fix(release): publish versioned images to Docker Hub

.gitea/workflows/release.yml

@@ -7,7 +7,6 @@ on:
 
 permissions:
   contents: write
-  packages: write
 
 jobs:
   release:
@@ -116,9 +115,9 @@ jobs:
             apt-get install -y docker-ce-cli
           fi
 
-      - name: Log in to Gitea container registry
+      - name: Log in to Docker Hub
         if: steps.release.outputs.created == 'true'
-        run: echo "${{ secrets.CONTAINER_REGISTRY_TOKEN }}" | docker login git.garvis.dev -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+        run: echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
 
       - name: Build and push web image
         if: steps.release.outputs.created == 'true'
@@ -129,9 +128,9 @@ jobs:
             --platform linux/amd64 \
             --target runner \
             --build-arg VERSION="$VERSION" \
-            -t "git.garvis.dev/dmg/minecraft-account-manager:${VERSION}" \
+            -t "dmgarvis/minecraft-account-manager:${VERSION}" \
             .
-          docker push "git.garvis.dev/dmg/minecraft-account-manager:${VERSION}"
+          docker push "dmgarvis/minecraft-account-manager:${VERSION}"
 
       - name: Build and push Discord bot image
         if: steps.release.outputs.created == 'true'
@@ -142,9 +141,9 @@ jobs:
             --platform linux/amd64 \
             --target bot \
             --build-arg VERSION="$VERSION" \
-            -t "git.garvis.dev/dmg/minecraft-account-manager-bot:${VERSION}" \
+            -t "dmgarvis/minecraft-account-manager-bot:${VERSION}" \
             .
-          docker push "git.garvis.dev/dmg/minecraft-account-manager-bot:${VERSION}"
+          docker push "dmgarvis/minecraft-account-manager-bot:${VERSION}"
 
       - name: Build and push migration image
         if: steps.release.outputs.created == 'true'
@@ -155,9 +154,9 @@ jobs:
             --platform linux/amd64 \
             --target migrate \
             --build-arg VERSION="$VERSION" \
-            -t "git.garvis.dev/dmg/minecraft-account-manager-migrate:${VERSION}" \
+            -t "dmgarvis/minecraft-account-manager-migrate:${VERSION}" \
             .
-          docker push "git.garvis.dev/dmg/minecraft-account-manager-migrate:${VERSION}"
+          docker push "dmgarvis/minecraft-account-manager-migrate:${VERSION}"
 
       - name: Create Gitea release and upload Velocity JAR
         if: steps.release.outputs.created == 'true'

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM node:22-alpine AS dependencies
+FROM node:22-alpine AS manifests
 WORKDIR /app
 RUN apk add --no-cache libc6-compat
 
@@ -13,8 +13,16 @@ COPY packages/database/package.json ./packages/database/package.json
 COPY packages/logging/package.json ./packages/logging/package.json
 COPY packages/minecraft/package.json ./packages/minecraft/package.json
 COPY packages/network/package.json ./packages/network/package.json
+
+FROM manifests AS dependencies
 RUN npm ci
 
+FROM manifests AS bot-dependencies
+RUN npm ci --omit=dev --workspace @minecraft-account-manager/discord-bot
+
+FROM manifests AS migration-dependencies
+RUN npm ci --omit=dev --workspace @minecraft-account-manager/database
+
 FROM dependencies AS builder
 COPY . .
 RUN npm run build --workspace @minecraft-account-manager/web
@@ -36,7 +44,7 @@ USER app
 EXPOSE 3000
 CMD ["node", "apps/web/server.js"]
 
-FROM dependencies AS bot
+FROM bot-dependencies AS bot
 ARG VERSION=development
 LABEL org.opencontainers.image.title="Minecraft Account Manager Discord Bot" \
       org.opencontainers.image.version="${VERSION}" \
@@ -51,7 +59,7 @@ COPY --chown=app:app packages ./packages
 USER app
 CMD ["npm", "run", "start", "--workspace", "@minecraft-account-manager/discord-bot"]
 
-FROM dependencies AS migrate
+FROM migration-dependencies AS migrate
 ARG VERSION=development
 LABEL org.opencontainers.image.title="Minecraft Account Manager Migrations" \
       org.opencontainers.image.version="${VERSION}" \

README.md

@@ -77,11 +77,12 @@ The token is displayed once and stored only as a SHA-256 hash.
 - PostgreSQL and Drizzle ORM
 - Keycloak OIDC for admin access with the `minecraft-account-manager-admin` role
 - Admin user search, account management, event exploration, DAU and confirmed-connection metrics, toggleable Natural Earth/OpenStreetMap user-location views, and automatic Discord nickname synchronization
-- Exclusive group admission: unassigned users fall back to protected `everyone`, and only the effective group's access setting applies
+- Exclusive group admission: unassigned users fall back to protected `everyone`, and administrators manage effective membership, access, recurring UTC login windows, and VPN/proxy/Tor exceptions through confirmed group workflows
 - Deployment-managed Discord guild ID and invite URL
 - discord.js bot with `/register` and `/account`
 - Java Edition online-mode accounts only
-- Velocity admission checks are fail closed
-- ProxyCheck.io geolocation and VPN/proxy/Tor detection with a 48-hour PostgreSQL cache
+- Velocity admission checks are fail closed; disabled group access overrides recurring schedules, which are evaluated only at login
+- Static denial-message templates support validated player/group variables and next scheduled UTC window guidance
+- ProxyCheck.io geolocation and VPN/proxy/Tor detection with a 48-hour PostgreSQL cache and group-scoped game-connection exceptions
 
 See [`docs/architecture.md`](docs/architecture.md) for trust boundaries and service responsibilities, [`docs/api-errors.md`](docs/api-errors.md) for the RFC 9457 API error contract, and [`docs/security-review.md`](docs/security-review.md) for implemented controls and production requirements, and [`docs/accessibility.md`](docs/accessibility.md) for the WCAG-oriented interface review.

apps/discord-bot/package.json

@@ -16,10 +16,10 @@
     "@minecraft-account-manager/logging": "*",
     "discord.js": "^14.25.1",
     "dotenv": "^17.2.3",
-    "drizzle-orm": "^0.45.1"
+    "drizzle-orm": "^0.45.1",
+    "tsx": "^4.21.0"
   },
   "devDependencies": {
-    "tsx": "^4.21.0",
     "typescript": "^5.9.3"
   }
 }

apps/web/package.json

@@ -29,6 +29,7 @@
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.2.1",
+    "@testing-library/react": "^16.3.2",
     "@types/d3-geo": "^3.1.1",
     "@types/leaflet": "^1.9.22",
     "@types/node": "^25.0.3",
@@ -37,6 +38,7 @@
     "@types/topojson-client": "^3.1.5",
     "eslint": "^9.39.4",
     "eslint-config-next": "^16.2.1",
+    "jsdom": "^30.0.1",
     "tailwindcss": "^4.2.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.0"

apps/web/src/app/account/page.tsx

@@ -63,7 +63,7 @@ export default async function AccountPage({
       .orderBy(desc(ipObservations.observedAt))
       .limit(100),
     discordIdentity(user),
-    db.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, isDefault: groups.isDefault })
+    db.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, anonymizedNetworksAllowed: groups.anonymizedNetworksAllowed, isDefault: groups.isDefault })
       .from(groups)
       .leftJoin(userGroupMemberships, eq(userGroupMemberships.groupId, groups.id))
       .where(or(eq(groups.isDefault, true), eq(userGroupMemberships.userId, user.id)))
@@ -192,8 +192,8 @@ export default async function AccountPage({
             </form>
             <section className="mt-8 border border-line bg-panel p-6">
               <p className="font-mono text-[10px] font-bold uppercase tracking-widest text-muted">Access groups</p>
-              {effectiveGroup ? <div className="mt-4 flex items-center justify-between gap-3"><span className="font-mono text-xs font-bold">{effectiveGroup.name}{effectiveGroup.isDefault ? " · default" : ""}</span><span className={`px-2 py-1 font-mono text-[9px] font-bold uppercase ${effectiveGroup.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{effectiveGroup.accessEnabled ? "Access on" : "Access off"}</span></div> : <p className="mt-4 text-sm text-accent">No default access group is configured.</p>}
-              <p className="mt-4 text-xs leading-5 text-muted">Your effective group alone determines Minecraft access.</p>
+              {effectiveGroup ? <div className="mt-4 flex flex-wrap items-center justify-between gap-3"><span className="font-mono text-xs font-bold">{effectiveGroup.name}{effectiveGroup.isDefault ? " · default" : ""}</span><div className="flex gap-2"><span className={`px-2 py-1 font-mono text-[9px] font-bold uppercase ${effectiveGroup.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{effectiveGroup.accessEnabled ? "Access on" : "Access off"}</span><span className="border border-line px-2 py-1 font-mono text-[9px] font-bold uppercase">VPN {effectiveGroup.anonymizedNetworksAllowed ? "allowed" : "denied"}</span></div></div> : <p className="mt-4 text-sm text-accent">No default access group is configured.</p>}
+              <p className="mt-4 text-xs leading-5 text-muted">Your effective group alone determines Minecraft and VPN/proxy/Tor access.</p>
             </section>
           </aside>
         </div>

apps/web/src/app/admin/(console)/actions.ts

@@ -1,32 +1,44 @@
 "use server";
 
-import { appSettings } from "@minecraft-account-manager/database";
+import { randomUUID } from "node:crypto";
+import { appSettings, events } from "@minecraft-account-manager/database";
+import { getClientIp } from "@minecraft-account-manager/network";
+import { eq } from "drizzle-orm";
+import { headers } from "next/headers";
 import { redirect } from "next/navigation";
+import { parseAdmissionMessages } from "@/lib/admission-settings";
 import { requireAdminSession } from "@/lib/auth/require-admin";
 import { db } from "@/lib/database";
 
-export async function saveDiscordSettings(formData: FormData) {
-  await requireAdminSession();
+export async function saveAdmissionSettings(formData: FormData) {
+  const admin = await requireAdminSession();
+  const messages = parseAdmissionMessages(formData);
+  if (!messages) redirect("/admin/settings?error=invalid-message");
 
-  const registrationMessage = String(formData.get("registrationMessage") ?? "").trim();
-
-  if (registrationMessage.length < 10 || registrationMessage.length > 500) {
-    redirect("/admin/settings?error=invalid-message");
-  }
-
-  await db
-    .insert(appSettings)
-    .values({
-      id: "default",
-      registrationMessage,
-    })
-    .onConflictDoUpdate({
-      target: appSettings.id,
-      set: {
-        registrationMessage,
-        updatedAt: new Date(),
-      },
-    });
+  const requestHeaders = await headers();
+  const ipAddress = getClientIp(requestHeaders, process.env.TRUST_PROXY === "true");
+  await db.transaction(async (tx) => {
+    const [previous] = await tx.select().from(appSettings).where(eq(appSettings.id, "default")).limit(1);
+    const changedFields = (Object.keys(messages) as Array<keyof typeof messages>)
+      .filter((field) => previous?.[field] !== messages[field]);
+    await tx.insert(appSettings)
+      .values({ id: "default", ...messages })
+      .onConflictDoUpdate({
+        target: appSettings.id,
+        set: { ...messages, updatedAt: new Date() },
+      });
+    if (changedFields.length) {
+      await tx.insert(events).values({
+        id: randomUUID(),
+        source: "/web/admin",
+        type: "games.minecraft.account-manager.settings.admission-messages-updated",
+        subject: "settings/default",
+        time: new Date(),
+        data: { changedFields, adminEmail: admin.email, adminName: admin.name },
+        ipAddress: ipAddress ?? null,
+      });
+    }
+  });
 
   redirect("/admin/settings?saved=1");
 }

apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx

@@ -1,15 +1,31 @@
-import { groups, userGroupMemberships, users } from "@minecraft-account-manager/database";
-import { asc, eq } from "drizzle-orm";
+import { groupAccessWindows, groups, minecraftAccounts, userGroupMemberships, users } from "@minecraft-account-manager/database";
+import { and, asc, desc, eq, isNull, sql } from "drizzle-orm";
+import type { ReactNode } from "react";
 import Link from "next/link";
 import { notFound } from "next/navigation";
+import { AdminModalForm } from "@/components/admin-modal-form";
+import { AdminUserTable } from "@/components/admin-user-table";
+import { GroupPolicyControl } from "@/components/group-policy-control";
+import { GroupScheduleEditor, GroupScheduleSummary } from "@/components/group-schedule-editor";
 import { db } from "@/lib/database";
-import { addGroupMember, assignDefaultGroup, deleteGroup, removeGroupMember, setGroupAccess } from "../actions";
+import { isEffectiveGroupMember } from "@/lib/group-management";
+import { assignUserGroupFromRegistry } from "../../users/actions";
+import { deleteGroup, replaceGroupSchedule, setGroupAccess, setGroupAnonymizedNetworkAccess, updateGroupDetails } from "../actions";
 
 const savedMessages: Record<string, string> = {
-  created: "Group created with access disabled.",
-  access: "Group access policy updated.",
-  "member-added": "User assigned to the group.",
-  "member-removed": "User returned to the default group.",
+  created: "Group created.",
+  details: "Group details updated.",
+  access: "Minecraft access policy updated.",
+  "network-access": "VPN, proxy, and Tor policy updated.",
+  schedule: "Weekly access schedule updated.",
+  group: "Member group updated.",
+};
+
+const errorMessages: Record<string, string> = {
+  "invalid-group": "Enter a valid name and a description of no more than 500 characters.",
+  "duplicate-group": "A group with that name already exists.",
+  "invalid-group-assignment": "The user or destination group no longer exists. No membership change was applied.",
+  "invalid-schedule": "Use valid, non-overlapping weekly access windows. Start and end cannot be identical.",
 };
 
 export const dynamic = "force-dynamic";
@@ -19,31 +35,48 @@ export default async function GroupPage({
   searchParams,
 }: {
   params: Promise<{ groupId: string }>;
-  searchParams: Promise<{ saved?: string }>;
+  searchParams: Promise<{ error?: string; saved?: string }>;
 }) {
   const { groupId } = await params;
   const query = await searchParams;
   const [group] = await db.select().from(groups).where(eq(groups.id, groupId)).limit(1);
   if (!group) notFound();
 
-  const [allUsers, memberships] = await Promise.all([
+  const [allUsers, allGroups, memberships, accessWindows] = await Promise.all([
     db.select({
       id: users.id,
       firstName: users.firstName,
       discordUsername: users.discordUsername,
       discordGlobalName: users.discordGlobalName,
       discordUserId: users.discordUserId,
-    }).from(users).orderBy(asc(users.discordUsername)),
+      onboardingCompletedAt: users.onboardingCompletedAt,
+      primaryUsername: minecraftAccounts.username,
+      accountCount: sql<number>`(
+        select count(*)::int from ${minecraftAccounts} account_count
+        where account_count.user_id = ${users.id}
+          and account_count.deleted_at is null
+      )`,
+    })
+      .from(users)
+      .leftJoin(minecraftAccounts, and(
+        eq(minecraftAccounts.userId, users.id),
+        eq(minecraftAccounts.isPrimary, true),
+        isNull(minecraftAccounts.deletedAt),
+      ))
+      .orderBy(users.firstName, users.discordUsername),
+    db.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault })
+      .from(groups).orderBy(desc(groups.isDefault), asc(groups.name)),
+    db.select({ userId: userGroupMemberships.userId, groupId: userGroupMemberships.groupId })
+      .from(userGroupMemberships),
     db.select({
-      userId: userGroupMemberships.userId,
-      groupId: userGroupMemberships.groupId,
-      groupName: groups.name,
-    }).from(userGroupMemberships).innerJoin(groups, eq(groups.id, userGroupMemberships.groupId)),
+      startMinuteOfWeek: groupAccessWindows.startMinuteOfWeek,
+      endMinuteOfWeek: groupAccessWindows.endMinuteOfWeek,
+    }).from(groupAccessWindows).where(eq(groupAccessWindows.groupId, group.id))
+      .orderBy(groupAccessWindows.startMinuteOfWeek),
   ]);
-  const assignmentByUser = new Map(memberships.map((membership) => [membership.userId, membership]));
-  const memberCount = group.isDefault
-    ? allUsers.length - assignmentByUser.size
-    : memberships.filter((membership) => membership.groupId === group.id).length;
+  const assignmentByUser = Object.fromEntries(memberships.map((membership) => [membership.userId, membership.groupId]));
+  const memberUsers = allUsers.filter((user) => isEffectiveGroupMember(user.id, assignmentByUser, group));
+  const returnTo = `/admin/groups/${group.id}`;
 
   return (
     <main className="mx-auto max-w-6xl px-6 py-12">
@@ -52,74 +85,66 @@ export default async function GroupPage({
         <div>
           <p className="font-mono text-xs font-bold uppercase tracking-[0.25em] text-accent">Access group</p>
           <div className="mt-4 flex flex-wrap items-center gap-3"><h1 className="font-display text-5xl font-black uppercase sm:text-7xl">{group.name}</h1>{group.isDefault && <span className="bg-ink px-3 py-2 font-mono text-[9px] font-bold uppercase text-canvas">Default</span>}</div>
-          <p className="mt-3 max-w-2xl text-sm leading-6 text-muted">{group.description ?? "No description."}</p>
+          <p className="mt-3 max-w-2xl whitespace-pre-line text-sm leading-6 text-muted">{group.description ?? "No description."}</p>
         </div>
-        <form action={setGroupAccess} className="border-l-2 border-accent pl-5">
+        <AdminModalForm
+          action={updateGroupDetails}
+          description={group.isDefault ? "Update the protected default group's description. Its name remains everyone." : "Update the administrator-facing name and description. The internal slug remains stable."}
+          submitLabel="Save details"
+          title={`Edit ${group.name}`}
+          triggerClassName="border border-ink px-5 py-3 font-mono text-[10px] font-bold uppercase tracking-wider"
+          triggerLabel="Edit group"
+        >
           <input name="groupId" type="hidden" value={group.id} />
-          <input name="accessEnabled" type="hidden" value={group.accessEnabled ? "no" : "yes"} />
-          <p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Minecraft admission</p>
-          <p className="mt-2 font-display text-2xl font-black uppercase">{group.accessEnabled ? "Allowed" : "Denied"}</p>
-          <button className="mt-3 font-mono text-[9px] font-bold uppercase text-accent underline underline-offset-4" type="submit">Turn access {group.accessEnabled ? "off" : "on"}</button>
-        </form>
+          <div className="space-y-5">
+            <label className="block text-sm font-bold">Name<input className="mt-2 w-full border border-line bg-canvas px-4 py-3 font-normal outline-none focus:border-accent read-only:cursor-not-allowed read-only:text-muted" defaultValue={group.name} maxLength={50} name="name" readOnly={group.isDefault} required /></label>
+            <label className="block text-sm font-bold">Description<textarea className="mt-2 min-h-32 w-full resize-y border border-line bg-canvas px-4 py-3 font-normal outline-none focus:border-accent" defaultValue={group.description ?? ""} maxLength={500} name="description" /></label>
+          </div>
+        </AdminModalForm>
       </header>
 
-      {query.saved && <p className="mt-7 border-l-2 border-signal bg-panel px-5 py-4 font-mono text-xs font-bold uppercase tracking-wider" role="status">{savedMessages[query.saved] ?? "Group updated."}</p>}
+      {query.saved && <p className="mt-7 border-l-2 border-signal bg-panel px-5 py-4 text-sm" role="status">{savedMessages[query.saved] ?? "Group updated."}</p>}
+      {query.error && <p className="mt-7 border-l-2 border-accent bg-panel px-5 py-4 text-sm text-accent" role="alert">{errorMessages[query.error] ?? "The group operation failed."}</p>}
 
-      <section className="mt-10">
-        <div className="flex items-end justify-between border-b border-line pb-4">
-          <div><p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Membership</p><h2 className="mt-2 font-display text-3xl font-black uppercase">Registered users</h2></div>
-          <span className="font-mono text-xs text-muted">{memberCount} members</span>
+      <section aria-labelledby="group-policy-heading" className="mt-10 border border-line bg-panel p-6 shadow-[6px_6px_0_var(--color-shadow)]">
+        <div className="border-b border-line pb-4"><p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Admission controls</p><h2 className="mt-2 font-display text-3xl font-black uppercase" id="group-policy-heading">Group policies</h2></div>
+        <div className="mt-6 grid gap-6 sm:grid-cols-2">
+          <PolicyDetail description="Controls whether members can connect to Minecraft. Disabled access always overrides the schedule." label="Minecraft access"><GroupPolicyControl action={setGroupAccess} enabled={group.accessEnabled} groupId={group.id} groupName={group.name} memberCount={memberUsers.length} policy="Minecraft access" returnLocation="detail" /></PolicyDetail>
+          <PolicyDetail description="Allows confirmed VPN, proxy, and Tor connections after access and schedule checks pass." label="VPN / proxy / Tor"><GroupPolicyControl action={setGroupAnonymizedNetworkAccess} enabled={group.anonymizedNetworksAllowed} groupId={group.id} groupName={group.name} memberCount={memberUsers.length} policy="VPN / proxy / Tor" returnLocation="detail" /></PolicyDetail>
         </div>
-        {group.isDefault && <p className="border-b border-line bg-panel px-5 py-4 text-sm text-muted">Users belong to <strong className="text-ink">everyone</strong> only while they have no explicit group assignment.</p>}
-        <div className="divide-y divide-line">
-          {allUsers.map((user) => {
-            const assignment = assignmentByUser.get(user.id);
-            const isMember = group.isDefault ? !assignment : assignment?.groupId === group.id;
-            return (
-              <article className="grid gap-4 py-5 sm:grid-cols-[1fr_auto] sm:items-center" key={user.id}>
-                <div>
-                  <Link className="font-mono text-sm font-bold underline decoration-line underline-offset-4 hover:decoration-accent" href={`/admin/users/${user.id}`}>{user.firstName ?? user.discordGlobalName ?? user.discordUsername}</Link>
-                  <p className="mt-1 font-mono text-[10px] text-muted">@{user.discordUsername} · {user.discordUserId}</p>
-                  {!isMember && assignment && <p className="mt-1 text-xs text-muted">Currently assigned to {assignment.groupName}</p>}
-                </div>
-                {isMember ? (
-                  group.isDefault ? <span className="font-mono text-[9px] font-bold uppercase text-muted">Default assignment</span> : (
-                    <form action={removeGroupMember}>
-                      <input name="groupId" type="hidden" value={group.id} />
-                      <input name="userId" type="hidden" value={user.id} />
-                      <button className="font-mono text-[9px] font-bold uppercase text-accent underline underline-offset-4" type="submit">Return to everyone</button>
-                    </form>
-                  )
-                ) : (
-                  <form action={group.isDefault ? assignDefaultGroup : addGroupMember}>
-                    <input name="groupId" type="hidden" value={group.id} />
-                    <input name="userId" type="hidden" value={user.id} />
-                    <button className="font-mono text-[9px] font-bold uppercase text-ink underline underline-offset-4" type="submit">Move to {group.name}</button>
-                  </form>
-                )}
-              </article>
-            );
-          })}
-          {!allUsers.length && <p className="py-8 text-sm text-muted">No registered users yet.</p>}
+        <div className="mt-7 scroll-mt-6 border-t border-line pt-6" id="group-schedule">
+          <div className="flex flex-col gap-5 sm:flex-row sm:items-start sm:justify-between">
+            <div className="max-w-2xl"><h3 className="font-mono text-xs font-bold uppercase">Weekly access schedule</h3><p className="mt-2 text-xs leading-5 text-muted">When Minecraft access is enabled, members may log in only during these recurring UTC windows. Existing sessions are not disconnected when a window ends.</p><div className="mt-4"><GroupScheduleSummary windows={accessWindows} /></div></div>
+            <AdminModalForm action={replaceGroupSchedule} description={`Replace the complete weekly access schedule for ${group.name}. Minecraft access must still be enabled.`} submitLabel="Save schedule" title={`Schedule ${group.name}`} triggerClassName="shrink-0 border border-ink px-4 py-3 font-mono text-[10px] font-bold uppercase tracking-wider" triggerLabel="Edit schedule">
+              <input name="groupId" type="hidden" value={group.id} />
+              <GroupScheduleEditor windows={accessWindows} />
+            </AdminModalForm>
+          </div>
         </div>
       </section>
 
