feat(admission): add scheduled group access

packages/auth/src/index.ts

@@ -125,8 +125,10 @@ export function isGameNetworkAllowed(
 export function gameAdmissionDenialReason(
   group: { accessEnabled: boolean; anonymizedNetworksAllowed: boolean } | null,
   classification: "unknown" | "clear" | "vpn" | "proxy" | "hosting" | "tor",
+  scheduleAllowed = true,
 ) {
   if (!group?.accessEnabled) return "group_access_disabled" as const;
+  if (!scheduleAllowed) return "schedule_disallowed" as const;
   if (!isGameNetworkAllowed(classification, group.anonymizedNetworksAllowed)) {
     return "anonymized_network_disallowed" as const;
   }

packages/auth/test/group-access.test.ts

@@ -31,12 +31,14 @@ describe("group-based admission", () => {
     }
   });
 
-  it("prioritizes disabled group access before the network exception policy", () => {
-    expect(gameAdmissionDenialReason({ accessEnabled: false, anonymizedNetworksAllowed: false }, "vpn"))
+  it("prioritizes disabled group access, then schedule, then network policy", () => {
+    expect(gameAdmissionDenialReason({ accessEnabled: false, anonymizedNetworksAllowed: false }, "vpn", false))
       .toBe("group_access_disabled");
-    expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: false }, "vpn"))
+    expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: false }, "vpn", false))
+      .toBe("schedule_disallowed");
+    expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: false }, "vpn", true))
       .toBe("anonymized_network_disallowed");
-    expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: true }, "vpn"))
+    expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: true }, "vpn", true))
       .toBeNull();
   });
 });