Add "servermods" folder to ignored folders in backups

Caused by 72ddaf91.

.config/dotnet-tools.json

@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "dotnet-ef": {
-      "version": "7.0.0-rc.1.22426.7",
+      "version": "8.0.3",
       "commands": [
         "dotnet-ef"
       ]

Agent/Phantom.Agent.Minecraft/Launcher/BaseLauncher.cs

@@ -1,4 +1,5 @@
-using System.Text;
+using System.Collections.ObjectModel;
+using System.Text;
 using Phantom.Agent.Minecraft.Instance;
 using Phantom.Agent.Minecraft.Java;
 using Phantom.Agent.Minecraft.Server;
@@ -11,6 +12,7 @@ public abstract class BaseLauncher : IServerLauncher {
 	private readonly InstanceProperties instanceProperties;
 
 	protected string MinecraftVersion => instanceProperties.ServerVersion;
+	protected string InstanceFolder => instanceProperties.InstanceFolder;
 
 	private protected BaseLauncher(InstanceProperties instanceProperties) {
 		this.instanceProperties = instanceProperties;
@@ -51,16 +53,14 @@ public abstract class BaseLauncher : IServerLauncher {
 		
 		var processConfigurator = new ProcessConfigurator {
 			FileName = javaRuntimeExecutable.ExecutablePath,
-			WorkingDirectory = instanceProperties.InstanceFolder,
+			WorkingDirectory = InstanceFolder,
 			RedirectInput = true,
 			UseShellExecute = false
 		};
 		
 		var processArguments = processConfigurator.ArgumentList;
 		PrepareJvmArguments(serverJar).Build(processArguments);
-		processArguments.Add("-jar");
-		processArguments.Add(serverJar.FilePath);
-		processArguments.Add("nogui");
+		PrepareJavaProcessArguments(processArguments, serverJar.FilePath);
 
 		var process = processConfigurator.CreateProcess();
 		var instanceProcess = new InstanceProcess(instanceProperties, process);
@@ -99,6 +99,12 @@ public abstract class BaseLauncher : IServerLauncher {
 
 	private protected virtual void CustomizeJvmArguments(JvmArgumentBuilder arguments) {}
 
+	protected virtual void PrepareJavaProcessArguments(Collection<string> processArguments, string serverJarFilePath) {
+		processArguments.Add("-jar");
+		processArguments.Add(serverJarFilePath);
+		processArguments.Add("nogui");
+	}
+
 	private protected virtual Task<ServerJarInfo> PrepareServerJar(ILogger logger, string serverJarPath, CancellationToken cancellationToken) {
 		return Task.FromResult(new ServerJarInfo(serverJarPath));
 	}

Agent/Phantom.Agent.Minecraft/Launcher/Types/ForgeLauncher.cs

@@ -0,0 +1,29 @@
+using System.Collections.ObjectModel;
+using Phantom.Agent.Minecraft.Instance;
+using Phantom.Agent.Minecraft.Java;
+using Serilog;
+
+namespace Phantom.Agent.Minecraft.Launcher.Types; 
+
+public sealed class ForgeLauncher : BaseLauncher {
+	public ForgeLauncher(InstanceProperties instanceProperties) : base(instanceProperties) {}
+	
+	private protected override void CustomizeJvmArguments(JvmArgumentBuilder arguments) {
+		arguments.AddProperty("terminal.ansi", "true"); // TODO
+	}
+
+	protected override void PrepareJavaProcessArguments(Collection<string> processArguments, string serverJarFilePath) {
+		if (OperatingSystem.IsWindows()) {
+			processArguments.Add("@libraries/net/minecraftforge/forge/1.20.1-47.2.0/win_args.txt");
+		}
+		else {
+			processArguments.Add("@libraries/net/minecraftforge/forge/1.20.1-47.2.0/unix_args.txt");
+		}
+		
+		processArguments.Add("nogui");
+	}
+
+	private protected override Task<ServerJarInfo> PrepareServerJar(ILogger logger, string serverJarPath, CancellationToken cancellationToken) {
+		return Task.FromResult(new ServerJarInfo(Path.Combine(InstanceFolder, "run.sh")));
+	}
+}

Agent/Phantom.Agent.Minecraft/Properties/MinecraftServerProperties.cs

@@ -18,4 +18,5 @@ static class MinecraftServerProperties {
 	public static readonly MinecraftServerProperty<ushort> ServerPort = new UnsignedShort("server-port");
 	public static readonly MinecraftServerProperty<ushort> RconPort = new UnsignedShort("rcon.port");
 	public static readonly MinecraftServerProperty<bool> EnableRcon = new Boolean("enable-rcon");
+	public static readonly MinecraftServerProperty<bool> SyncChunkWrites = new Boolean("sync-chunk-writes");
 }

Agent/Phantom.Agent.Minecraft/Properties/ServerProperties.cs

@@ -5,11 +5,13 @@ namespace Phantom.Agent.Minecraft.Properties;
 public sealed record ServerProperties(
 	ushort ServerPort,
 	ushort RconPort,
-	bool EnableRcon = true
+	bool EnableRcon = true,
+	bool SyncChunkWrites = false
 ) {
 	internal void SetTo(JavaPropertiesFileEditor properties) {
 		MinecraftServerProperties.ServerPort.Set(properties, ServerPort);
 		MinecraftServerProperties.RconPort.Set(properties, RconPort);
 		MinecraftServerProperties.EnableRcon.Set(properties, EnableRcon);
+		MinecraftServerProperties.SyncChunkWrites.Set(properties, SyncChunkWrites);
 	}
 }

Agent/Phantom.Agent.Minecraft/Server/ServerStatusProtocol.cs

@@ -3,28 +3,12 @@ using System.Buffers.Binary;
 using System.Net;
 using System.Net.Sockets;
 using System.Text;
-using Phantom.Utils.Logging;
-using Serilog;
+using Phantom.Common.Data.Instance;
 
 namespace Phantom.Agent.Minecraft.Server;
 
-public sealed class ServerStatusProtocol {
-	private readonly ILogger logger;
-
-	public ServerStatusProtocol(string loggerName) {
-		this.logger = PhantomLogger.Create<ServerStatusProtocol>(loggerName);
-	}
-
-	public async Task<int?> GetOnlinePlayerCount(int serverPort, CancellationToken cancellationToken) {
-		try {
-			return await GetOnlinePlayerCountOrThrow(serverPort, cancellationToken);
-		} catch (Exception e) {
-			logger.Error(e, "Caught exception while checking if players are online.");
-			return null;
-		}
-	}
-
-	private async Task<int?> GetOnlinePlayerCountOrThrow(int serverPort, CancellationToken cancellationToken) {
+public static class ServerStatusProtocol {
+	public static async Task<InstancePlayerCounts> GetPlayerCounts(ushort serverPort, CancellationToken cancellationToken) {
 		using var tcpClient = new TcpClient();
 		await tcpClient.ConnectAsync(IPAddress.Loopback, serverPort, cancellationToken);
 		var tcpStream = tcpClient.GetStream();
@@ -33,24 +17,22 @@ public sealed class ServerStatusProtocol {
 		tcpStream.WriteByte(0xFE);
 		await tcpStream.FlushAsync(cancellationToken);
 
-		short? messageLength = await ReadStreamHeader(tcpStream, cancellationToken);
-		return messageLength == null ? null : await ReadOnlinePlayerCount(tcpStream, messageLength.Value * 2, cancellationToken);
+		short messageLength = await ReadStreamHeader(tcpStream, cancellationToken);
+		return await ReadPlayerCounts(tcpStream, messageLength * 2, cancellationToken);
 	}
 
-	private async Task<short?> ReadStreamHeader(NetworkStream tcpStream, CancellationToken cancellationToken) {
+	private static async Task<short> ReadStreamHeader(NetworkStream tcpStream, CancellationToken cancellationToken) {
 		var headerBuffer = ArrayPool<byte>.Shared.Rent(3);
 		try {
 			await tcpStream.ReadExactlyAsync(headerBuffer, 0, 3, cancellationToken);
 
 			if (headerBuffer[0] != 0xFF) {
-				logger.Error("Unexpected first byte in response from server: {FirstByte}.", headerBuffer[0]);
-				return null;
+				throw new ProtocolException("Unexpected first byte in response from server: " + headerBuffer[0]);
 			}
 
 			short messageLength = BinaryPrimitives.ReadInt16BigEndian(headerBuffer.AsSpan(1));
 			if (messageLength <= 0) {
-				logger.Error("Unexpected message length in response from server: {MessageLength}.", messageLength);
-				return null;
+				throw new ProtocolException("Unexpected message length in response from server: " + messageLength);
 			}
 			
 			return messageLength;
@@ -59,35 +41,54 @@ public sealed class ServerStatusProtocol {
 		}
 	}
 
-	private async Task<int?> ReadOnlinePlayerCount(NetworkStream tcpStream, int messageLength, CancellationToken cancellationToken) {
+	private static async Task<InstancePlayerCounts> ReadPlayerCounts(NetworkStream tcpStream, int messageLength, CancellationToken cancellationToken) {
 		var messageBuffer = ArrayPool<byte>.Shared.Rent(messageLength);
 		try {
 			await tcpStream.ReadExactlyAsync(messageBuffer, 0, messageLength, cancellationToken);
-
-			// Valid response separator encoded in UTF-16BE is 0x00 0xA7 (§).
-			const byte SeparatorSecondByte = 0xA7;
-			
-			static bool IsValidSeparator(ReadOnlySpan<byte> buffer, int index) {
-				return index > 0 && buffer[index - 1] == 0x00;
-			}
-			
-			int separator2 = Array.LastIndexOf(messageBuffer, SeparatorSecondByte);
-			int separator1 = separator2 == -1 ? -1 : Array.LastIndexOf(messageBuffer, SeparatorSecondByte, separator2 - 1);
-			if (!IsValidSeparator(messageBuffer, separator1) || !IsValidSeparator(messageBuffer, separator2)) {
-				logger.Error("Could not find message separators in response from server.");
-				return null;
-			}
-
-			string onlinePlayerCountStr = Encoding.BigEndianUnicode.GetString(messageBuffer.AsSpan((separator1 + 1)..(separator2 - 1)));
-			if (!int.TryParse(onlinePlayerCountStr, out int onlinePlayerCount)) {
-				logger.Error("Could not parse online player count in response from server: {OnlinePlayerCount}.", onlinePlayerCountStr);
-				return null;
-			}
-			
-			logger.Debug("Detected {OnlinePlayerCount} online player(s).", onlinePlayerCount);
-			return onlinePlayerCount;
+			return ReadPlayerCountsFromResponse(messageBuffer.AsSpan(0, messageLength));
 		} finally {
 			ArrayPool<byte>.Shared.Return(messageBuffer);
 		}
 	}
+	
+	/// <summary>
+	/// Legacy query protocol uses the paragraph symbol (§) as separator encoded in UTF-16BE.
+	/// </summary>
+	private static readonly byte[] Separator = { 0x00, 0xA7 };
+	
+	private static InstancePlayerCounts ReadPlayerCountsFromResponse(ReadOnlySpan<byte> messageBuffer) {
+		int lastSeparator = messageBuffer.LastIndexOf(Separator);
+		int middleSeparator = messageBuffer[..lastSeparator].LastIndexOf(Separator);
+		
+		if (lastSeparator == -1 || middleSeparator == -1) {
+			throw new ProtocolException("Could not find message separators in response from server.");
+		}
+
+		var onlinePlayerCountBuffer = messageBuffer[(middleSeparator + Separator.Length)..lastSeparator];
+		var maximumPlayerCountBuffer = messageBuffer[(lastSeparator + Separator.Length)..];
+		
+		// Player counts are integers, whose maximum string length is 10 characters.
+		Span<char> integerStringBuffer = stackalloc char[10];
+		
+		return new InstancePlayerCounts(
+			DecodeAndParsePlayerCount(onlinePlayerCountBuffer, integerStringBuffer, "online"),
+			DecodeAndParsePlayerCount(maximumPlayerCountBuffer, integerStringBuffer, "maximum")
+		);
+	}
+	
+	private static int DecodeAndParsePlayerCount(ReadOnlySpan<byte> inputBuffer, Span<char> tempCharBuffer, string countType) {
+		if (!Encoding.BigEndianUnicode.TryGetChars(inputBuffer, tempCharBuffer, out int charCount)) {
+			throw new ProtocolException("Could not decode " + countType + " player count in response from server.");
+		}
+		
+		if (!int.TryParse(tempCharBuffer, out int playerCount)) {
+			throw new ProtocolException("Could not parse " + countType + " player count in response from server: " + tempCharBuffer[..charCount].ToString());
+		}
+		
+		return playerCount;
+	}
+	
+	public sealed class ProtocolException : Exception {
+		internal ProtocolException(string message) : base(message) {}
+	}
 }

