refactor: improved account matching and bypass loopback throttling

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25'
+          go-version-file: 'go.mod'
           cache: true
 
       - name: Verify dependencies

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25'
+          go-version-file: 'go.mod'
           cache: true
 
       - name: Run GoReleaser

internal/packet/gs/validate.go

@@ -6,6 +6,8 @@
 package gs
 
 import (
+	"strings"
+
 	"github.com/mmo-dev-team/l2go-auth/internal/client"
 	"github.com/mmo-dev-team/l2go-auth/internal/session"
 
@@ -40,7 +42,7 @@ func HandleValidate(gsc *client.GameServerClient, r *network.PacketReader) error
 
 	sess, ok := session.ValidateAndDelete(LoginOkID1)
 	success := ok &&
-		sess.Account == account &&
+		strings.EqualFold(sess.Account, account) &&
 		sess.Key.CheckPlayPair(LoginOkID1, LoginOkID2, PlayOkID1, PlayOkID2)
 
 	statusByte := byte(0)

internal/service/ban_manager.go

@@ -50,8 +50,18 @@ func NewBanManager(ctx context.Context, queries *db.Queries, maxAttempts int) *B
 	return bm
 }
 
+// IsBanned checks if a given IP address is currently banned. Loopback (127.0.0.1 /
+// ::1) is never banned — it is the host itself (local tools, load tests) and must not
+// be able to lock itself out via the brute-force throttle.
+
+
 // IsBanned checks if a given IP address is currently banned.
+// Loopback (127.0.0.1 / ::1) is never banned.
 func (m *BanManager) IsBanned(ip netip.Addr) bool {
+	if ip.IsLoopback() {
+		return false
+	}
+
 	m.mu.RLock()
 	expiry, ok := m.ipBans[ip]
 	m.mu.RUnlock()
@@ -83,6 +93,10 @@ func (m *BanManager) IsBanned(ip netip.Addr) bool {
 
 // RecordFailure increments the failure count for an IP and applies a ban if the threshold is reached.
 func (m *BanManager) RecordFailure(ip netip.Addr) {
+	if ip.IsLoopback() {
+		return // never throttle/ban the host itself
+	}
+
 	m.mu.Lock()
 
 	m.attempts[ip]++