoritiesClaim instanceof List<?> authorities) {
+                Collection<GrantedAuthority> authorityList = authorities.stream()
+                        .map(Object::toString)
+                        .map(SimpleGrantedAuthority::new)
+                        .collect(Collectors.toList());
+                log.debug("Authorities found in authorities: {}", authorityList);
+                return authorityList;
+            }
+
+            Object scopeClaim = claims.get("scope");
+            if (scopeClaim instanceof String scopeString) {
+                Collection<GrantedAuthority> authorityList = Arrays.stream(scopeString.split(" "))
+                        .map(scope -> new SimpleGrantedAuthority("SCOPE_" + scope))
+                        .collect(Collectors.toList());
+                log.debug("Authorities found in authorities scope string: {}", authorityList);
+                return authorityList;
+            }
+
+            if (scopeClaim instanceof List<?> scopeList) {
+                Collection<GrantedAuthority> authorityList = scopeList.stream()
+                        .map(Object::toString)
+                        .map(scope -> new SimpleGrantedAuthority("SCOPE_" + scope))
+                        .collect(Collectors.toList());
+                log.debug("Authorities found in authorities scope list: {}", authorityList);
+                return authorityList;
+            }
+
+            log.debug("No granted authorities found");
+            return Collections.emptyList();
+        });
+        return converter;
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/config/WebConfig.java

@@ -0,0 +1,48 @@
+package com.alttd.altitudeweb.config;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import org.springframework.web.servlet.resource.PathResourceResolver;
+
+import java.io.IOException;
+
+@Slf4j @Configuration
+public class WebConfig implements WebMvcConfigurer {
+
+    @Override
+    public void addResourceHandlers(ResourceHandlerRegistry registry) {
+        registry.addResourceHandler("/**")
+                .addResourceLocations("classpath:/static/browser")
+                .resourceChain(true)
+                .addResolver(new PathResourceResolver() {
+                    @Override
+                    protected Resource getResource(String resourcePath, Resource location) throws IOException {
+                        Resource requestedResource = location.createRelative(resourcePath);
+
+                        if (requestedResource.exists() && requestedResource.isReadable()) {
+                            log.debug("Serving resource {} from {}", resourcePath, location);
+                            return requestedResource;
+                        }
+
+                        log.debug("Resource {} not found in {}, serving index.html", resourcePath, location);
+
+                        return new ClassPathResource("/static/browser/index.html");
+                    }
+                });
+    }
+
+    @Controller
+    public static class HomeController {
+        @GetMapping("/")
+        public String index() {
+            return "forward:/index.html";
+        }
+    }
+
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/CorsConfig.java

@@ -18,7 +18,7 @@ public class CorsConfig implements WebMvcConfigurer {
         log.info("Registering CORS mappings for {}", String.join(", ", allowedOrigins));
         registry.addMapping("/**")
                 .allowedOrigins(allowedOrigins)
-                .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
+                .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
                 .allowedHeaders("*")
                 .allowCredentials(true);
     }

backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ChatController.java

@@ -0,0 +1,60 @@
+package com.alttd.altitudeweb.controllers.chat;
+
+import com.alttd.altitudeweb.api.ChatApi;
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
+import com.alttd.altitudeweb.model.ChatMessageDto;
+import com.alttd.altitudeweb.model.PlayerListVisibilityDto;
+import com.alttd.altitudeweb.model.ServerStateDto;
+import com.alttd.altitudeweb.services.chat.ChatService;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.UUID;
+
+@Slf4j
+@RestController
+@RequiredArgsConstructor
+public class ChatController implements ChatApi {
+
+    private final ChatService chatService;
+    private final AuthenticatedUuid authenticatedUuid;
+
+    @Override
+    public ResponseEntity<Void> hideUserFromPlayerList() {
+        UUID uuid = authenticatedUuid.getAuthenticatedUserUuid();
+        chatService.hideUserFromPlayerList(uuid);
+        return new ResponseEntity<>(HttpStatus.NO_CONTENT);
+    }
+
+    @Override
+    public ResponseEntity<Void> showUserInPlayerList() {
+        UUID uuid = authenticatedUuid.getAuthenticatedUserUuid();
+        chatService.showUserInPlayerList(uuid);
+        return new ResponseEntity<>(HttpStatus.NO_CONTENT);
+    }
+
+    @Override
+    public ResponseEntity<PlayerListVisibilityDto> getPlayerListVisibility() {
+        UUID uuid = authenticatedUuid.getAuthenticatedUserUuid();
+        PlayerListVisibilityDto visibility = new PlayerListVisibilityDto()
+                .hidden(chatService.isUserHiddenFromPlayerList(uuid));
+        return ResponseEntity.ok(visibility);
+    }
+
+    @Override
+    public ResponseEntity<Void> sendChatMessages(List<ChatMessageDto> chatMessageDtoList) {
+        List<ChatMessage> list = chatMessageDtoList.stream().map(ChatMessageMapper::fromDto).toList();
+        chatService.addChatMessage(list);
+        return new ResponseEntity<>(HttpStatus.ACCEPTED);
+    }
+
+    @Override
+    public ResponseEntity<Void> updateServerStates(ServerStateDto serverStateDto) {
+        chatService.updateServerState(serverStateDto);
+        return new ResponseEntity<>(HttpStatus.ACCEPTED);
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ChatInfoController.java

@@ -0,0 +1,46 @@
+package com.alttd.altitudeweb.controllers.chat;
+
+import com.alttd.altitudeweb.api.ChatInfoApi;
+import com.alttd.altitudeweb.model.PartyNameDto;
+import com.alttd.altitudeweb.model.PlayerNameDto;
+import com.alttd.altitudeweb.services.chat.ChatInfoService;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.UUID;
+
+@Slf4j
+@RestController
+@RequiredArgsConstructor
+public class ChatInfoController implements ChatInfoApi {
+
+    private final ChatInfoService chatInfoService;
+
+    @Override
+    public ResponseEntity<PlayerNameDto> getName(UUID uuid) {
+        return chatInfoService.getPlayerName(uuid)
+                .map(ResponseEntity::ok)
+                .orElse(ResponseEntity.notFound().build());
+    }
+
+    @Override
+    public ResponseEntity<PartyNameDto> getPartyName(String id) {
+        int partyId;
+        try {
+            partyId = Integer.parseInt(id);
+        } catch (NumberFormatException e) {
+            return ResponseEntity.badRequest().build();
+        }
+        return chatInfoService.getPartyName(partyId)
+                .map(partyName -> {
+                    PartyNameDto partyNameDto = new PartyNameDto();
+                    partyNameDto.setName(partyName);
+                    return partyNameDto;
+                })
+                .map(ResponseEntity::ok)
+                .orElse(ResponseEntity.notFound().build());
+    }
+
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ChatMessage.java

@@ -0,0 +1,23 @@
+package com.alttd.altitudeweb.controllers.chat;
+
+import lombok.Builder;
+import lombok.Getter;
+import lombok.Setter;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Builder
+@Getter
+public class ChatMessage {
+
+    private final UUID uuid;
+    @Setter
+    private Instant timestamp;
+    private final String server;
+    private final ChatMessageType type;
+    private final String channel;
+    private final String receiver;
+    private final String messageJson;
+    private final boolean notBlocked;
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ChatMessageMapper.java

@@ -0,0 +1,77 @@
+package com.alttd.altitudeweb.controllers.chat;
+
+import com.alttd.altitudeweb.database.chat.ChatLogDao;
+import com.alttd.altitudeweb.model.ChatMessageDto;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
+import lombok.experimental.UtilityClass;
+
+import java.util.UUID;
+
+@UtilityClass
+public class ChatMessageMapper {
+    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper()
+            .registerModule(new JavaTimeModule())
+            .enable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
+            .disable(SerializationFeature.WRITE_DATE_TIMESTAMPS_AS_NANOSECONDS);
+
+    public static ChatMessage fromDto(ChatMessageDto dto) {
+        return ChatMessage.builder()
+                .uuid(dto.getUuid())
+                .timestamp(dto.getTimestamp().toInstant())
+                .server(dto.getServer())
+                .type(fromDto(dto.getType()))
+                .channel(dto.getChannel())
+                .receiver(dto.getReceiver())
+                .messageJson(dto.getMessage())
+                .notBlocked(!dto.getBlocked())
+                .build();
+    }
+
+    private static ChatMessageType fromDto(ChatMessageDto.TypeEnum type) {
+        return switch (type) {
+            case PUBLIC -> ChatMessageType.PUBLIC;
+            case GLOBAL -> ChatMessageType.GLOBAL;
+            case PARTY -> ChatMessageType.PARTY;
+            case GAC -> ChatMessageType.GAC;
+            case MSG -> ChatMessageType.MSG;
+            case CUSTOM -> ChatMessageType.CUSTOM;
+            case UNKNOWN_DEFAULT_OPEN_API -> throw new IllegalArgumentException("Unknown chat message type");
+        };
+    }
+
+    public static ChatMessage fromDao(ChatLogDao dao) {
+        return ChatMessage.builder()
+                .uuid(UUID.fromString(dao.getUuid()))
+                .timestamp(dao.getTimeStamp().toInstant())
+                .server(dao.getServer())
+                .type(fromString(dao.getType()))
+                .channel(dao.getChannel())
+                .receiver(dao.getReceiver())
+                .messageJson(dao.getMiniMessage())
+                .notBlocked(!dao.isBlocked())
+                .build();
+    }
+
+    private static ChatMessageType fromString(String type) {
+        return switch (type) {
+            case "public" -> ChatMessageType.PUBLIC;
+            case "global" -> ChatMessageType.GLOBAL;
+            case "party" -> ChatMessageType.PARTY;
+            case "gac" -> ChatMessageType.GAC;
+            case "msg" -> ChatMessageType.MSG;
+            case "custom" -> ChatMessageType.CUSTOM;
+            default -> throw new IllegalArgumentException("Unknown chat message type");
+        };
+    }
+
+    public static String toJson(ChatMessage chatMessage) {
+        try {
+            return OBJECT_MAPPER.writeValueAsString(chatMessage);
+        } catch (JsonProcessingException e) {
+            throw new IllegalStateException("Failed to serialize ChatMessage to JSON: " + chatMessage.getUuid(), e);
+        }
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ChatMessageType.java

@@ -0,0 +1,10 @@
+package com.alttd.altitudeweb.controllers.chat;
+
+public enum ChatMessageType {
+    PUBLIC,
+    GLOBAL,
+    PARTY,
+    GAC,
+    MSG,
+    CUSTOM;
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ServerMessageController.java

@@ -0,0 +1,93 @@
+package com.alttd.altitudeweb.controllers.chat;
+
+import com.alttd.altitudeweb.api.ServerMessageApi;
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
+import com.alttd.altitudeweb.model.PartyMessageRequestDto;
+import com.alttd.altitudeweb.model.PrivateMessageRequestDto;
+import com.alttd.altitudeweb.model.PunishRequestDto;
+import com.alttd.altitudeweb.model.ServerMessageRequestDto;
+import com.alttd.altitudeweb.services.chat.to_server.ServerMessageService;
+import com.alttd.altitudeweb.services.chat.to_server.data.ChatFromWeb;
+import com.alttd.altitudeweb.services.chat.to_server.data.PartyChatFromWeb;
+import com.alttd.altitudeweb.services.chat.to_server.data.PrivateChatFromWeb;
+import com.alttd.altitudeweb.services.chat.to_server.data.PunishFromWeb;
+import com.alttd.altitudeweb.services.chat.to_server.mappers.ChatFromWebMapper;
+import com.alttd.altitudeweb.services.chat.to_server.mappers.PartyChatFromWebMapper;
+import com.alttd.altitudeweb.services.chat.to_server.mappers.PrivateChatFromWebMapper;
+import com.alttd.altitudeweb.services.chat.to_server.mappers.PunishFromWebMapper;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.UUID;
+
+@Slf4j
+@RestController
+@RequiredArgsConstructor
+public class ServerMessageController implements ServerMessageApi {
+
+    private final ServerMessageService serverMessageService;
+    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+    private final AuthenticatedUuid authenticatedUuid;
+
+    public static String toJson(Object object) {
+        try {
+            return OBJECT_MAPPER.writeValueAsString(object);
+        } catch (JsonProcessingException e) {
+            throw new IllegalStateException("Failed to serialize object to JSON", e);
+        }
+    }
+
+    @Override
+    public ResponseEntity<Void> punishPlayer(String server, PunishRequestDto punishRequestDto) throws Exception {
+        validateUser(punishRequestDto.getExecutor());
+        return send(server, "web_punish", PunishFromWebMapper.fromDto(punishRequestDto));
+    }
+
+    @Override
+    public ResponseEntity<Void> sendAdminChat(String server, ServerMessageRequestDto serverMessageRequestDto) {
+        validateUser(serverMessageRequestDto.getUuid());
+        return send(server, "web_ac_chat", ChatFromWebMapper.fromDto(serverMessageRequestDto));
+    }
+
+    @Override
+    public ResponseEntity<Void> sendPartyMessage(PartyMessageRequestDto partyMessageRequestDto) {
+        validateUser(partyMessageRequestDto.getFrom());
+        return send("proxy", "web_party_chat", PartyChatFromWebMapper.fromDto(partyMessageRequestDto));
+    }
+
+    @Override
+    public ResponseEntity<Void> sendPrivateMessage(PrivateMessageRequestDto privateMessageRequestDto) {
+        validateUser(privateMessageRequestDto.getFrom());
+        return send("proxy", "web_private_chat", PrivateChatFromWebMapper.fromDto(privateMessageRequestDto));
+    }
+
+    @Override
+    public ResponseEntity<Void> sendServerMessage(String server, ServerMessageRequestDto serverMessageRequestDto) {
+        validateUser(serverMessageRequestDto.getUuid());
+
+        //TODO [Stijn] [2026-08-02]: Validate the user can send a message in this server (or do that in chat)
+        return send(server, "web_chat", ChatFromWebMapper.fromDto(serverMessageRequestDto));
+    }
+
+    private void validateUser(UUID uuid) {
+        UUID authenticatedUserUuid = authenticatedUuid.getAuthenticatedUserUuid();
+        if (!authenticatedUserUuid.equals(uuid)) {
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Cannot send message as another user");
+        }
+    }
+
+    private ResponseEntity<Void> send(String server, String channel, Object data) {
+        String json = toJson(data);
+        if (serverMessageService.sendMessage(server, channel, json)) {
+            return new ResponseEntity<>(HttpStatus.ACCEPTED);
+        } else {
+            return new ResponseEntity<>(HttpStatus.NOT_FOUND);
+        }
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ServerStateMapper.java

@@ -0,0 +1,24 @@
+package com.alttd.altitudeweb.controllers.chat;
+
+import com.alttd.altitudeweb.model.ServerStateDto;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
+import lombok.experimental.UtilityClass;
+
+@UtilityClass
+public class ServerStateMapper {
+    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper()
+            .registerModule(new JavaTimeModule())
+            .enable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
+            .disable(SerializationFeature.WRITE_DATE_TIMESTAMPS_AS_NANOSECONDS);
+
+    public static String toJson(ServerStateDto serverStateDto) {
+        try {
+            return OBJECT_MAPPER.writeValueAsString(serverStateDto);
+        } catch (JsonProcessingException e) {
+            throw new IllegalStateException("Failed to serialize ServerStateDto to JSON", e);
+        }
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/data_from_auth/AuthenticatedUuid.java

@@ -0,0 +1,73 @@
+package com.alttd.altitudeweb.controllers.data_from_auth;
+
+import com.nimbusds.jwt.JWT;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.stereotype.Service;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.Optional;
+import java.util.UUID;
+
+@Slf4j
+@Service
+public class AuthenticatedUuid {
+    @Value("${UNSECURED:#{false}}")
+    private boolean unsecured;
+
+    /**
+     * Extracts and validates the authenticated user's UUID from the JWT token.
+     *
+     * @return The UUID of the authenticated user
+     * @throws ResponseStatusException with 401 status if authentication is invalid
+     */
+    public UUID getAuthenticatedUserUuid() {
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+
+        if (authentication == null || !(authentication.getPrincipal() instanceof Jwt jwt)) {
+            log.error("Authentication principal is null {} or not a JWT {}",
+                      authentication == null, authentication == null ?
+                                              "null" : authentication.getPrincipal() instanceof JWT);
+            if (unsecured) {
+                return UUID.fromString("55e46bc3-2a29-4c53-850f-dbd944dc5c5f");
+            }
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Authentication required");
+        }
+
+        String stringUuid = jwt.getSubject();
+
+        try {
+            return UUID.fromString(stringUuid);
+        } catch (IllegalArgumentException e) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Invalid UUID format");
+        }
+    }
+
+    /**
+     * Extracts the authenticated user's UUID from the JWT token.
+     *
+     * @return The UUID of the authenticated user
+     */
+    public Optional<UUID> tryGetAuthenticatedUserUuid() {
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+
+        if (authentication == null || !(authentication.getPrincipal() instanceof Jwt jwt)) {
+            if (unsecured) {
+                return Optional.of(UUID.fromString("55e46bc3-2a29-4c53-850f-dbd944dc5c5f"));
+            }
+            return Optional.empty();
+        }
+
+        String stringUuid = jwt.getSubject();
+
+        try {
+            return Optional.of(UUID.fromString(stringUuid));
+        } catch (IllegalArgumentException e) {
+            return Optional.empty();
+        }
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/event/CommandsToServerController.java

@@ -0,0 +1,48 @@
+package com.alttd.altitudeweb.controllers.event;
+
+import com.alttd.altitudeweb.services.chat.to_server.ServerMessageService;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.core.token.Token;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.web.servlet.mvc.method.annotation.SseEmitter;
+
+@RequiredArgsConstructor
+@Slf4j
+@RestController
+@RequestMapping("/api/chat/server/send")
+public class CommandsToServerController {
+
+    private final ServerMessageService serverMessageService;
+    @Value("${altitudeweb.token}")
+    private String validToken;
+
+    @GetMapping(path = "/subscribe/{server}", produces = MediaType.TEXT_EVENT_STREAM_VALUE)
+    public SseEmitter subscribe(@RequestHeader(value = "X-Altitude-Token", required = false) String token,
+                                HttpServletResponse response, @PathVariable String server) {
+        if (validToken == null || validToken.equals("invalid-token")) {
+            log.error("Invalid token in config");
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN);
+        }
+        if (token == null) {
+            log.error("No token provided when trying to subscribe to {}", server);
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
+        }
+
+        if (!token.equals(validToken)) {
+            log.error("Invalid token provided when trying to subscribe to {}", server);
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN);
+        }
+
+        response.setHeader("X-Accel-Buffering", "no"); // disables nginx buffering if present
+        response.setHeader("Cache-Control", "no-cache");
+
+        return serverMessageService.subscribe(server);
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/event/EventController.java

@@ -0,0 +1,100 @@
+package com.alttd.altitudeweb.controllers.event;
+
+import com.alttd.altitudeweb.controllers.chat.ChatMessageMapper;
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.chat.ChatLogMapper;
+import com.alttd.altitudeweb.database.web_db.chat_session.ChatSession;
+import com.alttd.altitudeweb.database.web_db.chat_session.ChatSessionMapper;
+import com.alttd.altitudeweb.model.PermissionClaimDto;
+import com.alttd.altitudeweb.services.chat.ChatService;
+import com.alttd.altitudeweb.services.chat.event_publisher.EventPublisher;
+import com.alttd.altitudeweb.services.chat.event_publisher.EventUser;
+import com.alttd.altitudeweb.setup.Connection;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.web.servlet.mvc.method.annotation.SseEmitter;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+import java.util.stream.Collectors;
+
+@RequiredArgsConstructor
+@Slf4j
+@RestController
+@RequestMapping("/api/chat/read")
+public class EventController {
+
+    private final static Duration MESSAGE_HISTORY_DURATION = Duration.ofHours(1);
+    private final ChatService chatService;
+
+    @GetMapping(path = "/subscribe", produces = MediaType.TEXT_EVENT_STREAM_VALUE)
+    public SseEmitter subscribe(@AuthenticationPrincipal Jwt jwt,
+                                HttpServletResponse response) {
+        if (jwt == null) {
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
+        }
+
+        List<String> authorities = jwt.getClaimAsStringList("authorities");
+        if (authorities == null || doesNotHavePermission(authorities)) {
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN);
+        }
+
+        response.setHeader("X-Accel-Buffering", "no"); // disables nginx buffering if present
+        response.setHeader("Cache-Control", "no-cache");
+
+        UUID subject;
+        try {
+            subject = UUID.fromString(jwt.getSubject());
+        } catch (IllegalArgumentException e) {
+            log.error("Invalid UUID in JWT subject: {}", jwt.getSubject());
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST);
+        }
+
+        String json = chatService.getMessagesSince(Instant.now().minus(MESSAGE_HISTORY_DURATION))
+                .stream()
+                .map(ChatMessageMapper::toJson)
+                .collect(Collectors.joining(",", "[", "]"));
+
+        Integer partyId = getPartyId(subject);
+        EventUser eventUser = new EventUser(subject, authorities, partyId);
+        return chatService.subscribe(eventUser, json);
+    }
+
+    private Integer getPartyId(UUID subject) {
+        CompletableFuture<Integer> partyIdFuture = new CompletableFuture<>();
+
+        Connection.getConnection(Databases.CHAT)
+                .runQuery(sqlSession -> {
+                    log.debug("Loading party id for uuid {}", subject);
+                    try {
+                        Integer partyId = sqlSession.getMapper(ChatLogMapper.class)
+                                .getPartyId(subject.toString())
+                                .orElse(null);
+
+                        partyIdFuture.complete(partyId);
+                    } catch (Exception e) {
+                        log.error("Failed to load party id", e);
+                        partyIdFuture.complete(null);
+                    }
+                });
+
+        return partyIdFuture.join();
+    }
+
+    private static boolean doesNotHavePermission(List<String> authorities) {
+        return !authorities.contains(PermissionClaimDto.HEAD_MOD.getValue()) && !authorities.contains(PermissionClaimDto.MOD.getValue());
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/forms/AppealController.java

@@ -0,0 +1,144 @@
+package com.alttd.altitudeweb.controllers.forms;
+
+import com.alttd.altitudeweb.api.AppealsApi;
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.litebans.HistoryRecord;
+import com.alttd.altitudeweb.database.litebans.HistoryType;
+import com.alttd.altitudeweb.database.litebans.IdHistoryMapper;
+import com.alttd.altitudeweb.database.web_db.forms.Appeal;
+import com.alttd.altitudeweb.database.web_db.forms.AppealMapper;
+import com.alttd.altitudeweb.database.web_db.mail.EmailVerification;
+import com.alttd.altitudeweb.database.web_db.mail.EmailVerificationMapper;
+import com.alttd.altitudeweb.mappers.AppealDataMapper;
+import com.alttd.altitudeweb.model.*;
+import com.alttd.altitudeweb.services.forms.DiscordAppeal;
+import com.alttd.altitudeweb.services.limits.RateLimit;
+import com.alttd.altitudeweb.services.mail.AppealMail;
+import com.alttd.altitudeweb.setup.Connection;
+import lombok.AllArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.HttpStatusCode;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
+
+@Slf4j
+@RestController
+@AllArgsConstructor
+@RateLimit(limit = 30, timeValue = 1, timeUnit = TimeUnit.HOURS)
+public class AppealController implements AppealsApi {
+
+    private final AppealDataMapper mapper;
+    private final AppealMail appealMail;
+    private final DiscordAppeal discordAppeal;
+    private final com.alttd.altitudeweb.services.discord.AppealDiscord appealDiscord;
+
+    @Override
+    public ResponseEntity<BannedUserResponseDto> getBannedUser(String discordId) throws Exception {
+        long discordIdAsLong = Long.parseLong(discordId);
+        return new ResponseEntity<>(discordAppeal.getBannedUser(discordIdAsLong), HttpStatus.OK);
+    }
+
+    @RateLimit(limit = 3, timeValue = 1, timeUnit = TimeUnit.HOURS, key = "discordAppeal")
+    @Override
+    public ResponseEntity<FormResponseDto> submitDiscordAppeal(DiscordAppealDto discordAppealDto) {
+        return new ResponseEntity<>(discordAppeal.submitAppeal(discordAppealDto), HttpStatus.OK);
+    }
+
+    @RateLimit(limit = 3, timeValue = 1, timeUnit = TimeUnit.HOURS, key = "minecraftAppeal")
+    @Override
+    public ResponseEntity<FormResponseDto> submitMinecraftAppeal(MinecraftAppealDto minecraftAppealDto) {
+        boolean success = true;
+        CompletableFuture<Appeal> appealCompletableFuture = new CompletableFuture<>();
+
+        Connection.getConnection(Databases.DEFAULT)
+                  .runQuery(sqlSession -> {
+                      log.debug("Loading history by id");
+                      try {
+                          Appeal appeal = mapper.minecraftAppealDtoToAppeal(minecraftAppealDto);
+                          sqlSession.getMapper(AppealMapper.class).createAppeal(appeal);
+                          appealCompletableFuture.complete(appeal);
+                      } catch (Exception e) {
+                          log.error("Failed to load history count", e);
+                          appealCompletableFuture.completeExceptionally(e);
+                      }
+                  });
+        Appeal appeal = appealCompletableFuture.join();
+        HistoryRecord history = getHistory(appeal.historyType(), appeal.historyId());
+        if (history == null) {
+            throw new ResponseStatusException(HttpStatusCode.valueOf(404), "History not found");
+        }
+        // Send to Discord channels
+        try {
+            appealDiscord.sendAppealToDiscord(appeal, history);
+        } catch (Exception e) {
+            log.error("Failed to send appeal {} to Discord", appeal.id(), e);
+            success = false;
+        }
+
+        appealMail.sendAppealNotification(appeal, history);
+
+        CompletableFuture<Optional<EmailVerification>> emailVerificationCompletableFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sqlSession -> {
+                    log.debug("Retrieving mail by uuid and address");
+
+                    EmailVerification verifiedMail = sqlSession.getMapper(EmailVerificationMapper.class)
+                                                                 .findByUserAndEmail(appeal.uuid(), appeal.email().toLowerCase());
+                    emailVerificationCompletableFuture.complete(Optional.ofNullable(verifiedMail));
+                });
+        Optional<EmailVerification> optionalEmailVerification = emailVerificationCompletableFuture.join();
+
+        if (optionalEmailVerification.isEmpty()) {
+            return ResponseEntity.badRequest().build();
+        }
+        EmailVerification emailVerification = optionalEmailVerification.get();
+        if (!emailVerification.verified()) {
+            return ResponseEntity.badRequest().build();
+        }
+        if (!success) {
+            return ResponseEntity.internalServerError().build();
+        }
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sqlSession -> {
+                    log.debug("Marking appeal {} as sent", appeal.id());
+                    sqlSession.getMapper(AppealMapper.class)
+                            .markAppealAsSent(appeal.id());
+                });
+        FormResponseDto appealResponseDto = new FormResponseDto(
+                appeal.id().toString(),
+                "Your appeal has been submitted. You will be notified when it has been reviewed.",
+                true);
+        return ResponseEntity.ok().body(appealResponseDto);
+    }
+
+    @Override
+    public ResponseEntity<FormResponseDto> updateMail(UpdateMailDto updateMailDto) {
+        //TODO move to its own endpoint
+        throw new ResponseStatusException(HttpStatusCode.valueOf(501), "Updating mail is not yet supported");
+    }
+
+    private HistoryRecord getHistory(String type, int id) {
+        HistoryType historyTypeEnum = HistoryType.getHistoryType(type);
+        CompletableFuture<HistoryRecord> historyRecordCompletableFuture = new CompletableFuture<>();
+
+        Connection.getConnection(Databases.LITE_BANS)
+                  .runQuery(sqlSession -> {
+                      log.debug("Loading history by id");
+                      try {
+                          HistoryRecord punishment = sqlSession.getMapper(IdHistoryMapper.class)
+                                                               .getRecentHistory(historyTypeEnum, id);
+                          historyRecordCompletableFuture.complete(punishment);
+                      } catch (Exception e) {
+                          log.error("Failed to load history count", e);
+                          historyRecordCompletableFuture.completeExceptionally(e);
+                      }
+                  });
+        return historyRecordCompletableFuture.join();
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/forms/ApplicationController.java

