55 lines
6.0 KiB
Markdown
55 lines
6.0 KiB
Markdown
---
|
|
type: User Story
|
|
title: Operate servers through an RCON console
|
|
description: Administrators execute bounded RCON commands through the server-side portal proxy.
|
|
tags: [admin, rcon, minecraft, console, security]
|
|
timestamp: 2026-08-14T01:23:35Z
|
|
story_id: US-022
|
|
status: verified
|
|
---
|
|
|
|
# User Story
|
|
|
|
As an administrator, I want an RCON console in the portal, so that I can operate configured Minecraft servers without exposing credentials to the browser.
|
|
|
|
# Acceptance Criteria
|
|
|
|
- [x] Existing account-manager administrators can select an enabled connection and execute an RCON command from the admin UI.
|
|
- [x] Browsers never connect to RCON directly; commands pass through the authenticated Next.js server runtime to the configured endpoint.
|
|
- [x] Every command independently rechecks administrator authorization and the selected connection's enabled state.
|
|
- [x] Commands are length-limited, reject control characters, execute with bounded concurrency and a timeout, and return bounded output.
|
|
- [x] Command responses are displayed safely, and commands and responses are not persisted in browser storage or application logs.
|
|
- [x] Every valid command is written to a `games.minecraft.account-manager.rcon.command.requested` audit event before it is sent.
|
|
- [x] The requested event records the complete command, administrator identity, server ID and name, timestamp, command verb, and command digest.
|
|
- [x] The corresponding `games.minecraft.account-manager.rcon.command.completed` event records success or failure, a safe failure reason, and duration without storing the RCON response.
|
|
- [x] A command is not sent if its required requested audit event cannot be recorded.
|
|
- [x] Administrators can search persistent RCON command history by command text and filter it by server and administrator.
|
|
- [x] History results show when the command was sent, who sent it, its target server, and its outcome.
|
|
- [x] Browser page-memory recall remains separate from persistent audit-backed history.
|
|
- [x] Authentication, timeout, and connection failures return safe operator-facing messages without credentials or stack traces.
|
|
- [x] The console spans the available content width and uses the portal color palette to present a terminal-style server header with connection controls, a single keyboard-accessible prompt, pending state, and scrollable transcript viewport.
|
|
- [x] Configured server addresses may be internal or external, and operators receive guidance that RCON network exposure and transport security remain their responsibility.
|
|
- [x] Connection errors and connection-operation results appear in the terminal viewport, including an actionable empty state when no connection exists.
|
|
- [x] The page has no duplicate connection form or connection-list panel outside the terminal workspace.
|
|
- [x] A bounded page-memory-only history lets administrators use Arrow Up and Arrow Down to recall and edit commands, then restore the unsent draft after the newest history entry.
|
|
- [x] After each command result and server selection change, focus returns to the command input for immediate editing or resubmission.
|
|
- [x] A bounded chronological transcript retains up to 50 page-memory command/response exchanges, labels each selected server and submitted command, places its safe response or error directly below it, and scrolls to the newest exchange.
|
|
|
|
# Implementation
|
|
|
|
The full-width portal-colored terminal workspace identifies and manages the selected server in its header, accepts one command through a keyboard-focused prompt, and displays connection-operation notices plus up to 50 chronological command/response exchanges in one auto-scrolling viewport. Each exchange labels its server and complete submitted command, then places the bounded safe response or error directly below it. It retains an actionable terminal and Add control when no connections exist, with no duplicate configuration panels. Up to 50 submitted commands remain only in page memory for editable Arrow Up/Arrow Down recall, including restoration of the current unsent draft; focus returns to the prompt after command results and server changes.
|
|
|
|
The client invokes an authenticated server action that revalidates the enabled connection, decrypts its credential only in the server runtime, and executes one bounded command. Before gateway execution, the action records the complete command and administrator in a requested event; if that write fails, the command is not sent. A shared correlation ID associates the requested event with its credential- and response-safe completion event. The gateway limits each process to one operation per server and eight total operations, applies a five-second end-to-end deadline plus bounded cleanup, and sanitizes and truncates output.
|
|
|
|
The protected command-history route reads these audit events, pairs lifecycle outcomes by correlation ID, and searches the latest 100 matching commands by command text, server, and administrator. It remains separate from the console's page-memory recall and links each result to its complete CloudEvent envelope.
|
|
|
|
# Validation
|
|
|
|
Application behavior is verified with gateway, validation, component, credential, server-action, and command-history tests; full workspace tests and type checks; web lint; OKF validation; Semgrep; dependency audit; and a production Next.js build on 2026-08-14. Action tests confirm audit-before-send behavior, complete command and administrator attribution, lifecycle correlation, safe outcomes, and response and credential exclusion. History tests confirm bounded filters, lifecycle pairing, and pending outcomes; component tests confirm the persistent-history link remains distinct from page-memory command recall and transcript behavior. The SoMC GitOps deployment previously verified Season 4 RCON through an authenticated internal ClusterIP Service backed by a Kubernetes Secret while product guidance also covers external server addresses.
|
|
|
|
# Related Stories
|
|
|
|
- [Manage RCON server connections](us-021-rcon-connections.md)
|
|
- [Operate settings and audit views](us-012-admin-operations.md)
|
|
- [Preserve an audit trail](us-010-audit-events.md)
|