2.2 KiB
2.2 KiB
type, title, description, tags, timestamp, story_id, status
| type | title | description | tags | timestamp | story_id | status | ||||
|---|---|---|---|---|---|---|---|---|---|---|
| User Story | Enforce registration at the Velocity proxy | Online-mode Java connections are admitted only after a fail-closed account-manager decision. |
|
2026-08-01T22:34:31Z | US-009 | verified |
User Story
As a registered player, I want the Velocity proxy to recognize my approved Java account, so that I can join while unknown identities are rejected.
Acceptance Criteria
- The plugin sends request ID, server ID, online-mode UUID, username, IP, and occurrence time.
- Every request uses a high-entropy per-server bearer credential stored only as a hash by the service.
- Requests outside the 45-second clock window are rejected.
- Database-unique request IDs reject cross-instance replay attempts.
- UUID matching is attempted before username fallback.
- Username fallback applies only when the stored account has no UUID.
- Successful fallback backfills UUID and canonical username.
- Changed usernames are persisted and audited.
- Registered players are allowed only when at least one assigned group has access enabled.
- Unknown players, group-disabled players, API failures, malformed responses, and unauthorized requests fail closed with registration guidance.
- The plugin records the real Velocity connection IP and supports Java Edition online mode only.
Implementation
plugins/velocityapps/web/src/app/api/velocity/access/route.tspackages/contracts/src/index.tspackages/database/src/schema.ts
Validation
plugins/velocity/src/test/java/games/dmg/accountmanager/AccountManagerClientTest.java- Shared request and response contracts are covered by
packages/contracts/test/contracts.test.ts.