Agent/Phantom.Agent.Services/Backups/BackupArchiver.cs

@@ -25,7 +25,7 @@ sealed class BackupArchiver {
 	}
 
 	private bool IsFolderSkipped(ImmutableList<string> relativePath) {
-		return relativePath is ["cache" or "crash-reports" or "debug" or "libraries" or "logs" or "mods" or "versions"];
+		return relativePath is ["cache" or "crash-reports" or "debug" or "libraries" or "logs" or "mods" or "servermods" or "versions"];
 	}
 	
 	[SuppressMessage("ReSharper", "ConvertIfStatementToReturnStatement")]

Agent/Phantom.Agent.Services/Backups/BackupScheduler.cs

@@ -1,10 +1,8 @@
-using Phantom.Agent.Minecraft.Instance;
-using Phantom.Agent.Minecraft.Server;
-using Phantom.Agent.Services.Instances;
+using Phantom.Agent.Services.Instances;
+using Phantom.Agent.Services.Instances.State;
 using Phantom.Common.Data.Backups;
 using Phantom.Utils.Logging;
 using Phantom.Utils.Tasks;
-using Phantom.Utils.Threading;
 
 namespace Phantom.Agent.Services.Backups;
 
@@ -16,20 +14,16 @@ sealed class BackupScheduler : CancellableBackgroundTask {
 
 	private readonly BackupManager backupManager;
 	private readonly InstanceContext context;
-	private readonly InstanceProcess process;
 	private readonly SemaphoreSlim backupSemaphore = new (1, 1);
-	private readonly int serverPort;
-	private readonly ServerStatusProtocol serverStatusProtocol;
 	private readonly ManualResetEventSlim serverOutputWhileWaitingForOnlinePlayers = new ();
+	private readonly InstancePlayerCountTracker playerCountTracker;
 	
 	public event EventHandler<BackupCreationResult>? BackupCompleted;
 
-	public BackupScheduler(InstanceContext context, InstanceProcess process, int serverPort) : base(PhantomLogger.Create<BackupScheduler>(context.ShortName)) {
+	public BackupScheduler(InstanceContext context, InstancePlayerCountTracker playerCountTracker) : base(PhantomLogger.Create<BackupScheduler>(context.ShortName)) {
 		this.backupManager = context.Services.BackupManager;
 		this.context = context;
-		this.process = process;
-		this.serverPort = serverPort;
-		this.serverStatusProtocol = new ServerStatusProtocol(context.ShortName);
+		this.playerCountTracker = playerCountTracker;
 		Start();
 	}
 
@@ -69,43 +63,18 @@ sealed class BackupScheduler : CancellableBackgroundTask {
 	}
 
 	private async Task WaitForOnlinePlayers() {
-		bool needsToLogOfflinePlayersMessage = true;
-		
-		process.AddOutputListener(ServerOutputListener, maxLinesToReadFromHistory: 0);
-		try {
-			while (!CancellationToken.IsCancellationRequested) {
-				serverOutputWhileWaitingForOnlinePlayers.Reset();
-				
-				var onlinePlayerCount = await serverStatusProtocol.GetOnlinePlayerCount(serverPort, CancellationToken);
-				if (onlinePlayerCount == null) {
-					Logger.Warning("Could not detect whether any players are online, starting a new backup.");
-					break;
-				}
-
-				if (onlinePlayerCount > 0) {
-					Logger.Information("Players are online, starting a new backup.");
-					break;
-				}
-
-				if (needsToLogOfflinePlayersMessage) {
-					needsToLogOfflinePlayersMessage = false;
-					Logger.Information("No players are online, waiting for someone to join before starting a new backup.");
-				}
-
-				await Task.Delay(TimeSpan.FromSeconds(10), CancellationToken);
-				
-				Logger.Debug("Waiting for server output before checking for online players again...");
-				await serverOutputWhileWaitingForOnlinePlayers.WaitHandle.WaitOneAsync(CancellationToken);
-			}
-		} finally {
-			process.RemoveOutputListener(ServerOutputListener);
+		var task = playerCountTracker.WaitForOnlinePlayers(CancellationToken);
+		if (!task.IsCompleted) {
+			Logger.Information("Waiting for someone to join before starting a new backup.");
 		}
-	}
 		
-	private void ServerOutputListener(object? sender, string line) {
-		if (!serverOutputWhileWaitingForOnlinePlayers.IsSet) {
-			serverOutputWhileWaitingForOnlinePlayers.Set();
-			Logger.Debug("Detected server output, signalling to check for online players again.");
+		try {
+			await task;
+			Logger.Information("Players are online, starting a new backup.");
+		} catch (OperationCanceledException) {
+			throw;
+		} catch (Exception) {
+			Logger.Warning("Could not detect whether any players are online, starting a new backup.");
 		}
 	}
 

Agent/Phantom.Agent.Services/Backups/BackupServerCommandDispatcher.cs

@@ -55,7 +55,6 @@ sealed partial class BackupServerCommandDispatcher : IDisposable {
 	}
 
 	public async Task SaveAllChunks() {
-		// TODO Try if not flushing and waiting a few seconds before flushing reduces lag.
 		await process.SendCommand(MinecraftCommand.SaveAll(flush: true), cancellationToken);
 		await savedTheGame.Task.WaitAsync(TimeSpan.FromMinutes(1), cancellationToken);
 	}

Agent/Phantom.Agent.Services/Instances/InstanceManagerActor.cs

@@ -102,6 +102,7 @@ sealed class InstanceManagerActor : ReceiveActor<InstanceManagerActor.ICommand>
 		IServerLauncher launcher = configuration.MinecraftServerKind switch {
 			MinecraftServerKind.Vanilla => new VanillaLauncher(properties),
 			MinecraftServerKind.Fabric  => new FabricLauncher(properties),
+			MinecraftServerKind.Forge   => new ForgeLauncher(properties),
 			_                           => InvalidLauncher.Instance
 		};
 

Agent/Phantom.Agent.Services/Instances/State/InstancePlayerCountTracker.cs

@@ -0,0 +1,140 @@
+using Phantom.Agent.Minecraft.Instance;
+using Phantom.Agent.Minecraft.Server;
+using Phantom.Agent.Rpc;
+using Phantom.Common.Data.Instance;
+using Phantom.Common.Messages.Agent.ToController;
+using Phantom.Utils.Logging;
+using Phantom.Utils.Tasks;
+using Phantom.Utils.Threading;
+
+namespace Phantom.Agent.Services.Instances.State;
+
+sealed class InstancePlayerCountTracker : CancellableBackgroundTask {
+	private readonly ControllerConnection controllerConnection;
+	private readonly Guid instanceGuid;
+	private readonly ushort serverPort;
+	private readonly InstanceProcess process;
+
+	private readonly TaskCompletionSource firstDetection = AsyncTasks.CreateCompletionSource();
+	private readonly ManualResetEventSlim serverOutputEvent = new ();
+
+	private InstancePlayerCounts? playerCounts;
+
+	public InstancePlayerCounts? PlayerCounts {
+		get {
+			lock (this) {
+				return playerCounts;
+			}
+		}
+		private set {
+			EventHandler<int?>? onlinePlayerCountChanged;
+			lock (this) {
+				if (playerCounts == value) {
+					return;
+				}
+				
+				playerCounts = value;
+				onlinePlayerCountChanged = OnlinePlayerCountChanged;
+			}
+
+			onlinePlayerCountChanged?.Invoke(this, value?.Online);
+			controllerConnection.Send(new ReportInstancePlayerCountsMessage(instanceGuid, value));
+		}
+	}
+
+	private event EventHandler<int?>? OnlinePlayerCountChanged;
+
+	private bool isDisposed = false;
+
+	public InstancePlayerCountTracker(InstanceContext context, InstanceProcess process, ushort serverPort) : base(PhantomLogger.Create<InstancePlayerCountTracker>(context.ShortName)) {
+		this.controllerConnection = context.Services.ControllerConnection;
+		this.instanceGuid = context.InstanceGuid;
+		this.process = process;
+		this.serverPort = serverPort;
+		Start();
+	}
+
+	protected override async Task RunTask() {
+		// Give the server time to start accepting connections.
+		await Task.Delay(TimeSpan.FromSeconds(10), CancellationToken);
+
+		serverOutputEvent.Set();
+		process.AddOutputListener(OnOutput, maxLinesToReadFromHistory: 0);
+		
+		while (!CancellationToken.IsCancellationRequested) {
+			serverOutputEvent.Reset();
+
+			PlayerCounts = await TryGetPlayerCounts();
+			
+			if (!firstDetection.Task.IsCompleted) {
+				firstDetection.SetResult();
+			}
+
+			await Task.Delay(TimeSpan.FromSeconds(10), CancellationToken);
+			await serverOutputEvent.WaitHandle.WaitOneAsync(CancellationToken);
+			await Task.Delay(TimeSpan.FromSeconds(1), CancellationToken);
+		}
+	}
+
+	private async Task<InstancePlayerCounts?> TryGetPlayerCounts() {
+		try {
+			var result = await ServerStatusProtocol.GetPlayerCounts(serverPort, CancellationToken);
+			Logger.Debug("Detected {OnlinePlayerCount} / {MaximumPlayerCount} online player(s).", result.Online, result.Maximum);
+			return result;
+		} catch (ServerStatusProtocol.ProtocolException e) {
+			Logger.Error(e.Message);
+			return null;
+		} catch (Exception e) {
+			Logger.Error(e, "Caught exception while checking online player count.");
+			return null;
+		}
+	}
+
+	public async Task WaitForOnlinePlayers(CancellationToken cancellationToken) {
+		await firstDetection.Task.WaitAsync(cancellationToken);
+
+		var onlinePlayersDetected = AsyncTasks.CreateCompletionSource();
+
+		lock (this) {
+			if (playerCounts is { Online: > 0 }) {
+				return;
+			}
+			else if (playerCounts == null) {
+				throw new InvalidOperationException();
+			}
+
+			OnlinePlayerCountChanged += OnOnlinePlayerCountChanged;
+
+			void OnOnlinePlayerCountChanged(object? sender, int? newPlayerCount) {
+				if (newPlayerCount == null) {
+					onlinePlayersDetected.TrySetException(new InvalidOperationException());
+					OnlinePlayerCountChanged -= OnOnlinePlayerCountChanged;
+				}
+				else if (newPlayerCount > 0) {
+					onlinePlayersDetected.TrySetResult();
+					OnlinePlayerCountChanged -= OnOnlinePlayerCountChanged;
+				}
+			}
+		}
+
+		await onlinePlayersDetected.Task;
+	}
+
+	private void OnOutput(object? sender, string? line) {
+		lock (this) {
+			if (!isDisposed) {
+				serverOutputEvent.Set();
+			}
+		}
+	}
+
+	protected override void Dispose() {
+		lock (this) {
+			isDisposed = true;
+			playerCounts = null;
+		}
+
+		process.RemoveOutputListener(OnOutput);
+		serverOutputEvent.Dispose();
+	}
+}

