feat(admission): add scheduled group access

2026-08-02 14:04:48 -04:00
parent eb1c5b6de4
commit c131465ff5
32 changed files with 2446 additions and 59 deletions
@@ -23,11 +23,14 @@ As a registered player, I want the Velocity proxy to recognize my approved Java
 - [x] Successful fallback backfills UUID and canonical username.
 - [x] Changed usernames are persisted and audited.
 - [x] Registered players are allowed only when their single effective group has access enabled; explicit assignments override the default group.
+- [x] Disabled group access overrides every schedule; enabled groups with weekly windows admit logins only during an active UTC window.
+- [x] Schedule policy is checked before VPN/proxy/Tor policy and is enforced only at login.
 - [x] Unknown players, group-disabled players, API failures, malformed responses, and unauthorized requests fail closed with registration guidance.
 - [x] The plugin records the real Velocity connection IP and supports Java Edition online mode only.
 - [x] After admission, Velocity reports `PostLoginEvent` as best-effort authenticated telemetry without disconnecting an admitted player when reporting fails.
 - [x] Confirmed-connection reports use fresh timestamps and database replay protection.
 - [x] Group-disabled and VPN/proxy/Tor-policy denials return distinct operator-configured messages.
+- [x] Schedule denials return the configured static template with the effective group, player, and next UTC window.
 - [x] The default anonymized-network message directs the player to contact a host for an exception.
 - [x] API failures, malformed responses, and unauthorized requests retain fail-closed plugin fallback behavior.