feat(groups): add fail-closed admission management

.env.example

@@ -24,3 +24,6 @@ IP_INTELLIGENCE_PROVIDER=proxycheck
 PROXYCHECK_API_KEY=
 IP_INTELLIGENCE_CACHE_HOURS=48
 BLOCK_HOSTING_IPS=false
+
+# Structured Pino logging
+LOG_LEVEL=info

.gitea/workflows/release.yml

@@ -130,10 +130,8 @@ jobs:
             --target runner \
             --build-arg VERSION="$VERSION" \
             -t "git.garvis.dev/dmg/minecraft-account-manager:${VERSION}" \
-            -t git.garvis.dev/dmg/minecraft-account-manager:latest \
             .
           docker push "git.garvis.dev/dmg/minecraft-account-manager:${VERSION}"
-          docker push git.garvis.dev/dmg/minecraft-account-manager:latest
 
       - name: Build and push Discord bot image
         if: steps.release.outputs.created == 'true'
@@ -145,10 +143,8 @@ jobs:
             --target bot \
             --build-arg VERSION="$VERSION" \
             -t "git.garvis.dev/dmg/minecraft-account-manager-bot:${VERSION}" \
-            -t git.garvis.dev/dmg/minecraft-account-manager-bot:latest \
             .
           docker push "git.garvis.dev/dmg/minecraft-account-manager-bot:${VERSION}"
-          docker push git.garvis.dev/dmg/minecraft-account-manager-bot:latest
 
       - name: Build and push migration image
         if: steps.release.outputs.created == 'true'
@@ -160,10 +156,8 @@ jobs:
             --target migrate \
             --build-arg VERSION="$VERSION" \
             -t "git.garvis.dev/dmg/minecraft-account-manager-migrate:${VERSION}" \
-            -t git.garvis.dev/dmg/minecraft-account-manager-migrate:latest \
             .
           docker push "git.garvis.dev/dmg/minecraft-account-manager-migrate:${VERSION}"
-          docker push git.garvis.dev/dmg/minecraft-account-manager-migrate:latest
 
       - name: Create Gitea release and upload Velocity JAR
         if: steps.release.outputs.created == 'true'

Dockerfile

@@ -10,6 +10,7 @@ COPY apps/discord-bot/package.json ./apps/discord-bot/package.json
 COPY packages/auth/package.json ./packages/auth/package.json
 COPY packages/contracts/package.json ./packages/contracts/package.json
 COPY packages/database/package.json ./packages/database/package.json
+COPY packages/logging/package.json ./packages/logging/package.json
 COPY packages/minecraft/package.json ./packages/minecraft/package.json
 COPY packages/network/package.json ./packages/network/package.json
 RUN npm ci
@@ -25,6 +26,7 @@ LABEL org.opencontainers.image.title="Minecraft Account Manager" \
       org.opencontainers.image.source="https://git.garvis.dev/dmg/minecraft-account-manager"
 WORKDIR /app
 ENV NODE_ENV=production \
+    APP_VERSION=${VERSION} \
     HOSTNAME=0.0.0.0 \
     PORT=3000
 RUN addgroup --system app && adduser --system --ingroup app app
@@ -40,7 +42,8 @@ LABEL org.opencontainers.image.title="Minecraft Account Manager Discord Bot" \
       org.opencontainers.image.version="${VERSION}" \
       org.opencontainers.image.source="https://git.garvis.dev/dmg/minecraft-account-manager"
 WORKDIR /app
-ENV NODE_ENV=production
+ENV NODE_ENV=production \
+    APP_VERSION=${VERSION}
 RUN addgroup --system app && adduser --system --ingroup app app
 COPY --chown=app:app package.json package-lock.json tsconfig.base.json ./
 COPY --chown=app:app apps/discord-bot ./apps/discord-bot

apps/discord-bot/.env.example

@@ -3,3 +3,4 @@ APP_URL=http://localhost:3000
 DISCORD_BOT_TOKEN=
 DISCORD_APPLICATION_ID=
 DISCORD_GUILD_ID=
+LOG_LEVEL=info

apps/discord-bot/package.json

@@ -13,6 +13,7 @@
     "@minecraft-account-manager/auth": "*",
     "@minecraft-account-manager/contracts": "*",
     "@minecraft-account-manager/database": "*",
+    "@minecraft-account-manager/logging": "*",
     "discord.js": "^14.25.1",
     "dotenv": "^17.2.3",
     "drizzle-orm": "^0.45.1"

apps/discord-bot/src/deploy-commands.ts

@@ -2,10 +2,22 @@ import "dotenv/config";
 import { REST, Routes } from "discord.js";
 import { commands } from "./commands";
 import { requiredEnvironment } from "./config";
+import { logger } from "./logger";
 
 const token = requiredEnvironment("DISCORD_BOT_TOKEN");
 const applicationId = requiredEnvironment("DISCORD_APPLICATION_ID");
 const rest = new REST({ version: "10" }).setToken(token);
 
-await rest.put(Routes.applicationCommands(applicationId), { body: commands });
-console.log(`Deployed ${commands.length} global Discord commands.`);
+try {
+  await rest.put(Routes.applicationCommands(applicationId), { body: commands });
+  logger.info(
+    { event: "discord.commands_deployed", commandCount: commands.length },
+    "Deployed global Discord commands",
+  );
+} catch (error) {
+  logger.fatal(
+    { err: error, event: "discord.commands_deploy_failed" },
+    "Failed to deploy global Discord commands",
+  );
+  process.exitCode = 1;
+}

apps/discord-bot/src/index.ts

@@ -14,6 +14,7 @@ import {
   GatewayIntentBits,
 } from "discord.js";
 import { commandNames, requiredEnvironment } from "./config";
+import { logger } from "./logger";
 
 const token = requiredEnvironment("DISCORD_BOT_TOKEN");
 const appUrl = requiredEnvironment("APP_URL");
@@ -24,7 +25,10 @@ const authRepository = createAuthRepository(db);
 const client = new Client({ intents: [GatewayIntentBits.Guilds] });
 
 client.once(Events.ClientReady, (readyClient) => {
-  console.log(`Discord bot ready as ${readyClient.user.tag}`);
+  logger.info(
+    { event: "discord.ready", botUserId: readyClient.user.id, botUsername: readyClient.user.username },
+    "Discord bot is ready",
+  );
 });
 
 client.on(Events.InteractionCreate, async (interaction) => {
@@ -71,9 +75,17 @@ client.on(Events.InteractionCreate, async (interaction) => {
       await interaction.editReply("Please wait 30 seconds before requesting another private account link.");
       return;
     }
-    console.error("Failed to create Discord account link", error);
+    logger.error(
+      { err: error, event: "discord.magic_link_failed", command: interaction.commandName },
+      "Failed to create Discord account link",
+    );
     await interaction.editReply("I could not create an account link. Please try again shortly.");
   }
 });
 
-await client.login(token);
+try {
+  await client.login(token);
+} catch (error) {
+  logger.fatal({ err: error, event: "discord.login_failed" }, "Discord bot login failed");
+  process.exitCode = 1;
+}

apps/discord-bot/src/logger.ts

@@ -0,0 +1,3 @@
+import { createLogger } from "@minecraft-account-manager/logging";
+
+export const logger = createLogger("minecraft-account-manager-discord-bot");

apps/web/next.config.ts

@@ -34,6 +34,7 @@ const nextConfig: NextConfig = {
   transpilePackages: [
     "@minecraft-account-manager/contracts",
     "@minecraft-account-manager/database",
+    "@minecraft-account-manager/logging",
   ],
 };
 

apps/web/package.json

@@ -14,6 +14,7 @@
     "@minecraft-account-manager/auth": "*",
     "@minecraft-account-manager/contracts": "*",
     "@minecraft-account-manager/database": "*",
+    "@minecraft-account-manager/logging": "*",
     "@minecraft-account-manager/minecraft": "*",
     "@minecraft-account-manager/network": "*",
     "drizzle-orm": "^0.45.1",

apps/web/src/app/account/actions.ts

@@ -6,20 +6,56 @@ import { and, eq, isNull, ne } from "drizzle-orm";
 import { redirect } from "next/navigation";
 import { recordUserEvent } from "@/lib/audit";
 import { db } from "@/lib/database";
+import { hasDiscordNicknameConfirmation } from "@/lib/dashboard-change-confirmation";
 import { requireCurrentUser } from "@/lib/auth/user-session";
 import { checkAccountAdditionNetwork, toAuditIpData } from "@/lib/ip-intelligence";
+import { logger } from "@/lib/logger";
 
 const USERNAME_PATTERN = /^[A-Za-z0-9_]{3,16}$/;
 
 export async function updateFirstName(formData: FormData) {
   const user = await requireCurrentUser();
   const firstName = String(formData.get("firstName") ?? "").trim();
+  const confirmed = hasDiscordNicknameConfirmation(formData);
   if (firstName.length < 1 || firstName.length > 50 || /[\u0000-\u001f\u007f]/.test(firstName)) {
     redirect("/account?error=invalid-name");
   }
-  await db.update(users).set({ firstName, updatedAt: new Date() }).where(eq(users.id, user.id));
+
+  const [primary] = await db.select({ username: minecraftAccounts.username }).from(minecraftAccounts).where(
+    and(eq(minecraftAccounts.userId, user.id), eq(minecraftAccounts.isPrimary, true), isNull(minecraftAccounts.deletedAt)),
+  ).limit(1);
+  if (!primary) redirect("/account?error=nickname-not-configured");
+  if (!confirmed) redirect(`/account?pendingName=${encodeURIComponent(firstName)}`);
+
+  const guildId = process.env.DISCORD_GUILD_ID?.trim();
+  const botToken = process.env.DISCORD_BOT_TOKEN?.trim();
+  if (!guildId || !botToken) redirect("/account?error=nickname-not-configured");
+  const nickname = formatDiscordNickname(firstName, primary.username);
+
+  try {
+    await db.transaction(async (tx) => {
+      await tx.update(users).set({ firstName, updatedAt: new Date() }).where(eq(users.id, user.id));
+      await updateGuildNickname({
+        guildId,
+        discordUserId: user.discordUserId,
+        nickname,
+        botToken,
+      });
+    });
+  } catch (error) {
+    logger.error(
+      { err: error, event: "account.first_name_update_failed" },
+      "Failed to update the user name and Discord nickname",
+    );
+    redirect(`/account?error=nickname-update-failed&pendingName=${encodeURIComponent(firstName)}`);
+  }
+
   await recordUserEvent(user, "games.minecraft.account-manager.user.first-name.updated", { firstName });
-  redirect("/account?confirmNickname=1");
+  await recordUserEvent(user, "games.minecraft.account-manager.discord.nickname.updated", {
+    nickname,
+    operation: "update-first-name",
+  });
+  redirect("/account?nicknameUpdated=1");
 }
 
 export async function addMinecraftAccount(formData: FormData) {
@@ -75,23 +111,58 @@ export async function addMinecraftAccount(formData: FormData) {
 export async function setPrimaryAccount(formData: FormData) {
   const user = await requireCurrentUser();
   const accountId = String(formData.get("accountId") ?? "");
+  const confirmed = hasDiscordNicknameConfirmation(formData);
+  const [requestedAccount] = await db.select({ id: minecraftAccounts.id, username: minecraftAccounts.username }).from(minecraftAccounts).where(
+    and(eq(minecraftAccounts.id, accountId), eq(minecraftAccounts.userId, user.id), isNull(minecraftAccounts.deletedAt)),
+  ).limit(1);
 
-  const changed = await db.transaction(async (tx) => {
-    const [account] = await tx.select({ id: minecraftAccounts.id }).from(minecraftAccounts).where(
-      and(eq(minecraftAccounts.id, accountId), eq(minecraftAccounts.userId, user.id), isNull(minecraftAccounts.deletedAt)),
-    ).limit(1);
-    if (!account) return false;
+  if (!requestedAccount) redirect("/account?error=unknown-account");
+  if (!user.firstName) redirect("/account?error=nickname-not-configured");
+  if (!confirmed) redirect(`/account?pendingPrimary=${encodeURIComponent(requestedAccount.id)}`);
 
-    await tx.update(minecraftAccounts).set({ isPrimary: false, updatedAt: new Date() }).where(
-      and(eq(minecraftAccounts.userId, user.id), isNull(minecraftAccounts.deletedAt)),
+  const guildId = process.env.DISCORD_GUILD_ID?.trim();
+  const botToken = process.env.DISCORD_BOT_TOKEN?.trim();
+  if (!guildId || !botToken) redirect("/account?error=nickname-not-configured");
+  const nickname = formatDiscordNickname(user.firstName, requestedAccount.username);
+
+  let changed = false;
+  try {
+    changed = await db.transaction(async (tx) => {
+      const [account] = await tx.select({ id: minecraftAccounts.id }).from(minecraftAccounts).where(
+        and(eq(minecraftAccounts.id, requestedAccount.id), eq(minecraftAccounts.userId, user.id), isNull(minecraftAccounts.deletedAt)),
+      ).limit(1);
+      if (!account) return false;
+
+      await tx.update(minecraftAccounts).set({ isPrimary: false, updatedAt: new Date() }).where(
+        and(eq(minecraftAccounts.userId, user.id), isNull(minecraftAccounts.deletedAt)),
+      );
+      await tx.update(minecraftAccounts).set({ isPrimary: true, updatedAt: new Date() }).where(eq(minecraftAccounts.id, account.id));
+      await updateGuildNickname({
+        guildId,
+        discordUserId: user.discordUserId,
+        nickname,
+        botToken,
+      });
+      return true;
+    });
+  } catch (error) {
+    logger.error(
+      { err: error, event: "account.primary_update_failed" },
+      "Failed to update the primary account and Discord nickname",
     );
-    await tx.update(minecraftAccounts).set({ isPrimary: true, updatedAt: new Date() }).where(eq(minecraftAccounts.id, account.id));
-    return true;
-  });
+    redirect(`/account?error=nickname-update-failed&pendingPrimary=${encodeURIComponent(requestedAccount.id)}`);
+  }
 
   if (!changed) redirect("/account?error=unknown-account");
-  await recordUserEvent(user, "games.minecraft.account-manager.minecraft-account.primary-changed", { accountId });
-  redirect("/account?confirmNickname=1");
+  await recordUserEvent(user, "games.minecraft.account-manager.minecraft-account.primary-changed", {
+    accountId: requestedAccount.id,
+    nickname,
+  });
+  await recordUserEvent(user, "games.minecraft.account-manager.discord.nickname.updated", {
+    nickname,
+    operation: "set-primary-account",
+  });
+  redirect("/account?nicknameUpdated=1");
 }
 
 export async function removeMinecraftAccount(formData: FormData) {

apps/web/src/app/account/page.tsx

@@ -1,9 +1,11 @@
 import { formatDiscordNickname } from "@minecraft-account-manager/minecraft";
-import { ipIntelligence, ipObservations, minecraftAccounts } from "@minecraft-account-manager/database";
-import { and, desc, eq, isNull } from "drizzle-orm";
+import { groups, ipIntelligence, ipObservations, minecraftAccounts, userGroupMemberships } from "@minecraft-account-manager/database";
+import { and, desc, eq, isNull, or } from "drizzle-orm";
 import { logout } from "@/app/auth/actions";
 import { db } from "@/lib/database";
 import { requireCurrentUser } from "@/lib/auth/user-session";
+import { groupAccessAddresses } from "@/lib/access-address-groups";
+import { discordIdentity } from "@/lib/discord-identity";
 import { intelligenceSummary } from "@/lib/event-ip-summary";
 import {
   addMinecraftAccount,
@@ -13,6 +15,10 @@ import {
   updateFirstName,
 } from "./actions";
 
