Scope addon-created BlueMap marker sets to their own worlds

[tastybento]

Problem

BlueMapHook.createMarkerSet() attached every new marker set to every map on the server:

api.getMaps().forEach(map -> map.getMarkerSets().put(id, markerSet));

populateAll() did the same again after a BlueMap reload, and removeMarkerSet() had the matching fan-out. So an addon registering a warps marker set for one game mode put that set in the sidebar of every other game mode's map, and of any non-BentoBox world's map as well. A set created but never populated was listed on every map while permanently empty.

Island marker sets were never affected — registerGameMode() already scopes those to the game mode's own overworld/nether/end.

Fix

MapHook#createMarkerSet(id, label) has no world parameter, so there is nothing to scope by at creation time. The worlds are instead learned lazily from the markers themselves:

• addPointMarker / addAreaMarker / addPolygonMarker record the world they were handed and attach the set to just that world's maps.
• populateAll() replays the recorded worlds after a BlueMap reload instead of hitting api.getMaps().
• removeMarkerSet() detaches from only the worlds the set was attached to.

A set with no markers yet is now attached nowhere, which is also the more useful behaviour.

Also in here

createMarkerSet() and removeMarkerSet() dereferenced the api field unconditionally, so an addon calling either before BlueMap finished loading — or during a /bluemap reload, when the hook nulls api in its onDisable callback — got an NPE. Both now guard, as does addMarkerSetToWorld.

getBlueMapAPI() was annotated @NonNull but returns null in exactly those two windows. It is now @Nullable with the windows documented; the old annotation told null-analysis to skip the check callers actually needed. Annotation-only change, so binary compatibility is unaffected.

Testing

8 new tests in BlueMapHookTest, including the direct regression test (testAddPointMarkerDoesNotAttachSetToUnrelatedWorld: two worlds with their own maps, marker added in one, assert the other's map stays clean), reload re-attachment, detach-on-remove, and the API-not-loaded path.

Full suite: 3374 tests, 0 failures.

Version

None needed — buildVersion is already 3.21.1 and 3.21.0 is the latest release, so this lands in the pending version.

Context

Spotted while investigating an admin's BlueMap report on Discord. It is not the cause of that report — that one is looking like an nginx gzip_static always / webroot issue on their side — but it is a real defect in the same code.

🤖 Generated with Claude Code

https://claude.ai/code/session_016pHWC6XapJj5gRtsFr74Tf

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
84.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud