dmg/minecraft-account-manager
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 29 Wiki Activity

feat(rcon): add admin server console
CI / validate (push) Successful in 6m5s
Details
Release / release (push) Successful in 9m56s
Details

Browse Source
This commit is contained in:
dmg
2026-08-07 21:44:00 -04:00
parent e43db34402
commit f9ccfd821d
26 changed files with 2800 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture.md
+6
View File
@@ -8,6 +8,10 @@ The Next.js application owns user onboarding, account management, admin configur
User authentication begins with an opaque, short-lived, single-use token created for a Discord user. Only a cryptographic hash of the token is persisted. Admin authentication is a separate Keycloak OIDC flow and requires the `minecraft-account-manager-admin` role.
### RCON administration
The administrator console stores one or more internal Minecraft RCON endpoints with write-only AES-GCM-encrypted passwords. Browser requests invoke authenticated server actions; only the Next.js runtime opens RCON TCP connections. Exact deployment-managed endpoint allowlisting prevents the connection registry from becoming an arbitrary internal network proxy. Commands and responses are bounded and ephemeral, while credential-safe audit events retain the operator, server, command verb, keyed digest, outcome, and duration. RCON is exposed only through internal cluster services and never through public ingress.
### Discord bot
The bot creates private login links in response to `/register` and `/account`. Discord user IDs are the canonical Discord identity; mutable usernames are snapshots only. Nickname updates target the deployment guild configured by `DISCORD_GUILD_ID`; the public join button uses `DISCORD_INVITE_URL`.
@@ -26,6 +30,8 @@ The admission decision is fail closed. Unknown players, disabled effective group
- Velocity requests use hashed per-server bearer credentials, timestamps, and database-unique request IDs for authentication and replay prevention.
- Session and one-time-code values are random and stored only as hashes.
- Exact IP addresses are sensitive data and require an explicit retention policy before production deployment.
- RCON hostnames and ports must match the deployment allowlist on save and use; passwords never cross the browser trust boundary.
- RCON commands and responses are untrusted, bounded, rendered only as text, and excluded from persistent history and logs.
## Database invariants