+function queryValue(value: string | string[] | undefined) {
+  return Array.isArray(value) ? value[0] : value;
+}
+
 const errorMessages: Record<string, string> = {
   "invalid-name": "Enter a valid name between 1 and 50 characters.",
   "invalid-username": "Java usernames use 3–16 letters, numbers, or underscores.",
@@ -27,11 +33,13 @@ const errorMessages: Record<string, string> = {
 export default async function AccountPage({
   searchParams,
 }: {
-  searchParams: Promise<Record<string, string | undefined>>;
+  searchParams: Promise<Record<string, string | string[] | undefined>>;
 }) {
   const user = await requireCurrentUser("/account");
   const query = await searchParams;
-  const [accounts, observations] = await Promise.all([
+  const error = queryValue(query.error);
+  const unverified = queryValue(query.unverified);
+  const [accounts, observations, discord, accessGroups] = await Promise.all([
     db
       .select()
       .from(minecraftAccounts)
@@ -50,12 +58,37 @@ export default async function AccountPage({
       .leftJoin(ipIntelligence, eq(ipIntelligence.ipAddress, ipObservations.ipAddress))
       .where(eq(ipObservations.userId, user.id))
       .orderBy(desc(ipObservations.observedAt))
-      .limit(20),
+      .limit(100),
+    discordIdentity(user),
+    db.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, isDefault: groups.isDefault })
+      .from(groups)
+      .leftJoin(userGroupMemberships, eq(userGroupMemberships.groupId, groups.id))
+      .where(or(eq(groups.isDefault, true), eq(userGroupMemberships.userId, user.id)))
+      .orderBy(desc(groups.isDefault), groups.name),
   ]);
+  const addressGroups = groupAccessAddresses(observations);
   const primary = accounts.find((account) => account.isPrimary);
   const desiredNickname = user.firstName && primary
     ? formatDiscordNickname(user.firstName, primary.username)
     : null;
+  const pendingName = queryValue(query.pendingName)?.trim();
+  const pendingPrimaryId = queryValue(query.pendingPrimary);
+  const pendingPrimary = accounts.find((account) => account.id === pendingPrimaryId);
+  const pendingChange = pendingName && pendingName.length <= 50 && primary
+    ? {
+        kind: "name" as const,
+        label: `Change your name to ${pendingName}`,
+        nickname: formatDiscordNickname(pendingName, primary.username),
+        firstName: pendingName,
+      }
+    : pendingPrimary && user.firstName
+      ? {
+          kind: "primary" as const,
+          label: `Make ${pendingPrimary.username} your primary account`,
+          nickname: formatDiscordNickname(user.firstName, pendingPrimary.username),
+          accountId: pendingPrimary.id,
+        }
+      : null;
 
   return (
     <main className="min-h-screen bg-canvas px-6 py-10 text-ink sm:py-16">
@@ -68,14 +101,35 @@ export default async function AccountPage({
           <form action={logout}><button className="font-mono text-xs font-bold uppercase tracking-wider underline underline-offset-4" type="submit">Sign out</button></form>
         </header>
 
-        {query.error && (
+        {error && (
           <p className="mt-8 border-l-2 border-accent bg-panel px-5 py-4 text-sm text-accent">
-            {errorMessages[query.error] ?? "The requested change could not be completed."}
+            {errorMessages[error] ?? "The requested change could not be completed."}
           </p>
         )}
-        {query.nicknameUpdated && <p className="mt-8 border-l-2 border-signal bg-panel px-5 py-4 font-mono text-xs font-bold uppercase tracking-wider">Discord nickname updated</p>}
+        {queryValue(query.nicknameUpdated) && <p className="mt-8 border-l-2 border-signal bg-panel px-5 py-4 font-mono text-xs font-bold uppercase tracking-wider">Profile and Discord nickname updated</p>}
 
-        {query.confirmNickname && desiredNickname && (
+        {pendingChange && (
+          <section className="mt-8 border border-accent bg-panel p-6 shadow-[6px_6px_0_var(--color-accent)] sm:flex sm:items-center sm:justify-between sm:gap-8">
+            <div>
+              <p className="font-mono text-[10px] font-bold uppercase tracking-widest text-accent">Review linked identity change</p>
+              <h2 className="mt-3 font-display text-2xl font-black uppercase">{pendingChange.label}</h2>
+              <p className="mt-3 text-sm leading-6 text-muted">Nothing changes until you confirm. This will also update your Discord nickname to:</p>
+              <p className="mt-2 font-display text-2xl font-black">{pendingChange.nickname}</p>
+            </div>
+            <div className="mt-6 flex flex-wrap items-center gap-4 sm:mt-0 sm:justify-end">
+              <form action={pendingChange.kind === "name" ? updateFirstName : setPrimaryAccount}>
+                {pendingChange.kind === "name"
+                  ? <input name="firstName" type="hidden" value={pendingChange.firstName} />
+                  : <input name="accountId" type="hidden" value={pendingChange.accountId} />}
+                <input name="confirmDiscordNickname" type="hidden" value="yes" />
+                <button className="border border-ink bg-ink px-5 py-3 font-mono text-xs font-bold uppercase tracking-wider text-canvas" type="submit">Confirm both changes</button>
+              </form>
+              <a className="font-mono text-[10px] font-bold uppercase underline underline-offset-4" href="/account">Cancel</a>
+            </div>
+          </section>
+        )}
+
+        {queryValue(query.confirmNickname) && desiredNickname && (
           <section className="mt-8 border border-accent bg-panel p-6 shadow-[6px_6px_0_var(--color-accent)] sm:flex sm:items-center sm:justify-between sm:gap-8">
             <div>
               <p className="font-mono text-[10px] font-bold uppercase tracking-widest text-accent">Confirm Discord change</p>
@@ -108,7 +162,7 @@ export default async function AccountPage({
                       <p className="mt-2 break-all font-mono text-[10px] text-muted">{account.minecraftUuid ?? "UUID will be learned at game login"}</p>
                     </div>
                     <div className="flex gap-4">
-                      {!account.isPrimary && <form action={setPrimaryAccount}><input name="accountId" type="hidden" value={account.id} /><button className="font-mono text-[10px] font-bold uppercase tracking-wider underline underline-offset-4" type="submit">Make primary</button></form>}
+                      {!account.isPrimary && <form action={setPrimaryAccount}><input name="accountId" type="hidden" value={account.id} /><button className="font-mono text-[10px] font-bold uppercase tracking-wider underline underline-offset-4" type="submit">Review primary change</button></form>}
                       <form action={removeMinecraftAccount}><input name="accountId" type="hidden" value={account.id} /><button className="font-mono text-[10px] font-bold uppercase tracking-wider text-accent underline underline-offset-4" type="submit">Remove</button></form>
                     </div>
                   </article>
@@ -116,11 +170,11 @@ export default async function AccountPage({
                 {accounts.length === 0 && <p className="py-8 text-muted">No active Minecraft accounts. Add one before joining the server.</p>}
               </div>
 
-              {query.unverified ? (
+              {unverified ? (
                 <form action={addMinecraftAccount} className="border-l-2 border-accent bg-panel p-6">
-                  <h3 className="font-display text-xl font-black uppercase">Mojang couldn’t verify “{query.unverified}”</h3>
+                  <h3 className="font-display text-xl font-black uppercase">Mojang couldn’t verify “{unverified}”</h3>
                   <p className="mt-2 text-sm leading-6 text-muted">Continue only if you are certain the spelling is correct.</p>
-                  <input name="username" type="hidden" value={query.unverified} /><input name="confirmUnverified" type="hidden" value="yes" />
+                  <input name="username" type="hidden" value={unverified} /><input name="confirmUnverified" type="hidden" value="yes" />
                   <button className="mt-5 border border-ink bg-ink px-4 py-2 font-mono text-[10px] font-bold uppercase tracking-wider text-canvas" type="submit">Add anyway</button>
                   <a className="ml-5 font-mono text-[10px] font-bold uppercase underline" href="/account">Cancel</a>
                 </form>
@@ -135,11 +189,24 @@ export default async function AccountPage({
             <section>
               <p className="font-mono text-[10px] font-bold uppercase tracking-widest text-muted">Recent security activity</p>
               <h2 className="mt-2 border-b border-line pb-4 font-display text-3xl font-black uppercase">Access addresses</h2>
-              {observations.length ? (
+              {addressGroups.length ? (
                 <div className="divide-y divide-line font-mono text-xs">
-                  {observations.map((observation) => {
-                    const summary = intelligenceSummary(observation.intelligence);
-                    return <div className="grid grid-cols-[1fr_auto] gap-4 py-4" key={observation.id}><div><p>{observation.ipAddress}</p><p className="mt-1 text-[10px] text-muted">{summary.location ?? "Location unavailable"} · {summary.classification ?? observation.classification}</p></div><span className="text-muted">{observation.source} · {observation.observedAt.toISOString()}</span></div>;
+                  <p className="py-3 text-[10px] leading-5 text-muted">Similar IPv4 /24 and IPv6 /64 networks are grouped. Counts cover your 100 most recent observations.</p>
+                  {addressGroups.map((group) => {
+                    const summary = intelligenceSummary(group.intelligence);
+                    return (
+                      <div className="grid gap-3 py-4 sm:grid-cols-[1fr_auto] sm:items-start" key={group.network}>
+                        <div>
+                          <div className="flex flex-wrap items-center gap-3">
+                            <p className="font-bold">{group.network}</p>
+                            <span className="border border-line px-2 py-1 text-[9px] uppercase tracking-wider text-muted">{group.count} {group.count === 1 ? "observation" : "observations"}</span>
+                          </div>
+                          <p className="mt-2 text-[10px] text-muted">Latest address {group.latestAddress}</p>
+                          <p className="mt-1 text-[10px] text-muted">{summary.location ?? "Location unavailable"} · {summary.classification ?? group.classification}</p>
+                        </div>
+                        <span className="text-[10px] text-muted sm:text-right">{group.sources.join(" + ")}<br />Last seen {group.latestObservedAt.toISOString()}</span>
+                      </div>
+                    );
                   })}
                 </div>
               ) : <p className="py-6 text-sm text-muted">No web or game access addresses have been recorded yet.</p>}
@@ -149,11 +216,25 @@ export default async function AccountPage({
           <aside>
             <form action={updateFirstName} className="border border-line bg-panel p-6 shadow-[6px_6px_0_var(--color-shadow)]">
               <p className="font-mono text-[10px] font-bold uppercase tracking-widest text-accent">Profile</p>
+              <dl className="mt-5 space-y-3 border-b border-line pb-5 font-mono text-[10px]">
+                <div><dt className="uppercase tracking-wider text-muted">Discord name</dt><dd className="mt-1 break-all font-bold text-ink">{discord.globalName ?? discord.username}</dd></div>
+                <div><dt className="uppercase tracking-wider text-muted">Discord username</dt><dd className="mt-1 break-all text-ink">@{discord.username}</dd></div>
+                <div><dt className="uppercase tracking-wider text-muted">Guild nickname</dt><dd className="mt-1 break-all text-ink">{discord.nickname ?? "No guild nickname"}</dd></div>
+                <div><dt className="uppercase tracking-wider text-muted">Discord ID</dt><dd className="mt-1 break-all text-ink">{discord.id}</dd></div>
+              </dl>
               <label className="mt-5 block font-mono text-xs font-bold uppercase tracking-wider" htmlFor="firstName">What we call you</label>
               <input className="mt-3 w-full border border-line bg-canvas px-4 py-3 outline-none focus:border-accent" defaultValue={user.firstName ?? ""} id="firstName" maxLength={50} name="firstName" required />
-              {desiredNickname && <p className="mt-4 text-xs leading-5 text-muted">Discord preview: <strong className="text-ink">{desiredNickname}</strong></p>}
-              <button className="mt-6 border border-ink px-4 py-2 font-mono text-[10px] font-bold uppercase tracking-wider" type="submit">Save name</button>
+              {desiredNickname && <p className="mt-4 text-xs leading-5 text-muted">Current Discord nickname: <strong className="text-ink">{desiredNickname}</strong></p>}
+              <p className="mt-3 text-xs leading-5 text-muted">You will review the new Discord nickname before anything changes.</p>
+              <button className="mt-6 border border-ink px-4 py-2 font-mono text-[10px] font-bold uppercase tracking-wider" type="submit">Review name change</button>
             </form>
+            <section className="mt-8 border border-line bg-panel p-6">
+              <p className="font-mono text-[10px] font-bold uppercase tracking-widest text-muted">Access groups</p>
+              <div className="mt-4 space-y-3">
+                {accessGroups.map((group) => <div className="flex items-center justify-between gap-3 border-t border-line pt-3 first:border-0 first:pt-0" key={group.id}><span className="font-mono text-xs font-bold">{group.name}{group.isDefault ? " · default" : ""}</span><span className={`px-2 py-1 font-mono text-[9px] font-bold uppercase ${group.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{group.accessEnabled ? "Access on" : "Access off"}</span></div>)}
+              </div>
+              <p className="mt-4 text-xs leading-5 text-muted">Minecraft access is allowed when any listed group has access on.</p>
+            </section>
           </aside>
         </div>
       </section>

apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx

@@ -0,0 +1,92 @@
+import { groups, userGroupMemberships, users } from "@minecraft-account-manager/database";
+import { asc, eq } from "drizzle-orm";
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { db } from "@/lib/database";
+import { addGroupMember, removeGroupMember, setGroupAccess } from "../actions";
+
+const savedMessages: Record<string, string> = {
+  created: "Group created with access disabled.",
+  access: "Group access policy updated.",
+  "member-added": "User added to the group.",
+  "member-removed": "User removed from the group.",
+};
+
+export default async function GroupPage({
+  params,
+  searchParams,
+}: {
+  params: Promise<{ groupId: string }>;
+  searchParams: Promise<{ saved?: string }>;
+}) {
+  const { groupId } = await params;
+  const query = await searchParams;
+  const [group] = await db.select().from(groups).where(eq(groups.id, groupId)).limit(1);
+  if (!group) notFound();
+
+  const [allUsers, memberships] = await Promise.all([
+    db.select({
+      id: users.id,
+      firstName: users.firstName,
+      discordUsername: users.discordUsername,
+      discordGlobalName: users.discordGlobalName,
+      discordUserId: users.discordUserId,
+    }).from(users).orderBy(asc(users.discordUsername)),
+    db.select({ userId: userGroupMemberships.userId }).from(userGroupMemberships)
+      .where(eq(userGroupMemberships.groupId, group.id)),
+  ]);
+  const memberIds = new Set(memberships.map((membership) => membership.userId));
+
+  return (
+    <main className="mx-auto max-w-6xl px-6 py-12">
+      <Link className="font-mono text-[10px] font-bold uppercase tracking-widest text-muted underline underline-offset-4" href="/admin/groups">← All groups</Link>
+      <header className="mt-7 flex flex-col gap-6 border-b border-line pb-8 lg:flex-row lg:items-end lg:justify-between">
+        <div>
+          <p className="font-mono text-xs font-bold uppercase tracking-[0.25em] text-accent">Access group</p>
+          <div className="mt-4 flex flex-wrap items-center gap-3"><h1 className="font-display text-5xl font-black uppercase sm:text-7xl">{group.name}</h1>{group.isDefault && <span className="bg-ink px-3 py-2 font-mono text-[9px] font-bold uppercase text-canvas">Default</span>}</div>
+          <p className="mt-3 max-w-2xl text-sm leading-6 text-muted">{group.description ?? "No description."}</p>
+        </div>
+        <form action={setGroupAccess} className="border-l-2 border-accent pl-5">
+          <input name="groupId" type="hidden" value={group.id} />
+          <input name="accessEnabled" type="hidden" value={group.accessEnabled ? "no" : "yes"} />
+          <p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Minecraft admission</p>
+          <p className="mt-2 font-display text-2xl font-black uppercase">{group.accessEnabled ? "Allowed" : "Denied"}</p>
+          <button className="mt-3 font-mono text-[9px] font-bold uppercase text-accent underline underline-offset-4" type="submit">Turn access {group.accessEnabled ? "off" : "on"}</button>
+        </form>
+      </header>
+
+      {query.saved && <p className="mt-7 border-l-2 border-signal bg-panel px-5 py-4 font-mono text-xs font-bold uppercase tracking-wider">{savedMessages[query.saved] ?? "Group updated."}</p>}
+
+      <section className="mt-10">
+        <div className="flex items-end justify-between border-b border-line pb-4">
+          <div><p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Membership</p><h2 className="mt-2 font-display text-3xl font-black uppercase">Registered users</h2></div>
+          <span className="font-mono text-xs text-muted">{group.isDefault ? allUsers.length : memberIds.size} members</span>
+        </div>
+        {group.isDefault && <p className="border-b border-line bg-panel px-5 py-4 text-sm text-muted">Membership in <strong className="text-ink">everyone</strong> is automatic and cannot be removed.</p>}
+        <div className="divide-y divide-line">
+          {allUsers.map((user) => {
+            const isMember = group.isDefault || memberIds.has(user.id);
+            return (
+              <article className="grid gap-4 py-5 sm:grid-cols-[1fr_auto] sm:items-center" key={user.id}>
+                <div>
+                  <Link className="font-mono text-sm font-bold underline decoration-line underline-offset-4 hover:decoration-accent" href={`/admin/users/${user.id}`}>{user.firstName ?? user.discordGlobalName ?? user.discordUsername}</Link>
+                  <p className="mt-1 font-mono text-[10px] text-muted">@{user.discordUsername} · {user.discordUserId}</p>
+                </div>
+                {group.isDefault ? (
+                  <span className="font-mono text-[9px] font-bold uppercase text-muted">Automatic member</span>
+                ) : (
+                  <form action={isMember ? removeGroupMember : addGroupMember}>
+                    <input name="groupId" type="hidden" value={group.id} />
+                    <input name="userId" type="hidden" value={user.id} />
+                    <button className={`font-mono text-[9px] font-bold uppercase underline underline-offset-4 ${isMember ? "text-accent" : "text-ink"}`} type="submit">{isMember ? "Remove from group" : "Add to group"}</button>
+                  </form>
+                )}
+              </article>
+            );
+          })}
+          {!allUsers.length && <p className="py-8 text-sm text-muted">No registered users yet.</p>}
+        </div>
+      </section>
+    </main>
+  );
+}

apps/web/src/app/admin/(console)/groups/actions.ts

@@ -0,0 +1,104 @@
+"use server";
+
+import { groups, userGroupMemberships, users } from "@minecraft-account-manager/database";
+import { and, eq } from "drizzle-orm";
+import { redirect } from "next/navigation";
+import { recordAdminSubjectEvent } from "@/lib/audit";
+import { requireAdminSession } from "@/lib/auth/require-admin";
+import { db } from "@/lib/database";
+
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+
+function groupPath(groupId: string, query?: string) {
+  return `/admin/groups/${encodeURIComponent(groupId)}${query ? `?${query}` : ""}`;
+}
+
+export async function createGroup(formData: FormData) {
+  const admin = await requireAdminSession();
+  const name = String(formData.get("name") ?? "").trim();
+  const slug = String(formData.get("slug") ?? "").trim().toLowerCase();
+  const description = String(formData.get("description") ?? "").trim();
+  if (name.length < 1 || name.length > 50 || !SLUG_PATTERN.test(slug) || slug.length > 50 || description.length > 500) {
+    redirect("/admin/groups?error=invalid-group");
+  }
+
+  let group: { id: string } | undefined;
+  try {
+    [group] = await db.insert(groups).values({
+      name,
+      slug,
+      description: description || null,
+      accessEnabled: false,
+      isDefault: false,
+    }).returning({ id: groups.id });
+  } catch {
+    redirect("/admin/groups?error=duplicate-group");
+  }
+  if (!group) redirect("/admin/groups?error=create-failed");
+
+  await recordAdminSubjectEvent(admin, `group/${group.id}`, "games.minecraft.account-manager.group.created", {
+    name,
+    slug,
+    accessEnabled: false,
+  });
+  redirect(groupPath(group.id, "saved=created"));
+}
+
+export async function setGroupAccess(formData: FormData) {
+  const admin = await requireAdminSession();
+  const groupId = String(formData.get("groupId") ?? "");
+  const accessEnabled = formData.get("accessEnabled") === "yes";
+  if (!UUID_PATTERN.test(groupId)) redirect("/admin/groups?error=unknown-group");
+
+  const [group] = await db.update(groups).set({ accessEnabled, updatedAt: new Date() })
+    .where(eq(groups.id, groupId)).returning({ id: groups.id, name: groups.name });
+  if (!group) redirect("/admin/groups?error=unknown-group");
+
+  await recordAdminSubjectEvent(admin, `group/${group.id}`, "games.minecraft.account-manager.group.access-updated", {
+    name: group.name,
+    accessEnabled,
+  });
+  redirect(groupPath(group.id, "saved=access"));
+}
+
+export async function addGroupMember(formData: FormData) {
+  const admin = await requireAdminSession();
+  const groupId = String(formData.get("groupId") ?? "");
+  const userId = String(formData.get("userId") ?? "");
+  if (!UUID_PATTERN.test(groupId) || !UUID_PATTERN.test(userId)) redirect("/admin/groups?error=invalid-membership");
+
+  const [[group], [user]] = await Promise.all([
+    db.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault }).from(groups).where(eq(groups.id, groupId)).limit(1),
+    db.select({ id: users.id }).from(users).where(eq(users.id, userId)).limit(1),
+  ]);
+  if (!group || !user || group.isDefault) redirect("/admin/groups?error=invalid-membership");
+
+  await db.insert(userGroupMemberships).values({ groupId: group.id, userId: user.id }).onConflictDoNothing();
+  await recordAdminSubjectEvent(admin, `user/${user.id}`, "games.minecraft.account-manager.group.member-added", {
+    groupId: group.id,
+    groupName: group.name,
+  });
+  redirect(groupPath(group.id, "saved=member-added"));
+}
+
+export async function removeGroupMember(formData: FormData) {
+  const admin = await requireAdminSession();
+  const groupId = String(formData.get("groupId") ?? "");
+  const userId = String(formData.get("userId") ?? "");
+  if (!UUID_PATTERN.test(groupId) || !UUID_PATTERN.test(userId)) redirect("/admin/groups?error=invalid-membership");
+
+  const [group] = await db.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault })
+    .from(groups).where(eq(groups.id, groupId)).limit(1);
+  if (!group || group.isDefault) redirect("/admin/groups?error=invalid-membership");
+
+  await db.delete(userGroupMemberships).where(and(
+    eq(userGroupMemberships.groupId, group.id),
+    eq(userGroupMemberships.userId, userId),
+  ));
+  await recordAdminSubjectEvent(admin, `user/${userId}`, "games.minecraft.account-manager.group.member-removed", {
+    groupId: group.id,
+    groupName: group.name,
+  });
+  redirect(groupPath(group.id, "saved=member-removed"));
+}

apps/web/src/app/admin/(console)/groups/page.tsx

@@ -0,0 +1,78 @@
+import { groups, userGroupMemberships, users } from "@minecraft-account-manager/database";
+import { asc, desc } from "drizzle-orm";
+import Link from "next/link";
+import { db } from "@/lib/database";
+import { createGroup, setGroupAccess } from "./actions";
+
+const errors: Record<string, string> = {
+  "invalid-group": "Enter a name and a lowercase slug containing letters, numbers, or hyphens.",
+  "duplicate-group": "That group slug already exists.",
+  "create-failed": "The group could not be created.",
+  "unknown-group": "That group no longer exists.",
+  "invalid-membership": "That membership change was invalid.",
+};
+
+export default async function GroupsPage({ searchParams }: { searchParams: Promise<{ error?: string }> }) {
+  const query = await searchParams;
+  const [allGroups, memberships, registeredUsers] = await Promise.all([
+    db.select().from(groups).orderBy(desc(groups.isDefault), asc(groups.name)),
+    db.select({ groupId: userGroupMemberships.groupId }).from(userGroupMemberships),
+    db.select({ id: users.id }).from(users),
+  ]);
+  const membershipCounts = new Map<string, number>();
+  for (const membership of memberships) {
+    membershipCounts.set(membership.groupId, (membershipCounts.get(membership.groupId) ?? 0) + 1);
+  }
+
+  return (
+    <main className="mx-auto max-w-6xl px-6 py-14">
+      <header className="border-b border-line pb-8">
+        <p className="font-mono text-xs font-bold uppercase tracking-[0.25em] text-accent">Admission policy</p>
+        <h1 className="mt-4 font-display text-5xl font-black uppercase">Access groups</h1>
+        <p className="mt-5 max-w-2xl leading-7 text-muted">Every registered user belongs to <strong className="text-ink">everyone</strong>. A player can join only when at least one of their groups has access enabled.</p>
+      </header>
+
+      {query.error && <p className="mt-7 border-l-2 border-accent bg-panel px-5 py-4 text-sm text-accent">{errors[query.error] ?? "The group operation failed."}</p>}
+
+      <section className="mt-10 grid gap-5 md:grid-cols-2">
+        {allGroups.map((group) => {
+          const memberCount = group.isDefault ? registeredUsers.length : membershipCounts.get(group.id) ?? 0;
+          return (
+            <article className="border border-line bg-panel p-6 shadow-[5px_5px_0_var(--color-shadow)]" key={group.id}>
+              <div className="flex items-start justify-between gap-4">
+                <div>
+                  <div className="flex flex-wrap items-center gap-2">
+                    <h2 className="font-display text-2xl font-black uppercase">{group.name}</h2>
+                    {group.isDefault && <span className="bg-ink px-2 py-1 font-mono text-[9px] font-bold uppercase text-canvas">Default</span>}
+                  </div>
+                  <p className="mt-1 font-mono text-[10px] text-muted">{group.slug} · {memberCount} members</p>
+                </div>
+                <span className={`px-3 py-2 font-mono text-[9px] font-bold uppercase ${group.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{group.accessEnabled ? "Access on" : "Access off"}</span>
+              </div>
+              <p className="mt-4 min-h-12 text-sm leading-6 text-muted">{group.description ?? "No description."}</p>
+              <div className="mt-5 flex items-center justify-between gap-4 border-t border-line pt-4">
+                <Link className="font-mono text-[10px] font-bold uppercase underline underline-offset-4" href={`/admin/groups/${group.id}`}>Manage members</Link>
+                <form action={setGroupAccess}>
+                  <input name="groupId" type="hidden" value={group.id} />
+                  <input name="accessEnabled" type="hidden" value={group.accessEnabled ? "no" : "yes"} />
+                  <button className="font-mono text-[10px] font-bold uppercase text-accent underline underline-offset-4" type="submit">Turn access {group.accessEnabled ? "off" : "on"}</button>
+                </form>
+              </div>
+            </article>
+          );
+        })}
+      </section>
+
+      <form action={createGroup} className="mt-12 border border-line bg-panel p-7 shadow-[8px_8px_0_var(--color-shadow)]">
+        <p className="font-mono text-[10px] font-bold uppercase tracking-widest text-accent">Create a group</p>
+        <div className="mt-5 grid gap-5 sm:grid-cols-2">
+          <label className="text-sm font-bold">Name<input className="mt-2 w-full border border-line bg-canvas px-4 py-3 font-normal outline-none focus:border-accent" maxLength={50} name="name" required /></label>
+          <label className="text-sm font-bold">Slug<input className="mt-2 w-full border border-line bg-canvas px-4 py-3 font-mono font-normal outline-none focus:border-accent" maxLength={50} name="slug" pattern="[a-z0-9]+(?:-[a-z0-9]+)*" placeholder="ops" required /></label>
+        </div>
+        <label className="mt-5 block text-sm font-bold">Description<textarea className="mt-2 min-h-24 w-full border border-line bg-canvas px-4 py-3 font-normal outline-none focus:border-accent" maxLength={500} name="description" /></label>
+        <p className="mt-4 text-xs text-muted">New groups start with access disabled.</p>
+        <button className="mt-6 border border-ink bg-ink px-5 py-3 font-mono text-[10px] font-bold uppercase tracking-wider text-canvas" type="submit">Create group</button>
+      </form>
+    </main>
+  );
+}

