3.8 KiB
3.8 KiB
type, title, description, tags, timestamp, story_id, status
| type | title | description | tags | timestamp | story_id | status | |||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| User Story | Control Minecraft admission with groups | Administrators assign users to groups and enable Minecraft access through explicit group policy. |
|
2026-08-02T15:03:59Z | US-017 | verified |
User Story
As an administrator, I want to organize registered users into access groups, so that server admission can be enabled for selected communities while remaining off by default.
Acceptance Criteria
- A registered user can have at most one explicit group assignment.
- Users without an explicit assignment fall back to the protected
everyonegroup. - The
everyonegroup remains created with Minecraft access disabled. - Administrators can create groups with access disabled by default and move users between groups.
- Administrators can enable or disable Minecraft admission for each group.
- Disabled Minecraft admission always denies group members; enabled admission may additionally be restricted by recurring UTC windows.
- Groups without windows retain unrestricted scheduling, and groups with windows admit logins only during an active window.
- Admission follows only the user's effective group; default and explicit-group access are never combined.
- Administrators can delete non-default groups, returning affected users to
everyone. - The protected default group cannot be deleted.
- Group creation, membership, and access-policy changes are audited.
- Users and administrators can inspect the user's single effective group assignment.
- Every group has an independently configurable VPN/proxy/Tor exception policy.
- The protected
everyonegroup and newly created groups disallow VPN, proxy, and Tor connections by default. - Confirmed VPN, proxy, or Tor game connections are denied unless the user's single effective group allows anonymized networks.
- Clear and hosting classifications are not denied by this group policy, and unavailable intelligence does not independently deny a registered player.
- VPN policy changes are authorized server-side and audited.
- Group creation can explicitly initialize Minecraft and VPN/proxy/Tor policies while retaining deny-by-default controls.
- List and detail policy changes use the same confirmation workflow.
- Effective member counts include unassigned users who fall back to
everyone. - Group names and descriptions are validated and editable server-side.
Implementation
packages/database/src/schema.tspackages/database/drizzle/0002_simple_queen_noir.sqlpackages/database/drizzle/0003_smiling_silver_samurai.sqlpackages/database/drizzle/0004_zippy_silver_centurion.sqlpackages/database/drizzle/0005_young_vertigo.sqlapps/web/src/app/admin/(console)/groups/page.tsxapps/web/src/app/admin/(console)/groups/[groupId]/page.tsxapps/web/src/app/api/velocity/access/route.ts
Validation
packages/auth/test/group-access.test.ts- Drizzle migration generation, TypeScript validation, tests, lint, and the production build must pass.