feat(admission): add group VPN exceptions
This commit is contained in:
@@ -2,6 +2,8 @@
|
||||
|
||||
## 2026-08-02
|
||||
|
||||
* **Add**: Provide Users-page group assignment, effective-group VPN/proxy/Tor exceptions for game admission, and independent configurable denial messages.
|
||||
* **Fix**: Treat malformed ProxyCheck proxy signals as unknown and classify every authenticated Velocity login before identity resolution.
|
||||
* **Fix**: Replace the dashboard's pre-enrichment network label with enriched company, ASN, connection type, Proxy/VPN status, and risk fields.
|
||||
* **Fix**: Group collocated map users into count-badged markers with complete nickname tooltips and per-user interactive-map links.
|
||||
* **Refine**: Replace registration counts with daily active users, collapse enriched VPN activity per user, add opt-in OpenStreetMap zoom, show managed nickname tooltips, and measure active Minecraft accounts from confirmed Velocity connections.
|
||||
|
||||
@@ -3,7 +3,7 @@ type: User Story
|
||||
title: Enrich portal and game login IPs
|
||||
description: Login audit events include cached approximate location and network intelligence from ProxyCheck.io.
|
||||
tags: [security, network, audit, proxycheck]
|
||||
timestamp: 2026-08-01T22:04:17Z
|
||||
timestamp: 2026-08-02T14:12:43Z
|
||||
story_id: US-007
|
||||
status: verified
|
||||
---
|
||||
@@ -19,7 +19,7 @@ As an operator, I want portal and registered game logins enriched with network c
|
||||
- [x] Provider failures are cached briefly and do not deny portal or registered game login.
|
||||
- [x] Private, loopback, reserved, documentation, and mapped-private addresses are never sent to ProxyCheck.
|
||||
- [x] Forwarded web IP headers are ignored unless trusted-proxy handling is explicitly enabled.
|
||||
- [x] Unknown game accounts do not trigger paid ProxyCheck lookups.
|
||||
- [x] Every authenticated Velocity login request uses the cached ProxyCheck path before identity resolution, preventing account-creation races from bypassing network policy.
|
||||
- [x] Login events and IP observations retain the available classification and approximate location.
|
||||
- [x] Users and administrators can see available location and classification in audit views.
|
||||
- [x] Repeated access observations are summarized by IPv4 /24 or IPv6 /64 network with counts, sources, and latest activity.
|
||||
|
||||
@@ -3,7 +3,7 @@ type: User Story
|
||||
title: Block account additions from anonymized networks
|
||||
description: User Minecraft-account additions fail closed for VPN, proxy, Tor, or unknown IP classifications.
|
||||
tags: [security, vpn, proxy, minecraft]
|
||||
timestamp: 2026-08-02T00:12:32Z
|
||||
timestamp: 2026-08-02T14:12:43Z
|
||||
story_id: US-008
|
||||
status: verified
|
||||
---
|
||||
@@ -22,6 +22,8 @@ As an operator, I want account additions blocked from anonymized networks, so th
|
||||
- [x] Blocked and classification-unavailable attempts create distinct audit events with safe intelligence details.
|
||||
- [x] Administrative account additions remain available as an authorized recovery path.
|
||||
- [x] Administrators see enriched risky-network observations collapsed to one latest summary per user.
|
||||
- [x] Game admission enforces confirmed VPN, proxy, and Tor classifications according to the user's effective-group exception policy.
|
||||
- [x] Account-addition blocking remains unchanged and independent from the game-admission exception.
|
||||
|
||||
# Implementation
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@ type: User Story
|
||||
title: Enforce registration at the Velocity proxy
|
||||
description: Online-mode Java connections are admitted only after a fail-closed account-manager decision.
|
||||
tags: [minecraft, velocity, whitelist, security]
|
||||
timestamp: 2026-08-02T00:12:32Z
|
||||
timestamp: 2026-08-02T14:12:43Z
|
||||
story_id: US-009
|
||||
status: verified
|
||||
---
|
||||
@@ -27,6 +27,9 @@ As a registered player, I want the Velocity proxy to recognize my approved Java
|
||||
- [x] The plugin records the real Velocity connection IP and supports Java Edition online mode only.
|
||||
- [x] After admission, Velocity reports `PostLoginEvent` as best-effort authenticated telemetry without disconnecting an admitted player when reporting fails.
|
||||
- [x] Confirmed-connection reports use fresh timestamps and database replay protection.
|
||||
- [x] Group-disabled and VPN/proxy/Tor-policy denials return distinct operator-configured messages.
|
||||
- [x] The default anonymized-network message directs the player to contact a host for an exception.
|
||||
- [x] API failures, malformed responses, and unauthorized requests retain fail-closed plugin fallback behavior.
|
||||
|
||||
# Implementation
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@ type: User Story
|
||||
title: Operate settings and audit views
|
||||
description: Authorized administrators control server messaging and investigate recent platform events.
|
||||
tags: [admin, settings, audit, operations]
|
||||
timestamp: 2026-08-01T22:34:31Z
|
||||
timestamp: 2026-08-02T14:12:43Z
|
||||
story_id: US-012
|
||||
status: verified
|
||||
---
|
||||
@@ -21,11 +21,16 @@ As an administrator, I want operational settings and audit visibility, so that I
|
||||
- [x] Event views show type, subject, IP, classification, and approximate location when available.
|
||||
- [x] Admin console access itself creates an audit event with the SSO identity.
