feat(admission): add scheduled group access

apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx

@@ -1,4 +1,4 @@
-import { groups, minecraftAccounts, userGroupMemberships, users } from "@minecraft-account-manager/database";
+import { groupAccessWindows, groups, minecraftAccounts, userGroupMemberships, users } from "@minecraft-account-manager/database";
 import { and, asc, desc, eq, isNull, sql } from "drizzle-orm";
 import type { ReactNode } from "react";
 import Link from "next/link";
@@ -6,16 +6,18 @@ import { notFound } from "next/navigation";
 import { AdminModalForm } from "@/components/admin-modal-form";
 import { AdminUserTable } from "@/components/admin-user-table";
 import { GroupPolicyControl } from "@/components/group-policy-control";
+import { GroupScheduleEditor, GroupScheduleSummary } from "@/components/group-schedule-editor";
 import { db } from "@/lib/database";
 import { isEffectiveGroupMember } from "@/lib/group-management";
 import { assignUserGroupFromRegistry } from "../../users/actions";
-import { deleteGroup, setGroupAccess, setGroupAnonymizedNetworkAccess, updateGroupDetails } from "../actions";
+import { deleteGroup, replaceGroupSchedule, setGroupAccess, setGroupAnonymizedNetworkAccess, updateGroupDetails } from "../actions";
 
 const savedMessages: Record<string, string> = {
   created: "Group created.",
   details: "Group details updated.",
   access: "Minecraft access policy updated.",
   "network-access": "VPN, proxy, and Tor policy updated.",
+  schedule: "Weekly access schedule updated.",
   group: "Member group updated.",
 };
 
@@ -23,6 +25,7 @@ const errorMessages: Record<string, string> = {
   "invalid-group": "Enter a valid name and a description of no more than 500 characters.",
   "duplicate-group": "A group with that name already exists.",
   "invalid-group-assignment": "The user or destination group no longer exists. No membership change was applied.",
+  "invalid-schedule": "Use valid, non-overlapping weekly access windows. Start and end cannot be identical.",
 };
 
 export const dynamic = "force-dynamic";
@@ -39,7 +42,7 @@ export default async function GroupPage({
   const [group] = await db.select().from(groups).where(eq(groups.id, groupId)).limit(1);
   if (!group) notFound();
 
-  const [allUsers, allGroups, memberships] = await Promise.all([
+  const [allUsers, allGroups, memberships, accessWindows] = await Promise.all([
     db.select({
       id: users.id,
       firstName: users.firstName,
@@ -65,6 +68,11 @@ export default async function GroupPage({
       .from(groups).orderBy(desc(groups.isDefault), asc(groups.name)),
     db.select({ userId: userGroupMemberships.userId, groupId: userGroupMemberships.groupId })
       .from(userGroupMemberships),
+    db.select({
+      startMinuteOfWeek: groupAccessWindows.startMinuteOfWeek,
+      endMinuteOfWeek: groupAccessWindows.endMinuteOfWeek,
+    }).from(groupAccessWindows).where(eq(groupAccessWindows.groupId, group.id))
+      .orderBy(groupAccessWindows.startMinuteOfWeek),
   ]);
   const assignmentByUser = Object.fromEntries(memberships.map((membership) => [membership.userId, membership.groupId]));
   const memberUsers = allUsers.filter((user) => isEffectiveGroupMember(user.id, assignmentByUser, group));
@@ -101,8 +109,17 @@ export default async function GroupPage({
       <section aria-labelledby="group-policy-heading" className="mt-10 border border-line bg-panel p-6 shadow-[6px_6px_0_var(--color-shadow)]">
         <div className="border-b border-line pb-4"><p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Admission controls</p><h2 className="mt-2 font-display text-3xl font-black uppercase" id="group-policy-heading">Group policies</h2></div>
         <div className="mt-6 grid gap-6 sm:grid-cols-2">
-          <PolicyDetail description="Controls whether members can connect to Minecraft." label="Minecraft access"><GroupPolicyControl action={setGroupAccess} enabled={group.accessEnabled} groupId={group.id} groupName={group.name} memberCount={memberUsers.length} policy="Minecraft access" returnLocation="detail" /></PolicyDetail>
-          <PolicyDetail description="Allows confirmed VPN, proxy, and Tor connections." label="VPN / proxy / Tor"><GroupPolicyControl action={setGroupAnonymizedNetworkAccess} enabled={group.anonymizedNetworksAllowed} groupId={group.id} groupName={group.name} memberCount={memberUsers.length} policy="VPN / proxy / Tor" returnLocation="detail" /></PolicyDetail>
+          <PolicyDetail description="Controls whether members can connect to Minecraft. Disabled access always overrides the schedule." label="Minecraft access"><GroupPolicyControl action={setGroupAccess} enabled={group.accessEnabled} groupId={group.id} groupName={group.name} memberCount={memberUsers.length} policy="Minecraft access" returnLocation="detail" /></PolicyDetail>
+          <PolicyDetail description="Allows confirmed VPN, proxy, and Tor connections after access and schedule checks pass." label="VPN / proxy / Tor"><GroupPolicyControl action={setGroupAnonymizedNetworkAccess} enabled={group.anonymizedNetworksAllowed} groupId={group.id} groupName={group.name} memberCount={memberUsers.length} policy="VPN / proxy / Tor" returnLocation="detail" /></PolicyDetail>
+        </div>
+        <div className="mt-7 border-t border-line pt-6">
+          <div className="flex flex-col gap-5 sm:flex-row sm:items-start sm:justify-between">
+            <div className="max-w-2xl"><h3 className="font-mono text-xs font-bold uppercase">Weekly access schedule</h3><p className="mt-2 text-xs leading-5 text-muted">When Minecraft access is enabled, members may log in only during these recurring UTC windows. Existing sessions are not disconnected when a window ends.</p><div className="mt-4"><GroupScheduleSummary windows={accessWindows} /></div></div>
+            <AdminModalForm action={replaceGroupSchedule} description={`Replace the complete weekly access schedule for ${group.name}. Minecraft access must still be enabled.`} submitLabel="Save schedule" title={`Schedule ${group.name}`} triggerClassName="shrink-0 border border-ink px-4 py-3 font-mono text-[10px] font-bold uppercase tracking-wider" triggerLabel="Edit schedule">
+              <input name="groupId" type="hidden" value={group.id} />
+              <GroupScheduleEditor windows={accessWindows} />
+            </AdminModalForm>
+          </div>
         </div>
       </section>