@@ -0,0 +1,155 @@
+package com.alttd.altitudeweb.controllers.forms;
+
+import com.alttd.altitudeweb.api.ApplicationsApi;
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.luckperms.UUIDUsernameMapper;
+import com.alttd.altitudeweb.database.web_db.forms.StaffApplication;
+import com.alttd.altitudeweb.database.web_db.forms.StaffApplicationMapper;
+import com.alttd.altitudeweb.database.web_db.mail.EmailVerification;
+import com.alttd.altitudeweb.database.web_db.mail.EmailVerificationMapper;
+import com.alttd.altitudeweb.mappers.StaffApplicationDataMapper;
+import com.alttd.altitudeweb.model.FormResponseDto;
+import com.alttd.altitudeweb.model.StaffApplicationDto;
+import com.alttd.altitudeweb.services.discord.StaffApplicationDiscord;
+import com.alttd.altitudeweb.services.limits.RateLimit;
+import com.alttd.altitudeweb.services.mail.StaffApplicationMail;
+import com.alttd.altitudeweb.setup.Connection;
+import lombok.AllArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.time.Instant;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.TimeUnit;
+
+@Slf4j
+@RestController
+@AllArgsConstructor
+@RateLimit(limit = 30, timeValue = 1, timeUnit = TimeUnit.HOURS)
+public class ApplicationController implements ApplicationsApi {
+
+    private final AuthenticatedUuid authenticatedUuid;
+    private final StaffApplicationDataMapper staffApplicationDataMapper;
+    private final StaffApplicationMail staffApplicationMail;
+    private final StaffApplicationDiscord staffApplicationDiscord;
+
+    private final Instant open = Instant.parse("2025-10-18T00:00:00Z");
+    private final Instant close = Instant.parse("2025-10-26T00:00:00Z");
+
+    @Override
+    public ResponseEntity<Boolean> getStaffApplicationsIsOpen() {
+        return ResponseEntity.ok(isOpen());
+    }
+
+    private boolean isOpen() {
+        Instant now = Instant.now();
+        return !now.isBefore(open) && !now.isAfter(close);
+    }
+
+    @Override
+    public ResponseEntity<FormResponseDto> submitStaffApplication(StaffApplicationDto staffApplicationDto) {
+        if (!isOpen()) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+        UUID userUuid = authenticatedUuid.getAuthenticatedUserUuid();
+
+        String email = staffApplicationDto.getEmail() == null ? null : staffApplicationDto.getEmail().toLowerCase();
+        Optional<EmailVerification> optionalEmail = fetchEmailVerification(userUuid, email);
+        if (optionalEmail.isEmpty() || !optionalEmail.get().verified()) {
+            log.warn("User {} attempted to submit an application without a verified email {}", userUuid, email);
+            return ResponseEntity.badRequest().build();
+        }
+
+        // Map and persist application
+        StaffApplication application = staffApplicationDataMapper.map(userUuid, staffApplicationDto);
+        saveApplication(application);
+
+        String username = getUsername(userUuid);
+
+        try {
+            if (!staffApplicationMail.sendApplicationEmail(username, application)) {
+                log.warn("Failed to send staff application email for {}", application.id());
+                return ResponseEntity.internalServerError().build();
+            }
+        } catch (Exception e) {
+            log.error("Error while sending staff application email for {}", application.id(), e);
+            return ResponseEntity.internalServerError().build();
+        }
+
+        try {
+            staffApplicationDiscord.sendApplicationToDiscord(username, application);
+        } catch (Exception e) {
+            log.error("Failed to send staff application {} to Discord", application.id(), e);
+            return ResponseEntity.internalServerError().build();
+        }
+        try {
+            markAsSent(application.id());
+        } catch (Exception e) {
+            log.error("Failed to mark application {} as sent", application.id(), e);
+            return ResponseEntity.internalServerError().build();
+        }
+        FormResponseDto response = buildResponse(application);
+        return ResponseEntity.status(200).body(response);
+    }
+
+    private void saveApplication(StaffApplication application) {
+        CompletableFuture<Void> saveFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sqlSession -> {
+                    try {
+                        sqlSession.getMapper(StaffApplicationMapper.class).insert(application);
+                        saveFuture.complete(null);
+                    } catch (Exception e) {
+                        log.error("Failed to insert staff application", e);
+                        saveFuture.completeExceptionally(e);
+                    }
+                });
+        saveFuture.join();
+    }
+
+    private Optional<EmailVerification> fetchEmailVerification(UUID userUuid, String email) {
+        CompletableFuture<Optional<EmailVerification>> emailVerificationFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sqlSession -> {
+                    EmailVerification verifiedMail = sqlSession.getMapper(EmailVerificationMapper.class)
+                            .findByUserAndEmail(userUuid, email);
+                    emailVerificationFuture.complete(Optional.ofNullable(verifiedMail));
+                });
+        return emailVerificationFuture.join();
+    }
+
+    private void markAsSent(UUID applicationId) {
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sqlSession -> sqlSession.getMapper(StaffApplicationMapper.class).markAsSent(applicationId));
+    }
+
+    private FormResponseDto buildResponse(StaffApplication application) {
+        String message = "Your staff application has been submitted. You will be notified when it has been reviewed.";
+        return new FormResponseDto(
+                application.id().toString(),
+                message,
+                true
+        );
+    }
+
+    private String getUsername(UUID uuid) {
+        CompletableFuture<String> usernameFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.LUCK_PERMS)
+                .runQuery(sqlSession -> {
+                    log.debug("Loading username for uuid {}", uuid);
+                    try {
+                        String username = sqlSession.getMapper(UUIDUsernameMapper.class).getUsernameFromUUID(uuid.toString());
+                        usernameFuture.complete(username);
+                    } catch (Exception e) {
+                        log.error("Failed to load username for uuid {}", uuid, e);
+                        usernameFuture.completeExceptionally(e);
+                    }
+                });
+        return usernameFuture.join();
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/forms/MailController.java

@@ -0,0 +1,104 @@
+package com.alttd.altitudeweb.controllers.forms;
+
+import com.alttd.altitudeweb.api.MailApi;
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
+import com.alttd.altitudeweb.database.web_db.mail.EmailVerification;
+import com.alttd.altitudeweb.model.MailResponseDto;
+import com.alttd.altitudeweb.model.SubmitEmailDto;
+import com.alttd.altitudeweb.model.VerifyCodeDto;
+import com.alttd.altitudeweb.model.EmailEntryDto;
+import com.alttd.altitudeweb.services.limits.RateLimit;
+import com.alttd.altitudeweb.services.mail.MailVerificationService;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.http.HttpStatus;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+
+@Slf4j
+@RestController
+@RequiredArgsConstructor
+@RateLimit(limit = 60, timeValue = 1, timeUnit = TimeUnit.HOURS)
+public class MailController implements MailApi {
+
+    private final MailVerificationService mailVerificationService;
+    private final AuthenticatedUuid authenticatedUuid;
+
+    @Override
+    @RateLimit(limit = 5, timeValue = 1, timeUnit = TimeUnit.HOURS, key = "mailSubmit")
+    public ResponseEntity<MailResponseDto> submitEmailForVerification(SubmitEmailDto submitEmailDto) {
+        UUID uuid = authenticatedUuid.getAuthenticatedUserUuid();
+        boolean emailAlreadyVerified = mailVerificationService.listAll(uuid).stream()
+                                           .filter(EmailVerification::verified)
+                                           .map(EmailVerification::email)
+                                           .anyMatch(mail -> mail.equalsIgnoreCase(submitEmailDto.getEmail()));
+        if (emailAlreadyVerified) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Email already verified for user");
+        }
+
+        EmailVerification saved = mailVerificationService.submitEmail(uuid, submitEmailDto.getEmail());
+        MailResponseDto response = new MailResponseDto()
+                .email(saved.email())
+                .message("Verification email sent")
+                .verified(false);
+        return ResponseEntity.status(HttpStatus.CREATED).body(response);
+    }
+
+    @Override
+    @RateLimit(limit = 20, timeValue = 1, timeUnit = TimeUnit.HOURS, key = "mailVerify")
+    public ResponseEntity<MailResponseDto> verifyEmailCode(VerifyCodeDto verifyCodeDto) {
+        UUID uuid = authenticatedUuid.getAuthenticatedUserUuid();
+        Optional<EmailVerification> optionalEmailVerification = mailVerificationService.verifyCode(uuid, verifyCodeDto.getCode());
+        if (optionalEmailVerification.isEmpty()) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Invalid verification code");
+        }
+        EmailVerification emailVerification = optionalEmailVerification.get();
+        MailResponseDto response = new MailResponseDto()
+                .email(emailVerification.email())
+                .message("Email verified successfully")
+                .verified(true);
+        return ResponseEntity.ok(response);
+    }
+
+    @Override
+    @RateLimit(limit = 5, timeValue = 1, timeUnit = TimeUnit.HOURS, key = "mailResend")
+    public ResponseEntity<MailResponseDto> resendVerificationEmail(SubmitEmailDto submitEmailDto) {
+        UUID uuid = authenticatedUuid.getAuthenticatedUserUuid();
+        EmailVerification updated = mailVerificationService.resend(uuid, submitEmailDto.getEmail());
+        if (updated == null) {
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "Email not found for user");
+        }
+        MailResponseDto response = new MailResponseDto()
+                .email(updated.email())
+                .message("Verification email resent")
+                .verified(false);
+        return ResponseEntity.ok(response);
+    }
+
+    @Override
+    @RateLimit(limit = 10, timeValue = 1, timeUnit = TimeUnit.HOURS, key = "mailDelete")
+    public ResponseEntity<Void> deleteEmail(SubmitEmailDto submitEmailDto) {
+        UUID uuid = authenticatedUuid.getAuthenticatedUserUuid();
+        boolean deleted = mailVerificationService.delete(uuid, submitEmailDto.getEmail());
+        if (!deleted) {
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "Email not found for user");
+        }
+        return ResponseEntity.noContent().build();
+    }
+
+    @Override
+    public ResponseEntity<List<EmailEntryDto>> getUserEmails() {
+        UUID uuid = authenticatedUuid.getAuthenticatedUserUuid();
+        List<EmailVerification> emails = mailVerificationService.listAll(uuid);
+        List<EmailEntryDto> result = emails.stream()
+                .map(ev -> new EmailEntryDto().email(ev.email()).verified(ev.verified()))
+                .toList();
+        return ResponseEntity.ok(result);
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/history/HistoryApiController.java

@@ -1,16 +1,18 @@
 package com.alttd.altitudeweb.controllers.history;
 
 import com.alttd.altitudeweb.api.HistoryApi;
-import com.alttd.altitudeweb.controllers.limits.RateLimit;
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
+import com.alttd.altitudeweb.services.limits.RateLimit;
 import com.alttd.altitudeweb.model.HistoryCountDto;
+import com.alttd.altitudeweb.model.PunishmentHistoryListDto;
 import com.alttd.altitudeweb.setup.Connection;
 import com.alttd.altitudeweb.database.Databases;
 import com.alttd.altitudeweb.database.litebans.*;
 import com.alttd.altitudeweb.model.PunishmentHistoryDto;
-import com.alttd.altitudeweb.model.PunishmentHistoryInnerDto;
+import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
 import java.util.UUID;
@@ -19,19 +21,22 @@ import java.util.concurrent.TimeUnit;
 
 @Slf4j
 @RestController
-@RateLimit(limit = 30, timeValue = 1, timeUnit = TimeUnit.MINUTES)
+@RateLimit(limit = 30, timeValue = 10, timeUnit = TimeUnit.SECONDS)
+@RequiredArgsConstructor
 public class HistoryApiController implements HistoryApi {
 
+    private final AuthenticatedUuid authenticatedUuid;
+
     @Override
-    public ResponseEntity<PunishmentHistoryDto> getHistoryForAll(String userType, String type, Integer page) {
+    public ResponseEntity<PunishmentHistoryListDto> getHistoryForAll(String userType, String type, Integer page) {
         return getHistoryForUsers(userType, type, "", page);
     }
 
     @Override
-    public ResponseEntity<PunishmentHistoryDto> getHistoryForUsers(String userType, String type, String user, Integer page) {
+    public ResponseEntity<PunishmentHistoryListDto> getHistoryForUsers(String userType, String type, String user, Integer page) {
         UserType userTypeEnum = UserType.getUserType(userType);
         HistoryType historyTypeEnum = HistoryType.getHistoryType(type);
-        PunishmentHistoryDto punishmentHistory = new PunishmentHistoryDto();
+        PunishmentHistoryListDto punishmentHistoryList = new PunishmentHistoryListDto();
         CompletableFuture<List<HistoryRecord>> historyRecords = new CompletableFuture<>();
 
         Connection.getConnection(Databases.LITE_BANS)
@@ -46,14 +51,14 @@ public class HistoryApiController implements HistoryApi {
                         historyRecords.completeExceptionally(e);
                     }
                 });
-        return mapPunishmentHistory(punishmentHistory, historyRecords);
+        return mapPunishmentHistory(punishmentHistoryList, historyRecords);
     }
 
     @Override
-    public ResponseEntity<PunishmentHistoryDto> getHistoryForUuid(String userType, String type, String uuid, Integer page) {
+    public ResponseEntity<PunishmentHistoryListDto> getHistoryForUuid(String userType, String type, String uuid, Integer page) {
         UserType userTypeEnum = UserType.getUserType(userType);
         HistoryType historyTypeEnum = HistoryType.getHistoryType(type);
-        PunishmentHistoryDto punishmentHistory = new PunishmentHistoryDto();
+        PunishmentHistoryListDto punishmentHistoryList = new PunishmentHistoryListDto();
         CompletableFuture<List<HistoryRecord>> historyRecords = new CompletableFuture<>();
 
         Connection.getConnection(Databases.LITE_BANS)
@@ -68,7 +73,7 @@ public class HistoryApiController implements HistoryApi {
                         historyRecords.completeExceptionally(e);
                     }
                 });
-        return mapPunishmentHistory(punishmentHistory, historyRecords);
+        return mapPunishmentHistory(punishmentHistoryList, historyRecords);
     }
 
     @Override
@@ -153,6 +158,44 @@ public class HistoryApiController implements HistoryApi {
         return ResponseEntity.ok().body(searchResultCountCompletableFuture.join());
     }
 
+    @Override
+    public ResponseEntity<PunishmentHistoryListDto> getAllHistoryForUUID(String uuid) {
+        PunishmentHistoryListDto punishmentHistoryList = new PunishmentHistoryListDto();
+        CompletableFuture<List<HistoryRecord>> historyRecordsCompletableFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.LITE_BANS).runQuery(sqlSession -> {
+            log.debug("Loading all history for uuid {}", uuid);
+            try {
+                List<HistoryRecord> punishments = sqlSession.getMapper(UUIDHistoryMapper.class)
+                        .getAllHistoryForUUID(UUID.fromString(uuid));
+                historyRecordsCompletableFuture.complete(punishments);
+            } catch (Exception e) {
+                log.error("Failed to load all history for uuid {}", uuid, e);
+                historyRecordsCompletableFuture.completeExceptionally(e);
+            }
+        });
+        return mapPunishmentHistory(punishmentHistoryList, historyRecordsCompletableFuture);
+    }
+
+    @Override
+    public ResponseEntity<PunishmentHistoryDto> getHistoryById(String type, Integer id) {
+        HistoryType historyTypeEnum = HistoryType.getHistoryType(type);
+        CompletableFuture<HistoryRecord> historyRecordCompletableFuture = new CompletableFuture<>();
+
+        Connection.getConnection(Databases.LITE_BANS)
+                .runQuery(sqlSession -> {
+                    log.debug("Loading history by id");
+                    try {
+                        HistoryRecord punishment = sqlSession.getMapper(IdHistoryMapper.class)
+                                .getRecentHistory(historyTypeEnum, id);
+                        historyRecordCompletableFuture.complete(punishment);
+                    } catch (Exception e) {
+                        log.error("Failed to load history count", e);
+                        historyRecordCompletableFuture.completeExceptionally(e);
+                    }
+                });
+        return ResponseEntity.ok().body(mapPunishmentHistory(historyRecordCompletableFuture.join()));
+    }
+
     private ResponseEntity<HistoryCountDto> mapHistoryCount(HistoryCount historyCount) {
         HistoryCountDto historyCountDto = new HistoryCountDto();
         historyCountDto.setBans(historyCount.getBans());
@@ -162,28 +205,140 @@ public class HistoryApiController implements HistoryApi {
         return ResponseEntity.ok().body(historyCountDto);
     }
 
-    private ResponseEntity<PunishmentHistoryDto> mapPunishmentHistory(PunishmentHistoryDto punishmentHistory, CompletableFuture<List<HistoryRecord>> historyRecords) {
+    private ResponseEntity<PunishmentHistoryListDto> mapPunishmentHistory(PunishmentHistoryListDto punishmentHistoryList, CompletableFuture<List<HistoryRecord>> historyRecords) {
         historyRecords.join().forEach(historyRecord -> {
-            PunishmentHistoryInnerDto.TypeEnum type = switch (historyRecord.getType().toLowerCase()) {
-                case "ban" -> PunishmentHistoryInnerDto.TypeEnum.BAN;
-                case "mute" -> PunishmentHistoryInnerDto.TypeEnum.MUTE;
-                case "warn" -> PunishmentHistoryInnerDto.TypeEnum.WARN;
-                case "kick" -> PunishmentHistoryInnerDto.TypeEnum.KICK;
-                default -> throw new IllegalStateException("Unexpected value: " + historyRecord.getType());
-            };
-            PunishmentHistoryInnerDto innerDto = new PunishmentHistoryInnerDto()
-                    .uuid(historyRecord.getUuid())
-                    .username(historyRecord.getPunishedName())
-                    .reason(historyRecord.getReason())
-                    .punishedByUuid(historyRecord.getBannedByUuid())
-                    .punishedBy(historyRecord.getBannedByName())
-                    .removedBy(historyRecord.getRemovedByName())
-                    .punishmentTime(historyRecord.getTime())
-                    .expiryTime(historyRecord.getUntil())
-                    .removedReason(historyRecord.getRemovedByReason())
-                    .type(type);
-            punishmentHistory.add(innerDto);
+            PunishmentHistoryDto innerDto = mapPunishmentHistory(historyRecord);
+            punishmentHistoryList.add(innerDto);
         });
-        return ResponseEntity.ok().body(punishmentHistory);
+        return ResponseEntity.ok().body(punishmentHistoryList);
+    }
+
+    private static PunishmentHistoryDto mapPunishmentHistory(HistoryRecord historyRecord) {
+        PunishmentHistoryDto.TypeEnum type = switch (historyRecord.getType().toLowerCase()) {
+            case "ban" -> PunishmentHistoryDto.TypeEnum.BAN;
+            case "mute" -> PunishmentHistoryDto.TypeEnum.MUTE;
+            case "warn" -> PunishmentHistoryDto.TypeEnum.WARN;
+            case "kick" -> PunishmentHistoryDto.TypeEnum.KICK;
+            default -> throw new IllegalStateException("Unexpected value: " + historyRecord.getType());
+        };
+        return new PunishmentHistoryDto()
+                .uuid(historyRecord.getUuid())
+                .username(historyRecord.getPunishedName())
+                .reason(historyRecord.getReason())
+                .punishedByUuid(historyRecord.getBannedByUuid())
+                .punishedBy(historyRecord.getBannedByName())
+                .removedBy(historyRecord.getRemovedByName())
+                .punishmentTime(historyRecord.getTime())
+                .expiryTime(historyRecord.getUntil())
+                .removedReason(historyRecord.getRemovedByReason())
+                .type(type)
+                .id(historyRecord.getId());
+    }
+
+    @Override
+    public ResponseEntity<PunishmentHistoryDto> updatePunishmentReason(String type, Integer id, String reason) {
+        log.debug("Updating reason for {} id {} to {}", type, id, reason);
+        HistoryType historyTypeEnum = HistoryType.getHistoryType(type);
+        CompletableFuture<PunishmentHistoryDto> result = new CompletableFuture<>();
+
+        final UUID actor = authenticatedUuid.getAuthenticatedUserUuid();
+
+        Connection.getConnection(Databases.LITE_BANS).runQuery(sqlSession -> {
+            try {
+                IdHistoryMapper idMapper = sqlSession.getMapper(IdHistoryMapper.class);
+                EditHistoryMapper editMapper = sqlSession.getMapper(EditHistoryMapper.class);
+                HistoryRecord before = idMapper.getRecentHistory(historyTypeEnum, id);
+                if (before == null) {
+                    result.complete(null);
+                    return;
+                }
+                int changed = editMapper.setReason(historyTypeEnum, id, reason);
+                HistoryRecord after = idMapper.getRecentHistory(historyTypeEnum, id);
+                log.info("[Punishment Edit] Actor={} Type={} Id={} Reason: '{}' -> '{}' (rows={})",
+                         actor, historyTypeEnum, id, before.getReason(), after != null ? after.getReason() : null, changed);
+                result.complete(after != null ? mapPunishmentHistory(after) : null);
+            } catch (Exception e) {
+                log.error("Failed to update reason for {} id {}", type, id, e);
+                result.completeExceptionally(e);
+            }
+        });
+        PunishmentHistoryDto body = result.join();
+        if (body == null) {
+            return ResponseEntity.notFound().build();
+        }
+        return ResponseEntity.ok(body);
+    }
+
+    @Override
+    public ResponseEntity<PunishmentHistoryDto> updatePunishmentUntil(String type, Integer id, Long until) {
+        log.debug("Updating until for {} id {} to {}", type, id, until);
+        HistoryType historyTypeEnum = HistoryType.getHistoryType(type);
+        CompletableFuture<PunishmentHistoryDto> result = new CompletableFuture<>();
+
+        final UUID actor = authenticatedUuid.getAuthenticatedUserUuid();
+
+        Connection.getConnection(Databases.LITE_BANS).runQuery(sqlSession -> {
+            try {
+                IdHistoryMapper idMapper = sqlSession.getMapper(IdHistoryMapper.class);
+                EditHistoryMapper editMapper = sqlSession.getMapper(EditHistoryMapper.class);
+                HistoryRecord before = idMapper.getRecentHistory(historyTypeEnum, id);
+                if (before == null) {
+                    result.complete(null);
+                    return;
+                }
+                int changed = editMapper.setUntil(historyTypeEnum, id, until);
+                HistoryRecord after = idMapper.getRecentHistory(historyTypeEnum, id);
+                log.info("[Punishment Edit] Actor={} Type={} Id={} Until: '{}' -> '{}' (rows={})",
+                         actor, historyTypeEnum, id, before.getUntil(), after != null ? after.getUntil() : null, changed);
+                result.complete(after != null ? mapPunishmentHistory(after) : null);
+            } catch (IllegalArgumentException e) {
+                log.warn("Invalid until edit for type {} id {}: {}", type, id, e.getMessage());
+                result.complete(null);
+            } catch (Exception e) {
+                log.error("Failed to update until for {} id {}", type, id, e);
+                result.completeExceptionally(e);
+            }
+        });
+        PunishmentHistoryDto body = result.join();
+        if (body == null) {
+            return ResponseEntity.notFound().build();
+        }
+        return ResponseEntity.ok(body);
+    }
+
+    @Override
+    public ResponseEntity<Void> removePunishment(String type, Integer id) {
+        log.debug("Removing punishment for {} id {}", type, id);
+        HistoryType historyTypeEnum = HistoryType.getHistoryType(type);
+        CompletableFuture<Boolean> result = new CompletableFuture<>();
+
+        final UUID actorUuid = authenticatedUuid.getAuthenticatedUserUuid();
+
+        Connection.getConnection(Databases.LITE_BANS).runQuery(sqlSession -> {
+            try {
+                IdHistoryMapper idMapper = sqlSession.getMapper(IdHistoryMapper.class);
+                EditHistoryMapper editMapper = sqlSession.getMapper(EditHistoryMapper.class);
+                HistoryRecord before = idMapper.getRecentHistory(historyTypeEnum, id);
+                if (before == null) {
+                    result.complete(false);
+                    return;
+                }
+                String actorName = sqlSession.getMapper(RecentNamesMapper.class).getUsername(actorUuid.toString());
+                int changed = editMapper.remove(historyTypeEnum, id);
+                log.info("[Punishment Remove] Actor={} ({}) Type={} Id={} Before(active={} removedBy={} reason='{}') (rows={})",
+                         actorName, actorUuid, historyTypeEnum, id,
+                         before.getRemovedByName() == null ? 1 : 0, before.getRemovedByName(), before.getRemovedByReason(),
+                         changed);
+                result.complete(changed > 0);
+            } catch (Exception e) {
+                log.error("Failed to remove punishment for {} id {}", type, id, e);
+                result.completeExceptionally(e);
+            }
+        });
+        Boolean ok = result.join();
+        if (ok == null || !ok) {
+            return ResponseEntity.notFound().build();
+        }
+        return ResponseEntity.noContent().build();
     }
 }

backend/src/main/java/com/alttd/altitudeweb/controllers/login/KeyPairService.java

@@ -0,0 +1,102 @@
+package com.alttd.altitudeweb.controllers.login;
+
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.web_db.KeyPairEntity;
+import com.alttd.altitudeweb.database.web_db.KeyPairMapper;
+import com.alttd.altitudeweb.setup.Connection;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+
+import java.security.*;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.security.spec.X509EncodedKeySpec;
+import java.time.Instant;
+import java.util.Base64;
+import java.util.concurrent.CompletableFuture;
+
+@Service
+@RequiredArgsConstructor
+@Slf4j
+public class KeyPairService {
+
+    private KeyPair cachedKeyPair = null;
+    private static final String RSA_ALGORITHM = "RSA";
+    private static final int RSA_KEY_SIZE = 2048;
+
+    public KeyPair getJwtSigningKeyPair() {
+        if (cachedKeyPair != null) {
+            return cachedKeyPair;
+        }
+        KeyPair keyPair = getOrCreateKeyPair();
+        if (keyPair != null) {
+            cachedKeyPair = keyPair;
+            return cachedKeyPair;
+        }
+        throw new IllegalStateException("Failed to generate or load key pair");
+    }
+
+    public KeyPair getOrCreateKeyPair() {
+        CompletableFuture<KeyPairEntity> keyPairFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sqlSession -> {
+                    log.debug("Loading key pair");
+                    try {
+                        KeyPairEntity entity = sqlSession.getMapper(KeyPairMapper.class).getKeyPair();
+                        keyPairFuture.complete(entity);
+                    } catch (Exception e) {
+                        log.error("Failed to key pair", e);
+                        keyPairFuture.completeExceptionally(e);
+                    }
+                });
+        KeyPairEntity keyPairEntity = keyPairFuture.join();
+        if (keyPairEntity != null) {
+            try {
+                byte[] privateKeyBytes = Base64.getDecoder().decode(keyPairEntity.getPrivateKey());
+                byte[] publicKeyBytes = Base64.getDecoder().decode(keyPairEntity.getPublicKey());
+
+                KeyFactory keyFactory = KeyFactory.getInstance(RSA_ALGORITHM);
+                PrivateKey privateKey = keyFactory.generatePrivate(new PKCS8EncodedKeySpec(privateKeyBytes));
+                PublicKey publicKey = keyFactory.generatePublic(new X509EncodedKeySpec(publicKeyBytes));
+
+                return new KeyPair(publicKey, privateKey);
+            } catch (Exception e) {
+                log.error("Failed to load key pair from database", e);
+            }
+        }
+
+        KeyPair keyPair = generateKeyPair();
+
+        try {
+            KeyPairEntity entity = new KeyPairEntity();
+            entity.setPrivateKey(Base64.getEncoder().encodeToString(keyPair.getPrivate().getEncoded()));
+            entity.setPublicKey(Base64.getEncoder().encodeToString(keyPair.getPublic().getEncoded()));
+            entity.setCreatedAt(Instant.now());
+
+            Connection.getConnection(Databases.DEFAULT)
+                    .runQuery(sqlSession -> {
+                        log.debug("Saving key pair");
+                        try {
+                            sqlSession.getMapper(KeyPairMapper.class).save(entity);
+                            log.info("Generated and saved new key pair");
+                        } catch (Exception e) {
+                            log.error("Failed to key pair", e);
+                        }
+                    });
+        } catch (Exception e) {
+            log.error("Failed to save key pair to database", e);
+        }
+
+        return keyPair;
+    }
+
+    private KeyPair generateKeyPair() {
+        try {
+            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(RSA_ALGORITHM);
+            keyPairGenerator.initialize(RSA_KEY_SIZE);
+            return keyPairGenerator.generateKeyPair();
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException("Error generating key pair", e);
+        }
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/login/LoginController.java