Agent/Phantom.Agent.Services/Instances/State/InstanceRunningState.cs

@@ -19,6 +19,7 @@ sealed class InstanceRunningState : IDisposable {
 	private readonly CancellationToken cancellationToken;
 
 	private readonly InstanceLogSender logSender;
+	private readonly InstancePlayerCountTracker playerCountTracker;
 	private readonly BackupScheduler backupScheduler;
 
 	private bool isDisposed;
@@ -32,8 +33,9 @@ sealed class InstanceRunningState : IDisposable {
 		this.cancellationToken = cancellationToken;
 
 		this.logSender = new InstanceLogSender(context.Services.ControllerConnection, context.InstanceGuid, context.ShortName);
+		this.playerCountTracker = new InstancePlayerCountTracker(context, process, configuration.ServerPort);
 
-		this.backupScheduler = new BackupScheduler(context, process, configuration.ServerPort);
+		this.backupScheduler = new BackupScheduler(context, playerCountTracker);
 		this.backupScheduler.BackupCompleted += OnScheduledBackupCompleted;
 	}
 
@@ -93,6 +95,11 @@ sealed class InstanceRunningState : IDisposable {
 		}
 	}
 
+	public void OnStopInitiated() {
+		backupScheduler.Stop();
+		playerCountTracker.Stop();
+	}
+	
 	private bool TryDispose() {
 		lock (this) {
 			if (isDisposed) {
@@ -102,8 +109,8 @@ sealed class InstanceRunningState : IDisposable {
 			isDisposed = true;
 		}
 
+		OnStopInitiated();
 		logSender.Stop();
-		backupScheduler.Stop();
 		
 		Process.Dispose();
 		

Agent/Phantom.Agent.Services/Instances/State/InstanceStopProcedure.cs

@@ -25,6 +25,8 @@ static class InstanceStopProcedure {
 
 		try {
 			// Too late to cancel the stop procedure now.
+			runningState.OnStopInitiated();
+			
 			if (!process.HasEnded) {
 				context.Logger.Information("Session stopping now.");
 				await DoStop(context, process);
@@ -85,7 +87,7 @@ static class InstanceStopProcedure {
 	private static async Task WaitForSessionToEnd(InstanceContext context, InstanceProcess process) {
 		try {
 			await process.WaitForExit(TimeSpan.FromSeconds(55));
-		} catch (OperationCanceledException) {
+		} catch (TimeoutException) {
 			try {
 				context.Logger.Warning("Waiting timed out, killing session...");
 				process.Kill();

Common/Phantom.Common.Data.Web/Instance/Instance.cs

@@ -8,9 +8,10 @@ public sealed partial record Instance(
 	[property: MemoryPackOrder(0)] Guid InstanceGuid,
 	[property: MemoryPackOrder(1)] InstanceConfiguration Configuration,
 	[property: MemoryPackOrder(2)] IInstanceStatus Status,
-	[property: MemoryPackOrder(3)] bool LaunchAutomatically
+	[property: MemoryPackOrder(3)] InstancePlayerCounts? PlayerCounts,
+	[property: MemoryPackOrder(4)] bool LaunchAutomatically
 ) {
 	public static Instance Offline(Guid instanceGuid, InstanceConfiguration configuration, bool launchAutomatically = false) {
-		return new Instance(instanceGuid, configuration, InstanceStatus.Offline, launchAutomatically);
+		return new Instance(instanceGuid, configuration, InstanceStatus.Offline, PlayerCounts: null, launchAutomatically);
 	}
 }

Common/Phantom.Common.Data.Web/Users/AuthenticatedUserInfo.cs

@@ -1,4 +1,5 @@
-using MemoryPack;
+using System.Collections.Immutable;
+using MemoryPack;
 
 namespace Phantom.Common.Data.Web.Users;
 
@@ -6,5 +7,18 @@ namespace Phantom.Common.Data.Web.Users;
 public sealed partial record AuthenticatedUserInfo(
 	[property: MemoryPackOrder(0)] Guid Guid,
 	[property: MemoryPackOrder(1)] string Name,
-	[property: MemoryPackOrder(2)] PermissionSet Permissions
-);
+	[property: MemoryPackOrder(2)] PermissionSet Permissions,
+	[property: MemoryPackOrder(3)] ImmutableHashSet<Guid> ManagedAgentGuids
+) {
+	public bool CheckPermission(Permission permission) {
+		return Permissions.Check(permission);
+	}
+
+	public bool HasAccessToAgent(Guid agentGuid) {
+		return ManagedAgentGuids.Contains(agentGuid) || Permissions.Check(Permission.ManageAllAgents);
+	}
+
+	public ImmutableHashSet<Guid> FilterAccessibleAgentGuids(ImmutableHashSet<Guid> agentGuids) {
+		return Permissions.Check(Permission.ManageAllAgents) ? agentGuids : agentGuids.Intersect(ManagedAgentGuids);
+	}
+}

Common/Phantom.Common.Data.Web/Users/Permission.cs

@@ -14,6 +14,9 @@ public sealed record Permission(string Id, Permission? Parent) {
 		return Register(id, this);
 	}
 
+	public const string ManageAllAgentsPolicy = "Agents.ManageAll";
+	public static readonly Permission ManageAllAgents = Register(ManageAllAgentsPolicy);
+	
 	public const string ViewInstancesPolicy = "Instances.View";
 	public static readonly Permission ViewInstances = Register(ViewInstancesPolicy);
 	

Common/Phantom.Common.Data/Instance/InstancePlayerCounts.cs

@@ -0,0 +1,9 @@
+using MemoryPack;
+
+namespace Phantom.Common.Data.Instance;
+
+[MemoryPackable(GenerateType.VersionTolerant)]
+public readonly partial record struct InstancePlayerCounts(
+	[property: MemoryPackOrder(0)] int Online,
+	[property: MemoryPackOrder(1)] int Maximum
+);

Common/Phantom.Common.Data/Minecraft/MinecraftServerKind.cs

@@ -2,5 +2,6 @@
 
 public enum MinecraftServerKind : ushort {
 	Vanilla = 1,
-	Fabric = 2
+	Fabric = 2,
+	Forge = 3
 }

Common/Phantom.Common.Messages.Agent/AgentMessageRegistries.cs

@@ -31,6 +31,7 @@ public static class AgentMessageRegistries {
 		ToController.Add<InstanceOutputMessage>(5);
 		ToController.Add<ReportAgentStatusMessage>(6);
 		ToController.Add<ReportInstanceEventMessage>(7);
+		ToController.Add<ReportInstancePlayerCountsMessage>(8);
 		ToController.Add<ReplyMessage>(127);
 	}
 

Common/Phantom.Common.Messages.Agent/ToController/ReportInstancePlayerCountsMessage.cs

@@ -0,0 +1,10 @@
+using MemoryPack;
+using Phantom.Common.Data.Instance;
+
+namespace Phantom.Common.Messages.Agent.ToController;
+
+[MemoryPackable(GenerateType.VersionTolerant)]
+public sealed partial record ReportInstancePlayerCountsMessage(
+	[property: MemoryPackOrder(0)] Guid InstanceGuid,
+	[property: MemoryPackOrder(1)] InstancePlayerCounts? PlayerCounts
+) : IMessageToController;

Common/Phantom.Common.Messages.Web/ToController/LogInMessage.cs

@@ -1,4 +1,5 @@
 using MemoryPack;
+using Phantom.Common.Data;
 using Phantom.Common.Data.Web.Users;
 using Phantom.Utils.Actor;
 
@@ -8,4 +9,4 @@ namespace Phantom.Common.Messages.Web.ToController;
 public sealed partial record LogInMessage(
 	[property: MemoryPackOrder(0)] string Username,
 	[property: MemoryPackOrder(1)] string Password
-) : IMessageToController, ICanReply<LogInSuccess?>;
+) : IMessageToController, ICanReply<Optional<LogInSuccess>>;

Common/Phantom.Common.Messages.Web/WebMessageRegistries.cs

@@ -24,7 +24,7 @@ public static class WebMessageRegistries {
 	static WebMessageRegistries() {
 		ToController.Add<RegisterWebMessage>(0);
 		ToController.Add<UnregisterWebMessage>(1);
-		ToController.Add<LogInMessage, LogInSuccess?>(2);
+		ToController.Add<LogInMessage, Optional<LogInSuccess>>(2);
 		ToController.Add<LogOutMessage>(3);
 		ToController.Add<GetAuthenticatedUser, Optional<AuthenticatedUserInfo>>(4);
 		ToController.Add<CreateOrUpdateAdministratorUserMessage, CreateOrUpdateAdministratorUserResult>(5);

Controller/Phantom.Controller.Database.Postgres/Migrations/20240407211636_UserAgentAccess.Designer.cs

