[sven-n]

Split out of #995 (original commit by @OviedoMarcelo, authorship kept).

Problem

Account.SecurityCode defaults to "", not null, so the check in GuildKickPlayerAction

if (player.Account!.SecurityCode != null && player.Account.SecurityCode != securityCode)

always compared the input against an empty string. No input can match that, and there's no in-game or web flow to set a security code. As a result, a guild master could never kick a member, and also couldn't disband the guild, because disbanding is a self-kick.

Change

• The check now works like DeleteCharacterAction: if no security code is set, the input is checked against the account password (BCrypt). Otherwise it's checked against the security code.
• The debug log no longer contains the entered or the stored security code.
• New tests in GuildActionTest:
  • a kick with the password succeeds when no security code is set
  • a kick with a wrong password is rejected
  • when a security code is set, the password isn't accepted, but the code is

Testing

• dotnet test tests/MUnique.OpenMU.Tests --filter GuildActionTest: 32/32 passed.
• With the old GuildKickPlayerAction, GuildKickWithPasswordWhenNoSecurityCodeIsSetAsync fails, as expected.

---

Generated by Claude Code