The requested user could not be found.
} + {query.error &&{query.error === "invalid-group-assignment" ? "The user or group no longer exists. No group change was applied." : "The requested user could not be found."}
} + {query.saved === "group" &&User group updated.
}
-
+
diff --git a/apps/web/src/app/api/velocity/access/route.ts b/apps/web/src/app/api/velocity/access/route.ts
index 86bfc53..6e52f2f 100644
--- a/apps/web/src/app/api/velocity/access/route.ts
+++ b/apps/web/src/app/api/velocity/access/route.ts
@@ -1,5 +1,5 @@
import { randomUUID } from "node:crypto";
-import { isRequestTimestampFresh, resolveEffectiveGroup, verifyHashedToken } from "@minecraft-account-manager/auth";
+import { gameAdmissionDenialReason, isRequestTimestampFresh, resolveEffectiveGroup, verifyHashedToken } from "@minecraft-account-manager/auth";
import { problemDetails, velocityAccessRequestSchema } from "@minecraft-account-manager/contracts";
import {
appSettings,
@@ -13,6 +13,7 @@ import {
} from "@minecraft-account-manager/database";
import { and, eq, isNull, lt, sql } from "drizzle-orm";
import { NextResponse } from "next/server";
+import { admissionDenialMessage, DEFAULT_ADMISSION_MESSAGES } from "@/lib/admission-settings";
import { db } from "@/lib/database";
import { isUniqueConstraintViolation } from "@/lib/database-errors";
import { getIpIntelligence, toAuditIpData } from "@/lib/ip-intelligence";
@@ -20,7 +21,6 @@ import { logger } from "@/lib/logger";
import { problemInstance, problemResponse } from "@/lib/problem-response";
const MAX_CLOCK_SKEW_MS = 45_000;
-const DEFAULT_DENIAL_MESSAGE = "Please register your Minecraft account before joining.";
function methodNotAllowed(request: Request) {
const response = problemResponse(problemDetails(
@@ -111,35 +111,13 @@ async function handleVelocityAccess(request: Request) {
}
const [settings] = await db.select().from(appSettings).where(eq(appSettings.id, "default")).limit(1);
- const denialMessage = settings?.registrationMessage ?? DEFAULT_DENIAL_MESSAGE;
+ const admissionMessages = {
+ registrationMessage: settings?.registrationMessage ?? DEFAULT_ADMISSION_MESSAGES.registrationMessage,
+ groupAccessDeniedMessage: settings?.groupAccessDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.groupAccessDeniedMessage,
+ vpnDeniedMessage: settings?.vpnDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.vpnDeniedMessage,
+ };
- let [knownAccount] = await db
- .select({ id: minecraftAccounts.id })
- .from(minecraftAccounts)
- .where(
- and(
- eq(minecraftAccounts.minecraftUuid, input.minecraftUuid),
- isNull(minecraftAccounts.deletedAt),
- ),
- )
- .limit(1);
- if (!knownAccount) {
- [knownAccount] = await db
- .select({ id: minecraftAccounts.id })
- .from(minecraftAccounts)
- .where(
- and(
- isNull(minecraftAccounts.minecraftUuid),
- sql`lower(${minecraftAccounts.username}) = lower(${input.username})`,
- isNull(minecraftAccounts.deletedAt),
- ),
- )
- .limit(1);
- }
-
- const intelligence = knownAccount
- ? await getIpIntelligence(input.ipAddress)
- : { classification: "unknown" as const, provider: null };
+ const intelligence = await getIpIntelligence(input.ipAddress);
const auditIpData = toAuditIpData(intelligence);
const decision = await db.transaction(async (tx) => {
@@ -209,23 +187,24 @@ async function handleVelocityAccess(request: Request) {
classification: intelligence.classification,
observedAt: occurredAt,
});
- return { allowed: false as const, message: denialMessage };
+ return { allowed: false as const, message: admissionDenialMessage("not_registered", admissionMessages) };
}
const [explicitGroup] = await tx
- .select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled })
+ .select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, anonymizedNetworksAllowed: groups.anonymizedNetworksAllowed })
.from(userGroupMemberships)
.innerJoin(groups, eq(groups.id, userGroupMemberships.groupId))
.where(eq(userGroupMemberships.userId, account.userId))
.limit(1);
const [defaultGroup] = await tx
- .select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled })
+ .select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, anonymizedNetworksAllowed: groups.anonymizedNetworksAllowed })
.from(groups)
.where(eq(groups.isDefault, true))
.limit(1);
const effectiveGroup = resolveEffectiveGroup(explicitGroup ?? null, defaultGroup ?? null);
- if (!effectiveGroup?.accessEnabled) {
+ const denialReason = gameAdmissionDenialReason(effectiveGroup ?? null, intelligence.classification);
+ if (denialReason) {
await tx.insert(events).values({
id: randomUUID(),
source: `/velocity/${input.serverId}`,
@@ -235,7 +214,9 @@ async function handleVelocityAccess(request: Request) {
actorUserId: account.userId,
data: {
username: input.username,
- reason: "group_access_disabled",
+ reason: denialReason,
+ accessGroup: effectiveGroup?.name ?? null,
+ accessGroupId: effectiveGroup?.id ?? null,
ipIntelligence: auditIpData,
},
ipAddress: input.ipAddress,
@@ -251,9 +232,14 @@ async function handleVelocityAccess(request: Request) {
classification: intelligence.classification,
observedAt: occurredAt,
});
- return { allowed: false as const, message: "Your account group does not currently have server access." };
+ return {
+ allowed: false as const,
+ message: admissionDenialMessage(denialReason, admissionMessages),
+ };
}
+ if (!effectiveGroup) throw new Error("Effective access group is unavailable after admission approval");
+
if (account.minecraftUuid !== input.minecraftUuid || account.username !== input.username) {
await tx
.update(minecraftAccounts)
@@ -304,6 +290,7 @@ async function handleVelocityAccess(request: Request) {
uuidBackfilled: account.minecraftUuid === null,
ipIntelligence: auditIpData,
accessGroup: effectiveGroup.name,
+ accessGroupId: effectiveGroup.id,
},
ipAddress: input.ipAddress,
correlationId: input.requestId,
diff --git a/apps/web/src/components/user-group-select.test.tsx b/apps/web/src/components/user-group-select.test.tsx
new file mode 100644
index 0000000..d0a810f
