Concealment only works for OPed players.

[harmlessaccount]

I'm running an offline semi-vanilla server with no rules, so protecting player bases is essential. To prevent location exposure during login, I've set onJoin.concealment to true and teleport players to the server's spawn point upon joining. After successful login, they are then sent back to their last quit location.

This setup works perfectly when testing with an OP account—I'm correctly teleported to spawn on join, and only sent back to my last location after a successful login. However, when using a non-OP account, the plugin seems to bypass the concealment setting. The player is immediately teleported to their last quit location, even before logging in.

It seems like the concealment feature doesn't apply properly to non-OP accounts. Could this be a permission issue, or is there something else affecting how the concealment is applied?

nameValidation: false
timeout: 120
passwordValidation:
  minLength: 6
  maxLength: 32
  minUppercase: 0
  minNumbers: 0
pinValidation:
  minLength: 6
  maxLength: 6
effects:
  title: true
  particles: false
  sounds: true
  blindness: false
welcomeMessage:
  text:
  - '&7Welcome&7!'
  enabled: false
requirePin: false
sendPinSetReminder: false
sessionExpiresIn: 1
onFirstJoin:
  teleport: false
  x: 825
  y: 64
  z: 1072
  yaw: 237.766
  pitch: -0.864
  world: world
onJoin:
  # Concealment if set to true (also requires teleport to be true) will teleport a player to their position after authentication
  concealment: true
  teleport: true
  x: 825
  y: 64
  z: 1072
  yaw: 237.766
  pitch: -0.864
  world: world
duplicateIpProtection:
  # 0 - No protection
  # 1 - Max is applied to online players
  # 2 - Max is applied to registered players
  protectionLevel: 0
  maxPerIp: 1000
  notifyOnDuplicateIp: true
database:
  type: sqlite # mysql or sqlite
  credentials: # Only for mysql, ignore if using sqlite
    host: 127.0.0.1:3306
    user: root
    password: root
    database: authy
lang: en_us