@@ -0,0 +1,252 @@
+package com.alttd.altitudeweb.controllers.login;
+
+import com.alttd.altitudeweb.api.LoginApi;
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.litebans.RecentNamesMapper;
+import com.alttd.altitudeweb.database.web_db.PrivilegedUser;
+import com.alttd.altitudeweb.database.web_db.PrivilegedUserMapper;
+import com.alttd.altitudeweb.model.PermissionClaimDto;
+import com.alttd.altitudeweb.model.UsernameDto;
+import com.alttd.altitudeweb.services.limits.RateLimit;
+import com.alttd.altitudeweb.setup.Connection;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.scheduling.annotation.EnableScheduling;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.security.oauth2.jwt.JwtClaimsSet;
+import org.springframework.security.oauth2.jwt.JwtEncoder;
+import org.springframework.security.oauth2.jwt.JwtEncoderParameters;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.time.Instant;
+import java.util.*;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+import java.util.concurrent.TimeUnit;
+
+@Slf4j
+@RequiredArgsConstructor
+@EnableScheduling
+@RestController
+public class LoginController implements LoginApi {
+
+    private final JwtEncoder jwtEncoder;
+    private final AuthenticatedUuid authenticatedUuid;
+
+    @Value("${login.secret:#{null}}")
+    private String loginSecret;
+
+    @Value("${my-server.address:#{null}}")
+    private String serverAddress;
+
+    private record CacheEntry(UUID uuid, Instant expiry) {
+    }
+
+    private static final ConcurrentMap<String, CacheEntry> cache = new ConcurrentHashMap<>();
+
+    @Scheduled(fixedRate = 300000) // 5 minutes in milliseconds
+    protected void clearExpiredCacheEntries() {
+        Instant now = Instant.now();
+        int initialCacheSize = cache.size();
+        cache.entrySet().removeIf(entry -> entry.getValue().expiry().isBefore(now));
+        log.info("Cleared {} expired cache entries", initialCacheSize - cache.size());
+    }
+
+    @RateLimit(limit = 100, timeValue = 1, timeUnit = TimeUnit.MINUTES, key = "addLogin")
+    @Override
+    public ResponseEntity<String> requestLogin(String authorization, String uuid) {
+        UUID uuidFromString;
+        try {
+            uuidFromString = UUID.fromString(uuid);
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.badRequest().build();
+        }
+
+        log.info("{} is requesting a login code", uuid);
+
+        if (authorization == null || !authorization.startsWith("SECRET ")) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+
+        String secret = authorization.substring("SECRET ".length());
+        if (!isValidSecret(secret)) {
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Invalid secret");
+        }
+
+        Optional<String> key = cache.entrySet().stream()
+                                    .filter(entry -> entry.getValue().uuid.equals(uuidFromString))
+                                    .map(Map.Entry::getKey)
+                                    .findFirst();
+
+        if (key.isPresent()) {
+            log.info("{} got cached key: {}", uuid,  key.get());
+            return ResponseEntity.ok(key.get());
+        }
+
+        String loginCode = generateLoginCode(uuidFromString);
+        log.info("{} received login code: {}", uuid, loginCode);
+        return ResponseEntity.ok(loginCode);
+    }
+
+    @Override
+    public ResponseEntity<UsernameDto> getUsername() {
+        log.debug("Loading username for logged in user");
+
+        try {
+            // Get authenticated UUID using the utility method
+            UUID uuid = authenticatedUuid.getAuthenticatedUserUuid();
+            log.debug("Loaded username for logged in user {}", uuid);
+
+            // Create response with username
+            UsernameDto usernameDto = new UsernameDto();
+            usernameDto.setUsername(getUsername(uuid));
+            log.debug("Loaded username for logged in user {}", usernameDto.getUsername());
+
+            return ResponseEntity.ok(usernameDto);
+
+        } catch (ResponseStatusException e) {
+            // The utility method already throws proper exceptions, we just need to convert them to ResponseEntity
+            return ResponseEntity.status(e.getStatusCode()).build();
+        }
+    }
+
+    private String getUsername(UUID uuid) {
+        CompletableFuture<String> username = new CompletableFuture<>();
+
+        Connection.getConnection(Databases.LITE_BANS)
+                  .runQuery(sqlSession -> {
+                      log.debug("Loading all history through logged in uuid");
+                      try {
+                          String temp = sqlSession
+                                  .getMapper(RecentNamesMapper.class)
+                                  .getUsername(uuid.toString());
+                          username.complete(temp);
+                      } catch (Exception e) {
+                          log.error("Failed to find username for uuid {}", uuid, e);
+                          username.completeExceptionally(e);
+                      }
+                  });
+        return username.join();
+    }
+
+    @Value("${UNSECURED:#{false}}")
+    private boolean unsecured;
+
+    @RateLimit(limit = 5, timeValue = 1, timeUnit = TimeUnit.MINUTES, key = "login")
+    @Override
+    public ResponseEntity<String> login(String code) {
+        if (unsecured) {
+            log.warn("Unsecured login is enabled, skipping login validation!");
+        } else {
+            log.info("Received login request with code {}", code);
+        }
+        if (code == null) {
+            log.warn("Received null login code");
+            return ResponseEntity.badRequest().build();
+        }
+
+        CacheEntry cacheEntry = cache.get(code);
+        if (!unsecured && (cacheEntry == null || cacheEntry.expiry().isBefore(Instant.now()))) {
+            log.warn("Received invalid login code {}", code);
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+
+        if (unsecured && cacheEntry == null) {
+            cacheEntry = new CacheEntry(UUID.fromString("55e46bc3-2a29-4c53-850f-dbd944dc5c5f"), Instant.now().plusSeconds(TimeUnit.DAYS.toSeconds(1)));
+        }
+
+        String token = generateToken(cacheEntry.uuid);
+        log.debug("Generated token for user {} with token {}", cacheEntry.uuid, token);
+
+        cache.remove(code);
+
+        log.debug("Generated token for user {}", cacheEntry.uuid);
+        return ResponseEntity.ok(token);
+    }
+
+    private String generateLoginCode(UUID uuid) {
+        String characters = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+        StringBuilder loginCode = new StringBuilder();
+        for (int i = 0; i < 8; i++) {
+            int index = (int) (Math.random() * characters.length());
+            loginCode.append(characters.charAt(index));
+        }
+        CacheEntry cacheEntry = new CacheEntry(uuid,
+                Instant.now().plusSeconds(TimeUnit.MINUTES.toSeconds(15)));
+        cache.put(loginCode.toString(), cacheEntry);
+        return loginCode.toString();
+    }
+
+    private boolean isValidSecret(String secret) {
+        if (loginSecret == null) {
+            log.warn("No login secret set, skipping secret validation");
+            return false;
+        }
+        if (loginSecret.length() < 16) {
+            log.warn("Login secret is too short, skipping secret validation");
+            return false;
+        }
+        if (!loginSecret.equals(secret)) {
+            log.info("Received invalid secret attempt");
+            return false;
+        }
+        return true;
+    }
+
+    private String generateToken(UUID uuid) {
+        Instant now = Instant.now();
+        //TODO make a JWT for renewing and one for storing permissions for a session (expiry 1 hour)
+        Instant expiryTime = now.plusSeconds(TimeUnit.DAYS.toSeconds(30));
+        CompletableFuture<Optional<PrivilegedUser>> privilegedUserCompletableFuture = new CompletableFuture<>();
+        List<PermissionClaimDto> claimList = new ArrayList<>();
+        Connection.getConnection(Databases.DEFAULT)
+                  .runQuery(sqlSession -> {
+                      try {
+                          log.debug("Loading user by uuid {}", uuid.toString());
+                          PrivilegedUserMapper mapper = sqlSession.getMapper(PrivilegedUserMapper.class);
+                          Optional<PrivilegedUser> optionalPrivilegedUser = mapper
+                                  .getUserByUuid(uuid);
+
+                          if (optionalPrivilegedUser.isEmpty()) {
+                              PrivilegedUser privilegedUser = new PrivilegedUser(null, uuid, List.of());
+                              mapper.createPrivilegedUser(privilegedUser);
+                              privilegedUserCompletableFuture.complete(
+                                      Optional.of(privilegedUser));
+                          } else {
+                              privilegedUserCompletableFuture.complete(optionalPrivilegedUser);
+                          }
+                      } catch (Exception e) {
+                          log.error("Failed to load user by uuid", e);
+                          privilegedUserCompletableFuture.completeExceptionally(e);
+                      }
+                  });
+        Optional<PrivilegedUser> privilegedUser = privilegedUserCompletableFuture.join();
+        claimList.add(PermissionClaimDto.USER);
+        privilegedUser.ifPresent(user -> user.getPermissions().forEach(permission -> {
+            try {
+                claimList.add(PermissionClaimDto.fromValue(permission));
+                log.debug("Added permission claim {}", permission);
+            } catch (IllegalArgumentException e) {
+                log.warn("Received invalid permission claim: {}", permission);
+            }
+        }));
+        log.debug("Generated token for user {} with claims {}", uuid.toString(),
+                claimList.stream().map(PermissionClaimDto::getValue).toList());
+        JwtClaimsSet claims = JwtClaimsSet.builder()
+                                          .issuer(serverAddress)
+                                          .claim("authorities",
+                                                  claimList.stream().map(PermissionClaimDto::getValue).toList())
+                                          .issuedAt(now)
+                                          .expiresAt(expiryTime)
+                                          .subject(uuid.toString())
+                                          .build();
+
+        return jwtEncoder.encode(JwtEncoderParameters.from(claims)).getTokenValue();
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/particles/ParticleController.java

@@ -0,0 +1,141 @@
+package com.alttd.altitudeweb.controllers.particles;
+
+import com.alttd.altitudeweb.api.ParticlesApi;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.client.RestTemplate;
+import org.springframework.web.multipart.MultipartFile;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+@Slf4j
+@RequiredArgsConstructor
+@RestController
+public class ParticleController implements ParticlesApi {
+
+//    @Value("${login.secret:#{null}}")
+//    private String loginSecret;
+
+    @Value("${particles.file_path}")
+    private String particlesFilePath;
+
+//    @Value("${notification.server.url:http://localhost:8080}")
+//    private String notificationServerUrl;
+
+    @Override
+    public ResponseEntity<Resource> downloadFile(String filename) {
+        File file = new File(particlesFilePath);
+        if (!file.exists() || !file.isDirectory()) {
+            log.error("Particles file path {} is not a directory, not downloading particles file", particlesFilePath);
+            return ResponseEntity.status(404).build();
+        }
+        return getFileForDownload(file, filename);
+    }
+
+    @Override
+    public ResponseEntity<Resource> downloadFileForUser(String uuid, String filename) {
+        File file = new File(particlesFilePath);
+        if (!file.exists() || !file.isDirectory()) {
+            log.error("Particles file path {} is not a directory, not downloading particles user file", particlesFilePath);
+            return ResponseEntity.status(404).build();
+        }
+        File targetDir = new File(file, uuid);
+        if (targetDir.exists()) {
+            return getFileForDownload(targetDir, filename);
+        } else {
+            log.warn("User {} does not have a directory for particles files", uuid);
+            return ResponseEntity.notFound().build();
+        }
+    }
+
+    private ResponseEntity<Resource> getFileForDownload(File file, String filename) {
+        filename += ".json";
+        File targetFile = new File(file, filename);
+        if (!targetFile.exists()) {
+            log.warn("Particles file {} does not exist", targetFile.getAbsolutePath());
+            return ResponseEntity.notFound().build();
+        }
+
+        if (!targetFile.isFile()) {
+            log.warn("Particles file {} is not a file", targetFile.getAbsolutePath());
+            return ResponseEntity.status(404).build();
+        }
+
+        try {
+            Path path = targetFile.toPath();
+            ByteArrayResource resource = new ByteArrayResource(Files.readAllBytes(path));
+
+            return ResponseEntity.ok()
+                    .contentLength(targetFile.length())
+                    .contentType(MediaType.APPLICATION_JSON)
+                    .header(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"" + filename + "\"")
+                    .body(resource);
+        } catch (IOException e) {
+            log.error("Failed to read particles file {}: {}", targetFile.getAbsolutePath(), e.getMessage(), e);
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build();
+        }
+
+    }
+
+    @Override
+    public ResponseEntity<Void> saveFile(String filename, MultipartFile content) {
+        File file = new File(particlesFilePath);
+        if (!file.exists() || !file.isDirectory()) {
+            log.error("Particles file path {} is not a directory, not saving particles file", particlesFilePath);
+            return ResponseEntity.status(404).build();
+        }
+        return writeContentToFile(file, filename, content);
+    }
+
+    @Override
+    public ResponseEntity<Void> saveFileForUser(String uuid, String filename, MultipartFile content) {
+        File file = new File(particlesFilePath);
+        if (!file.exists() || !file.isDirectory()) {
+            log.error("Particles file path {} is not a directory, not saving particles user file", particlesFilePath);
+            return ResponseEntity.status(404).build();
+        }
+        File targetDir = new File(file, uuid);
+        if (!file.exists()) {
+            log.debug("Creating particles directory {}", targetDir.getAbsolutePath());
+            if (targetDir.mkdirs()) {
+                log.info("Created particles user directory {}", targetDir.getAbsolutePath());
+            }
+        }
+
+        return writeContentToFile(file, filename, content);
+    }
+
+
+    private ResponseEntity<Void> writeContentToFile(File dir, String filename, MultipartFile content) {
+        filename += ".json";
+        File targetFile = new File(dir, filename);
+        if (!Files.isWritable(targetFile.toPath())) {
+            log.error("Particles file {} is not writable", targetFile.getAbsolutePath());
+            return ResponseEntity.status(403).build();
+        }
+
+        if (targetFile.exists()) {
+            log.warn("Overwriting existing particles file {}", targetFile.getAbsolutePath());
+        }
+
+        try {
+            content.transferTo(targetFile);
+        } catch (Exception e) {
+            log.error("Failed to write particles file {}", targetFile.getAbsolutePath(), e);
+            return ResponseEntity.status(500).build();
+        }
+
+        return ResponseEntity.ok().build();
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/site/SiteController.java

@@ -0,0 +1,57 @@
+package com.alttd.altitudeweb.controllers.site;
+
+import com.alttd.altitudeweb.api.SiteApi;
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
+import com.alttd.altitudeweb.model.StaffPlaytimeDto;
+import com.alttd.altitudeweb.model.StaffPlaytimeListDto;
+import com.alttd.altitudeweb.model.VoteDataDto;
+import com.alttd.altitudeweb.model.VoteStatsDto;
+import com.alttd.altitudeweb.services.limits.RateLimit;
+import com.alttd.altitudeweb.services.site.StaffPtService;
+import com.alttd.altitudeweb.services.site.VoteService;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.time.Instant;
+import java.time.OffsetDateTime;
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+
+@Slf4j
+@RestController
+@RequiredArgsConstructor
+@RateLimit(limit = 2, timeValue = 10, timeUnit = TimeUnit.SECONDS)
+public class SiteController implements SiteApi {
+
+    private final VoteService voteService;
+    private final AuthenticatedUuid authenticatedUuid;
+    private final StaffPtService staffPtService;
+
+    @Override
+    @RateLimit(limit = 1, timeValue = 1, timeUnit = TimeUnit.SECONDS, key = "getStaffPlaytime")
+    public ResponseEntity<StaffPlaytimeListDto> getStaffPlaytime(OffsetDateTime from, OffsetDateTime to) {
+        Optional<List<StaffPlaytimeDto>> staffPlaytimeDto = staffPtService.getStaffPlaytime(from.toInstant(), to.toInstant());
+        if (staffPlaytimeDto.isEmpty()) {
+             return ResponseEntity.noContent().build();
+        }
+        StaffPlaytimeListDto staffPlaytimeListDto = new StaffPlaytimeListDto();
+        staffPlaytimeListDto.addAll(staffPlaytimeDto.get());
+        return ResponseEntity.ok(staffPlaytimeListDto);
+    }
+
+    @Override
+    @RateLimit(limit = 5, timeValue = 1, timeUnit = TimeUnit.MINUTES, key = "getVoteStats")
+    public ResponseEntity<VoteDataDto> getVoteStats() {
+        UUID uuid = authenticatedUuid.getAuthenticatedUserUuid();
+        Optional<VoteDataDto> optionalVoteDataDto = voteService.getVoteStats(uuid);
+        if (optionalVoteDataDto.isEmpty()) {
+            return ResponseEntity.noContent().build();
+        }
+        VoteDataDto voteDataDto = optionalVoteDataDto.get();
+        return ResponseEntity.ok(voteDataDto);
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/controllers/team/TeamApiController.java

@@ -1,7 +1,7 @@
 package com.alttd.altitudeweb.controllers.team;
 
 import com.alttd.altitudeweb.api.TeamApi;
-import com.alttd.altitudeweb.controllers.limits.RateLimit;
+import com.alttd.altitudeweb.services.limits.RateLimit;
 import com.alttd.altitudeweb.setup.Connection;
 import com.alttd.altitudeweb.database.Databases;
 import com.alttd.altitudeweb.database.luckperms.Player;

backend/src/main/java/com/alttd/altitudeweb/mappers/AppealDataMapper.java

@@ -0,0 +1,35 @@
+package com.alttd.altitudeweb.mappers;
+
+import com.alttd.altitudeweb.database.web_db.forms.Appeal;
+import com.alttd.altitudeweb.model.MinecraftAppealDto;
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Service
+public class AppealDataMapper {
+    public MinecraftAppealDto appealToMinecraftAppealDto(Appeal appeal) {
+        MinecraftAppealDto minecraftAppealDto = new MinecraftAppealDto();
+        minecraftAppealDto.setAppeal(appeal.reason());
+        minecraftAppealDto.setUsername(appeal.username());
+        minecraftAppealDto.setUuid(appeal.uuid());
+        minecraftAppealDto.setEmail(appeal.email());
+        return minecraftAppealDto;
+    }
+
+    public Appeal minecraftAppealDtoToAppeal(MinecraftAppealDto minecraftAppealDto) {
+        return new Appeal(
+                UUID.randomUUID(),
+                minecraftAppealDto.getUuid(),
+                minecraftAppealDto.getPunishmentType().toString(),
+                minecraftAppealDto.getPunishmentId(),
+                minecraftAppealDto.getUsername(),
+                minecraftAppealDto.getAppeal(),
+                Instant.now(),
+                null,
+                minecraftAppealDto.getEmail(),
+                null
+        );
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/mappers/BannedUserToBannedUserDtoMapper.java

@@ -0,0 +1,14 @@
+package com.alttd.altitudeweb.mappers;
+
+import com.alttd.altitudeweb.model.BannedUserDto;
+import com.alttd.webinterface.appeals.BannedUser;
+import org.springframework.stereotype.Service;
+
+@Service
+public class BannedUserToBannedUserDtoMapper {
+
+    public BannedUserDto map(BannedUser bannedUser) {
+        return new BannedUserDto(String.valueOf(bannedUser.userId()), bannedUser.reason(), bannedUser.name(), bannedUser.avatarUrl());
+    }
+
+}

backend/src/main/java/com/alttd/altitudeweb/mappers/DiscordAppealDtoToDiscordAppealMapper.java

@@ -0,0 +1,26 @@
+package com.alttd.altitudeweb.mappers;
+
+import com.alttd.altitudeweb.database.web_db.forms.DiscordAppeal;
+import com.alttd.altitudeweb.model.DiscordAppealDto;
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Service
+public class DiscordAppealDtoToDiscordAppealMapper {
+
+    public DiscordAppeal map(DiscordAppealDto discordAppealDto, UUID loggedInUserUuid, String discordUsername) {
+        return new DiscordAppeal(
+                UUID.randomUUID(),
+                loggedInUserUuid,
+                Long.parseLong(discordAppealDto.getDiscordId()),
+                discordUsername,
+                discordAppealDto.getAppeal(),
+                Instant.now(),
+                null,
+                discordAppealDto.getEmail(),
+                null);
+    }
+
+}

backend/src/main/java/com/alttd/altitudeweb/mappers/StaffApplicationDataMapper.java

@@ -0,0 +1,53 @@
+package com.alttd.altitudeweb.mappers;
+
+import com.alttd.altitudeweb.database.web_db.forms.StaffApplication;
+import com.alttd.altitudeweb.model.StaffApplicationDto;
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.UUID;
+import java.util.stream.Collectors;
+
+@Service
+public class StaffApplicationDataMapper {
+
+    /**
+     * Maps the incoming DTO and the authenticated user's UUID to a StaffApplication entity.
+     * Normalizes and prepares fields as needed (lowercase email, join availableDays, timestamps, ids).
+     */
+    public StaffApplication map(UUID userUuid, StaffApplicationDto dto) {
+        String email = dto.getEmail() == null ? null : dto.getEmail().toLowerCase();
+        String availableDaysJoined = joinList(dto.getAvailableDays());
+
+        return new StaffApplication(
+                UUID.randomUUID(),
+                userUuid,
+                email,
+                dto.getAge(),
+                dto.getDiscordUsername(),
+                Boolean.TRUE.equals(dto.getMeetsRequirements()),
+                dto.getPronouns(),
+                dto.getJoinDate(),
+                dto.getWeeklyPlaytime(),
+                availableDaysJoined,
+                dto.getAvailableTimes(),
+                dto.getPreviousExperience(),
+                dto.getPluginExperience(),
+                dto.getModeratorExpectations(),
+                dto.getAdditionalInfo(),
+                Instant.now(),
+                null,
+                null
+        );
+    }
+
+    private String joinList(List<String> list) {
+        if (list == null) return null;
+        // Avoid NPEs and trim entries
+        return list.stream()
+                .filter(s -> s != null && !s.isBlank())
+                .map(String::trim)
+                .collect(Collectors.joining(","));
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/mappers/StaffPtToStaffPlaytimeMapper.java

@@ -0,0 +1,70 @@
+package com.alttd.altitudeweb.mappers;
+
+import com.alttd.altitudeweb.database.luckperms.PlayerWithGroup;
+import com.alttd.altitudeweb.database.proxyplaytime.StaffPt;
+import com.alttd.altitudeweb.model.StaffPlaytimeDto;
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.time.OffsetDateTime;
+import java.time.ZoneOffset;
+import java.util.*;
+import java.util.concurrent.TimeUnit;
+
+@Service
+public final class StaffPtToStaffPlaytimeMapper {
+    private record PlaytimeInfo(long totalPlaytime, long lastPlayed) {}
+
+    public List<StaffPlaytimeDto> map(List<StaffPt> sessions, List<PlayerWithGroup> staffMembers, long from, long to, HashMap<String, String> staffGroupsMap) {
+        Map<UUID, PlaytimeInfo> playtimeData = getUuidPlaytimeInfoMap(sessions, from, to);
+
+        for (PlayerWithGroup staffMember : staffMembers) {
+            if (!playtimeData.containsKey(staffMember.uuid())) {
+                playtimeData.put(staffMember.uuid(), new PlaytimeInfo(0L, Long.MIN_VALUE));
+            }
+        }
+
+        List<StaffPlaytimeDto> results = new ArrayList<>(playtimeData.size());
+        for (Map.Entry<UUID, PlaytimeInfo> entry : playtimeData.entrySet()) {
+            long lastPlayedMillis = entry.getValue().lastPlayed() == Long.MIN_VALUE ? 0L : entry.getValue().lastPlayed();
+            StaffPlaytimeDto dto = new StaffPlaytimeDto();
+            Optional<PlayerWithGroup> first = staffMembers.stream()
+                    .filter(player -> player.uuid().equals(entry.getKey())).findFirst();
+            dto.setStaffMember(first.isPresent() ? first.get().username() : entry.getKey().toString());
+            dto.setStaffMember(staffMembers.stream()
+                                       .filter(player -> player.uuid().equals(entry.getKey()))
+                                       .map(PlayerWithGroup::username)
+                                       .findFirst()
+                                       .orElse(entry.getKey().toString())
+                              );
+            dto.setLastPlayed(OffsetDateTime.ofInstant(Instant.ofEpochMilli(lastPlayedMillis), ZoneOffset.UTC));
+            dto.setPlaytime((int) TimeUnit.MILLISECONDS.toMinutes(entry.getValue().totalPlaytime()));
+            if (first.isPresent()) {
+                dto.setRole(staffGroupsMap.getOrDefault(first.get().group(), "Unknown"));
+            } else {
+                dto.setRole("Unknown");
+            }
+            results.add(dto);
+        }
+        return results;
+    }
+
+    private Map<UUID, PlaytimeInfo> getUuidPlaytimeInfoMap(List<StaffPt> sessions, long from, long to) {
+        Map<UUID, PlaytimeInfo> playtimeData = new HashMap<>();
+        for (StaffPt session : sessions) {
+            long overlapStart = Math.max(session.sessionStart(), from);
+            long overlapEnd = Math.min(session.sessionEnd(), to);
+            if (overlapEnd <= overlapStart) {
+                continue;
+            }
+
+            PlaytimeInfo info = playtimeData.getOrDefault(session.uuid(), new PlaytimeInfo(0L, Long.MIN_VALUE));
+            long totalPlaytime = info.totalPlaytime() + (overlapEnd - overlapStart);
+            long lastPlayed = Math.max(info.lastPlayed(), overlapEnd);
+            playtimeData.put(session.uuid(), new PlaytimeInfo(totalPlaytime, lastPlayed));
+        }
+        return playtimeData;
+    }
+}
+
+

backend/src/main/java/com/alttd/altitudeweb/mappers/VotingStatsRowToVoteDataDto.java