+      <section className="mt-10" aria-labelledby="group-members-heading">
+        <div className="flex items-end justify-between border-b border-line pb-4">
+          <div><p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Effective membership</p><h2 className="mt-2 font-display text-3xl font-black uppercase" id="group-members-heading">Members</h2></div>
+          <span className="font-mono text-xs text-muted">{memberUsers.length} {memberUsers.length === 1 ? "member" : "members"}</span>
+        </div>
+        <p className="border-x border-line bg-panel px-5 py-4 text-sm text-muted">{group.isDefault ? <>These users have no explicit assignment and therefore use <strong className="text-ink">everyone</strong>.</> : <>Choose another group to move a member, or choose <strong className="text-ink">everyone</strong> to remove the member from {group.name}. Every change requires confirmation.</>}</p>
+        <div className="mt-5"><AdminUserTable action={assignUserGroupFromRegistry} assignmentByUser={assignmentByUser} emptyMessage="This group has no effective members." groups={allGroups} returnTo={returnTo} users={memberUsers} /></div>
+      </section>
+
       {!group.isDefault && (
-        <section className="mt-12 border border-accent bg-panel p-6">
-          <p className="font-mono text-[10px] font-bold uppercase tracking-widest text-accent">Danger zone</p>
-          <h2 className="mt-3 font-display text-2xl font-black uppercase">Delete {group.name}</h2>
-          <p className="mt-3 max-w-2xl text-sm leading-6 text-muted">Deleting this group returns its {memberCount} {memberCount === 1 ? "member" : "members"} to the protected default group. This cannot be undone.</p>
-          <details className="mt-5">
-            <summary className="w-fit cursor-pointer font-mono text-[10px] font-bold uppercase text-accent underline underline-offset-4">Review deletion</summary>
-            <form action={deleteGroup} className="mt-4 flex flex-wrap items-center gap-4">
-              <input name="groupId" type="hidden" value={group.id} />
-              <input name="confirmDelete" type="hidden" value="yes" />
-              <button className="bg-accent px-5 py-3 font-mono text-[10px] font-bold uppercase tracking-wider text-canvas" type="submit">Delete group permanently</button>
-              <span className="text-xs text-muted">Members will use everyone immediately.</span>
-            </form>
-          </details>
+        <section className="mt-12 flex flex-col gap-5 border border-accent bg-panel p-6 sm:flex-row sm:items-center sm:justify-between">
+          <div><p className="font-mono text-[10px] font-bold uppercase tracking-widest text-accent">Danger zone</p><h2 className="mt-2 font-display text-2xl font-black uppercase">Delete {group.name}</h2><p className="mt-2 max-w-2xl text-sm leading-6 text-muted">All {memberUsers.length} effective {memberUsers.length === 1 ? "member" : "members"} will return to everyone.</p></div>
+          <AdminModalForm action={deleteGroup} description={`Permanently delete ${group.name} and return ${memberUsers.length} ${memberUsers.length === 1 ? "member" : "members"} to everyone. This cannot be undone.`} intent="danger" submitLabel="Delete group" title={`Delete ${group.name}?`} triggerClassName="bg-accent px-5 py-3 font-mono text-[10px] font-bold uppercase tracking-wider text-canvas" triggerLabel="Delete group">
+            <input name="groupId" type="hidden" value={group.id} />
+            <input name="confirmDelete" type="hidden" value="yes" />
+          </AdminModalForm>
         </section>
       )}
     </main>
   );
 }
+
+function PolicyDetail({ children, description, label }: { children: ReactNode; description: string; label: string }) {
+  return <div className="flex items-center justify-between gap-5 border-l-2 border-accent pl-5"><div><h3 className="font-mono text-xs font-bold uppercase">{label}</h3><p className="mt-2 text-xs leading-5 text-muted">{description}</p></div>{children}</div>;
+}

apps/web/src/app/admin/(console)/groups/actions.schedule.test.ts

@@ -0,0 +1,98 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const actionState = vi.hoisted(() => ({
+  selected: [] as unknown[][],
+  inserted: [] as unknown[],
+  deleted: 0,
+  authorized: 0,
+  failAudit: false,
+}));
+
+vi.mock("@/lib/auth/require-admin", () => ({
+  requireAdminSession: async () => {
+    actionState.authorized += 1;
+    return { email: "admin@example.test", name: "Admin" };
+  },
+}));
+
+vi.mock("next/headers", () => ({ headers: async () => new Headers() }));
+vi.mock("next/navigation", () => ({
+  redirect: (path: string) => {
+    throw new Error(`REDIRECT:${path}`);
+  },
+}));
+
+vi.mock("@/lib/database", () => {
+  function selection(response: unknown[]) {
+    const chain: Record<string, unknown> = {};
+    for (const method of ["from", "where", "orderBy"]) chain[method] = () => chain;
+    chain.limit = () => Promise.resolve(response);
+    chain.then = (resolve: (value: unknown[]) => unknown, reject: (reason: unknown) => unknown) =>
+      Promise.resolve(response).then(resolve, reject);
+    return chain;
+  }
+  const tx = {
+    execute: async () => undefined,
+    select: () => selection(actionState.selected.shift() ?? []),
+    delete: () => ({ where: async () => { actionState.deleted += 1; } }),
+    insert: () => ({
+      values: async (value: unknown) => {
+        if (actionState.failAudit && !Array.isArray(value)) throw new Error("audit unavailable");
+        actionState.inserted.push(value);
+      },
+    }),
+  };
+  return { db: { transaction: async (callback: (transaction: typeof tx) => Promise<unknown>) => callback(tx) } };
+});
+
+import { replaceGroupSchedule } from "./actions";
+
+function scheduleForm() {
+  const formData = new FormData();
+  formData.set("groupId", "11111111-1111-4111-8111-111111111111");
+  formData.append("startMinuteOfWeek", "6960");
+  formData.append("endMinuteOfWeek", "7200");
+  return formData;
+}
+
+describe("replaceGroupSchedule", () => {
+  beforeEach(() => {
+    actionState.selected = [
+      [{ id: "11111111-1111-4111-8111-111111111111", name: "Friday friends" }],
+      [{ startMinuteOfWeek: 480, endMinuteOfWeek: 540 }],
+    ];
+    actionState.inserted = [];
+    actionState.deleted = 0;
+    actionState.authorized = 0;
+    actionState.failAudit = false;
+  });
+
+  it("reauthorizes and replaces all windows with an audit in one transaction", async () => {
+    await expect(replaceGroupSchedule(scheduleForm())).rejects.toThrow("REDIRECT:/admin/groups/11111111-1111-4111-8111-111111111111?saved=schedule");
+    expect(actionState.authorized).toBe(1);
+    expect(actionState.deleted).toBe(1);
+    expect(actionState.inserted[0]).toEqual([{
+      groupId: "11111111-1111-4111-8111-111111111111",
+      startMinuteOfWeek: 6960,
+      endMinuteOfWeek: 7200,
+    }]);
+    expect(actionState.inserted[1]).toEqual(expect.objectContaining({
+      type: "games.minecraft.account-manager.group.schedule-updated",
+      data: expect.objectContaining({
+        previousWindows: [{ startMinuteOfWeek: 480, endMinuteOfWeek: 540 }],
+        windows: [{ startMinuteOfWeek: 6960, endMinuteOfWeek: 7200 }],
+        adminEmail: "admin@example.test",
+      }),
+    }));
+  });
+
+  it("does not report success when the atomic audit write fails", async () => {
+    actionState.failAudit = true;
+    await expect(replaceGroupSchedule(scheduleForm())).rejects.toThrow("audit unavailable");
+    expect(actionState.inserted).toEqual([[{
+      groupId: "11111111-1111-4111-8111-111111111111",
+      startMinuteOfWeek: 6960,
+      endMinuteOfWeek: 7200,
+    }]]);
+  });
+});

apps/web/src/app/admin/(console)/groups/actions.ts

@@ -1,150 +1,214 @@
 "use server";
 
 import { randomUUID } from "node:crypto";
-import { events, groups, userGroupMemberships, users } from "@minecraft-account-manager/database";
+import { events, groupAccessWindows, groups, userGroupMemberships } from "@minecraft-account-manager/database";
 import { getClientIp } from "@minecraft-account-manager/network";
-import { and, eq } from "drizzle-orm";
+import { and, eq, ne, sql } from "drizzle-orm";
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
-import { recordAdminSubjectEvent } from "@/lib/audit";
 import { requireAdminSession } from "@/lib/auth/require-admin";
 import { db } from "@/lib/database";
+import { editableGroupName, groupSlug, validateGroupDetails } from "@/lib/group-management";
+import { parseScheduleWindows } from "@/lib/group-schedule";
 
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+
+type Admin = Awaited<ReturnType<typeof requireAdminSession>>;
+type ReturnLocation = "list" | "detail";
 
 function groupPath(groupId: string, query?: string) {
   return `/admin/groups/${encodeURIComponent(groupId)}${query ? `?${query}` : ""}`;
 }
 
+function returnLocation(formData: FormData): ReturnLocation {
+  return formData.get("returnLocation") === "list" ? "list" : "detail";
+}
+
+function operationPath(groupId: string, location: ReturnLocation, query: string) {
+  return location === "list" ? `/admin/groups?${query}` : groupPath(groupId, query);
+}
+
+async function auditContext() {
+  const requestHeaders = await headers();
+  return getClientIp(requestHeaders, process.env.TRUST_PROXY === "true");
+}
+
+function auditData(admin: Admin, data: Record<string, unknown>) {
+  return { ...data, adminEmail: admin.email, adminName: admin.name };
+}
+
 export async function createGroup(formData: FormData) {
   const admin = await requireAdminSession();
-  const name = String(formData.get("name") ?? "").trim();
-  const slug = String(formData.get("slug") ?? "").trim().toLowerCase();
-  const description = String(formData.get("description") ?? "").trim();
-  if (name.length < 1 || name.length > 50 || !SLUG_PATTERN.test(slug) || slug.length > 50 || description.length > 500) {
-    redirect("/admin/groups?error=invalid-group");
-  }
+  const details = validateGroupDetails(formData.get("name"), formData.get("description"));
+  if (!details) redirect("/admin/groups?error=invalid-group");
+  const accessEnabled = formData.get("accessEnabled") === "yes";
+  const anonymizedNetworksAllowed = formData.get("anonymizedNetworksAllowed") === "yes";
+  const ipAddress = await auditContext();
 
-  let group: { id: string } | undefined;
+  let created: { id: string } | null = null;
   try {
-    [group] = await db.insert(groups).values({
-      name,
-      slug,
-      description: description || null,
-      accessEnabled: false,
-      isDefault: false,
-    }).returning({ id: groups.id });
+    created = await db.transaction(async (tx) => {
+      await tx.execute(sql`select pg_advisory_xact_lock(hashtext('minecraft-account-manager-group-identity'))`);
+      const [duplicate] = await tx.select({ id: groups.id }).from(groups)
+        .where(sql`lower(${groups.name}) = lower(${details.name})`).limit(1);
+      if (duplicate) return null;
+      const existing = await tx.select({ slug: groups.slug }).from(groups);
+      const slug = groupSlug(details.name, new Set(existing.map((group) => group.slug.toLowerCase())));
+      const [group] = await tx.insert(groups).values({
+        name: details.name,
+        slug,
+        description: details.description || null,
+        accessEnabled,
+        anonymizedNetworksAllowed,
+        isDefault: false,
+      }).returning({ id: groups.id });
+      if (!group) throw new Error("Group insert returned no row");
+      await tx.insert(events).values({
+        id: randomUUID(),
+        source: "/web/admin",
+        type: "games.minecraft.account-manager.group.created",
+        subject: `group/${group.id}`,
+        time: new Date(),
+        data: auditData(admin, {
+          name: details.name,
+          slug,
+          accessEnabled,
+          anonymizedNetworksAllowed,
+        }),
+        ipAddress: ipAddress ?? null,
+      });
+      return group;
+    });
   } catch {
-    redirect("/admin/groups?error=duplicate-group");
+    redirect("/admin/groups?error=create-failed");
   }
-  if (!group) redirect("/admin/groups?error=create-failed");
+  if (!created) redirect("/admin/groups?error=duplicate-group");
+  redirect(groupPath(created.id, "saved=created"));
+}
 
-  await recordAdminSubjectEvent(admin, `group/${group.id}`, "games.minecraft.account-manager.group.created", {
-    name,
-    slug,
-    accessEnabled: false,
+export async function updateGroupDetails(formData: FormData) {
+  const admin = await requireAdminSession();
+  const groupId = String(formData.get("groupId") ?? "");
+  const details = validateGroupDetails(formData.get("name"), formData.get("description"));
+  if (!UUID_PATTERN.test(groupId) || !details) redirect(operationPath(groupId, "detail", "error=invalid-group"));
+  const ipAddress = await auditContext();
+
+  const result = await db.transaction(async (tx) => {
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('minecraft-account-manager-group-identity'))`);
+    await tx.execute(sql`select ${groups.id} from ${groups} where ${groups.id} = ${groupId} for update`);
+    const [current] = await tx.select().from(groups).where(eq(groups.id, groupId)).limit(1);
+    if (!current) return "missing" as const;
+    const name = editableGroupName(current.name, current.isDefault, details.name);
+    if (!current.isDefault) {
+      const [duplicate] = await tx.select({ id: groups.id }).from(groups)
+        .where(and(sql`lower(${groups.name}) = lower(${name})`, ne(groups.id, current.id))).limit(1);
+      if (duplicate) return "duplicate" as const;
+    }
+    const [updated] = await tx.update(groups).set({ name, description: details.description || null, updatedAt: new Date() })
+      .where(eq(groups.id, current.id)).returning({ id: groups.id });
+    if (!updated) return "missing" as const;
+    await tx.insert(events).values({
+      id: randomUUID(),
+      source: "/web/admin",
+      type: "games.minecraft.account-manager.group.details-updated",
+      subject: `group/${current.id}`,
+      time: new Date(),
+      data: auditData(admin, {
+        previousName: current.name,
+        name,
+        previousDescription: current.description,
+        description: details.description || null,
+      }),
+      ipAddress: ipAddress ?? null,
+    });
+    return "updated" as const;
   });
-  redirect(groupPath(group.id, "saved=created"));
+  if (result === "missing") redirect("/admin/groups?error=unknown-group");
+  if (result === "duplicate") redirect(groupPath(groupId, "error=duplicate-group"));
+  redirect(groupPath(groupId, "saved=details"));
+}
+
+async function updateGroupPolicy(
+  formData: FormData,
+  policy: "access" | "anonymized-networks",
+) {
+  const admin = await requireAdminSession();
+  const groupId = String(formData.get("groupId") ?? "");
+  const location = returnLocation(formData);
+  if (!UUID_PATTERN.test(groupId)) redirect("/admin/groups?error=unknown-group");
+  const enabled = formData.get("enabled") === "yes";
+  const ipAddress = await auditContext();
+
+  const group = await db.transaction(async (tx) => {
+    await tx.execute(sql`select ${groups.id} from ${groups} where ${groups.id} = ${groupId} for update`);
+    const [current] = await tx.select().from(groups).where(eq(groups.id, groupId)).limit(1);
+    if (!current) return null;
+    const update = policy === "access" ? { accessEnabled: enabled } : { anonymizedNetworksAllowed: enabled };
+    const [updated] = await tx.update(groups).set({ ...update, updatedAt: new Date() })
+      .where(eq(groups.id, current.id)).returning({ id: groups.id });
+    if (!updated) return null;
+    await tx.insert(events).values({
+      id: randomUUID(),
+      source: "/web/admin",
+      type: policy === "access"
+        ? "games.minecraft.account-manager.group.access-updated"
+        : "games.minecraft.account-manager.group.anonymized-network-access-updated",
+      subject: `group/${current.id}`,
+      time: new Date(),
+      data: auditData(admin, {
+        name: current.name,
+        previousEnabled: policy === "access" ? current.accessEnabled : current.anonymizedNetworksAllowed,
+        enabled,
+      }),
+      ipAddress: ipAddress ?? null,
+    });
+    return current;
+  });
+  if (!group) redirect("/admin/groups?error=unknown-group");
+  redirect(operationPath(group.id, location, `saved=${policy === "access" ? "access" : "network-access"}`));
 }
 
 export async function setGroupAccess(formData: FormData) {
-  const admin = await requireAdminSession();
-  const groupId = String(formData.get("groupId") ?? "");
-  const accessEnabled = formData.get("accessEnabled") === "yes";
-  if (!UUID_PATTERN.test(groupId)) redirect("/admin/groups?error=unknown-group");
-
-  const [group] = await db.update(groups).set({ accessEnabled, updatedAt: new Date() })
-    .where(eq(groups.id, groupId)).returning({ id: groups.id, name: groups.name });
-  if (!group) redirect("/admin/groups?error=unknown-group");
-
-  await recordAdminSubjectEvent(admin, `group/${group.id}`, "games.minecraft.account-manager.group.access-updated", {
-    name: group.name,
-    accessEnabled,
-  });
-  redirect(groupPath(group.id, "saved=access"));
+  return updateGroupPolicy(formData, "access");
 }
 
-export async function addGroupMember(formData: FormData) {
-  const admin = await requireAdminSession();
-  const groupId = String(formData.get("groupId") ?? "");
-  const userId = String(formData.get("userId") ?? "");
-  if (!UUID_PATTERN.test(groupId) || !UUID_PATTERN.test(userId)) redirect("/admin/groups?error=invalid-membership");
-
-  const [[group], [user]] = await Promise.all([
-    db.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault }).from(groups).where(eq(groups.id, groupId)).limit(1),
-    db.select({ id: users.id }).from(users).where(eq(users.id, userId)).limit(1),
-  ]);
-  if (!group || !user || group.isDefault) redirect("/admin/groups?error=invalid-membership");
-
-  const previousGroup = await db.transaction(async (tx) => {
-    const [previous] = await tx
-      .select({ id: groups.id, name: groups.name })
-      .from(userGroupMemberships)
-      .innerJoin(groups, eq(groups.id, userGroupMemberships.groupId))
-      .where(eq(userGroupMemberships.userId, user.id))
-      .limit(1);
-    await tx.delete(userGroupMemberships).where(eq(userGroupMemberships.userId, user.id));
-    await tx.insert(userGroupMemberships).values({ groupId: group.id, userId: user.id });
-    return previous ?? null;
-  });
-  await recordAdminSubjectEvent(admin, `user/${user.id}`, "games.minecraft.account-manager.group.assignment-updated", {
-    groupId: group.id,
-    groupName: group.name,
-    previousGroupId: previousGroup?.id ?? null,
-    previousGroupName: previousGroup?.name ?? "everyone",
-  });
-  redirect(groupPath(group.id, "saved=member-added"));
+export async function setGroupAnonymizedNetworkAccess(formData: FormData) {
+  return updateGroupPolicy(formData, "anonymized-networks");
 }
 
-export async function removeGroupMember(formData: FormData) {
+export async function replaceGroupSchedule(formData: FormData) {
   const admin = await requireAdminSession();
   const groupId = String(formData.get("groupId") ?? "");
-  const userId = String(formData.get("userId") ?? "");
-  if (!UUID_PATTERN.test(groupId) || !UUID_PATTERN.test(userId)) redirect("/admin/groups?error=invalid-membership");
+  const windows = parseScheduleWindows(formData);
+  if (!UUID_PATTERN.test(groupId) || !windows) redirect(groupPath(groupId, "error=invalid-schedule"));
+  const ipAddress = await auditContext();
 
-  const [group] = await db.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault })
-    .from(groups).where(eq(groups.id, groupId)).limit(1);
-  if (!group || group.isDefault) redirect("/admin/groups?error=invalid-membership");
-
-  await db.delete(userGroupMemberships).where(and(
-    eq(userGroupMemberships.groupId, group.id),
-    eq(userGroupMemberships.userId, userId),
-  ));
-  await recordAdminSubjectEvent(admin, `user/${userId}`, "games.minecraft.account-manager.group.assignment-removed", {
-    groupId: group.id,
-    groupName: group.name,
-    fallbackGroup: "everyone",
+  const updated = await db.transaction(async (tx) => {
+    await tx.execute(sql`select ${groups.id} from ${groups} where ${groups.id} = ${groupId} for update`);
+    const [group] = await tx.select({ id: groups.id, name: groups.name }).from(groups)
+      .where(eq(groups.id, groupId)).limit(1);
+    if (!group) return null;
+    const previous = await tx.select({
+      startMinuteOfWeek: groupAccessWindows.startMinuteOfWeek,
+      endMinuteOfWeek: groupAccessWindows.endMinuteOfWeek,
+    }).from(groupAccessWindows).where(eq(groupAccessWindows.groupId, group.id));
+    await tx.delete(groupAccessWindows).where(eq(groupAccessWindows.groupId, group.id));
+    if (windows.length) {
+      await tx.insert(groupAccessWindows).values(windows.map((window) => ({ ...window, groupId: group.id })));
+    }
+    await tx.insert(events).values({
+      id: randomUUID(),
+      source: "/web/admin",
+      type: "games.minecraft.account-manager.group.schedule-updated",
+      subject: `group/${group.id}`,
+      time: new Date(),
+      data: auditData(admin, { name: group.name, previousWindows: previous, windows }),
+      ipAddress: ipAddress ?? null,
+    });
+    return group;
   });
-  redirect(groupPath(group.id, "saved=member-removed"));
-}
-
-export async function assignDefaultGroup(formData: FormData) {
-  const admin = await requireAdminSession();
-  const groupId = String(formData.get("groupId") ?? "");
-  const userId = String(formData.get("userId") ?? "");
-  if (!UUID_PATTERN.test(groupId) || !UUID_PATTERN.test(userId)) redirect("/admin/groups?error=invalid-membership");
-
-  const [[defaultGroup], [user]] = await Promise.all([
-    db.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault }).from(groups).where(eq(groups.id, groupId)).limit(1),
-    db.select({ id: users.id }).from(users).where(eq(users.id, userId)).limit(1),
-  ]);
-  if (!defaultGroup?.isDefault || !user) redirect("/admin/groups?error=invalid-membership");
-
-  const [previous] = await db
-    .select({ id: groups.id, name: groups.name })
-    .from(userGroupMemberships)
-    .innerJoin(groups, eq(groups.id, userGroupMemberships.groupId))
-    .where(eq(userGroupMemberships.userId, user.id))
-    .limit(1);
-  await db.delete(userGroupMemberships).where(eq(userGroupMemberships.userId, user.id));
-  await recordAdminSubjectEvent(admin, `user/${user.id}`, "games.minecraft.account-manager.group.assignment-updated", {
-    groupId: defaultGroup.id,
-    groupName: defaultGroup.name,
-    previousGroupId: previous?.id ?? null,
-    previousGroupName: previous?.name ?? null,
-  });
-  redirect(groupPath(defaultGroup.id, "saved=member-added"));
+  if (!updated) redirect("/admin/groups?error=unknown-group");
+  redirect(groupPath(updated.id, "saved=schedule"));
 }
 
 export async function deleteGroup(formData: FormData) {
@@ -152,40 +216,32 @@ export async function deleteGroup(formData: FormData) {
   const groupId = String(formData.get("groupId") ?? "");
   const confirmed = formData.get("confirmDelete") === "yes";
   if (!UUID_PATTERN.test(groupId) || !confirmed) redirect("/admin/groups?error=invalid-delete");
-  const requestHeaders = await headers();
-  const ipAddress = getClientIp(requestHeaders, process.env.TRUST_PROXY === "true");
+  const ipAddress = await auditContext();
 
   const deleted = await db.transaction(async (tx) => {
-    const [group] = await tx
-      .select({ id: groups.id, name: groups.name, slug: groups.slug, isDefault: groups.isDefault })
-      .from(groups)
-      .where(eq(groups.id, groupId))
-      .limit(1);
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('minecraft-account-manager-group-membership'))`);
+    await tx.execute(sql`select ${groups.id} from ${groups} where ${groups.id} = ${groupId} for update`);
+    const [group] = await tx.select().from(groups).where(eq(groups.id, groupId)).limit(1);
     if (!group || group.isDefault) return null;
-    const members = await tx
-      .select({ userId: userGroupMemberships.userId })
-      .from(userGroupMemberships)
-      .where(eq(userGroupMemberships.groupId, group.id));
+    const members = await tx.select({ userId: userGroupMemberships.userId })
+      .from(userGroupMemberships).where(eq(userGroupMemberships.groupId, group.id));
     await tx.insert(events).values({
       id: randomUUID(),
       source: "/web/admin",
       type: "games.minecraft.account-manager.group.deleted",
       subject: `group/${group.id}`,
       time: new Date(),
-      data: {
+      data: auditData(admin, {
         name: group.name,
         slug: group.slug,
         affectedUsers: members.length,
         fallbackGroup: "everyone",
-        adminEmail: admin.email,
-        adminName: admin.name,
-      },
+      }),
       ipAddress: ipAddress ?? null,
     });
     await tx.delete(groups).where(eq(groups.id, group.id));
     return group;
   });
   if (!deleted) redirect("/admin/groups?error=protected-group");
-
   redirect("/admin/groups?saved=deleted");
 }

apps/web/src/app/admin/(console)/groups/page.tsx

@@ -1,84 +1,109 @@
-import { groups, userGroupMemberships, users } from "@minecraft-account-manager/database";
-import { asc, desc } from "drizzle-orm";
+import { groupAccessWindows, groups, userGroupMemberships, users } from "@minecraft-account-manager/database";
+import { asc, count, desc } from "drizzle-orm";
 import Link from "next/link";
+import { AdminModalForm } from "@/components/admin-modal-form";
+import { GroupPolicyControl } from "@/components/group-policy-control";
 import { db } from "@/lib/database";
-import { createGroup, setGroupAccess } from "./actions";
+import { effectiveGroupMemberCount } from "@/lib/group-management";
+import { groupScheduleStatus } from "@/lib/group-schedule";
+import { createGroup, setGroupAccess, setGroupAnonymizedNetworkAccess } from "./actions";
 
 const errors: Record<string, string> = {
-  "invalid-group": "Enter a name and a lowercase slug containing letters, numbers, or hyphens.",
-  "duplicate-group": "That group slug already exists.",
+  "invalid-group": "Enter a group name and an optional description of no more than 500 characters.",
+  "duplicate-group": "A group with that name already exists.",
   "create-failed": "The group could not be created.",
   "unknown-group": "That group no longer exists.",
-  "invalid-membership": "That membership change was invalid.",
   "invalid-delete": "Confirm the group deletion before continuing.",
   "protected-group": "The protected default group cannot be deleted.",
 };
 
