53 lines
3.1 KiB
Markdown
53 lines
3.1 KiB
Markdown
---
|
|
type: User Story
|
|
title: Control Minecraft admission with groups
|
|
description: Administrators assign users to groups and enable Minecraft access through explicit group policy.
|
|
tags: [admin, groups, authorization, velocity, security]
|
|
timestamp: 2026-08-02T14:12:43Z
|
|
story_id: US-017
|
|
status: verified
|
|
---
|
|
|
|
# User Story
|
|
|
|
As an administrator, I want to organize registered users into access groups, so that server admission can be enabled for selected communities while remaining off by default.
|
|
|
|
# Acceptance Criteria
|
|
|
|
- [x] A registered user can have at most one explicit group assignment.
|
|
- [x] Users without an explicit assignment fall back to the protected `everyone` group.
|
|
- [x] The `everyone` group remains created with Minecraft access disabled.
|
|
- [x] Administrators can create groups with access disabled by default and move users between groups.
|
|
- [x] Administrators can enable or disable Minecraft admission for each group.
|
|
- [x] Admission follows only the user's effective group; default and explicit-group access are never combined.
|
|
- [x] Administrators can delete non-default groups, returning affected users to `everyone`.
|
|
- [x] The protected default group cannot be deleted.
|
|
- [x] Group creation, membership, and access-policy changes are audited.
|
|
- [x] Users and administrators can inspect the user's single effective group assignment.
|
|
- [x] Every group has an independently configurable VPN/proxy/Tor exception policy.
|
|
- [x] The protected `everyone` group and newly created groups disallow VPN, proxy, and Tor connections by default.
|
|
- [x] Confirmed VPN, proxy, or Tor game connections are denied unless the user's single effective group allows anonymized networks.
|
|
- [x] Clear and hosting classifications are not denied by this group policy, and unavailable intelligence does not independently deny a registered player.
|
|
- [x] VPN policy changes are authorized server-side and audited.
|
|
|
|
# Implementation
|
|
|
|
- [`packages/database/src/schema.ts`](../packages/database/src/schema.ts)
|
|
- [`packages/database/drizzle/0002_simple_queen_noir.sql`](../packages/database/drizzle/0002_simple_queen_noir.sql)
|
|
- [`packages/database/drizzle/0003_smiling_silver_samurai.sql`](../packages/database/drizzle/0003_smiling_silver_samurai.sql)
|
|
- [`packages/database/drizzle/0004_zippy_silver_centurion.sql`](../packages/database/drizzle/0004_zippy_silver_centurion.sql)
|
|
- [`apps/web/src/app/admin/(console)/groups/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/page.tsx)
|
|
- [`apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/%5BgroupId%5D/page.tsx)
|
|
- [`apps/web/src/app/api/velocity/access/route.ts`](../apps/web/src/app/api/velocity/access/route.ts)
|
|
|
|
# Validation
|
|
|
|
- [`packages/auth/test/group-access.test.ts`](../packages/auth/test/group-access.test.ts)
|
|
- Drizzle migration generation, TypeScript validation, tests, lint, and the production build must pass.
|
|
|
|
# Related Stories
|
|
|
|
- [Enforce registration at Velocity](us-009-velocity-admission.md)
|
|
- [Manage users as an administrator](us-013-admin-user-management.md)
|
|
- [Preserve an audit trail](us-010-audit-events.md)
|