feat(admission): add group VPN exceptions

packages/auth/test/group-access.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { resolveEffectiveGroup } from "../src/index";
+import { gameAdmissionDenialReason, isGameNetworkAllowed, resolveEffectiveGroup } from "../src/index";
 
 describe("group-based admission", () => {
   const everyone = { name: "everyone", accessEnabled: false };
@@ -17,4 +17,26 @@ describe("group-based admission", () => {
     const limited = { name: "limited", accessEnabled: false };
     expect(resolveEffectiveGroup(limited, enabledDefault)?.accessEnabled).toBe(false);
   });
+
+  it("denies confirmed anonymized game networks unless the effective group allows them", () => {
+    for (const classification of ["vpn", "proxy", "tor"] as const) {
+      expect(isGameNetworkAllowed(classification, false)).toBe(false);
+      expect(isGameNetworkAllowed(classification, true)).toBe(true);
+    }
+  });
+
+  it("does not apply the group exception policy to clear, hosting, or unavailable intelligence", () => {
+    for (const classification of ["clear", "hosting", "unknown"] as const) {
+      expect(isGameNetworkAllowed(classification, false)).toBe(true);
+    }
+  });
+
+  it("prioritizes disabled group access before the network exception policy", () => {
+    expect(gameAdmissionDenialReason({ accessEnabled: false, anonymizedNetworksAllowed: false }, "vpn"))
+      .toBe("group_access_disabled");
+    expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: false }, "vpn"))
+      .toBe("anonymized_network_disallowed");
+    expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: true }, "vpn"))
+      .toBeNull();
+  });
 });