3.3 KiB
3.3 KiB
type, title, description, tags, timestamp, story_id, status
| type | title | description | tags | timestamp | story_id | status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| User Story | Schedule group access in UTC | Administrators restrict enabled groups to recurring weekly UTC windows and provide static denial-message templates. |
|
2026-08-02T17:42:26Z | US-020 | verified |
User Story
As an administrator, I want an enabled group to have recurring access windows, so that its members can join only during approved weekly periods and receive useful denial guidance.
Acceptance Criteria
- A group can have zero or more recurring weekly access windows stored and evaluated in UTC.
- The browser shows each UTC window's current equivalent in the administrator's local timezone while clearly identifying UTC as authoritative.
- The Groups table identifies unrestricted groups and the configured window count, linking each status to schedule management.
- Administrators can add and remove multiple windows, including windows that cross the end of the UTC week.
- Window starts are inclusive and window ends are exclusive.
- No configured windows preserve unrestricted scheduling behavior while Minecraft access is enabled.
- Disabled Minecraft access always denies admission, regardless of schedule.
- Enabled Minecraft access with configured windows allows login only inside an active window.
- VPN/proxy/Tor policy is evaluated only after group access and schedule policy pass.
- Schedule enforcement occurs at login and does not disconnect an existing session when a window ends.
- Schedule changes require confirmation, reauthorize the administrator, and commit atomically with an audit event.
- Malformed or overlapping schedule data is rejected; malformed persisted policy fails closed.
- Registration, group-disabled, and VPN/proxy/Tor templates support
{player}and{group}. - Schedule-denied templates additionally support
{next_start}and{next_end}for the earliest upcoming UTC window. - Unknown template variables, control characters, and invalid lengths are rejected server-side.
- Registration denials use
everyonewhen no effective group can be resolved.
Implementation
packages/database/src/schema.tspackages/database/drizzle/0005_young_vertigo.sqlapps/web/src/lib/group-schedule.tsapps/web/src/lib/admission-settings.tsapps/web/src/app/admin/(console)/groups/[groupId]/page.tsxapps/web/src/app/api/velocity/access/route.ts
Validation
UTC recurrence, multiple-window selection, local conversion, malformed schedules, template validation, policy precedence, and schedule-editor interactions are covered by automated tests. Drizzle generation, migration preflight, TypeScript, lint, build, security checks, and OKF validation must pass.