apps/web/src/app/admin/(console)/layout.tsx

@@ -30,10 +30,11 @@ export default async function AdminConsoleLayout({ children }: { children: React
     <div className="min-h-screen bg-canvas text-ink">
       <header className="border-b border-line bg-panel">
         <div className="mx-auto flex max-w-6xl items-center justify-between px-6 py-5">
-          <Link className="font-display text-sm font-black uppercase tracking-[0.2em]" href="/admin">Blocklist / Ops</Link>
+          <Link className="font-display text-sm font-black uppercase tracking-[0.2em]" href="/admin">SoMC Portal / Ops</Link>
           <nav className="ml-auto mr-8 flex gap-5 font-mono text-[10px] font-bold uppercase tracking-widest">
             <Link className="hover:text-accent" href="/admin">Settings</Link>
             <Link className="hover:text-accent" href="/admin/users">Users</Link>
+            <Link className="hover:text-accent" href="/admin/groups">Groups</Link>
             <Link className="hover:text-accent" href="/admin/events">Events</Link>
           </nav>
           <AdminSignOutButton />

apps/web/src/app/admin/(console)/page.tsx

@@ -11,6 +11,8 @@ export default async function AdminPage({
   const query = await searchParams;
   const [settings] = await db.select().from(appSettings).where(eq(appSettings.id, "default")).limit(1);
   const message = settings?.registrationMessage ?? "Please register your Minecraft account before joining.";
+  const guildId = process.env.DISCORD_GUILD_ID?.trim();
+  const inviteUrl = process.env.DISCORD_INVITE_URL?.trim();
 
   return (
     <main className="mx-auto max-w-6xl px-6 py-14">
@@ -19,9 +21,9 @@ export default async function AdminPage({
           <p className="font-mono text-xs font-bold uppercase tracking-[0.25em] text-accent">System settings</p>
           <h1 className="mt-4 font-display text-5xl font-black uppercase leading-none tracking-tight">Server gate</h1>
           <p className="mt-6 max-w-sm leading-7 text-muted">The Discord guild and invite are deployment environment settings. Operators can adjust the message shown to denied Minecraft players here.</p>
-          <dl className="mt-7 space-y-2 font-mono text-[10px] uppercase tracking-wider text-muted">
-            <div><dt className="inline font-bold text-ink">Guild:</dt> <dd className="inline">{process.env.DISCORD_GUILD_ID ? "configured" : "missing"}</dd></div>
-            <div><dt className="inline font-bold text-ink">Invite:</dt> <dd className="inline">{process.env.DISCORD_INVITE_URL ? "configured" : "missing"}</dd></div>
+          <dl className="mt-7 space-y-4 font-mono text-[10px] uppercase tracking-wider text-muted">
+            <div><dt className="font-bold text-ink">Guild ID</dt><dd className="mt-1 break-all normal-case">{guildId ?? "Missing"}</dd></div>
+            <div><dt className="font-bold text-ink">Invite URL</dt><dd className="mt-1 break-all normal-case">{inviteUrl ? <a className="text-ink underline decoration-accent underline-offset-4" href={inviteUrl} rel="noreferrer" target="_blank">{inviteUrl}</a> : "Missing"}</dd></div>
           </dl>
         </section>
 

apps/web/src/app/admin/(console)/users/[userId]/page.tsx

@@ -1,9 +1,11 @@
 import { formatManagedDiscordNickname } from "@minecraft-account-manager/minecraft";
-import { events, ipObservations, minecraftAccounts, users } from "@minecraft-account-manager/database";
+import { events, groups, ipObservations, minecraftAccounts, userGroupMemberships, users } from "@minecraft-account-manager/database";
 import { and, desc, eq, isNull, or } from "drizzle-orm";
 import Link from "next/link";
 import { notFound } from "next/navigation";
+import { groupAccessAddresses } from "@/lib/access-address-groups";
 import { db } from "@/lib/database";
+import { discordIdentity } from "@/lib/discord-identity";
 import { eventIpSummary } from "@/lib/event-ip-summary";
 import {
   addUserMinecraftAccount,
@@ -43,7 +45,7 @@ export default async function AdminUserPage({
   const [user] = await db.select().from(users).where(eq(users.id, userId)).limit(1);
   if (!user) notFound();
 
-  const [accounts, recentEvents, observations] = await Promise.all([
+  const [accounts, recentEvents, observations, discord, accessGroups] = await Promise.all([
     db
       .select()
       .from(minecraftAccounts)
@@ -60,8 +62,17 @@ export default async function AdminUserPage({
       .from(ipObservations)
       .where(eq(ipObservations.userId, user.id))
       .orderBy(desc(ipObservations.observedAt))
-      .limit(20),
+      .limit(100),
+    discordIdentity(user),
+    db.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, isDefault: groups.isDefault })
+      .from(groups)
+      .leftJoin(userGroupMemberships, eq(userGroupMemberships.groupId, groups.id))
+      .where(or(eq(groups.isDefault, true), eq(userGroupMemberships.userId, user.id)))
+      .orderBy(desc(groups.isDefault), groups.name),
   ]);
+  const addressGroups = groupAccessAddresses(
+    observations.map((observation) => ({ ...observation, intelligence: null })),
+  );
   const primary = accounts.find((account) => account.isPrimary);
   const nickname = user.firstName
     ? formatManagedDiscordNickname(user.firstName, primary?.username ?? null)
@@ -74,7 +85,12 @@ export default async function AdminUserPage({
         <div>
           <p className="font-mono text-xs font-bold uppercase tracking-[0.25em] text-accent">User record</p>
           <h1 className="mt-4 font-display text-5xl font-black uppercase sm:text-7xl">{user.firstName ?? "Name needed"}</h1>
-          <p className="mt-3 font-mono text-xs text-muted">@{user.discordUsername} · {user.discordUserId}</p>
+          <dl className="mt-4 grid gap-x-8 gap-y-2 font-mono text-[10px] text-muted sm:grid-cols-2">
+            <div><dt className="uppercase tracking-wider">Discord name</dt><dd className="mt-1 text-xs text-ink">{discord.globalName ?? discord.username}</dd></div>
+            <div><dt className="uppercase tracking-wider">Discord username</dt><dd className="mt-1 text-xs text-ink">@{discord.username}</dd></div>
+            <div><dt className="uppercase tracking-wider">Guild nickname</dt><dd className="mt-1 text-xs text-ink">{discord.nickname ?? "No guild nickname"}</dd></div>
+            <div><dt className="uppercase tracking-wider">Discord ID</dt><dd className="mt-1 break-all text-xs text-ink">{discord.id}</dd></div>
+          </dl>
         </div>
         <div className="border-l-2 border-accent pl-5">
           <p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Expected Discord nickname</p>
@@ -160,11 +176,28 @@ export default async function AdminUserPage({
             <button className="mt-6 border border-ink px-4 py-2 font-mono text-[9px] font-bold uppercase tracking-wider" type="submit">Save and synchronize</button>
           </form>
 
+          <section className="border border-line bg-panel p-6">
+            <div className="flex items-center justify-between gap-3"><p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Access groups</p><Link className="font-mono text-[9px] font-bold uppercase underline underline-offset-4" href="/admin/groups">Manage</Link></div>
+            <div className="mt-4 space-y-3">
+              {accessGroups.map((group) => <div className="flex items-center justify-between gap-3" key={group.id}><Link className="font-mono text-xs font-bold underline decoration-line underline-offset-4" href={`/admin/groups/${group.id}`}>{group.name}{group.isDefault ? " · default" : ""}</Link><span className={`px-2 py-1 font-mono text-[9px] font-bold uppercase ${group.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{group.accessEnabled ? "On" : "Off"}</span></div>)}
+            </div>
+          </section>
+
           <section className="border border-line bg-panel p-6">
             <p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Recent addresses</p>
+            <p className="mt-3 text-[10px] leading-5 text-muted">Grouped by IPv4 /24 or IPv6 /64 network across the 100 most recent observations.</p>
             <div className="mt-4 divide-y divide-line">
-              {observations.map((observation) => <div className="py-3" key={observation.id}><p className="font-mono text-xs">{observation.ipAddress}</p><p className="mt-1 font-mono text-[9px] text-muted">{observation.source} · {observation.observedAt.toISOString()}</p></div>)}
-              {!observations.length && <p className="py-3 text-xs text-muted">No addresses recorded.</p>}
+              {addressGroups.map((group) => (
+                <div className="py-3" key={group.network}>
+                  <div className="flex items-center justify-between gap-3">
+                    <p className="font-mono text-xs font-bold">{group.network}</p>
+                    <span className="font-mono text-[9px] text-muted">×{group.count}</span>
+                  </div>
+                  <p className="mt-1 font-mono text-[9px] text-muted">{group.sources.join(" + ")} · {group.latestObservedAt.toISOString()}</p>
+                  <p className="mt-1 break-all font-mono text-[9px] text-muted">Latest {group.latestAddress}</p>
+                </div>
+              ))}
+              {!addressGroups.length && <p className="py-3 text-xs text-muted">No addresses recorded.</p>}
             </div>
           </section>
         </aside>

apps/web/src/app/admin/(console)/users/page.tsx

@@ -15,6 +15,7 @@ export default async function AdminUsersPage({
     ? or(
         ilike(users.firstName, pattern),
         ilike(users.discordUsername, pattern),
+        ilike(users.discordGlobalName, pattern),
         eq(users.discordUserId, search),
         sql`exists (
           select 1 from ${minecraftAccounts}
@@ -33,6 +34,7 @@ export default async function AdminUsersPage({
       id: users.id,
       firstName: users.firstName,
       discordUsername: users.discordUsername,
+      discordGlobalName: users.discordGlobalName,
       discordUserId: users.discordUserId,
       onboardingCompletedAt: users.onboardingCompletedAt,
       primaryUsername: minecraftAccounts.username,
@@ -85,7 +87,7 @@ export default async function AdminUsersPage({
             {results.map((user) => (
               <tr className="transition-colors hover:bg-canvas/60" key={user.id}>
                 <td className="p-4"><Link className="font-display text-lg font-black underline decoration-line underline-offset-4 hover:text-accent" href={`/admin/users/${user.id}`}>{user.firstName ?? "Name needed"}</Link></td>
-                <td className="p-4"><div className="font-mono text-xs">@{user.discordUsername}</div><div className="mt-1 font-mono text-[9px] text-muted">{user.discordUserId}</div></td>
+                <td className="p-4"><div className="font-mono text-xs font-bold">{user.discordGlobalName ?? user.discordUsername}</div><div className="mt-1 font-mono text-[10px] text-muted">@{user.discordUsername}</div><div className="mt-1 font-mono text-[9px] text-muted">{user.discordUserId}</div></td>
                 <td className="p-4 font-mono text-xs">{user.primaryUsername ?? "—"}</td>
                 <td className="p-4 font-mono text-xs">{user.accountCount}</td>
                 <td className="p-4"><span className={`border px-2 py-1 font-mono text-[9px] uppercase tracking-wider ${user.onboardingCompletedAt ? "border-line text-muted" : "border-accent text-accent"}`}>{user.onboardingCompletedAt ? "Ready" : "Onboarding"}</span></td>

apps/web/src/app/api/velocity/access/route.ts

@@ -1,19 +1,22 @@
 import { randomUUID } from "node:crypto";
-import { isRequestTimestampFresh, verifyHashedToken } from "@minecraft-account-manager/auth";
+import { enabledAccessGroup, isRequestTimestampFresh, verifyHashedToken } from "@minecraft-account-manager/auth";
 import { problemDetails, velocityAccessRequestSchema } from "@minecraft-account-manager/contracts";
 import {
   appSettings,
   events,
+  groups,
   ipObservations,
   minecraftAccounts,
   pluginCredentials,
   pluginRequests,
+  userGroupMemberships,
 } from "@minecraft-account-manager/database";
-import { and, eq, isNull, lt, sql } from "drizzle-orm";
+import { and, eq, isNull, lt, or, sql } from "drizzle-orm";
 import { NextResponse } from "next/server";
 import { db } from "@/lib/database";
 import { isUniqueConstraintViolation } from "@/lib/database-errors";
 import { getIpIntelligence, toAuditIpData } from "@/lib/ip-intelligence";
+import { logger } from "@/lib/logger";
 import { problemInstance, problemResponse } from "@/lib/problem-response";
 
 const MAX_CLOCK_SKEW_MS = 45_000;
@@ -209,6 +212,42 @@ async function handleVelocityAccess(request: Request) {
         return { allowed: false as const, message: denialMessage };
       }
 
