60 lines
3.8 KiB
Markdown
60 lines
3.8 KiB
Markdown
---
|
|
type: User Story
|
|
title: Control Minecraft admission with groups
|
|
description: Administrators assign users to groups and enable Minecraft access through explicit group policy.
|
|
tags: [admin, groups, authorization, velocity, security]
|
|
timestamp: 2026-08-02T15:03:59Z
|
|
story_id: US-017
|
|
status: verified
|
|
---
|
|
|
|
# User Story
|
|
|
|
As an administrator, I want to organize registered users into access groups, so that server admission can be enabled for selected communities while remaining off by default.
|
|
|
|
# Acceptance Criteria
|
|
|
|
- [x] A registered user can have at most one explicit group assignment.
|
|
- [x] Users without an explicit assignment fall back to the protected `everyone` group.
|
|
- [x] The `everyone` group remains created with Minecraft access disabled.
|
|
- [x] Administrators can create groups with access disabled by default and move users between groups.
|
|
- [x] Administrators can enable or disable Minecraft admission for each group.
|
|
- [x] Disabled Minecraft admission always denies group members; enabled admission may additionally be restricted by recurring UTC windows.
|
|
- [x] Groups without windows retain unrestricted scheduling, and groups with windows admit logins only during an active window.
|
|
- [x] Admission follows only the user's effective group; default and explicit-group access are never combined.
|
|
- [x] Administrators can delete non-default groups, returning affected users to `everyone`.
|
|
- [x] The protected default group cannot be deleted.
|
|
- [x] Group creation, membership, and access-policy changes are audited.
|
|
- [x] Users and administrators can inspect the user's single effective group assignment.
|
|
- [x] Every group has an independently configurable VPN/proxy/Tor exception policy.
|
|
- [x] The protected `everyone` group and newly created groups disallow VPN, proxy, and Tor connections by default.
|
|
- [x] Confirmed VPN, proxy, or Tor game connections are denied unless the user's single effective group allows anonymized networks.
|
|
- [x] Clear and hosting classifications are not denied by this group policy, and unavailable intelligence does not independently deny a registered player.
|
|
- [x] VPN policy changes are authorized server-side and audited.
|
|
- [x] Group creation can explicitly initialize Minecraft and VPN/proxy/Tor policies while retaining deny-by-default controls.
|
|
- [x] List and detail policy changes use the same confirmation workflow.
|
|
- [x] Effective member counts include unassigned users who fall back to `everyone`.
|
|
- [x] Group names and descriptions are validated and editable server-side.
|
|
|
|
# Implementation
|
|
|
|
- [`packages/database/src/schema.ts`](../packages/database/src/schema.ts)
|
|
- [`packages/database/drizzle/0002_simple_queen_noir.sql`](../packages/database/drizzle/0002_simple_queen_noir.sql)
|
|
- [`packages/database/drizzle/0003_smiling_silver_samurai.sql`](../packages/database/drizzle/0003_smiling_silver_samurai.sql)
|
|
- [`packages/database/drizzle/0004_zippy_silver_centurion.sql`](../packages/database/drizzle/0004_zippy_silver_centurion.sql)
|
|
- [`packages/database/drizzle/0005_young_vertigo.sql`](../packages/database/drizzle/0005_young_vertigo.sql)
|
|
- [`apps/web/src/app/admin/(console)/groups/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/page.tsx)
|
|
- [`apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/%5BgroupId%5D/page.tsx)
|
|
- [`apps/web/src/app/api/velocity/access/route.ts`](../apps/web/src/app/api/velocity/access/route.ts)
|
|
|
|
# Validation
|
|
|
|
- [`packages/auth/test/group-access.test.ts`](../packages/auth/test/group-access.test.ts)
|
|
- Drizzle migration generation, TypeScript validation, tests, lint, and the production build must pass.
|
|
|
|
# Related Stories
|
|
|
|
- [Enforce registration at Velocity](us-009-velocity-admission.md)
|
|
- [Manage users as an administrator](us-013-admin-user-management.md)
|
|
- [Preserve an audit trail](us-010-audit-events.md)
|