dmg/minecraft-account-manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 28 Wiki Activity

feat(rcon): allow administrator-defined endpoints
CI / validate (push) Successful in 6m16s
Details
Release / release (push) Successful in 8m27s
Details

Browse Source
This commit is contained in:
dmg
2026-08-08 07:45:24 -04:00
parent f9ccfd821d
commit 7f6d69e0a7
9 changed files with 35 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
design/us-021-rcon-connections.md
+4 -4
View File
@@ -3,7 +3,7 @@ type: User Story
title: Manage RCON server connections
description: Administrators manage encrypted connection settings for internal Minecraft RCON endpoints.
tags: [admin, rcon, minecraft, security, operations]
timestamp: 2026-08-08T01:36:00Z
timestamp: 2026-08-08T11:44:59Z
story_id: US-021
status: verified
---
@@ -18,7 +18,7 @@ As an administrator, I want to manage one or more Minecraft RCON connections, so
- [x] Each connection has a unique display name, internal hostname, port, enabled state, and write-only password.
- [x] RCON passwords are encrypted with an authenticated cipher using a deployment-managed master key and are never returned to the browser, audit events, or application logs.
- [x] Updating a connection preserves its password unless an administrator explicitly supplies a replacement.
- [x] Connection host and port pairs must match a deployment-managed exact internal endpoint allowlist, and IP literals are rejected.
- [x] Administrators can save any syntactically valid DNS hostname and port without deployment-managed endpoint configuration; IP literals remain rejected.
- [x] Testing a connection authenticates through the server-side RCON proxy and reports a safe success or failure result.
- [x] Deleting a connection requires explicit confirmation.
- [x] Connection mutations independently recheck administrator authorization and create credential-safe audit events.
@@ -26,11 +26,11 @@ As an administrator, I want to manage one or more Minecraft RCON connections, so
# Implementation
The administrator RCON page and server actions manage allowlisted endpoints, preserve write-only passwords, encrypt credentials with connection-bound AES-256-GCM, and emit credential-safe audit events. The `rcon_servers` table is delivered through generated migration `0006_curious_lester.sql`.
The administrator RCON page and server actions manage endpoints without deployment-managed endpoint configuration, preserve write-only passwords, encrypt credentials with connection-bound AES-256-GCM, and emit credential-safe audit events. The `rcon_servers` table is delivered through generated migration `0006_curious_lester.sql`.
# Validation
Verified with RCON validation, encryption, gateway, component, and server-action tests; full workspace tests and type checks; web lint; OKF validation; and a production Next.js build on 2026-08-08. Action tests confirm independent authorization, password preservation, enabled-state rechecks, safe failures, and command audit redaction.
Verified with RCON validation, encryption, gateway, component, and server-action tests; full workspace tests and type checks; web lint; OKF validation; Semgrep; dependency audit; and a production Next.js build on 2026-08-08. Validation confirms arbitrary valid DNS hostname and port pairs no longer require deployment configuration while IP literals and malformed hostnames remain rejected. Action tests confirm independent authorization, password preservation, enabled-state rechecks, safe failures, and command audit redaction.
# Related Stories