+      const assignedGroups = await tx
+        .select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled })
+        .from(groups)
+        .leftJoin(userGroupMemberships, eq(userGroupMemberships.groupId, groups.id))
+        .where(or(eq(groups.isDefault, true), eq(userGroupMemberships.userId, account.userId)));
+      const enabledGroup = enabledAccessGroup(assignedGroups);
+
+      if (!enabledGroup) {
+        await tx.insert(events).values({
+          id: randomUUID(),
+          source: `/velocity/${input.serverId}`,
+          type: "games.minecraft.account-manager.game.login.denied",
+          subject: `minecraft-account/${account.id}`,
+          time: occurredAt,
+          actorUserId: account.userId,
+          data: {
+            username: input.username,
+            reason: "group_access_disabled",
+            ipIntelligence: auditIpData,
+          },
+          ipAddress: input.ipAddress,
+          correlationId: input.requestId,
+        });
+        await tx.insert(ipObservations).values({
+          userId: account.userId,
+          minecraftAccountId: account.id,
+          source: "game",
+          ipAddress: input.ipAddress,
+          minecraftUuid: input.minecraftUuid,
+          username: input.username,
+          classification: intelligence.classification,
+          observedAt: occurredAt,
+        });
+        return { allowed: false as const, message: "Your account group does not currently have server access." };
+      }
+
       if (account.minecraftUuid !== input.minecraftUuid || account.username !== input.username) {
         await tx
           .update(minecraftAccounts)
@@ -258,6 +297,7 @@ async function handleVelocityAccess(request: Request) {
           previousUsername: account.username === input.username ? null : account.username,
           uuidBackfilled: account.minecraftUuid === null,
           ipIntelligence: auditIpData,
+          accessGroup: enabledGroup.name,
         },
         ipAddress: input.ipAddress,
         correlationId: input.requestId,
@@ -284,7 +324,10 @@ export async function POST(request: Request) {
       ));
     }
 
-    console.error("Velocity access request failed");
+    logger.error(
+      { err: error, event: "velocity.access_failed", instance },
+      "Velocity access request failed",
+    );
     return problemResponse(problemDetails(
       "urn:error:service-unavailable",
       "Service unavailable",

apps/web/src/app/auth/discord/route.ts

@@ -3,6 +3,7 @@ import { createAuthRepository, ipObservations, recordEvent } from "@minecraft-ac
 import { getClientIp } from "@minecraft-account-manager/network";
 import type { NextRequest } from "next/server";
 import { NextResponse } from "next/server";
+import { applicationUrl } from "@/lib/application-url";
 import { db } from "@/lib/database";
 import { getIpIntelligence, toAuditIpData } from "@/lib/ip-intelligence";
 
@@ -38,7 +39,7 @@ export async function GET(request: NextRequest) {
     ]);
 
     const destination = result.user.firstName ? "/account" : "/welcome";
-    const response = NextResponse.redirect(new URL(destination, request.url));
+    const response = NextResponse.redirect(applicationUrl(destination));
     response.cookies.set(SESSION_COOKIE_NAME, result.sessionToken, {
       httpOnly: true,
       secure: process.env.NODE_ENV === "production",
@@ -49,7 +50,7 @@ export async function GET(request: NextRequest) {
     return response;
   } catch (error) {
     if (error instanceof InvalidLoginCodeError) {
-      return NextResponse.redirect(new URL("/auth/error", request.url));
+      return NextResponse.redirect(applicationUrl("/auth/error"));
     }
     throw error;
   }

apps/web/src/app/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="8" fill="#171916"/>
+  <path d="M9 9h21v21H9z" fill="#bc3f24"/>
+  <path d="M34 9h21v21H34zM9 34h21v21H9z" fill="#eee8d8"/>
+  <path d="M34 34h21v21H34z" fill="#b5d452"/>
+  <path d="M21 18h13v8H26v4h8v8H21z" fill="#171916"/>
+</svg>

apps/web/src/app/layout.tsx

@@ -1,16 +1,20 @@
 import type { Metadata } from "next";
 import type { ReactNode } from "react";
+import { SiteFooter } from "@/components/site-footer";
 import "./globals.css";
 
 export const metadata: Metadata = {
-  title: "Blocklist — Minecraft Account Manager",
+  title: "SoMC Portal — Minecraft Account Manager",
   description: "Connect your Discord identity to approved Minecraft accounts.",
 };
 
 export default function RootLayout({ children }: Readonly<{ children: ReactNode }>) {
   return (
     <html lang="en">
-      <body>{children}</body>
+      <body className="flex min-h-screen flex-col">
+        <div className="flex-1">{children}</div>
+        <SiteFooter />
+      </body>
     </html>
   );
 }

apps/web/src/app/page.tsx

@@ -18,11 +18,11 @@ export default async function HomePage({
       <div className="terrain" aria-hidden="true" />
       <div className="relative mx-auto flex min-h-screen max-w-7xl flex-col px-6 pb-10 pt-7 sm:px-10 lg:px-16">
         <header className="flex items-center justify-between border-b border-line pb-5">
-          <a className="flex items-center gap-3" href="#top" aria-label="Blocklist home">
+          <a className="flex items-center gap-3" href="#top" aria-label="SoMC Portal home">
             <span className="grid size-9 place-items-center border border-accent bg-accent text-sm font-black text-canvas shadow-[4px_4px_0_var(--color-shadow)]">
               B
             </span>
-            <span className="font-display text-sm font-bold uppercase tracking-[0.22em]">Blocklist</span>
+            <span className="font-display text-sm font-bold uppercase tracking-[0.22em]">SoMC Portal</span>
           </a>
           <span className="hidden items-center gap-2 font-mono text-xs uppercase tracking-widest text-muted sm:flex">
             <span className="size-2 bg-signal shadow-[0_0_12px_var(--color-signal)]" />
@@ -84,10 +84,6 @@ export default async function HomePage({
           </aside>
         </section>
 
-        <footer className="flex flex-col gap-3 border-t border-line pt-5 font-mono text-[10px] uppercase tracking-[0.18em] text-muted sm:flex-row sm:items-center sm:justify-between">
-          <span>Java Edition only</span>
-          <span>Unknown players are denied by default</span>
-        </footer>
       </div>
     </main>
   );

apps/web/src/components/site-footer.test.tsx

@@ -0,0 +1,13 @@
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it } from "vitest";
+import { SiteFooter } from "./site-footer";
+
+describe("SiteFooter", () => {
+  it("credits DMG Games with the requested sponsor link", () => {
+    const markup = renderToStaticMarkup(<SiteFooter />);
+
+    expect(markup).toContain("Social Minecraft is sponsored by");
+    expect(markup).toContain('href="https://dmg.games"');
+    expect(markup).toContain("DMG Games.");
+  });
+});

apps/web/src/components/site-footer.tsx

@@ -0,0 +1,15 @@
+export function SiteFooter() {
+  return (
+    <footer className="border-t border-line bg-panel px-6 py-6 text-center font-mono text-[10px] uppercase tracking-[0.16em] text-muted">
+      Social Minecraft is sponsored by{" "}
+      <a
+        className="font-bold text-ink underline decoration-accent underline-offset-4 transition-colors hover:text-accent"
+        href="https://dmg.games"
+        rel="noreferrer"
+        target="_blank"
+      >
+        DMG Games.
+      </a>
+    </footer>
+  );
+}

apps/web/src/lib/access-address-groups.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+import { groupAccessAddresses } from "./access-address-groups";
+
+describe("groupAccessAddresses", () => {
+  it("collapses repeated observations from the same network into one recent summary", () => {
+    const groups = groupAccessAddresses([
+      { id: "old", ipAddress: "198.51.100.21", source: "web", classification: "clear", observedAt: new Date("2026-08-01T10:00:00Z"), intelligence: null },
+      { id: "new", ipAddress: "198.51.100.240", source: "game", classification: "clear", observedAt: new Date("2026-08-01T12:00:00Z"), intelligence: { provider: "proxycheck" } },
+      { id: "other", ipAddress: "203.0.113.9", source: "web", classification: "vpn", observedAt: new Date("2026-08-01T11:00:00Z"), intelligence: null },
+    ]);
+
+    expect(groups).toHaveLength(2);
+    expect(groups[0]).toMatchObject({
+      network: "198.51.100.0/24",
+      latestAddress: "198.51.100.240",
+      sources: ["game", "web"],
+      count: 2,
+      classification: "clear",
+      intelligence: { provider: "proxycheck" },
+    });
+    expect(groups[0]?.latestObservedAt.toISOString()).toBe("2026-08-01T12:00:00.000Z");
+  });
+});

apps/web/src/lib/access-address-groups.ts

@@ -0,0 +1,60 @@
+import { addressGroup } from "@minecraft-account-manager/network";
+
+type AccessObservation = {
+  id: string;
+  ipAddress: string;
+  source: string;
+  classification: string;
+  observedAt: Date;
+  intelligence: Record<string, unknown> | null;
+};
+
+export type AccessAddressGroup = {
+  network: string;
+  latestAddress: string;
+  sources: string[];
+  count: number;
+  firstObservedAt: Date;
+  latestObservedAt: Date;
+  classification: string;
+  intelligence: Record<string, unknown> | null;
+};
+
+export function groupAccessAddresses(observations: AccessObservation[]) {
+  const groups = new Map<string, AccessAddressGroup & { sourceSet: Set<string> }>();
+
+  for (const observation of observations) {
+    const network = addressGroup(observation.ipAddress);
+    const existing = groups.get(network);
+    if (!existing) {
+      groups.set(network, {
+        network,
+        latestAddress: observation.ipAddress,
+        sources: [],
+        sourceSet: new Set([observation.source]),
+        count: 1,
+        firstObservedAt: observation.observedAt,
+        latestObservedAt: observation.observedAt,
+        classification: observation.classification,
+        intelligence: observation.intelligence,
+      });
+      continue;
+    }
+
+    existing.count += 1;
+    existing.sourceSet.add(observation.source);
+    if (observation.observedAt < existing.firstObservedAt) {
+      existing.firstObservedAt = observation.observedAt;
+    }
+    if (observation.observedAt > existing.latestObservedAt) {
+      existing.latestAddress = observation.ipAddress;
+      existing.latestObservedAt = observation.observedAt;
+      existing.classification = observation.classification;
+      existing.intelligence = observation.intelligence;
+    }
+  }
+
+  return [...groups.values()]
+    .map(({ sourceSet, ...group }) => ({ ...group, sources: [...sourceSet].sort() }))
+    .sort((left, right) => right.latestObservedAt.getTime() - left.latestObservedAt.getTime());
+}

apps/web/src/lib/application-url.test.ts

@@ -0,0 +1,9 @@
+import { describe, expect, it } from "vitest";
+import { applicationUrl } from "./application-url";
+
+describe("applicationUrl", () => {
+  it("builds browser redirects from the configured public application URL", () => {
+    expect(applicationUrl("/welcome", "https://portal.somc.club"))
+      .toEqual(new URL("https://portal.somc.club/welcome"));
+  });
+});

apps/web/src/lib/application-url.ts

@@ -0,0 +1,4 @@
+export function applicationUrl(path: string, baseUrl = process.env.APP_URL) {
+  if (!baseUrl) throw new Error("APP_URL is required to build public application URLs");
+  return new URL(path, baseUrl);
+}

apps/web/src/lib/audit.ts

@@ -5,9 +5,9 @@ import { db } from "@/lib/database";
 
 const UI_ACCESSED = "games.minecraft.account-manager.ui.accessed";
 
-export async function recordAdminEvent(
+export async function recordAdminSubjectEvent(
   admin: { email: string | null; name: string | null },
-  targetUserId: string,
+  subject: string,
   type: string,
   data: Record<string, unknown>,
 ) {
@@ -16,12 +16,21 @@ export async function recordAdminEvent(
   return recordEvent(db, {
     type,
     source: "/web/admin",
-    subject: `user/${targetUserId}`,
+    subject,
     ipAddress: ipAddress ?? undefined,
     data: { ...data, adminEmail: admin.email, adminName: admin.name },
   });
 }
 
+export async function recordAdminEvent(
+  admin: { email: string | null; name: string | null },
+  targetUserId: string,
+  type: string,
+  data: Record<string, unknown>,
+) {
+  return recordAdminSubjectEvent(admin, `user/${targetUserId}`, type, data);
+}
+
 export async function recordUserEvent(
   user: { id: string },
   type: string,

apps/web/src/lib/dashboard-change-confirmation.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from "vitest";
+import { hasDiscordNicknameConfirmation } from "./dashboard-change-confirmation";
+
+describe("dashboard identity change confirmation", () => {
+  it("accepts only the explicit Discord nickname confirmation value", () => {
+    expect(hasDiscordNicknameConfirmation(new FormData())).toBe(false);
+
+    const declined = new FormData();
+    declined.set("confirmDiscordNickname", "no");
+    expect(hasDiscordNicknameConfirmation(declined)).toBe(false);
+
+    const confirmed = new FormData();
+    confirmed.set("confirmDiscordNickname", "yes");
+    expect(hasDiscordNicknameConfirmation(confirmed)).toBe(true);
+  });
+});

apps/web/src/lib/dashboard-change-confirmation.ts

@@ -0,0 +1,3 @@
+export function hasDiscordNicknameConfirmation(formData: FormData) {
+  return formData.get("confirmDiscordNickname") === "yes";
+}

apps/web/src/lib/discord-identity.ts

@@ -0,0 +1,33 @@
+import { getGuildMemberIdentity } from "@minecraft-account-manager/minecraft";
+import { logger } from "@/lib/logger";
+
+export async function discordIdentity(input: {
+  discordUserId: string;
+  discordUsername: string;
+  discordGlobalName: string | null;
+}) {
+  const guildId = process.env.DISCORD_GUILD_ID?.trim();
+  const botToken = process.env.DISCORD_BOT_TOKEN?.trim();
+  const fallback = {
+    id: input.discordUserId,
+    username: input.discordUsername,
+    globalName: input.discordGlobalName,
+    nickname: null as string | null,
+    live: false,
+  };
+  if (!guildId || !botToken) return fallback;
+
+  try {
+    return { ...await getGuildMemberIdentity({
+      guildId,
+      discordUserId: input.discordUserId,
+      botToken,
+    }), live: true };
+  } catch (error) {
+    logger.warn(
+      { err: error, event: "discord.identity_lookup_failed", discordUserId: input.discordUserId },
+      "Discord guild identity lookup failed",
+    );
+    return fallback;
+  }
+}

apps/web/src/lib/ip-intelligence.ts

@@ -12,6 +12,7 @@ import { ipIntelligence } from "@minecraft-account-manager/database";
 import { and, eq, gt } from "drizzle-orm";
 import { headers } from "next/headers";
 import { db } from "@/lib/database";
+import { logger } from "@/lib/logger";
 
 const classifications = new Set<IpClassification>([
   "unknown",
@@ -77,6 +78,13 @@ export async function getIpIntelligence(
   options: { now?: Date; forceRefresh?: boolean } = {},
 ): Promise<IpIntelligenceResult> {
   if (!isPublicIp(ipAddress)) {
+    logger.warn(
+      {
+        event: "ip_intelligence.skipped",
+        reason: "non_public_address",
+      },
+      "IP intelligence lookup skipped for a non-public client address",
+    );
     return { classification: "unknown", provider: null };
   }
 