+const savedMessages: Record<string, string> = {
+  deleted: "Group deleted. Its former members now use the default group.",
+  access: "Minecraft access policy updated.",
+  "network-access": "VPN, proxy, and Tor policy updated.",
+};
+
 export const dynamic = "force-dynamic";
 
 export default async function GroupsPage({ searchParams }: { searchParams: Promise<{ error?: string; saved?: string }> }) {
   const query = await searchParams;
-  const [allGroups, memberships, registeredUsers] = await Promise.all([
+  const [allGroups, memberships, [registeredUsers], scheduleCounts] = await Promise.all([
     db.select().from(groups).orderBy(desc(groups.isDefault), asc(groups.name)),
     db.select({ groupId: userGroupMemberships.groupId }).from(userGroupMemberships),
-    db.select({ id: users.id }).from(users),
+    db.select({ count: count() }).from(users),
+    db.select({ groupId: groupAccessWindows.groupId, count: count() })
+      .from(groupAccessWindows)
+      .groupBy(groupAccessWindows.groupId),
   ]);
-  const membershipCounts = new Map<string, number>();
-  for (const membership of memberships) {
-    membershipCounts.set(membership.groupId, (membershipCounts.get(membership.groupId) ?? 0) + 1);
-  }
-  const explicitlyAssignedUsers = memberships.length;
-
+  const scheduleCountByGroup = new Map(scheduleCounts.map((schedule) => [schedule.groupId, Number(schedule.count)]));
   return (
     <main className="mx-auto max-w-6xl px-6 py-14">
-      <header className="border-b border-line pb-8">
-        <p className="font-mono text-xs font-bold uppercase tracking-[0.25em] text-accent">Admission policy</p>
-        <h1 className="mt-4 font-display text-5xl font-black uppercase">Access groups</h1>
-        <p className="mt-5 max-w-2xl leading-7 text-muted">Each user has one effective group. Users without an explicit assignment fall back to <strong className="text-ink">everyone</strong>; Minecraft admission follows only that group’s access setting.</p>
+      <header className="flex flex-col gap-6 border-b border-line pb-8 sm:flex-row sm:items-end sm:justify-between">
+        <div>
+          <p className="font-mono text-xs font-bold uppercase tracking-[0.25em] text-accent">Admission policy</p>
+          <h1 className="mt-4 font-display text-5xl font-black uppercase">Access groups</h1>
+          <p className="mt-5 max-w-2xl leading-7 text-muted">One effective group controls Minecraft and VPN access. Every policy change asks for confirmation before it applies.</p>
+        </div>
+        <AdminModalForm
+          action={createGroup}
+          description="Create a named access group. Both policies start denied unless you explicitly enable them below."
+          submitLabel="Create group"
+          title="Add access group"
+          triggerClassName="border border-ink bg-ink px-5 py-3 font-mono text-[10px] font-bold uppercase tracking-wider text-canvas"
+          triggerLabel="Add group"
+        >
+          <div className="space-y-5">
+            <label className="block text-sm font-bold">Name<input autoComplete="off" className="mt-2 w-full border border-line bg-canvas px-4 py-3 font-normal outline-none focus:border-accent" maxLength={50} name="name" required /></label>
+            <label className="block text-sm font-bold">Description<textarea className="mt-2 min-h-28 w-full resize-y border border-line bg-canvas px-4 py-3 font-normal outline-none focus:border-accent" maxLength={500} name="description" /></label>
+            <PolicyCheckbox description="Allow members to connect to Minecraft." label="Minecraft access" name="accessEnabled" />
+            <PolicyCheckbox description="Allow confirmed VPN, proxy, and Tor connections." label="VPN / proxy / Tor exception" name="anonymizedNetworksAllowed" />
+          </div>
+        </AdminModalForm>
       </header>
 
       {query.error && <p className="mt-7 border-l-2 border-accent bg-panel px-5 py-4 text-sm text-accent" role="alert">{errors[query.error] ?? "The group operation failed."}</p>}
-      {query.saved === "deleted" && <p className="mt-7 border-l-2 border-signal bg-panel px-5 py-4 text-sm" role="status">Group deleted. Its former members now use the default group.</p>}
+      {query.saved && <p className="mt-7 border-l-2 border-signal bg-panel px-5 py-4 text-sm" role="status">{savedMessages[query.saved] ?? "Group updated."}</p>}
 
-      <section className="mt-10 grid gap-5 md:grid-cols-2">
-        {allGroups.map((group) => {
-          const memberCount = group.isDefault ? registeredUsers.length - explicitlyAssignedUsers : membershipCounts.get(group.id) ?? 0;
-          return (
-            <article className="border border-line bg-panel p-6 shadow-[5px_5px_0_var(--color-shadow)]" key={group.id}>
-              <div className="flex items-start justify-between gap-4">
-                <div>
-                  <div className="flex flex-wrap items-center gap-2">
-                    <h2 className="font-display text-2xl font-black uppercase">{group.name}</h2>
-                    {group.isDefault && <span className="bg-ink px-2 py-1 font-mono text-[9px] font-bold uppercase text-canvas">Default</span>}
-                  </div>
-                  <p className="mt-1 font-mono text-[10px] text-muted">{group.slug} · {memberCount} members</p>
-                </div>
-                <span className={`px-3 py-2 font-mono text-[9px] font-bold uppercase ${group.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{group.accessEnabled ? "Access on" : "Access off"}</span>
-              </div>
-              <p className="mt-4 min-h-12 text-sm leading-6 text-muted">{group.description ?? "No description."}</p>
-              <div className="mt-5 flex items-center justify-between gap-4 border-t border-line pt-4">
-                <Link className="font-mono text-[10px] font-bold uppercase underline underline-offset-4" href={`/admin/groups/${group.id}`}>Manage members</Link>
-                <form action={setGroupAccess}>
-                  <input name="groupId" type="hidden" value={group.id} />
-                  <input name="accessEnabled" type="hidden" value={group.accessEnabled ? "no" : "yes"} />
-                  <button className="font-mono text-[10px] font-bold uppercase text-accent underline underline-offset-4" type="submit">Turn access {group.accessEnabled ? "off" : "on"}</button>
-                </form>
-              </div>
-            </article>
-          );
-        })}
-      </section>
-
-      <form action={createGroup} className="mt-12 border border-line bg-panel p-7 shadow-[8px_8px_0_var(--color-shadow)]">
-        <p className="font-mono text-[10px] font-bold uppercase tracking-widest text-accent">Create a group</p>
-        <div className="mt-5 grid gap-5 sm:grid-cols-2">
-          <label className="text-sm font-bold">Name<input className="mt-2 w-full border border-line bg-canvas px-4 py-3 font-normal outline-none focus:border-accent" maxLength={50} name="name" required /></label>
-          <label className="text-sm font-bold">Slug<input className="mt-2 w-full border border-line bg-canvas px-4 py-3 font-mono font-normal outline-none focus:border-accent" maxLength={50} name="slug" pattern="[a-z0-9]+(?:-[a-z0-9]+)*" placeholder="ops" required /></label>
-        </div>
-        <label className="mt-5 block text-sm font-bold">Description<textarea className="mt-2 min-h-24 w-full border border-line bg-canvas px-4 py-3 font-normal outline-none focus:border-accent" maxLength={500} name="description" /></label>
-        <p className="mt-4 text-xs text-muted">New groups start with access disabled.</p>
-        <button className="mt-6 border border-ink bg-ink px-5 py-3 font-mono text-[10px] font-bold uppercase tracking-wider text-canvas" type="submit">Create group</button>
-      </form>
+      <div className="mt-9 overflow-x-auto border border-line bg-panel shadow-[8px_8px_0_var(--color-shadow)]">
+        <table className="w-full min-w-[880px] border-collapse text-left">
+          <caption className="sr-only">Access groups and their effective policies</caption>
+          <thead className="border-b border-line font-mono text-[10px] uppercase tracking-widest text-muted">
+            <tr><th className="p-4" scope="col">Name</th><th className="p-4" scope="col">Minecraft access</th><th className="p-4" scope="col">Schedule</th><th className="p-4" scope="col">VPN access</th><th className="p-4 text-right" scope="col">Users</th></tr>
+          </thead>
+          <tbody className="divide-y divide-line">
+            {allGroups.map((group) => {
+              const memberCount = effectiveGroupMemberCount(
+                Number(registeredUsers?.count ?? 0),
+                memberships.map((membership) => membership.groupId),
+                group,
+              );
+              const scheduleStatus = groupScheduleStatus(scheduleCountByGroup.get(group.id) ?? 0);
+              return (
+                <tr className="transition-colors hover:bg-canvas/60" key={group.id}>
+                  <th className="p-4 text-left" scope="row">
+                    <Link className="font-display text-xl font-black uppercase underline decoration-line underline-offset-4 hover:text-accent" href={`/admin/groups/${group.id}`}>{group.name}</Link>
+                    {group.isDefault && <span className="ml-3 bg-ink px-2 py-1 font-mono text-[8px] font-bold uppercase text-canvas">Default</span>}
+                  </th>
+                  <td className="p-4"><GroupPolicyControl action={setGroupAccess} enabled={group.accessEnabled} groupId={group.id} groupName={group.name} memberCount={memberCount} policy="Minecraft access" returnLocation="list" /></td>
+                  <td className="p-4"><Link aria-label={`${scheduleStatus}. Edit schedule for ${group.name}`} className={`font-mono text-[10px] font-bold uppercase underline underline-offset-4 ${scheduleStatus === "Unrestricted" ? "text-muted" : "text-accent"}`} href={`/admin/groups/${group.id}#group-schedule`}>{scheduleStatus}</Link></td>
+                  <td className="p-4"><GroupPolicyControl action={setGroupAnonymizedNetworkAccess} enabled={group.anonymizedNetworksAllowed} groupId={group.id} groupName={group.name} memberCount={memberCount} policy="VPN / proxy / Tor" returnLocation="list" /></td>
+                  <td className="p-4 text-right font-mono text-sm font-bold">{memberCount}</td>
+                </tr>
+              );
+            })}
+          </tbody>
+        </table>
+      </div>
+      <p className="mt-4 text-xs leading-5 text-muted">Users without an explicit assignment count toward <strong className="text-ink">everyone</strong>.</p>
     </main>
   );
 }
+
+function PolicyCheckbox({ description, label, name }: { description: string; label: string; name: string }) {
+  return (
+    <label className="flex cursor-pointer items-start justify-between gap-4 border border-line bg-canvas p-4">
+      <span><span className="block font-mono text-xs font-bold uppercase">{label}</span><span className="mt-1 block text-xs leading-5 text-muted">{description}</span></span>
+      <input className="mt-1 size-5 accent-[var(--color-accent)]" name={name} type="checkbox" value="yes" />
+    </label>
+  );
+}

apps/web/src/app/admin/(console)/settings/page.tsx

@@ -1,7 +1,8 @@
 import { appSettings } from "@minecraft-account-manager/database";
 import { eq } from "drizzle-orm";
+import { DEFAULT_ADMISSION_MESSAGES } from "@/lib/admission-settings";
 import { db } from "@/lib/database";
-import { saveDiscordSettings } from "../actions";
+import { saveAdmissionSettings } from "../actions";
 
 export const dynamic = "force-dynamic";
 
@@ -12,7 +13,12 @@ export default async function SettingsPage({
 }) {
   const query = await searchParams;
   const [settings] = await db.select().from(appSettings).where(eq(appSettings.id, "default")).limit(1);
-  const message = settings?.registrationMessage ?? "Please register your Minecraft account before joining.";
+  const messages = {
+    registrationMessage: settings?.registrationMessage ?? DEFAULT_ADMISSION_MESSAGES.registrationMessage,
+    groupAccessDeniedMessage: settings?.groupAccessDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.groupAccessDeniedMessage,
+    vpnDeniedMessage: settings?.vpnDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.vpnDeniedMessage,
+    scheduledAccessDeniedMessage: settings?.scheduledAccessDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.scheduledAccessDeniedMessage,
+  };
   const guildId = process.env.DISCORD_GUILD_ID?.trim();
   const inviteUrl = process.env.DISCORD_INVITE_URL?.trim();
 
@@ -29,23 +35,51 @@ export default async function SettingsPage({
           </dl>
         </section>
 
-        <form action={saveDiscordSettings} className="border border-line bg-panel p-7 shadow-[8px_8px_0_var(--color-shadow)] sm:p-9">
+        <form action={saveAdmissionSettings} className="border border-line bg-panel p-7 shadow-[8px_8px_0_var(--color-shadow)] sm:p-9">
           {query.saved && <p className="mb-6 border-l-2 border-signal pl-4 font-mono text-xs font-bold uppercase tracking-wider" role="status">Settings saved</p>}
           {query.error && <p className="mb-6 border-l-2 border-accent pl-4 text-sm" role="alert">Check the configuration value and try again.</p>}
 
-          <label className="block font-mono text-xs font-bold uppercase tracking-wider" htmlFor="registrationMessage">Denied-player message</label>
-          <textarea
-            className="mt-3 min-h-32 w-full resize-y border border-line bg-canvas px-4 py-3 text-sm leading-6 outline-none focus:border-accent"
-            defaultValue={message}
-            id="registrationMessage"
-            maxLength={500}
-            minLength={10}
-            name="registrationMessage"
-            required
-          />
+          <fieldset className="space-y-7">
+            <legend className="font-display text-2xl font-black uppercase">Minecraft denial messages</legend>
+            <p className="text-sm leading-6 text-muted">Each plain-text template is returned for one admission outcome. Messages must be between 10 and 500 characters. Registration, group, and network templates support <code>{"{player}"}</code> and <code>{"{group}"}</code>.</p>
+            <AdmissionMessageField description="Shown when the Minecraft identity is not registered. The unresolved group is everyone." label="Registration required" name="registrationMessage" value={messages.registrationMessage} />
+            <AdmissionMessageField description="Shown when the effective group has Minecraft access disabled." label="Group access disabled" name="groupAccessDeniedMessage" value={messages.groupAccessDeniedMessage} />
+            <AdmissionMessageField description="Shown outside a scheduled access window. Also supports {next_start} and {next_end}; generated times explicitly use UTC." label="Scheduled access denied" name="scheduledAccessDeniedMessage" value={messages.scheduledAccessDeniedMessage} />
+            <AdmissionMessageField description="Shown for VPN, proxy, or Tor connections when the effective group has no exception." label="VPN, proxy, or Tor denied" name="vpnDeniedMessage" value={messages.vpnDeniedMessage} />
+          </fieldset>
           <button className="mt-8 border border-ink bg-ink px-6 py-3 font-mono text-xs font-bold uppercase tracking-[0.16em] text-canvas hover:bg-accent" type="submit">Save configuration</button>
         </form>
       </div>
     </main>
   );
 }
+
+function AdmissionMessageField({
+  description,
+  label,
+  name,
+  value,
+}: {
+  description: string;
+  label: string;
+  name: "registrationMessage" | "groupAccessDeniedMessage" | "scheduledAccessDeniedMessage" | "vpnDeniedMessage";
+  value: string;
+}) {
+  const descriptionId = `${name}-description`;
+  return (
+    <div>
+      <label className="block font-mono text-xs font-bold uppercase tracking-wider" htmlFor={name}>{label}</label>
+      <p className="mt-2 text-xs leading-5 text-muted" id={descriptionId}>{description}</p>
+      <textarea
+        aria-describedby={descriptionId}
+        className="mt-3 min-h-28 w-full resize-y border border-line bg-canvas px-4 py-3 text-sm leading-6 outline-none focus:border-accent"
+        defaultValue={value}
+        id={name}
+        maxLength={500}
+        minLength={10}
+        name={name}
+        required
+      />
+    </div>
+  );
+}

apps/web/src/app/admin/(console)/users/[userId]/page.tsx

@@ -86,7 +86,7 @@ export default async function AdminUserPage({
       .orderBy(desc(ipObservations.observedAt))
       .limit(100),
     discordIdentity(user),
-    db.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, isDefault: groups.isDefault })
+    db.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, anonymizedNetworksAllowed: groups.anonymizedNetworksAllowed, isDefault: groups.isDefault })
       .from(groups)
       .leftJoin(userGroupMemberships, eq(userGroupMemberships.groupId, groups.id))
       .where(or(eq(groups.isDefault, true), eq(userGroupMemberships.userId, user.id)))
@@ -208,7 +208,7 @@ export default async function AdminUserPage({
 
           <section className="border border-line bg-panel p-6">
             <div className="flex items-center justify-between gap-3"><p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Access groups</p><Link className="font-mono text-[9px] font-bold uppercase underline underline-offset-4" href="/admin/groups">Manage</Link></div>
-            {effectiveGroup ? <div className="mt-4 flex items-center justify-between gap-3"><Link className="font-mono text-xs font-bold underline decoration-line underline-offset-4" href={`/admin/groups/${effectiveGroup.id}`}>{effectiveGroup.name}{effectiveGroup.isDefault ? " · default" : ""}</Link><span className={`px-2 py-1 font-mono text-[9px] font-bold uppercase ${effectiveGroup.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{effectiveGroup.accessEnabled ? "On" : "Off"}</span></div> : <p className="mt-4 text-sm text-accent">No effective group configured.</p>}
+            {effectiveGroup ? <div className="mt-4 flex flex-wrap items-center justify-between gap-3"><Link className="font-mono text-xs font-bold underline decoration-line underline-offset-4" href={`/admin/groups/${effectiveGroup.id}`}>{effectiveGroup.name}{effectiveGroup.isDefault ? " · default" : ""}</Link><div className="flex gap-2"><span className={`px-2 py-1 font-mono text-[9px] font-bold uppercase ${effectiveGroup.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{effectiveGroup.accessEnabled ? "Access on" : "Access off"}</span><span className="border border-line px-2 py-1 font-mono text-[9px] font-bold uppercase">VPN {effectiveGroup.anonymizedNetworksAllowed ? "allowed" : "denied"}</span></div></div> : <p className="mt-4 text-sm text-accent">No effective group configured.</p>}
           </section>
 
           <section className="border border-line bg-panel p-6">

apps/web/src/app/admin/(console)/users/actions.ts

@@ -1,16 +1,20 @@
 "use server";
 
+import { randomUUID } from "node:crypto";
 import {
   formatManagedDiscordNickname,
   lookupJavaProfile,
   updateGuildNickname,
 } from "@minecraft-account-manager/minecraft";
-import { minecraftAccounts, users } from "@minecraft-account-manager/database";
-import { and, eq, isNull, ne } from "drizzle-orm";
+import { events, groups, minecraftAccounts, userGroupMemberships, users } from "@minecraft-account-manager/database";
+import { getClientIp } from "@minecraft-account-manager/network";
+import { and, eq, isNull, ne, sql } from "drizzle-orm";
+import { headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { recordAdminEvent } from "@/lib/audit";
 import { requireAdminSession } from "@/lib/auth/require-admin";
 import { db } from "@/lib/database";
+import { adminGroupReturnPath } from "@/lib/group-management";
 
 const USERNAME_PATTERN = /^[A-Za-z0-9_]{3,16}$/;
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -72,6 +76,67 @@ async function recordSyncFailure(
   );
 }
 