--- /dev/null
+++ b/apps/web/src/components/user-group-select.test.tsx
@@ -0,0 +1,21 @@
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it } from "vitest";
+import { UserGroupSelect } from "./user-group-select";
+
+describe("UserGroupSelect", () => {
+ it("renders the effective group and preserves the active search", () => {
+ const markup = renderToStaticMarkup( undefined}
+ effectiveGroupId="group-ops"
+ groups={[{ id: "group-everyone", name: "everyone" }, { id: "group-ops", name: "Ops" }]}
+ search="alex smith"
+ userId="user-one"
+ userLabel="Alex"
+ />);
+
+ expect(markup).toContain('aria-label="Group for Alex"');
+ expect(markup).toContain('');
+ expect(markup).toContain('');
+ expect(markup).toContain("Apply group");
+ });
+});
diff --git a/apps/web/src/components/user-group-select.tsx b/apps/web/src/components/user-group-select.tsx
new file mode 100644
index 0000000..50b828e
--- /dev/null
+++ b/apps/web/src/components/user-group-select.tsx
@@ -0,0 +1,60 @@
+"use client";
+
+import { useFormStatus } from "react-dom";
+
+export function UserGroupSelect({
+ action,
+ effectiveGroupId,
+ groups,
+ search,
+ userId,
+ userLabel,
+}: {
+ action: (formData: FormData) => Promise;
+ effectiveGroupId: string;
+ groups: Array<{ id: string; name: string }>;
+ search: string;
+ userId: string;
+ userLabel: string;
+}) {
+ const helpId = `group-help-${userId}`;
+ return (
+
+ );
+}
+
+function GroupSelectControl({
+ effectiveGroupId,
+ groups,
+ helpId,
+ userLabel,
+}: {
+ effectiveGroupId: string;
+ groups: Array<{ id: string; name: string }>;
+ helpId: string;
+ userLabel: string;
+}) {
+ const { pending } = useFormStatus();
+ return (
+ <>
+
+ {pending ? "Updating group." : ""}
+
+
+ );
+}
diff --git a/apps/web/src/lib/admission-settings.test.ts b/apps/web/src/lib/admission-settings.test.ts
new file mode 100644
index 0000000..53e90d6
--- /dev/null
+++ b/apps/web/src/lib/admission-settings.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest";
+import { admissionDenialMessage, DEFAULT_ADMISSION_MESSAGES, parseAdmissionMessages } from "./admission-settings";
+
+describe("admission message settings", () => {
+ it("normalizes three independently configured denial messages", () => {
+ const formData = new FormData();
+ formData.set("registrationMessage", " Register your account before joining. ");
+ formData.set("groupAccessDeniedMessage", "This group cannot access the server right now.");
+ formData.set("vpnDeniedMessage", "VPN access requires a host-approved exception.");
+
+ expect(parseAdmissionMessages(formData)).toEqual({
+ registrationMessage: "Register your account before joining.",
+ groupAccessDeniedMessage: "This group cannot access the server right now.",
+ vpnDeniedMessage: "VPN access requires a host-approved exception.",
+ });
+ });
+
+ it("selects the configured message for each admission denial reason", () => {
+ expect(admissionDenialMessage("not_registered", DEFAULT_ADMISSION_MESSAGES)).toBe(DEFAULT_ADMISSION_MESSAGES.registrationMessage);
+ expect(admissionDenialMessage("group_access_disabled", DEFAULT_ADMISSION_MESSAGES)).toBe(DEFAULT_ADMISSION_MESSAGES.groupAccessDeniedMessage);
+ expect(admissionDenialMessage("anonymized_network_disallowed", DEFAULT_ADMISSION_MESSAGES)).toBe(DEFAULT_ADMISSION_MESSAGES.vpnDeniedMessage);
+ });
+
+ it("rejects missing, short, overlong, or control-character messages", () => {
+ for (const invalid of ["short", "a".repeat(501), "Denied\nInjected"] as const) {
+ const formData = new FormData();
+ formData.set("registrationMessage", DEFAULT_ADMISSION_MESSAGES.registrationMessage);
+ formData.set("groupAccessDeniedMessage", DEFAULT_ADMISSION_MESSAGES.groupAccessDeniedMessage);
+ formData.set("vpnDeniedMessage", invalid);
+ expect(parseAdmissionMessages(formData)).toBeNull();
+ }
+ });
+});
diff --git a/apps/web/src/lib/admission-settings.ts b/apps/web/src/lib/admission-settings.ts
new file mode 100644
index 0000000..24b189f
--- /dev/null
+++ b/apps/web/src/lib/admission-settings.ts
@@ -0,0 +1,37 @@
+export interface AdmissionMessages {
+ registrationMessage: string;
+ groupAccessDeniedMessage: string;
+ vpnDeniedMessage: string;
+}
+
+export const DEFAULT_ADMISSION_MESSAGES: AdmissionMessages = {
+ registrationMessage: "Please register your Minecraft account before joining.",
+ groupAccessDeniedMessage: "Your account group does not currently have server access. Contact a host if you believe this is a mistake.",
+ vpnDeniedMessage: "VPN, proxy, and Tor connections are not allowed. Contact a host to request an exception.",
+} as const;
+
+export function admissionDenialMessage(
+ reason: "not_registered" | "group_access_disabled" | "anonymized_network_disallowed",
+ messages: AdmissionMessages,
+) {
+ if (reason === "not_registered") return messages.registrationMessage;
+ if (reason === "group_access_disabled") return messages.groupAccessDeniedMessage;
+ return messages.vpnDeniedMessage;
+}
+
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+
+function messageValue(formData: FormData, name: string) {
+ const value = String(formData.get(name) ?? "").trim();
+ return value.length >= 10 && value.length <= 500 && !CONTROL_CHARACTERS.test(value)
+ ? value
+ : null;
+}
+
+export function parseAdmissionMessages(formData: FormData) {
+ const registrationMessage = messageValue(formData, "registrationMessage");
+ const groupAccessDeniedMessage = messageValue(formData, "groupAccessDeniedMessage");
+ const vpnDeniedMessage = messageValue(formData, "vpnDeniedMessage");
+ if (!registrationMessage || !groupAccessDeniedMessage || !vpnDeniedMessage) return null;
+ return { registrationMessage, groupAccessDeniedMessage, vpnDeniedMessage };
+}
diff --git a/design/log.md b/design/log.md
index dd7ada6..d7e21b5 100644
--- a/design/log.md
+++ b/design/log.md
@@ -2,6 +2,8 @@
## 2026-08-02
+* **Add**: Provide Users-page group assignment, effective-group VPN/proxy/Tor exceptions for game admission, and independent configurable denial messages.
