Disabling enablePremium still leaves Velocity in premium mode for stored users

[strobil]

What behaviour is observed?

I am running AuthMe on Paper behind the official AuthMe Velocity plugin.

With existing premium users, setting settings.enablePremium: false does not fully return the network to offline mode. AuthMe on the backend stops the premium bypass, but Velocity still treats usernames stored with a premiumUUID as premium and performs Mojang verification for them. Those users are then asked for their AuthMe password while still going through the proxy-side premium profile path.

The stored premium usernames are sent to Velocity on proxy.started regardless of enablePremium. If the effective list is empty, the backend currently sends no list at all, so premium_names.cache can also remain stale. Both /freemium and /authme freemium return that the feature is disabled once the setting is false, so there is no supported cleanup path afterward.

Looking at the current code, AsynchronousJoin.canBypassWithPremium() checks ENABLE_PREMIUM, while the BungeeReceiver handler for proxy.started calls dataSource.getPremiumUsernames() without the same check.

Expected behaviour

When enablePremium is false, every player should be handled as an offline-mode user by both AuthMe and the proxy. Existing premiumUUID values may remain in the database so they can be restored if the feature is enabled again, but they should be ignored while it is disabled.

On proxy startup the backend should send an authoritative empty premium list when the feature is disabled, allowing Velocity to replace and persist an empty cache. /premium should remain unavailable; /freemium should either remain usable for cleanup or be unnecessary because the stored flags are inactive.

To Reproduce

1. Run a Paper backend with AuthMe behind Velocity using the official AuthMe Velocity plugin, Hooks.bungeecord: true, and MySQL.
2. Set settings.enablePremium: true.
3. Register an account, run /premium, reconnect, and confirm that premium login works.
4. Stop the backend and proxy, change settings.enablePremium to false, then start them again.
5. Join with the same account so the deferred proxy.started handshake can be delivered.
6. Observe that Velocity still loads/receives the stored username as premium, while backend AuthMe no longer grants the premium bypass and requires normal password authentication.
7. Run /freemium or /authme freemium <player>; AuthMe reports that premium support is disabled instead of clearing the stale flag.

Plugin list

Relevant plugins on Paper: AuthMe 6.0.1-SNAPSHOT-b2767, LuckPerms 5.5.65, ProtocolLib 5.5.0-SNAPSHOT, ViaVersion 5.11.0, ViaBackwards 5.11.0, PlaceholderAPI 2.12.3.

Proxy: Velocity with AuthMe Velocity 6.0.1-SNAPSHOT-b2767.

Server Implementation

BungeeCord

Database Implementation

MySQL

AuthMe Version

6.0.1-SNAPSHOT-b2767 (Paper and Velocity builds from CodeMC)

Error log (if applicable)

No exception is thrown.

Configuration

https://gist.github.com/strobil/1beae5c424758a31fa850b2fb76fb946