+export async function assignUserGroupFromRegistry(formData: FormData) {
+  const admin = await requireAdminSession();
+  const userId = String(formData.get("userId") ?? "");
+  const groupId = String(formData.get("groupId") ?? "");
+  const returnTo = formData.get("returnTo");
+  if (!UUID_PATTERN.test(userId) || !UUID_PATTERN.test(groupId)) redirect(adminGroupReturnPath(returnTo, "error=invalid-group-assignment"));
+
+  const requestHeaders = await headers();
+  const ipAddress = getClientIp(requestHeaders, process.env.TRUST_PROXY === "true");
+  try {
+    await db.transaction(async (tx) => {
+      await tx.execute(sql`select pg_advisory_xact_lock(hashtext('minecraft-account-manager-group-membership'))`);
+      await tx.execute(sql`select ${groups.id} from ${groups} where ${groups.id} = ${groupId} for update`);
+      await tx.execute(sql`select ${users.id} from ${users} where ${users.id} = ${userId} for update`);
+      const [[user], [targetGroup]] = await Promise.all([
+        tx.select({ id: users.id }).from(users).where(eq(users.id, userId)).limit(1),
+        tx.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault }).from(groups).where(eq(groups.id, groupId)).limit(1),
+      ]);
+      if (!user || !targetGroup) throw new Error("User or destination group no longer exists");
+      const [membership] = await tx.select({ groupId: userGroupMemberships.groupId })
+        .from(userGroupMemberships).where(eq(userGroupMemberships.userId, user.id)).limit(1);
+      if (membership && membership.groupId !== targetGroup.id) {
+        await tx.execute(sql`select ${groups.id} from ${groups} where ${groups.id} = ${membership.groupId} for update`);
+      }
+      const [previous] = await tx.select({ id: groups.id, name: groups.name })
+        .from(userGroupMemberships)
+        .innerJoin(groups, eq(groups.id, userGroupMemberships.groupId))
+        .where(eq(userGroupMemberships.userId, user.id))
+        .limit(1);
+      if (targetGroup.isDefault) {
+        await tx.delete(userGroupMemberships).where(eq(userGroupMemberships.userId, user.id));
+      } else {
+        await tx.insert(userGroupMemberships).values({ userId: user.id, groupId: targetGroup.id })
+          .onConflictDoUpdate({
+            target: userGroupMemberships.userId,
+            set: { groupId: targetGroup.id },
+          });
+      }
+      await tx.insert(events).values({
+        id: randomUUID(),
+        source: "/web/admin",
+        type: "games.minecraft.account-manager.group.assignment-updated",
+        subject: `user/${user.id}`,
+        time: new Date(),
+        data: {
+          groupId: targetGroup.id,
+          groupName: targetGroup.name,
+          previousGroupId: previous?.id ?? null,
+          previousGroupName: previous?.name ?? "everyone",
+          adminEmail: admin.email,
+          adminName: admin.name,
+        },
+        ipAddress: ipAddress ?? null,
+      });
+    });
+  } catch {
+    redirect(adminGroupReturnPath(returnTo, "error=invalid-group-assignment"));
+  }
+  redirect(adminGroupReturnPath(returnTo, "saved=group"));
+}
+
 export async function updateUserName(formData: FormData) {
   const admin = await requireAdminSession();
   const userId = String(formData.get("userId") ?? "");

apps/web/src/app/admin/(console)/users/page.tsx

@@ -1,14 +1,15 @@
-import { minecraftAccounts, users } from "@minecraft-account-manager/database";
-import { and, eq, ilike, isNull, or, sql } from "drizzle-orm";
-import Link from "next/link";
+import { groups, minecraftAccounts, userGroupMemberships, users } from "@minecraft-account-manager/database";
+import { and, asc, desc, eq, ilike, isNull, or, sql } from "drizzle-orm";
+import { AdminUserTable } from "@/components/admin-user-table";
 import { db } from "@/lib/database";
+import { assignUserGroupFromRegistry } from "./actions";
 
 export const dynamic = "force-dynamic";
 
 export default async function AdminUsersPage({
   searchParams,
 }: {
-  searchParams: Promise<{ q?: string; error?: string }>;
+  searchParams: Promise<{ q?: string; error?: string; saved?: string }>;
 }) {
   const query = await searchParams;
   const search = query.q?.trim().slice(0, 100) ?? "";
@@ -31,33 +32,41 @@ export default async function AdminUsersPage({
       )
     : undefined;
 
-  const results = await db
-    .select({
-      id: users.id,
-      firstName: users.firstName,
-      discordUsername: users.discordUsername,
-      discordGlobalName: users.discordGlobalName,
-      discordUserId: users.discordUserId,
-      onboardingCompletedAt: users.onboardingCompletedAt,
-      primaryUsername: minecraftAccounts.username,
-      accountCount: sql<number>`(
-        select count(*)::int from ${minecraftAccounts} account_count
-        where account_count.user_id = ${users.id}
-          and account_count.deleted_at is null
-      )`,
-    })
-    .from(users)
-    .leftJoin(
-      minecraftAccounts,
-      and(
-        eq(minecraftAccounts.userId, users.id),
-        eq(minecraftAccounts.isPrimary, true),
-        isNull(minecraftAccounts.deletedAt),
-      ),
-    )
-    .where(where)
-    .orderBy(users.firstName, users.discordUsername)
-    .limit(100);
+  const [results, allGroups, memberships] = await Promise.all([
+    db
+      .select({
+        id: users.id,
+        firstName: users.firstName,
+        discordUsername: users.discordUsername,
+        discordGlobalName: users.discordGlobalName,
+        discordUserId: users.discordUserId,
+        onboardingCompletedAt: users.onboardingCompletedAt,
+        primaryUsername: minecraftAccounts.username,
+        accountCount: sql<number>`(
+          select count(*)::int from ${minecraftAccounts} account_count
+          where account_count.user_id = ${users.id}
+            and account_count.deleted_at is null
+        )`,
+      })
+      .from(users)
+      .leftJoin(
+        minecraftAccounts,
+        and(
+          eq(minecraftAccounts.userId, users.id),
+          eq(minecraftAccounts.isPrimary, true),
+          isNull(minecraftAccounts.deletedAt),
+        ),
+      )
+      .where(where)
+      .orderBy(users.firstName, users.discordUsername)
+      .limit(100),
+    db.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault })
+      .from(groups).orderBy(desc(groups.isDefault), asc(groups.name)),
+    db.select({ userId: userGroupMemberships.userId, groupId: userGroupMemberships.groupId })
+      .from(userGroupMemberships),
+  ]);
+  const assignmentByUser = Object.fromEntries(memberships.map((membership) => [membership.userId, membership.groupId]));
+  const returnTo = `/admin/users${search ? `?${new URLSearchParams({ q: search }).toString()}` : ""}`;
 
   return (
     <main className="mx-auto max-w-6xl px-6 py-14">
@@ -79,27 +88,11 @@ export default async function AdminUsersPage({
         </form>
       </div>
 
-      {query.error && <p className="mt-7 border-l-2 border-accent bg-panel px-5 py-4 text-sm text-accent" role="alert">The requested user could not be found.</p>}
+      {query.error && <p className="mt-7 border-l-2 border-accent bg-panel px-5 py-4 text-sm text-accent" role="alert">{query.error === "invalid-group-assignment" ? "The user or group no longer exists. No group change was applied." : "The requested user could not be found."}</p>}
+      {query.saved === "group" && <p className="mt-7 border-l-2 border-signal bg-panel px-5 py-4 text-sm" role="status">User group updated.</p>}
 
-      <div className="mt-8 overflow-x-auto border border-line bg-panel shadow-[8px_8px_0_var(--color-shadow)]">
-        <table className="w-full min-w-[760px] border-collapse text-left">
-          <caption className="sr-only">Registered portal users</caption>
-          <thead className="border-b border-line font-mono text-[10px] uppercase tracking-widest text-muted">
-            <tr><th className="p-4" scope="col">User</th><th className="p-4" scope="col">Discord</th><th className="p-4" scope="col">Primary</th><th className="p-4" scope="col">Accounts</th><th className="p-4" scope="col">Status</th></tr>
-          </thead>
-          <tbody className="divide-y divide-line">
-            {results.map((user) => (
-              <tr className="transition-colors hover:bg-canvas/60" key={user.id}>
-                <th className="p-4 text-left" scope="row"><Link className="font-display text-lg font-black underline decoration-line underline-offset-4 hover:text-accent" href={`/admin/users/${user.id}`}>{user.firstName ?? "Name needed"}</Link></th>
-                <td className="p-4"><div className="font-mono text-xs font-bold">{user.discordGlobalName ?? user.discordUsername}</div><div className="mt-1 font-mono text-[10px] text-muted">@{user.discordUsername}</div><div className="mt-1 font-mono text-[9px] text-muted">{user.discordUserId}</div></td>
-                <td className="p-4 font-mono text-xs">{user.primaryUsername ?? "—"}</td>
-                <td className="p-4 font-mono text-xs">{user.accountCount}</td>
-                <td className="p-4"><span className={`border px-2 py-1 font-mono text-[9px] uppercase tracking-wider ${user.onboardingCompletedAt ? "border-line text-muted" : "border-accent text-accent"}`}>{user.onboardingCompletedAt ? "Ready" : "Onboarding"}</span></td>
-              </tr>
-            ))}
-            {!results.length && <tr><td className="p-8 text-muted" colSpan={5}>No users match that search.</td></tr>}
-          </tbody>
-        </table>
+      <div className="mt-8">
+        <AdminUserTable action={assignUserGroupFromRegistry} assignmentByUser={assignmentByUser} emptyMessage="No users match that search." groups={allGroups} returnTo={returnTo} users={results} />
       </div>
       <p className="mt-4 font-mono text-[9px] uppercase tracking-widest text-muted">Showing up to 100 users</p>
     </main>

apps/web/src/app/api/velocity/access/route.schedule.test.ts

@@ -0,0 +1,136 @@
+import { hashToken } from "@minecraft-account-manager/auth";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const databaseState = vi.hoisted(() => ({
+  responses: [] as unknown[][],
+  inserted: [] as Array<Record<string, unknown>>,
+  isolationLevel: "",
+}));
+
+vi.mock("@/lib/database", () => {
+  function selection(response: unknown[]) {
+    const chain: Record<string, unknown> = {};
+    for (const method of ["from", "where", "innerJoin", "leftJoin", "orderBy"]) {
+      chain[method] = () => chain;
+    }
+    chain.limit = () => Promise.resolve(response);
+    chain.then = (resolve: (value: unknown[]) => unknown, reject: (reason: unknown) => unknown) =>
+      Promise.resolve(response).then(resolve, reject);
+    return chain;
+  }
+  const tx = {
+    select: () => selection(databaseState.responses.shift() ?? []),
+    insert: () => ({
+      values: (value: Record<string, unknown>) => {
+        databaseState.inserted.push(value);
+        return Promise.resolve();
+      },
+    }),
+    delete: () => ({ where: () => Promise.resolve() }),
+    update: () => ({ set: () => ({ where: () => Promise.resolve() }) }),
+  };
+  return {
+    db: {
+      select: () => selection(databaseState.responses.shift() ?? []),
+      transaction: async (callback: (transaction: typeof tx) => Promise<unknown>, options: { isolationLevel?: string }) => {
+        databaseState.isolationLevel = options?.isolationLevel ?? "";
+        return callback(tx);
+      },
+    },
+  };
+});
+
+vi.mock("@/lib/ip-intelligence", () => ({
+  getIpIntelligence: async () => ({ classification: "clear" }),
+  toAuditIpData: () => ({ classification: "clear" }),
+}));
+
+vi.mock("@/lib/logger", () => ({ logger: { error: vi.fn() } }));
+
+import { POST } from "./route";
+
+const messages = {
+  registrationMessage: "Register {player} in {group}.",
+  groupAccessDeniedMessage: "Disabled {player} in {group}.",
+  vpnDeniedMessage: "Network denied for {player} in {group}.",
+  scheduledAccessDeniedMessage: "Scheduled {player} in {group}: {next_start} / {next_end}.",
+};
+
+function utcMinuteOfWeek(value: Date) {
+  return ((value.getUTCDay() + 6) % 7) * 1440 + value.getUTCHours() * 60 + value.getUTCMinutes();
+}
+
+function normalized(value: number) {
+  return (value + 10080) % 10080;
+}
+
+function request() {
+  return new Request("http://localhost/api/velocity/access", {
+    method: "POST",
+    headers: { authorization: "Bearer route-secret", "content-type": "application/json" },
+    body: JSON.stringify({
+      requestId: "11111111-1111-4111-8111-111111111111",
+      serverId: "velocity-main",
+      minecraftUuid: "0123456789abcdef0123456789abcdef",
+      username: "AlexMC",
+      ipAddress: "203.0.113.10",
+      occurredAt: new Date().toISOString(),
+    }),
+  });
+}
+
+function arrange(group: { accessEnabled: boolean; anonymizedNetworksAllowed: boolean }, windows: Array<{ startMinuteOfWeek: number; endMinuteOfWeek: number }>) {
+  databaseState.responses = [
+    [{ secretHash: hashToken("route-secret") }],
+    [messages],
+    [{ id: "account-id", userId: "user-id", minecraftUuid: "0123456789abcdef0123456789abcdef", username: "AlexMC" }],
+    [{ id: "group-id", name: "Friday friends", ...group }],
+    [{ id: "everyone-id", name: "everyone", accessEnabled: false, anonymizedNetworksAllowed: false }],
+    windows,
+  ];
+}
+
+describe("Velocity scheduled admission integration", () => {
+  beforeEach(() => {
+    databaseState.responses = [];
+    databaseState.inserted = [];
+    databaseState.isolationLevel = "";
+  });
+
+  it("loads effective-group windows and returns a rendered schedule denial", async () => {
+    const minute = utcMinuteOfWeek(new Date());
+    arrange(
+      { accessEnabled: true, anonymizedNetworksAllowed: false },
+      [{ startMinuteOfWeek: normalized(minute + 60), endMinuteOfWeek: normalized(minute + 120) }],
+    );
+
+    const response = await POST(request());
+    const body = await response.json();
+    expect(body.allowed).toBe(false);
+    expect(body.message).toMatch(/^Scheduled AlexMC in Friday friends: .* UTC \/ .* UTC\.$/);
+    expect(databaseState.isolationLevel).toBe("repeatable read");
+    expect(databaseState.inserted).toContainEqual(expect.objectContaining({
+      type: "games.minecraft.account-manager.game.login.denied",
+      data: expect.objectContaining({ reason: "schedule_disallowed", accessGroup: "Friday friends" }),
+    }));
+  });
+
+  it("fails closed for malformed persisted windows while disabled access retains precedence", async () => {
+    const malformed = [
+      { startMinuteOfWeek: 100, endMinuteOfWeek: 200 },
+      { startMinuteOfWeek: 150, endMinuteOfWeek: 250 },
+    ];
+    arrange({ accessEnabled: true, anonymizedNetworksAllowed: true }, malformed);
+    expect(await (await POST(request())).json()).toMatchObject({ allowed: false, message: expect.stringContaining("unavailable") });
+    expect(databaseState.inserted).toContainEqual(expect.objectContaining({
+      data: expect.objectContaining({ reason: "schedule_disallowed" }),
+    }));
+
+    databaseState.inserted = [];
+    arrange({ accessEnabled: false, anonymizedNetworksAllowed: true }, malformed);
+    expect(await (await POST(request())).json()).toEqual({ allowed: false, message: "Disabled AlexMC in Friday friends." });
+    expect(databaseState.inserted).toContainEqual(expect.objectContaining({
+      data: expect.objectContaining({ reason: "group_access_disabled" }),
+    }));
+  });
+});

apps/web/src/app/api/velocity/access/route.ts

@@ -4,6 +4,7 @@ import { problemDetails, velocityAccessRequestSchema } from "@minecraft-account-
 import {
   appSettings,
   events,
+  groupAccessWindows,
   groups,
   ipObservations,
   minecraftAccounts,
@@ -13,14 +14,15 @@ import {
 } from "@minecraft-account-manager/database";
 import { and, eq, isNull, lt, sql } from "drizzle-orm";
 import { NextResponse } from "next/server";
+import { admissionDenialMessage, DEFAULT_ADMISSION_MESSAGES, renderAdmissionMessage } from "@/lib/admission-settings";
 import { db } from "@/lib/database";
 import { isUniqueConstraintViolation } from "@/lib/database-errors";
+import { evaluateRegisteredPlayerAdmission } from "@/lib/game-admission-policy";
 import { getIpIntelligence, toAuditIpData } from "@/lib/ip-intelligence";
 import { logger } from "@/lib/logger";
 import { problemInstance, problemResponse } from "@/lib/problem-response";
 
 const MAX_CLOCK_SKEW_MS = 45_000;
-const DEFAULT_DENIAL_MESSAGE = "Please register your Minecraft account before joining.";
 
 function methodNotAllowed(request: Request) {
   const response = problemResponse(problemDetails(
@@ -111,36 +113,16 @@ async function handleVelocityAccess(request: Request) {
   }
 
   const [settings] = await db.select().from(appSettings).where(eq(appSettings.id, "default")).limit(1);
-  const denialMessage = settings?.registrationMessage ?? DEFAULT_DENIAL_MESSAGE;
+  const admissionMessages = {
+    registrationMessage: settings?.registrationMessage ?? DEFAULT_ADMISSION_MESSAGES.registrationMessage,
+    groupAccessDeniedMessage: settings?.groupAccessDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.groupAccessDeniedMessage,
+    vpnDeniedMessage: settings?.vpnDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.vpnDeniedMessage,
+    scheduledAccessDeniedMessage: settings?.scheduledAccessDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.scheduledAccessDeniedMessage,
+  };
 
-  let [knownAccount] = await db
-    .select({ id: minecraftAccounts.id })
-    .from(minecraftAccounts)
-    .where(
-      and(
-        eq(minecraftAccounts.minecraftUuid, input.minecraftUuid),
-        isNull(minecraftAccounts.deletedAt),
-      ),
-    )
-    .limit(1);
-  if (!knownAccount) {
-    [knownAccount] = await db
-      .select({ id: minecraftAccounts.id })
-      .from(minecraftAccounts)
-      .where(
-        and(
-          isNull(minecraftAccounts.minecraftUuid),
-          sql`lower(${minecraftAccounts.username}) = lower(${input.username})`,
-          isNull(minecraftAccounts.deletedAt),
-        ),
-      )
-      .limit(1);
-  }
-
-  const intelligence = knownAccount
-    ? await getIpIntelligence(input.ipAddress)
-    : { classification: "unknown" as const, provider: null };
+  const intelligence = await getIpIntelligence(input.ipAddress);
   const auditIpData = toAuditIpData(intelligence);
+  const decisionAt = new Date();
 
   const decision = await db.transaction(async (tx) => {
       await tx.delete(pluginRequests).where(lt(pluginRequests.expiresAt, new Date()));
@@ -209,23 +191,43 @@ async function handleVelocityAccess(request: Request) {
           classification: intelligence.classification,
           observedAt: occurredAt,
         });
-        return { allowed: false as const, message: denialMessage };
+        return {
+          allowed: false as const,
+          message: renderAdmissionMessage(admissionDenialMessage("not_registered", admissionMessages), {
+            player: input.username,
+            group: "everyone",
+          }),
+        };
       }
 
       const [explicitGroup] = await tx
-        .select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled })
+        .select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, anonymizedNetworksAllowed: groups.anonymizedNetworksAllowed })
         .from(userGroupMemberships)
         .innerJoin(groups, eq(groups.id, userGroupMemberships.groupId))
         .where(eq(userGroupMemberships.userId, account.userId))
         .limit(1);
       const [defaultGroup] = await tx
-        .select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled })
+        .select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, anonymizedNetworksAllowed: groups.anonymizedNetworksAllowed })
         .from(groups)
         .where(eq(groups.isDefault, true))
         .limit(1);
       const effectiveGroup = resolveEffectiveGroup(explicitGroup ?? null, defaultGroup ?? null);
-
-      if (!effectiveGroup?.accessEnabled) {
+      const accessWindows = effectiveGroup
+        ? await tx.select({
+            startMinuteOfWeek: groupAccessWindows.startMinuteOfWeek,
+            endMinuteOfWeek: groupAccessWindows.endMinuteOfWeek,
+          }).from(groupAccessWindows).where(eq(groupAccessWindows.groupId, effectiveGroup.id))
+        : [];
+      const policyDecision = evaluateRegisteredPlayerAdmission({
+        group: effectiveGroup ?? null,
+        windows: accessWindows,
+        classification: intelligence.classification,
+        now: decisionAt,
+        player: input.username,
+        messages: admissionMessages,
+      });
+      if (!policyDecision.allowed) {
+        const denialReason = policyDecision.reason;
         await tx.insert(events).values({
           id: randomUUID(),
           source: `/velocity/${input.serverId}`,
@@ -235,7 +237,13 @@ async function handleVelocityAccess(request: Request) {
           actorUserId: account.userId,
           data: {
             username: input.username,
-            reason: "group_access_disabled",
+            reason: denialReason,
+            accessGroup: effectiveGroup?.name ?? null,
+            accessGroupId: effectiveGroup?.id ?? null,
+            nextScheduleWindow: policyDecision.nextWindow ? {
+              start: policyDecision.nextWindow.start.toISOString(),
+              end: policyDecision.nextWindow.end.toISOString(),
+            } : null,
             ipIntelligence: auditIpData,
           },
           ipAddress: input.ipAddress,
@@ -251,9 +259,14 @@ async function handleVelocityAccess(request: Request) {
           classification: intelligence.classification,
           observedAt: occurredAt,
         });
-        return { allowed: false as const, message: "Your account group does not currently have server access." };
+        return {
+          allowed: false as const,
+          message: policyDecision.message,
+        };
       }
 