+* **Fix**: Treat malformed ProxyCheck proxy signals as unknown and classify every authenticated Velocity login before identity resolution.
* **Fix**: Replace the dashboard's pre-enrichment network label with enriched company, ASN, connection type, Proxy/VPN status, and risk fields.
* **Fix**: Group collocated map users into count-badged markers with complete nickname tooltips and per-user interactive-map links.
* **Refine**: Replace registration counts with daily active users, collapse enriched VPN activity per user, add opt-in OpenStreetMap zoom, show managed nickname tooltips, and measure active Minecraft accounts from confirmed Velocity connections.
diff --git a/design/us-007-ip-intelligence.md b/design/us-007-ip-intelligence.md
index 1a5a278..4ef0917 100644
--- a/design/us-007-ip-intelligence.md
+++ b/design/us-007-ip-intelligence.md
@@ -3,7 +3,7 @@ type: User Story
title: Enrich portal and game login IPs
description: Login audit events include cached approximate location and network intelligence from ProxyCheck.io.
tags: [security, network, audit, proxycheck]
-timestamp: 2026-08-01T22:04:17Z
+timestamp: 2026-08-02T14:12:43Z
story_id: US-007
status: verified
---
@@ -19,7 +19,7 @@ As an operator, I want portal and registered game logins enriched with network c
- [x] Provider failures are cached briefly and do not deny portal or registered game login.
- [x] Private, loopback, reserved, documentation, and mapped-private addresses are never sent to ProxyCheck.
- [x] Forwarded web IP headers are ignored unless trusted-proxy handling is explicitly enabled.
-- [x] Unknown game accounts do not trigger paid ProxyCheck lookups.
+- [x] Every authenticated Velocity login request uses the cached ProxyCheck path before identity resolution, preventing account-creation races from bypassing network policy.
- [x] Login events and IP observations retain the available classification and approximate location.
- [x] Users and administrators can see available location and classification in audit views.
- [x] Repeated access observations are summarized by IPv4 /24 or IPv6 /64 network with counts, sources, and latest activity.
diff --git a/design/us-008-vpn-blocking.md b/design/us-008-vpn-blocking.md
index d738d6c..d853113 100644
--- a/design/us-008-vpn-blocking.md
+++ b/design/us-008-vpn-blocking.md
@@ -3,7 +3,7 @@ type: User Story
title: Block account additions from anonymized networks
description: User Minecraft-account additions fail closed for VPN, proxy, Tor, or unknown IP classifications.
tags: [security, vpn, proxy, minecraft]
-timestamp: 2026-08-02T00:12:32Z
+timestamp: 2026-08-02T14:12:43Z
story_id: US-008
status: verified
---
@@ -22,6 +22,8 @@ As an operator, I want account additions blocked from anonymized networks, so th
- [x] Blocked and classification-unavailable attempts create distinct audit events with safe intelligence details.
- [x] Administrative account additions remain available as an authorized recovery path.
- [x] Administrators see enriched risky-network observations collapsed to one latest summary per user.
+- [x] Game admission enforces confirmed VPN, proxy, and Tor classifications according to the user's effective-group exception policy.
+- [x] Account-addition blocking remains unchanged and independent from the game-admission exception.
# Implementation
diff --git a/design/us-009-velocity-admission.md b/design/us-009-velocity-admission.md
index d123f9f..eb1aaa7 100644
--- a/design/us-009-velocity-admission.md
+++ b/design/us-009-velocity-admission.md
@@ -3,7 +3,7 @@ type: User Story
title: Enforce registration at the Velocity proxy
description: Online-mode Java connections are admitted only after a fail-closed account-manager decision.
tags: [minecraft, velocity, whitelist, security]
-timestamp: 2026-08-02T00:12:32Z
+timestamp: 2026-08-02T14:12:43Z
story_id: US-009
status: verified
---
@@ -27,6 +27,9 @@ As a registered player, I want the Velocity proxy to recognize my approved Java
- [x] The plugin records the real Velocity connection IP and supports Java Edition online mode only.
- [x] After admission, Velocity reports `PostLoginEvent` as best-effort authenticated telemetry without disconnecting an admitted player when reporting fails.
- [x] Confirmed-connection reports use fresh timestamps and database replay protection.
+- [x] Group-disabled and VPN/proxy/Tor-policy denials return distinct operator-configured messages.
+- [x] The default anonymized-network message directs the player to contact a host for an exception.
+- [x] API failures, malformed responses, and unauthorized requests retain fail-closed plugin fallback behavior.
# Implementation
diff --git a/design/us-012-admin-operations.md b/design/us-012-admin-operations.md
index 78adbde..4c4f61b 100644
--- a/design/us-012-admin-operations.md
+++ b/design/us-012-admin-operations.md
@@ -3,7 +3,7 @@ type: User Story
title: Operate settings and audit views
description: Authorized administrators control server messaging and investigate recent platform events.
tags: [admin, settings, audit, operations]
-timestamp: 2026-08-01T22:34:31Z
+timestamp: 2026-08-02T14:12:43Z
story_id: US-012
status: verified
---
@@ -21,11 +21,16 @@ As an administrator, I want operational settings and audit visibility, so that I
- [x] Event views show type, subject, IP, classification, and approximate location when available.
- [x] Admin console access itself creates an audit event with the SSO identity.
- [x] Settings, users, and events are linked from the shared admin navigation.
+- [x] Administrators can independently configure registration-required, group-access-disabled, and VPN/proxy/Tor-denied game messages.
+- [x] Every message is validated server-side and has a safe default.
+- [x] Admission-message changes are audited with the administrator identity without logging credentials.
# Implementation
- [`apps/web/src/app/admin/(console)/page.tsx`](../apps/web/src/app/admin/%28console%29/page.tsx)
- [`apps/web/src/app/admin/(console)/actions.ts`](../apps/web/src/app/admin/%28console%29/actions.ts)
+- [`apps/web/src/lib/admission-settings.ts`](../apps/web/src/lib/admission-settings.ts)
+- [`packages/database/drizzle/0004_zippy_silver_centurion.sql`](../packages/database/drizzle/0004_zippy_silver_centurion.sql)
- [`apps/web/src/app/admin/(console)/events/page.tsx`](../apps/web/src/app/admin/%28console%29/events/page.tsx)
# Validation
diff --git a/design/us-013-admin-user-management.md b/design/us-013-admin-user-management.md
index c6085c8..ad314af 100644
--- a/design/us-013-admin-user-management.md
+++ b/design/us-013-admin-user-management.md
@@ -3,7 +3,7 @@ type: User Story
title: Manage users as an administrator
description: Authorized operators search users and maintain their names, linked accounts, primaries, and Discord nicknames.
tags: [admin, users, minecraft, discord]
-timestamp: 2026-08-01T22:34:31Z
+timestamp: 2026-08-02T14:12:43Z
story_id: US-013
status: verified
---
@@ -24,12 +24,17 @@ As an administrator, I want to manage a user's identity and Minecraft accounts,
- [x] Administrators can set a new primary account and automatically update Discord.