@@ -0,0 +1,62 @@
+package com.alttd.altitudeweb.mappers;
+
+import com.alttd.altitudeweb.database.votingplugin.VotingStatsRow;
+import com.alttd.altitudeweb.model.VoteDataDto;
+import com.alttd.altitudeweb.model.VoteInfoDto;
+import com.alttd.altitudeweb.model.VoteStatsDto;
+import com.alttd.altitudeweb.model.VoteStreakDto;
+import org.springframework.stereotype.Service;
+
+import java.util.Arrays;
+import java.util.List;
+
+@Service
+public class VotingStatsRowToVoteDataDto {
+
+    public VoteDataDto map(VotingStatsRow votingStatsRow) {
+        VoteDataDto voteDataDto = new VoteDataDto();
+        voteDataDto.setVoteStats(getVoteStats(votingStatsRow));
+        voteDataDto.setVoteStreak(getVoteStreak(votingStatsRow));
+        voteDataDto.setBestVoteStreak(getBestVoteStreak(votingStatsRow));
+        voteDataDto.setAllVoteInfo(getVoteInfo(votingStatsRow.lastVotes()));
+        return voteDataDto;
+    }
+
+    private VoteStreakDto getVoteStreak(VotingStatsRow votingStatsRow) {
+        VoteStreakDto voteStreakDto = new VoteStreakDto();
+        voteStreakDto.setDailyStreak(votingStatsRow.dailyStreak());
+        voteStreakDto.setWeeklyStreak(votingStatsRow.weeklyStreak());
+        voteStreakDto.setMonthlyStreak(votingStatsRow.monthlyStreak());
+        return voteStreakDto;
+    }
+
+    private VoteStreakDto getBestVoteStreak(VotingStatsRow votingStatsRow) {
+        VoteStreakDto voteStreakDto = new VoteStreakDto();
+        voteStreakDto.setDailyStreak(votingStatsRow.bestDailyStreak());
+        voteStreakDto.setWeeklyStreak(votingStatsRow.bestWeeklyStreak());
+        voteStreakDto.setMonthlyStreak(votingStatsRow.bestMonthlyStreak());
+        return voteStreakDto;
+    }
+
+
+    private VoteStatsDto getVoteStats(VotingStatsRow votingStatsRow) {
+        VoteStatsDto voteStatsDto = new VoteStatsDto();
+        voteStatsDto.setDaily(votingStatsRow.totalVotesToday());
+        voteStatsDto.setWeekly(votingStatsRow.totalVotesThisWeek());
+        voteStatsDto.setMonthly(votingStatsRow.totalVotesThisMonth());
+        voteStatsDto.setTotal(votingStatsRow.totalVotesAllTime());
+        return voteStatsDto;
+    }
+
+    private List<VoteInfoDto> getVoteInfo(String lastVotes) {
+        return Arrays.stream(lastVotes.split("%line%"))
+                .map(voteInfo -> {
+                    String[] siteAndTimestamp = voteInfo.split("//");
+                    VoteInfoDto voteInfoDto = new VoteInfoDto();
+                    voteInfoDto.setSiteName(siteAndTimestamp[0]);
+                    voteInfoDto.setLastVoteTimestamp(Long.parseLong(siteAndTimestamp[1]));
+                    return voteInfoDto;
+                })
+                .toList();
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/ChatInfoService.java

@@ -0,0 +1,44 @@
+package com.alttd.altitudeweb.services.chat;
+
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.chat.NicknameMapper;
+import com.alttd.altitudeweb.database.chat.PartyMapper;
+import com.alttd.altitudeweb.database.luckperms.UUIDUsernameMapper;
+import com.alttd.altitudeweb.model.PlayerNameDto;
+import com.alttd.altitudeweb.setup.Connection;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+
+import java.util.Optional;
+import java.util.UUID;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class ChatInfoService {
+
+    public Optional<PlayerNameDto> getPlayerName(UUID uuid) {
+        String username = Connection.getConnection(Databases.LUCK_PERMS)
+                .runQueryWithResult(sqlSession -> sqlSession.getMapper(UUIDUsernameMapper.class).getUsernameFromUUID(uuid.toString()));
+
+        if (username == null) {
+            return Optional.empty();
+        }
+
+        Optional<String> nickname = Connection.getConnection(Databases.CHAT)
+                .runQueryWithResult(sqlSession -> sqlSession.getMapper(NicknameMapper.class).getNicknameFromUUID(uuid.toString()));
+
+        PlayerNameDto playerNameDto = new PlayerNameDto();
+        playerNameDto.setName(username);
+        playerNameDto.setNickname(nickname.orElse(null));
+
+        return Optional.of(playerNameDto);
+    }
+
+    public Optional<String> getPartyName(int id) {
+        return Connection.getConnection(Databases.CHAT)
+                .runQueryWithResult(sqlSession -> sqlSession.getMapper(PartyMapper.class).getPartyName(id));
+    }
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/ChatService.java

@@ -0,0 +1,263 @@
+package com.alttd.altitudeweb.services.chat;
+
+import com.alttd.altitudeweb.controllers.chat.ChatMessage;
+import com.alttd.altitudeweb.controllers.chat.ChatMessageMapper;
+import com.alttd.altitudeweb.controllers.chat.ServerStateMapper;
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.chat.ChatLogMapper;
+import com.alttd.altitudeweb.database.web_db.chat_session.ChatSession;
+import com.alttd.altitudeweb.database.web_db.chat_session.ChatSessionMapper;
+import com.alttd.altitudeweb.model.PermissionClaimDto;
+import com.alttd.altitudeweb.model.ServerDto;
+import com.alttd.altitudeweb.model.ServerStateDto;
+import com.alttd.altitudeweb.services.chat.event_publisher.EventPublisher;
+import com.alttd.altitudeweb.services.chat.event_publisher.EventUser;
+import com.alttd.altitudeweb.services.chat.event_publisher.MessageForUser;
+import com.alttd.altitudeweb.services.chat.to_server.ServerMessageService;
+import com.alttd.altitudeweb.services.chat.to_server.mappers.PlayerListStateMapper;
+import com.alttd.altitudeweb.setup.Connection;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.event.EventListener;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Service;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.web.servlet.mvc.method.annotation.SseEmitter;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.*;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.stream.Collectors;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class ChatService {
+
+    private static final Duration MAX_AGE = Duration.ofHours(1);
+    private final EventPublisher eventPublisher;
+    private final ServerMessageService serverMessageService;
+    private final NavigableMap<Instant, ChatMessage> chatMessages = new TreeMap<>();
+    private final Map<String, EventUser> eventUserMap = new ConcurrentHashMap<>();
+    private final Set<UUID> hiddenUsers = ConcurrentHashMap.newKeySet();
+    private final Map<String, ServerDto> serverStateCache = new HashMap<>();
+
+    @Value("${chat.allowed-servers}")
+    private String[] allowedServers;
+    private long lastMillis = 0;
+
+    @Scheduled(cron = "0 * * * * *")
+    public void clearOldMessages() {
+        Instant cutoff = Instant.now().minus(MAX_AGE);
+        int currentSize = chatMessages.size();
+
+        chatMessages.headMap(cutoff, false).clear();
+
+        log.info("Clearing old chat messages. Removed {}/{} messages",
+                currentSize - chatMessages.size(), currentSize);
+    }
+
+    @EventListener(ApplicationReadyEvent.class)
+    public void loadMessagesFromDb() {
+        Connection.getConnection(Databases.CHAT)
+                .runQuery(sqlSession -> {
+                    log.debug("Loading uuid search result count");
+                    try {
+                        sqlSession.getMapper(ChatLogMapper.class)
+                                .getChatLogs(Instant.now().minus(Duration.ofHours(1)).toEpochMilli())
+                                .stream()
+                                .map(ChatMessageMapper::fromDao)
+                                .forEach(this::putChatMessage);
+                    } catch (Exception e) {
+                        log.error("Failed to load history count", e);
+                    }
+                });
+    }
+
+    public synchronized SseEmitter subscribe(EventUser eventUser, String json) {
+        String key = eventUser.uuid().toString();
+        boolean newUser = eventUserMap.put(key, eventUser) == null;
+        SseEmitter emitter = eventPublisher.subscribe(key, json, this::handleSessionEnd);
+        if (newUser) {
+            sendPlayerStateToServers();
+        }
+        sendServerStateToUser(key, eventUser);
+        return emitter;
+    }
+
+    private synchronized void handleSessionEnd(String key, Instant sessionStart, Instant sessionEnd) {
+        EventUser eventUser = eventUserMap.get(key);
+        if (eventUser == null) {
+            log.error("Failed to find event user for key {}", key);
+            return;
+        }
+        ChatSession chatSession = ChatSession.builder()
+                .uuid(eventUser.uuid())
+                .session_start(sessionStart)
+                .session_end(sessionEnd)
+                .build();
+        saveSession(chatSession);
+
+        if (!eventPublisher.hasSubscribers(key) && eventUserMap.remove(key, eventUser)) {
+            hiddenUsers.remove(eventUser.uuid());
+            sendPlayerStateToServers();
+        }
+    }
+
+    public synchronized void hideUserFromPlayerList(UUID uuid) {
+        requireActiveHeadMod(uuid);
+        if (hiddenUsers.add(uuid)) {
+            sendPlayerStateToServers();
+        }
+    }
+
+    public synchronized void showUserInPlayerList(UUID uuid) {
+        requireActiveHeadMod(uuid);
+        if (hiddenUsers.remove(uuid)) {
+            sendPlayerStateToServers();
+        }
+    }
+
+    public synchronized boolean isUserHiddenFromPlayerList(UUID uuid) {
+        requireActiveHeadMod(uuid);
+        return hiddenUsers.contains(uuid);
+    }
+
+    private void requireActiveHeadMod(UUID uuid) {
+        EventUser eventUser = eventUserMap.get(uuid.toString());
+        if (eventUser == null) {
+            throw new ResponseStatusException(HttpStatus.CONFLICT, "No active chat session");
+        }
+        if (!eventUser.hasPermission(PermissionClaimDto.HEAD_MOD)) {
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Only head moderators can change session visibility");
+        }
+    }
+
+    private void sendPlayerStateToServers() {
+        ArrayList<UUID> activePlayers = eventUserMap.values().stream()
+                .map(EventUser::uuid)
+                .filter(uuid -> !hiddenUsers.contains(uuid))
+                .collect(Collectors.toCollection(ArrayList::new));
+        serverMessageService.sendMessageToAll("player_state", PlayerListStateMapper.fromList(activePlayers));
+    }
+
+    private void saveSession(ChatSession chatSession) {
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sqlSession -> {
+                    log.debug("Saving chat session");
+                    try {
+                        sqlSession.getMapper(ChatSessionMapper.class).storeSession(chatSession);
+                        log.debug("Saved chat session");
+                    } catch (Exception e) {
+                        log.error("Failed to save chat session", e);
+                    }
+                });
+    }
+
+    private synchronized void setUniqueTimestamp(ChatMessage chatMessage) {
+        long timestamp = chatMessage.getTimestamp().toEpochMilli();
+        if (timestamp == lastMillis) {
+            timestamp += 1;
+        } else {
+            return;
+        }
+        lastMillis = timestamp;
+        chatMessage.setTimestamp(Instant.ofEpochMilli(timestamp));
+    }
+
+    private void putChatMessage(ChatMessage chatMessage) {
+        setUniqueTimestamp(chatMessage);
+        chatMessages.put(chatMessage.getTimestamp(), chatMessage);
+    }
+
+    public void addChatMessage(List<ChatMessage> chatMessageList) {
+        chatMessageList.forEach(this::putChatMessage);
+        sendMessagesToListeners(chatMessageList);
+    }
+
+    public synchronized void updateServerState(ServerStateDto serverStateDto) {
+        serverStateDto.getServers().forEach(serverDto -> serverStateCache.put(serverDto.getName(), serverDto));
+        sendToUsers("server-state", this::getServerStateJson);
+    }
+
+    private String getServerStateJson(EventUser eventUser) {
+        if (eventUser.hasPermission(PermissionClaimDto.HEAD_MOD)) {
+            return ServerStateMapper.toJson(new ServerStateDto().servers(serverStateCache.values().stream().toList()));
+        }
+
+        List<ServerDto> filteredServers = serverStateCache.values().stream()
+                .filter(serverDto -> Arrays.asList(allowedServers).contains(serverDto.getName()))
+                .toList();
+
+        return ServerStateMapper.toJson(new ServerStateDto().servers(filteredServers));
+    }
+
+    private void sendServerStateToUser(String key, EventUser eventUser) {
+        String json = getServerStateJson(eventUser);
+        eventPublisher.sendToUser(key, "server-state", json);
+    }
+
+    private void sendMessagesToListeners(List<ChatMessage> chatMessageList) {
+        Map<ChatMessage, String> jsonCache = new HashMap<>();
+        for (ChatMessage message : chatMessageList) {
+            jsonCache.put(message, ChatMessageMapper.toJson(message));
+        }
+
+        sendToUsers("chat", (eventUser) ->
+                chatMessageList.stream()
+                        .filter(chatMessage -> shouldReceive(eventUser, chatMessage))
+                        .map(jsonCache::get)
+                        .collect(Collectors.joining(",", "[", "]"))
+        );
+    }
+
+
+    /**
+     * Broadcasts to every currently subscribed key. The message content for
+     * each key is resolved via messageForUser, which now works off the
+     * unique key itself rather than an EventUser instance.
+     */
+    public void sendToUsers(String eventName, MessageForUser messageForUser) {
+        eventUserMap.forEach((key, eventUser) -> {
+            String json = messageForUser.get(eventUser);
+            eventPublisher.sendToUser(key, eventName, json);
+        });
+    }
+
+    private boolean shouldReceive(EventUser eventUser, ChatMessage chatMessage) {
+        if (eventUser.hasPermission(PermissionClaimDto.HEAD_MOD)) {
+            return true;
+        }
+
+        if (!Arrays.asList(allowedServers).contains(chatMessage.getServer())) {
+            return false;
+        }
+
+        if (!chatMessage.isNotBlocked()) {
+            return false;
+        }
+
+        return switch (chatMessage.getType()) {
+            case PUBLIC, GLOBAL -> true;
+            case PARTY -> {
+                Integer partyId = eventUser.partyId();
+                if (partyId == null) {
+                    yield false;
+                }
+                yield chatMessage.getChannel().equals(String.valueOf(partyId));
+            }
+            case MSG -> eventUser.uuid().toString().equals(chatMessage.getReceiver());
+            case GAC -> eventUser.hasPermission(PermissionClaimDto.MOD);
+            case CUSTOM -> false;
+        };
+    }
+
+    public List<ChatMessage> getMessagesSince(Instant instant) {
+        return chatMessages.tailMap(instant, false).values().stream().toList();
+    }
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/event_publisher/EventPublisher.java

@@ -0,0 +1,148 @@
+package com.alttd.altitudeweb.services.chat.event_publisher;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Service;
+import org.springframework.web.servlet.mvc.method.annotation.SseEmitter;
+
+import java.io.IOException;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+/**
+ * Generic SSE event publisher, keyed by an arbitrary "unique" string
+ * The same key may be used by several concurrent connections
+ * (e.g., a user/server with multiple open tabs or connections).
+ * Each subscribe() call adds its own emitter under that key
+ * without evicting the others.
+ */
+@RequiredArgsConstructor
+@Service
+@Slf4j
+public class EventPublisher {
+
+    private final Map<String, List<SseEmitter>> emitterMap = new ConcurrentHashMap<>();
+    private final Map<SseEmitter, Runnable> emitterCleanupMap = new ConcurrentHashMap<>();
+
+    /**
+     * Invoked once a given emitter for uniqueKey is cleaned up (completed,
+     * timed out, or errored). Callers use this to do whatever bookkeeping
+     * they need (e.g., persisting a Session) using sessionStart/sessionEnd.
+     */
+    @FunctionalInterface
+    public interface SessionCleanupCallback {
+        void onCleanup(String uniqueKey, Instant sessionStart, Instant sessionEnd);
+    }
+    public SseEmitter subscribe(String uniqueKey, SessionCleanupCallback cleanupCallback) {
+        return subscribe(uniqueKey, null, cleanupCallback);
+    }
+
+    public SseEmitter subscribe(String uniqueKey, String initialData, SessionCleanupCallback cleanupCallback) {
+        SseEmitter emitter = new SseEmitter(0L); // no built-in timeout; heartbeat governs liveness
+
+        emitterMap.computeIfAbsent(uniqueKey, k -> new CopyOnWriteArrayList<>()).add(emitter);
+        Instant sessionStart = Instant.now();
+        log.info("Key {} subscribed, active emitters: {}", uniqueKey, countActive());
+
+        AtomicBoolean cleanedUp = new AtomicBoolean();
+        Runnable cleanup = () -> {
+            if (cleanedUp.compareAndSet(false, true)) {
+                handleCleanup(uniqueKey, emitter, sessionStart, cleanupCallback);
+            }
+        };
+        emitterCleanupMap.put(emitter, cleanup);
+
+        // covers: clean disconnect (tab closed normally), server-side timeout, write failure
+        emitter.onCompletion(cleanup);
+        emitter.onTimeout(cleanup);
+        emitter.onError(e -> cleanup.run());
+
+        try {
+            if (initialData != null) {
+                emitter.send(SseEmitter.event().name("connected").data(initialData));
+            } else {
+                emitter.send(SseEmitter.event().name("connected"));
+            }
+        } catch (IOException e) {
+            cleanup.run();
+        }
+
+        return emitter;
+    }
+
+    // runs every 20s: keeps idle timeouts from firing,
+    // AND prunes emitters whose sockets are actually dead
+    @Scheduled(fixedRate = 20_000)
+    public void heartbeat() {
+        emitterMap.values().forEach(list -> {
+            for (SseEmitter emitter : list) {
+                try {
+                    emitter.send(SseEmitter.event().comment("heartbeat"));
+                } catch (IOException e) {
+                    cleanup(emitter);
+                }
+            }
+        });
+        emitterMap.entrySet().removeIf(e -> e.getValue().isEmpty());
+    }
+
+    public void sendToUser(String uniqueKey, String eventName, String json) {
+        List<SseEmitter> userEmitters = emitterMap.get(uniqueKey);
+        if (userEmitters == null) {
+            log.warn("No emitters found for unique key: {}", uniqueKey);
+            return;
+        }
+
+        for (SseEmitter emitter : userEmitters) {
+            try {
+                emitter.send(SseEmitter.event().name(eventName).data(json));
+            } catch (IOException e) {
+                log.warn("Failed to send event to user: {}", uniqueKey, e);
+                cleanup(emitter);
+            }
+        }
+    }
+
+    public boolean hasSubscribers(String uniqueKey) {
+        List<SseEmitter> emitters = emitterMap.get(uniqueKey);
+        return emitters != null && !emitters.isEmpty();
+    }
+
+    private long countActive() {
+        return emitterMap.values().stream().mapToLong(List::size).sum();
+    }
+
+    private void cleanup(SseEmitter emitter) {
+        Runnable cleanup = emitterCleanupMap.get(emitter);
+        if (cleanup != null) {
+            cleanup.run();
+        }
+    }
+
+    private void handleCleanup(String uniqueKey, SseEmitter emitter, Instant sessionStart,
+                               SessionCleanupCallback cleanupCallback) {
+        emitterCleanupMap.remove(emitter);
+        List<SseEmitter> userEmitters = emitterMap.get(uniqueKey);
+        if (userEmitters != null) {
+            userEmitters.remove(emitter);
+            if (userEmitters.isEmpty()) {
+                emitterMap.remove(uniqueKey);
+            }
+        }
+        Instant sessionEnd = Instant.now();
+        Duration between = Duration.between(sessionStart, sessionEnd);
+        log.info("Cleaned up emitter for {}, active emitters: {}, session duration: {}",
+                uniqueKey, countActive(), between
+        );
+
+        if (cleanupCallback != null) {
+            cleanupCallback.onCleanup(uniqueKey, sessionStart, sessionEnd);
+        }
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/event_publisher/EventUser.java

@@ -0,0 +1,28 @@
+package com.alttd.altitudeweb.services.chat.event_publisher;
+
+import com.alttd.altitudeweb.model.PermissionClaimDto;
+
+import java.util.List;
+import java.util.Objects;
+import java.util.UUID;
+
+public record EventUser(UUID uuid, List<String> authorities, Integer partyId) {
+
+    public boolean hasPermission(PermissionClaimDto permission) {
+        return authorities.contains(permission.getValue());
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        EventUser eventUser = (EventUser) o;
+        return Objects.equals(uuid, eventUser.uuid);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(uuid);
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/event_publisher/MessageForUser.java

@@ -0,0 +1,8 @@
+package com.alttd.altitudeweb.services.chat.event_publisher;
+
+@FunctionalInterface
+public interface MessageForUser {
+
+    String get(EventUser eventUser);
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/ServerMessageService.java

@@ -0,0 +1,65 @@
+package com.alttd.altitudeweb.services.chat.to_server;
+
+import com.alttd.altitudeweb.services.chat.event_publisher.EventPublisher;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Service;
+import org.springframework.web.servlet.mvc.method.annotation.SseEmitter;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class ServerMessageService {
+
+    private static final String PLAYER_STATE_CHANNEL = "player_state";
+    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+    private final Set<String> servers = ConcurrentHashMap.newKeySet();
+    private final EventPublisher eventPublisher;
+    private volatile String latestPlayerState;
+
+    public synchronized SseEmitter subscribe(String server) {
+        servers.add(server);
+        log.info("Server {} subscribed", server);
+        SseEmitter emitter = eventPublisher.subscribe(server, this::handleSessionEnd);
+        if (latestPlayerState != null) {
+            eventPublisher.sendToUser(server, PLAYER_STATE_CHANNEL, latestPlayerState);
+        }
+        return emitter;
+    }
+
+    private synchronized void handleSessionEnd(String key, Instant sessionStart, Instant sessionEnd) {
+        log.info("Server session ended for {}. Active from {} for {}", key, sessionStart, Duration.between(sessionStart, sessionEnd));
+    }
+
+    public void sendMessageToAll(String channel, Object data) {
+        String json;
+        try {
+            json = OBJECT_MAPPER.writeValueAsString(data);
+        } catch (JsonProcessingException e) {
+            throw new IllegalStateException("Failed to serialize server message", e);
+        }
+
+        if (PLAYER_STATE_CHANNEL.equals(channel)) {
+            latestPlayerState = json;
+        }
+
+        servers.forEach(server -> eventPublisher.sendToUser(server, channel, json));
+    }
+
+    public boolean sendMessage(String server, String channel, String json) {
+        if (!servers.contains(server)) {
+            log.warn("Server {} is not connected, not sending message", server);
+            return false;
+        }
+        eventPublisher.sendToUser(server, channel, json);
+        return true;
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/data/ChatFromWeb.java

@@ -0,0 +1,16 @@
+package com.alttd.altitudeweb.services.chat.to_server.data;
+
+import lombok.Builder;
+import lombok.Data;
+import lombok.Getter;
+
+import java.util.UUID;
+
+@Builder
+@Getter
+public class ChatFromWeb {
+
+    private final UUID sender;
+    private final String message;
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/data/PartyChatFromWeb.java

@@ -0,0 +1,16 @@
+package com.alttd.altitudeweb.services.chat.to_server.data;
+
+import lombok.Builder;
+import lombok.Getter;
+
+import java.util.UUID;
+
+@Builder
+@Getter
+public class PartyChatFromWeb {
+
+    private final UUID sender;
+    private final String message;
+    private final String partyId;
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/data/PlayerListState.java

@@ -0,0 +1,17 @@
+package com.alttd.altitudeweb.services.chat.to_server.data;
+
+import lombok.Builder;
+import lombok.Data;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+
+import java.util.List;
+import java.util.UUID;
+
+@Builder
+@Getter
+public class PlayerListState {
+
+    private List<UUID> activePlayers;
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/data/PrivateChatFromWeb.java

@@ -0,0 +1,16 @@
+package com.alttd.altitudeweb.services.chat.to_server.data;
+
+import lombok.Builder;
+import lombok.Getter;
+
+import java.util.UUID;
+
+@Builder
+@Getter
+public class PrivateChatFromWeb {
+
+    private final UUID sender;
+    private final String message;
+    private final UUID recipient;
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/data/PunishFromWeb.java

@@ -0,0 +1,18 @@
+package com.alttd.altitudeweb.services.chat.to_server.data;
+
+import lombok.Builder;
+import lombok.Getter;
+
+import java.util.UUID;
+
+@Builder
+@Getter
+public class PunishFromWeb {
+
+    private final UUID executor;
+    private final UUID target;
+    private final String type;
+    private final String reason;
+    private final String time;
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/mappers/ChatFromWebMapper.java

@@ -0,0 +1,18 @@
+package com.alttd.altitudeweb.services.chat.to_server.mappers;
+
+import com.alttd.altitudeweb.model.ServerMessageRequestDto;
+import com.alttd.altitudeweb.services.chat.to_server.data.ChatFromWeb;
+import lombok.experimental.UtilityClass;
+
+@UtilityClass
+public class ChatFromWebMapper {
+
+    public static ChatFromWeb fromDto(ServerMessageRequestDto dto) {
+        return ChatFromWeb.builder()
+                .sender(dto.getUuid())
+                .message(dto.getMessage())
+                .build();
+    }
+
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/mappers/PartyChatFromWebMapper.java

@@ -0,0 +1,18 @@
+package com.alttd.altitudeweb.services.chat.to_server.mappers;
+
+import com.alttd.altitudeweb.model.PartyMessageRequestDto;
+import com.alttd.altitudeweb.services.chat.to_server.data.PartyChatFromWeb;
+import lombok.experimental.UtilityClass;
+
+@UtilityClass
+public class PartyChatFromWebMapper {
+
+    public static PartyChatFromWeb fromDto(PartyMessageRequestDto dto) {
+        return PartyChatFromWeb.builder()
+                .sender(dto.getFrom())
+                .message(dto.getMessage())
+                .partyId(dto.getPartyId())
+                .build();
+    }
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/mappers/PlayerListStateMapper.java

@@ -0,0 +1,19 @@
+package com.alttd.altitudeweb.services.chat.to_server.mappers;
+
+import com.alttd.altitudeweb.services.chat.to_server.data.PlayerListState;
+import lombok.experimental.UtilityClass;
+
+import java.util.ArrayList;
+import java.util.UUID;
+
+@UtilityClass
+public class PlayerListStateMapper {
+
+    public static PlayerListState fromList(ArrayList<UUID> activeViewers) {
+        return PlayerListState.builder()
+                .activePlayers(activeViewers)
+                .build();
+    }
+
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/mappers/PrivateChatFromWebMapper.java

@@ -0,0 +1,18 @@
+package com.alttd.altitudeweb.services.chat.to_server.mappers;
+
+import com.alttd.altitudeweb.model.PrivateMessageRequestDto;
+import com.alttd.altitudeweb.services.chat.to_server.data.PrivateChatFromWeb;
+import lombok.experimental.UtilityClass;
+
+@UtilityClass
+public class PrivateChatFromWebMapper {
+
+    public static PrivateChatFromWeb fromDto(PrivateMessageRequestDto dto) {
+        return PrivateChatFromWeb.builder()
+                .sender(dto.getFrom())
+                .message(dto.getMessage())
+                .recipient(dto.getTo())
+                .build();
+    }
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/chat/to_server/mappers/PunishFromWebMapper.java

@@ -0,0 +1,20 @@
+package com.alttd.altitudeweb.services.chat.to_server.mappers;
+
+import com.alttd.altitudeweb.model.PunishRequestDto;
+import com.alttd.altitudeweb.services.chat.to_server.data.PunishFromWeb;
+import lombok.experimental.UtilityClass;
+
+@UtilityClass
+public class PunishFromWebMapper {
+
+    public static PunishFromWeb fromDto(PunishRequestDto dto) {
+        return PunishFromWeb.builder()
+                .executor(dto.getExecutor())
+                .target(dto.getTarget())
+                .type(dto.getType().getValue())
+                .reason(dto.getReason())
+                .time(dto.getTime())
+                .build();
+    }
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/discord/AppealDiscord.java