@@ -0,0 +1,353 @@
+// <auto-generated />
+using System;
+using System.Text.Json;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using Phantom.Controller.Database;
+
+#nullable disable
+
+namespace Phantom.Controller.Database.Postgres.Migrations
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20240407211636_UserAgentAccess")]
+    partial class UserAgentAccess
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "8.0.0")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.AgentEntity", b =>
+                {
+                    b.Property<Guid>("AgentGuid")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("BuildVersion")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("MaxInstances")
+                        .HasColumnType("integer");
+
+                    b.Property<ushort>("MaxMemory")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("ProtocolVersion")
+                        .HasColumnType("integer");
+
+                    b.HasKey("AgentGuid");
+
+                    b.ToTable("Agents", "agents");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.AuditLogEntity", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<JsonDocument>("Data")
+                        .HasColumnType("jsonb");
+
+                    b.Property<string>("EventType")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("SubjectId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("SubjectType")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("UserGuid")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTime>("UtcTime")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserGuid");
+
+                    b.ToTable("AuditLog", "system");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.EventLogEntity", b =>
+                {
+                    b.Property<Guid>("EventGuid")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("AgentGuid")
+                        .HasColumnType("uuid");
+
+                    b.Property<JsonDocument>("Data")
+                        .HasColumnType("jsonb");
+
+                    b.Property<string>("EventType")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("SubjectId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("SubjectType")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("UtcTime")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("EventGuid");
+
+                    b.ToTable("EventLog", "system");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.InstanceEntity", b =>
+                {
+                    b.Property<Guid>("InstanceGuid")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentGuid")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("InstanceName")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("JavaRuntimeGuid")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("JvmArguments")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<bool>("LaunchAutomatically")
+                        .HasColumnType("boolean");
+
+                    b.Property<ushort>("MemoryAllocation")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("MinecraftServerKind")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("MinecraftVersion")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("RconPort")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("ServerPort")
+                        .HasColumnType("integer");
+
+                    b.HasKey("InstanceGuid");
+
+                    b.ToTable("Instances", "agents");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.PermissionEntity", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("Permissions", "identity");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.RoleEntity", b =>
+                {
+                    b.Property<Guid>("RoleGuid")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("RoleGuid");
+
+                    b.ToTable("Roles", "identity");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.RolePermissionEntity", b =>
+                {
+                    b.Property<Guid>("RoleGuid")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("PermissionId")
+                        .HasColumnType("text");
+
+                    b.HasKey("RoleGuid", "PermissionId");
+
+                    b.HasIndex("PermissionId");
+
+                    b.ToTable("RolePermissions", "identity");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.UserAgentAccessEntity", b =>
+                {
+                    b.Property<Guid>("UserGuid")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentGuid")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("UserGuid", "AgentGuid");
+
+                    b.HasIndex("AgentGuid");
+
+                    b.ToTable("UserAgentAccess", "identity");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.UserEntity", b =>
+                {
+                    b.Property<Guid>("UserGuid")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("PasswordHash")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("UserGuid");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("Users", "identity");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.UserPermissionEntity", b =>
+                {
+                    b.Property<Guid>("UserGuid")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("PermissionId")
+                        .HasColumnType("text");
+
+                    b.HasKey("UserGuid", "PermissionId");
+
+                    b.HasIndex("PermissionId");
+
+                    b.ToTable("UserPermissions", "identity");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.UserRoleEntity", b =>
+                {
+                    b.Property<Guid>("UserGuid")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("RoleGuid")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("UserGuid", "RoleGuid");
+
+                    b.HasIndex("RoleGuid");
+
+                    b.ToTable("UserRoles", "identity");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.AuditLogEntity", b =>
+                {
+                    b.HasOne("Phantom.Controller.Database.Entities.UserEntity", "User")
+                        .WithMany()
+                        .HasForeignKey("UserGuid")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.RolePermissionEntity", b =>
+                {
+                    b.HasOne("Phantom.Controller.Database.Entities.PermissionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("PermissionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Phantom.Controller.Database.Entities.RoleEntity", null)
+                        .WithMany()
+                        .HasForeignKey("RoleGuid")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.UserAgentAccessEntity", b =>
+                {
+                    b.HasOne("Phantom.Controller.Database.Entities.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentGuid")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Phantom.Controller.Database.Entities.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("UserGuid")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.UserPermissionEntity", b =>
+                {
+                    b.HasOne("Phantom.Controller.Database.Entities.PermissionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("PermissionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Phantom.Controller.Database.Entities.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("UserGuid")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.UserRoleEntity", b =>
+                {
+                    b.HasOne("Phantom.Controller.Database.Entities.RoleEntity", "Role")
+                        .WithMany()
+                        .HasForeignKey("RoleGuid")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Phantom.Controller.Database.Entities.UserEntity", "User")
+                        .WithMany()
+                        .HasForeignKey("UserGuid")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Role");
+
+                    b.Navigation("User");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

Controller/Phantom.Controller.Database.Postgres/Migrations/20240407211636_UserAgentAccess.cs

@@ -0,0 +1,56 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Phantom.Controller.Database.Postgres.Migrations
+{
+    /// <inheritdoc />
+    public partial class UserAgentAccess : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "UserAgentAccess",
+                schema: "identity",
+                columns: table => new
+                {
+                    UserGuid = table.Column<Guid>(type: "uuid", nullable: false),
+                    AgentGuid = table.Column<Guid>(type: "uuid", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_UserAgentAccess", x => new { x.UserGuid, x.AgentGuid });
+                    table.ForeignKey(
+                        name: "FK_UserAgentAccess_Agents_AgentGuid",
+                        column: x => x.AgentGuid,
+                        principalSchema: "agents",
+                        principalTable: "Agents",
+                        principalColumn: "AgentGuid",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_UserAgentAccess_Users_UserGuid",
+                        column: x => x.UserGuid,
+                        principalSchema: "identity",
+                        principalTable: "Users",
+                        principalColumn: "UserGuid",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_UserAgentAccess_AgentGuid",
+                schema: "identity",
+                table: "UserAgentAccess",
+                column: "AgentGuid");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "UserAgentAccess",
+                schema: "identity");
+        }
+    }
+}

Controller/Phantom.Controller.Database.Postgres/Migrations/ApplicationDbContextModelSnapshot.cs

@@ -18,7 +18,7 @@ namespace Phantom.Controller.Database.Postgres.Migrations
         {
 #pragma warning disable 612, 618
             modelBuilder
-                .HasAnnotation("ProductVersion", "7.0.11")
+                .HasAnnotation("ProductVersion", "8.0.0")
                 .HasAnnotation("Relational:MaxIdentifierLength", 63);
 
             NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
@@ -204,6 +204,21 @@ namespace Phantom.Controller.Database.Postgres.Migrations
                     b.ToTable("RolePermissions", "identity");
                 });
 
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.UserAgentAccessEntity", b =>
+                {
+                    b.Property<Guid>("UserGuid")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentGuid")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("UserGuid", "AgentGuid");
+
+                    b.HasIndex("AgentGuid");
+
+                    b.ToTable("UserAgentAccess", "identity");
+                });
+
             modelBuilder.Entity("Phantom.Controller.Database.Entities.UserEntity", b =>
                 {
                     b.Property<Guid>("UserGuid")
@@ -281,6 +296,21 @@ namespace Phantom.Controller.Database.Postgres.Migrations
                         .IsRequired();
                 });
 
+            modelBuilder.Entity("Phantom.Controller.Database.Entities.UserAgentAccessEntity", b =>
+                {
+                    b.HasOne("Phantom.Controller.Database.Entities.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentGuid")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Phantom.Controller.Database.Entities.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("UserGuid")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
             modelBuilder.Entity("Phantom.Controller.Database.Entities.UserPermissionEntity", b =>
                 {
                     b.HasOne("Phantom.Controller.Database.Entities.PermissionEntity", null)

Controller/Phantom.Controller.Database/ApplicationDbContext.cs

@@ -20,6 +20,7 @@ public class ApplicationDbContext : DbContext {
 	public DbSet<UserRoleEntity> UserRoles { get; init; } = null!;
 	public DbSet<UserPermissionEntity> UserPermissions { get; init; } = null!;
 	public DbSet<RolePermissionEntity> RolePermissions { get; init; } = null!;
+	public DbSet<UserAgentAccessEntity> UserAgentAccess { get; init; } = null!;
 
 	public DbSet<AgentEntity> Agents { get; init; } = null!;
 	public DbSet<InstanceEntity> Instances { get; init; } = null!;
@@ -62,6 +63,12 @@ public class ApplicationDbContext : DbContext {
 			b.HasOne<RoleEntity>().WithMany().HasForeignKey(static e => e.RoleGuid).IsRequired().OnDelete(DeleteBehavior.Cascade);
 			b.HasOne<PermissionEntity>().WithMany().HasForeignKey(static e => e.PermissionId).IsRequired().OnDelete(DeleteBehavior.Cascade);
 		});
+		
+		builder.Entity<UserAgentAccessEntity>(static b => {
+			b.HasKey(static e => new { UserId = e.UserGuid, AgentId = e.AgentGuid });
+			b.HasOne<UserEntity>().WithMany().HasForeignKey(static e => e.UserGuid).IsRequired().OnDelete(DeleteBehavior.Cascade);
+			b.HasOne<AgentEntity>().WithMany().HasForeignKey(static e => e.AgentGuid).IsRequired().OnDelete(DeleteBehavior.Cascade);
+		});
 	}
 
 	protected override void ConfigureConventions(ModelConfigurationBuilder builder) {

Controller/Phantom.Controller.Database/Entities/UserAgentAccessEntity.cs

@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations.Schema;
+
+namespace Phantom.Controller.Database.Entities;
+
+[Table("UserAgentAccess", Schema = "identity")]
+public sealed class UserAgentAccessEntity {
+	public Guid UserGuid { get; init; }
+	public Guid AgentGuid { get; init; }
+	
+	public UserAgentAccessEntity(Guid userGuid, Guid agentGuid) {
+		UserGuid = userGuid;
+		AgentGuid = agentGuid;
+	}
+}

Controller/Phantom.Controller.Database/Repositories/EventLogRepository.cs

@@ -17,11 +17,12 @@ public sealed class EventLogRepository {
 		db.Ctx.EventLog.Add(new EventLogEntity(eventGuid, utcTime, agentGuid, eventType, subjectId, extra));
 	}
 	
-	public Task<ImmutableArray<EventLogItem>> GetMostRecentItems(int count, CancellationToken cancellationToken) {
+	public Task<ImmutableArray<EventLogItem>> GetMostRecentItems(ImmutableHashSet<Guid> agentGuids, int count, CancellationToken cancellationToken) {
 		return db.Ctx
 		         .EventLog
 		         .AsQueryable()
 		         .OrderByDescending(static entity => entity.UtcTime)
+		         .Where(entity => entity.AgentGuid == null || agentGuids.Contains(entity.AgentGuid.Value))
 		         .Take(count)
 		         .AsAsyncEnumerable()
 		         .Select(static entity => new EventLogItem(entity.UtcTime, entity.AgentGuid, entity.EventType, entity.SubjectType, entity.SubjectId, entity.Data?.RootElement.ToString()))

Controller/Phantom.Controller.Database/Repositories/PermissionRepository.cs

@@ -1,4 +1,5 @@
-using Microsoft.EntityFrameworkCore;
+using System.Collections.Immutable;
+using Microsoft.EntityFrameworkCore;
 using Phantom.Common.Data.Web.Users;
 using Phantom.Controller.Database.Entities;
 using Phantom.Utils.Collections;
@@ -23,4 +24,12 @@ public sealed class PermissionRepository {
 
 		return new PermissionSet(await userPermissions.Union(rolePermissions).AsAsyncEnumerable().ToImmutableSetAsync());
 	}
+
+	public Task<ImmutableHashSet<Guid>> GetManagedAgentGuids(UserEntity user) {
+		return db.Ctx.UserAgentAccess
+		         .Where(ua => ua.UserGuid == user.UserGuid)
+		         .Select(static ua => ua.AgentGuid)
+		         .AsAsyncEnumerable()
+		         .ToImmutableSetAsync();
+	}
 }

