---
type: User Story
title: Control Minecraft admission with groups
description: Administrators assign users to groups and enable Minecraft access through explicit group policy.
tags: [admin, groups, authorization, velocity, security]
timestamp: 2026-08-02T15:03:59Z
story_id: US-017
status: verified
---

# User Story

As an administrator, I want to organize registered users into access groups, so that server admission can be enabled for selected communities while remaining off by default.

# Acceptance Criteria

- [x] A registered user can have at most one explicit group assignment.
- [x] Users without an explicit assignment fall back to the protected `everyone` group.
- [x] The `everyone` group remains created with Minecraft access disabled.
- [x] Administrators can create groups with access disabled by default and move users between groups.
- [x] Administrators can enable or disable Minecraft admission for each group.
- [x] Admission follows only the user's effective group; default and explicit-group access are never combined.
- [x] Administrators can delete non-default groups, returning affected users to `everyone`.
- [x] The protected default group cannot be deleted.
- [x] Group creation, membership, and access-policy changes are audited.
- [x] Users and administrators can inspect the user's single effective group assignment.
- [x] Every group has an independently configurable VPN/proxy/Tor exception policy.
- [x] The protected `everyone` group and newly created groups disallow VPN, proxy, and Tor connections by default.
- [x] Confirmed VPN, proxy, or Tor game connections are denied unless the user's single effective group allows anonymized networks.
- [x] Clear and hosting classifications are not denied by this group policy, and unavailable intelligence does not independently deny a registered player.
- [x] VPN policy changes are authorized server-side and audited.
- [x] Group creation can explicitly initialize Minecraft and VPN/proxy/Tor policies while retaining deny-by-default controls.
- [x] List and detail policy changes use the same confirmation workflow.
- [x] Effective member counts include unassigned users who fall back to `everyone`.
- [x] Group names and descriptions are validated and editable server-side.

# Implementation

- [`packages/database/src/schema.ts`](../packages/database/src/schema.ts)
- [`packages/database/drizzle/0002_simple_queen_noir.sql`](../packages/database/drizzle/0002_simple_queen_noir.sql)
- [`packages/database/drizzle/0003_smiling_silver_samurai.sql`](../packages/database/drizzle/0003_smiling_silver_samurai.sql)
- [`packages/database/drizzle/0004_zippy_silver_centurion.sql`](../packages/database/drizzle/0004_zippy_silver_centurion.sql)
- [`apps/web/src/app/admin/(console)/groups/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/page.tsx)
- [`apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/%5BgroupId%5D/page.tsx)
- [`apps/web/src/app/api/velocity/access/route.ts`](../apps/web/src/app/api/velocity/access/route.ts)

# Validation

- [`packages/auth/test/group-access.test.ts`](../packages/auth/test/group-access.test.ts)
- Drizzle migration generation, TypeScript validation, tests, lint, and the production build must pass.

# Related Stories

- [Enforce registration at Velocity](us-009-velocity-admission.md)
- [Manage users as an administrator](us-013-admin-user-management.md)
- [Preserve an audit trail](us-010-audit-events.md)