@@ -0,0 +1,279 @@
+package com.alttd.altitudeweb.services.discord;
+
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.discord.AppealList;
+import com.alttd.altitudeweb.database.discord.AppealListMapper;
+import com.alttd.altitudeweb.database.discord.OutputChannel;
+import com.alttd.altitudeweb.database.discord.OutputChannelMapper;
+import com.alttd.altitudeweb.database.litebans.HistoryCountMapper;
+import com.alttd.altitudeweb.database.litebans.HistoryRecord;
+import com.alttd.altitudeweb.database.litebans.HistoryType;
+import com.alttd.altitudeweb.database.litebans.UserType;
+import com.alttd.altitudeweb.database.web_db.forms.Appeal;
+import com.alttd.altitudeweb.database.web_db.forms.AppealMapper;
+import com.alttd.altitudeweb.database.web_db.forms.DiscordAppeal;
+import com.alttd.altitudeweb.database.web_db.forms.DiscordAppealMapper;
+import com.alttd.altitudeweb.setup.Connection;
+import com.alttd.webinterface.appeals.AppealSender;
+import com.alttd.webinterface.objects.MessageForEmbed;
+import com.alttd.webinterface.send_message.DiscordSender;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+import java.util.*;
+import java.util.concurrent.CompletableFuture;
+
+@Slf4j
+@Service
+public class AppealDiscord {
+
+    private static final String OUTPUT_TYPE = "APPEAL";
+
+    public void sendAppealToDiscord(DiscordAppeal discordAppeal) {
+        CompletableFuture<List<OutputChannel>> channelsFuture = getChannelListFuture();
+        List<OutputChannel> channels = channelsFuture.join();
+        if (channels.isEmpty()) {
+            log.warn("Discord appeal: No Discord output channels found for type {}. Skipping Discord send.", OUTPUT_TYPE);
+            return;
+        }
+
+        String createdAt = formatInstant(discordAppeal.createdAt());
+        List<DiscordSender.EmbedField> fields = new ArrayList<>();
+
+        // Group: User
+        fields.add(new DiscordSender.EmbedField(
+                "User",
+                """
+                Discord Username: `%s`
+                Discord id: %s
+                MC UUID: %s
+                Submitted: %s
+                """.formatted(
+                        safe(discordAppeal.discordUsername()),
+                        discordAppeal.discordId(),
+                        safe(String.valueOf(discordAppeal.uuid())),
+                        createdAt
+                             ),
+                false
+        ));
+
+        Optional<Long> optionalAssignedTo = assignAppeal();
+        if (optionalAssignedTo.isPresent()) {
+            Long assignedTo = optionalAssignedTo.get();
+            fields.add(new DiscordSender.EmbedField(
+                    "Assigned to",
+                    "Assigned to: <@" + assignedTo + ">",
+                    true
+            ));
+            assignDiscordAppealTo(discordAppeal.id(), assignedTo);
+        } else {
+            fields.add(new DiscordSender.EmbedField(
+                    "Assigned to",
+                    "Assigned to: None (failed to assign)",
+                    true
+            ));
+        }
+
+        String description = safe(discordAppeal.reason());
+
+        List<Long> channelIds = channels.stream()
+                .map(OutputChannel::channel)
+                .toList();
+
+        // colorRgb = null (use default), timestamp = appeal.createdAt if available
+        Instant timestamp = discordAppeal.createdAt() != null ? discordAppeal.createdAt() : Instant.now();
+        MessageForEmbed newAppealSubmitted = new MessageForEmbed(
+                "New Discord Appeal Submitted", description, fields, null, timestamp, null);
+        AppealSender.getInstance().sendAppeal(channelIds, newAppealSubmitted, optionalAssignedTo.orElse(0L));
+    }
+    
+    public void sendAppealToDiscord(Appeal appeal, HistoryRecord history) {
+        // Fetch channels
+        CompletableFuture<List<OutputChannel>> channelsFuture = getChannelListFuture();
+
+        CompletableFuture<Integer> bansF = getCountAsync(HistoryType.BAN, appeal.uuid());
+        CompletableFuture<Integer> mutesF = getCountAsync(HistoryType.MUTE, appeal.uuid());
+        CompletableFuture<Integer> warnsF = getCountAsync(HistoryType.WARN, appeal.uuid());
+        CompletableFuture<Integer> kicksF = getCountAsync(HistoryType.KICK, appeal.uuid());
+
+        List<OutputChannel> channels = channelsFuture.join();
+        int bans = bansF.join();
+        int mutes = mutesF.join();
+        int warns = warnsF.join();
+        int kicks = kicksF.join();
+
+        if (channels.isEmpty()) {
+            log.warn("No Discord output channels found for type {}. Skipping Discord send.", OUTPUT_TYPE);
+            return;
+        }
+
+        // Build embed
+        boolean active = history.getUntil() == null || history.getUntil() <= 0 || history.getUntil() > System.currentTimeMillis();
+        String createdAt = formatInstant(appeal.createdAt());
+
+        List<DiscordSender.EmbedField> fields = new ArrayList<>();
+        // Group: User
+        fields.add(new DiscordSender.EmbedField(
+                "User",
+                "Username: `" + safe(appeal.username()) + "`\n" +
+                        "UUID: " + safe(String.valueOf(appeal.uuid())) + "\n" +
+                        "Submitted: " + createdAt,
+                false
+        ));
+        // Group: Punishment
+        fields.add(new DiscordSender.EmbedField(
+                "Punishment",
+                "Type: " + safe(String.valueOf(appeal.historyType())) + "\n" +
+                        "ID: " + safe(String.valueOf(appeal.historyId())) + "\n" +
+                        "Reason: " + safe(history.getReason()) + "\n" +
+                        "Active: " + active,
+                false
+        ));
+        // Group: Previous punishments
+        fields.add(new DiscordSender.EmbedField(
+                "Previous punishments",
+                "Bans: " + bans + "\n" +
+                        "Mutes: " + mutes + "\n" +
+                        "Warnings: " + warns + "\n" +
+                        "Kicks: " + kicks,
+                true
+        ));
+        Optional<Long> optionalAssignedTo = assignAppeal();
+        if (optionalAssignedTo.isPresent()) {
+            Long assignedTo = optionalAssignedTo.get();
+            fields.add(new DiscordSender.EmbedField(
+                    "Assigned to",
+                    "Assigned to: <@" + assignedTo + ">",
+                    true
+            ));
+            assignMinecraftAppealTo(appeal.id(), assignedTo);
+        } else {
+            fields.add(new DiscordSender.EmbedField(
+                    "Assigned to",
+                    "Assigned to: None (failed to assign)",
+                    true
+            ));
+        }
+
+        String description = safe(appeal.reason());
+
+        List<Long> channelIds = channels.stream()
+                .map(OutputChannel::channel)
+                .toList();
+
+        // colorRgb = null (use default), timestamp = appeal.createdAt if available
+        Instant timestamp = appeal.createdAt() != null ? appeal.createdAt() : Instant.now();
+        MessageForEmbed newAppealSubmitted = new MessageForEmbed(
+                "New Appeal Submitted", description, fields, null, timestamp, null);
+        AppealSender.getInstance().sendAppeal(channelIds, newAppealSubmitted, optionalAssignedTo.orElse(0L));
+    }
+
+    private static CompletableFuture<List<OutputChannel>> getChannelListFuture() {
+        CompletableFuture<List<OutputChannel>> channelsFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.DISCORD).runQuery(sql -> {
+            try {
+                List<OutputChannel> channels = sql.getMapper(OutputChannelMapper.class)
+                        .getChannelsWithOutputType(OUTPUT_TYPE);
+                channelsFuture.complete(channels);
+            } catch (Exception e) {
+                log.error("Failed to load output channels for {}", OUTPUT_TYPE, e);
+                channelsFuture.complete(new ArrayList<>());
+            }
+        });
+        return channelsFuture;
+    }
+
+    private void assignMinecraftAppealTo(UUID appealId, Long assignedTo) {
+        Connection.getConnection(Databases.DEFAULT).runQuery(sql -> {
+            try {
+                sql.getMapper(AppealMapper.class).assignAppeal(appealId, assignedTo);
+            } catch (Exception e) {
+                log.error("Failed to assign appeal to {}", assignedTo, e);
+            }
+        });
+    }
+
+    private void assignDiscordAppealTo(UUID appealId, Long assignedTo) {
+        Connection.getConnection(Databases.DEFAULT).runQuery(sql -> {
+            try {
+                sql.getMapper(DiscordAppealMapper.class).assignDiscordAppeal(appealId, assignedTo);
+            } catch (Exception e) {
+                log.error("Failed to assign appeal to {}", assignedTo, e);
+            }
+        });
+    }
+
+    private CompletableFuture<Integer> getCountAsync(HistoryType type, java.util.UUID uuid) {
+        CompletableFuture<Integer> future = new CompletableFuture<>();
+        Connection.getConnection(Databases.LITE_BANS).runQuery(sql -> {
+            try {
+                Integer count = sql.getMapper(HistoryCountMapper.class)
+                        .getUuidPunishmentCount(type, UserType.PLAYER, uuid);
+                future.complete(count == null ? 0 : count);
+            } catch (Exception e) {
+                log.error("Failed to load punishment count for {} ({})", type, uuid, e);
+                future.complete(0);
+            }
+        });
+        return future;
+    }
+
+    private String safe(String s) {
+        return s == null ? "unknown" : s;
+    }
+
+    private String formatInstant(Instant instant) {
+        if (instant == null) return "unknown";
+        return instant.atZone(ZoneId.of("UTC"))
+                .format(DateTimeFormatter.ofPattern("yyyy MMMM dd hh:mm a '(UTC)'"));
+    }
+
+    private Optional<Long> assignAppeal() {
+        CompletableFuture<Long> assignToCompletableFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.DISCORD).runQuery(sql -> {
+            try {
+                AppealListMapper mapper = sql.getMapper(AppealListMapper.class);
+                List<AppealList> appealList = mapper
+                        .getAppealList();
+
+
+                if (appealList.isEmpty()) {
+                    log.warn("No appeal lists found. Skipping assignment.");
+                    assignToCompletableFuture.complete(0L);
+                    return;
+                }
+                Optional<AppealList> optionalAssignTo = appealList
+                        .stream()
+                        .filter(AppealList::next).findFirst();
+                AppealList assignTo = optionalAssignTo.orElseGet(appealList::getFirst);
+                assignToCompletableFuture.complete(assignTo.userId());
+
+                try {
+                    Optional<AppealList> optionalNextAppealList = appealList
+                            .stream()
+                            .filter(entry -> entry.userId() > assignTo.userId())
+                            .min(Comparator.comparing(AppealList::userId));
+                    AppealList nextAppealList = optionalNextAppealList.orElse(appealList.stream()
+                                                                                      .min(Comparator.comparing(AppealList::userId))
+                                                                                      .orElse(assignTo));
+                    mapper.updateNext(assignTo.userId(), false);
+                    mapper.updateNext(nextAppealList.userId(), true);
+                } catch (Exception e) {
+                    log.error("Failed to assign next appeal", e);
+                }
+
+            } catch (Exception e) {
+                log.error("Failed to load appeal list", e);
+                assignToCompletableFuture.complete(0L);
+            }
+        });
+        Long assignTo = assignToCompletableFuture.join();
+        if (assignTo.equals(0L)) {
+            return Optional.empty();
+        }
+        return Optional.of(assignTo);
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/discord/StaffApplicationDiscord.java

@@ -0,0 +1,103 @@
+package com.alttd.altitudeweb.services.discord;
+
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.discord.OutputChannel;
+import com.alttd.altitudeweb.database.discord.OutputChannelMapper;
+import com.alttd.altitudeweb.database.web_db.forms.StaffApplication;
+import com.alttd.altitudeweb.setup.Connection;
+import com.alttd.webinterface.objects.MessageForEmbed;
+import com.alttd.webinterface.send_message.DiscordSender;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.CompletableFuture;
+
+@Slf4j
+@Service
+public class StaffApplicationDiscord {
+
+    private static final String OUTPUT_TYPE = "STAFF_APPLICATION";
+
+    public void sendApplicationToDiscord(String username, StaffApplication application) {
+        // Fetch channels for staff applications
+        CompletableFuture<List<OutputChannel>> channelsFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.DISCORD).runQuery(sql -> {
+            try {
+                List<OutputChannel> channels = sql.getMapper(OutputChannelMapper.class)
+                        .getChannelsWithOutputType(OUTPUT_TYPE);
+                channelsFuture.complete(channels);
+            } catch (Exception e) {
+                log.error("Failed to load output channels for {}", OUTPUT_TYPE, e);
+                channelsFuture.complete(new ArrayList<>());
+            }
+        });
+
+        List<OutputChannel> channels = channelsFuture.join();
+        if (channels.isEmpty()) {
+            log.warn("No Discord output channels found for type {}. Skipping Discord send.", OUTPUT_TYPE);
+            return;
+        }
+
+        // Build embed content
+        List<DiscordSender.EmbedField> fields = new ArrayList<>();
+        fields.add(new DiscordSender.EmbedField(
+                "Applicant",
+                "Username: `" + safe(username) + "`\n" +
+                        "Discord: `" + safe(application.discordUsername()) + "`\n" +
+                        "Email: " + safe(application.email()) + "\n" +
+                        "Age: " + safe(String.valueOf(application.age())) + "\n" +
+                        "Meets reqs: " + (application.meetsRequirements() != null && application.meetsRequirements()),
+                false
+        ));
+        fields.add(new DiscordSender.EmbedField(
+                "Availability",
+                "Days: " + safe(application.availableDays()) + "\n" +
+                        "Times: " + safe(application.availableTimes()),
+                false
+        ));
+        fields.add(new DiscordSender.EmbedField(
+                "Experience",
+                "Previous: " + safe(application.previousExperience()) + "\n" +
+                        "Plugins: " + safe(application.pluginExperience()) + "\n" +
+                        "Expectations: " + safe(application.moderatorExpectations()),
+                false
+        ));
+        if (application.additionalInfo() != null && !application.additionalInfo().isBlank()) {
+            fields.add(new DiscordSender.EmbedField(
+                    "Additional Info",
+                    application.additionalInfo(),
+                    false
+            ));
+        }
+
+        List<Long> channelIds = channels.stream()
+                .map(OutputChannel::channel)
+                .toList();
+
+        Instant timestamp = application.createdAt() != null ? application.createdAt() : Instant.now();
+        MessageForEmbed messageForEmbed = new MessageForEmbed(
+                "New Staff Application Submitted",
+                "Join date: " + (application.joinDate() != null ? application.joinDate().toString() : "unknown") +
+                "\nSubmitted: " + formatInstant(timestamp),
+                fields,
+                null,
+                timestamp,
+                null);
+        DiscordSender.getInstance().sendEmbedWithThreadToChannels(channelIds, messageForEmbed, "Staff Application");
+    }
+
+    private String safe(String s) {
+        return s == null ? "unknown" : s;
+    }
+
+    private String formatInstant(Instant instant) {
+        if (instant == null) return "unknown";
+        return instant.atZone(ZoneId.of("UTC"))
+                .format(DateTimeFormatter.ofPattern("yyyy MMMM dd hh:mm a '(UTC)'"));
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/forms/DiscordAppeal.java

@@ -0,0 +1,138 @@
+package com.alttd.altitudeweb.services.forms;
+
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.luckperms.UUIDUsernameMapper;
+import com.alttd.altitudeweb.database.web_db.forms.DiscordAppealMapper;
+import com.alttd.altitudeweb.database.web_db.mail.EmailVerification;
+import com.alttd.altitudeweb.database.web_db.mail.EmailVerificationMapper;
+import com.alttd.altitudeweb.mappers.BannedUserToBannedUserDtoMapper;
+import com.alttd.altitudeweb.mappers.DiscordAppealDtoToDiscordAppealMapper;
+import com.alttd.altitudeweb.model.BannedUserResponseDto;
+import com.alttd.altitudeweb.model.DiscordAppealDto;
+import com.alttd.altitudeweb.model.FormResponseDto;
+import com.alttd.altitudeweb.services.discord.AppealDiscord;
+import com.alttd.altitudeweb.services.mail.AppealMail;
+import com.alttd.altitudeweb.setup.Connection;
+import com.alttd.webinterface.appeals.BannedUser;
+import com.alttd.webinterface.appeals.DiscordAppealDiscord;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Service;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.Optional;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class DiscordAppeal {
+
+    private final BannedUserToBannedUserDtoMapper bannedUserToBannedUserDtoMapper;
+    private final DiscordAppealDtoToDiscordAppealMapper discordAppealDtoToDiscordAppealMapper;
+    private final AuthenticatedUuid authenticatedUuid;
+    private final AppealDiscord appealDiscord;
+    private final AppealMail appealMail;
+
+    public BannedUserResponseDto getBannedUser(Long discordId) {
+        DiscordAppealDiscord discordAppeal = DiscordAppealDiscord.getInstance();
+        Optional<BannedUser> join = discordAppeal.getBannedUser(discordId).join();
+        if (join.isEmpty()) {
+            return new BannedUserResponseDto(false);
+        }
+        BannedUserResponseDto bannedUserResponseDto = new BannedUserResponseDto(true);
+        bannedUserResponseDto.setBannedUser(bannedUserToBannedUserDtoMapper.map(join.get()));
+        return bannedUserResponseDto;
+    }
+
+    public FormResponseDto submitAppeal(DiscordAppealDto discordAppealDto) {
+        DiscordAppealDiscord discordAppealDiscord = DiscordAppealDiscord.getInstance();
+        long discordId = Long.parseLong(discordAppealDto.getDiscordId());
+        Optional<BannedUser> join = discordAppealDiscord.getBannedUser(discordId).join();
+        if (join.isEmpty()) {
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "User not found");
+        }
+        BannedUser bannedUser = join.get();
+
+        Optional<UUID> optionalUUID = authenticatedUuid.tryGetAuthenticatedUserUuid();
+        if (optionalUUID.isEmpty()) {
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "User not authenticated");
+        }
+        UUID uuid = optionalUUID.get();
+        CompletableFuture<com.alttd.altitudeweb.database.web_db.forms.DiscordAppeal> appealCompletableFuture = new CompletableFuture<>();
+
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sqlSession -> {
+                    log.debug("Loading history by id");
+                    try {
+                        com.alttd.altitudeweb.database.web_db.forms.DiscordAppeal discordAppealRecord = discordAppealDtoToDiscordAppealMapper
+                                .map(discordAppealDto, uuid, bannedUser.name());
+                        sqlSession.getMapper(DiscordAppealMapper.class).createDiscordAppeal(discordAppealRecord);
+                        appealCompletableFuture.complete(discordAppealRecord);
+                    } catch (Exception e) {
+                        log.error("Failed to load history count", e);
+                        appealCompletableFuture.completeExceptionally(e);
+                    }
+                });
+        com.alttd.altitudeweb.database.web_db.forms.DiscordAppeal discordAppeal = appealCompletableFuture.join();
+
+        CompletableFuture<Optional<EmailVerification>> emailVerificationCompletableFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sqlSession -> {
+                    log.debug("Retrieving mail by uuid and address");
+
+                    EmailVerification verifiedMail = sqlSession.getMapper(EmailVerificationMapper.class)
+                            .findByUserAndEmail(discordAppeal.uuid(), discordAppeal.email().toLowerCase());
+                    emailVerificationCompletableFuture.complete(Optional.ofNullable(verifiedMail));
+                });
+        Optional<EmailVerification> optionalEmailVerification = emailVerificationCompletableFuture.join();
+
+        if (optionalEmailVerification.isEmpty()) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Invalid mail");
+        }
+        EmailVerification emailVerification = optionalEmailVerification.get();
+        if (!emailVerification.verified()) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Mail not verified");
+        }
+
+        try {
+            appealDiscord.sendAppealToDiscord(discordAppeal);
+        } catch (Exception e) {
+            log.error("Failed to send appeal {} to Discord", discordAppeal.id(), e);
+            throw new ResponseStatusException(HttpStatus.INTERNAL_SERVER_ERROR, "Failed to send appeal to Discord");
+        }
+        //TODO verify mail
+        String username = getUsername(uuid);
+        appealMail.sendAppealNotification(discordAppeal, username);
+
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sqlSession -> {
+                    log.debug("Marking appeal {} as sent", discordAppeal.id());
+                    sqlSession.getMapper(DiscordAppealMapper.class)
+                            .markDiscordAppealAsSent(discordAppeal.id());
+                });
+        return new FormResponseDto(
+                discordAppeal.id().toString(),
+                "Your appeal has been submitted. You will be notified when it has been reviewed.",
+                true);
+    }
+
+    private String getUsername(UUID uuid) {
+        CompletableFuture<String> usernameFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.LUCK_PERMS)
+                .runQuery(sqlSession -> {
+                    log.debug("Loading username for uuid {}", uuid);
+                    try {
+                        String username = sqlSession.getMapper(UUIDUsernameMapper.class).getUsernameFromUUID(uuid.toString());
+                        usernameFuture.complete(username);
+                    } catch (Exception e) {
+                        log.error("Failed to load username for uuid {}", uuid, e);
+                        usernameFuture.completeExceptionally(e);
+                    }
+                });
+        return usernameFuture.join();
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/limits/InMemoryRateLimiterService.java

@@ -1,4 +1,4 @@
-package com.alttd.altitudeweb.controllers.limits;
+package com.alttd.altitudeweb.services.limits;
 
 import org.springframework.stereotype.Service;
 

backend/src/main/java/com/alttd/altitudeweb/services/limits/RateLimit.java

@@ -1,4 +1,4 @@
-package com.alttd.altitudeweb.controllers.limits;
+package com.alttd.altitudeweb.services.limits;
 
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;

backend/src/main/java/com/alttd/altitudeweb/services/limits/RateLimitAspect.java

@@ -1,5 +1,6 @@
-package com.alttd.altitudeweb.controllers.limits;
+package com.alttd.altitudeweb.services.limits;
 
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
@@ -16,6 +17,8 @@ import org.springframework.web.context.request.ServletRequestAttributes;
 
 import java.lang.reflect.Method;
 import java.time.Duration;
+import java.util.Optional;
+import java.util.UUID;
 
 @Aspect
 @Component
@@ -24,10 +27,11 @@ import java.time.Duration;
 public class RateLimitAspect {
     
     private final InMemoryRateLimiterService rateLimiterService;
+    private final AuthenticatedUuid authenticatedUuid;
     
     @Around("""
-            @annotation(com.alttd.altitudeweb.controllers.limits.RateLimit)
-            || @within(com.alttd.altitudeweb.controllers.limits.RateLimit)""")
+            @annotation(com.alttd.altitudeweb.services.limits.RateLimit)
+            || @within(com.alttd.altitudeweb.services.limits.RateLimit)""")
     public Object rateLimit(ProceedingJoinPoint joinPoint) throws Throwable {
         ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
         if (requestAttributes == null) {
@@ -37,7 +41,6 @@ public class RateLimitAspect {
         HttpServletRequest request = requestAttributes.getRequest();
         HttpServletResponse response = requestAttributes.getResponse();
 
-        String clientIp = request.getRemoteAddr();
         MethodSignature signature = (MethodSignature) joinPoint.getSignature();
         Method method = signature.getMethod();
         
@@ -54,7 +57,12 @@ public class RateLimitAspect {
         Duration duration = Duration.ofSeconds(rateLimit.timeUnit().toSeconds(rateLimit.timeValue()));
         String customKey = rateLimit.key();
 
-        String key = clientIp + "-" + (customKey.isEmpty() ? method.getName() : customKey);
+        Optional<UUID> optionalUUID = authenticatedUuid.tryGetAuthenticatedUserUuid();
+        if (optionalUUID.isEmpty()) {
+            return joinPoint.proceed();
+        }
+        UUID uuid = optionalUUID.get();
+        String key = uuid + "-" + (customKey.isEmpty() ? method.getName() : customKey);
 
         boolean allowed = rateLimiterService.tryAcquire(key, limit, duration);
         
@@ -67,7 +75,7 @@ public class RateLimitAspect {
             
             return joinPoint.proceed();
         } else {
-            log.warn("Rate limit exceeded for IP: {}, endpoint: {}", clientIp, request.getRequestURI());
+            log.warn("Rate limit exceeded for uuid: {}, endpoint: {}", uuid, request.getRequestURI());
 
             Duration nextResetTime = rateLimiterService.getNextResetTime(key, duration);
 

backend/src/main/java/com/alttd/altitudeweb/services/limits/RequestCounter.java

@@ -1,4 +1,4 @@
-package com.alttd.altitudeweb.controllers.limits;
+package com.alttd.altitudeweb.services.limits;
 
 import java.time.Duration;
 import java.time.Instant;

backend/src/main/java/com/alttd/altitudeweb/services/mail/AppealMail.java

@@ -0,0 +1,111 @@
+package com.alttd.altitudeweb.services.mail;
+
+import com.alttd.altitudeweb.database.litebans.HistoryRecord;
+import com.alttd.altitudeweb.database.web_db.forms.Appeal;
+import com.alttd.altitudeweb.database.web_db.forms.DiscordAppeal;
+import jakarta.mail.MessagingException;
+import jakarta.mail.internet.MimeMessage;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.mail.javamail.JavaMailSender;
+import org.springframework.mail.javamail.MimeMessageHelper;
+import org.springframework.stereotype.Service;
+import org.thymeleaf.context.Context;
+import org.thymeleaf.spring6.SpringTemplateEngine;
+
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class AppealMail {
+
+    private final JavaMailSender mailSender;
+    private final SpringTemplateEngine templateEngine;
+
+    @Value("${spring.mail.username}")
+    private String fromEmail;
+
+    private static final String APPEAL_EMAIL = "[email protected]";
+
+    /**
+     * Sends an email notification about the appeal to both the user and the appeals team.
+     *
+     * @param appeal The appeal object containing all necessary information
+     */
+    public void sendAppealNotification(DiscordAppeal appeal, String username) {
+        try {
+            sendEmailToAppealsTeam(appeal, username);
+
+            log.info("Discord Appeal notification emails sent successfully for appeal ID: {}", appeal.id());
+        } catch (Exception e) {
+            log.error("Failed to send discord appeal notification emails for appeal ID: {}", appeal.id(), e);
+        }
+    }
+    /**
+     * Sends an email notification about the appeal to both the user and the appeals team.
+     *
+     * @param appeal The appeal object containing all necessary information
+     */
+    public void sendAppealNotification(Appeal appeal, HistoryRecord history) {
+        try {
+            sendEmailToAppealsTeam(appeal, history);
+
+            log.info("Appeal notification emails sent successfully for appeal ID: {}", appeal.id());
+        } catch (Exception e) {
+            log.error("Failed to send appeal notification emails for appeal ID: {}", appeal.id(), e);
+        }
+    }
+
+    private void sendEmailToAppealsTeam(Appeal appeal, HistoryRecord history) throws MessagingException {
+        MimeMessage message = mailSender.createMimeMessage();
+        MimeMessageHelper helper = new MimeMessageHelper(message, true);
+
+        helper.setFrom(fromEmail);
+        helper.setTo(APPEAL_EMAIL);
+        helper.setReplyTo(appeal.email());
+        helper.setSubject("New Appeal Submitted - " + appeal.username());
+
+        Context context = new Context();
+        context.setVariable("appeal", appeal);
+        context.setVariable("history", history);
+        context.setVariable("createdAt", appeal.createdAt()
+                                               .atZone(ZoneId.of("UTC"))
+                                               .format(DateTimeFormatter.ofPattern("yyyy MMMM dd hh:mm a '(UTC)'")));
+        context.setVariable("active", history.getUntil() <= 0 || history.getUntil() > System.currentTimeMillis());
+        String content = templateEngine.process("appeal-email", context);
+
+        helper.setText(content, true);
+        mailSender.send(message);
+    }
+
+    private void sendEmailToAppealsTeam(DiscordAppeal appeal, String username) throws MessagingException {
+        MimeMessage message = mailSender.createMimeMessage();
+        MimeMessageHelper helper = getAppealMimeMessageHelper(appeal, message);
+
+        Context context = new Context();
+        context.setVariable("appeal", appeal);
+        context.setVariable("createdAt", appeal.createdAt()
+                                               .atZone(ZoneId.of("UTC"))
+                                               .format(DateTimeFormatter.ofPattern("yyyy MMMM dd hh:mm a '(UTC)'")));
+
+        context.setVariable("minecraftName", username);
+        String content = templateEngine.process("discord-appeal-email", context);
+
+        helper.setText(content, true);
+        mailSender.send(message);
+    }
+
+    private MimeMessageHelper getAppealMimeMessageHelper(DiscordAppeal appeal, MimeMessage message) throws MessagingException {
+        MimeMessageHelper helper = new MimeMessageHelper(message, true);
+
+        helper.setFrom(fromEmail);
+        helper.setTo(APPEAL_EMAIL);
+        helper.setReplyTo(appeal.email());
+        helper.setSubject("New Appeal Submitted - " + appeal.discordUsername());
+        return helper;
+    }
+
+}

backend/src/main/java/com/alttd/altitudeweb/services/mail/MailVerificationService.java