- [x] Every action rechecks role and account ownership and records the acting administrator.
- [x] Discord failures do not falsely persist the requested name, primary, or removal change.
+- [x] Each row in the administrator user registry shows the user's effective group in an accessible dropdown.
+- [x] Selecting a group immediately applies the assignment; selecting `everyone` removes the explicit assignment.
+- [x] Group changes preserve the active user search and show accessible success or error feedback.
+- [x] Registry assignment changes revalidate administrator authorization, user existence, and group existence, and audit the previous and new effective groups.
# Implementation
- [`apps/web/src/app/admin/(console)/users/page.tsx`](../apps/web/src/app/admin/%28console%29/users/page.tsx)
- [`apps/web/src/app/admin/(console)/users/[userId]/page.tsx`](../apps/web/src/app/admin/%28console%29/users/%5BuserId%5D/page.tsx)
- [`apps/web/src/app/admin/(console)/users/actions.ts`](../apps/web/src/app/admin/%28console%29/users/actions.ts)
+- [`apps/web/src/components/user-group-select.tsx`](../apps/web/src/components/user-group-select.tsx)
# Validation
diff --git a/design/us-017-group-access.md b/design/us-017-group-access.md
index 82ede33..8b5f8f0 100644
--- a/design/us-017-group-access.md
+++ b/design/us-017-group-access.md
@@ -3,7 +3,7 @@ type: User Story
title: Control Minecraft admission with groups
description: Administrators assign users to groups and enable Minecraft access through explicit group policy.
tags: [admin, groups, authorization, velocity, security]
-timestamp: 2026-08-01T23:10:59Z
+timestamp: 2026-08-02T14:12:43Z
story_id: US-017
status: verified
---
@@ -24,12 +24,18 @@ As an administrator, I want to organize registered users into access groups, so
- [x] The protected default group cannot be deleted.
- [x] Group creation, membership, and access-policy changes are audited.
- [x] Users and administrators can inspect the user's single effective group assignment.
+- [x] Every group has an independently configurable VPN/proxy/Tor exception policy.
+- [x] The protected `everyone` group and newly created groups disallow VPN, proxy, and Tor connections by default.
+- [x] Confirmed VPN, proxy, or Tor game connections are denied unless the user's single effective group allows anonymized networks.
+- [x] Clear and hosting classifications are not denied by this group policy, and unavailable intelligence does not independently deny a registered player.
+- [x] VPN policy changes are authorized server-side and audited.
# Implementation
- [`packages/database/src/schema.ts`](../packages/database/src/schema.ts)
- [`packages/database/drizzle/0002_simple_queen_noir.sql`](../packages/database/drizzle/0002_simple_queen_noir.sql)
- [`packages/database/drizzle/0003_smiling_silver_samurai.sql`](../packages/database/drizzle/0003_smiling_silver_samurai.sql)
+- [`packages/database/drizzle/0004_zippy_silver_centurion.sql`](../packages/database/drizzle/0004_zippy_silver_centurion.sql)
- [`apps/web/src/app/admin/(console)/groups/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/page.tsx)
- [`apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/%5BgroupId%5D/page.tsx)
- [`apps/web/src/app/api/velocity/access/route.ts`](../apps/web/src/app/api/velocity/access/route.ts)
diff --git a/docs/accessibility.md b/docs/accessibility.md
index 69ee987..403d836 100644
--- a/docs/accessibility.md
+++ b/docs/accessibility.md
@@ -12,6 +12,7 @@ Player account management, administrator navigation, dashboard metrics and chart
- Darkened the accent color so accent text reaches at least 4.5:1 contrast on both canvas and panel backgrounds.
- Preserved reduced-motion behavior and disabled decorative cursor animation when requested.
- Added labels or accessible names to search, Minecraft username, settings, group, and event-filter controls.
+- Added per-user group dropdowns with immediate-change instructions, keyboard submission fallback, and live success or error feedback.
- Added `fieldset` and `legend` semantics to multi-select event-type filters.
- Added table captions, column scopes, and row scopes to administrator data tables.
- Added `role=status` with polite announcements for successful nickname changes and `role=alert` with assertive announcements for errors.
diff --git a/docs/architecture.md b/docs/architecture.md
index c0fb823..78bb18d 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -16,7 +16,7 @@ The bot creates private login links in response to `/register` and `/account`. D
Velocity sends the authenticated Java UUID, current username, source IP, server ID, request ID, and occurrence time. The API matches UUID first. Username fallback is allowed only when the stored account has no UUID, after which UUID and canonical username are updated.
-The admission decision is fail closed. Unknown players, invalid responses, expired requests, authentication failures, and unavailable API responses are denied with the configured registration message. After admission succeeds, `PostLoginEvent` reports a confirmed proxy connection through a fresh, authenticated, replay-protected request. Connection telemetry is best effort and never disconnects an already admitted player.
+The admission decision is fail closed. Unknown players, disabled effective groups, disallowed confirmed VPN/proxy/Tor connections, invalid responses, expired requests, authentication failures, and unavailable API responses are denied. Registration, group-access, and anonymized-network denials use independent operator-configured messages; transport and service failures retain the plugin's local fallback. After admission succeeds, `PostLoginEvent` reports a confirmed proxy connection through a fresh, authenticated, replay-protected request. Connection telemetry is best effort and never disconnects an already admitted player.
## Trust boundaries
@@ -38,7 +38,7 @@ The admission decision is fail closed. Unknown players, invalid responses, expir
## IP intelligence
-ProxyCheck.io supplies approximate city/region/country, coordinates, timezone, ASN, network company, connection type, proxy signal, risk, and VPN/proxy/Tor classification. Results are cached in PostgreSQL for 48 hours by default. Portal and game login events are enriched when data is available; lookup failures do not deny login. User Minecraft-account additions fail closed for unknown, VPN, proxy, or Tor classifications and record denied attempts. Hosting-provider blocking is optional through `BLOCK_HOSTING_IPS=true`. Private and reserved addresses are never sent to ProxyCheck.