+      if (!effectiveGroup) throw new Error("Effective access group is unavailable after admission approval");
+
       if (account.minecraftUuid !== input.minecraftUuid || account.username !== input.username) {
         await tx
           .update(minecraftAccounts)
@@ -304,13 +317,14 @@ async function handleVelocityAccess(request: Request) {
           uuidBackfilled: account.minecraftUuid === null,
           ipIntelligence: auditIpData,
           accessGroup: effectiveGroup.name,
+          accessGroupId: effectiveGroup.id,
         },
         ipAddress: input.ipAddress,
         correlationId: input.requestId,
       });
 
       return { allowed: true as const, message: "Account approved." };
-    });
+    }, { isolationLevel: "repeatable read" });
 
   return NextResponse.json(decision);
 }

apps/web/src/components/admin-modal-form.test.tsx

@@ -0,0 +1,59 @@
+// @vitest-environment jsdom
+
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { AdminModalForm } from "./admin-modal-form";
+
+beforeEach(() => {
+  HTMLDialogElement.prototype.showModal = function showModal() { this.open = true; };
+  HTMLDialogElement.prototype.close = function close() {
+    this.open = false;
+    this.dispatchEvent(new Event("close"));
+  };
+});
+
+describe("AdminModalForm", () => {
+  it("renders an accessible trigger, labelled dialog, cancellation, and pending-capable submit control", () => {
+    const markup = renderToStaticMarkup(
+      <AdminModalForm
+        action={async () => undefined}
+        description="Review this policy change before applying it."
+        submitLabel="Apply policy"
+        title="Change access policy"
+        triggerLabel="Change"
+      >
+        <input name="groupId" type="hidden" value="group-one" />
+      </AdminModalForm>,
+    );
+    expect(markup).toContain("Change access policy");
+    expect(markup).toContain("Review this policy change before applying it.");
+    expect(markup).toContain("<dialog");
+    expect(markup).toContain("aria-haspopup=\"dialog\"");
+    expect(markup).toContain("Cancel");
+    expect(markup).toContain("Apply policy");
+  });
+
+  it("opens, cancels, and prevents dismissal while the action is pending", async () => {
+    let finishAction!: () => void;
+    const action = vi.fn(() => new Promise<void>((resolve) => { finishAction = resolve; }));
+    render(<AdminModalForm action={action} description="Confirm it." submitLabel="Apply policy" title="Change access policy" triggerLabel="Change" />);
+
+    fireEvent.click(screen.getByRole("button", { name: "Change" }));
+    const dialog = screen.getByRole("dialog") as HTMLDialogElement;
+    expect(dialog.open).toBe(true);
+    fireEvent.click(screen.getByRole("button", { name: "Apply policy" }));
+    await waitFor(() => expect(action).toHaveBeenCalledOnce());
+    expect((screen.getByRole("button", { name: "Change" }) as HTMLButtonElement).disabled).toBe(true);
+
+    const cancelEvent = new Event("cancel", { bubbles: false, cancelable: true });
+    dialog.dispatchEvent(cancelEvent);
+    expect(cancelEvent.defaultPrevented).toBe(true);
+    expect(dialog.open).toBe(true);
+
+    finishAction();
+    await waitFor(() => expect((screen.getByRole("button", { name: "Change" }) as HTMLButtonElement).disabled).toBe(false));
+    fireEvent.click(screen.getByRole("button", { name: "Cancel" }));
+    expect(dialog.open).toBe(false);
+  });
+});

apps/web/src/components/admin-modal-form.tsx

@@ -0,0 +1,109 @@
+"use client";
+
+import type { ReactNode, RefObject } from "react";
+import { useEffect, useId, useRef, useState } from "react";
+import { useFormStatus } from "react-dom";
+
+export function AdminModalForm({
+  action,
+  children,
+  description,
+  intent = "default",
+  submitLabel,
+  title,
+  triggerClassName,
+  triggerLabel,
+  triggerPressed,
+}: {
+  action: (formData: FormData) => Promise<void>;
+  children?: ReactNode;
+  description: string;
+  intent?: "default" | "danger";
+  submitLabel: string;
+  title: string;
+  triggerClassName?: string;
+  triggerLabel: string;
+  triggerPressed?: boolean;
+}) {
+  const dialogRef = useRef<HTMLDialogElement>(null);
+  const titleId = useId();
+  const descriptionId = useId();
+  const [submitting, setSubmitting] = useState(false);
+  const [dialogGeneration, setDialogGeneration] = useState(0);
+  return (
+    <>
+      <button
+        aria-haspopup="dialog"
+        aria-pressed={triggerPressed}
+        className={triggerClassName ?? "font-mono text-[10px] font-bold uppercase underline underline-offset-4"}
+        disabled={submitting}
+        onClick={() => {
+          setDialogGeneration((generation) => generation + 1);
+          dialogRef.current?.showModal();
+        }}
+        type="button"
+      >
+        {triggerLabel}
+      </button>
+      <dialog
+        aria-describedby={descriptionId}
+        aria-labelledby={titleId}
+        className="admin-modal m-auto max-h-[90vh] w-[min(92vw,36rem)] overflow-y-auto border border-ink bg-panel p-0 text-ink shadow-[10px_10px_0_var(--color-shadow)] backdrop:bg-ink/70"
+        onCancel={(event) => { if (submitting) event.preventDefault(); }}
+        ref={dialogRef}
+      >
+        <form action={action} className="p-6 sm:p-8" onSubmit={() => setSubmitting(true)}>
+          <p className="font-mono text-[9px] font-bold uppercase tracking-[0.2em] text-accent">Confirm operation</p>
+          <h2 className="mt-3 font-display text-3xl font-black uppercase" id={titleId}>{title}</h2>
+          <p className="mt-3 text-sm leading-6 text-muted" id={descriptionId}>{description}</p>
+          {children && <div className="mt-6" key={dialogGeneration}>{children}</div>}
+          <ModalActions dialogRef={dialogRef} intent={intent} onPendingChange={setSubmitting} submitLabel={submitLabel} />
+        </form>
+      </dialog>
+    </>
+  );
+}
+
+function ModalActions({
+  dialogRef,
+  intent,
+  onPendingChange,
+  submitLabel,
+}: {
+  dialogRef: RefObject<HTMLDialogElement | null>;
+  intent: "default" | "danger";
+  onPendingChange: (pending: boolean) => void;
+  submitLabel: string;
+}) {
+  const { pending } = useFormStatus();
+  const observedPending = useRef(false);
+  useEffect(() => {
+    if (pending) {
+      observedPending.current = true;
+      onPendingChange(true);
+    } else if (observedPending.current) {
+      observedPending.current = false;
+      onPendingChange(false);
+    }
+  }, [onPendingChange, pending]);
+  return (
+    <div className="mt-8 flex flex-wrap justify-end gap-3 border-t border-line pt-5">
+      <button
+        className="border border-line px-5 py-3 font-mono text-[10px] font-bold uppercase tracking-wider disabled:opacity-50"
+        disabled={pending}
+        onClick={() => dialogRef.current?.close()}
+        type="button"
+      >
+        Cancel
+      </button>
+      <button
+        className={`px-5 py-3 font-mono text-[10px] font-bold uppercase tracking-wider text-canvas disabled:cursor-wait disabled:opacity-60 ${intent === "danger" ? "bg-accent" : "bg-ink"}`}
+        disabled={pending}
+        type="submit"
+      >
+        {pending ? "Applying…" : submitLabel}
+      </button>
+      <span aria-live="polite" className="sr-only">{pending ? "Operation in progress." : ""}</span>
+    </div>
+  );
+}

apps/web/src/components/admin-user-table.test.tsx

@@ -0,0 +1,30 @@
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it } from "vitest";
+import { AdminUserTable } from "./admin-user-table";
+
+describe("AdminUserTable", () => {
+  it("renders reusable identity and confirmed group controls", () => {
+    const markup = renderToStaticMarkup(<AdminUserTable
+      action={async () => undefined}
+      assignmentByUser={{ user1: "ops" }}
+      emptyMessage="No members."
+      groups={[{ id: "everyone", name: "everyone", isDefault: true }, { id: "ops", name: "Ops", isDefault: false }]}
+      returnTo="/admin/groups/11111111-1111-4111-8111-111111111111"
+      users={[{
+        id: "user1",
+        firstName: "Alex",
+        discordUsername: "alex",
+        discordGlobalName: "Alex Global",
+        discordUserId: "123",
+        onboardingCompletedAt: new Date("2026-08-01T00:00:00Z"),
+        primaryUsername: "AlexMC",
+        accountCount: 2,
+      }]}
+    />);
+    expect(markup).toContain("Alex Global");
+    expect(markup).toContain("AlexMC");
+    expect(markup).toContain("Accounts");
+    expect(markup).toContain("Group for Alex");
+    expect(markup).toContain("Confirm move");
+  });
+});

apps/web/src/components/admin-user-table.tsx

@@ -0,0 +1,54 @@
+import Link from "next/link";
+import { UserGroupSelect } from "./user-group-select";
+
+export interface AdminUserRow {
+  id: string;
+  firstName: string | null;
+  discordUsername: string;
+  discordGlobalName: string | null;
+  discordUserId: string;
+  onboardingCompletedAt: Date | null;
+  primaryUsername: string | null;
+  accountCount: number;
+}
+
+export function AdminUserTable({
+  action,
+  assignmentByUser,
+  emptyMessage,
+  groups,
+  returnTo,
+  users,
+}: {
+  action: (formData: FormData) => Promise<void>;
+  assignmentByUser: Record<string, string>;
+  emptyMessage: string;
+  groups: Array<{ id: string; name: string; isDefault: boolean }>;
+  returnTo: string;
+  users: AdminUserRow[];
+}) {
+  const defaultGroup = groups.find((group) => group.isDefault);
+  return (
+    <div className="overflow-x-auto border border-line bg-panel shadow-[8px_8px_0_var(--color-shadow)]">
+      <table className="w-full min-w-[900px] border-collapse text-left">
+        <caption className="sr-only">Registered portal users and effective groups</caption>
+        <thead className="border-b border-line font-mono text-[10px] uppercase tracking-widest text-muted">
+          <tr><th className="p-4" scope="col">User</th><th className="p-4" scope="col">Discord</th><th className="p-4" scope="col">Primary</th><th className="p-4" scope="col">Accounts</th><th className="p-4" scope="col">Group</th><th className="p-4" scope="col">Status</th></tr>
+        </thead>
+        <tbody className="divide-y divide-line">
+          {users.map((user) => (
+            <tr className="transition-colors hover:bg-canvas/60" key={user.id}>
+              <th className="p-4 text-left" scope="row"><Link className="font-display text-lg font-black underline decoration-line underline-offset-4 hover:text-accent" href={`/admin/users/${user.id}`}>{user.firstName ?? "Name needed"}</Link></th>
+              <td className="p-4"><div className="font-mono text-xs font-bold">{user.discordGlobalName ?? user.discordUsername}</div><div className="mt-1 font-mono text-[10px] text-muted">@{user.discordUsername}</div><div className="mt-1 font-mono text-[9px] text-muted">{user.discordUserId}</div></td>
+              <td className="p-4 font-mono text-xs">{user.primaryUsername ?? "—"}</td>
+              <td className="p-4 font-mono text-xs">{user.accountCount}</td>
+              <td className="p-4">{defaultGroup ? <UserGroupSelect action={action} effectiveGroupId={assignmentByUser[user.id] ?? defaultGroup.id} groups={groups} returnTo={returnTo} userId={user.id} userLabel={user.firstName ?? user.discordUsername} /> : <span className="text-xs text-accent">Default group missing</span>}</td>
+              <td className="p-4"><span className={`border px-2 py-1 font-mono text-[9px] uppercase tracking-wider ${user.onboardingCompletedAt ? "border-line text-muted" : "border-accent text-accent"}`}>{user.onboardingCompletedAt ? "Ready" : "Onboarding"}</span></td>
+            </tr>
+          ))}
+          {!users.length && <tr><td className="p-8 text-muted" colSpan={6}>{emptyMessage}</td></tr>}
+        </tbody>
+      </table>
+    </div>
+  );
+}

apps/web/src/components/group-policy-control.tsx

@@ -0,0 +1,36 @@
+import { AdminModalForm } from "./admin-modal-form";
+
+export function GroupPolicyControl({
+  action,
+  enabled,
+  groupId,
+  groupName,
+  memberCount,
+  policy,
+  returnLocation,
+}: {
+  action: (formData: FormData) => Promise<void>;
+  enabled: boolean;
+  groupId: string;
+  groupName: string;
+  memberCount: number;
+  policy: string;
+  returnLocation: "list" | "detail";
+}) {
+  const nextState = enabled ? "deny" : "allow";
+  return (
+    <AdminModalForm
+      action={action}
+      description={`${nextState === "allow" ? "Allow" : "Deny"} ${policy.toLowerCase()} for ${memberCount} effective ${memberCount === 1 ? "member" : "members"} of ${groupName}.`}
+      submitLabel={`${nextState === "allow" ? "Allow" : "Deny"} access`}
+      title={`${nextState === "allow" ? "Allow" : "Deny"} ${policy}?`}
+      triggerClassName={`min-w-24 border px-3 py-2 font-mono text-[9px] font-bold uppercase tracking-wider ${enabled ? "border-signal bg-signal text-ink" : "border-accent bg-transparent text-accent"}`}
+      triggerLabel={enabled ? "Allowed" : "Denied"}
+      triggerPressed={enabled}
+    >
+      <input name="groupId" type="hidden" value={groupId} />
+      <input name="enabled" type="hidden" value={enabled ? "no" : "yes"} />
+      <input name="returnLocation" type="hidden" value={returnLocation} />
+    </AdminModalForm>
+  );
+}

apps/web/src/components/group-schedule-editor.test.tsx

@@ -0,0 +1,55 @@
+// @vitest-environment jsdom
+
+import { fireEvent, render, screen, within } from "@testing-library/react";
+import { beforeEach, describe, expect, it } from "vitest";
+import { AdminModalForm } from "./admin-modal-form";
+import { GroupScheduleEditor, GroupScheduleSummary } from "./group-schedule-editor";
+
+beforeEach(() => {
+  HTMLDialogElement.prototype.showModal = function showModal() { this.open = true; };
+  HTMLDialogElement.prototype.close = function close() {
+    this.open = false;
+    this.dispatchEvent(new Event("close"));
+  };
+});
+
+describe("GroupScheduleEditor", () => {
+  it("shows UTC authority, browser-local equivalents, and repeatable windows", () => {
+    const { container } = render(<GroupScheduleEditor windows={[{
+      startMinuteOfWeek: 6960,
+      endMinuteOfWeek: 7199,
+    }]} />);
+
+    expect(screen.getByText(/stored and enforced in UTC/i)).toBeTruthy();
+    expect(screen.getAllByRole("group", { name: /access window/i })).toHaveLength(1);
+    expect(container.querySelectorAll('input[name="startMinuteOfWeek"]')).toHaveLength(1);
+
+    fireEvent.click(screen.getByRole("button", { name: /add window/i }));
+    expect(screen.getAllByRole("group", { name: /access window/i })).toHaveLength(2);
+    expect(container.querySelectorAll('input[name="startMinuteOfWeek"]')).toHaveLength(2);
+
+    fireEvent.click(screen.getAllByRole("button", { name: /remove window/i })[0]!);
+    expect(screen.getAllByRole("group", { name: /access window/i })).toHaveLength(1);
+  });
+
+  it("discards an abandoned draft when its confirmation dialog is reopened", () => {
+    render(<AdminModalForm action={async () => undefined} description="Confirm schedule." submitLabel="Save schedule" title="Schedule group" triggerLabel="Edit schedule"><GroupScheduleEditor windows={[{ startMinuteOfWeek: 6960, endMinuteOfWeek: 7200 }]} /></AdminModalForm>);
+    fireEvent.click(screen.getByRole("button", { name: "Edit schedule" }));
+    const dialog = screen.getByRole("dialog");
+    fireEvent.click(within(dialog).getByRole("button", { name: "Add window" }));
+    expect(within(dialog).getAllByRole("group", { name: /access window/i })).toHaveLength(2);
+    fireEvent.click(within(dialog).getByRole("button", { name: "Cancel" }));
+
+    fireEvent.click(screen.getByRole("button", { name: "Edit schedule" }));
+    expect(within(dialog).getAllByRole("group", { name: /access window/i })).toHaveLength(1);
+  });
+
+  it("summarizes an unrestricted group and configured local equivalents", () => {
+    const { container, rerender } = render(<GroupScheduleSummary windows={[]} />);
+    expect(container.textContent).toMatch(/no schedule restrictions/i);
+
+    rerender(<GroupScheduleSummary windows={[{ startMinuteOfWeek: 6960, endMinuteOfWeek: 7199 }]} />);
+    expect(container.textContent).toMatch(/current browser-local equivalent/i);
+    expect(container.textContent).toContain("Friday 20:00 UTC");
+  });
+});

apps/web/src/components/group-schedule-editor.tsx

@@ -0,0 +1,143 @@
+"use client";
+
+import { useRef, useState, useSyncExternalStore } from "react";
+import {
+  formatWeeklyMinute,
+  localWindowToUtc,
+  utcWindowToLocal,
+  type WeeklyAccessWindow,
+} from "@/lib/group-schedule";
+
+const DAYS = ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday"] as const;
+
+interface EditableWindow extends WeeklyAccessWindow {
+  key: number;
+}
+
+function minuteParts(minuteOfWeek: number) {
+  const day = Math.floor(minuteOfWeek / 1440);
+  const minute = minuteOfWeek % 1440;
+  return {
+    day,
+    time: `${String(Math.floor(minute / 60)).padStart(2, "0")}:${String(minute % 60).padStart(2, "0")}`,
+  };
+}
+
+function withDay(minuteOfWeek: number, day: number) {
+  return day * 1440 + (minuteOfWeek % 1440);
+}
+
+function withTime(minuteOfWeek: number, time: string) {
+  const [hour, minute] = time.split(":").map(Number);
+  return Math.floor(minuteOfWeek / 1440) * 1440 + (hour ?? 0) * 60 + (minute ?? 0);
+}
+
+const subscribeToBrowserClock = () => () => undefined;
+
+function useBrowserClock() {
+  const offset = useSyncExternalStore(
+    subscribeToBrowserClock,
+    () => new Date().getTimezoneOffset(),
+    () => 0,
+  );
+  const zone = useSyncExternalStore(
+    subscribeToBrowserClock,
+    () => Intl.DateTimeFormat().resolvedOptions().timeZone || "browser local time",
+    () => "UTC",
+  );
+  return { offset, zone };
+}
+
+export function GroupScheduleEditor({ windows }: { windows: WeeklyAccessWindow[] }) {
+  const { offset, zone } = useBrowserClock();
+  const [editable, setEditable] = useState<EditableWindow[]>(
+    windows.map((window, key) => ({ ...window, key })),
+  );
+  const nextKey = useRef(windows.length);
+
+  function update(key: number, field: "startMinuteOfWeek" | "endMinuteOfWeek", value: number) {
+    setEditable((current) => current.map((window) => {
+      if (window.key !== key) return window;
+      const local = { ...utcWindowToLocal(window, offset), [field]: value };
+      return { ...localWindowToUtc(local, offset), key };
+    }));
+  }
+
+  return (
+    <div className="space-y-5">
+      <p className="text-sm leading-6 text-muted">
+        Schedules are stored and enforced in UTC. The editor shows the current browser-local equivalent in <strong className="text-ink">{zone}</strong>; it may shift when your local daylight-saving offset changes.
+      </p>
+      {!editable.length && <p className="border-l-2 border-signal pl-4 text-sm">No windows means no schedule restrictions while Minecraft access is enabled.</p>}
+      {editable.map((window, index) => {
+        const local = utcWindowToLocal(window, offset);
+        const start = minuteParts(local.startMinuteOfWeek);
+        const end = minuteParts(local.endMinuteOfWeek);
+        return (
+          <fieldset aria-label={`Access window ${index + 1}`} className="border border-line p-4" key={window.key}>
+            <legend className="px-2 font-mono text-[10px] font-bold uppercase tracking-wider">Access window {index + 1}</legend>
+            <div className="grid gap-4 sm:grid-cols-2">
+              <ScheduleBoundary day={start.day} label="Starts" onDay={(day) => update(window.key, "startMinuteOfWeek", withDay(local.startMinuteOfWeek, day))} onTime={(time) => update(window.key, "startMinuteOfWeek", withTime(local.startMinuteOfWeek, time))} time={start.time} />
+              <ScheduleBoundary day={end.day} label="Ends (exclusive)" onDay={(day) => update(window.key, "endMinuteOfWeek", withDay(local.endMinuteOfWeek, day))} onTime={(time) => update(window.key, "endMinuteOfWeek", withTime(local.endMinuteOfWeek, time))} time={end.time} />
+            </div>
+            <input name="startMinuteOfWeek" type="hidden" value={window.startMinuteOfWeek} />
+            <input name="endMinuteOfWeek" type="hidden" value={window.endMinuteOfWeek} />
+            <div className="mt-4 flex flex-wrap items-center justify-between gap-3">
+              <p className="font-mono text-[9px] uppercase text-muted">UTC: {formatWeeklyMinute(window.startMinuteOfWeek)}–{formatWeeklyMinute(window.endMinuteOfWeek)}</p>
+              <button className="font-mono text-[10px] font-bold uppercase text-accent underline underline-offset-4" onClick={() => setEditable((current) => current.filter((item) => item.key !== window.key))} type="button">Remove window {index + 1}</button>
+            </div>
+          </fieldset>
+        );
+      })}
+      <button
+        className="border border-ink px-4 py-2 font-mono text-[10px] font-bold uppercase tracking-wider disabled:cursor-not-allowed disabled:opacity-50"
+        disabled={editable.length >= 50}
+        onClick={() => {
+          const key = nextKey.current++;
+          setEditable((current) => [...current, {
+            key,
+            ...localWindowToUtc({
+              startMinuteOfWeek: 4 * 1440 + 20 * 60,
+              endMinuteOfWeek: 5 * 1440,
+            }, offset),
+          }]);
+        }}
+        type="button"
+      >Add window</button>
+    </div>
+  );
+}
+
+function ScheduleBoundary({ day, label, onDay, onTime, time }: {
+  day: number;
+  label: string;
+  onDay: (day: number) => void;
+  onTime: (time: string) => void;
+  time: string;
+}) {
+  return (
+    <div>
+      <span className="block text-xs font-bold">{label}</span>
+      <div className="mt-2 grid grid-cols-[1fr_auto] gap-2">
+        <label><span className="sr-only">{label} weekday</span><select className="w-full border border-line bg-canvas px-3 py-2 text-sm" onChange={(event) => onDay(Number(event.target.value))} value={day}>{DAYS.map((name, value) => <option key={name} value={value}>{name}</option>)}</select></label>
+        <label><span className="sr-only">{label} time</span><input className="border border-line bg-canvas px-3 py-2 text-sm" onChange={(event) => onTime(event.target.value)} required type="time" value={time} /></label>
+      </div>
+    </div>
+  );
+}
+
+export function GroupScheduleSummary({ windows }: { windows: WeeklyAccessWindow[] }) {
+  const { offset, zone } = useBrowserClock();
+  if (!windows.length) return <p className="text-sm text-muted">No schedule restrictions. Enabled members may attempt to join at any time.</p>;
+  return (
+    <div>
+      <p className="text-xs text-muted">Current browser-local equivalent: {zone}. UTC remains authoritative.</p>
+      <ol className="mt-3 space-y-2">
+        {windows.map((window, index) => {
+          const local = utcWindowToLocal(window, offset);
+          return <li className="border-l-2 border-accent pl-3 text-sm" key={`${window.startMinuteOfWeek}-${window.endMinuteOfWeek}-${index}`}><span className="font-bold">{formatWeeklyMinute(local.startMinuteOfWeek)}–{formatWeeklyMinute(local.endMinuteOfWeek)}</span><span className="mt-1 block font-mono text-[9px] uppercase text-muted">{formatWeeklyMinute(window.startMinuteOfWeek)} UTC–{formatWeeklyMinute(window.endMinuteOfWeek)} UTC</span></li>;
+        })}
+      </ol>
+    </div>
+  );
+}

apps/web/src/components/user-group-select.test.tsx

@@ -0,0 +1,53 @@
+// @vitest-environment jsdom
+
+import { fireEvent, render, screen } from "@testing-library/react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { beforeEach, describe, expect, it } from "vitest";
+import { UserGroupSelect } from "./user-group-select";
+
+const groups = [{ id: "group-everyone", name: "everyone" }, { id: "group-ops", name: "Ops" }];
+
+beforeEach(() => {
+  HTMLDialogElement.prototype.showModal = function showModal() { this.open = true; };
+  HTMLDialogElement.prototype.close = function close() {
+    this.open = false;
+    this.dispatchEvent(new Event("close"));
+  };
+});
+
+describe("UserGroupSelect", () => {
+  it("renders the effective group and preserves the return path", () => {
+    const markup = renderToStaticMarkup(<UserGroupSelect
+      action={async () => undefined}
+      effectiveGroupId="group-ops"
+      groups={groups}
+      returnTo="/admin/users?q=alex%20smith"
+      userId="user-one"
+      userLabel="Alex"
+    />);
+
+    expect(markup).toContain('aria-label="Group for Alex"');
+    expect(markup).toContain('<option value="group-ops" selected="">Ops</option>');
+    expect(markup).toContain('<input type="hidden" name="returnTo" value="/admin/users?q=alex%20smith"/>');
+    expect(markup).toContain("Changing this selection opens a confirmation dialog.");
+    expect(markup).toContain("Confirm move");
+  });
+
+  it("requires confirmation and restores the effective group when cancelled", () => {
+    render(<UserGroupSelect action={async () => undefined} effectiveGroupId="group-ops" groups={groups} returnTo="/admin/users" userId="user-one" userLabel="Alex" />);
+    const select = screen.getByRole("combobox", { name: "Group for Alex" }) as HTMLSelectElement;
+
+    fireEvent.change(select, { target: { value: "group-everyone" } });
+    const dialog = screen.getByRole("dialog") as HTMLDialogElement;
+    expect(dialog.open).toBe(true);
+    expect(select.value).toBe("group-everyone");
+    expect(select.disabled).toBe(true);
+    expect(screen.getByText(/from/).textContent).toContain("Ops");
+    expect(screen.getByText(/from/).textContent).toContain("everyone");
+
+    fireEvent.click(screen.getByRole("button", { name: "Cancel" }));
+    expect(dialog.open).toBe(false);
+    expect(select.value).toBe("group-ops");
+    expect(select.disabled).toBe(false);
+  });
+});