@@ -0,0 +1,144 @@
+package com.alttd.altitudeweb.services.mail;
+
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.web_db.mail.EmailVerification;
+import com.alttd.altitudeweb.database.web_db.mail.EmailVerificationMapper;
+import com.alttd.altitudeweb.setup.Connection;
+import jakarta.mail.MessagingException;
+import jakarta.mail.internet.MimeMessage;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.mail.javamail.JavaMailSender;
+import org.springframework.mail.javamail.MimeMessageHelper;
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.util.Optional;
+import java.util.Random;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class MailVerificationService {
+
+    private final JavaMailSender mailSender;
+
+    @Value("${spring.mail.username}")
+    private String fromEmail;
+
+    public java.util.List<EmailVerification> listAll(UUID userUuid) {
+        java.util.concurrent.CompletableFuture<java.util.List<EmailVerification>> future = new java.util.concurrent.CompletableFuture<>();
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sql -> {
+                    EmailVerificationMapper mapper = sql.getMapper(EmailVerificationMapper.class);
+                    future.complete(mapper.findAllByUser(userUuid));
+                });
+        return future.join();
+    }
+
+    public EmailVerification submitEmail(UUID userUuid, String email) {
+        String code = generateCode();
+        Instant now = Instant.now();
+        final String finalEmail = email.toLowerCase();
+
+        CompletableFuture<EmailVerification> future = new CompletableFuture<>();
+        Connection.getConnection(Databases.DEFAULT)
+                  .runQuery(sql -> {
+                    EmailVerificationMapper mapper = sql.getMapper(EmailVerificationMapper.class);
+                    EmailVerification existing = mapper.findByUserAndEmail(userUuid, finalEmail);
+                    EmailVerification toPersist;
+                    if (existing == null) {
+                        toPersist = new EmailVerification(UUID.randomUUID(), userUuid, finalEmail, code, false, now, null, now);
+                        mapper.insert(toPersist);
+                    } else {
+                        mapper.updateCodeAndLastSent(existing.id(), code, now);
+                        toPersist = new EmailVerification(existing.id(), userUuid, finalEmail, code, false, existing.createdAt(), null, now);
+                    }
+                    future.complete(toPersist);
+                });
+        EmailVerification saved = future.join();
+        sendVerificationEmail(saved);
+        return saved;
+    }
+
+    public Optional<EmailVerification> verifyCode(UUID userUuid, String code) {
+        CompletableFuture<Optional<EmailVerification>> future = new CompletableFuture<>();
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sql -> {
+                    EmailVerificationMapper mapper = sql.getMapper(EmailVerificationMapper.class);
+                    EmailVerification found = mapper.findByUserAndCode(userUuid, code);
+                    if (found == null) {
+                        future.complete(Optional.empty());
+                        return;
+                    }
+                    mapper.markVerified(found.id(), Instant.now());
+                    future.complete(Optional.of(found));
+                });
+        return future.join();
+    }
+
+    public EmailVerification resend(UUID userUuid, String email) {
+        String code = generateCode();
+        Instant now = Instant.now();
+        final String finalEmail = email.toLowerCase();
+        CompletableFuture<EmailVerification> future = new CompletableFuture<>();
+        Connection.getConnection(Databases.DEFAULT)
+                  .runQuery(sql -> {
+                    EmailVerificationMapper mapper = sql.getMapper(EmailVerificationMapper.class);
+                    EmailVerification existing = mapper.findByUserAndEmail(userUuid, finalEmail);
+                    if (existing != null) {
+                        mapper.updateCodeAndLastSent(existing.id(), code, now);
+                        future.complete(new EmailVerification(existing.id(), userUuid,
+                                finalEmail, code, false, existing.createdAt(), null, now));
+                    } else {
+                        future.complete(null);
+                    }
+                });
+        EmailVerification updated = future.join();
+        if (updated != null) {
+            sendVerificationEmail(updated);
+        }
+        return updated;
+    }
+
+    public boolean delete(UUID userUuid, String email) {
+        final String finalEmail = email.toLowerCase();
+        CompletableFuture<Boolean> future = new CompletableFuture<>();
+        Connection.getConnection(Databases.DEFAULT)
+                .runQuery(sql -> {
+                    EmailVerificationMapper mapper = sql.getMapper(EmailVerificationMapper.class);
+                    EmailVerification existing = mapper.findByUserAndEmail(userUuid, finalEmail);
+                    if (existing != null) {
+                        mapper.deleteByUserAndEmail(userUuid, finalEmail);
+                        future.complete(true);
+                    } else {
+                        future.complete(false);
+                    }
+                });
+        return future.join();
+    }
+
+    private void sendVerificationEmail(EmailVerification emailVerification) {
+        try {
+            MimeMessage message = mailSender.createMimeMessage();
+            MimeMessageHelper helper = new MimeMessageHelper(message, true);
+            helper.setFrom(fromEmail);
+            helper.setTo(emailVerification.email().toLowerCase());
+            helper.setSubject("Your verification code");
+            helper.setText("Your verification code is: " + emailVerification.verificationCode(), false);
+            mailSender.send(message);
+        } catch (MessagingException e) {
+            log.error("Failed to send verification email to {}", emailVerification.email(), e);
+        }
+    }
+
+    private String generateCode() {
+        // 6-digit numeric code
+        Random random = new Random();
+        int num = 100000 + random.nextInt(899999);
+        return String.valueOf(num);
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/mail/StaffApplicationMail.java

@@ -0,0 +1,72 @@
+package com.alttd.altitudeweb.services.mail;
+
+import com.alttd.altitudeweb.database.web_db.forms.StaffApplication;
+import jakarta.mail.MessagingException;
+import jakarta.mail.internet.MimeMessage;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.mail.javamail.JavaMailSender;
+import org.springframework.mail.javamail.MimeMessageHelper;
+import org.springframework.stereotype.Service;
+import org.thymeleaf.context.Context;
+import org.thymeleaf.spring6.SpringTemplateEngine;
+
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class StaffApplicationMail {
+
+    private final JavaMailSender mailSender;
+    private final SpringTemplateEngine templateEngine;
+
+    @Value("${spring.mail.username}")
+    private String fromEmail;
+
+    private static final String STAFF_APPLICATION_EMAIL = "[email protected]";
+
+    /**
+     * Sends an email with the staff application details to the staff applications team mailbox.
+     * Returns true if the email was sent successfully.
+     */
+    public boolean sendApplicationEmail(String username, StaffApplication application) {
+        try {
+            doSend(username, application);
+            log.info("Staff application email sent successfully for application ID: {}", application.id());
+            return true;
+        } catch (Exception e) {
+            log.error("Failed to send staff application email for application ID: {}", application.id(), e);
+            return false;
+        }
+    }
+
+    private void doSend(String username, StaffApplication application) throws MessagingException {
+        MimeMessage message = mailSender.createMimeMessage();
+        MimeMessageHelper helper = new MimeMessageHelper(message, true);
+
+        helper.setFrom(fromEmail);
+        helper.setTo(STAFF_APPLICATION_EMAIL);
+        helper.setReplyTo(application.email());
+        helper.setSubject("Staff Application: " + safe(application.discordUsername()));
+
+        // Prepare template context
+        String createdAt = application.createdAt()
+                .atZone(ZoneId.of("UTC"))
+                .format(DateTimeFormatter.ofPattern("yyyy MMMM dd hh:mm a '(UTC)'"));
+        Context context = new Context();
+        context.setVariable("application", application);
+        context.setVariable("createdAt", createdAt);
+        context.setVariable("username", username);
+
+        String content = templateEngine.process("staff-application-email", context);
+        helper.setText(content, true);
+        mailSender.send(message);
+    }
+
+    private String safe(String s) {
+        return s == null ? "unknown" : s;
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/site/StaffPtService.java

@@ -0,0 +1,83 @@
+package com.alttd.altitudeweb.services.site;
+
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.luckperms.Player;
+import com.alttd.altitudeweb.database.luckperms.PlayerWithGroup;
+import com.alttd.altitudeweb.database.luckperms.TeamMemberMapper;
+import com.alttd.altitudeweb.database.proxyplaytime.StaffPlaytimeMapper;
+import com.alttd.altitudeweb.database.proxyplaytime.StaffPt;
+import com.alttd.altitudeweb.mappers.StaffPtToStaffPlaytimeMapper;
+import com.alttd.altitudeweb.model.StaffPlaytimeDto;
+import com.alttd.altitudeweb.setup.Connection;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
+import java.util.stream.Collectors;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class StaffPtService {
+    private final static HashMap<String, String> STAFF_GROUPS_MAP = new HashMap<>();
+    private final static String STAFF_GROUPS;
+    static {
+        STAFF_GROUPS_MAP.put("group.owner", "Owner");
+        STAFF_GROUPS_MAP.put("group.manager", "Manager");
+        STAFF_GROUPS_MAP.put("group.admin", "Admin");
+        STAFF_GROUPS_MAP.put("group.headmod", "Head Mod");
+        STAFF_GROUPS_MAP.put("group.moderator", "Moderator");
+        STAFF_GROUPS_MAP.put("group.trainee", "Trainee");
+        STAFF_GROUPS_MAP.put("group.developer", "Developer");
+        STAFF_GROUPS = STAFF_GROUPS_MAP.keySet().stream()
+                .map(group -> "'" + group + "'")
+                .collect(Collectors.joining(", "));
+    }
+    private final StaffPtToStaffPlaytimeMapper staffPtToStaffPlaytimeMapper;
+
+    public Optional<List<StaffPlaytimeDto>> getStaffPlaytime(Instant from, Instant to) {
+        CompletableFuture<List<PlayerWithGroup>> staffMembersFuture = new CompletableFuture<>();
+        CompletableFuture<List<StaffPt>> staffPlaytimeFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.LUCK_PERMS)
+                .runQuery(sqlSession -> {
+                    log.debug("Loading staff members");
+                    try {
+                        List<PlayerWithGroup> staffMemberList = sqlSession.getMapper(TeamMemberMapper.class)
+                                .getTeamMembersOfGroupList(STAFF_GROUPS);
+                        staffMembersFuture.complete(staffMemberList);
+                    } catch (Exception e) {
+                        log.error("Failed to load staff members", e);
+                        staffMembersFuture.completeExceptionally(e);
+                    }
+                });
+        List<PlayerWithGroup> staffMembers = staffMembersFuture.join().stream()
+                .collect(Collectors.collectingAndThen(
+                        Collectors.toMap(PlayerWithGroup::uuid, player -> player, (player1, player2) -> player1),
+                        m -> new ArrayList<>(m.values())));
+        Connection.getConnection(Databases.PROXY_PLAYTIME)
+                .runQuery(sqlSession -> {
+                    String staffUUIDs = staffMembers.stream()
+                            .map(PlayerWithGroup::uuid)
+                            .map(uuid -> "'" + uuid + "'")
+                            .collect(Collectors.joining(","));
+                    log.debug("Loading staff playtime for group");
+                    try {
+                        List<StaffPt> sessionsDuring = sqlSession.getMapper(StaffPlaytimeMapper.class)
+                                .getSessionsDuring(from.toEpochMilli(), to.toEpochMilli(), staffUUIDs);
+                        staffPlaytimeFuture.complete(sessionsDuring);
+                    } catch (Exception e) {
+                        log.error("Failed to load staff playtime", e);
+                        staffPlaytimeFuture.completeExceptionally(e);
+                    }
+                });
+        List<StaffPt> join = staffPlaytimeFuture.join();
+        HashMap<String, String> staffGroupsMap = new HashMap<>(STAFF_GROUPS_MAP);
+        return Optional.of(staffPtToStaffPlaytimeMapper.map(join, staffMembers, from.toEpochMilli(), to.toEpochMilli(), staffGroupsMap));
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/site/VoteService.java

@@ -0,0 +1,47 @@
+package com.alttd.altitudeweb.services.site;
+
+import com.alttd.altitudeweb.database.Databases;
+import com.alttd.altitudeweb.database.votingplugin.VotingPluginUsersMapper;
+import com.alttd.altitudeweb.database.votingplugin.VotingStatsRow;
+import com.alttd.altitudeweb.mappers.VotingStatsRowToVoteDataDto;
+import com.alttd.altitudeweb.model.VoteDataDto;
+import com.alttd.altitudeweb.setup.Connection;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+
+import java.util.Optional;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class VoteService {
+
+    private final VotingStatsRowToVoteDataDto votingStatsRowToVoteDataDto;
+
+    public Optional<VoteDataDto> getVoteStats(UUID uuid) {
+        CompletableFuture<Optional<VoteDataDto>> voteDataDtoFuture = new CompletableFuture<>();
+        Connection.getConnection(Databases.VOTING_PLUGIN).runQuery(sqlSession -> {
+            try {
+                VotingPluginUsersMapper votingPluginUsersMapper = sqlSession.getMapper(VotingPluginUsersMapper.class);
+                Optional<VotingStatsRow> optionalVotingStatsRow = votingPluginUsersMapper.getStatsByUuid(uuid);
+                if (optionalVotingStatsRow.isEmpty()) {
+                    log.debug("No voting stats found for {}", uuid);
+                    voteDataDtoFuture.complete(Optional.empty());
+                    return;
+                }
+
+                VotingStatsRow votingStatsRow = optionalVotingStatsRow.get();
+
+                VoteDataDto voteDataDto = votingStatsRowToVoteDataDto.map(votingStatsRow);
+                voteDataDtoFuture.complete(Optional.of(voteDataDto));
+            } catch (Exception e) {
+                log.error("Failed to get vote data for {}", uuid, e);
+                voteDataDtoFuture.completeExceptionally(e);
+            }
+        });
+        return voteDataDtoFuture.join();//TODO handle exception
+    }
+}

backend/src/main/java/com/alttd/altitudeweb/services/user/UserDetailsServiceImpl.java

@@ -0,0 +1,27 @@
+package com.alttd.altitudeweb.services.user;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.stereotype.Service;
+
+import java.util.Collections;
+import java.util.UUID;
+
+@Service
+@RequiredArgsConstructor
+public class UserDetailsServiceImpl implements UserDetailsService {
+
+    @Override
+    public UserDetails loadUserByUsername(String uuid) throws UsernameNotFoundException {
+        try {
+            //Validate uuid
+            UUID.fromString(uuid);
+            return new User(uuid, "", Collections.emptyList());
+        } catch (IllegalArgumentException e) {
+            throw new UsernameNotFoundException("Invalid UUID format: " + uuid);
+        }
+    }
+}

backend/src/main/resources/application-beta.properties

@@ -0,0 +1,9 @@
+spring.application.name=AltitudeWeb
+database.name=${DB_NAME:web_db}
+database.port=${DB_PORT:3306}
+database.host=${DB_HOST:localhost}
+database.user=${DB_USER:root}
+database.password=${DB_PASSWORD:root}
+cors.allowed-origins=${CORS:https://beta.alttd.com}
+my-server.address=${SERVER_ADDRESS:https://beta.alttd.com}
+logging.level.com.alttd.altitudeweb=DEBUG

backend/src/main/resources/application-test.properties

@@ -1,8 +1,4 @@
-spring.application.name=AltitudeWeb
-database.name=${DB_NAME:web_db}
-database.port=${DB_PORT:3306}
-database.host=${DB_HOST:localhost}
-database.user=${DB_USER:root}
-database.password=${DB_PASSWORD:root}
-cors.allowed-origins=${CORS:http://localhost:4200}
+cors.allowed-origins=${CORS:http://localhost:4200,http://localhost:8080,http://localhost:80}
+my-server.address=${SERVER_ADDRESS:http://localhost:8080}
 logging.level.com.alttd.altitudeweb=DEBUG
+logging.level.org.springframework.security=DEBUG

backend/src/main/resources/application.properties

@@ -5,4 +5,23 @@ database.host=${DB_HOST:localhost}
 database.user=${DB_USER:root}
 database.password=${DB_PASSWORD:root}
 cors.allowed-origins=${CORS:https://alttd.com}
+login.secret=${LOGIN_SECRET:SET_TOKEN}
+particles.file_path=${PARTICLE_FILE_PATH:${user.home}/.altitudeweb/particles}
+notification.server.url=${SERVER_IP:10.0.0.107}:${SERVER_PORT:8080}
+my-server.address=${SERVER_ADDRESS:https://alttd.com}
 logging.level.com.alttd.altitudeweb=INFO
+discord.token=${DISCORD_TOKEN}
+spring.mail.host=${MAIL_HOST:smtp.zoho.com}
+spring.mail.port=${MAIL_PORT:465}
+spring.mail.username=${MAIL_USER}
+spring.mail.password=${MAIL_PASSWORD}
+spring.mail.properties.mail.smtp.auth=true
+spring.mail.properties.mail.smtp.ssl.enable=true
+spring.mail.properties.mail.smtp.socketFactory.class=javax.net.ssl.SSLSocketFactory
+chat.allowed-ip=${ALLOWED_IP:10.0.0.0/24}
+chat.allowed-servers=${ALLOWED_SERVERS:bayou,lobby,creative}
+management.endpoints.web.exposure.include=mappings
+server.forward-headers-strategy=native
+server.tomcat.remoteip.remote-ip-header=CF-Connecting-IP
+server.tomcat.remoteip.trusted-proxies=10\\.0\\.0\\.103
+altitudeweb.token=${TOKEN:invalid-token}

backend/src/main/resources/templates/appeal-email.html

@@ -0,0 +1,123 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org" lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Appeal Notification</title>
+    <style>
+        @font-face {
+            font-family: 'minecraft-title';
+            src: url('https://beta.alttd.com/public/fonts/minecraft-title.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-title.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-title.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/minecraft-title.woff') format('woff');
+        }
+
+        @font-face {
+            font-family: 'minecraft-text';
+            src: url('https://beta.alttd.com/public/fonts/minecraft-text.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-text.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-text.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/minecraft-text.woff') format('woff');
+        }
+        
+        @font-face {
+            font-family: 'opensans';
+            src: url('https://beta.alttd.com/public/fonts/opensans.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/opensans.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/opensans.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/opensans.woff') format('woff');
+        }
+
+        @font-face {
+            font-family: 'opensans-bold';
+            src: url('https://beta.alttd.com/public/fonts/opensans-bold.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/opensans-bold.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/opensans-bold.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/opensans-bold.woff') format('woff');
+        }
+
+        body {
+            font-family: 'minecraft-title', sans-serif;
+        }
+
+        .columnSection {
+            width: 80%;
+            max-width: 800px;
+            margin: 0 auto;
+            display: flex;
+        }
+
+        .columnContainer {
+            flex: 1 1 200px;
+            min-width: 200px;
+            box-sizing: border-box;
+            padding: 0 15px;
+        }
+
+        img {
+            display: block;
+            margin: auto;
+            padding-top: 10px;
+        }
+
+        ul {
+            list-style-type: none;
+            padding-left: 0;
+        }
+
+        li {
+            padding-bottom: 7px;
+        }
+
+        li, p {
+            font-family: 'opensans', sans-serif;
+            font-size: 1rem;
+        }
+
+        h2 {
+            font-size: 1.5rem;
+        }
+
+        @media (max-width: 1150px) {
+            .columnContainer, .columnSection {
+                width: 90%;
+            }
+        }
+
+        @media (max-width: 690px) {
+            .columnContainer {
+                width: 100%;
+                text-align: center;
+            }
+        }
+    </style>
+</head>
+<body>
+    <main>
+        <img id="header-img" src="https://beta.alttd.com/public/img/logos/logo.png" alt="The Altitude Minecraft Server" height="159"
+             width="275">
+        <h1 style="text-align: center;" th:text="'Appeal by ' + ${appeal.username}">Appeal by Username</h1>
+        <section class="columnSection">
+            <div class="columnContainer">
+                <div>
+                    <h2>User information</h2>
+                    <ul>
+                        <li><strong>Username:</strong> <span th:text="${appeal.username}">username</span></li>
+                        <li><strong>UUID:</strong> <span th:text="${appeal.uuid}">uuid</span></li>
+                        <li><strong>Email:</strong> <span th:text="${appeal.email}">email</span></li>
+                        <li><strong>Submitted at:</strong> <span th:text="${createdAt}">date</span></li>
+                        <li><strong>Reason:</strong> <span th:text="${history.reason}">reason</span></li>
+                        <li><strong>Active:</strong> <span th:text="${active}">unknown</span></li>
+                    </ul>
+                </div>
+            </div>
+            <div class="columnContainer">
+                <div>
+                    <h2>Appeal:</h2>
+                    <p th:text="${appeal.reason}">appeal</p>
+                </div>
+            </div>
+        </section>
+    </main>
+</body>
+</html>

backend/src/main/resources/templates/discord-appeal-email.html

@@ -0,0 +1,122 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org" lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Discord Appeal Notification</title>
+    <style>
+        @font-face {
+            font-family: 'minecraft-title';
+            src: url('https://beta.alttd.com/public/fonts/minecraft-title.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-title.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-title.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/minecraft-title.woff') format('woff');
+        }
+
+        @font-face {
+            font-family: 'minecraft-text';
+            src: url('https://beta.alttd.com/public/fonts/minecraft-text.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-text.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-text.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/minecraft-text.woff') format('woff');
+        }
+        
+        @font-face {
+            font-family: 'opensans';
+            src: url('https://beta.alttd.com/public/fonts/opensans.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/opensans.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/opensans.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/opensans.woff') format('woff');
+        }
+
+        @font-face {
+            font-family: 'opensans-bold';
+            src: url('https://beta.alttd.com/public/fonts/opensans-bold.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/opensans-bold.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/opensans-bold.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/opensans-bold.woff') format('woff');
+        }
+
+        body {
+            font-family: 'minecraft-title', sans-serif;
+        }
+
+        .columnSection {
+            width: 80%;
+            max-width: 800px;
+            margin: 0 auto;
+            display: flex;
+        }
+
+        .columnContainer {
+            flex: 1 1 200px;
+            min-width: 200px;
+            box-sizing: border-box;
+            padding: 0 15px;
+        }
+
+        img {
+            display: block;
+            margin: auto;
+            padding-top: 10px;
+        }
+
+        ul {
+            list-style-type: none;
+            padding-left: 0;
+        }
+
+        li {
+            padding-bottom: 7px;
+        }
+
+        li, p {
+            font-family: 'opensans', sans-serif;
+            font-size: 1rem;
+        }
+
+        h2 {
+            font-size: 1.5rem;
+        }
+
+        @media (max-width: 1150px) {
+            .columnContainer, .columnSection {
+                width: 90%;
+            }
+        }
+
+        @media (max-width: 690px) {
+            .columnContainer {
+                width: 100%;
+                text-align: center;
+            }
+        }
+    </style>
+</head>
+<body>
+    <main>
+        <img id="header-img" src="https://beta.alttd.com/public/img/logos/logo.png" alt="The Altitude Minecraft Server" height="159"
+             width="275">
+        <h1 style="text-align: center;" th:text="'Appeal by ' + ${appeal.discordUsername}">Appeal by Username</h1>
+        <section class="columnSection">
+            <div class="columnContainer">
+                <div>
+                    <h2>User information</h2>
+                    <ul>
+                        <li><strong>Discord Username:</strong> <span th:text="${appeal.discordUsername}">dc username</span></li>
+                        <li><strong>UUID:</strong> <span th:text="${appeal.uuid}">uuid</span></li>
+                        <li><strong>Minecraft Username:</strong> <span th:text="${minecraftName}">mc username</span></li>
+                        <li><strong>Email:</strong> <span th:text="${appeal.email}">email</span></li>
+                        <li><strong>Submitted at:</strong> <span th:text="${createdAt}">date</span></li>
+                    </ul>
+                </div>
+            </div>
+            <div class="columnContainer">
+                <div>
+                    <h2>Appeal:</h2>
+                    <p th:text="${appeal.reason}">appeal</p>
+                </div>
+            </div>
+        </section>
+    </main>
+</body>
+</html>

backend/src/main/resources/templates/staff-application-email.html

@@ -0,0 +1,138 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org" lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Staff Application</title>
+    <style>
+        @font-face {
+            font-family: 'minecraft-title';
+            src: url('https://beta.alttd.com/public/fonts/minecraft-title.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-title.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-title.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/minecraft-title.woff') format('woff');
+        }
+
+        @font-face {
+            font-family: 'minecraft-text';
+            src: url('https://beta.alttd.com/public/fonts/minecraft-text.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-text.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/minecraft-text.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/minecraft-text.woff') format('woff');
+        }
+
+        @font-face {
+            font-family: 'opensans';
+            src: url('https://beta.alttd.com/public/fonts/opensans.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/opensans.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/opensans.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/opensans.woff') format('woff');
+        }
+
+        @font-face {
+            font-family: 'opensans-bold';
+            src: url('https://beta.alttd.com/public/fonts/opensans-bold.ttf') format('truetype'),
+            url('https://beta.alttd.com/public/fonts/opensans-bold.eot') format('embedded-opentype'),
+            url('https://beta.alttd.com/public/fonts/opensans-bold.svg') format('svg'),
+            url('https://beta.alttd.com/public/fonts/opensans-bold.woff') format('woff');
+        }
+
+        body {
+            font-family: 'minecraft-title', sans-serif;
+        }
+
+        .columnSection {
+            width: 80%;
+            max-width: 800px;
+            margin: 0 auto;
+            display: flex;
+        }
+
+        .columnContainer {
+            flex: 1 1 200px;
+            min-width: 200px;
+            box-sizing: border-box;
+            padding: 0 15px;
+        }
+
+        img {
+            display: block;
+            margin: auto;
+            padding-top: 10px;
+        }
+
+        ul {
+            list-style-type: none;
+            padding-left: 0;
+        }
+
+        li {
+            padding-bottom: 7px;
+        }
+
+        li, p {
+            font-family: 'opensans', sans-serif;
+            font-size: 1rem;
+        }
+
+        h2 {
+            font-size: 1.5rem;
+        }
+
+        @media (max-width: 1150px) {
+            .columnContainer, .columnSection {
+                width: 90%;
+            }
+        }
+
+        @media (max-width: 690px) {
+            .columnContainer {
+                width: 100%;
+                text-align: center;
+            }
+        }
+    </style>
+</head>
+<body>
+<main>
+    <img id="header-img" src="https://beta.alttd.com/public/img/logos/logo.png" alt="The Altitude Minecraft Server" height="159" width="275">
+    <h1 style="text-align: center;" th:text="'Staff application by ' + ${application.discordUsername}">Staff application</h1>
+
+    <section class="columnSection">
+        <div class="columnContainer">
+            <div>
+                <h2>Applicant</h2>
+                <ul>
+                    <li><strong>Username:</strong> <span th:text="${username}">uuid</span></li>
+                    <li><strong>Email:</strong> <span th:text="${application.email}">email</span></li>
+                    <li><strong>Discord:</strong> <span th:text="${application.discordUsername}">discord</span></li>
+                    <li><strong>Age:</strong> <span th:text="${application.age}">age</span></li>
+                    <li><strong>Pronouns:</strong> <span th:text="${application.pronouns}">pronouns</span></li>
+                    <li><strong>Join date:</strong> <span th:text="${application.joinDate}">date</span></li>
+                    <li><strong>Submitted at:</strong> <span th:text="${createdAt}">date</span></li>
+                </ul>
+            </div>
+        </div>
+        <div class="columnContainer">
+            <div>
+                <h2>Availability</h2>
+                <ul>
+                    <li><strong>Days:</strong> <span th:text="${application.availableDays}">days</span></li>
+                    <li><strong>Times:</strong> <span th:text="${application.availableTimes}">times</span></li>
+                    <li><strong>Weekly playtime:</strong> <span th:text="${application.weeklyPlaytime}">0</span> hours</li>
+                </ul>
+
+                <h2>Experience</h2>
+                <p><strong>Previous:</strong><br><span th:text="${application.previousExperience}">previous experience</span></p>
+                <p><strong>Plugins:</strong><br><span th:text="${application.pluginExperience}">plugin experience</span></p>
+                <p><strong>Expectations:</strong><br><span th:text="${application.moderatorExpectations}">moderator expectations</span></p>
+
+                <div th:if="${application.additionalInfo} != null and ${application.additionalInfo} != ''">
+                    <h2>Additional info</h2>
+                    <p th:text="${application.additionalInfo}">additional info</p>
+                </div>
+            </div>
+        </div>
+    </section>
+</main>
+</body>
+</html>

backend/src/test/java/com/alttd/altitudeweb/controllers/chat/ChatControllerTest.java