Controller/Phantom.Controller.Services/Agents/AgentActor.cs

@@ -10,14 +10,12 @@ using Phantom.Common.Data.Replies;
 using Phantom.Common.Data.Web.Agent;
 using Phantom.Common.Data.Web.Instance;
 using Phantom.Common.Data.Web.Minecraft;
-using Phantom.Common.Data.Web.Users;
 using Phantom.Common.Messages.Agent;
 using Phantom.Common.Messages.Agent.ToAgent;
 using Phantom.Controller.Database;
 using Phantom.Controller.Database.Entities;
 using Phantom.Controller.Minecraft;
 using Phantom.Controller.Services.Instances;
-using Phantom.Controller.Services.Users.Sessions;
 using Phantom.Utils.Actor;
 using Phantom.Utils.Actor.Mailbox;
 using Phantom.Utils.Actor.Tasks;
@@ -34,7 +32,7 @@ sealed class AgentActor : ReceiveActor<AgentActor.ICommand> {
 	private static readonly TimeSpan DisconnectionRecheckInterval = TimeSpan.FromSeconds(5);
 	private static readonly TimeSpan DisconnectionThreshold = TimeSpan.FromSeconds(12);
 
-	public readonly record struct Init(Guid AgentGuid, AgentConfiguration AgentConfiguration, ControllerState ControllerState, MinecraftVersions MinecraftVersions, UserLoginManager UserLoginManager, IDbContextProvider DbProvider, CancellationToken CancellationToken);
+	public readonly record struct Init(Guid AgentGuid, AgentConfiguration AgentConfiguration, ControllerState ControllerState, MinecraftVersions MinecraftVersions, IDbContextProvider DbProvider, CancellationToken CancellationToken);
 	
 	public static Props<ICommand> Factory(Init init) {
 		return Props<ICommand>.Create(() => new AgentActor(init), new ActorConfiguration { SupervisorStrategy = SupervisorStrategies.Resume, MailboxType = UnboundedJumpAheadMailbox.Name });
@@ -42,7 +40,6 @@ sealed class AgentActor : ReceiveActor<AgentActor.ICommand> {
 
 	private readonly ControllerState controllerState;
 	private readonly MinecraftVersions minecraftVersions;
-	private readonly UserLoginManager userLoginManager;
 	private readonly IDbContextProvider dbProvider;
 	private readonly CancellationToken cancellationToken;
 	
@@ -79,7 +76,6 @@ sealed class AgentActor : ReceiveActor<AgentActor.ICommand> {
 	private AgentActor(Init init) {
 		this.controllerState = init.ControllerState;
 		this.minecraftVersions = init.MinecraftVersions;
-		this.userLoginManager = init.UserLoginManager;
 		this.dbProvider = init.DbProvider;
 		this.cancellationToken = init.CancellationToken;
 		
@@ -98,11 +94,12 @@ sealed class AgentActor : ReceiveActor<AgentActor.ICommand> {
 		Receive<NotifyIsAliveCommand>(NotifyIsAlive);
 		Receive<UpdateStatsCommand>(UpdateStats);
 		Receive<UpdateJavaRuntimesCommand>(UpdateJavaRuntimes);
-		ReceiveAndReplyLater<CreateOrUpdateInstanceCommand, Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>>(CreateOrUpdateInstance);
+		ReceiveAndReplyLater<CreateOrUpdateInstanceCommand, Result<CreateOrUpdateInstanceResult, InstanceActionFailure>>(CreateOrUpdateInstance);
 		Receive<UpdateInstanceStatusCommand>(UpdateInstanceStatus);
-		ReceiveAndReplyLater<LaunchInstanceCommand, Result<LaunchInstanceResult, UserInstanceActionFailure>>(LaunchInstance);
-		ReceiveAndReplyLater<StopInstanceCommand, Result<StopInstanceResult, UserInstanceActionFailure>>(StopInstance);
-		ReceiveAndReplyLater<SendCommandToInstanceCommand, Result<SendCommandToInstanceResult, UserInstanceActionFailure>>(SendMinecraftCommand);
+		Receive<UpdateInstancePlayerCountsCommand>(UpdateInstancePlayerCounts);
+		ReceiveAndReplyLater<LaunchInstanceCommand, Result<LaunchInstanceResult, InstanceActionFailure>>(LaunchInstance);
+		ReceiveAndReplyLater<StopInstanceCommand, Result<StopInstanceResult, InstanceActionFailure>>(StopInstance);
+		ReceiveAndReplyLater<SendCommandToInstanceCommand, Result<SendCommandToInstanceResult, InstanceActionFailure>>(SendMinecraftCommand);
 		Receive<ReceiveInstanceDataCommand>(ReceiveInstanceData);
 	}
 
@@ -150,28 +147,20 @@ sealed class AgentActor : ReceiveActor<AgentActor.ICommand> {
 		}
 	}
 
-	private async Task<Result<TReply, UserInstanceActionFailure>> RequestInstance<TCommand, TReply>(ImmutableArray<byte> authToken, Guid instanceGuid, Func<Guid, TCommand> commandFactoryFromLoggedInUserGuid) where TCommand : InstanceActor.ICommand, ICanReply<Result<TReply, InstanceActionFailure>> {
-		var loggedInUser = userLoginManager.GetLoggedInUser(authToken);
-		if (!loggedInUser.CheckPermission(Permission.ControlInstances)) {
-			return (UserInstanceActionFailure) UserActionFailure.NotAuthorized;
-		}
-		
-		var command = commandFactoryFromLoggedInUserGuid(loggedInUser.Guid!.Value);
-		
+	private async Task<Result<TReply, InstanceActionFailure>> RequestInstance<TCommand, TReply>(Guid instanceGuid, TCommand command) where TCommand : InstanceActor.ICommand, ICanReply<Result<TReply, InstanceActionFailure>> {
 		if (instanceActorByGuid.TryGetValue(instanceGuid, out var instance)) {
-			var result = await instance.Request(command, cancellationToken);
-			return result.MapError(static error => (UserInstanceActionFailure) error);
+			return await instance.Request(command, cancellationToken);
 		}
 		else {
 			Logger.Warning("Could not deliver command {CommandType} to instance {InstanceGuid}, instance not found.", command.GetType().Name, instanceGuid);
-			return (UserInstanceActionFailure) InstanceActionFailure.InstanceDoesNotExist;
+			return InstanceActionFailure.InstanceDoesNotExist;
 		}
 	}
 
 	private async Task<ImmutableArray<ConfigureInstanceMessage>> PrepareInitialConfigurationMessages() {
 		var configurationMessages = ImmutableArray.CreateBuilder<ConfigureInstanceMessage>();
 		
-		foreach (var (instanceGuid, instanceConfiguration, _, launchAutomatically) in instanceDataByGuid.Values.ToImmutableArray()) {
+		foreach (var (instanceGuid, instanceConfiguration, _, _, launchAutomatically) in instanceDataByGuid.Values.ToImmutableArray()) {
 			var serverExecutableInfo = await minecraftVersions.GetServerExecutableInfo(instanceConfiguration.MinecraftVersion, cancellationToken);
 			configurationMessages.Add(new ConfigureInstanceMessage(instanceGuid, instanceConfiguration, new InstanceLaunchProperties(serverExecutableInfo), launchAutomatically));
 		}
@@ -195,15 +184,17 @@ sealed class AgentActor : ReceiveActor<AgentActor.ICommand> {
 	
 	public sealed record UpdateJavaRuntimesCommand(ImmutableArray<TaggedJavaRuntime> JavaRuntimes) : ICommand;
 	
-	public sealed record CreateOrUpdateInstanceCommand(ImmutableArray<byte> AuthToken, Guid InstanceGuid, InstanceConfiguration Configuration) : ICommand, ICanReply<Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>>;
+	public sealed record CreateOrUpdateInstanceCommand(Guid LoggedInUserGuid, Guid InstanceGuid, InstanceConfiguration Configuration) : ICommand, ICanReply<Result<CreateOrUpdateInstanceResult, InstanceActionFailure>>;
 	
 	public sealed record UpdateInstanceStatusCommand(Guid InstanceGuid, IInstanceStatus Status) : ICommand;
 	
-	public sealed record LaunchInstanceCommand(ImmutableArray<byte> AuthToken, Guid InstanceGuid) : ICommand, ICanReply<Result<LaunchInstanceResult, UserInstanceActionFailure>>;
+	public sealed record UpdateInstancePlayerCountsCommand(Guid InstanceGuid, InstancePlayerCounts? PlayerCounts) : ICommand;
 
-	public sealed record StopInstanceCommand(ImmutableArray<byte> AuthToken, Guid InstanceGuid, MinecraftStopStrategy StopStrategy) : ICommand, ICanReply<Result<StopInstanceResult, UserInstanceActionFailure>>;
+	public sealed record LaunchInstanceCommand(Guid LoggedInUserGuid, Guid InstanceGuid) : ICommand, ICanReply<Result<LaunchInstanceResult, InstanceActionFailure>>;
 	
-	public sealed record SendCommandToInstanceCommand(ImmutableArray<byte> AuthToken, Guid InstanceGuid, string Command) : ICommand, ICanReply<Result<SendCommandToInstanceResult, UserInstanceActionFailure>>;
+	public sealed record StopInstanceCommand(Guid LoggedInUserGuid, Guid InstanceGuid, MinecraftStopStrategy StopStrategy) : ICommand, ICanReply<Result<StopInstanceResult, InstanceActionFailure>>;
+	
+	public sealed record SendCommandToInstanceCommand(Guid LoggedInUserGuid, Guid InstanceGuid, string Command) : ICommand, ICanReply<Result<SendCommandToInstanceResult, InstanceActionFailure>>;
 	
 	public sealed record ReceiveInstanceDataCommand(Instance Instance) : ICommand, IJumpAhead;
 
@@ -292,30 +283,25 @@ sealed class AgentActor : ReceiveActor<AgentActor.ICommand> {
 		controllerState.UpdateAgentJavaRuntimes(agentGuid, javaRuntimes);
 	}
 	
-	private Task<Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>> CreateOrUpdateInstance(CreateOrUpdateInstanceCommand command) {
-		var loggedInUser = userLoginManager.GetLoggedInUser(command.AuthToken);
-		if (!loggedInUser.CheckPermission(Permission.CreateInstances)) {
-			return Task.FromResult<Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>>((UserInstanceActionFailure) UserActionFailure.NotAuthorized);
-		}
-		
+	private Task<Result<CreateOrUpdateInstanceResult, InstanceActionFailure>> CreateOrUpdateInstance(CreateOrUpdateInstanceCommand command) {
 		var instanceConfiguration = command.Configuration;
 
 		if (string.IsNullOrWhiteSpace(instanceConfiguration.InstanceName)) {
-			return Task.FromResult<Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>>(CreateOrUpdateInstanceResult.InstanceNameMustNotBeEmpty);
+			return Task.FromResult<Result<CreateOrUpdateInstanceResult, InstanceActionFailure>>(CreateOrUpdateInstanceResult.InstanceNameMustNotBeEmpty);
 		}
 		
 		if (instanceConfiguration.MemoryAllocation <= RamAllocationUnits.Zero) {
-			return Task.FromResult<Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>>(CreateOrUpdateInstanceResult.InstanceMemoryMustNotBeZero);
+			return Task.FromResult<Result<CreateOrUpdateInstanceResult, InstanceActionFailure>>(CreateOrUpdateInstanceResult.InstanceMemoryMustNotBeZero);
 		}
 		
 		return minecraftVersions.GetServerExecutableInfo(instanceConfiguration.MinecraftVersion, cancellationToken)
-		                        .ContinueOnActor(CreateOrUpdateInstance1, loggedInUser.Guid!.Value, command)
+		                        .ContinueOnActor(CreateOrUpdateInstance1, command)
 		                        .Unwrap();
 	}
 
