dmg/minecraft-account-manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 28 Wiki Activity

feat(admission): add scheduled group access
CI / validate (push) Successful in 6m15s
Details
Release / release (push) Successful in 7m49s
Details

Browse Source
This commit is contained in:
dmg
2026-08-02 14:04:48 -04:00
parent eb1c5b6de4
commit c131465ff5
32 changed files with 2446 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security-review.md
+4 -2
View File
@@ -24,9 +24,11 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
- Velocity credentials are high-entropy bearer tokens stored only as hashes.
- Velocity admission and confirmed-connection requests have a 45-second clock window and database-unique request IDs for cross-instance replay prevention.
- Velocity and its API fail closed.
- Registered players require an enabled effective group; explicit assignments replace rather than combine with the protected, disabled-by-default `everyone` fallback.
- Registered players require an enabled effective group; explicit assignments replace rather than combine with the protected, disabled-by-default `everyone` fallback. Disabled access always overrides scheduling.
- Enabled groups with recurring UTC windows admit only during an active login window. Window boundaries and overlap are validated server-side, malformed persisted policy fails closed, and connected sessions are not re-evaluated.
- Confirmed VPN, proxy, and Tor game connections are denied unless that same effective group has an explicit exception; `everyone` and new groups default to no exception.
- Group, VPN-policy, identity, and membership mutations re-check the Keycloak administrator role server-side; registry assignments, policy changes, group edits, creation, deletion, and message settings commit atomically with their audit events.
- Static admission templates use a fixed allowlist of non-executable variables. Unknown placeholders and control characters are rejected, and rendered values remain plain JSON/text.
- Group, schedule, VPN-policy, identity, and membership mutations re-check the Keycloak administrator role server-side; registry assignments, policy changes, group edits, creation, deletion, and message settings commit atomically with their audit events.
- Group identity creation/rename and membership assignment/deletion use compatible PostgreSQL advisory and row locks to prevent duplicate names, stale audit records, or membership/deletion races. The protected default name and deletion restriction are enforced server-side.
- Every bearer-authenticated Velocity login uses cached IP intelligence before identity resolution, preventing account-creation races from bypassing network policy; malformed provider proxy signals classify as unknown.
- Event filters accept only event types already present in the ledger, and event detail routes remain role-protected.