|
||||
- [x] Settings, users, and events are linked from the shared admin navigation.
|
||||
- [x] Administrators can independently configure registration-required, group-access-disabled, and VPN/proxy/Tor-denied game messages.
|
||||
- [x] Every message is validated server-side and has a safe default.
|
||||
- [x] Admission-message changes are audited with the administrator identity without logging credentials.
|
||||
|
||||
# Implementation
|
||||
|
||||
- [`apps/web/src/app/admin/(console)/page.tsx`](../apps/web/src/app/admin/%28console%29/page.tsx)
|
||||
- [`apps/web/src/app/admin/(console)/actions.ts`](../apps/web/src/app/admin/%28console%29/actions.ts)
|
||||
- [`apps/web/src/lib/admission-settings.ts`](../apps/web/src/lib/admission-settings.ts)
|
||||
- [`packages/database/drizzle/0004_zippy_silver_centurion.sql`](../packages/database/drizzle/0004_zippy_silver_centurion.sql)
|
||||
- [`apps/web/src/app/admin/(console)/events/page.tsx`](../apps/web/src/app/admin/%28console%29/events/page.tsx)
|
||||
|
||||
# Validation
|
||||
|
||||
@@ -3,7 +3,7 @@ type: User Story
|
||||
title: Manage users as an administrator
|
||||
description: Authorized operators search users and maintain their names, linked accounts, primaries, and Discord nicknames.
|
||||
tags: [admin, users, minecraft, discord]
|
||||
timestamp: 2026-08-01T22:34:31Z
|
||||
timestamp: 2026-08-02T14:12:43Z
|
||||
story_id: US-013
|
||||
status: verified
|
||||
---
|
||||
@@ -24,12 +24,17 @@ As an administrator, I want to manage a user's identity and Minecraft accounts,
|
||||
- [x] Administrators can set a new primary account and automatically update Discord.
|
||||
- [x] Every action rechecks role and account ownership and records the acting administrator.
|
||||
- [x] Discord failures do not falsely persist the requested name, primary, or removal change.
|
||||
- [x] Each row in the administrator user registry shows the user's effective group in an accessible dropdown.
|
||||
- [x] Selecting a group immediately applies the assignment; selecting `everyone` removes the explicit assignment.
|
||||
- [x] Group changes preserve the active user search and show accessible success or error feedback.
|
||||
- [x] Registry assignment changes revalidate administrator authorization, user existence, and group existence, and audit the previous and new effective groups.
|
||||
|
||||
# Implementation
|
||||
|
||||
- [`apps/web/src/app/admin/(console)/users/page.tsx`](../apps/web/src/app/admin/%28console%29/users/page.tsx)
|
||||
- [`apps/web/src/app/admin/(console)/users/[userId]/page.tsx`](../apps/web/src/app/admin/%28console%29/users/%5BuserId%5D/page.tsx)
|
||||
- [`apps/web/src/app/admin/(console)/users/actions.ts`](../apps/web/src/app/admin/%28console%29/users/actions.ts)
|
||||
- [`apps/web/src/components/user-group-select.tsx`](../apps/web/src/components/user-group-select.tsx)
|
||||
|
||||
# Validation
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@ type: User Story
|
||||
title: Control Minecraft admission with groups
|
||||
description: Administrators assign users to groups and enable Minecraft access through explicit group policy.
|
||||
tags: [admin, groups, authorization, velocity, security]
|
||||
timestamp: 2026-08-01T23:10:59Z
|
||||
timestamp: 2026-08-02T14:12:43Z
|
||||
story_id: US-017
|
||||
status: verified
|
||||
---
|
||||
@@ -24,12 +24,18 @@ As an administrator, I want to organize registered users into access groups, so
|
||||
- [x] The protected default group cannot be deleted.
|
||||
- [x] Group creation, membership, and access-policy changes are audited.
|
||||
- [x] Users and administrators can inspect the user's single effective group assignment.
|
||||
- [x] Every group has an independently configurable VPN/proxy/Tor exception policy.
|
||||
- [x] The protected `everyone` group and newly created groups disallow VPN, proxy, and Tor connections by default.
|
||||
- [x] Confirmed VPN, proxy, or Tor game connections are denied unless the user's single effective group allows anonymized networks.
|
||||
- [x] Clear and hosting classifications are not denied by this group policy, and unavailable intelligence does not independently deny a registered player.
|
||||
- [x] VPN policy changes are authorized server-side and audited.
|
||||
|
||||
# Implementation
|
||||
|
||||
- [`packages/database/src/schema.ts`](../packages/database/src/schema.ts)
|
||||
- [`packages/database/drizzle/0002_simple_queen_noir.sql`](../packages/database/drizzle/0002_simple_queen_noir.sql)
|
||||
- [`packages/database/drizzle/0003_smiling_silver_samurai.sql`](../packages/database/drizzle/0003_smiling_silver_samurai.sql)
|
||||
- [`packages/database/drizzle/0004_zippy_silver_centurion.sql`](../packages/database/drizzle/0004_zippy_silver_centurion.sql)
|
||||
- [`apps/web/src/app/admin/(console)/groups/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/page.tsx)
|
||||
- [`apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/%5BgroupId%5D/page.tsx)
|
||||
- [`apps/web/src/app/api/velocity/access/route.ts`](../apps/web/src/app/api/velocity/access/route.ts)
|
||||
|
||||
Reference in New Issue
Block a user