+ProxyCheck.io supplies approximate city/region/country, coordinates, timezone, ASN, network company, connection type, proxy signal, risk, and VPN/proxy/Tor classification. Results are cached in PostgreSQL for 48 hours by default. Portal logins and every bearer-authenticated Velocity login are enriched through the cache before identity resolution; lookup failures do not independently deny a registered player. Confirmed VPN, proxy, and Tor game connections require an exception on the player's effective group. User Minecraft-account additions fail closed for unknown, VPN, proxy, or Tor classifications and record denied attempts. Hosting-provider blocking is optional through `BLOCK_HOSTING_IPS=true`. Private and reserved addresses are never sent to ProxyCheck.
## Event naming
diff --git a/docs/security-review.md b/docs/security-review.md
index fa52ea0..bd5d2ca 100644
--- a/docs/security-review.md
+++ b/docs/security-review.md
@@ -25,7 +25,9 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
- Velocity admission and confirmed-connection requests have a 45-second clock window and database-unique request IDs for cross-instance replay prevention.
- Velocity and its API fail closed.
- Registered players require an enabled effective group; explicit assignments replace rather than combine with the protected, disabled-by-default `everyone` fallback.
-- Group and membership mutations re-check the Keycloak administrator role server-side; destructive group deletion and its audit event commit atomically.
+- Confirmed VPN, proxy, and Tor game connections are denied unless that same effective group has an explicit exception; `everyone` and new groups default to no exception.
+- Group, VPN-policy, and membership mutations re-check the Keycloak administrator role server-side; registry assignments, VPN-policy changes, message settings, and destructive group deletion commit atomically with their audit events.
+- Every bearer-authenticated Velocity login uses cached IP intelligence before identity resolution, preventing account-creation races from bypassing network policy; malformed provider proxy signals classify as unknown.
- Event filters accept only event types already present in the ledger, and event detail routes remain role-protected.
- The administrator-only map defaults to bundled Natural Earth boundaries. OpenStreetMap tile requests begin only after an explicit operator opt-in; marker coordinates are not transmitted as data, but the requested tiles disclose the viewed geographic extent along with the administrator's IP and portal origin.
- Grouped-map popup labels and links are created with DOM `textContent` and server-rendered React escaping rather than interpolated HTML.
diff --git a/packages/auth/src/index.ts b/packages/auth/src/index.ts
index 9b86262..af196ad 100644
--- a/packages/auth/src/index.ts
+++ b/packages/auth/src/index.ts
@@ -115,6 +115,24 @@ export function resolveEffectiveGroup(explicitGroup: T | null, defaultGroup:
return explicitGroup ?? defaultGroup;
}
+export function isGameNetworkAllowed(
+ classification: "unknown" | "clear" | "vpn" | "proxy" | "hosting" | "tor",
+ anonymizedNetworksAllowed: boolean,
+) {
+ return anonymizedNetworksAllowed || !["vpn", "proxy", "tor"].includes(classification);
+}
+
+export function gameAdmissionDenialReason(
+ group: { accessEnabled: boolean; anonymizedNetworksAllowed: boolean } | null,
+ classification: "unknown" | "clear" | "vpn" | "proxy" | "hosting" | "tor",
+) {
+ if (!group?.accessEnabled) return "group_access_disabled" as const;
+ if (!isGameNetworkAllowed(classification, group.anonymizedNetworksAllowed)) {
+ return "anonymized_network_disallowed" as const;
+ }
+ return null;
+}
+
export function verifyHashedToken(providedToken: string, expectedHash: string) {
const provided = Buffer.from(hashToken(providedToken), "utf8");
const expected = Buffer.from(expectedHash, "utf8");
diff --git a/packages/auth/test/group-access.test.ts b/packages/auth/test/group-access.test.ts
index 650a210..f9c6db9 100644
--- a/packages/auth/test/group-access.test.ts
+++ b/packages/auth/test/group-access.test.ts
@@ -1,5 +1,5 @@
import { describe, expect, it } from "vitest";
-import { resolveEffectiveGroup } from "../src/index";
+import { gameAdmissionDenialReason, isGameNetworkAllowed, resolveEffectiveGroup } from "../src/index";
describe("group-based admission", () => {
const everyone = { name: "everyone", accessEnabled: false };
@@ -17,4 +17,26 @@ describe("group-based admission", () => {
const limited = { name: "limited", accessEnabled: false };
expect(resolveEffectiveGroup(limited, enabledDefault)?.accessEnabled).toBe(false);
});
+
+ it("denies confirmed anonymized game networks unless the effective group allows them", () => {
+ for (const classification of ["vpn", "proxy", "tor"] as const) {
+ expect(isGameNetworkAllowed(classification, false)).toBe(false);
+ expect(isGameNetworkAllowed(classification, true)).toBe(true);
+ }
+ });
+
+ it("does not apply the group exception policy to clear, hosting, or unavailable intelligence", () => {
+ for (const classification of ["clear", "hosting", "unknown"] as const) {
+ expect(isGameNetworkAllowed(classification, false)).toBe(true);
+ }
+ });
+
+ it("prioritizes disabled group access before the network exception policy", () => {
+ expect(gameAdmissionDenialReason({ accessEnabled: false, anonymizedNetworksAllowed: false }, "vpn"))
+ .toBe("group_access_disabled");
+ expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: false }, "vpn"))
+ .toBe("anonymized_network_disallowed");
+ expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: true }, "vpn"))
+ .toBeNull();
+ });
});
diff --git a/packages/database/drizzle/0004_zippy_silver_centurion.sql b/packages/database/drizzle/0004_zippy_silver_centurion.sql
new file mode 100644
index 0000000..54a055f
--- /dev/null
+++ b/packages/database/drizzle/0004_zippy_silver_centurion.sql
@@ -0,0 +1,3 @@
+ALTER TABLE "app_settings" ADD COLUMN "group_access_denied_message" text DEFAULT 'Your account group does not currently have server access. Contact a host if you believe this is a mistake.' NOT NULL;--> statement-breakpoint
+ALTER TABLE "app_settings" ADD COLUMN "vpn_denied_message" text DEFAULT 'VPN, proxy, and Tor connections are not allowed. Contact a host to request an exception.' NOT NULL;--> statement-breakpoint
+ALTER TABLE "groups" ADD COLUMN "anonymized_networks_allowed" boolean DEFAULT false NOT NULL;
\ No newline at end of file
diff --git a/packages/database/drizzle/meta/0004_snapshot.json b/packages/database/drizzle/meta/0004_snapshot.json
new file mode 100644
index 0000000..ca452aa
--- /dev/null
+++ b/packages/database/drizzle/meta/0004_snapshot.json
@@ -0,0 +1,1292 @@
+{
+ "id": "37b4bb6b-f83c-46ab-8370-ffa5a4f16e9e",
+ "prevId": "7a39edf8-ec83-4a5e-a228-8ab0a5bde3c7",
+ "version": "7",
+ "dialect": "postgresql",
+ "tables": {
+ "public.app_settings": {
+ "name": "app_settings",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "text",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "'default'"
+ },
+ "registration_message": {
+ "name": "registration_message",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'Please register your Minecraft account before joining.'"