@@ -0,0 +1,75 @@
+package com.alttd.altitudeweb.controllers.chat;
+
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
+import com.alttd.altitudeweb.model.ServerStateDto;
+import com.alttd.altitudeweb.model.PlayerListVisibilityDto;
+import com.alttd.altitudeweb.services.chat.ChatService;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+
+import java.util.UUID;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.verify;
+
+@ExtendWith(MockitoExtension.class)
+class ChatControllerTest {
+
+    @Mock
+    private ChatService chatService;
+
+    @Mock
+    private AuthenticatedUuid authenticatedUuid;
+
+    @InjectMocks
+    private ChatController chatController;
+
+    @Test
+    void testUpdateServerStatesDelegatesToService() {
+        ServerStateDto serverStateDto = new ServerStateDto();
+        
+        ResponseEntity<Void> response = chatController.updateServerStates(serverStateDto);
+        
+        verify(chatService).updateServerState(serverStateDto);
+        assertEquals(HttpStatus.ACCEPTED, response.getStatusCode());
+    }
+
+    @Test
+    void hideUserFromPlayerListDelegatesForAuthenticatedUser() {
+        UUID uuid = UUID.randomUUID();
+        org.mockito.Mockito.when(authenticatedUuid.getAuthenticatedUserUuid()).thenReturn(uuid);
+
+        ResponseEntity<Void> response = chatController.hideUserFromPlayerList();
+
+        verify(chatService).hideUserFromPlayerList(uuid);
+        assertEquals(HttpStatus.NO_CONTENT, response.getStatusCode());
+    }
+
+    @Test
+    void showUserInPlayerListDelegatesForAuthenticatedUser() {
+        UUID uuid = UUID.randomUUID();
+        org.mockito.Mockito.when(authenticatedUuid.getAuthenticatedUserUuid()).thenReturn(uuid);
+
+        ResponseEntity<Void> response = chatController.showUserInPlayerList();
+
+        verify(chatService).showUserInPlayerList(uuid);
+        assertEquals(HttpStatus.NO_CONTENT, response.getStatusCode());
+    }
+
+    @Test
+    void getPlayerListVisibilityReturnsBackendState() {
+        UUID uuid = UUID.randomUUID();
+        org.mockito.Mockito.when(authenticatedUuid.getAuthenticatedUserUuid()).thenReturn(uuid);
+        org.mockito.Mockito.when(chatService.isUserHiddenFromPlayerList(uuid)).thenReturn(true);
+
+        ResponseEntity<PlayerListVisibilityDto> response = chatController.getPlayerListVisibility();
+
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        assertEquals(true, response.getBody().getHidden());
+    }
+}

backend/src/test/java/com/alttd/altitudeweb/services/chat/ChatServiceTest.java

@@ -0,0 +1,239 @@
+package com.alttd.altitudeweb.services.chat;
+
+import com.alttd.altitudeweb.controllers.chat.ChatMessage;
+import com.alttd.altitudeweb.controllers.chat.ChatMessageType;
+import com.alttd.altitudeweb.model.PermissionClaimDto;
+import com.alttd.altitudeweb.model.ServerDto;
+import com.alttd.altitudeweb.model.ServerStateDto;
+import com.alttd.altitudeweb.services.chat.event_publisher.EventPublisher;
+import com.alttd.altitudeweb.services.chat.event_publisher.EventUser;
+import com.alttd.altitudeweb.services.chat.event_publisher.MessageForUser;
+import com.alttd.altitudeweb.services.chat.to_server.ServerMessageService;
+import com.alttd.altitudeweb.services.chat.to_server.data.PlayerListState;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.UUID;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.*;
+
+class ChatServiceTest {
+
+    private ChatService chatService;
+    private EventPublisher eventPublisher;
+    private ServerMessageService serverMessageService;
+
+    @BeforeEach
+    void setUp() {
+        eventPublisher = mock(EventPublisher.class);
+        serverMessageService = mock(ServerMessageService.class);
+        chatService = spy(new ChatService(eventPublisher, serverMessageService));
+        ReflectionTestUtils.setField(chatService, "allowedServers", new String[]{"server1"});
+    }
+
+    @Test
+    void testPublicMessageSentToEveryone() {
+        ChatMessage message = ChatMessage.builder()
+                .uuid(UUID.randomUUID())
+                .type(ChatMessageType.PUBLIC)
+                .server("server1")
+                .messageJson("hello")
+                .notBlocked(true)
+                .timestamp(Instant.now())
+                .build();
+
+        chatService.addChatMessage(List.of(message));
+
+        ArgumentCaptor<MessageForUser> captor = ArgumentCaptor.forClass(MessageForUser.class);
+        verify(chatService).sendToUsers(anyString(), captor.capture());
+
+        MessageForUser messageForUser = captor.getValue();
+        EventUser user = new EventUser(UUID.randomUUID(), List.of(), null);
+        String result = messageForUser.get(user);
+
+        assertTrue(result.contains("hello"));
+    }
+
+    @Test
+    void testGacMessageSentOnlyToStaff() {
+        ChatMessage message = ChatMessage.builder()
+                .uuid(UUID.randomUUID())
+                .type(ChatMessageType.GAC)
+                .server("server1")
+                .messageJson("staff chat")
+                .notBlocked(true)
+                .timestamp(Instant.now())
+                .build();
+
+        chatService.addChatMessage(List.of(message));
+
+        ArgumentCaptor<MessageForUser> captor = ArgumentCaptor.forClass(MessageForUser.class);
+        verify(chatService).sendToUsers(anyString(), captor.capture());
+
+        MessageForUser messageForUser = captor.getValue();
+
+        EventUser regularUser = new EventUser(UUID.randomUUID(), List.of(), null);
+        assertFalse(messageForUser.get(regularUser).contains("staff chat"), "Regular user should not see GAC message");
+
+        EventUser modUser = new EventUser(UUID.randomUUID(), List.of(PermissionClaimDto.MOD.getValue()), null);
+        assertTrue(messageForUser.get(modUser).contains("staff chat"), "MOD should see GAC message");
+    }
+
+    @Test
+    void testMsgMessageSentToSenderAndReceiver() {
+        UUID senderUuid = UUID.randomUUID();
+        UUID receiverUuid = UUID.randomUUID();
+        ChatMessage message = ChatMessage.builder()
+                .uuid(senderUuid)
+                .type(ChatMessageType.MSG)
+                .server("server1")
+                .receiver(receiverUuid.toString())
+                .messageJson("private message")
+                .notBlocked(true)
+                .timestamp(Instant.now())
+                .build();
+
+        chatService.addChatMessage(List.of(message));
+
+        ArgumentCaptor<MessageForUser> captor = ArgumentCaptor.forClass(MessageForUser.class);
+        verify(chatService).sendToUsers(anyString(), captor.capture());
+
+        MessageForUser messageForUser = captor.getValue();
+
+        EventUser sender = new EventUser(senderUuid, List.of(), null);
+        EventUser receiver = new EventUser(receiverUuid, List.of(), null);
+        EventUser other = new EventUser(UUID.randomUUID(), List.of(), null);
+
+        assertTrue(messageForUser.get(receiver).contains("private message"), "Receiver should see the message");
+        assertFalse(messageForUser.get(other).contains("private message"), "Others should not see private message");
+    }
+
+    @Test
+    void testGlobalMessageSentToEveryone() {
+        ChatMessage message = ChatMessage.builder()
+                .uuid(UUID.randomUUID())
+                .type(ChatMessageType.GLOBAL)
+                .server("server1")
+                .messageJson("global hello")
+                .notBlocked(true)
+                .timestamp(Instant.now())
+                .build();
+
+        chatService.addChatMessage(List.of(message));
+
+        ArgumentCaptor<MessageForUser> captor = ArgumentCaptor.forClass(MessageForUser.class);
+        verify(chatService).sendToUsers(anyString(), captor.capture());
+
+        MessageForUser messageForUser = captor.getValue();
+        EventUser user = new EventUser(UUID.randomUUID(), List.of(), null);
+        assertTrue(messageForUser.get(user).contains("global hello"));
+    }
+
+    @Test
+    void testBlockedMessageOnlySentToHeadMod() {
+        ChatMessage message = ChatMessage.builder()
+                .uuid(UUID.randomUUID())
+                .type(ChatMessageType.PUBLIC)
+                .server("server1")
+                .messageJson("blocked message")
+                .notBlocked(false)
+                .timestamp(Instant.now())
+                .build();
+
+        chatService.addChatMessage(List.of(message));
+
+        ArgumentCaptor<MessageForUser> captor = ArgumentCaptor.forClass(MessageForUser.class);
+        verify(chatService).sendToUsers(anyString(), captor.capture());
+
+        MessageForUser messageForUser = captor.getValue();
+        EventUser regularUser = new EventUser(UUID.randomUUID(), List.of(), null);
+        EventUser headModUser = new EventUser(UUID.randomUUID(), List.of(PermissionClaimDto.HEAD_MOD.getValue()), null);
+
+        assertFalse(messageForUser.get(regularUser).contains("blocked message"));
+        assertTrue(messageForUser.get(headModUser).contains("blocked message"));
+    }
+
+    @Test
+    void testUpdateServerStateFiltering() {
+        ServerStateDto serverStateDto = new ServerStateDto()
+                .addServersItem(new ServerDto().name("server1"))
+                .addServersItem(new ServerDto().name("server2"));
+
+        chatService.updateServerState(serverStateDto);
+
+        ArgumentCaptor<MessageForUser> captor = ArgumentCaptor.forClass(MessageForUser.class);
+        verify(chatService).sendToUsers(eq("server-state"), captor.capture());
+
+        MessageForUser messageForUser = captor.getValue();
+
+        EventUser regularUser = new EventUser(UUID.randomUUID(), List.of(), null);
+        String regularResult = messageForUser.get(regularUser);
+        assertTrue(regularResult.contains("server1"), "Regular user should see allowed server");
+        assertFalse(regularResult.contains("server2"), "Regular user should NOT see non-allowed server");
+
+        EventUser headModUser = new EventUser(UUID.randomUUID(), List.of(PermissionClaimDto.HEAD_MOD.getValue()), null);
+        String headModResult = messageForUser.get(headModUser);
+        assertTrue(headModResult.contains("server1"), "HEAD_MOD should see allowed server");
+        assertTrue(headModResult.contains("server2"), "HEAD_MOD should see non-allowed server");
+    }
+
+    @Test
+    void subscribingUserBroadcastsActivePlayerStateOnce() {
+        UUID uuid = UUID.randomUUID();
+        EventUser eventUser = new EventUser(uuid, List.of(), null);
+
+        chatService.subscribe(eventUser, "[]");
+        chatService.subscribe(eventUser, "[]");
+
+        ArgumentCaptor<PlayerListState> stateCaptor = ArgumentCaptor.forClass(PlayerListState.class);
+        verify(serverMessageService, times(1)).sendMessageToAll(eq("player_state"), stateCaptor.capture());
+        assertEquals(List.of(uuid), stateCaptor.getValue().getActivePlayers());
+    }
+
+    @Test
+    void headModCanHideCurrentSessionFromPlayerState() {
+        UUID uuid = UUID.randomUUID();
+        EventUser eventUser = new EventUser(uuid, List.of(PermissionClaimDto.HEAD_MOD.getValue()), null);
+        chatService.subscribe(eventUser, "[]");
+        clearInvocations(serverMessageService);
+
+        chatService.hideUserFromPlayerList(uuid);
+
+        ArgumentCaptor<PlayerListState> stateCaptor = ArgumentCaptor.forClass(PlayerListState.class);
+        verify(serverMessageService).sendMessageToAll(eq("player_state"), stateCaptor.capture());
+        assertTrue(stateCaptor.getValue().getActivePlayers().isEmpty());
+        assertTrue(chatService.isUserHiddenFromPlayerList(uuid));
+
+        clearInvocations(serverMessageService);
+        chatService.showUserInPlayerList(uuid);
+
+        verify(serverMessageService).sendMessageToAll(eq("player_state"), stateCaptor.capture());
+        assertEquals(List.of(uuid), stateCaptor.getValue().getActivePlayers());
+        assertFalse(chatService.isUserHiddenFromPlayerList(uuid));
+    }
+
+    @Test
+    void modCannotHideCurrentSessionFromPlayerState() {
+        UUID uuid = UUID.randomUUID();
+        EventUser eventUser = new EventUser(uuid, List.of(PermissionClaimDto.MOD.getValue()), null);
+        chatService.subscribe(eventUser, "[]");
+        clearInvocations(serverMessageService);
+
+        ResponseStatusException exception = assertThrows(ResponseStatusException.class,
+                () -> chatService.hideUserFromPlayerList(uuid));
+
+        assertEquals(403, exception.getStatusCode().value());
+        verifyNoInteractions(serverMessageService);
+    }
+}

backend/src/test/java/com/alttd/altitudeweb/services/chat/to_server/ServerMessageServiceTest.java

@@ -0,0 +1,52 @@
+package com.alttd.altitudeweb.services.chat.to_server;
+
+import com.alttd.altitudeweb.services.chat.event_publisher.EventPublisher;
+import com.alttd.altitudeweb.services.chat.to_server.data.PlayerListState;
+import org.junit.jupiter.api.Test;
+import org.springframework.web.servlet.mvc.method.annotation.SseEmitter;
+
+import java.util.List;
+import java.util.UUID;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+class ServerMessageServiceTest {
+
+    @Test
+    void broadcastsSerializedPlayerStateToEveryServer() {
+        EventPublisher eventPublisher = mock(EventPublisher.class);
+        when(eventPublisher.subscribe(any(), any(EventPublisher.SessionCleanupCallback.class)))
+                .thenReturn(new SseEmitter());
+        ServerMessageService service = new ServerMessageService(eventPublisher);
+        UUID uuid = UUID.randomUUID();
+
+        service.subscribe("server-one");
+        service.subscribe("server-two");
+        service.sendMessageToAll("player_state", PlayerListState.builder()
+                .activePlayers(List.of(uuid))
+                .build());
+
+        String expectedJson = "{\"activePlayers\":[\"" + uuid + "\"]}";
+        verify(eventPublisher).sendToUser("server-one", "player_state", expectedJson);
+        verify(eventPublisher).sendToUser("server-two", "player_state", expectedJson);
+    }
+
+    @Test
+    void newlySubscribedServerReceivesLatestPlayerState() {
+        EventPublisher eventPublisher = mock(EventPublisher.class);
+        when(eventPublisher.subscribe(eq("server-one"), any(EventPublisher.SessionCleanupCallback.class)))
+                .thenReturn(new SseEmitter());
+        ServerMessageService service = new ServerMessageService(eventPublisher);
+
+        service.sendMessageToAll("player_state", PlayerListState.builder()
+                .activePlayers(List.of())
+                .build());
+        service.subscribe("server-one");
+
+        verify(eventPublisher).sendToUser("server-one", "player_state", "{\"activePlayers\":[]}");
+    }
+}

database/build.gradle.kts

@@ -16,6 +16,7 @@ dependencies {
     implementation("org.mybatis:mybatis:3.5.13")
     compileOnly("org.slf4j:slf4j-api:2.0.17")
     compileOnly("org.slf4j:slf4j-simple:2.0.17")
+    compileOnly("org.jetbrains:annotations:26.0.2")
 }
 
 tasks.test {

database/src/main/java/com/alttd/altitudeweb/database/Databases.java

@@ -6,7 +6,11 @@ import lombok.Getter;
 public enum Databases {
     DEFAULT("web_db"),
     LUCK_PERMS("luckperms"),
-    LITE_BANS("litebans");
+    LITE_BANS("litebans"),
+    DISCORD("discordLink"),
+    PROXY_PLAYTIME("proxyplaytime"),
+    VOTING_PLUGIN("votingplugin"),
+    CHAT("chat");
 
     private final String internalName;
 

database/src/main/java/com/alttd/altitudeweb/database/chat/ChatLogDao.java

@@ -0,0 +1,21 @@
+package com.alttd.altitudeweb.database.chat;
+
+import lombok.Builder;
+import lombok.Getter;
+
+import java.sql.Timestamp;
+
+@Builder
+@Getter
+public class ChatLogDao {
+
+    private final String uuid;
+    private final Timestamp timeStamp;
+    private final String server;
+    private final String type;
+    private final String channel;
+    private final String receiver;
+    private final String miniMessage;
+    private final boolean blocked;
+
+}

database/src/main/java/com/alttd/altitudeweb/database/chat/ChatLogMapper.java

@@ -0,0 +1,25 @@
+package com.alttd.altitudeweb.database.chat;
+
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+
+import java.util.List;
+import java.util.Optional;
+
+public interface ChatLogMapper {
+
+    @Select("""
+            SELECT uuid, time_stamp, server, type, channel, receiver, mini_message, blocked
+            FROM chat_log
+            WHERE mini_message IS NOT NULL
+            AND time_stamp >= #{since}
+            """)
+    List<ChatLogDao> getChatLogs(@Param("since") long since);
+
+    @Select("""
+            SELECT party_id FROM chat_users
+            WHERE uuid = #{uuid}
+            """)
+    Optional<Integer> getPartyId(@Param("uuid") String uuid);
+
+}

database/src/main/java/com/alttd/altitudeweb/database/chat/NicknameMapper.java

@@ -0,0 +1,15 @@
+package com.alttd.altitudeweb.database.chat;
+
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+
+import java.util.Optional;
+
+public interface NicknameMapper {
+    @Select("""
+            SELECT nickname
+            FROM nicknames
+            WHERE uuid = #{uuid}
+            """)
+    Optional<String> getNicknameFromUUID(@Param("uuid") String uuid);
+}

database/src/main/java/com/alttd/altitudeweb/database/chat/PartyMapper.java

@@ -0,0 +1,16 @@
+package com.alttd.altitudeweb.database.chat;
+
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+
+import java.util.Optional;
+
+public interface PartyMapper {
+
+    @Select("""
+            SELECT party_name FROM parties
+            WHERE id = #{id}
+            """)
+    Optional<String> getPartyName(@Param("id") int id);
+
+}

database/src/main/java/com/alttd/altitudeweb/database/discord/AppealList.java

@@ -0,0 +1,4 @@
+package com.alttd.altitudeweb.database.discord;
+
+public record AppealList(Long userId, boolean next) {
+}

database/src/main/java/com/alttd/altitudeweb/database/discord/AppealListMapper.java

@@ -0,0 +1,25 @@
+package com.alttd.altitudeweb.database.discord;
+
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+import org.apache.ibatis.annotations.Update;
+
+import java.util.List;
+
+public interface AppealListMapper {
+
+    @Select("""
+            SELECT userId, next
+            FROM appeal_list
+            ORDER BY userId;
+            """)
+    List<AppealList> getAppealList();
+
+    @Update("""
+            UPDATE appeal_list
+            SET next = #{next}
+            WHERE userId = #{userId}
+            """)
+    void updateNext(@Param("userId") long userId, @Param("next") boolean next);
+
+}

database/src/main/java/com/alttd/altitudeweb/database/discord/OutputChannel.java

@@ -0,0 +1,4 @@
+package com.alttd.altitudeweb.database.discord;
+
+public record OutputChannel(long guild, String outputType, long channel, String channelType) {
+}

database/src/main/java/com/alttd/altitudeweb/database/discord/OutputChannelMapper.java

@@ -0,0 +1,15 @@
+package com.alttd.altitudeweb.database.discord;
+
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+
+import java.util.List;
+
+public interface OutputChannelMapper {
+    @Select("""
+            SELECT guild, output_type, channel, channel_type
+            FROM output_channels
+            WHERE output_type = #{outputType}
+            """)
+    List<OutputChannel> getChannelsWithOutputType(@Param("outputType") String outputType);
+}

database/src/main/java/com/alttd/altitudeweb/database/litebans/EditHistoryMapper.java

@@ -0,0 +1,64 @@
+package com.alttd.altitudeweb.database.litebans;
+
+import org.apache.ibatis.annotations.Delete;
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Update;
+import org.jetbrains.annotations.NotNull;
+
+public interface EditHistoryMapper {
+
+    @Update("""
+            UPDATE ${table_name}
+            SET reason = #{reason}
+            WHERE id = #{id}
+            """)
+    int updateReason(@Param("table_name") String tableName,
+                     @Param("id") int id,
+                     @Param("reason") String reason);
+
+    @Update("""
+            UPDATE ${table_name}
+            SET until = #{until}
+            WHERE id = #{id}
+            """)
+    int updateUntil(@Param("table_name") String tableName,
+                    @Param("id") int id,
+                    @Param("until") Long until);
+
+    @Delete("""
+            DELETE FROM ${table_name}
+            WHERE id = #{id}
+            """)
+    int deletePunishment(@Param("table_name") String tableName,
+                         @Param("id") int id);
+
+    default int setReason(@NotNull HistoryType type, int id, String reason) {
+        return switch (type) {
+            case ALL -> throw new IllegalArgumentException("HistoryType.ALL is not supported");
+            case BAN -> updateReason("litebans_bans", id, reason);
+            case MUTE -> updateReason("litebans_mutes", id, reason);
+            case KICK -> updateReason("litebans_kicks", id, reason);
+            case WARN -> updateReason("litebans_warnings", id, reason);
+        };
+    }
+
+    default int setUntil(@NotNull HistoryType type, int id, Long until) {
+        return switch (type) {
+            case ALL -> throw new IllegalArgumentException("HistoryType.ALL is not supported");
+            case BAN -> updateUntil("litebans_bans", id, until);
+            case MUTE -> updateUntil("litebans_mutes", id, until);
+            case KICK -> throw new IllegalArgumentException("KICK has no until");
+            case WARN -> updateUntil("litebans_warnings", id, until);
+        };
+    }
+
+    default int remove(@NotNull HistoryType type, int id) {
+        return switch (type) {
+            case ALL -> throw new IllegalArgumentException("HistoryType.ALL is not supported");
+            case BAN -> deletePunishment("litebans_bans", id);
+            case MUTE -> deletePunishment("litebans_mutes", id);
+            case KICK -> deletePunishment("litebans_kicks", id);
+            case WARN -> deletePunishment("litebans_warnings", id);
+        };
+    }
+}

database/src/main/java/com/alttd/altitudeweb/database/litebans/HistoryRecord.java

@@ -5,6 +5,7 @@ import lombok.Data;
 @Data
 public class HistoryRecord {
     private String uuid;
+    private int id;
     private String punishedName;
     private String reason;
     private String bannedByUuid;

database/src/main/java/com/alttd/altitudeweb/database/litebans/IdHistoryMapper.java

@@ -0,0 +1,54 @@
+package com.alttd.altitudeweb.database.litebans;
+
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Result;
+import org.apache.ibatis.annotations.Results;
+import org.apache.ibatis.annotations.Select;
+
+public interface IdHistoryMapper {
+    @Results({
+            @Result(property = "id", column = "id"),
+            @Result(property = "uuid", column = "uuid"),
+            @Result(property = "punishedName", column = "punished_name"),
+            @Result(property = "reason", column = "reason"),
+            @Result(property = "bannedByUuid", column = "banned_by_uuid"),
+            @Result(property = "bannedByName", column = "banned_by_name"),
+            @Result(property = "removedByName", column = "removed_by_name"),
+            @Result(property = "time", column = "time"),
+            @Result(property = "until", column = "until"),
+            @Result(property = "removedByReason", column = "removed_by_reason")
+    })
+    @Select("""
+            SELECT punishment.id,
+                   punishment.uuid,
+                   user_lookup.name AS punished_name,
+                   punishment.reason,
+                   punishment.banned_by_uuid,
+                   punishment.banned_by_name,
+                   punishment.removed_by_name,
+                   punishment.time,
+                   punishment.until,
+                   punishment.removed_by_reason
+            FROM (SELECT *
+                  FROM ${table_name} AS punishment
+                  WHERE punishment.id = #{id})
+                     AS punishment
+            INNER JOIN user_lookup
+                ON user_lookup.uuid = punishment.uuid
+            """)
+    HistoryRecord getHistoryForId(@Param("table_name") String tableName,
+                                  @Param("type") String type,
+                                  @Param("id") int id);
+
+    default HistoryRecord getRecentHistory(HistoryType historyType, int id) {
+        HistoryRecord historyRecord = switch (historyType) {
+            case ALL -> throw new IllegalArgumentException("HistoryType.ALL is not supported");
+            case BAN -> getHistoryForId("litebans_bans", "ban", id);
+            case MUTE -> getHistoryForId("litebans_mutes", "mute", id);
+            case KICK -> getHistoryForId("litebans_kicks", "kick", id);
+            case WARN -> getHistoryForId("litebans_warnings", "warn", id);
+        };
+        historyRecord.setType(historyType.name().toLowerCase());
+        return historyRecord;
+    }
+}

database/src/main/java/com/alttd/altitudeweb/database/litebans/NameHistoryMapper.java

@@ -4,6 +4,7 @@ import org.apache.ibatis.annotations.Param;
 import org.apache.ibatis.annotations.Result;
 import org.apache.ibatis.annotations.Results;
 import org.apache.ibatis.annotations.Select;
+import org.jetbrains.annotations.NotNull;
 
 import java.util.List;
 