-	private Task<Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>> CreateOrUpdateInstance1(FileDownloadInfo? serverExecutableInfo, Guid loggedInUserGuid, CreateOrUpdateInstanceCommand command) {
+	private Task<Result<CreateOrUpdateInstanceResult, InstanceActionFailure>> CreateOrUpdateInstance1(FileDownloadInfo? serverExecutableInfo, CreateOrUpdateInstanceCommand command) {
 		if (serverExecutableInfo == null) {
-			return Task.FromResult<Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>>(CreateOrUpdateInstanceResult.MinecraftVersionDownloadInfoNotFound);
+			return Task.FromResult<Result<CreateOrUpdateInstanceResult, InstanceActionFailure>>(CreateOrUpdateInstanceResult.MinecraftVersionDownloadInfoNotFound);
 		}
 		
 		var instanceConfiguration = command.Configuration;
@@ -325,13 +311,13 @@ sealed class AgentActor : ReceiveActor<AgentActor.ICommand> {
 			instanceActorRef = CreateNewInstance(Instance.Offline(command.InstanceGuid, instanceConfiguration));
 		}
 		
-		var configureInstanceCommand = new InstanceActor.ConfigureInstanceCommand(loggedInUserGuid, command.InstanceGuid, instanceConfiguration, new InstanceLaunchProperties(serverExecutableInfo), isCreatingInstance);
+		var configureInstanceCommand = new InstanceActor.ConfigureInstanceCommand(command.LoggedInUserGuid, command.InstanceGuid, instanceConfiguration, new InstanceLaunchProperties(serverExecutableInfo), isCreatingInstance);
 		
 		return instanceActorRef.Request(configureInstanceCommand, cancellationToken)
 		                       .ContinueOnActor(CreateOrUpdateInstance2, configureInstanceCommand);
 	}
 	
-	private Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure> CreateOrUpdateInstance2(Result<ConfigureInstanceResult, InstanceActionFailure> result, InstanceActor.ConfigureInstanceCommand command) {
+	private Result<CreateOrUpdateInstanceResult, InstanceActionFailure> CreateOrUpdateInstance2(Result<ConfigureInstanceResult, InstanceActionFailure> result, InstanceActor.ConfigureInstanceCommand command) {
 		var instanceGuid = command.InstanceGuid;
 		var instanceName = command.Configuration.InstanceName;
 		var isCreating = command.IsCreatingInstance;
@@ -359,16 +345,20 @@ sealed class AgentActor : ReceiveActor<AgentActor.ICommand> {
 		TellInstance(command.InstanceGuid, new InstanceActor.SetStatusCommand(command.Status));
 	}
 	
-	private Task<Result<LaunchInstanceResult, UserInstanceActionFailure>> LaunchInstance(LaunchInstanceCommand command) {
-		return RequestInstance<InstanceActor.LaunchInstanceCommand, LaunchInstanceResult>(command.AuthToken, command.InstanceGuid, static loggedInUserGuid => new InstanceActor.LaunchInstanceCommand(loggedInUserGuid));
+	private void UpdateInstancePlayerCounts(UpdateInstancePlayerCountsCommand command) {
+		TellInstance(command.InstanceGuid, new InstanceActor.SetPlayerCountsCommand(command.PlayerCounts));
 	}
 
-	private Task<Result<StopInstanceResult, UserInstanceActionFailure>> StopInstance(StopInstanceCommand command) {
-		return RequestInstance<InstanceActor.StopInstanceCommand, StopInstanceResult>(command.AuthToken, command.InstanceGuid, loggedInUserGuid => new InstanceActor.StopInstanceCommand(loggedInUserGuid, command.StopStrategy));
+	private Task<Result<LaunchInstanceResult, InstanceActionFailure>> LaunchInstance(LaunchInstanceCommand command) {
+		return RequestInstance<InstanceActor.LaunchInstanceCommand, LaunchInstanceResult>(command.InstanceGuid, new InstanceActor.LaunchInstanceCommand(command.LoggedInUserGuid));
 	}
 
-	private Task<Result<SendCommandToInstanceResult, UserInstanceActionFailure>> SendMinecraftCommand(SendCommandToInstanceCommand command) {
-		return RequestInstance<InstanceActor.SendCommandToInstanceCommand, SendCommandToInstanceResult>(command.AuthToken, command.InstanceGuid, loggedInUserGuid => new InstanceActor.SendCommandToInstanceCommand(loggedInUserGuid, command.Command));
+	private Task<Result<StopInstanceResult, InstanceActionFailure>> StopInstance(StopInstanceCommand command) {
+		return RequestInstance<InstanceActor.StopInstanceCommand, StopInstanceResult>(command.InstanceGuid, new InstanceActor.StopInstanceCommand(command.LoggedInUserGuid, command.StopStrategy));
+	}
+
+	private Task<Result<SendCommandToInstanceResult, InstanceActionFailure>> SendMinecraftCommand(SendCommandToInstanceCommand command) {
+		return RequestInstance<InstanceActor.SendCommandToInstanceCommand, SendCommandToInstanceResult>(command.InstanceGuid, new InstanceActor.SendCommandToInstanceCommand(command.LoggedInUserGuid, command.Command));
 	}
 
 	private void ReceiveInstanceData(ReceiveInstanceDataCommand command) {

Controller/Phantom.Controller.Services/Agents/AgentManager.cs

@@ -1,4 +1,5 @@
 using System.Collections.Concurrent;
+using System.Collections.Immutable;
 using Akka.Actor;
 using Phantom.Common.Data;
 using Phantom.Common.Data.Agent;
@@ -44,7 +45,7 @@ sealed class AgentManager {
 	}
 
 	private ActorRef<AgentActor.ICommand> CreateAgentActor(Guid agentGuid, AgentConfiguration agentConfiguration) {
-		var init = new AgentActor.Init(agentGuid, agentConfiguration, controllerState, minecraftVersions, userLoginManager, dbProvider, cancellationToken);
+		var init = new AgentActor.Init(agentGuid, agentConfiguration, controllerState, minecraftVersions, dbProvider, cancellationToken);
 		var name = "Agent:" + agentGuid;
 		return actorSystem.ActorOf(AgentActor.Factory(init), name);
 	}
@@ -87,7 +88,18 @@ sealed class AgentManager {
 		}
 	}
 
-	public async Task<Result<TReply, UserInstanceActionFailure>> DoInstanceAction<TCommand, TReply>(Guid agentGuid, TCommand command) where TCommand : class, AgentActor.ICommand, ICanReply<Result<TReply, UserInstanceActionFailure>> {
-		return agentsByGuid.TryGetValue(agentGuid, out var agent) ? await agent.Request(command, cancellationToken) : (UserInstanceActionFailure) InstanceActionFailure.AgentDoesNotExist;
+	public async Task<Result<TReply, UserInstanceActionFailure>> DoInstanceAction<TCommand, TReply>(Permission requiredPermission, ImmutableArray<byte> authToken, Guid agentGuid, Func<Guid, TCommand> commandFactoryFromLoggedInUserGuid) where TCommand : class, AgentActor.ICommand, ICanReply<Result<TReply, InstanceActionFailure>> {
+		var loggedInUser = userLoginManager.GetLoggedInUser(authToken);
+		if (!loggedInUser.HasAccessToAgent(agentGuid) || !loggedInUser.CheckPermission(requiredPermission)) {
+			return (UserInstanceActionFailure) UserActionFailure.NotAuthorized;
+		}
+		
+		if (!agentsByGuid.TryGetValue(agentGuid, out var agent)) {
+			return (UserInstanceActionFailure) InstanceActionFailure.AgentDoesNotExist;
+		}
+		
+		var command = commandFactoryFromLoggedInUserGuid(loggedInUser.Guid!.Value);
+		var result = await agent.Request(command, cancellationToken);
+		return result.MapError(static error => (UserInstanceActionFailure) error);
 	}
 }

Controller/Phantom.Controller.Services/ControllerServices.cs

@@ -64,7 +64,7 @@ public sealed class ControllerServices : IDisposable {
 		this.InstanceLogManager = new InstanceLogManager();
 		
 		this.AuditLogManager = new AuditLogManager(dbProvider);
-		this.EventLogManager = new EventLogManager(ActorSystem, dbProvider, shutdownCancellationToken);
+		this.EventLogManager = new EventLogManager(ControllerState, ActorSystem, dbProvider, shutdownCancellationToken);
 		
 		this.AgentRegistrationHandler = new AgentRegistrationHandler(AgentManager, InstanceLogManager, EventLogManager);
 		this.WebRegistrationHandler = new WebRegistrationHandler(webAuthToken, ControllerState, InstanceLogManager, UserManager, RoleManager, UserRoleManager, UserLoginManager, AuditLogManager, AgentManager, MinecraftVersions, EventLogManager);

Controller/Phantom.Controller.Services/Events/EventLogManager.cs

@@ -11,11 +11,13 @@ using Phantom.Utils.Actor;
 namespace Phantom.Controller.Services.Events; 
 
 sealed partial class EventLogManager {
+	private readonly ControllerState controllerState;
 	private readonly ActorRef<EventLogDatabaseStorageActor.ICommand> databaseStorageActor;
 	private readonly IDbContextProvider dbProvider;
 	private readonly CancellationToken cancellationToken;
 
-	public EventLogManager(IActorRefFactory actorSystem, IDbContextProvider dbProvider, CancellationToken cancellationToken) {
+	public EventLogManager(ControllerState controllerState, IActorRefFactory actorSystem, IDbContextProvider dbProvider, CancellationToken cancellationToken) {
+		this.controllerState = controllerState;
 		this.databaseStorageActor = actorSystem.ActorOf(EventLogDatabaseStorageActor.Factory(new EventLogDatabaseStorageActor.Init(dbProvider, cancellationToken)), "EventLogDatabaseStorage");
 		this.dbProvider = dbProvider;
 		this.cancellationToken = cancellationToken;
@@ -30,7 +32,9 @@ sealed partial class EventLogManager {
 			return UserActionFailure.NotAuthorized;
 		}
 		
+		var accessibleAgentGuids = loggedInUser.FilterAccessibleAgentGuids(controllerState.AgentsByGuid.Keys.ToImmutableHashSet());
+		
 		await using var db = dbProvider.Lazy();
-		return await new EventLogRepository(db).GetMostRecentItems(count, cancellationToken);
+		return await new EventLogRepository(db).GetMostRecentItems(accessibleAgentGuids, count, cancellationToken);
 	}
 }

Controller/Phantom.Controller.Services/Instances/InstanceActor.cs

@@ -26,6 +26,7 @@ sealed class InstanceActor : ReceiveActor<InstanceActor.ICommand> {
 	
 	private InstanceConfiguration configuration;
 	private IInstanceStatus status;
+	private InstancePlayerCounts? playerCounts;
 	private bool launchAutomatically;
 
 	private readonly ActorRef<InstanceDatabaseStorageActor.ICommand> databaseStorageActor;
@@ -35,11 +36,12 @@ sealed class InstanceActor : ReceiveActor<InstanceActor.ICommand> {
 		this.agentConnection = init.AgentConnection;
 		this.cancellationToken = init.CancellationToken;
 		