apps/web/src/components/user-group-select.tsx

@@ -0,0 +1,99 @@
+"use client";
+
+import type { RefObject } from "react";
+import { useEffect, useId, useRef, useState } from "react";
+import { useFormStatus } from "react-dom";
+
+export function UserGroupSelect({
+  action,
+  effectiveGroupId,
+  groups,
+  returnTo,
+  userId,
+  userLabel,
+}: {
+  action: (formData: FormData) => Promise<void>;
+  effectiveGroupId: string;
+  groups: Array<{ id: string; name: string }>;
+  returnTo: string;
+  userId: string;
+  userLabel: string;
+}) {
+  const dialogRef = useRef<HTMLDialogElement>(null);
+  const titleId = useId();
+  const descriptionId = useId();
+  const helpId = useId();
+  const [selectedGroupId, setSelectedGroupId] = useState(effectiveGroupId);
+  const [proposedGroupId, setProposedGroupId] = useState<string | null>(null);
+  const [submitting, setSubmitting] = useState(false);
+  const currentGroup = groups.find((group) => group.id === effectiveGroupId);
+  const proposedGroup = groups.find((group) => group.id === proposedGroupId);
+
+  function resetSelection() {
+    setSelectedGroupId(effectiveGroupId);
+    setProposedGroupId(null);
+  }
+
+  return (
+    <>
+      <span className="sr-only" id={helpId}>Changing this selection opens a confirmation dialog.</span>
+      <select
+        aria-describedby={helpId}
+        aria-label={`Group for ${userLabel}`}
+        className="max-w-44 border border-line bg-canvas px-3 py-2 font-mono text-xs outline-none focus:border-accent disabled:cursor-wait disabled:opacity-60"
+        disabled={proposedGroupId !== null || submitting}
+        onChange={(event) => {
+          const nextGroupId = event.currentTarget.value;
+          if (nextGroupId === effectiveGroupId) return;
+          setSelectedGroupId(nextGroupId);
+          setProposedGroupId(nextGroupId);
+          dialogRef.current?.showModal();
+        }}
+        value={selectedGroupId}
+      >
+        {groups.map((group) => <option key={group.id} value={group.id}>{group.name}</option>)}
+      </select>
+      <dialog
+        aria-describedby={descriptionId}
+        aria-labelledby={titleId}
+        className="admin-modal m-auto w-[min(92vw,34rem)] border border-ink bg-panel p-0 text-ink shadow-[10px_10px_0_var(--color-shadow)] backdrop:bg-ink/70"
+        onCancel={(event) => { if (submitting) event.preventDefault(); }}
+        onClose={() => { if (!submitting) resetSelection(); }}
+        ref={dialogRef}
+      >
+        <form action={action} className="p-6 sm:p-8" onSubmit={() => setSubmitting(true)}>
+          <input name="userId" type="hidden" value={userId} />
+          <input name="groupId" type="hidden" value={proposedGroupId ?? effectiveGroupId} />
+          <input name="returnTo" type="hidden" value={returnTo} />
+          <p className="font-mono text-[9px] font-bold uppercase tracking-[0.2em] text-accent">Confirm membership</p>
+          <h2 className="mt-3 font-display text-3xl font-black uppercase" id={titleId}>Move {userLabel}?</h2>
+          <p className="mt-3 text-sm leading-6 text-muted" id={descriptionId}>
+            Change the effective group from <strong className="text-ink">{currentGroup?.name ?? "unknown"}</strong> to <strong className="text-ink">{proposedGroup?.name ?? "unknown"}</strong>. Their access policy changes immediately.
+          </p>
+          <AssignmentActions dialogRef={dialogRef} onPendingChange={setSubmitting} />
+        </form>
+      </dialog>
+    </>
+  );
+}
+
+function AssignmentActions({ dialogRef, onPendingChange }: { dialogRef: RefObject<HTMLDialogElement | null>; onPendingChange: (pending: boolean) => void }) {
+  const { pending } = useFormStatus();
+  const observedPending = useRef(false);
+  useEffect(() => {
+    if (pending) {
+      observedPending.current = true;
+      onPendingChange(true);
+    } else if (observedPending.current) {
+      observedPending.current = false;
+      onPendingChange(false);
+    }
+  }, [onPendingChange, pending]);
+  return (
+    <div className="mt-8 flex justify-end gap-3 border-t border-line pt-5">
+      <button className="border border-line px-5 py-3 font-mono text-[10px] font-bold uppercase" disabled={pending} onClick={() => dialogRef.current?.close()} type="button">Cancel</button>
+      <button className="bg-ink px-5 py-3 font-mono text-[10px] font-bold uppercase text-canvas disabled:cursor-wait disabled:opacity-60" disabled={pending} type="submit">{pending ? "Moving…" : "Confirm move"}</button>
+      <span aria-live="polite" className="sr-only">{pending ? "Group change in progress." : ""}</span>
+    </div>
+  );
+}

apps/web/src/components/user-world-map.test.tsx

@@ -44,7 +44,8 @@ describe("UserWorldMap", () => {
     expect(markup).toContain("Alex (AlexMC)");
     expect(markup).toContain("2 users near Mountain View, California, US");
     expect(markup).toMatch(/<text[^>]*>2<\/text>/);
-    expect(markup).toContain('<details class="mt-5 border-t border-line pt-4" id="map-location-list" open="">');
+    expect(markup).toContain('<details class="mt-5 border-t border-line pt-4" id="map-location-list">');
+    expect(markup).not.toContain('id="map-location-list" open');
     expect(markup).toContain("Mountain View, California, US");
     expect(markup).toContain("Comcast Cable Communications, LLC");
     expect(markup).toContain("AS7922");

apps/web/src/components/user-world-map.tsx

@@ -99,7 +99,7 @@ export function UserWorldMap({ locations, unavailableCount }: { locations: UserM
       </MapViewToggle>
       <p className="mt-2 text-right font-mono text-[9px] text-muted">Map boundaries: Natural Earth, public domain</p>
 
-      <details className="mt-5 border-t border-line pt-4" id="map-location-list" open={locationGroups.some((group) => group.count > 1)}>
+      <details className="mt-5 border-t border-line pt-4" id="map-location-list">
         <summary className="w-fit cursor-pointer font-mono text-[10px] font-bold uppercase underline underline-offset-4">View accessible location list</summary>
         <div className="mt-4 overflow-x-auto">
           <table className="w-full min-w-[980px] border-collapse text-left text-xs">

apps/web/src/lib/admission-settings.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, it } from "vitest";
+import { admissionDenialMessage, DEFAULT_ADMISSION_MESSAGES, parseAdmissionMessages, renderAdmissionMessage } from "./admission-settings";
+
+describe("admission message settings", () => {
+  it("normalizes independently configured denial templates with allowed variables", () => {
+    const formData = validMessages();
+    formData.set("registrationMessage", "  Register {player} before joining {group}.  ");
+    formData.set("scheduledAccessDeniedMessage", "{player}, {group} may join from {next_start} to {next_end}.");
+
+    expect(parseAdmissionMessages(formData)).toEqual({
+      registrationMessage: "Register {player} before joining {group}.",
+      groupAccessDeniedMessage: "{player} cannot access the server with {group}.",
+      vpnDeniedMessage: "VPN access for {player} in {group} requires an exception.",
+      scheduledAccessDeniedMessage: "{player}, {group} may join from {next_start} to {next_end}.",
+    });
+  });
+
+  it("selects the configured message for each admission denial reason", () => {
+    expect(admissionDenialMessage("not_registered", DEFAULT_ADMISSION_MESSAGES)).toBe(DEFAULT_ADMISSION_MESSAGES.registrationMessage);
+    expect(admissionDenialMessage("group_access_disabled", DEFAULT_ADMISSION_MESSAGES)).toBe(DEFAULT_ADMISSION_MESSAGES.groupAccessDeniedMessage);
+    expect(admissionDenialMessage("schedule_disallowed", DEFAULT_ADMISSION_MESSAGES)).toBe(DEFAULT_ADMISSION_MESSAGES.scheduledAccessDeniedMessage);
+    expect(admissionDenialMessage("anonymized_network_disallowed", DEFAULT_ADMISSION_MESSAGES)).toBe(DEFAULT_ADMISSION_MESSAGES.vpnDeniedMessage);
+  });
+
+  it("renders static variables without evaluating expressions", () => {
+    expect(renderAdmissionMessage("{player} uses {group}; next: {next_start}–{next_end}.", {
+      player: "AlexMC",
+      group: "Friday friends",
+      next_start: "2026-08-07 20:00 UTC",
+      next_end: "2026-08-07 23:59 UTC",
+    })).toBe("AlexMC uses Friday friends; next: 2026-08-07 20:00 UTC–2026-08-07 23:59 UTC.");
+  });
+
+  it("rejects missing, short, overlong, control-character, or unsupported-variable messages", () => {
+    for (const invalid of ["short", "a".repeat(501), "Denied\nInjected", "Denied for {next_start}.", "Denied for {unknown}."] as const) {
+      const formData = validMessages();
+      formData.set("vpnDeniedMessage", invalid);
+      expect(parseAdmissionMessages(formData)).toBeNull();
+    }
+  });
+});
+
+function validMessages() {
+  const formData = new FormData();
+  formData.set("registrationMessage", "Register {player} before joining {group}.");
+  formData.set("groupAccessDeniedMessage", "{player} cannot access the server with {group}.");
+  formData.set("vpnDeniedMessage", "VPN access for {player} in {group} requires an exception.");
+  formData.set("scheduledAccessDeniedMessage", "{group} may join from {next_start} to {next_end}.");
+  return formData;
+}

apps/web/src/lib/admission-settings.ts

@@ -0,0 +1,54 @@
+export interface AdmissionMessages {
+  registrationMessage: string;
+  groupAccessDeniedMessage: string;
+  vpnDeniedMessage: string;
+  scheduledAccessDeniedMessage: string;
+}
+
+export type AdmissionDenialReason =
+  | "not_registered"
+  | "group_access_disabled"
+  | "schedule_disallowed"
+  | "anonymized_network_disallowed";
+
+export const DEFAULT_ADMISSION_MESSAGES: AdmissionMessages = {
+  registrationMessage: "Please register your Minecraft account before joining.",
+  groupAccessDeniedMessage: "Your account group does not currently have server access. Contact a host if you believe this is a mistake.",
+  vpnDeniedMessage: "VPN, proxy, and Tor connections are not allowed. Contact a host to request an exception.",
+  scheduledAccessDeniedMessage: "Your group is only allowed access from {next_start} to {next_end}.",
+} as const;
+
+export function admissionDenialMessage(reason: AdmissionDenialReason, messages: AdmissionMessages) {
+  if (reason === "not_registered") return messages.registrationMessage;
+  if (reason === "group_access_disabled") return messages.groupAccessDeniedMessage;
+  if (reason === "schedule_disallowed") return messages.scheduledAccessDeniedMessage;
+  return messages.vpnDeniedMessage;
+}
+
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+const TEMPLATE_VARIABLE = /\{([a-z_]+)\}/g;
+const COMMON_VARIABLES = new Set(["player", "group"]);
+const SCHEDULE_VARIABLES = new Set(["player", "group", "next_start", "next_end"]);
+
+type MessageName = keyof AdmissionMessages;
+
+function messageValue(formData: FormData, name: MessageName, allowedVariables: Set<string>) {
+  const value = String(formData.get(name) ?? "").trim();
+  if (value.length < 10 || value.length > 500 || CONTROL_CHARACTERS.test(value)) return null;
+  const withoutVariables = value.replace(TEMPLATE_VARIABLE, (match, variable: string) =>
+    allowedVariables.has(variable) ? "" : match);
+  return /[{}]/.test(withoutVariables) ? null : value;
+}
+
+export function parseAdmissionMessages(formData: FormData) {
+  const registrationMessage = messageValue(formData, "registrationMessage", COMMON_VARIABLES);
+  const groupAccessDeniedMessage = messageValue(formData, "groupAccessDeniedMessage", COMMON_VARIABLES);
+  const vpnDeniedMessage = messageValue(formData, "vpnDeniedMessage", COMMON_VARIABLES);
+  const scheduledAccessDeniedMessage = messageValue(formData, "scheduledAccessDeniedMessage", SCHEDULE_VARIABLES);
+  if (!registrationMessage || !groupAccessDeniedMessage || !vpnDeniedMessage || !scheduledAccessDeniedMessage) return null;
+  return { registrationMessage, groupAccessDeniedMessage, vpnDeniedMessage, scheduledAccessDeniedMessage };
+}
+
+export function renderAdmissionMessage(template: string, variables: Record<string, string>) {
+  return template.replace(TEMPLATE_VARIABLE, (match, variable: string) => variables[variable] ?? match);
+}

apps/web/src/lib/game-admission-policy.test.ts

@@ -0,0 +1,61 @@
+import { describe, expect, it } from "vitest";
+import { DEFAULT_ADMISSION_MESSAGES } from "./admission-settings";
+import { evaluateRegisteredPlayerAdmission } from "./game-admission-policy";
+
+const group = {
+  name: "Friday friends",
+  accessEnabled: true,
+  anonymizedNetworksAllowed: false,
+};
+const fridayWindow = { startMinuteOfWeek: 6960, endMinuteOfWeek: 7200 };
+
+describe("registered player admission policy", () => {
+  it("lets disabled Minecraft access override an active schedule", () => {
+    const decision = evaluateRegisteredPlayerAdmission({
+      group: { ...group, accessEnabled: false },
+      windows: [fridayWindow],
+      classification: "clear",
+      now: new Date("2026-08-07T21:00:00Z"),
+      player: "AlexMC",
+      messages: DEFAULT_ADMISSION_MESSAGES,
+    });
+    expect(decision.reason).toBe("group_access_disabled");
+  });
+
+  it("denies an enabled group outside its schedule with the next UTC window", () => {
+    const decision = evaluateRegisteredPlayerAdmission({
+      group,
+      windows: [fridayWindow],
+      classification: "vpn",
+      now: new Date("2026-08-08T01:00:00Z"),
+      player: "AlexMC",
+      messages: {
+        ...DEFAULT_ADMISSION_MESSAGES,
+        scheduledAccessDeniedMessage: "{player} in {group}: {next_start}–{next_end}.",
+      },
+    });
+    expect(decision.reason).toBe("schedule_disallowed");
+    expect(decision.message).toBe("AlexMC in Friday friends: 2026-08-14 20:00 UTC–2026-08-15 00:00 UTC.");
+  });
+
+  it("applies network policy only after group access and schedule pass", () => {
+    const denied = evaluateRegisteredPlayerAdmission({
+      group,
+      windows: [fridayWindow],
+      classification: "vpn",
+      now: new Date("2026-08-07T21:00:00Z"),
+      player: "AlexMC",
+      messages: DEFAULT_ADMISSION_MESSAGES,
+    });
+    expect(denied.reason).toBe("anonymized_network_disallowed");
+
+    expect(evaluateRegisteredPlayerAdmission({
+      group: { ...group, anonymizedNetworksAllowed: true },
+      windows: [fridayWindow],
+      classification: "vpn",
+      now: new Date("2026-08-07T21:00:00Z"),
+      player: "AlexMC",
+      messages: DEFAULT_ADMISSION_MESSAGES,
+    }).allowed).toBe(true);
+  });
+});

apps/web/src/lib/game-admission-policy.ts

@@ -0,0 +1,43 @@
+import { gameAdmissionDenialReason } from "@minecraft-account-manager/auth";
+import {
+  admissionDenialMessage,
+  renderAdmissionMessage,
+  type AdmissionMessages,
+} from "./admission-settings";
+import {
+  evaluateGroupSchedule,
+  formatScheduleInstant,
+  type WeeklyAccessWindow,
+} from "./group-schedule";
+
+interface EffectiveGroupPolicy {
+  name: string;
+  accessEnabled: boolean;
+  anonymizedNetworksAllowed: boolean;
+}
+
+interface RegisteredPlayerAdmissionInput {
+  group: EffectiveGroupPolicy | null;
+  windows: WeeklyAccessWindow[];
+  classification: "unknown" | "clear" | "vpn" | "proxy" | "hosting" | "tor";
+  now: Date;
+  player: string;
+  messages: AdmissionMessages;
+}
+
+export function evaluateRegisteredPlayerAdmission(input: RegisteredPlayerAdmissionInput) {
+  const schedule = evaluateGroupSchedule(input.windows, input.now);
+  const reason = gameAdmissionDenialReason(input.group, input.classification, schedule.allowed);
+  if (!reason) return { allowed: true as const, reason: null, message: null, nextWindow: null };
+  return {
+    allowed: false as const,
+    reason,
+    message: renderAdmissionMessage(admissionDenialMessage(reason, input.messages), {
+      player: input.player,
+      group: input.group?.name ?? "everyone",
+      next_start: schedule.nextWindow ? formatScheduleInstant(schedule.nextWindow.start) : "unavailable",
+      next_end: schedule.nextWindow ? formatScheduleInstant(schedule.nextWindow.end) : "unavailable",
+    }),
+    nextWindow: schedule.nextWindow,
+  };
+}

apps/web/src/lib/group-management.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+import { adminGroupReturnPath, editableGroupName, effectiveGroupMemberCount, isEffectiveGroupMember, groupSlug, validateGroupDetails } from "./group-management";
+
+describe("group management", () => {
+  it("generates a collision-safe internal slug from the display name", () => {
+    expect(groupSlug("  Trusted Öps Team!  ", new Set(["trusted-ops-team", "trusted-ops-team-2"])))
+      .toBe("trusted-ops-team-3");
+    expect(groupSlug("🔥", new Set())).toBe("group");
+  });
+
+  it("allows only local Users and group-detail return paths", () => {
+    expect(adminGroupReturnPath("/admin/users?q=alex", "saved=group")).toBe("/admin/users?q=alex&saved=group");
+    expect(adminGroupReturnPath("/admin/groups/11111111-1111-4111-8111-111111111111", "saved=group"))
+      .toBe("/admin/groups/11111111-1111-4111-8111-111111111111?saved=group");
+    expect(adminGroupReturnPath("https://evil.example/admin/users", "saved=group")).toBe("/admin/users?saved=group");
+    expect(adminGroupReturnPath("/admin/settings", "error=invalid-group-assignment")).toBe("/admin/users?error=invalid-group-assignment");
+  });
+
+  it("counts and filters explicit and default effective memberships", () => {
+    const assignments = { one: "ops", two: "builders" };
+    expect(effectiveGroupMemberCount(4, Object.values(assignments), { id: "everyone", isDefault: true })).toBe(2);
+    expect(effectiveGroupMemberCount(4, Object.values(assignments), { id: "ops", isDefault: false })).toBe(1);
+    expect(isEffectiveGroupMember("three", assignments, { id: "everyone", isDefault: true })).toBe(true);
+    expect(isEffectiveGroupMember("one", assignments, { id: "ops", isDefault: false })).toBe(true);
+    expect(isEffectiveGroupMember("two", assignments, { id: "ops", isDefault: false })).toBe(false);
+  });
+
+  it("keeps the protected default group name fixed", () => {
+    expect(editableGroupName("everyone", true, "Renamed")).toBe("everyone");
+    expect(editableGroupName("Ops", false, "Trusted hosts")).toBe("Trusted hosts");
+  });
+
+  it("validates and normalizes editable group details", () => {
+    expect(validateGroupDetails("  Trusted hosts  ", "  Can use managed VPNs.  ")).toEqual({
+      name: "Trusted hosts",
+      description: "Can use managed VPNs.",
+    });
+    expect(validateGroupDetails("", "description")).toBeNull();
+    expect(validateGroupDetails("bad\nname", "description")).toBeNull();
+    expect(validateGroupDetails("Valid", "x".repeat(501))).toBeNull();
+  });
+});

apps/web/src/lib/group-management.ts

@@ -0,0 +1,75 @@
+const NAME_CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+const TEXT_CONTROL_CHARACTERS = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
+
+export function validateGroupDetails(nameValue: unknown, descriptionValue: unknown) {
+  const name = String(nameValue ?? "").trim();
+  const description = String(descriptionValue ?? "").trim();
+  if (
+    name.length < 1 ||
+    name.length > 50 ||
+    NAME_CONTROL_CHARACTERS.test(name) ||
+    description.length > 500 ||
+    TEXT_CONTROL_CHARACTERS.test(description)
+  ) return null;
+  return { name, description };
+}
+
+export function adminGroupReturnPath(
+  value: unknown,
+  result: "saved=group" | "error=invalid-group-assignment",
+) {
+  const requested = String(value ?? "");
+  let pathname = "/admin/users";
+  const parameters = new URLSearchParams();
+  if (requested.startsWith("/")) {
+    const url = new URL(requested, "http://internal");
+    if (url.pathname === "/admin/users") {
+      const search = url.searchParams.get("q")?.trim().slice(0, 100);
+      if (search) parameters.set("q", search);
+    } else if (/^\/admin\/groups\/[0-9a-f-]{36}$/i.test(url.pathname)) {
+      pathname = url.pathname;
+    }
+  }
+  const [key, resultValue] = result.split("=", 2) as ["saved" | "error", string];
+  parameters.set(key, resultValue);
+  return `${pathname}?${parameters.toString()}`;
+}
+
+export function editableGroupName(currentName: string, isDefault: boolean, requestedName: string) {
+  return isDefault ? currentName : requestedName;
+}
+
+export function effectiveGroupMemberCount(
+  totalUsers: number,
+  assignedGroupIds: string[],
+  group: { id: string; isDefault: boolean },
+) {
+  return group.isDefault
+    ? Math.max(0, totalUsers - assignedGroupIds.length)
+    : assignedGroupIds.filter((groupId) => groupId === group.id).length;
+}
+
+export function isEffectiveGroupMember(
+  userId: string,
+  assignmentByUser: Record<string, string>,
+  group: { id: string; isDefault: boolean },
+) {
+  return group.isDefault ? !assignmentByUser[userId] : assignmentByUser[userId] === group.id;
+}
+
+export function groupSlug(name: string, existingSlugs: Set<string>) {
+  const normalized = name
+    .normalize("NFKD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "") || "group";
+  const base = normalized.slice(0, 50).replace(/-+$/g, "") || "group";
+  if (!existingSlugs.has(base)) return base;
+  for (let suffix = 2; suffix < 10_000; suffix += 1) {
+    const suffixText = `-${suffix}`;
+    const candidate = `${base.slice(0, 50 - suffixText.length).replace(/-+$/g, "")}${suffixText}`;
+    if (!existingSlugs.has(candidate)) return candidate;
+  }
+  throw new Error("Could not generate a unique group slug");
+}