@@ -24,6 +25,7 @@ public interface NameHistoryMapper {
      * order
      */
     @Results({
+            @Result(property = "id", column = "id"),
             @Result(property = "uuid", column = "uuid"),
             @Result(property = "punishedName", column = "punished_name"),
             @Result(property = "reason", column = "reason"),
@@ -36,7 +38,8 @@ public interface NameHistoryMapper {
             @Result(property = "type", column = "type")
     })
     @Select("""
-            SELECT all_punishments.uuid,
+            SELECT id,
+                   all_punishments.uuid,
                    user_lookup.name AS punished_name,
                    reason,
                    banned_by_uuid,
@@ -62,7 +65,6 @@ public interface NameHistoryMapper {
      * Retrieves a list of all types of recent punishment history records sorted
      * in descending time order. This result does NOT contain kicks history
      *
-     * @param nameColumn  the column name in the database indicating the name to use for filtering
      * @param limit       the maximum number of records to fetch
      * @param offset      the starting offset position of the result set
      *
@@ -70,6 +72,7 @@ public interface NameHistoryMapper {
      * order
      */
     @Results({
+            @Result(property = "id", column = "id"),
             @Result(property = "uuid", column = "uuid"),
             @Result(property = "punishedName", column = "punished_name"),
             @Result(property = "reason", column = "reason"),
@@ -82,17 +85,19 @@ public interface NameHistoryMapper {
             @Result(property = "type", column = "type")
     })
     @Select("""
-            SELECT punishments.uuid,
+            SELECT punishment.id,
+                   punishment.uuid,
                    user_lookup.name AS punished_name,
-                   punishments.reason,
-                   punishments.banned_by_uuid,
-                   punishments.banned_by_name,
-                   punishments.removed_by_name,
-                   punishments.time,
-                   punishments.until,
-                   punishments.removed_by_reason,
-                   punishments.type
+                   punishment.reason,
+                   punishment.banned_by_uuid,
+                   punishment.banned_by_name,
+                   punishment.removed_by_name,
+                   punishment.time,
+                   punishment.until,
+                   punishment.removed_by_reason,
+                   punishment.type
             FROM (SELECT uuid,
+                         id,
                          reason,
                          banned_by_uuid,
                          banned_by_name,
@@ -103,9 +108,9 @@ public interface NameHistoryMapper {
                          type
                   FROM all_punishments
                   ORDER BY time DESC
-                  LIMIT #{limit} OFFSET #{offset}) AS punishments
+                  LIMIT #{limit} OFFSET #{offset}) AS punishment
                      INNER JOIN user_lookup
-                                ON user_lookup.uuid = punishments.uuid;
+                                ON user_lookup.uuid = punishment.uuid;
             """)
     List<HistoryRecord> getRecentAllHistory(@Param("limit") int limit,
                                             @Param("offset") int offset);
@@ -124,6 +129,7 @@ public interface NameHistoryMapper {
      * order
      */
     @Results({
+            @Result(property = "id", column = "id"),
             @Result(property = "uuid", column = "uuid"),
             @Result(property = "punishedName", column = "punished_name"),
             @Result(property = "reason", column = "reason"),
@@ -135,22 +141,24 @@ public interface NameHistoryMapper {
             @Result(property = "removedByReason", column = "removed_by_reason")
     })
     @Select("""
-            SELECT punishment.uuid,
+            SELECT punishment.id,
+                   punishment.uuid,
                    user_lookup.name AS punished_name,
-                   reason,
-                   banned_by_uuid,
-                   banned_by_name,
-                   removed_by_name,
-                   time,
-                   until,
-                   removed_by_reason
-            FROM ${tableName} AS punishment
-                     INNER JOIN user_lookup ON user_lookup.uuid = punishment.uuid
+                   punishment.reason,
+                   punishment.banned_by_uuid,
+                   punishment.banned_by_name,
+                   punishment.removed_by_name,
+                   punishment.time,
+                   punishment.until,
+                   punishment.removed_by_reason
+            FROM ${table_name} AS punishment
+                     INNER JOIN user_lookup
+                                ON user_lookup.uuid = punishment.uuid
             WHERE ${name_column} LIKE #{partialName}
             ORDER BY time DESC
             LIMIT #{limit} OFFSET #{offset}
             """)
-    List<HistoryRecord> getRecentHistoryForName(@Param("tableName") String tableName,
+    List<HistoryRecord> getRecentHistoryForName(@Param("table_name") String tableName,
                                                 @Param("partialName") String partialName,
                                                 @Param("name_column") String nameColumn,
                                                 @Param("limit") int limit,
@@ -161,8 +169,6 @@ public interface NameHistoryMapper {
      * parameters. The records are sorted in descending order by time and limited to a specified range.
      *
      * @param tableName   the name of the database table to query the history records from
-     * @param partialName a partial or complete name of the user to filter the records, case-insensitive
-     * @param nameColumn  the column name in the database indicating the name to use for filtering
      * @param limit       the maximum number of records to fetch
      * @param offset      the starting offset position of the result set
      *
@@ -170,6 +176,7 @@ public interface NameHistoryMapper {
      * order
      */
     @Results({
+            @Result(property = "id", column = "id"),
             @Result(property = "uuid", column = "uuid"),
             @Result(property = "punishedName", column = "punished_name"),
             @Result(property = "reason", column = "reason"),
@@ -181,7 +188,8 @@ public interface NameHistoryMapper {
             @Result(property = "removedByReason", column = "removed_by_reason")
     })
     @Select("""
-            SELECT punishment.uuid,
+            SELECT punishment.id,
+                   punishment.uuid,
                    user_lookup.name AS punished_name,
                    punishment.reason,
                    punishment.banned_by_uuid,
@@ -191,7 +199,8 @@ public interface NameHistoryMapper {
                    punishment.until,
                    punishment.removed_by_reason
             FROM (
-                     SELECT uuid,
+                     SELECT id,
+                            uuid,
                             reason,
                             banned_by_uuid,
                             banned_by_name,
@@ -199,14 +208,13 @@ public interface NameHistoryMapper {
                             time,
                             until,
                             removed_by_reason
-                     FROM ${tableName} AS punishment
-                     WHERE ${name_column} LIKE #{partialName}
+                     FROM ${table_name} AS punishment
                      ORDER BY time DESC
                      LIMIT #{limit} OFFSET #{offset}
                  ) AS punishment
                      INNER JOIN user_lookup ON user_lookup.uuid = punishment.uuid
             """)
-    List<HistoryRecord> getRecentHistory(@Param("tableName") String tableName,
+    List<HistoryRecord> getRecentHistory(@Param("table_name") String tableName,
                                         @Param("limit") int limit,
                                         @Param("offset") int offset);
 
@@ -254,23 +262,23 @@ public interface NameHistoryMapper {
         }
     }
 
-    private List<HistoryRecord> getRecentBans(UserType userType, String partialName, int page) {
+    private @NotNull List<HistoryRecord> getRecentBans(UserType userType, String partialName, int page) {
         return addType(getRecent("litebans_bans", userType, partialName, page), "ban");
     }
 
-    private List<HistoryRecord> getRecentKicks(UserType userType, String partialName, int page) {
+    private @NotNull List<HistoryRecord> getRecentKicks(UserType userType, String partialName, int page) {
         return addType(getRecent("litebans_kicks", userType, partialName, page), "kick");
     }
 
-    private List<HistoryRecord> getRecentMutes(UserType userType, String partialName, int page) {
+    private @NotNull List<HistoryRecord> getRecentMutes(UserType userType, String partialName, int page) {
         return addType(getRecent("litebans_mutes", userType, partialName, page), "mute");
     }
 
-    private List<HistoryRecord> getRecentWarns(UserType userType, String partialName, int page) {
+    private @NotNull List<HistoryRecord> getRecentWarns(UserType userType, String partialName, int page) {
         return addType(getRecent("litebans_warnings", userType, partialName, page), "warn");
     }
 
-    private List<HistoryRecord> addType(List<HistoryRecord> historyRecords, String type) {
+    private @NotNull List<HistoryRecord> addType(@NotNull List<HistoryRecord> historyRecords, String type) {
         historyRecords.forEach(historyRecord -> historyRecord.setType(type));
         return historyRecords;
     }

database/src/main/java/com/alttd/altitudeweb/database/litebans/RecentNamesMapper.java

@@ -7,6 +7,17 @@ import java.util.ArrayList;
 import java.util.List;
 
 public interface RecentNamesMapper {
+
+    @Select("""
+            SELECT DISTINCT name AS username
+            FROM litebans_history
+            WHERE uuid = #{uuid}
+            ORDER BY date DESC
+            LIMIT 1;
+            """)
+    String getUsername(@Param("uuid") String uuid);
+
+
     @Select("""
             SELECT DISTINCT user_lookup.name AS punished_name
             FROM ${tableName} AS punishment

database/src/main/java/com/alttd/altitudeweb/database/litebans/UUIDHistoryMapper.java

@@ -1,10 +1,11 @@
 package com.alttd.altitudeweb.database.litebans;
 
-import com.alttd.altitudeweb.type_handler.UUIDTypeHandler;
 import org.apache.ibatis.annotations.Param;
 import org.apache.ibatis.annotations.Result;
 import org.apache.ibatis.annotations.Results;
 import org.apache.ibatis.annotations.Select;
+import org.jetbrains.annotations.Contract;
+import org.jetbrains.annotations.NotNull;
 
 import java.util.List;
 import java.util.UUID;
@@ -14,10 +15,11 @@ public interface UUIDHistoryMapper {
     int PAGE_SIZE = 10;
 
     @Results({
-            @Result(property = "uuid", column = "uuid", javaType = UUID.class, typeHandler = UUIDTypeHandler.class),
+            @Result(property = "id", column = "id"),
+            @Result(property = "uuid", column = "uuid"),
             @Result(property = "punishedName", column = "punished_name"),
             @Result(property = "reason", column = "reason"),
-            @Result(property = "bannedByUuid", column = "banned_by_uuid", javaType = UUID.class, typeHandler = UUIDTypeHandler.class),
+            @Result(property = "bannedByUuid", column = "banned_by_uuid"),
             @Result(property = "bannedByName", column = "banned_by_name"),
             @Result(property = "removedByName", column = "removed_by_name"),
             @Result(property = "time", column = "time"),
@@ -26,7 +28,7 @@ public interface UUIDHistoryMapper {
             @Result(property = "type", column = "type")
     })
     @Select("""
-            SELECT all_punishments.uuid, user_lookup.name AS punished_name, reason, banned_by_uuid, banned_by_name,
+            SELECT id, all_punishments.uuid, user_lookup.name AS punished_name, reason, banned_by_uuid, banned_by_name,
                    removed_by_name, time, until, removed_by_reason, type
             FROM all_punishments
             INNER JOIN user_lookup
@@ -41,10 +43,11 @@ public interface UUIDHistoryMapper {
                                             @Param("offset") int offset);
 
     @Results({
-            @Result(property = "uuid", column = "uuid", javaType = UUID.class, typeHandler = UUIDTypeHandler.class),
+            @Result(property = "id", column = "id"),
+            @Result(property = "uuid", column = "uuid"),
             @Result(property = "punishedName", column = "punished_name"),
             @Result(property = "reason", column = "reason"),
-            @Result(property = "bannedByUuid", column = "banned_by_uuid", javaType = UUID.class, typeHandler = UUIDTypeHandler.class),
+            @Result(property = "bannedByUuid", column = "banned_by_uuid"),
             @Result(property = "bannedByName", column = "banned_by_name"),
             @Result(property = "removedByName", column = "removed_by_name"),
             @Result(property = "time", column = "time"),
@@ -52,7 +55,7 @@ public interface UUIDHistoryMapper {
             @Result(property = "removedByReason", column = "removed_by_reason")
     })
     @Select("""
-            SELECT punishment.uuid, user_lookup.name AS punished_name, reason, banned_by_uuid, banned_by_name,
+            SELECT punishment.id, punishment.uuid, user_lookup.name AS punished_name, reason, banned_by_uuid, banned_by_name,
                    removed_by_name, time, until, removed_by_reason
             FROM ${tableName} AS punishment
             INNER JOIN user_lookup ON user_lookup.uuid = punishment.uuid
@@ -66,7 +69,8 @@ public interface UUIDHistoryMapper {
                                          @Param("limit") int limit,
                                          @Param("offset") int offset);
 
-    default List<HistoryRecord> getRecent(HistoryType historyType, UserType userType, UUID uuid, int page) {
+    default List<HistoryRecord> getRecent(@NotNull HistoryType historyType, @NotNull UserType userType,
+                                          @NotNull UUID uuid, int page) {
         return switch (historyType) {
             case ALL -> getRecentAll(userType, uuid, page);
             case BAN -> getRecentBans(userType, uuid, page);
@@ -76,7 +80,12 @@ public interface UUIDHistoryMapper {
         };
     }
 
-    private List<HistoryRecord> getRecent(String tableName, UserType userType, UUID uuid, int page) {
+    default List<HistoryRecord> getAllHistoryForUUID(@NotNull UUID uuid) {
+        return getRecentAllHistory(uuid.toString(), "uuid", 100, 0);
+    }
+
+    private List<HistoryRecord> getRecent(@NotNull String tableName, @NotNull UserType userType,
+                                          @NotNull UUID uuid, int page) {
         int offset = page * PAGE_SIZE;
         int limit = PAGE_SIZE;
         return switch (userType) {
@@ -85,7 +94,7 @@ public interface UUIDHistoryMapper {
         };
     }
 
-    private List<HistoryRecord> getRecentAll(UserType userType, UUID uuid, int page) {
+    private List<HistoryRecord> getRecentAll(@NotNull UserType userType, @NotNull UUID uuid, int page) {
         int offset = page * PAGE_SIZE;
         int limit = PAGE_SIZE;
         return switch (userType) {
@@ -96,23 +105,24 @@ public interface UUIDHistoryMapper {
         };
     }
 
-    private List<HistoryRecord> getRecentBans(UserType userType, UUID uuid, int page) {
+    private @NotNull List<HistoryRecord> getRecentBans(@NotNull UserType userType, @NotNull UUID uuid, int page) {
         return addType(getRecent("litebans_bans", userType, uuid, page), "ban");
     }
 
-    private List<HistoryRecord> getRecentKicks(UserType userType, UUID uuid, int page) {
+    private @NotNull List<HistoryRecord> getRecentKicks(@NotNull UserType userType, @NotNull UUID uuid, int page) {
         return addType(getRecent("litebans_kicks", userType, uuid, page), "kick");
     }
 
-    private List<HistoryRecord> getRecentMutes(UserType userType, UUID uuid, int page) {
+    private @NotNull List<HistoryRecord> getRecentMutes(@NotNull UserType userType, @NotNull UUID uuid, int page) {
         return addType(getRecent("litebans_mutes", userType, uuid, page), "mute");
     }
 
-    private List<HistoryRecord> getRecentWarns(UserType userType, UUID uuid, int page) {
+    private @NotNull List<HistoryRecord> getRecentWarns(@NotNull UserType userType, @NotNull UUID uuid, int page) {
         return addType(getRecent("litebans_warnings", userType, uuid, page), "warn");
     }
 
-    private List<HistoryRecord> addType(List<HistoryRecord> historyRecords, String type) {
+    @Contract("_, _ -> param1")
+    private @NotNull List<HistoryRecord> addType(@NotNull List<HistoryRecord> historyRecords, @NotNull String type) {
         historyRecords.forEach(historyRecord -> historyRecord.setType(type));
         return historyRecords;
     }

database/src/main/java/com/alttd/altitudeweb/database/luckperms/PlayerWithGroup.java

@@ -0,0 +1,6 @@
+package com.alttd.altitudeweb.database.luckperms;
+
+import java.util.UUID;
+
+public record PlayerWithGroup(String username, UUID uuid, String group) {
+}

database/src/main/java/com/alttd/altitudeweb/database/luckperms/TeamMemberMapper.java

@@ -15,7 +15,24 @@ public interface TeamMemberMapper {
             SELECT players.username, players.uuid
             FROM luckperms_user_permissions AS permissions
             INNER JOIN luckperms_players AS players ON players.uuid = permissions.uuid
-            WHERE permission = #{groupPermission}
+            WHERE permission = #{groupPermission} AND server = 'global'
+            AND world = 'global'
             """)
     List<Player> getTeamMembers(@Param("groupPermission") String groupPermission);
+
+    @ConstructorArgs({
+            @Arg(column = "username", javaType = String.class),
+            @Arg(column = "uuid", javaType = UUID.class, typeHandler = UUIDTypeHandler.class),
+            @Arg(column = "group", javaType = String.class)
+    })
+    @Select("""
+        SELECT players.username, players.uuid, permissions.permission AS 'group'
+        FROM luckperms_user_permissions AS permissions
+        INNER JOIN luckperms_players AS players ON players.uuid = permissions.uuid
+        WHERE permission IN (${groupPermissions})
+          AND server = 'global'
+          AND world = 'global'
+        """)
+    List<PlayerWithGroup> getTeamMembersOfGroupList(@Param("groupPermissions") String groupPermissions);
+
 }

database/src/main/java/com/alttd/altitudeweb/database/luckperms/UUIDUsernameMapper.java

@@ -0,0 +1,13 @@
+package com.alttd.altitudeweb.database.luckperms;
+
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+
+public interface UUIDUsernameMapper {
+    @Select("""
+            SELECT username
+            FROM luckperms_players
+            WHERE uuid = #{uuid}
+            """)
+    String getUsernameFromUUID(@Param("uuid") String uuid);
+}

database/src/main/java/com/alttd/altitudeweb/database/proxyplaytime/StaffPlaytimeMapper.java

@@ -0,0 +1,33 @@
+package com.alttd.altitudeweb.database.proxyplaytime;
+
+import com.alttd.altitudeweb.type_handler.UUIDTypeHandler;
+import org.apache.ibatis.annotations.Arg;
+import org.apache.ibatis.annotations.ConstructorArgs;
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+
+import java.util.List;
+import java.util.UUID;
+
+public interface StaffPlaytimeMapper {
+    @ConstructorArgs({
+            @Arg(column = "uuid", javaType = UUID.class, typeHandler = UUIDTypeHandler.class),
+            @Arg(column = "serverName", javaType = String.class),
+            @Arg(column = "sessionStart", javaType = long.class),
+            @Arg(column = "sessionEnd", javaType = long.class)
+    })
+    @Select("""
+        SELECT uuid,
+               server_name AS serverName,
+               session_start AS sessionStart,
+               session_end   AS sessionEnd
+        FROM sessions
+        WHERE session_end > #{from}
+          AND session_start < #{to}
+          AND uuid IN (${staffUUIDs})
+        ORDER BY uuid, session_start
+        """)
+    List<StaffPt> getSessionsDuring(@Param("from") long from,
+                                    @Param("to") long to,
+                                    @Param("staffUUIDs") String staffUUIDs);
+}

database/src/main/java/com/alttd/altitudeweb/database/proxyplaytime/StaffPt.java

@@ -0,0 +1,6 @@
+package com.alttd.altitudeweb.database.proxyplaytime;
+
+import java.util.UUID;
+
+public record StaffPt(UUID uuid, String serverName, long sessionStart, long sessionEnd) {
+}

database/src/main/java/com/alttd/altitudeweb/database/votingplugin/VotingPluginUsersMapper.java

@@ -0,0 +1,28 @@
+package com.alttd.altitudeweb.database.votingplugin;
+
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+
+import java.util.Optional;
+import java.util.UUID;
+
+public interface VotingPluginUsersMapper {
+
+    @Select("""
+             SELECT
+                 LastVotes as lastVotes,
+                 BestDayVoteStreak as bestDailyStreak,
+                 BestWeekVoteStreak as bestWeeklyStreak,
+                 BestMonthVoteStreak as bestMonthlyStreak,
+                 DayVoteStreak as dailyStreak,
+                 WeekVoteStreak as weeklyStreak,
+                 MonthVoteStreak as monthlyStreak,
+                 DailyTotal as totalVotesToday,
+                 WeeklyTotal as totalVotesThisWeek,
+                 MonthTotal as totalVotesThisMonth,
+                 AllTimeTotal as totalVotesAllTime
+             FROM votingplugin.VotingPlugin_Users
+             WHERE uuid = #{uuid}
+            """)
+    Optional<VotingStatsRow> getStatsByUuid(@Param("uuid") UUID uuid);
+}

database/src/main/java/com/alttd/altitudeweb/database/votingplugin/VotingStatsRow.java

@@ -0,0 +1,15 @@
+package com.alttd.altitudeweb.database.votingplugin;
+
+public record VotingStatsRow(
+        String lastVotes,
+        Integer bestDailyStreak,
+        Integer bestWeeklyStreak,
+        Integer bestMonthlyStreak,
+        Integer dailyStreak,
+        Integer weeklyStreak,
+        Integer monthlyStreak,
+        Integer totalVotesToday,
+        Integer totalVotesThisWeek,
+        Integer totalVotesThisMonth,
+        Integer totalVotesAllTime
+        ) { }

database/src/main/java/com/alttd/altitudeweb/database/web_db/KeyPairEntity.java

@@ -0,0 +1,16 @@
+package com.alttd.altitudeweb.database.web_db;
+
+import lombok.Data;
+import lombok.NoArgsConstructor;
+import lombok.AllArgsConstructor;
+import java.time.Instant;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class KeyPairEntity {
+    private int id;
+    private String privateKey;
+    private String publicKey;
+    private Instant createdAt;
+}

database/src/main/java/com/alttd/altitudeweb/database/web_db/KeyPairMapper.java

@@ -0,0 +1,20 @@
+package com.alttd.altitudeweb.database.web_db;
+
+import org.apache.ibatis.annotations.*;
+
+public interface KeyPairMapper {
+    
+    @Select("""
+            SELECT id, private_key AS privateKey, public_key AS publicKey, created_at AS createdAt
+            FROM key_pair
+            ORDER BY id
+                DESC LIMIT 1
+            """)
+    KeyPairEntity getKeyPair();
+    
+    @Insert("""
+            INSERT INTO key_pair (id, private_key, public_key, created_at)
+            VALUES (#{id}, #{privateKey}, #{publicKey}, #{createdAt})
+            """)
+    void save(KeyPairEntity keyPair);
+}

database/src/main/java/com/alttd/altitudeweb/database/web_db/PrivilegedUser.java

@@ -0,0 +1,17 @@
+package com.alttd.altitudeweb.database.web_db;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.List;
+import java.util.UUID;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class PrivilegedUser {
+    private Integer id;
+    private UUID uuid;
+    private List<String> permissions;
+}

database/src/main/java/com/alttd/altitudeweb/database/web_db/PrivilegedUserMapper.java

@@ -0,0 +1,110 @@
+package com.alttd.altitudeweb.database.web_db;
+
+import org.apache.ibatis.annotations.*;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+
+public interface PrivilegedUserMapper {
+
+    /**
+     * Retrieves a user by their UUID along with their permissions
+     * @param uuid The UUID of the user to retrieve
+     * @return The optional PrivilegedUser with their permissions
+     */
+    @Select("""
+        SELECT id, uuid
+        FROM privileged_users
+        WHERE uuid = #{uuid}
+        """)
+    @Results({
+            @Result(property = "id", column = "id"),
+            @Result(property = "uuid", column = "uuid"),
+            @Result(property = "permissions", column = "id", javaType = List.class,
+                    many = @Many(select = "getPermissionsForUser"))
+    })
+    Optional<PrivilegedUser> getUserByUuid(@Param("uuid") UUID uuid);
+
+    /**
+     * Retrieves all privileged users with their permissions
+     * @return List of all privileged users with their permissions
+     */
+    @Select("""
+            SELECT id, uuid
+            FROM privileged_users
+            """)
+    @Results({
+            @Result(property = "id", column = "id"),
+            @Result(property = "uuid", column = "uuid"),
+            @Result(property = "permissions", column = "id", javaType = List.class,
+                    many = @Many(select = "getPermissionsForUser"))
+    })
+    List<PrivilegedUser> getAllUsers();
+
+    /**
+     * Gets all permissions for a specific user
+     * @param userId The ID of the user
+     * @return List of permission strings
+     */
+    @Select("""
+            SELECT privileges
+            FROM privileges
+            WHERE user_id = #{userId}
+            """)
+    List<String> getPermissionsForUser(@Param("userId") int userId);
+
+    /**
+     * Adds a new privileged user
+     * @param user The PrivilegedUser object to add
+     * @return The number of rows affected
+     */
+    @Insert("""
+            INSERT INTO privileged_users (uuid)
+            VALUES (#{user.uuid})
+            """)
+    @Options(useGeneratedKeys = true, keyProperty = "user.id", keyColumn = "id")
+    int addUser(@Param("user") PrivilegedUser user);
+
+    /**
+     * Deletes a privileged user by their UUID
+     * @param uuid The UUID of the user to delete
+     * @return The number of rows affected
+     */
+    @Delete("""
+            DELETE FROM privileged_users
+            WHERE uuid = #{uuid}
+            """)
+    int deleteUserByUuid(@Param("uuid") String uuid);
+
+    /**
+     * Adds a permission to a user
+     * @param userId The ID of the user
+     * @param permission The permission to add
+     * @return The number of rows affected
+     */
+    @Insert("""
+            INSERT INTO privileges (user_id, privileges)
+            VALUES (#{userId}, #{permission})
+            """)
+    int addPermissionToUser(@Param("userId") int userId, @Param("permission") String permission);
+
+    /**
+     * Removes a permission from a user
+     * @param userId The ID of the user
+     * @param permission The permission to remove
+     * @return The number of rows affected
+     */
+    @Delete("""
+            DELETE FROM privileges
+            WHERE user_id = #{userId} AND privileges = #{permission}
+            """)
+    int removePermissionFromUser(@Param("userId") int userId, @Param("permission") String permission);
+
+    @Insert("""
+        INSERT INTO privileged_users (uuid)
+        VALUES (#{user.uuid})
+        """)
+    @SelectKey(statement = "SELECT LAST_INSERT_ID()", keyProperty = "user.id", before = false, resultType = int.class)
+    void createPrivilegedUser(@Param("user") PrivilegedUser user);
+}

database/src/main/java/com/alttd/altitudeweb/database/web_db/SettingsMapper.java

@@ -3,6 +3,6 @@ package com.alttd.altitudeweb.database.web_db;
 import org.apache.ibatis.annotations.Select;
 
 public interface SettingsMapper {
-    @Select("SELECT host, port, name, username, password FROM db_connection_settings WHERE name = #{database}")
+    @Select("SELECT host, port, name, username, password FROM db_connection_settings WHERE internal_name = #{database}")
     DatabaseSettings getSettings(String database);
 }

database/src/main/java/com/alttd/altitudeweb/database/web_db/chat_session/ChatSession.java

@@ -0,0 +1,18 @@
+package com.alttd.altitudeweb.database.web_db.chat_session;
+
+import lombok.Builder;
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Getter
+@Builder
+public class ChatSession {
+
+    private final UUID uuid;
+    private final Instant session_start;
+    private final Instant session_end;
+
+}

database/src/main/java/com/alttd/altitudeweb/database/web_db/chat_session/ChatSessionMapper.java

@@ -0,0 +1,13 @@
+package com.alttd.altitudeweb.database.web_db.chat_session;
+
+import org.apache.ibatis.annotations.Insert;
+
+public interface ChatSessionMapper {
+
+    @Insert("""
+        INSERT INTO chat_session (uuid, session_start, session_end)
+        VALUES (#{uuid}, #{session_start}, #{session_end})
+    """)
+    void storeSession(ChatSession chatSession);
+
+}