2.0 KiB
2.0 KiB
type, title, description, tags, timestamp, story_id, status
| type | title | description | tags | timestamp | story_id | status | ||||
|---|---|---|---|---|---|---|---|---|---|---|
| User Story | Block account additions from anonymized networks | User Minecraft-account additions fail closed for VPN, proxy, Tor, or unknown IP classifications. |
|
2026-08-02T14:12:43Z | US-008 | verified |
User Story
As an operator, I want account additions blocked from anonymized networks, so that whitelist identities are established from attributable connections.
Acceptance Criteria
- VPN, proxy, and Tor classifications block user account additions.
- Unknown or unavailable classification blocks additions rather than failing open.
- Hosting-provider ranges can be blocked through deployment configuration.
- Normal portal use and game login are not denied solely because intelligence is unavailable.
- Blocked users receive a clear recovery message without provider internals.
- Blocked and classification-unavailable attempts create distinct audit events with safe intelligence details.
- Administrative account additions remain available as an authorized recovery path.
- Administrators see enriched risky-network observations collapsed to one latest summary per user.
- Game admission enforces confirmed VPN, proxy, and Tor classifications according to the user's effective-group exception policy.
- Account-addition blocking remains unchanged and independent from the game-admission exception.
Implementation
apps/web/src/lib/ip-intelligence.tsapps/web/src/app/welcome/actions.tsapps/web/src/app/account/actions.ts- Configuration:
PROXYCHECK_API_KEY,BLOCK_HOSTING_IPS,TRUST_PROXY
Validation
The fail-closed classification policy and provider mappings are covered by packages/network/test/proxycheck.test.ts.