apps/web/src/lib/group-schedule.test.ts

@@ -0,0 +1,123 @@
+import { describe, expect, it } from "vitest";
+import {
+  evaluateGroupSchedule,
+  groupScheduleStatus,
+  localWindowToUtc,
+  parseScheduleWindows,
+  utcWindowToLocal,
+  type WeeklyAccessWindow,
+} from "./group-schedule";
+
+const fridayEvening: WeeklyAccessWindow = {
+  startMinuteOfWeek: 4 * 24 * 60 + 20 * 60,
+  endMinuteOfWeek: 4 * 24 * 60 + 23 * 60 + 59,
+};
+
+describe("weekly group access schedules", () => {
+  it("summarizes whether a group has configured windows", () => {
+    expect(groupScheduleStatus(0)).toBe("Unrestricted");
+    expect(groupScheduleStatus(1)).toBe("1 window");
+    expect(groupScheduleStatus(3)).toBe("3 windows");
+  });
+
+  it("allows an enabled group at any time when no schedule is configured", () => {
+    expect(evaluateGroupSchedule([], new Date("2026-08-07T19:00:00Z"))).toEqual({
+      allowed: true,
+      nextWindow: null,
+    });
+  });
+
+  it("allows only inside a UTC window and identifies the next window when denied", () => {
+    expect(evaluateGroupSchedule([fridayEvening], new Date("2026-08-07T21:30:00Z")).allowed).toBe(true);
+
+    const denied = evaluateGroupSchedule([fridayEvening], new Date("2026-08-08T01:00:00Z"));
+    expect(denied.allowed).toBe(false);
+    expect(denied.nextWindow).toEqual({
+      start: new Date("2026-08-14T20:00:00.000Z"),
+      end: new Date("2026-08-14T23:59:00.000Z"),
+    });
+  });
+
+  it("uses inclusive starts and exclusive ends across the UTC week boundary", () => {
+    const sundayNight = { startMinuteOfWeek: 6 * 1440 + 23 * 60, endMinuteOfWeek: 2 * 60 };
+    expect(evaluateGroupSchedule([sundayNight], new Date("2026-08-09T23:00:00Z")).allowed).toBe(true);
+    expect(evaluateGroupSchedule([sundayNight], new Date("2026-08-10T01:59:59Z")).allowed).toBe(true);
+    expect(evaluateGroupSchedule([sundayNight], new Date("2026-08-10T02:00:00Z")).allowed).toBe(false);
+  });
+
+  it("selects the earliest upcoming window when several are configured", () => {
+    const mondayMorning = { startMinuteOfWeek: 8 * 60, endMinuteOfWeek: 9 * 60 };
+    const decision = evaluateGroupSchedule(
+      [fridayEvening, mondayMorning],
+      new Date("2026-08-08T01:00:00Z"),
+    );
+    expect(decision.nextWindow?.start).toEqual(new Date("2026-08-10T08:00:00.000Z"));
+    expect(decision.nextWindow?.end).toEqual(new Date("2026-08-10T09:00:00.000Z"));
+  });
+
+  it("fails closed for malformed persisted policy", () => {
+    expect(evaluateGroupSchedule([
+      { startMinuteOfWeek: 100, endMinuteOfWeek: 200 },
+      { startMinuteOfWeek: 150, endMinuteOfWeek: 250 },
+    ], new Date("2026-08-03T02:30:00Z"))).toEqual({ allowed: false, nextWindow: null });
+  });
+
+  it("rejects malformed and overlapping submitted windows", () => {
+    const valid = new FormData();
+    valid.append("startMinuteOfWeek", "6960");
+    valid.append("endMinuteOfWeek", "7199");
+    valid.append("startMinuteOfWeek", "480");
+    valid.append("endMinuteOfWeek", "540");
+    expect(parseScheduleWindows(valid)).toEqual([
+      { startMinuteOfWeek: 480, endMinuteOfWeek: 540 },
+      fridayEvening,
+    ]);
+
+    const overlapping = new FormData();
+    overlapping.append("startMinuteOfWeek", "100");
+    overlapping.append("endMinuteOfWeek", "200");
+    overlapping.append("startMinuteOfWeek", "150");
+    overlapping.append("endMinuteOfWeek", "250");
+    expect(parseScheduleWindows(overlapping)).toBeNull();
+
+    const wrappingOverlap = new FormData();
+    wrappingOverlap.append("startMinuteOfWeek", String(6 * 1440 + 23 * 60));
+    wrappingOverlap.append("endMinuteOfWeek", String(2 * 60));
+    wrappingOverlap.append("startMinuteOfWeek", String(60));
+    wrappingOverlap.append("endMinuteOfWeek", String(3 * 60));
+    expect(parseScheduleWindows(wrappingOverlap)).toBeNull();
+
+    const mismatched = new FormData();
+    mismatched.append("startMinuteOfWeek", "100");
+    expect(parseScheduleWindows(mismatched)).toBeNull();
+
+    const invalid = new FormData();
+    invalid.append("startMinuteOfWeek", "10080");
+    invalid.append("endMinuteOfWeek", "0");
+    expect(parseScheduleWindows(invalid)).toBeNull();
+
+    for (const malformedValue of ["", " ", "+1", "0x10", "1e2", "1.5"]) {
+      const malformed = new FormData();
+      malformed.append("startMinuteOfWeek", malformedValue);
+      malformed.append("endMinuteOfWeek", "2");
+      expect(parseScheduleWindows(malformed)).toBeNull();
+    }
+
+    const tooMany = new FormData();
+    for (let index = 0; index < 51; index += 1) {
+      tooMany.append("startMinuteOfWeek", String(index * 2));
+      tooMany.append("endMinuteOfWeek", String(index * 2 + 1));
+    }
+    expect(parseScheduleWindows(tooMany)).toBeNull();
+  });
+
+  it("converts browser-local weekly values to authoritative UTC and back", () => {
+    const local = { startMinuteOfWeek: 4 * 1440 + 20 * 60, endMinuteOfWeek: 4 * 1440 + 23 * 60 };
+    const utc = localWindowToUtc(local, 420);
+    expect(utc).toEqual({
+      startMinuteOfWeek: 5 * 1440 + 3 * 60,
+      endMinuteOfWeek: 5 * 1440 + 6 * 60,
+    });
+    expect(utcWindowToLocal(utc, 420)).toEqual(local);
+  });
+});

apps/web/src/lib/group-schedule.ts

@@ -0,0 +1,124 @@
+export const MINUTES_PER_WEEK = 7 * 24 * 60;
+const MAX_WINDOWS = 50;
+
+export function groupScheduleStatus(windowCount: number) {
+  if (windowCount <= 0) return "Unrestricted";
+  return `${windowCount} ${windowCount === 1 ? "window" : "windows"}`;
+}
+
+export interface WeeklyAccessWindow {
+  startMinuteOfWeek: number;
+  endMinuteOfWeek: number;
+}
+
+interface ScheduleDecision {
+  allowed: boolean;
+  nextWindow: { start: Date; end: Date } | null;
+}
+
+function normalizedMinute(value: number) {
+  return ((value % MINUTES_PER_WEEK) + MINUTES_PER_WEEK) % MINUTES_PER_WEEK;
+}
+
+function validWindow(window: WeeklyAccessWindow) {
+  return Number.isInteger(window.startMinuteOfWeek)
+    && Number.isInteger(window.endMinuteOfWeek)
+    && window.startMinuteOfWeek >= 0
+    && window.startMinuteOfWeek < MINUTES_PER_WEEK
+    && window.endMinuteOfWeek >= 0
+    && window.endMinuteOfWeek < MINUTES_PER_WEEK
+    && window.startMinuteOfWeek !== window.endMinuteOfWeek;
+}
+
+function segments(window: WeeklyAccessWindow) {
+  return window.endMinuteOfWeek > window.startMinuteOfWeek
+    ? [[window.startMinuteOfWeek, window.endMinuteOfWeek] as const]
+    : [
+        [window.startMinuteOfWeek, MINUTES_PER_WEEK] as const,
+        [0, window.endMinuteOfWeek] as const,
+      ];
+}
+
+export function validateScheduleWindows(windows: WeeklyAccessWindow[]) {
+  if (windows.length > MAX_WINDOWS || windows.some((window) => !validWindow(window))) return null;
+  for (let left = 0; left < windows.length; left += 1) {
+    for (let right = left + 1; right < windows.length; right += 1) {
+      const overlaps = segments(windows[left]!).some(([leftStart, leftEnd]) =>
+        segments(windows[right]!).some(([rightStart, rightEnd]) =>
+          leftStart < rightEnd && rightStart < leftEnd));
+      if (overlaps) return null;
+    }
+  }
+  return [...windows].sort((left, right) => left.startMinuteOfWeek - right.startMinuteOfWeek);
+}
+
+export function parseScheduleWindows(formData: FormData) {
+  const starts = formData.getAll("startMinuteOfWeek").map(String);
+  const ends = formData.getAll("endMinuteOfWeek").map(String);
+  if (starts.length !== ends.length) return null;
+  const decimalInteger = /^(0|[1-9]\d*)$/;
+  if (starts.some((value) => !decimalInteger.test(value)) || ends.some((value) => !decimalInteger.test(value))) {
+    return null;
+  }
+  return validateScheduleWindows(starts.map((start, index) => ({
+    startMinuteOfWeek: Number(start),
+    endMinuteOfWeek: Number(ends[index]),
+  })));
+}
+
+function utcWeekStart(now: Date) {
+  const dayFromMonday = (now.getUTCDay() + 6) % 7;
+  return Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() - dayFromMonday);
+}
+
+function windowDuration(window: WeeklyAccessWindow) {
+  return normalizedMinute(window.endMinuteOfWeek - window.startMinuteOfWeek);
+}
+
+export function evaluateGroupSchedule(windows: WeeklyAccessWindow[], now: Date): ScheduleDecision {
+  if (!windows.length) return { allowed: true, nextWindow: null };
+  const valid = validateScheduleWindows(windows);
+  if (!valid || !Number.isFinite(now.getTime())) return { allowed: false, nextWindow: null };
+
+  const weekStart = utcWeekStart(now);
+  const occurrences = valid.flatMap((window) => [-1, 0, 1].map((weekOffset) => {
+    const start = new Date(weekStart + (weekOffset * MINUTES_PER_WEEK + window.startMinuteOfWeek) * 60_000);
+    const end = new Date(start.getTime() + windowDuration(window) * 60_000);
+    return { start, end };
+  }));
+  if (occurrences.some(({ start, end }) => now >= start && now < end)) {
+    return { allowed: true, nextWindow: null };
+  }
+  const nextWindow = occurrences
+    .filter(({ start }) => start > now)
+    .sort((left, right) => left.start.getTime() - right.start.getTime())[0] ?? null;
+  return { allowed: false, nextWindow };
+}
+
+export function localWindowToUtc(window: WeeklyAccessWindow, browserOffsetMinutes: number) {
+  return {
+    startMinuteOfWeek: normalizedMinute(window.startMinuteOfWeek + browserOffsetMinutes),
+    endMinuteOfWeek: normalizedMinute(window.endMinuteOfWeek + browserOffsetMinutes),
+  };
+}
+
+export function utcWindowToLocal(window: WeeklyAccessWindow, browserOffsetMinutes: number) {
+  return {
+    startMinuteOfWeek: normalizedMinute(window.startMinuteOfWeek - browserOffsetMinutes),
+    endMinuteOfWeek: normalizedMinute(window.endMinuteOfWeek - browserOffsetMinutes),
+  };
+}
+
+const WEEKDAYS = ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday"] as const;
+
+export function formatWeeklyMinute(minuteOfWeek: number) {
+  const minute = normalizedMinute(minuteOfWeek);
+  const day = WEEKDAYS[Math.floor(minute / (24 * 60))];
+  const hour = Math.floor((minute % (24 * 60)) / 60);
+  const minuteOfHour = minute % 60;
+  return `${day} ${String(hour).padStart(2, "0")}:${String(minuteOfHour).padStart(2, "0")}`;
+}
+
+export function formatScheduleInstant(value: Date) {
+  return `${value.toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}

design/index.md

@@ -32,6 +32,8 @@ This OKF bundle is the product record for implemented and proposed behavior. Sto
 * [US-016 — Build and publish versioned releases](us-016-automated-releases.md) - Gitea Actions publish the Velocity JAR and web and migration images.
 * [US-017 — Control admission with groups](us-017-group-access.md) - Each user has one effective group that explicitly controls Minecraft access.
 * [US-018 — Monitor community account activity](us-018-admin-dashboard.md) - Administrators review daily users, confirmed connections, locations, denials, and risky networks.
+* [US-019 — Manage groups efficiently](us-019-admin-group-management.md) - Administrators manage group identity, policies, membership, and creation through focused confirmed workflows.
+* [US-020 — Schedule group access in UTC](us-020-scheduled-group-access.md) - Enabled groups may be restricted to recurring weekly UTC windows with static denial-message templates.
 
 # Tracking
 

design/log.md

@@ -2,6 +2,10 @@
 
 ## 2026-08-02
 
+* **Extend**: Add recurring UTC group-access windows, browser-local schedule editing, and validated static denial-message variables.
+* **Refine**: Replace admin group cards with a policy table, confirmed modal workflows, editable group details, and reusable effective-member management.
+* **Add**: Provide Users-page group assignment, effective-group VPN/proxy/Tor exceptions for game admission, and independent configurable denial messages.
+* **Fix**: Treat malformed ProxyCheck proxy signals as unknown and classify every authenticated Velocity login before identity resolution.
 * **Fix**: Replace the dashboard's pre-enrichment network label with enriched company, ASN, connection type, Proxy/VPN status, and risk fields.
 * **Fix**: Group collocated map users into count-badged markers with complete nickname tooltips and per-user interactive-map links.
 * **Refine**: Replace registration counts with daily active users, collapse enriched VPN activity per user, add opt-in OpenStreetMap zoom, show managed nickname tooltips, and measure active Minecraft accounts from confirmed Velocity connections.

design/us-007-ip-intelligence.md

@@ -3,7 +3,7 @@ type: User Story
 title: Enrich portal and game login IPs
 description: Login audit events include cached approximate location and network intelligence from ProxyCheck.io.
 tags: [security, network, audit, proxycheck]
-timestamp: 2026-08-01T22:04:17Z
+timestamp: 2026-08-02T14:12:43Z
 story_id: US-007
 status: verified
 ---
@@ -19,7 +19,7 @@ As an operator, I want portal and registered game logins enriched with network c
 - [x] Provider failures are cached briefly and do not deny portal or registered game login.
 - [x] Private, loopback, reserved, documentation, and mapped-private addresses are never sent to ProxyCheck.
 - [x] Forwarded web IP headers are ignored unless trusted-proxy handling is explicitly enabled.
-- [x] Unknown game accounts do not trigger paid ProxyCheck lookups.
+- [x] Every authenticated Velocity login request uses the cached ProxyCheck path before identity resolution, preventing account-creation races from bypassing network policy.
 - [x] Login events and IP observations retain the available classification and approximate location.
 - [x] Users and administrators can see available location and classification in audit views.
 - [x] Repeated access observations are summarized by IPv4 /24 or IPv6 /64 network with counts, sources, and latest activity.

design/us-008-vpn-blocking.md

@@ -3,7 +3,7 @@ type: User Story
 title: Block account additions from anonymized networks
 description: User Minecraft-account additions fail closed for VPN, proxy, Tor, or unknown IP classifications.
 tags: [security, vpn, proxy, minecraft]
-timestamp: 2026-08-02T00:12:32Z
+timestamp: 2026-08-02T14:12:43Z
 story_id: US-008
 status: verified
 ---
@@ -22,6 +22,8 @@ As an operator, I want account additions blocked from anonymized networks, so th
 - [x] Blocked and classification-unavailable attempts create distinct audit events with safe intelligence details.
 - [x] Administrative account additions remain available as an authorized recovery path.
 - [x] Administrators see enriched risky-network observations collapsed to one latest summary per user.
+- [x] Game admission enforces confirmed VPN, proxy, and Tor classifications according to the user's effective-group exception policy.
+- [x] Account-addition blocking remains unchanged and independent from the game-admission exception.
 
 # Implementation
 

design/us-009-velocity-admission.md

@@ -3,7 +3,7 @@ type: User Story
 title: Enforce registration at the Velocity proxy
 description: Online-mode Java connections are admitted only after a fail-closed account-manager decision.
 tags: [minecraft, velocity, whitelist, security]
-timestamp: 2026-08-02T00:12:32Z
+timestamp: 2026-08-02T14:12:43Z
 story_id: US-009
 status: verified
 ---
@@ -23,10 +23,16 @@ As a registered player, I want the Velocity proxy to recognize my approved Java
 - [x] Successful fallback backfills UUID and canonical username.
 - [x] Changed usernames are persisted and audited.
 - [x] Registered players are allowed only when their single effective group has access enabled; explicit assignments override the default group.
+- [x] Disabled group access overrides every schedule; enabled groups with weekly windows admit logins only during an active UTC window.
+- [x] Schedule policy is checked before VPN/proxy/Tor policy and is enforced only at login.
 - [x] Unknown players, group-disabled players, API failures, malformed responses, and unauthorized requests fail closed with registration guidance.
 - [x] The plugin records the real Velocity connection IP and supports Java Edition online mode only.
 - [x] After admission, Velocity reports `PostLoginEvent` as best-effort authenticated telemetry without disconnecting an admitted player when reporting fails.
 - [x] Confirmed-connection reports use fresh timestamps and database replay protection.
+- [x] Group-disabled and VPN/proxy/Tor-policy denials return distinct operator-configured messages.
+- [x] Schedule denials return the configured static template with the effective group, player, and next UTC window.
+- [x] The default anonymized-network message directs the player to contact a host for an exception.
+- [x] API failures, malformed responses, and unauthorized requests retain fail-closed plugin fallback behavior.
 
 # Implementation
 

design/us-012-admin-operations.md

@@ -3,7 +3,7 @@ type: User Story
 title: Operate settings and audit views
 description: Authorized administrators control server messaging and investigate recent platform events.
 tags: [admin, settings, audit, operations]
-timestamp: 2026-08-01T22:34:31Z
+timestamp: 2026-08-02T14:12:43Z
 story_id: US-012
 status: verified
 ---
@@ -21,11 +21,18 @@ As an administrator, I want operational settings and audit visibility, so that I
 - [x] Event views show type, subject, IP, classification, and approximate location when available.
 - [x] Admin console access itself creates an audit event with the SSO identity.
 - [x] Settings, users, and events are linked from the shared admin navigation.
+- [x] Administrators can independently configure registration-required, group-access-disabled, schedule-denied, and VPN/proxy/Tor-denied game-message templates.
+- [x] Registration, group, and network templates accept only `{player}` and `{group}`; schedule templates also accept `{next_start}` and `{next_end}`.
+- [x] Every template is validated server-side and has a safe default.
+- [x] Admission-message changes are audited with the administrator identity without logging credentials.
 
 # Implementation
 
 - [`apps/web/src/app/admin/(console)/page.tsx`](../apps/web/src/app/admin/%28console%29/page.tsx)
 - [`apps/web/src/app/admin/(console)/actions.ts`](../apps/web/src/app/admin/%28console%29/actions.ts)
+- [`apps/web/src/lib/admission-settings.ts`](../apps/web/src/lib/admission-settings.ts)
+- [`packages/database/drizzle/0004_zippy_silver_centurion.sql`](../packages/database/drizzle/0004_zippy_silver_centurion.sql)
+- [`packages/database/drizzle/0005_young_vertigo.sql`](../packages/database/drizzle/0005_young_vertigo.sql)
 - [`apps/web/src/app/admin/(console)/events/page.tsx`](../apps/web/src/app/admin/%28console%29/events/page.tsx)
 
 # Validation

design/us-013-admin-user-management.md

@@ -3,7 +3,7 @@ type: User Story
 title: Manage users as an administrator
 description: Authorized operators search users and maintain their names, linked accounts, primaries, and Discord nicknames.
 tags: [admin, users, minecraft, discord]
-timestamp: 2026-08-01T22:34:31Z
+timestamp: 2026-08-02T15:03:59Z
 story_id: US-013
 status: verified
 ---
@@ -24,12 +24,22 @@ As an administrator, I want to manage a user's identity and Minecraft accounts,
 - [x] Administrators can set a new primary account and automatically update Discord.
 - [x] Every action rechecks role and account ownership and records the acting administrator.
 - [x] Discord failures do not falsely persist the requested name, primary, or removal change.
+- [x] Each row in the administrator user registry shows the user's effective group in an accessible dropdown.
+- [x] Selecting a group immediately applies the assignment; selecting `everyone` removes the explicit assignment.
+- [x] Group changes preserve the active user search and show accessible success or error feedback.
+- [x] Registry assignment changes revalidate administrator authorization, user existence, and group existence, and audit the previous and new effective groups.
+- [x] User rows and group-assignment controls are reusable between the Users registry and group-member details.
+- [x] Group details show only the group's effective members with identity, Discord, primary-account, account-count, status, and group columns.
+- [x] Changing a user's group requires modal confirmation and choosing `everyone` removes the explicit assignment.
+- [x] Moving a member to another group removes that user from the current effective-member list after confirmation.
 
 # Implementation
 
 - [`apps/web/src/app/admin/(console)/users/page.tsx`](../apps/web/src/app/admin/%28console%29/users/page.tsx)
 - [`apps/web/src/app/admin/(console)/users/[userId]/page.tsx`](../apps/web/src/app/admin/%28console%29/users/%5BuserId%5D/page.tsx)
 - [`apps/web/src/app/admin/(console)/users/actions.ts`](../apps/web/src/app/admin/%28console%29/users/actions.ts)
+- [`apps/web/src/components/user-group-select.tsx`](../apps/web/src/components/user-group-select.tsx)
+- [`apps/web/src/components/admin-user-table.tsx`](../apps/web/src/components/admin-user-table.tsx)
 
 # Validation
 

design/us-017-group-access.md

@@ -3,7 +3,7 @@ type: User Story
 title: Control Minecraft admission with groups
 description: Administrators assign users to groups and enable Minecraft access through explicit group policy.
 tags: [admin, groups, authorization, velocity, security]
-timestamp: 2026-08-01T23:10:59Z
+timestamp: 2026-08-02T15:03:59Z
 story_id: US-017
 status: verified
 ---
@@ -19,17 +19,30 @@ As an administrator, I want to organize registered users into access groups, so
 - [x] The `everyone` group remains created with Minecraft access disabled.
 - [x] Administrators can create groups with access disabled by default and move users between groups.
 - [x] Administrators can enable or disable Minecraft admission for each group.
+- [x] Disabled Minecraft admission always denies group members; enabled admission may additionally be restricted by recurring UTC windows.
+- [x] Groups without windows retain unrestricted scheduling, and groups with windows admit logins only during an active window.
 - [x] Admission follows only the user's effective group; default and explicit-group access are never combined.
 - [x] Administrators can delete non-default groups, returning affected users to `everyone`.
 - [x] The protected default group cannot be deleted.
 - [x] Group creation, membership, and access-policy changes are audited.
 - [x] Users and administrators can inspect the user's single effective group assignment.
+- [x] Every group has an independently configurable VPN/proxy/Tor exception policy.
+- [x] The protected `everyone` group and newly created groups disallow VPN, proxy, and Tor connections by default.
+- [x] Confirmed VPN, proxy, or Tor game connections are denied unless the user's single effective group allows anonymized networks.
+- [x] Clear and hosting classifications are not denied by this group policy, and unavailable intelligence does not independently deny a registered player.
+- [x] VPN policy changes are authorized server-side and audited.
+- [x] Group creation can explicitly initialize Minecraft and VPN/proxy/Tor policies while retaining deny-by-default controls.
+- [x] List and detail policy changes use the same confirmation workflow.
+- [x] Effective member counts include unassigned users who fall back to `everyone`.
+- [x] Group names and descriptions are validated and editable server-side.
 