+ },
+ "group_access_denied_message": {
+ "name": "group_access_denied_message",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'Your account group does not currently have server access. Contact a host if you believe this is a mistake.'"
+ },
+ "vpn_denied_message": {
+ "name": "vpn_denied_message",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'VPN, proxy, and Tor connections are not allowed. Contact a host to request an exception.'"
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.events": {
+ "name": "events",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true
+ },
+ "spec_version": {
+ "name": "spec_version",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'1.0'"
+ },
+ "source": {
+ "name": "source",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "type": {
+ "name": "type",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "subject": {
+ "name": "subject",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "time": {
+ "name": "time",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "data_content_type": {
+ "name": "data_content_type",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'application/json'"
+ },
+ "data_schema": {
+ "name": "data_schema",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "data": {
+ "name": "data",
+ "type": "jsonb",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "actor_user_id": {
+ "name": "actor_user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "ip_address": {
+ "name": "ip_address",
+ "type": "inet",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "correlation_id": {
+ "name": "correlation_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "published_at": {
+ "name": "published_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "events_time_idx": {
+ "name": "events_time_idx",
+ "columns": [
+ {
+ "expression": "time",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "events_type_time_idx": {
+ "name": "events_type_time_idx",
+ "columns": [
+ {
+ "expression": "type",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "time",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "events_subject_time_idx": {
+ "name": "events_subject_time_idx",
+ "columns": [
+ {
+ "expression": "subject",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "time",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "events_unpublished_idx": {
+ "name": "events_unpublished_idx",
+ "columns": [
+ {
+ "expression": "created_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "where": "\"events\".\"published_at\" is null",
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "events_actor_user_id_users_id_fk": {
+ "name": "events_actor_user_id_users_id_fk",
+ "tableFrom": "events",
+ "tableTo": "users",
+ "columnsFrom": [
+ "actor_user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.groups": {
+ "name": "groups",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "name": {
+ "name": "name",
+ "type": "varchar(50)",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "slug": {
+ "name": "slug",
+ "type": "varchar(50)",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "description": {
+ "name": "description",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "access_enabled": {
+ "name": "access_enabled",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": false
+ },
+ "anonymized_networks_allowed": {
+ "name": "anonymized_networks_allowed",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": false
+ },
+ "is_default": {
+ "name": "is_default",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "groups_slug_uidx": {
+ "name": "groups_slug_uidx",
+ "columns": [
+ {
+ "expression": "lower(\"slug\")",
+ "asc": true,
+ "isExpression": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "groups_one_default_uidx": {
+ "name": "groups_one_default_uidx",
+ "columns": [
+ {
+ "expression": "is_default",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "where": "\"groups\".\"is_default\" = true",
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.ip_intelligence": {
+ "name": "ip_intelligence",
+ "schema": "",
+ "columns": {
+ "ip_address": {
+ "name": "ip_address",
+ "type": "inet",
+ "primaryKey": true,
+ "notNull": true
+ },
+ "classification": {
+ "name": "classification",
+ "type": "ip_classification",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'unknown'"
+ },
+ "provider": {
+ "name": "provider",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "raw_response": {
+ "name": "raw_response",
+ "type": "jsonb",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "checked_at": {
+ "name": "checked_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "expires_at": {
+ "name": "expires_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {},
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.ip_observations": {
+ "name": "ip_observations",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "minecraft_account_id": {
+ "name": "minecraft_account_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "source": {
+ "name": "source",
+ "type": "ip_observation_source",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "ip_address": {
+ "name": "ip_address",
+ "type": "inet",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "minecraft_uuid": {
+ "name": "minecraft_uuid",
+ "type": "varchar(32)",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "username": {
+ "name": "username",
+ "type": "varchar(16)",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "classification": {
+ "name": "classification",
+ "type": "ip_classification",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "'unknown'"
+ },
+ "observed_at": {
+ "name": "observed_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "ip_observations_user_observed_idx": {
+ "name": "ip_observations_user_observed_idx",
+ "columns": [
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "observed_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "ip_observations_account_observed_idx": {
+ "name": "ip_observations_account_observed_idx",
+ "columns": [
+ {
+ "expression": "minecraft_account_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ },
+ {
+ "expression": "observed_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "ip_observations_user_id_users_id_fk": {
+ "name": "ip_observations_user_id_users_id_fk",
+ "tableFrom": "ip_observations",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ },
+ "ip_observations_minecraft_account_id_minecraft_accounts_id_fk": {
+ "name": "ip_observations_minecraft_account_id_minecraft_accounts_id_fk",
+ "tableFrom": "ip_observations",
+ "tableTo": "minecraft_accounts",
+ "columnsFrom": [
+ "minecraft_account_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "set null",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.login_codes": {
+ "name": "login_codes",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "token_hash": {
+ "name": "token_hash",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "discord_user_id": {
+ "name": "discord_user_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "discord_username": {
+ "name": "discord_username",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "discord_global_name": {
+ "name": "discord_global_name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "expires_at": {