@@ -96,14 +104,23 @@ export async function getIpIntelligence(
     const result = await provider.classify(ipAddress);
     await cacheResult(ipAddress, result, now, cacheHours() * 60 * 60_000);
     return result;
-  } catch {
+  } catch (error) {
+    const providerName = process.env.IP_INTELLIGENCE_PROVIDER?.trim().toLowerCase() || null;
     const result: IpIntelligenceResult = {
       classification: "unknown",
-      provider: process.env.IP_INTELLIGENCE_PROVIDER?.trim().toLowerCase() || null,
+      provider: providerName,
       lookupError: true,
     };
-    await cacheResult(ipAddress, result, now, 5 * 60_000).catch(() => undefined);
-    console.error("IP intelligence lookup failed");
+    await cacheResult(ipAddress, result, now, 5 * 60_000).catch((cacheError) => {
+      logger.error(
+        { err: cacheError, event: "ip_intelligence.cache_failed", provider: providerName },
+        "Failed to cache an IP intelligence lookup error",
+      );
+    });
+    logger.error(
+      { err: error, event: "ip_intelligence.lookup_failed", provider: providerName },
+      "IP intelligence lookup failed",
+    );
     return result;
   }
 }
@@ -134,6 +151,15 @@ export async function checkAccountAdditionNetwork() {
   const requestHeaders = await headers();
   const ipAddress = getClientIp(requestHeaders, process.env.TRUST_PROXY === "true");
   if (!ipAddress) {
+    logger.warn(
+      {
+        event: "client_ip.unavailable",
+        trustProxy: process.env.TRUST_PROXY === "true",
+        forwardedForPresent: requestHeaders.has("x-forwarded-for"),
+        realIpPresent: requestHeaders.has("x-real-ip"),
+      },
+      "Client IP address was unavailable for account addition",
+    );
     return {
       allowed: false as const,
       reason: "unavailable" as const,

apps/web/src/lib/logger.ts

@@ -0,0 +1,3 @@
+import { createLogger } from "@minecraft-account-manager/logging";
+
+export const logger = createLogger("minecraft-account-manager-web");

design/index.md

@@ -30,6 +30,7 @@ This OKF bundle is the product record for implemented and proposed behavior. Sto
 * [US-014 — Receive standardized API errors](us-014-problem-details.md) - Application APIs return RFC 9457 Problem Details.
 * [US-015 — Deploy and operate securely](us-015-platform-operations.md) - Operators have reproducible builds, migrations, credentials, and security controls.
 * [US-016 — Build and publish versioned releases](us-016-automated-releases.md) - Gitea Actions publish the Velocity JAR and web and migration images.
+* [US-017 — Control admission with groups](us-017-group-access.md) - Administrators assign users to groups that explicitly grant Minecraft access.
 
 # Tracking
 

design/log.md

@@ -2,6 +2,13 @@
 
 ## 2026-08-01
 
+* **Extend**: Add SoMC Portal branding, live Discord identity details, admin guild configuration visibility, and fail-closed group-based Minecraft admission.
+* **Refine**: Group repeated access networks, confirm linked Discord nickname changes before mutation, and add DMG Games sponsorship attribution.
+* **Extend**: Add shared Pino logging with credential redaction and actionable web and Discord runtime diagnostics.
+* **Fix**: Build magic-link redirects from the configured public portal URL instead of the reverse proxy's internal request origin.
+* **Verify**: Confirmed `v1.1.1` left all pre-existing `latest` digests unchanged while publishing versioned artifacts.
+* **Refine**: Removed mutable `latest` publication so all deployable artifacts use explicit semantic versions.
+* **Verify**: Confirmed the `v1.1.0` Discord bot image and matching web, migration, and Velocity artifacts.
 * **Extend**: Added a releasable Discord bot image and a dependency-free web health endpoint for Kubernetes deployment.
 * **Verify**: Confirmed the initial `v1.0.0` release, public Velocity JAR, and versioned and `latest` web and migration image manifests.
 * **Create**: Added Gitea CI and semantic-release pipelines for downloadable Velocity JARs and versioned web and migration images.

design/us-001-discord-entry.md

@@ -3,7 +3,7 @@ type: User Story
 title: Enter the account portal through Discord
 description: Direct visitors are guided to the configured Discord community and its account commands.
 tags: [player, portal, discord, onboarding]
-timestamp: 2026-08-01T18:43:58Z
+timestamp: 2026-08-01T22:34:31Z
 story_id: US-001
 status: verified
 ---
@@ -18,11 +18,15 @@ As a prospective player, I want the portal to direct me to the community Discord
 - [x] Given a configured invite URL, when the visitor selects the join action, then the Discord invite opens in a new browser context.
 - [x] Given a configured guild ID, when the visitor selects the app action, then a `discord://` guild link is opened.
 - [x] Given an unauthenticated protected-page request, when authorization fails, then the visitor returns to the portal with prominent Discord instructions.
+- [x] Every portal page credits Social Minecraft sponsorship by DMG Games and links to `https://dmg.games`.
+- [x] Portal branding uses the SoMC Portal name and a dedicated favicon.
 
 # Implementation
 
 - [`apps/web/src/app/page.tsx`](../apps/web/src/app/page.tsx)
 - [`apps/web/src/lib/auth/user-session.ts`](../apps/web/src/lib/auth/user-session.ts)
+- [`apps/web/src/components/site-footer.tsx`](../apps/web/src/components/site-footer.tsx)
+- [`apps/web/src/app/icon.svg`](../apps/web/src/app/icon.svg)
 - Configuration: `DISCORD_GUILD_ID`, `DISCORD_INVITE_URL`
 
 # Validation

design/us-002-discord-magic-link.md

@@ -3,7 +3,7 @@ type: User Story
 title: Authenticate with a Discord magic link
 description: Discord users receive private single-use links that establish secure portal sessions.
 tags: [player, discord, authentication, security]
-timestamp: 2026-08-01T18:43:58Z
+timestamp: 2026-08-01T20:43:46Z
 story_id: US-002
 status: verified
 ---
@@ -19,6 +19,7 @@ As a Discord community member, I want `/register` and `/account` to issue a priv
 - [x] Given a login token, then it expires after ten minutes and can be consumed only once.
 - [x] Given repeated link requests, then requests are rate limited per Discord user and older active links are invalidated.
 - [x] Given a valid link, when it is consumed, then the Discord user is created or refreshed and a secure seven-day session is established.
+- [x] Given a magic-link result behind a reverse proxy, then the browser is redirected through the configured public application URL rather than an internal container address.
 - [x] Given an invalid, expired, or consumed link, then the user sees a safe recovery page instructing them to request another link.
 
 # Implementation
@@ -27,10 +28,12 @@ As a Discord community member, I want `/register` and `/account` to issue a priv
 - [`packages/auth/src/index.ts`](../packages/auth/src/index.ts)
 - [`packages/database/src/auth-repository.ts`](../packages/database/src/auth-repository.ts)
 - [`apps/web/src/app/auth/discord/route.ts`](../apps/web/src/app/auth/discord/route.ts)
+- [`apps/web/src/lib/application-url.ts`](../apps/web/src/lib/application-url.ts)
 
 # Validation
 
 - [`packages/auth/test/magic-link.test.ts`](../packages/auth/test/magic-link.test.ts)
+- [`apps/web/src/lib/application-url.test.ts`](../apps/web/src/lib/application-url.test.ts)
 - Discord command and authentication workspaces pass TypeScript validation.
 
 # Related Stories

design/us-005-user-dashboard.md

@@ -3,7 +3,7 @@ type: User Story
 title: Manage linked accounts from the dashboard
 description: Authenticated users maintain their profile and active Java Edition accounts.
 tags: [player, dashboard, minecraft, profile]
-timestamp: 2026-08-01T18:43:58Z
+timestamp: 2026-08-01T22:34:31Z
 story_id: US-005
 status: verified
 ---
@@ -20,8 +20,10 @@ As a registered player, I want to manage my profile and linked Minecraft account
 - [x] The user can soft-remove an active account.
 - [x] The user can choose exactly one active primary account.
 - [x] Removing a primary account promotes another active account when one exists.
-- [x] Name and primary changes show the expected Discord nickname and require confirmation.
+- [x] Name and primary changes preview the expected Discord nickname and require explicit confirmation before either profile mutation occurs.
 - [x] The dashboard shows recent portal and game IP observations with classification and available location.
+- [x] The dashboard shows the user's Discord display name, username, guild nickname, and immutable Discord ID.
+- [x] The dashboard shows effective access groups and whether each group grants Minecraft access.
 - [x] The user can revoke the current session by signing out.
 
 # Implementation
@@ -32,7 +34,7 @@ As a registered player, I want to manage my profile and linked Minecraft account
 
 # Validation
 
-Server actions verify the current session and constrain every account lookup by the authenticated user ID.
+Server actions verify the current session, constrain every account lookup by the authenticated user ID, and require the explicit Discord confirmation field before name or primary-account mutations. Confirmation parsing is covered by [`apps/web/src/lib/dashboard-change-confirmation.test.ts`](../apps/web/src/lib/dashboard-change-confirmation.test.ts).
 
 # Related Stories
 

design/us-007-ip-intelligence.md

@@ -3,7 +3,7 @@ type: User Story
 title: Enrich portal and game login IPs
 description: Login audit events include cached approximate location and network intelligence from ProxyCheck.io.
 tags: [security, network, audit, proxycheck]
-timestamp: 2026-08-01T18:43:58Z
+timestamp: 2026-08-01T22:04:17Z
 story_id: US-007
 status: verified
 ---
@@ -22,6 +22,7 @@ As an operator, I want portal and registered game logins enriched with network c
 - [x] Unknown game accounts do not trigger paid ProxyCheck lookups.
 - [x] Login events and IP observations retain the available classification and approximate location.
 - [x] Users and administrators can see available location and classification in audit views.
+- [x] Repeated access observations are summarized by IPv4 /24 or IPv6 /64 network with counts, sources, and latest activity.
 
 # Implementation
 
@@ -34,6 +35,8 @@ As an operator, I want portal and registered game logins enriched with network c
 
 - [`packages/network/test/proxycheck.test.ts`](../packages/network/test/proxycheck.test.ts)
 - [`packages/network/test/client-ip.test.ts`](../packages/network/test/client-ip.test.ts)
+- [`packages/network/test/address-groups.test.ts`](../packages/network/test/address-groups.test.ts)
+- [`apps/web/src/lib/access-address-groups.test.ts`](../apps/web/src/lib/access-address-groups.test.ts)
 
 # Related Stories
 

design/us-009-velocity-admission.md

@@ -3,7 +3,7 @@ type: User Story
 title: Enforce registration at the Velocity proxy
 description: Online-mode Java connections are admitted only after a fail-closed account-manager decision.
 tags: [minecraft, velocity, whitelist, security]
-timestamp: 2026-08-01T18:52:20Z
+timestamp: 2026-08-01T22:34:31Z
 story_id: US-009
 status: verified
 ---
@@ -22,7 +22,8 @@ As a registered player, I want the Velocity proxy to recognize my approved Java
 - [x] Username fallback applies only when the stored account has no UUID.
 - [x] Successful fallback backfills UUID and canonical username.
 - [x] Changed usernames are persisted and audited.
-- [x] Unknown players, API failures, malformed responses, and unauthorized requests fail closed with registration guidance.
+- [x] Registered players are allowed only when at least one assigned group has access enabled.
+- [x] Unknown players, group-disabled players, API failures, malformed responses, and unauthorized requests fail closed with registration guidance.
 - [x] The plugin records the real Velocity connection IP and supports Java Edition online mode only.
 