-		(this.instanceGuid, this.configuration, this.status, this.launchAutomatically) = init.Instance;
+		(this.instanceGuid, this.configuration, this.status, this.playerCounts, this.launchAutomatically) = init.Instance;
 
 		this.databaseStorageActor = Context.ActorOf(InstanceDatabaseStorageActor.Factory(new InstanceDatabaseStorageActor.Init(instanceGuid, init.DbProvider, init.CancellationToken)), "DatabaseStorage");
 
 		Receive<SetStatusCommand>(SetStatus);
+		Receive<SetPlayerCountsCommand>(SetPlayerCounts);
 		ReceiveAsyncAndReply<ConfigureInstanceCommand, Result<ConfigureInstanceResult, InstanceActionFailure>>(ConfigureInstance);
 		ReceiveAsyncAndReply<LaunchInstanceCommand, Result<LaunchInstanceResult, InstanceActionFailure>>(LaunchInstance);
 		ReceiveAsyncAndReply<StopInstanceCommand, Result<StopInstanceResult, InstanceActionFailure>>(StopInstance);
@@ -47,7 +49,7 @@ sealed class InstanceActor : ReceiveActor<InstanceActor.ICommand> {
 	}
 
 	private void NotifyInstanceUpdated() {
-		agentActor.Tell(new AgentActor.ReceiveInstanceDataCommand(new Instance(instanceGuid, configuration, status, launchAutomatically)));
+		agentActor.Tell(new AgentActor.ReceiveInstanceDataCommand(new Instance(instanceGuid, configuration, status, playerCounts, launchAutomatically)));
 	}
 
 	private void SetLaunchAutomatically(bool newValue) {
@@ -66,6 +68,8 @@ sealed class InstanceActor : ReceiveActor<InstanceActor.ICommand> {
 
 	public sealed record SetStatusCommand(IInstanceStatus Status) : ICommand;
 	
+	public sealed record SetPlayerCountsCommand(InstancePlayerCounts? PlayerCounts) : ICommand;
+
 	public sealed record ConfigureInstanceCommand(Guid AuditLogUserGuid, Guid InstanceGuid, InstanceConfiguration Configuration, InstanceLaunchProperties LaunchProperties, bool IsCreatingInstance) : ICommand, ICanReply<Result<ConfigureInstanceResult, InstanceActionFailure>>;
 
 	public sealed record LaunchInstanceCommand(Guid AuditLogUserGuid) : ICommand, ICanReply<Result<LaunchInstanceResult, InstanceActionFailure>>;
@@ -76,6 +80,16 @@ sealed class InstanceActor : ReceiveActor<InstanceActor.ICommand> {
 
 	private void SetStatus(SetStatusCommand command) {
 		status = command.Status;
+		
+		if (!status.IsRunning() && status != InstanceStatus.Offline /* Guard against temporary disconnects */) {
+			playerCounts = null;
+		}
+		
+		NotifyInstanceUpdated();
+	}
+	
+	private void SetPlayerCounts(SetPlayerCountsCommand command) {
+		playerCounts = command.PlayerCounts;
 		NotifyInstanceUpdated();
 	}
 

Controller/Phantom.Controller.Services/Rpc/AgentMessageHandlerActor.cs

@@ -39,6 +39,7 @@ sealed class AgentMessageHandlerActor : ReceiveActor<IMessageToController> {
 		Receive<AdvertiseJavaRuntimesMessage>(HandleAdvertiseJavaRuntimes);
 		Receive<ReportAgentStatusMessage>(HandleReportAgentStatus);
 		Receive<ReportInstanceStatusMessage>(HandleReportInstanceStatus);
+		Receive<ReportInstancePlayerCountsMessage>(HandleReportInstancePlayerCounts);
 		Receive<ReportInstanceEventMessage>(HandleReportInstanceEvent);
 		Receive<InstanceOutputMessage>(HandleInstanceOutput);
 		Receive<ReplyMessage>(HandleReply);
@@ -74,6 +75,10 @@ sealed class AgentMessageHandlerActor : ReceiveActor<IMessageToController> {
 		agentManager.TellAgent(agentGuid, new AgentActor.UpdateInstanceStatusCommand(message.InstanceGuid, message.InstanceStatus));
 	}
 
+	private void HandleReportInstancePlayerCounts(ReportInstancePlayerCountsMessage message) {
+		agentManager.TellAgent(agentGuid, new AgentActor.UpdateInstancePlayerCountsCommand(message.InstanceGuid, message.PlayerCounts));
+	}
+
 	private void HandleReportInstanceEvent(ReportInstanceEventMessage message) {
 		message.Event.Accept(eventLogManager.CreateInstanceEventVisitor(message.EventGuid, message.UtcTime, agentGuid, message.InstanceGuid));
 	}

Controller/Phantom.Controller.Services/Rpc/WebMessageHandlerActor.cs

@@ -71,7 +71,7 @@ sealed class WebMessageHandlerActor : ReceiveActor<IMessageToController> {
 
 		ReceiveAsync<RegisterWebMessage>(HandleRegisterWeb);
 		Receive<UnregisterWebMessage>(HandleUnregisterWeb);
-		ReceiveAndReplyLater<LogInMessage, LogInSuccess?>(HandleLogIn);
+		ReceiveAndReplyLater<LogInMessage, Optional<LogInSuccess>>(HandleLogIn);
 		Receive<LogOutMessage>(HandleLogOut);
 		ReceiveAndReply<GetAuthenticatedUser, Optional<AuthenticatedUserInfo>>(GetAuthenticatedUser);
 		ReceiveAndReplyLater<CreateOrUpdateAdministratorUserMessage, CreateOrUpdateAdministratorUserResult>(HandleCreateOrUpdateAdministratorUser);
@@ -100,7 +100,7 @@ sealed class WebMessageHandlerActor : ReceiveActor<IMessageToController> {
 		connection.Close();
 	}
 
-	private Task<LogInSuccess?> HandleLogIn(LogInMessage message) {
+	private Task<Optional<LogInSuccess>> HandleLogIn(LogInMessage message) {
 		return userLoginManager.LogIn(message.Username, message.Password);
 	}
 
@@ -141,19 +141,39 @@ sealed class WebMessageHandlerActor : ReceiveActor<IMessageToController> {
 	}
 
 	private Task<Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>> HandleCreateOrUpdateInstance(CreateOrUpdateInstanceMessage message) {
-		return agentManager.DoInstanceAction<AgentActor.CreateOrUpdateInstanceCommand, CreateOrUpdateInstanceResult>(message.Configuration.AgentGuid, new AgentActor.CreateOrUpdateInstanceCommand(message.AuthToken, message.InstanceGuid, message.Configuration));
+		return agentManager.DoInstanceAction<AgentActor.CreateOrUpdateInstanceCommand, CreateOrUpdateInstanceResult>(
+			Permission.CreateInstances,
+			message.AuthToken,
+			message.Configuration.AgentGuid,
+			loggedInUserGuid => new AgentActor.CreateOrUpdateInstanceCommand(loggedInUserGuid, message.InstanceGuid, message.Configuration)
+		);
 	}
 
 	private Task<Result<LaunchInstanceResult, UserInstanceActionFailure>> HandleLaunchInstance(LaunchInstanceMessage message) {
-		return agentManager.DoInstanceAction<AgentActor.LaunchInstanceCommand, LaunchInstanceResult>(message.AgentGuid, new AgentActor.LaunchInstanceCommand(message.AuthToken, message.InstanceGuid));
+		return agentManager.DoInstanceAction<AgentActor.LaunchInstanceCommand, LaunchInstanceResult>(
+			Permission.ControlInstances,
+			message.AuthToken,
+			message.AgentGuid,
+			loggedInUserGuid => new AgentActor.LaunchInstanceCommand(loggedInUserGuid, message.InstanceGuid)
+		);
 	}
 
 	private Task<Result<StopInstanceResult, UserInstanceActionFailure>> HandleStopInstance(StopInstanceMessage message) {
-		return agentManager.DoInstanceAction<AgentActor.StopInstanceCommand, StopInstanceResult>(message.AgentGuid, new AgentActor.StopInstanceCommand(message.AuthToken, message.InstanceGuid, message.StopStrategy));
+		return agentManager.DoInstanceAction<AgentActor.StopInstanceCommand, StopInstanceResult>(
+			Permission.ControlInstances,
+			message.AuthToken,
+			message.AgentGuid,
+			loggedInUserGuid => new AgentActor.StopInstanceCommand(loggedInUserGuid, message.InstanceGuid, message.StopStrategy)
+		);
 	}
 
 	private Task<Result<SendCommandToInstanceResult, UserInstanceActionFailure>> HandleSendCommandToInstance(SendCommandToInstanceMessage message) {
-		return agentManager.DoInstanceAction<AgentActor.SendCommandToInstanceCommand, SendCommandToInstanceResult>(message.AgentGuid, new AgentActor.SendCommandToInstanceCommand(message.AuthToken, message.InstanceGuid, message.Command));
+		return agentManager.DoInstanceAction<AgentActor.SendCommandToInstanceCommand, SendCommandToInstanceResult>(
+			Permission.ControlInstances,
+			message.AuthToken,
+			message.AgentGuid,
+			loggedInUserGuid => new AgentActor.SendCommandToInstanceCommand(loggedInUserGuid, message.InstanceGuid, message.Command)
+		);
 	}
 
 	private Task<ImmutableArray<MinecraftVersion>> HandleGetMinecraftVersions(GetMinecraftVersionsMessage message) {

Controller/Phantom.Controller.Services/Users/Sessions/AuthenticatedUserCache.cs

@@ -14,9 +14,12 @@ sealed class AuthenticatedUserCache {
 	}
 
 	public async Task<AuthenticatedUserInfo?> Update(UserEntity user, ILazyDbContext db) {
+		var permissionRepository = new PermissionRepository(db);
+		var userPermissions = await permissionRepository.GetAllUserPermissions(user);
+		var userManagedAgentGuids = await permissionRepository.GetManagedAgentGuids(user);
+		
 		var userGuid = user.UserGuid;
-		var userPermissions = await new PermissionRepository(db).GetAllUserPermissions(user);
-		var userInfo = new AuthenticatedUserInfo(userGuid, user.Name, userPermissions);
+		var userInfo = new AuthenticatedUserInfo(userGuid, user.Name, userPermissions, userManagedAgentGuids);
 		return authenticatedUsersByGuid[userGuid] = userInfo;
 	}
 	

Controller/Phantom.Controller.Services/Users/Sessions/LoggedInUser.cs

@@ -1,4 +1,5 @@
-using Phantom.Common.Data.Web.Users;
+using System.Collections.Immutable;
+using Phantom.Common.Data.Web.Users;
 
 namespace Phantom.Controller.Services.Users.Sessions;
 
