2.3 KiB
2.3 KiB
type, title, description, tags, timestamp, story_id, status
| type | title | description | tags | timestamp | story_id | status | ||||
|---|---|---|---|---|---|---|---|---|---|---|
| User Story | Enrich portal and game login IPs | Login audit events include cached approximate location and network intelligence from ProxyCheck.io. |
|
2026-08-02T14:12:43Z | US-007 | verified |
User Story
As an operator, I want portal and registered game logins enriched with network context, so that suspicious access can be investigated.
Acceptance Criteria
- Given a public login IP, then ProxyCheck can provide city, region, country, coordinates, timezone, ASN, provider, risk, and anonymity classification.
- Results are cached in PostgreSQL for 48 hours by default.
- Provider failures are cached briefly and do not deny portal or registered game login.
- Private, loopback, reserved, documentation, and mapped-private addresses are never sent to ProxyCheck.
- Forwarded web IP headers are ignored unless trusted-proxy handling is explicitly enabled.
- Every authenticated Velocity login request uses the cached ProxyCheck path before identity resolution, preventing account-creation races from bypassing network policy.
- Login events and IP observations retain the available classification and approximate location.
- Users and administrators can see available location and classification in audit views.
- Repeated access observations are summarized by IPv4 /24 or IPv6 /64 network with counts, sources, and latest activity.
Implementation
packages/network/src/index.tsapps/web/src/lib/ip-intelligence.tsapps/web/src/app/auth/discord/route.tsapps/web/src/app/api/velocity/access/route.ts
Validation
packages/network/test/proxycheck.test.tspackages/network/test/client-ip.test.tspackages/network/test/address-groups.test.tsapps/web/src/lib/access-address-groups.test.ts