40 lines
1.7 KiB
Markdown
40 lines
1.7 KiB
Markdown
---
|
|
type: User Story
|
|
title: Block account additions from anonymized networks
|
|
description: User Minecraft-account additions fail closed for VPN, proxy, Tor, or unknown IP classifications.
|
|
tags: [security, vpn, proxy, minecraft]
|
|
timestamp: 2026-08-01T18:43:58Z
|
|
story_id: US-008
|
|
status: verified
|
|
---
|
|
|
|
# User Story
|
|
|
|
As an operator, I want account additions blocked from anonymized networks, so that whitelist identities are established from attributable connections.
|
|
|
|
# Acceptance Criteria
|
|
|
|
- [x] VPN, proxy, and Tor classifications block user account additions.
|
|
- [x] Unknown or unavailable classification blocks additions rather than failing open.
|
|
- [x] Hosting-provider ranges can be blocked through deployment configuration.
|
|
- [x] Normal portal use and game login are not denied solely because intelligence is unavailable.
|
|
- [x] Blocked users receive a clear recovery message without provider internals.
|
|
- [x] Blocked and classification-unavailable attempts create distinct audit events with safe intelligence details.
|
|
- [x] Administrative account additions remain available as an authorized recovery path.
|
|
|
|
# Implementation
|
|
|
|
- [`apps/web/src/lib/ip-intelligence.ts`](../apps/web/src/lib/ip-intelligence.ts)
|
|
- [`apps/web/src/app/welcome/actions.ts`](../apps/web/src/app/welcome/actions.ts)
|
|
- [`apps/web/src/app/account/actions.ts`](../apps/web/src/app/account/actions.ts)
|
|
- Configuration: `PROXYCHECK_API_KEY`, `BLOCK_HOSTING_IPS`, `TRUST_PROXY`
|
|
|
|
# Validation
|
|
|
|
The fail-closed classification policy and provider mappings are covered by [`packages/network/test/proxycheck.test.ts`](../packages/network/test/proxycheck.test.ts).
|
|
|
|
# Related Stories
|
|
|
|
- [Enrich login IPs](us-007-ip-intelligence.md)
|
|
- [Validate Minecraft accounts](us-004-minecraft-validation.md)
|