 # Implementation
@@ -41,3 +42,4 @@ As a registered player, I want the Velocity proxy to recognize my approved Java
 
 - [Validate Minecraft accounts](us-004-minecraft-validation.md)
 - [Standardize API errors](us-014-problem-details.md)
+- [Control Minecraft admission with groups](us-017-group-access.md)

design/us-012-admin-operations.md

@@ -3,7 +3,7 @@ type: User Story
 title: Operate settings and audit views
 description: Authorized administrators control server messaging and investigate recent platform events.
 tags: [admin, settings, audit, operations]
-timestamp: 2026-08-01T18:43:58Z
+timestamp: 2026-08-01T22:34:31Z
 story_id: US-012
 status: verified
 ---
@@ -14,7 +14,7 @@ As an administrator, I want operational settings and audit visibility, so that I
 
 # Acceptance Criteria
 
-- [x] The admin console reports whether deployment-managed Discord guild and invite settings are configured.
+- [x] The admin console shows the deployment-managed Discord guild ID and linked invite URL.
 - [x] An authorized administrator can update the denied-player registration message.
 - [x] Settings actions validate message length server-side.
 - [x] Administrators can browse the latest 100 events.

design/us-013-admin-user-management.md

@@ -3,7 +3,7 @@ type: User Story
 title: Manage users as an administrator
 description: Authorized operators search users and maintain their names, linked accounts, primaries, and Discord nicknames.
 tags: [admin, users, minecraft, discord]
-timestamp: 2026-08-01T18:43:58Z
+timestamp: 2026-08-01T22:34:31Z
 story_id: US-013
 status: verified
 ---
@@ -16,7 +16,7 @@ As an administrator, I want to manage a user's identity and Minecraft accounts,
 
 - [x] Administrators can search by preferred name, Discord username or ID, Minecraft username, or UUID.
 - [x] Search results show onboarding state, primary username, and active account count.
-- [x] A user detail view shows Discord identity, active accounts, recent events, and recent IP observations.
+- [x] A user detail view shows Discord display name, username, guild nickname, immutable ID, active accounts, groups, recent events, and recent IP observations.
 - [x] Administrators can update the preferred name and synchronize Discord.
 - [x] Administrators can add Mojang-verified accounts or explicitly override an unverified username.
 - [x] Administrators can remove an account only after a visible confirmation step.
@@ -39,3 +39,4 @@ Nickname fallback behavior is tested in [`packages/minecraft/test/minecraft.test
 
 - [Administrator SSO](us-011-admin-sso.md)
 - [Synchronize Discord nicknames](us-006-discord-nickname.md)
+- [Control Minecraft admission with groups](us-017-group-access.md)

design/us-015-platform-operations.md

@@ -3,7 +3,7 @@ type: User Story
 title: Deploy and operate the platform securely
 description: Operators have repeatable builds, migrations, credential provisioning, configuration, and security checks.
 tags: [operations, security, database, deployment]
-timestamp: 2026-08-01T19:46:09Z
+timestamp: 2026-08-01T21:37:26Z
 story_id: US-015
 status: verified
 ---
@@ -22,6 +22,7 @@ As a platform operator, I want reproducible deployment and security controls, so
 - [x] Environment examples document database, Keycloak, Discord, trusted proxy, and ProxyCheck settings without secrets.
 - [x] The web application sets CSP, framing, MIME, referrer, and permissions headers.
 - [x] The web runtime provides a dependency-free health endpoint for orchestration probes.
+- [x] Web and Discord bot runtimes emit structured Pino logs with credential-field redaction and safe operational context.
 - [x] npm dependency audit and Semgrep security review complete without findings at the last verified change.
 - [x] Architecture, Keycloak, API error, security, bot, and Velocity operating documentation is available.
 
@@ -33,10 +34,11 @@ As a platform operator, I want reproducible deployment and security controls, so
 - [`packages/database/scripts/create-plugin-credential.ts`](../packages/database/scripts/create-plugin-credential.ts)
 - [`plugins/velocity/build.gradle.kts`](../plugins/velocity/build.gradle.kts)
 - [`apps/web/next.config.ts`](../apps/web/next.config.ts)
+- [`packages/logging/src/index.ts`](../packages/logging/src/index.ts)
 
 # Validation
 
-Use `npm test`, `npm run typecheck`, `npm run lint`, `npm run build`, `npm run velocity:build`, `npm audit`, and `npm run design:validate`.
+Use `npm test`, `npm run typecheck`, `npm run lint`, `npm run build`, `npm run velocity:build`, `npm audit`, and `npm run design:validate`. Structured logging redaction is covered by [`packages/logging/test/logger.test.ts`](../packages/logging/test/logger.test.ts).
 
 # Related Stories
 

design/us-016-automated-releases.md

@@ -3,9 +3,9 @@ type: User Story
 title: Build and publish versioned releases
 description: Gitea Actions validate every change and publish semantically versioned Velocity and container artifacts.
 tags: [operations, ci, release, velocity, docker]
-timestamp: 2026-08-01T19:46:09Z
+timestamp: 2026-08-01T20:05:49Z
 story_id: US-016
-status: implemented
+status: verified
 ---
 
 # User Story
@@ -20,9 +20,10 @@ As a platform operator, I want automated validation and semantic releases, so th
 - [x] Main-branch conventional commits determine the next semantic version and create a `vMAJOR.MINOR.PATCH` tag.
 - [x] A release build embeds the semantic version in the Velocity plugin and JAR filename.
 - [x] A public Gitea release exposes the versioned Velocity JAR as a downloadable asset.
-- [x] Releases publish versioned and `latest` web runtime images to the Gitea registry.
-- [ ] Releases publish versioned and `latest` Discord bot images to the Gitea registry.
-- [x] Releases publish versioned and `latest` migration images that run versioned Drizzle migrations.
+- [x] Releases publish semantically versioned web runtime images to the Gitea registry.
+- [x] Releases publish semantically versioned Discord bot images to the Gitea registry.
+- [x] Releases publish semantically versioned migration images that run versioned Drizzle migrations.
+- [x] Releases do not publish mutable container tags such as `latest`.
 - [x] Runtime containers use unprivileged users and exclude development source and secrets where practical.
 - [x] Operators are told which repository secrets must be configured before the first push.
 
@@ -37,7 +38,7 @@ As a platform operator, I want automated validation and semantic releases, so th
 
 # Validation
 
-Local OKF, lint, typecheck, test, Next.js build, and versioned Velocity JAR checks pass. Initial Gitea CI and release runs succeeded. Release `v1.0.0` provides a publicly downloadable JAR whose Velocity metadata reports `1.0.0`. Registry manifests were resolved for versioned and `latest` web and migration images. Discord bot image publication is implemented for the next feature release. Pull-request commitlint configuration is present; its conditional execution will be exercised by the first pull request.
+Local OKF, lint, typecheck, test, Next.js build, and versioned Velocity JAR checks pass. Initial Gitea CI and release runs succeeded. Release `v1.0.0` provides a publicly downloadable JAR whose Velocity metadata reports `1.0.0`. Registry manifests were resolved for the published semantic-version tags. Release `v1.1.0` also publishes resolvable versioned web, Discord bot, and migration manifests and a public Velocity JAR whose metadata reports `1.1.0`. Release `v1.1.1` published immutable semantic-version tags only; prior `latest` digests remained unchanged. Pull-request commitlint configuration is present; its conditional execution will be exercised by the first pull request.
 
 # Related Stories
 

design/us-017-group-access.md

@@ -0,0 +1,44 @@
+---
+type: User Story
+title: Control Minecraft admission with groups
+description: Administrators assign users to groups and enable Minecraft access through explicit group policy.
+tags: [admin, groups, authorization, velocity, security]
+timestamp: 2026-08-01T22:36:20Z
+story_id: US-017
+status: verified
+---
+
+# User Story
+
+As an administrator, I want to organize registered users into access groups, so that server admission can be enabled for selected communities while remaining off by default.
+
+# Acceptance Criteria
+
+- [x] Every registered user implicitly belongs to the protected `everyone` group.
+- [x] The `everyone` group is created with Minecraft access disabled.
+- [x] Administrators can create groups with access disabled by default.
+- [x] Administrators can add and remove users from non-default groups.
+- [x] Administrators can enable or disable Minecraft admission for each group.
+- [x] A registered player is admitted when any assigned group has access enabled.
+- [x] A registered player is denied when none of their groups has access enabled.
+- [x] Group creation, membership, and access-policy changes are audited.
+- [x] Users and administrators can inspect the user's effective group assignments.
+
+# Implementation
+
+- [`packages/database/src/schema.ts`](../packages/database/src/schema.ts)
+- [`packages/database/drizzle/0002_simple_queen_noir.sql`](../packages/database/drizzle/0002_simple_queen_noir.sql)
+- [`apps/web/src/app/admin/(console)/groups/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/page.tsx)
+- [`apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/%5BgroupId%5D/page.tsx)
+- [`apps/web/src/app/api/velocity/access/route.ts`](../apps/web/src/app/api/velocity/access/route.ts)
+
+# Validation
+
+- [`packages/auth/test/group-access.test.ts`](../packages/auth/test/group-access.test.ts)
+- Drizzle migration generation, TypeScript validation, tests, lint, and the production build must pass.
+
+# Related Stories
+
+- [Enforce registration at Velocity](us-009-velocity-admission.md)
+- [Manage users as an administrator](us-013-admin-user-management.md)
+- [Preserve an audit trail](us-010-audit-events.md)

docs/releases.md

@@ -32,13 +32,10 @@ Each release creates:
 
 - Gitea release asset `minecraft-account-manager-velocity-VERSION.jar`
 - `git.garvis.dev/dmg/minecraft-account-manager:VERSION`
-- `git.garvis.dev/dmg/minecraft-account-manager:latest`
 - `git.garvis.dev/dmg/minecraft-account-manager-bot:VERSION`
-- `git.garvis.dev/dmg/minecraft-account-manager-bot:latest`
 - `git.garvis.dev/dmg/minecraft-account-manager-migrate:VERSION`
-- `git.garvis.dev/dmg/minecraft-account-manager-migrate:latest`
 
-Use immutable version tags for deployments. `latest` is a convenience pointer to the newest release.
+Only immutable semantic-version tags are published. Mutable tags such as `latest` must never be used in deployments or release-asset URLs.
 
 ## Discord bot
 

docs/security-review.md

@@ -24,12 +24,14 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
 - Velocity credentials are high-entropy bearer tokens stored only as hashes.
 - Velocity requests have a 45-second clock window and database-unique request IDs for cross-instance replay prevention.
 - Velocity and its API fail closed.
+- Registered players require at least one enabled access group; the implicit `everyone` group starts disabled.
+- Group and membership mutations re-check the Keycloak administrator role server-side and are audited.
 - ORM-parameterized queries are used throughout.
 - CSP, clickjacking, MIME-sniffing, referrer, and browser-permission headers are configured.
 - Forwarded IP headers are ignored unless `TRUST_PROXY=true` is explicitly configured.
 - Private and reserved addresses are not sent to ProxyCheck.io; lookup results are cached to reduce disclosure and API usage.
 - Portal and game login events include approximate network location and VPN/proxy classification when available.
-- Secrets are excluded from logs and repository configuration.
+- Structured Pino logging redacts credential fields, and secrets are excluded from logs and repository configuration.
 
 ## Outstanding production requirements
 

package-lock.json

@@ -22,6 +22,7 @@
         "@minecraft-account-manager/auth": "*",
         "@minecraft-account-manager/contracts": "*",
         "@minecraft-account-manager/database": "*",
+        "@minecraft-account-manager/logging": "*",
         "discord.js": "^14.25.1",
         "dotenv": "^17.2.3",
         "drizzle-orm": "^0.45.1"
@@ -38,6 +39,7 @@
         "@minecraft-account-manager/auth": "*",
         "@minecraft-account-manager/contracts": "*",
         "@minecraft-account-manager/database": "*",
+        "@minecraft-account-manager/logging": "*",
         "@minecraft-account-manager/minecraft": "*",
         "@minecraft-account-manager/network": "*",
         "drizzle-orm": "^0.45.1",
@@ -1781,6 +1783,10 @@
       "resolved": "apps/discord-bot",
       "link": true
     },
+    "node_modules/@minecraft-account-manager/logging": {
+      "resolved": "packages/logging",
+      "link": true
+    },
     "node_modules/@minecraft-account-manager/minecraft": {
       "resolved": "packages/minecraft",
       "link": true
@@ -2038,6 +2044,12 @@
         "url": "https://github.com/sponsors/panva"
       }
     },
+    "node_modules/@pinojs/redact": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
+      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
+      "license": "MIT"
+    },
     "node_modules/@rolldown/binding-android-arm64": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.1.tgz",
@@ -3810,6 +3822,15 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/atomic-sleep": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
+      "integrity": "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
     "node_modules/available-typed-arrays": {
       "version": "1.0.7",
       "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.7.tgz",
@@ -7052,6 +7073,15 @@
         "node": "^10.13.0 || >=12.0.0"
       }
     },
+    "node_modules/on-exit-leak-free": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
+      "integrity": "sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/openid-client": {
       "version": "5.7.1",
       "resolved": "https://registry.npmjs.org/openid-client/-/openid-client-5.7.1.tgz",
@@ -7220,6 +7250,43 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/pino": {
+      "version": "10.3.1",
+      "resolved": "https://registry.npmjs.org/pino/-/pino-10.3.1.tgz",
+      "integrity": "sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==",
+      "license": "MIT",
+      "dependencies": {
+        "@pinojs/redact": "^0.4.0",
+        "atomic-sleep": "^1.0.0",
+        "on-exit-leak-free": "^2.1.0",
+        "pino-abstract-transport": "^3.0.0",
+        "pino-std-serializers": "^7.0.0",
+        "process-warning": "^5.0.0",
+        "quick-format-unescaped": "^4.0.3",
+        "real-require": "^0.2.0",
+        "safe-stable-stringify": "^2.3.1",
+        "sonic-boom": "^4.0.1",
+        "thread-stream": "^4.0.0"
+      },
+      "bin": {
+        "pino": "bin.js"
+      }
+    },
+    "node_modules/pino-abstract-transport": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/pino-abstract-transport/-/pino-abstract-transport-3.0.0.tgz",
+      "integrity": "sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==",
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.0.0"
+      }
+    },
+    "node_modules/pino-std-serializers": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-7.1.0.tgz",
+      "integrity": "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==",
+      "license": "MIT"
+    },
     "node_modules/possible-typed-array-names": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",
@@ -7317,6 +7384,22 @@
       "integrity": "sha512-WuxUnVtlWL1OfZFQFuqvnvs6MiAGk9UNsBostyBOB0Is9wb5uRESevA6rnl/rkksXaGX3GzZhPup5d6Vp1nFew==",
       "license": "MIT"
     },
+    "node_modules/process-warning": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.1.0.tgz",
+      "integrity": "sha512-jQSaVHsPgtyw60e1rQ/A+/ArPEj/S8pS/vFnyGa/gYFXrKk/6RuDkoqVDQ5NI5MmS01698ltlAk0NoDBNLujRw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/prop-types": {
       "version": "15.8.1",
       "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz",
@@ -7360,6 +7443,12 @@
       ],
       "license": "MIT"
     },
+    "node_modules/quick-format-unescaped": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
+      "integrity": "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==",
+      "license": "MIT"
+    },
     "node_modules/react": {
       "version": "19.2.8",
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz",
@@ -7388,6 +7477,15 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/real-require": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/real-require/-/real-require-0.2.0.tgz",
+      "integrity": "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12.13.0"
+      }
+    },
     "node_modules/reflect.getprototypeof": {
       "version": "1.0.10",
       "resolved": "https://registry.npmjs.org/reflect.getprototypeof/-/reflect.getprototypeof-1.0.10.tgz",
@@ -7600,6 +7698,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/safe-stable-stringify": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
+      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/scheduler": {
       "version": "0.27.0",
       "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
@@ -7834,6 +7941,15 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/sonic-boom": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
+      "integrity": "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==",
+      "license": "MIT",
+      "dependencies": {
+        "atomic-sleep": "^1.0.0"
+      }
+    },
     "node_modules/source-map": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -7864,6 +7980,15 @@
         "source-map": "^0.6.0"
       }
     },
+    "node_modules/split2": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
+      "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">= 10.x"
+      }
+    },
     "node_modules/stable-hash": {
       "version": "0.0.5",
       "resolved": "https://registry.npmjs.org/stable-hash/-/stable-hash-0.0.5.tgz",
@@ -8106,6 +8231,24 @@
         "url": "https://opencollective.com/webpack"
       }
     },
+    "node_modules/thread-stream": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-4.2.0.tgz",
+      "integrity": "sha512-e2zZ96wSChazBsbENf/Pcm/4swHt2cEKQ92rhUjkL9GCKiTDJIaTBenjE/m9DXi0QBmTMDkFDdOomUy20A1tDQ==",
+      "license": "MIT",
+      "dependencies": {
+        "real-require": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/thread-stream/node_modules/real-require": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/real-require/-/real-require-1.0.0.tgz",
+      "integrity": "sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==",
+      "license": "MIT"
+    },
     "node_modules/tinybench": {
       "version": "2.9.0",
       "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
@@ -9215,6 +9358,18 @@
         "typescript": "^5.9.3"
       }
     },
+    "packages/logging": {
+      "name": "@minecraft-account-manager/logging",
+      "version": "0.1.0",
+      "dependencies": {
+        "pino": "^10.3.1"
+      },
+      "devDependencies": {
+        "@types/node": "^25.0.3",
+        "typescript": "^5.9.3",
+        "vitest": "^4.1.0"
+      }
+    },
     "packages/minecraft": {
       "name": "@minecraft-account-manager/minecraft",
       "version": "0.1.0",