 # Implementation
 
 - [`packages/database/src/schema.ts`](../packages/database/src/schema.ts)
 - [`packages/database/drizzle/0002_simple_queen_noir.sql`](../packages/database/drizzle/0002_simple_queen_noir.sql)
 - [`packages/database/drizzle/0003_smiling_silver_samurai.sql`](../packages/database/drizzle/0003_smiling_silver_samurai.sql)
+- [`packages/database/drizzle/0004_zippy_silver_centurion.sql`](../packages/database/drizzle/0004_zippy_silver_centurion.sql)
+- [`packages/database/drizzle/0005_young_vertigo.sql`](../packages/database/drizzle/0005_young_vertigo.sql)
 - [`apps/web/src/app/admin/(console)/groups/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/page.tsx)
 - [`apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/%5BgroupId%5D/page.tsx)
 - [`apps/web/src/app/api/velocity/access/route.ts`](../apps/web/src/app/api/velocity/access/route.ts)

design/us-019-admin-group-management.md

@@ -0,0 +1,48 @@
+---
+type: User Story
+title: Manage groups efficiently
+description: Administrators use concise policy tables, focused group details, and confirmed modal workflows to manage access groups.
+tags: [admin, groups, usability, authorization]
+timestamp: 2026-08-02T15:03:59Z
+story_id: US-019
+status: verified
+---
+
+# User Story
+
+As an administrator, I want a concise group policy table and focused group details, so that I can manage access without navigating cumbersome controls.
+
+# Acceptance Criteria
+
+- [x] The main Groups page lists name, Minecraft access, schedule status, VPN/proxy/Tor access, and effective member count with the default group first and remaining names ordered alphabetically.
+- [x] Policy controls show their current state and require confirmation in an accessible modal before mutation.
+- [x] Selecting a group name opens a detail page with its description, policies, and effective members.
+- [x] Add group opens an accessible modal asking for name, description, Minecraft access, and VPN/proxy/Tor access.
+- [x] New-group policies default to denied and can be enabled before creation.
+- [x] Administrators manage only the display name; an internal collision-safe slug is generated automatically.
+- [x] Administrators can edit group name and description; the protected `everyone` name remains fixed while its description remains editable.
+- [x] Non-default groups can be deleted only after modal confirmation, returning all affected users to `everyone`.
+- [x] Group identity, policy, creation, and deletion mutations commit atomically with their audit events.
+- [x] Modal controls support keyboard operation, focus management, cancellation, and clear pending state.
+- [x] Group details summarize recurring UTC access windows in the browser's local timezone.
+- [x] Administrators use a confirmed modal to add, remove, and replace multiple non-overlapping windows.
+
+# Implementation
+
+- [`apps/web/src/app/admin/(console)/groups/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/page.tsx)
+- [`apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/%5BgroupId%5D/page.tsx)
+- [`apps/web/src/app/admin/(console)/groups/actions.ts`](../apps/web/src/app/admin/%28console%29/groups/actions.ts)
+- [`apps/web/src/components/admin-modal-form.tsx`](../apps/web/src/components/admin-modal-form.tsx)
+- [`apps/web/src/components/group-policy-control.tsx`](../apps/web/src/components/group-policy-control.tsx)
+- [`apps/web/src/components/group-schedule-editor.tsx`](../apps/web/src/components/group-schedule-editor.tsx)
+- [`apps/web/src/lib/group-management.ts`](../apps/web/src/lib/group-management.ts)
+
+# Validation
+
+Native-dialog interaction and pending-state behavior are covered by [`apps/web/src/components/admin-modal-form.test.tsx`](../apps/web/src/components/admin-modal-form.test.tsx). Slug, return-path, protected-name, and effective-membership behavior are covered by [`apps/web/src/lib/group-management.test.ts`](../apps/web/src/lib/group-management.test.ts). TypeScript, lint, accessibility review, Semgrep, production build, and OKF validation pass.
+
+# Related Stories
+
+- [Manage users as an administrator](us-013-admin-user-management.md)
+- [Control Minecraft admission with groups](us-017-group-access.md)
+- [Preserve an audit trail](us-010-audit-events.md)

design/us-020-scheduled-group-access.md

@@ -0,0 +1,52 @@
+---
+type: User Story
+title: Schedule group access in UTC
+description: Administrators restrict enabled groups to recurring weekly UTC windows and provide static denial-message templates.
+tags: [admin, groups, scheduling, velocity, templates, security]
+timestamp: 2026-08-02T17:42:26Z
+story_id: US-020
+status: verified
+---
+
+# User Story
+
+As an administrator, I want an enabled group to have recurring access windows, so that its members can join only during approved weekly periods and receive useful denial guidance.
+
+# Acceptance Criteria
+
+- [x] A group can have zero or more recurring weekly access windows stored and evaluated in UTC.
+- [x] The browser shows each UTC window's current equivalent in the administrator's local timezone while clearly identifying UTC as authoritative.
+- [x] The Groups table identifies unrestricted groups and the configured window count, linking each status to schedule management.
+- [x] Administrators can add and remove multiple windows, including windows that cross the end of the UTC week.
+- [x] Window starts are inclusive and window ends are exclusive.
+- [x] No configured windows preserve unrestricted scheduling behavior while Minecraft access is enabled.
+- [x] Disabled Minecraft access always denies admission, regardless of schedule.
+- [x] Enabled Minecraft access with configured windows allows login only inside an active window.
+- [x] VPN/proxy/Tor policy is evaluated only after group access and schedule policy pass.
+- [x] Schedule enforcement occurs at login and does not disconnect an existing session when a window ends.
+- [x] Schedule changes require confirmation, reauthorize the administrator, and commit atomically with an audit event.
+- [x] Malformed or overlapping schedule data is rejected; malformed persisted policy fails closed.
+- [x] Registration, group-disabled, and VPN/proxy/Tor templates support `{player}` and `{group}`.
+- [x] Schedule-denied templates additionally support `{next_start}` and `{next_end}` for the earliest upcoming UTC window.
+- [x] Unknown template variables, control characters, and invalid lengths are rejected server-side.
+- [x] Registration denials use `everyone` when no effective group can be resolved.
+
+# Implementation
+
+- [`packages/database/src/schema.ts`](../packages/database/src/schema.ts)
+- [`packages/database/drizzle/0005_young_vertigo.sql`](../packages/database/drizzle/0005_young_vertigo.sql)
+- [`apps/web/src/lib/group-schedule.ts`](../apps/web/src/lib/group-schedule.ts)
+- [`apps/web/src/lib/admission-settings.ts`](../apps/web/src/lib/admission-settings.ts)
+- [`apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/%5BgroupId%5D/page.tsx)
+- [`apps/web/src/app/api/velocity/access/route.ts`](../apps/web/src/app/api/velocity/access/route.ts)
+
+# Validation
+
+UTC recurrence, multiple-window selection, local conversion, malformed schedules, template validation, policy precedence, and schedule-editor interactions are covered by automated tests. Drizzle generation, migration preflight, TypeScript, lint, build, security checks, and OKF validation must pass.
+
+# Related Stories
+
+- [Enforce registration at Velocity](us-009-velocity-admission.md)
+- [Operate settings and audit views](us-012-admin-operations.md)
+- [Control Minecraft admission with groups](us-017-group-access.md)
+- [Manage groups efficiently](us-019-admin-group-management.md)

docs/accessibility.md

@@ -12,6 +12,9 @@ Player account management, administrator navigation, dashboard metrics and chart
 - Darkened the accent color so accent text reaches at least 4.5:1 contrast on both canvas and panel backgrounds.
 - Preserved reduced-motion behavior and disabled decorative cursor animation when requested.
 - Added labels or accessible names to search, Minecraft username, settings, group, and event-filter controls.
+- Added reusable per-user group dropdowns that open labelled confirmation dialogs, restore the prior selection on cancellation, prevent dismissal while pending, and provide live progress and result feedback.
+- Group creation, policy, schedule editing, metadata editing, and deletion use scrollable native modal dialogs with keyboard cancellation, focus management, descriptive confirmation text, and disabled pending controls.
+- Weekly schedule rows use labelled fieldsets, weekday and time controls, explicit exclusive-end wording, authoritative UTC values, and browser-local equivalents with the detected timezone.
 - Added `fieldset` and `legend` semantics to multi-select event-type filters.
 - Added table captions, column scopes, and row scopes to administrator data tables.
 - Added `role=status` with polite announcements for successful nickname changes and `role=alert` with assertive announcements for errors.

docs/architecture.md

@@ -16,7 +16,7 @@ The bot creates private login links in response to `/register` and `/account`. D
 
 Velocity sends the authenticated Java UUID, current username, source IP, server ID, request ID, and occurrence time. The API matches UUID first. Username fallback is allowed only when the stored account has no UUID, after which UUID and canonical username are updated.
 
-The admission decision is fail closed. Unknown players, invalid responses, expired requests, authentication failures, and unavailable API responses are denied with the configured registration message. After admission succeeds, `PostLoginEvent` reports a confirmed proxy connection through a fresh, authenticated, replay-protected request. Connection telemetry is best effort and never disconnects an already admitted player.
+The admission decision is fail closed. Unknown players, disabled effective groups, out-of-window scheduled groups, disallowed confirmed VPN/proxy/Tor connections, invalid responses, expired requests, authentication failures, and unavailable API responses are denied. Policy order is fixed: registration, enabled effective group, recurring UTC schedule, then anonymized-network exception. Zero schedule windows mean no time restriction; configured starts are inclusive and ends are exclusive. Scheduling is checked only at login and never disconnects an admitted player. Registration, group-access, schedule, and anonymized-network denials use independent operator-configured static templates; validated variables provide player, group, and next-window UTC guidance without executable expressions. Transport and service failures retain the plugin's local fallback. After admission succeeds, `PostLoginEvent` reports a confirmed proxy connection through a fresh, authenticated, replay-protected request. Connection telemetry is best effort and never disconnects an already admitted player.
 
 ## Trust boundaries
 
@@ -32,13 +32,14 @@ The admission decision is fail closed. Unknown players, invalid responses, expir
 - A Discord user ID maps to one user.
 - An active Minecraft UUID or case-insensitive username maps to one account.
 - A user has at most one active primary Minecraft account.
+- Group schedule boundaries are integer UTC minutes of the recurring Monday-based week; malformed or overlapping persisted windows fail closed during admission.
 - Removed accounts are soft deleted to retain audit history.
 - Audit events are CloudEvents-shaped, append-only application records.
 - `published_at` reserves an outbox-style path for later Kafka publishing.
 
 ## IP intelligence
 
-ProxyCheck.io supplies approximate city/region/country, coordinates, timezone, ASN, network company, connection type, proxy signal, risk, and VPN/proxy/Tor classification. Results are cached in PostgreSQL for 48 hours by default. Portal and game login events are enriched when data is available; lookup failures do not deny login. User Minecraft-account additions fail closed for unknown, VPN, proxy, or Tor classifications and record denied attempts. Hosting-provider blocking is optional through `BLOCK_HOSTING_IPS=true`. Private and reserved addresses are never sent to ProxyCheck.
+ProxyCheck.io supplies approximate city/region/country, coordinates, timezone, ASN, network company, connection type, proxy signal, risk, and VPN/proxy/Tor classification. Results are cached in PostgreSQL for 48 hours by default. Portal logins and every bearer-authenticated Velocity login are enriched through the cache before identity resolution; lookup failures do not independently deny a registered player. Confirmed VPN, proxy, and Tor game connections require an exception on the player's effective group. User Minecraft-account additions fail closed for unknown, VPN, proxy, or Tor classifications and record denied attempts. Hosting-provider blocking is optional through `BLOCK_HOSTING_IPS=true`. Private and reserved addresses are never sent to ProxyCheck.
 
 ## Event naming
 

docs/security-review.md

@@ -24,8 +24,13 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
 - Velocity credentials are high-entropy bearer tokens stored only as hashes.
 - Velocity admission and confirmed-connection requests have a 45-second clock window and database-unique request IDs for cross-instance replay prevention.
 - Velocity and its API fail closed.
-- Registered players require an enabled effective group; explicit assignments replace rather than combine with the protected, disabled-by-default `everyone` fallback.
-- Group and membership mutations re-check the Keycloak administrator role server-side; destructive group deletion and its audit event commit atomically.
+- Registered players require an enabled effective group; explicit assignments replace rather than combine with the protected, disabled-by-default `everyone` fallback. Disabled access always overrides scheduling.
+- Enabled groups with recurring UTC windows admit only during an active login window. Window boundaries and overlap are validated server-side, malformed persisted policy fails closed, and connected sessions are not re-evaluated.
+- Confirmed VPN, proxy, and Tor game connections are denied unless that same effective group has an explicit exception; `everyone` and new groups default to no exception.
+- Static admission templates use a fixed allowlist of non-executable variables. Unknown placeholders and control characters are rejected, and rendered values remain plain JSON/text.
+- Group, schedule, VPN-policy, identity, and membership mutations re-check the Keycloak administrator role server-side; registry assignments, policy changes, group edits, creation, deletion, and message settings commit atomically with their audit events.
+- Group identity creation/rename and membership assignment/deletion use compatible PostgreSQL advisory and row locks to prevent duplicate names, stale audit records, or membership/deletion races. The protected default name and deletion restriction are enforced server-side.
+- Every bearer-authenticated Velocity login uses cached IP intelligence before identity resolution, preventing account-creation races from bypassing network policy; malformed provider proxy signals classify as unknown.
 - Event filters accept only event types already present in the ledger, and event detail routes remain role-protected.
 - The administrator-only map defaults to bundled Natural Earth boundaries. OpenStreetMap tile requests begin only after an explicit operator opt-in; marker coordinates are not transmitted as data, but the requested tiles disclose the viewed geographic extent along with the administrator's IP and portal origin.
 - Grouped-map popup labels and links are created with DOM `textContent` and server-rendered React escaping rather than interpolated HTML.

packages/auth/src/index.ts

@@ -115,6 +115,26 @@ export function resolveEffectiveGroup<T>(explicitGroup: T | null, defaultGroup:
   return explicitGroup ?? defaultGroup;
 }
 
+export function isGameNetworkAllowed(
+  classification: "unknown" | "clear" | "vpn" | "proxy" | "hosting" | "tor",
+  anonymizedNetworksAllowed: boolean,
+) {
+  return anonymizedNetworksAllowed || !["vpn", "proxy", "tor"].includes(classification);
+}
+
+export function gameAdmissionDenialReason(
+  group: { accessEnabled: boolean; anonymizedNetworksAllowed: boolean } | null,
+  classification: "unknown" | "clear" | "vpn" | "proxy" | "hosting" | "tor",
+  scheduleAllowed = true,
+) {
+  if (!group?.accessEnabled) return "group_access_disabled" as const;
+  if (!scheduleAllowed) return "schedule_disallowed" as const;
+  if (!isGameNetworkAllowed(classification, group.anonymizedNetworksAllowed)) {
+    return "anonymized_network_disallowed" as const;
+  }
+  return null;
+}
+
 export function verifyHashedToken(providedToken: string, expectedHash: string) {
   const provided = Buffer.from(hashToken(providedToken), "utf8");
   const expected = Buffer.from(expectedHash, "utf8");

packages/auth/test/group-access.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { resolveEffectiveGroup } from "../src/index";
+import { gameAdmissionDenialReason, isGameNetworkAllowed, resolveEffectiveGroup } from "../src/index";
 
 describe("group-based admission", () => {
   const everyone = { name: "everyone", accessEnabled: false };
@@ -17,4 +17,28 @@ describe("group-based admission", () => {
     const limited = { name: "limited", accessEnabled: false };
     expect(resolveEffectiveGroup(limited, enabledDefault)?.accessEnabled).toBe(false);
   });
+
+  it("denies confirmed anonymized game networks unless the effective group allows them", () => {
+    for (const classification of ["vpn", "proxy", "tor"] as const) {
+      expect(isGameNetworkAllowed(classification, false)).toBe(false);
+      expect(isGameNetworkAllowed(classification, true)).toBe(true);
+    }
+  });
+
+  it("does not apply the group exception policy to clear, hosting, or unavailable intelligence", () => {
+    for (const classification of ["clear", "hosting", "unknown"] as const) {
+      expect(isGameNetworkAllowed(classification, false)).toBe(true);
+    }
+  });
+
+  it("prioritizes disabled group access, then schedule, then network policy", () => {
+    expect(gameAdmissionDenialReason({ accessEnabled: false, anonymizedNetworksAllowed: false }, "vpn", false))
+      .toBe("group_access_disabled");
+    expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: false }, "vpn", false))
+      .toBe("schedule_disallowed");
+    expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: false }, "vpn", true))
+      .toBe("anonymized_network_disallowed");
+    expect(gameAdmissionDenialReason({ accessEnabled: true, anonymizedNetworksAllowed: true }, "vpn", true))
+      .toBeNull();
+  });
 });

packages/database/drizzle/0004_zippy_silver_centurion.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "app_settings" ADD COLUMN "group_access_denied_message" text DEFAULT 'Your account group does not currently have server access. Contact a host if you believe this is a mistake.' NOT NULL;--> statement-breakpoint
+ALTER TABLE "app_settings" ADD COLUMN "vpn_denied_message" text DEFAULT 'VPN, proxy, and Tor connections are not allowed. Contact a host to request an exception.' NOT NULL;--> statement-breakpoint
+ALTER TABLE "groups" ADD COLUMN "anonymized_networks_allowed" boolean DEFAULT false NOT NULL;

packages/database/drizzle/0005_young_vertigo.sql

@@ -0,0 +1,12 @@
+CREATE TABLE "group_access_windows" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"group_id" uuid NOT NULL,
+	"start_minute_of_week" integer NOT NULL,
+	"end_minute_of_week" integer NOT NULL,
+	"created_at" timestamp (3) with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "group_access_windows_minute_range_check" CHECK ("group_access_windows"."start_minute_of_week" >= 0 and "group_access_windows"."start_minute_of_week" < 10080 and "group_access_windows"."end_minute_of_week" >= 0 and "group_access_windows"."end_minute_of_week" < 10080 and "group_access_windows"."start_minute_of_week" <> "group_access_windows"."end_minute_of_week")
+);
+--> statement-breakpoint
+ALTER TABLE "app_settings" ADD COLUMN "scheduled_access_denied_message" text DEFAULT 'Your group is only allowed access from {next_start} to {next_end}.' NOT NULL;--> statement-breakpoint
+ALTER TABLE "group_access_windows" ADD CONSTRAINT "group_access_windows_group_id_groups_id_fk" FOREIGN KEY ("group_id") REFERENCES "public"."groups"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "group_access_windows_group_idx" ON "group_access_windows" USING btree ("group_id");

packages/database/drizzle/meta/_journal.json

@@ -29,6 +29,20 @@
       "when": 1785625186545,
       "tag": "0003_smiling_silver_samurai",
       "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1785678753029,
+      "tag": "0004_zippy_silver_centurion",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1785692345708,
+      "tag": "0005_young_vertigo",
+      "breakpoints": true
     }
   ]
 }

packages/database/package.json

@@ -15,12 +15,12 @@
   },
   "dependencies": {
     "@minecraft-account-manager/auth": "*",
+    "drizzle-kit": "^0.31.10",
     "drizzle-orm": "^0.45.1",
-    "postgres": "^3.4.8"
+    "postgres": "^3.4.8",
+    "tsx": "^4.21.0"
   },
   "devDependencies": {
-    "drizzle-kit": "^0.31.10",
-    "tsx": "^4.21.0",
     "typescript": "^5.9.3"
   }
 }

packages/database/src/schema.ts

@@ -1,7 +1,9 @@
 import { sql } from "drizzle-orm";
 import {
   boolean,
+  check,
   index,
+  integer,
   inet,
   jsonb,
   pgEnum,
@@ -70,6 +72,7 @@ export const groups = pgTable(
     slug: varchar("slug", { length: 50 }).notNull(),
     description: text("description"),
     accessEnabled: boolean("access_enabled").notNull().default(false),
+    anonymizedNetworksAllowed: boolean("anonymized_networks_allowed").notNull().default(false),
     isDefault: boolean("is_default").notNull().default(false),
     ...timestamps(),
   },
@@ -79,6 +82,26 @@ export const groups = pgTable(
   ],
 );
 
+export const groupAccessWindows = pgTable(
+  "group_access_windows",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    groupId: uuid("group_id")
+      .notNull()
+      .references(() => groups.id, { onDelete: "cascade" }),
+    startMinuteOfWeek: integer("start_minute_of_week").notNull(),
+    endMinuteOfWeek: integer("end_minute_of_week").notNull(),
+    createdAt: createdAt(),
+  },
+  (table) => [
+    index("group_access_windows_group_idx").on(table.groupId),
+    check(
+      "group_access_windows_minute_range_check",
+      sql`${table.startMinuteOfWeek} >= 0 and ${table.startMinuteOfWeek} < 10080 and ${table.endMinuteOfWeek} >= 0 and ${table.endMinuteOfWeek} < 10080 and ${table.startMinuteOfWeek} <> ${table.endMinuteOfWeek}`,
+    ),
+  ],
+);
+
 export const userGroupMemberships = pgTable(
   "user_group_memberships",
   {
@@ -171,6 +194,15 @@ export const appSettings = pgTable("app_settings", {
   registrationMessage: text("registration_message")
     .notNull()
     .default("Please register your Minecraft account before joining."),
+  groupAccessDeniedMessage: text("group_access_denied_message")
+    .notNull()
+    .default("Your account group does not currently have server access. Contact a host if you believe this is a mistake."),
+  vpnDeniedMessage: text("vpn_denied_message")
+    .notNull()
+    .default("VPN, proxy, and Tor connections are not allowed. Contact a host to request an exception."),
+  scheduledAccessDeniedMessage: text("scheduled_access_denied_message")
+    .notNull()
+    .default("Your group is only allowed access from {next_start} to {next_end}."),
   ...timestamps(),
 });
 

packages/network/src/index.ts

@@ -51,7 +51,9 @@ function numberValue(value: unknown) {
 }
 
 function proxyClassification(proxy: unknown, type: unknown): IpClassification {
-  if (String(proxy).toLowerCase() !== "yes") return "clear";
+  const normalizedProxy = String(proxy).toLowerCase();
+  if (normalizedProxy === "no") return "clear";
+  if (normalizedProxy !== "yes") return "unknown";
   const normalizedType = String(type ?? "").toLowerCase();
   if (normalizedType.includes("tor")) return "tor";
   if (normalizedType.includes("vpn")) return "vpn";

packages/network/test/proxycheck.test.ts

@@ -50,6 +50,14 @@ describe("ProxyCheck.io intelligence", () => {
     );
   });
 
+  it("treats missing or malformed proxy signals as unknown", async () => {
+    for (const proxy of [undefined, null, "maybe"] as const) {
+      const request = vi.fn<typeof fetch>().mockResolvedValue(response({ proxy, type: "Residential" }));
+      await expect(new ProxyCheckProvider({ apiKey: "secret", request }).classify(ipAddress))
+        .resolves.toMatchObject({ classification: "unknown", network: { proxy: null } });
+    }
+  });
+
   it("maps VPN and Tor responses to explicit classifications", async () => {
     const vpnRequest = vi.fn<typeof fetch>().mockResolvedValue(response({ proxy: "yes", type: "VPN" }));
     const torRequest = vi.fn<typeof fetch>().mockResolvedValue(response({ proxy: "yes", type: "TOR" }));

plugins/velocity/README.md

@@ -1,6 +1,6 @@
 # Velocity admission plugin
 
-The plugin checks every online-mode Java login against the account-manager API. It fails closed: unavailable, unauthorized, stale, replayed, malformed, and unknown requests are denied. After a player completes proxy login, the plugin sends best-effort `PostLoginEvent` telemetry used for confirmed-connection activity metrics; reporting failure is logged without disconnecting the player.
+The plugin checks every online-mode Java login against the account-manager API. It fails closed: unavailable, unauthorized, stale, replayed, malformed, unknown-account, group-disabled, and group-policy VPN/proxy/Tor requests are denied. After a player completes proxy login, the plugin sends best-effort `PostLoginEvent` telemetry used for confirmed-connection activity metrics; reporting failure is logged without disconnecting the player.
 
 ## Download or build
 
@@ -31,4 +31,4 @@ npm run plugin:create-credential --workspace @minecraft-account-manager/database
 
 Copy the displayed token into the plugin's `api-token`. Configure the HTTPS account-manager URL and ensure `server-id` matches. Restrict access to the plugin configuration because it contains the bearer token, then restart Velocity.
 
-The proxy must run in online mode. Unknown players and API failures receive the configured registration message.
+The proxy must run in online mode. Unknown players, disabled groups, and disallowed VPN/proxy/Tor connections receive their operator-configured API message. API failures receive the plugin's local registration fallback.