+ "name": "expires_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "consumed_at": {
+ "name": "consumed_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "login_codes_token_hash_uidx": {
+ "name": "login_codes_token_hash_uidx",
+ "columns": [
+ {
+ "expression": "token_hash",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "login_codes_discord_user_idx": {
+ "name": "login_codes_discord_user_idx",
+ "columns": [
+ {
+ "expression": "discord_user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "login_codes_expires_idx": {
+ "name": "login_codes_expires_idx",
+ "columns": [
+ {
+ "expression": "expires_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.minecraft_accounts": {
+ "name": "minecraft_accounts",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "minecraft_uuid": {
+ "name": "minecraft_uuid",
+ "type": "varchar(32)",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "username": {
+ "name": "username",
+ "type": "varchar(16)",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "validation_status": {
+ "name": "validation_status",
+ "type": "minecraft_validation_status",
+ "typeSchema": "public",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "is_primary": {
+ "name": "is_primary",
+ "type": "boolean",
+ "primaryKey": false,
+ "notNull": true,
+ "default": false
+ },
+ "last_verified_at": {
+ "name": "last_verified_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "deleted_at": {
+ "name": "deleted_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "minecraft_accounts_user_idx": {
+ "name": "minecraft_accounts_user_idx",
+ "columns": [
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "minecraft_accounts_active_uuid_uidx": {
+ "name": "minecraft_accounts_active_uuid_uidx",
+ "columns": [
+ {
+ "expression": "minecraft_uuid",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "where": "\"minecraft_accounts\".\"deleted_at\" is null and \"minecraft_accounts\".\"minecraft_uuid\" is not null",
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "minecraft_accounts_active_username_uidx": {
+ "name": "minecraft_accounts_active_username_uidx",
+ "columns": [
+ {
+ "expression": "lower(\"username\")",
+ "asc": true,
+ "isExpression": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "where": "\"minecraft_accounts\".\"deleted_at\" is null",
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "minecraft_accounts_one_primary_per_user_uidx": {
+ "name": "minecraft_accounts_one_primary_per_user_uidx",
+ "columns": [
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "where": "\"minecraft_accounts\".\"is_primary\" = true and \"minecraft_accounts\".\"deleted_at\" is null",
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "minecraft_accounts_user_id_users_id_fk": {
+ "name": "minecraft_accounts_user_id_users_id_fk",
+ "tableFrom": "minecraft_accounts",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.plugin_credentials": {
+ "name": "plugin_credentials",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "server_id": {
+ "name": "server_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "secret_hash": {
+ "name": "secret_hash",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "revoked_at": {
+ "name": "revoked_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "plugin_credentials_server_id_uidx": {
+ "name": "plugin_credentials_server_id_uidx",
+ "columns": [
+ {
+ "expression": "server_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.plugin_requests": {
+ "name": "plugin_requests",
+ "schema": "",
+ "columns": {
+ "request_id": {
+ "name": "request_id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true
+ },
+ "server_id": {
+ "name": "server_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "received_at": {
+ "name": "received_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "expires_at": {
+ "name": "expires_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true
+ }
+ },
+ "indexes": {
+ "plugin_requests_expires_idx": {
+ "name": "plugin_requests_expires_idx",
+ "columns": [
+ {
+ "expression": "expires_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "plugin_requests_server_id_plugin_credentials_server_id_fk": {
+ "name": "plugin_requests_server_id_plugin_credentials_server_id_fk",
+ "tableFrom": "plugin_requests",
+ "tableTo": "plugin_credentials",
+ "columnsFrom": [
+ "server_id"
+ ],
+ "columnsTo": [
+ "server_id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.sessions": {
+ "name": "sessions",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "token_hash": {
+ "name": "token_hash",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "expires_at": {
+ "name": "expires_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "last_seen_at": {
+ "name": "last_seen_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "revoked_at": {
+ "name": "revoked_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "sessions_token_hash_uidx": {
+ "name": "sessions_token_hash_uidx",
+ "columns": [
+ {
+ "expression": "token_hash",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "sessions_user_idx": {
+ "name": "sessions_user_idx",
+ "columns": [
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "sessions_expires_idx": {
+ "name": "sessions_expires_idx",
+ "columns": [
+ {
+ "expression": "expires_at",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "sessions_user_id_users_id_fk": {
+ "name": "sessions_user_id_users_id_fk",
+ "tableFrom": "sessions",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.user_group_memberships": {
+ "name": "user_group_memberships",
+ "schema": "",
+ "columns": {
+ "user_id": {
+ "name": "user_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "group_id": {
+ "name": "group_id",
+ "type": "uuid",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "user_group_memberships_user_uidx": {
+ "name": "user_group_memberships_user_uidx",
+ "columns": [
+ {
+ "expression": "user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ },
+ "user_group_memberships_group_idx": {
+ "name": "user_group_memberships_group_idx",
+ "columns": [
+ {
+ "expression": "group_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": false,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {
+ "user_group_memberships_user_id_users_id_fk": {
+ "name": "user_group_memberships_user_id_users_id_fk",
+ "tableFrom": "user_group_memberships",
+ "tableTo": "users",
+ "columnsFrom": [
+ "user_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ },
+ "user_group_memberships_group_id_groups_id_fk": {
+ "name": "user_group_memberships_group_id_groups_id_fk",
+ "tableFrom": "user_group_memberships",
+ "tableTo": "groups",
+ "columnsFrom": [
+ "group_id"
+ ],
+ "columnsTo": [
+ "id"
+ ],
+ "onDelete": "cascade",
+ "onUpdate": "no action"
+ }
+ },
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ },
+ "public.users": {
+ "name": "users",
+ "schema": "",
+ "columns": {
+ "id": {
+ "name": "id",
+ "type": "uuid",
+ "primaryKey": true,
+ "notNull": true,
+ "default": "gen_random_uuid()"
+ },
+ "discord_user_id": {
+ "name": "discord_user_id",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "discord_username": {
+ "name": "discord_username",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": true