packages/auth/src/index.ts

@@ -111,6 +111,10 @@ export function hashToken(token: string) {
   return createHash("sha256").update(token).digest("hex");
 }
 
+export function enabledAccessGroup<T extends { accessEnabled: boolean }>(assignedGroups: T[]) {
+  return assignedGroups.find((group) => group.accessEnabled) ?? null;
+}
+
 export function verifyHashedToken(providedToken: string, expectedHash: string) {
   const provided = Buffer.from(hashToken(providedToken), "utf8");
   const expected = Buffer.from(expectedHash, "utf8");

packages/auth/test/group-access.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vitest";
+import { enabledAccessGroup } from "../src/index";
+
+describe("group-based admission", () => {
+  it("denies default-off users and allows access when any assigned group is enabled", () => {
+    expect(enabledAccessGroup([{ name: "everyone", accessEnabled: false }])).toBeNull();
+    expect(enabledAccessGroup([
+      { name: "everyone", accessEnabled: false },
+      { name: "ops", accessEnabled: true },
+    ])).toEqual({ name: "ops", accessEnabled: true });
+  });
+});

packages/database/drizzle/0002_simple_queen_noir.sql

@@ -0,0 +1,25 @@
+CREATE TABLE "groups" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"name" varchar(50) NOT NULL,
+	"slug" varchar(50) NOT NULL,
+	"description" text,
+	"access_enabled" boolean DEFAULT false NOT NULL,
+	"is_default" boolean DEFAULT false NOT NULL,
+	"created_at" timestamp (3) with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp (3) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "user_group_memberships" (
+	"user_id" uuid NOT NULL,
+	"group_id" uuid NOT NULL,
+	"created_at" timestamp (3) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "user_group_memberships" ADD CONSTRAINT "user_group_memberships_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "user_group_memberships" ADD CONSTRAINT "user_group_memberships_group_id_groups_id_fk" FOREIGN KEY ("group_id") REFERENCES "public"."groups"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "groups_slug_uidx" ON "groups" USING btree (lower("slug"));--> statement-breakpoint
+CREATE UNIQUE INDEX "groups_one_default_uidx" ON "groups" USING btree ("is_default") WHERE "groups"."is_default" = true;--> statement-breakpoint
+CREATE UNIQUE INDEX "user_group_memberships_user_group_uidx" ON "user_group_memberships" USING btree ("user_id","group_id");--> statement-breakpoint
+CREATE INDEX "user_group_memberships_group_idx" ON "user_group_memberships" USING btree ("group_id");--> statement-breakpoint
+INSERT INTO "groups" ("name", "slug", "description", "access_enabled", "is_default")
+VALUES ('everyone', 'everyone', 'Default group containing every registered user.', false, true);

packages/database/drizzle/meta/_journal.json

@@ -15,6 +15,13 @@
       "when": 1785605590058,
       "tag": "0001_silent_ultragirl",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1785623198008,
+      "tag": "0002_simple_queen_noir",
+      "breakpoints": true
     }
   ]
 }

packages/database/src/auth-repository.ts

@@ -113,6 +113,7 @@ export async function findUserBySessionToken(db: Database, tokenHash: string, no
       id: users.id,
       discordUserId: users.discordUserId,
       discordUsername: users.discordUsername,
+      discordGlobalName: users.discordGlobalName,
       firstName: users.firstName,
       onboardingCompletedAt: users.onboardingCompletedAt,
       sessionExpiresAt: sessions.expiresAt,

packages/database/src/schema.ts

@@ -62,6 +62,40 @@ export const users = pgTable(
   (table) => [uniqueIndex("users_discord_user_id_uidx").on(table.discordUserId)],
 );
 
+export const groups = pgTable(
+  "groups",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    name: varchar("name", { length: 50 }).notNull(),
+    slug: varchar("slug", { length: 50 }).notNull(),
+    description: text("description"),
+    accessEnabled: boolean("access_enabled").notNull().default(false),
+    isDefault: boolean("is_default").notNull().default(false),
+    ...timestamps(),
+  },
+  (table) => [
+    uniqueIndex("groups_slug_uidx").on(sql`lower(${table.slug})`),
+    uniqueIndex("groups_one_default_uidx").on(table.isDefault).where(sql`${table.isDefault} = true`),
+  ],
+);
+
+export const userGroupMemberships = pgTable(
+  "user_group_memberships",
+  {
+    userId: uuid("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    groupId: uuid("group_id")
+      .notNull()
+      .references(() => groups.id, { onDelete: "cascade" }),
+    createdAt: createdAt(),
+  },
+  (table) => [
+    uniqueIndex("user_group_memberships_user_group_uidx").on(table.userId, table.groupId),
+    index("user_group_memberships_group_idx").on(table.groupId),
+  ],
+);
+
 export const minecraftAccounts = pgTable(
   "minecraft_accounts",
   {

packages/logging/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@minecraft-account-manager/logging",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "exports": { ".": "./src/index.ts" },
+  "scripts": {
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "pino": "^10.3.1"
+  },
+  "devDependencies": {
+    "@types/node": "^25.0.3",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.0"
+  }
+}

packages/logging/src/index.ts

@@ -0,0 +1,35 @@
+import pino, { type DestinationStream, type Logger } from "pino";
+
+const redactedPaths = [
+  "apiKey",
+  "authorization",
+  "password",
+  "token",
+  "*.apiKey",
+  "*.authorization",
+  "*.password",
+  "*.token",
+  "headers.authorization",
+  "req.headers.authorization",
+];
+
+export function createLogger(
+  service: string,
+  options: { destination?: DestinationStream } = {},
+): Logger {
+  return pino(
+    {
+      level: process.env.LOG_LEVEL?.trim() || "info",
+      base: {
+        service,
+        environment: process.env.NODE_ENV ?? "development",
+        version: process.env.APP_VERSION ?? "development",
+      },
+      redact: {
+        paths: redactedPaths,
+        censor: "[Redacted]",
+      },
+    },
+    options.destination,
+  );
+}

packages/logging/test/logger.test.ts

@@ -0,0 +1,31 @@
+import { Writable } from "node:stream";
+import { describe, expect, it } from "vitest";
+import { createLogger } from "../src/index";
+
+function captureLog() {
+  let output = "";
+  const destination = new Writable({
+    write(chunk, _encoding, callback) {
+      output += chunk.toString();
+      callback();
+    },
+  });
+  return { destination, read: () => JSON.parse(output.trim()) as Record<string, unknown> };
+}
+
+describe("structured application logging", () => {
+  it("emits service metadata and redacts credential fields", () => {
+    const capture = captureLog();
+    const logger = createLogger("account-manager-test", { destination: capture.destination });
+
+    logger.info({ token: "secret-token", apiKey: "secret-key", operation: "test" }, "Test event");
+
+    expect(capture.read()).toMatchObject({
+      service: "account-manager-test",
+      token: "[Redacted]",
+      apiKey: "[Redacted]",
+      operation: "test",
+      msg: "Test event",
+    });
+  });
+});

packages/logging/tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": { "types": ["node", "vitest/globals"] },
+  "include": ["src/**/*.ts", "test/**/*.ts"]
+}

packages/minecraft/src/index.ts

@@ -46,6 +46,46 @@ export function formatManagedDiscordNickname(
   return [...firstName.trim()].slice(0, DISCORD_NICKNAME_LIMIT).join("").trimEnd();
 }
 
+export interface DiscordGuildIdentity {
+  id: string;
+  username: string;
+  globalName: string | null;
+  nickname: string | null;
+}
+
+export async function getGuildMemberIdentity(
+  input: { guildId: string; discordUserId: string; botToken: string },
+  request: typeof fetch = fetch,
+): Promise<DiscordGuildIdentity> {
+  const response = await request(
+    `https://discord.com/api/v10/guilds/${input.guildId}/members/${input.discordUserId}`,
+    {
+      headers: {
+        authorization: `Bot ${input.botToken}`,
+        accept: "application/json",
+      },
+      cache: "no-store",
+    },
+  );
+  if (!response.ok) throw new Error(`Discord guild member lookup failed (${response.status})`);
+
+  const payload: unknown = await response.json();
+  if (!payload || typeof payload !== "object") throw new Error("Discord guild member lookup returned invalid data");
+  const member = payload as { nick?: unknown; user?: unknown };
+  if (!member.user || typeof member.user !== "object") throw new Error("Discord guild member lookup omitted user data");
+  const user = member.user as { id?: unknown; username?: unknown; global_name?: unknown };
+  if (typeof user.id !== "string" || typeof user.username !== "string") {
+    throw new Error("Discord guild member lookup returned invalid user data");
+  }
+
+  return {
+    id: user.id,
+    username: user.username,
+    globalName: typeof user.global_name === "string" ? user.global_name : null,
+    nickname: typeof member.nick === "string" ? member.nick : null,
+  };
+}
+
 export async function updateGuildNickname(
   input: {
     guildId: string;

packages/minecraft/test/discord.test.ts

@@ -1,5 +1,25 @@
 import { describe, expect, it, vi } from "vitest";
-import { updateGuildNickname } from "../src/index";
+import { getGuildMemberIdentity, updateGuildNickname } from "../src/index";
+
+describe("Discord guild identity", () => {
+  it("reads the member username, global name, nickname, and immutable ID", async () => {
+    const request = vi.fn<typeof fetch>().mockResolvedValue(new Response(JSON.stringify({
+      nick: "Sam (Notch)",
+      user: { id: "987654321098765432", username: "samcraft", global_name: "Sam" },
+    }), { status: 200, headers: { "content-type": "application/json" } }));
+
+    await expect(getGuildMemberIdentity({
+      guildId: "123456789012345678",
+      discordUserId: "987654321098765432",
+      botToken: "secret",
+    }, request)).resolves.toEqual({
+      id: "987654321098765432",
+      username: "samcraft",
+      globalName: "Sam",
+      nickname: "Sam (Notch)",
+    });
+  });
+});
 
 describe("Discord nickname updates", () => {
   it("updates a member in the configured guild using bot authentication", async () => {

packages/network/src/index.ts

@@ -118,6 +118,26 @@ export class ProxyCheckProvider implements IpIntelligenceProvider {
   }
 }
 
+export function addressGroup(ipAddress: string) {
+  const hostAddress = ipAddress.split("/", 1)[0] ?? ipAddress;
+  if (!isIP(hostAddress)) return ipAddress;
+
+  let address = ipaddr.parse(hostAddress);
+  if (address instanceof ipaddr.IPv6 && address.isIPv4MappedAddress()) {
+    address = address.toIPv4Address();
+  }
+
+  const prefixLength = address.kind() === "ipv4" ? 24 : 64;
+  const bytes = address.toByteArray();
+  for (let bit = prefixLength; bit < bytes.length * 8; bit += 1) {
+    const byteIndex = Math.floor(bit / 8);
+    const bitMask = 1 << (7 - (bit % 8));
+    bytes[byteIndex] = (bytes[byteIndex] ?? 0) & ~bitMask;
+  }
+
+  return `${ipaddr.fromByteArray(bytes).toString()}/${prefixLength}`;
+}
+
 export function isPublicIp(ipAddress: string) {
   if (!isIP(ipAddress)) return false;
 

packages/network/test/address-groups.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vitest";
+import { addressGroup } from "../src/index";
+
+describe("access address groups", () => {
+  it("groups nearby IPv4 and IPv6 addresses by their stable network prefix", () => {
+    expect(addressGroup("198.51.100.21")).toBe("198.51.100.0/24");
+    expect(addressGroup("198.51.100.240")).toBe("198.51.100.0/24");
+    expect(addressGroup("198.51.100.99/32")).toBe("198.51.100.0/24");
+    expect(addressGroup("2001:db8:abcd:1234:1111::1")).toBe("2001:db8:abcd:1234::/64");
+    expect(addressGroup("2001:db8:abcd:1234:ffff::9")).toBe("2001:db8:abcd:1234::/64");
+  });
+});