+ },
+ "discord_global_name": {
+ "name": "discord_global_name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "first_name": {
+ "name": "first_name",
+ "type": "text",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "onboarding_completed_at": {
+ "name": "onboarding_completed_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": false
+ },
+ "created_at": {
+ "name": "created_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ },
+ "updated_at": {
+ "name": "updated_at",
+ "type": "timestamp (3) with time zone",
+ "primaryKey": false,
+ "notNull": true,
+ "default": "now()"
+ }
+ },
+ "indexes": {
+ "users_discord_user_id_uidx": {
+ "name": "users_discord_user_id_uidx",
+ "columns": [
+ {
+ "expression": "discord_user_id",
+ "isExpression": false,
+ "asc": true,
+ "nulls": "last"
+ }
+ ],
+ "isUnique": true,
+ "concurrently": false,
+ "method": "btree",
+ "with": {}
+ }
+ },
+ "foreignKeys": {},
+ "compositePrimaryKeys": {},
+ "uniqueConstraints": {},
+ "policies": {},
+ "checkConstraints": {},
+ "isRLSEnabled": false
+ }
+ },
+ "enums": {
+ "public.ip_classification": {
+ "name": "ip_classification",
+ "schema": "public",
+ "values": [
+ "unknown",
+ "clear",
+ "vpn",
+ "proxy",
+ "hosting",
+ "tor"
+ ]
+ },
+ "public.ip_observation_source": {
+ "name": "ip_observation_source",
+ "schema": "public",
+ "values": [
+ "web",
+ "game"
+ ]
+ },
+ "public.minecraft_validation_status": {
+ "name": "minecraft_validation_status",
+ "schema": "public",
+ "values": [
+ "verified",
+ "user_confirmed"
+ ]
+ }
+ },
+ "schemas": {},
+ "sequences": {},
+ "roles": {},
+ "policies": {},
+ "views": {},
+ "_meta": {
+ "columns": {},
+ "schemas": {},
+ "tables": {}
+ }
+}
\ No newline at end of file
diff --git a/packages/database/drizzle/meta/_journal.json b/packages/database/drizzle/meta/_journal.json
index 4c67a5b..9c3608b 100644
--- a/packages/database/drizzle/meta/_journal.json
+++ b/packages/database/drizzle/meta/_journal.json
@@ -29,6 +29,13 @@
"when": 1785625186545,
"tag": "0003_smiling_silver_samurai",
"breakpoints": true
+ },
+ {
+ "idx": 4,
+ "version": "7",
+ "when": 1785678753029,
+ "tag": "0004_zippy_silver_centurion",
+ "breakpoints": true
}
]
}
\ No newline at end of file
diff --git a/packages/database/src/schema.ts b/packages/database/src/schema.ts
index 8d24389..3e8445d 100644
--- a/packages/database/src/schema.ts
+++ b/packages/database/src/schema.ts
@@ -70,6 +70,7 @@ export const groups = pgTable(
slug: varchar("slug", { length: 50 }).notNull(),
description: text("description"),
accessEnabled: boolean("access_enabled").notNull().default(false),
+ anonymizedNetworksAllowed: boolean("anonymized_networks_allowed").notNull().default(false),
isDefault: boolean("is_default").notNull().default(false),
...timestamps(),
},
@@ -171,6 +172,12 @@ export const appSettings = pgTable("app_settings", {
registrationMessage: text("registration_message")
.notNull()
.default("Please register your Minecraft account before joining."),
+ groupAccessDeniedMessage: text("group_access_denied_message")
+ .notNull()
+ .default("Your account group does not currently have server access. Contact a host if you believe this is a mistake."),
+ vpnDeniedMessage: text("vpn_denied_message")
+ .notNull()
+ .default("VPN, proxy, and Tor connections are not allowed. Contact a host to request an exception."),
...timestamps(),
});
diff --git a/packages/network/src/index.ts b/packages/network/src/index.ts
index 5af693b..b42f0b9 100644
--- a/packages/network/src/index.ts
+++ b/packages/network/src/index.ts
@@ -51,7 +51,9 @@ function numberValue(value: unknown) {
}
function proxyClassification(proxy: unknown, type: unknown): IpClassification {
- if (String(proxy).toLowerCase() !== "yes") return "clear";
+ const normalizedProxy = String(proxy).toLowerCase();
+ if (normalizedProxy === "no") return "clear";
+ if (normalizedProxy !== "yes") return "unknown";
const normalizedType = String(type ?? "").toLowerCase();
if (normalizedType.includes("tor")) return "tor";
if (normalizedType.includes("vpn")) return "vpn";
diff --git a/packages/network/test/proxycheck.test.ts b/packages/network/test/proxycheck.test.ts
index 715db85..5e9345a 100644
--- a/packages/network/test/proxycheck.test.ts
+++ b/packages/network/test/proxycheck.test.ts
@@ -50,6 +50,14 @@ describe("ProxyCheck.io intelligence", () => {
);
});
+ it("treats missing or malformed proxy signals as unknown", async () => {
+ for (const proxy of [undefined, null, "maybe"] as const) {
+ const request = vi.fn().mockResolvedValue(response({ proxy, type: "Residential" }));
+ await expect(new ProxyCheckProvider({ apiKey: "secret", request }).classify(ipAddress))
+ .resolves.toMatchObject({ classification: "unknown", network: { proxy: null } });
+ }
+ });
+
it("maps VPN and Tor responses to explicit classifications", async () => {
const vpnRequest = vi.fn().mockResolvedValue(response({ proxy: "yes", type: "VPN" }));
const torRequest = vi.fn().mockResolvedValue(response({ proxy: "yes", type: "TOR" }));
diff --git a/plugins/velocity/README.md b/plugins/velocity/README.md
index 7b8cdf1..899917d 100644
--- a/plugins/velocity/README.md
+++ b/plugins/velocity/README.md
@@ -1,6 +1,6 @@
# Velocity admission plugin
-The plugin checks every online-mode Java login against the account-manager API. It fails closed: unavailable, unauthorized, stale, replayed, malformed, and unknown requests are denied. After a player completes proxy login, the plugin sends best-effort `PostLoginEvent` telemetry used for confirmed-connection activity metrics; reporting failure is logged without disconnecting the player.
+The plugin checks every online-mode Java login against the account-manager API. It fails closed: unavailable, unauthorized, stale, replayed, malformed, unknown-account, group-disabled, and group-policy VPN/proxy/Tor requests are denied. After a player completes proxy login, the plugin sends best-effort `PostLoginEvent` telemetry used for confirmed-connection activity metrics; reporting failure is logged without disconnecting the player.
## Download or build
@@ -31,4 +31,4 @@ npm run plugin:create-credential --workspace @minecraft-account-manager/database
Copy the displayed token into the plugin's `api-token`. Configure the HTTPS account-manager URL and ensure `server-id` matches. Restrict access to the plugin configuration because it contains the bearer token, then restart Velocity.
-The proxy must run in online mode. Unknown players and API failures receive the configured registration message.
+The proxy must run in online mode. Unknown players, disabled groups, and disallowed VPN/proxy/Tor connections receive their operator-configured API message. API failures receive the plugin's local registration fallback.
| User | Discord | Primary | Accounts | Status | |
|---|---|---|---|---|---|
| User | Discord | Primary | Accounts | Group | Status | {user.discordGlobalName ?? user.discordUsername} @{user.discordUsername} {user.discordUserId} |
{user.primaryUsername ?? "—"} | {user.accountCount} | +{defaultGroup ? |
{user.onboardingCompletedAt ? "Ready" : "Onboarding"} | ))} - {!results.length &&
| No users match that search. | |||||
| No users match that search. |