@@ -6,6 +7,14 @@ readonly record struct LoggedInUser(AuthenticatedUserInfo? AuthenticatedUserInfo
 	public Guid? Guid => AuthenticatedUserInfo?.Guid;
 	
 	public bool CheckPermission(Permission permission) {
-		return AuthenticatedUserInfo != null && AuthenticatedUserInfo.Permissions.Check(permission);
+		return AuthenticatedUserInfo is {} info && info.CheckPermission(permission);
+	}
+
+	public bool HasAccessToAgent(Guid agentGuid) {
+		return AuthenticatedUserInfo is {} info && info.HasAccessToAgent(agentGuid);
+	}
+
+	public ImmutableHashSet<Guid> FilterAccessibleAgentGuids(ImmutableHashSet<Guid> agentGuids) {
+		return AuthenticatedUserInfo is {} info ? info.FilterAccessibleAgentGuids(agentGuids) : ImmutableHashSet<Guid>.Empty;
 	}
 }

Controller/Phantom.Controller.Services/Users/Sessions/UserLoginManager.cs

@@ -1,5 +1,6 @@
 using System.Collections.Immutable;
 using System.Security.Cryptography;
+using Phantom.Common.Data;
 using Phantom.Common.Data.Web.Users;
 using Phantom.Controller.Database;
 using Phantom.Controller.Database.Repositories;
@@ -29,7 +30,7 @@ sealed class UserLoginManager {
 		return sessionBuckets[token[0]];
 	}
 
-	public async Task<LogInSuccess?> LogIn(string username, string password) {
+	public async Task<Optional<LogInSuccess>> LogIn(string username, string password) {
 		Guid userGuid;
 		AuthenticatedUserInfo? authenticatedUserInfo;
 		
@@ -38,12 +39,12 @@ sealed class UserLoginManager {
 
 			var user = await userRepository.GetByName(username);
 			if (user == null || !UserPasswords.Verify(password, user.PasswordHash)) {
-				return null;
+				return default;
 			}
 
 			authenticatedUserInfo = await authenticatedUserCache.Update(user, db);
 			if (authenticatedUserInfo == null) {
-				return null;
+				return default;
 			}
 
 			userGuid = user.UserGuid;

Dockerfile

@@ -27,7 +27,7 @@ WORKDIR /data
 COPY --from=eclipse-temurin:8-jre  /opt/java/openjdk /opt/java/8
 COPY --from=eclipse-temurin:16-jdk /opt/java/openjdk /opt/java/16
 COPY --from=eclipse-temurin:17-jre /opt/java/openjdk /opt/java/17
-COPY --from=eclipse-temurin:20-jre /opt/java/openjdk /opt/java/20
+COPY --from=eclipse-temurin:21-jre /opt/java/openjdk /opt/java/21
 
 ARG DEBIAN_FRONTEND=noninteractive
 

Web/Phantom.Web.Services/Agents/AgentManager.cs

@@ -2,6 +2,7 @@
 using Phantom.Common.Data.Web.Agent;
 using Phantom.Utils.Events;
 using Phantom.Utils.Logging;
+using Phantom.Web.Services.Authentication;
 
 namespace Phantom.Web.Services.Agents; 
 
@@ -18,7 +19,13 @@ public sealed class AgentManager {
 		return agents.Value;
 	}
 	
-	public ImmutableDictionary<Guid, Agent> ToDictionaryByGuid() {
-		return agents.Value.ToImmutableDictionary(static agent => agent.AgentGuid);
+	public ImmutableDictionary<Guid, Agent> ToDictionaryByGuid(AuthenticatedUser? authenticatedUser) {
+		if (authenticatedUser == null) {
+			return ImmutableDictionary<Guid, Agent>.Empty;
+		}
+		
+		return agents.Value
+		             .Where(agent => authenticatedUser.Info.HasAccessToAgent(agent.AgentGuid))
+		             .ToImmutableDictionary(static agent => agent.AgentGuid);
 	}
 }

Web/Phantom.Web.Services/Authentication/AuthenticatedUser.cs

@@ -3,8 +3,4 @@ using Phantom.Common.Data.Web.Users;
 
 namespace Phantom.Web.Services.Authentication;
 
-public sealed record AuthenticatedUser(AuthenticatedUserInfo Info, ImmutableArray<byte> Token) {
-	public bool CheckPermission(Permission permission) {
-		return Info.Permissions.Check(permission);
-	}
-}
+public sealed record AuthenticatedUser(AuthenticatedUserInfo Info, ImmutableArray<byte> Token);

Web/Phantom.Web.Services/Authentication/UserLoginManager.cs

@@ -1,4 +1,5 @@
-using Phantom.Common.Data.Web.Users;
+using Phantom.Common.Data;
+using Phantom.Common.Data.Web.Users;
 using Phantom.Common.Messages.Web.ToController;
 using Phantom.Utils.Logging;
 using Phantom.Web.Services.Rpc;
@@ -22,23 +23,20 @@ public sealed class UserLoginManager {
 	}
 
 	public async Task<bool> LogIn(string username, string password, string? returnUrl = null) {
-		LogInSuccess? success;
+		Optional<LogInSuccess> result;
 		try {
-			success = await controllerConnection.Send<LogInMessage, LogInSuccess?>(new LogInMessage(username, password), TimeSpan.FromSeconds(30));
+			result = await controllerConnection.Send<LogInMessage, Optional<LogInSuccess>>(new LogInMessage(username, password), TimeSpan.FromSeconds(30));
 		} catch (Exception e) {
 			Logger.Error(e, "Could not log in {Username}.", username);
 			return false;
 		}
 
-		if (success == null) {
+		if (result.Value is not var (userInfo, authToken)) {
 			return false;
 		}
 
 		Logger.Information("Successfully logged in {Username}.", username);
 
-		var userInfo = success.UserInfo;
-		var authToken = success.AuthToken;
-		
 		authenticationStateProvider.SetUnloadedSession();
 		await sessionBrowserStorage.Store(userInfo.Guid, authToken);
 		await authenticationStateProvider.GetAuthenticationStateAsync();

Web/Phantom.Web.Services/Events/EventLogManager.cs

@@ -16,7 +16,7 @@ public sealed class EventLogManager {
 	}
 
 	public async Task<Result<ImmutableArray<EventLogItem>, UserActionFailure>> GetMostRecentItems(AuthenticatedUser? authenticatedUser, int count, CancellationToken cancellationToken) {
-		if (authenticatedUser != null && authenticatedUser.CheckPermission(Permission.ViewEvents)) {
+		if (authenticatedUser != null && authenticatedUser.Info.CheckPermission(Permission.ViewEvents)) {
 			var message = new GetEventLogMessage(authenticatedUser.Token, count);
 			return await controllerConnection.Send<GetEventLogMessage, Result<ImmutableArray<EventLogItem>, UserActionFailure>>(message, cancellationToken);
 		}

Web/Phantom.Web.Services/Instances/InstanceManager.cs

@@ -33,12 +33,17 @@ public sealed class InstanceManager {
 		return instances.Value;
 	}
 
-	public Instance? GetByGuid(Guid instanceGuid) {
-		return instances.Value.GetValueOrDefault(instanceGuid);
+	public Instance? GetByGuid(AuthenticatedUser? authenticatedUser, Guid instanceGuid) {
+		if (authenticatedUser == null) {
+			return null;
+		}
+		
+		var instance = instances.Value.GetValueOrDefault(instanceGuid);
+		return instance != null && authenticatedUser.Info.HasAccessToAgent(instance.Configuration.AgentGuid) ? instance : null;
 	}
 
 	public async Task<Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>> CreateOrUpdateInstance(AuthenticatedUser? authenticatedUser, Guid instanceGuid, InstanceConfiguration configuration, CancellationToken cancellationToken) {
-		if (authenticatedUser != null && authenticatedUser.CheckPermission(Permission.CreateInstances)) {
+		if (authenticatedUser != null && authenticatedUser.Info.CheckPermission(Permission.CreateInstances)) {
 			var message = new CreateOrUpdateInstanceMessage(authenticatedUser.Token, instanceGuid, configuration);
 			return await controllerConnection.Send<CreateOrUpdateInstanceMessage, Result<CreateOrUpdateInstanceResult, UserInstanceActionFailure>>(message, cancellationToken);
 		}
@@ -48,7 +53,7 @@ public sealed class InstanceManager {
 	}
 
 	public async Task<Result<LaunchInstanceResult, UserInstanceActionFailure>> LaunchInstance(AuthenticatedUser? authenticatedUser, Guid agentGuid, Guid instanceGuid, CancellationToken cancellationToken) {
-		if (authenticatedUser != null && authenticatedUser.CheckPermission(Permission.ControlInstances)) {
+		if (authenticatedUser != null && authenticatedUser.Info.CheckPermission(Permission.ControlInstances)) {
 			var message = new LaunchInstanceMessage(authenticatedUser.Token, agentGuid, instanceGuid);
 			return await controllerConnection.Send<LaunchInstanceMessage, Result<LaunchInstanceResult, UserInstanceActionFailure>>(message, cancellationToken);
 		}
@@ -58,7 +63,7 @@ public sealed class InstanceManager {
 	}
 
 	public async Task<Result<StopInstanceResult, UserInstanceActionFailure>> StopInstance(AuthenticatedUser? authenticatedUser, Guid agentGuid, Guid instanceGuid, MinecraftStopStrategy stopStrategy, CancellationToken cancellationToken) {
-		if (authenticatedUser != null && authenticatedUser.CheckPermission(Permission.ControlInstances)) {
+		if (authenticatedUser != null && authenticatedUser.Info.CheckPermission(Permission.ControlInstances)) {
 			var message = new StopInstanceMessage(authenticatedUser.Token, agentGuid, instanceGuid, stopStrategy);
 			return await controllerConnection.Send<StopInstanceMessage, Result<StopInstanceResult, UserInstanceActionFailure>>(message, cancellationToken);
 		}
@@ -68,7 +73,7 @@ public sealed class InstanceManager {
 	}
 
 	public async Task<Result<SendCommandToInstanceResult, UserInstanceActionFailure>> SendCommandToInstance(AuthenticatedUser? authenticatedUser, Guid agentGuid, Guid instanceGuid, string command, CancellationToken cancellationToken) {
-		if (authenticatedUser != null && authenticatedUser.CheckPermission(Permission.ControlInstances)) {
+		if (authenticatedUser != null && authenticatedUser.Info.CheckPermission(Permission.ControlInstances)) {
 			var message = new SendCommandToInstanceMessage(authenticatedUser.Token, agentGuid, instanceGuid, command);
 			return await controllerConnection.Send<SendCommandToInstanceMessage, Result<SendCommandToInstanceResult, UserInstanceActionFailure>>(message, cancellationToken);
 		}

Web/Phantom.Web.Services/Users/AuditLogManager.cs

@@ -16,7 +16,7 @@ public sealed class AuditLogManager {
 	}
 
 	public async Task<Result<ImmutableArray<AuditLogItem>, UserActionFailure>> GetMostRecentItems(AuthenticatedUser? authenticatedUser, int count, CancellationToken cancellationToken) {
-		if (authenticatedUser != null && authenticatedUser.CheckPermission(Permission.ViewAudit)) {
+		if (authenticatedUser != null && authenticatedUser.Info.CheckPermission(Permission.ViewAudit)) {
 			var message = new GetAuditLogMessage(authenticatedUser.Token, count);
 			return await controllerConnection.Send<GetAuditLogMessage, Result<ImmutableArray<AuditLogItem>, UserActionFailure>>(message, cancellationToken);
 		}

Web/Phantom.Web.Services/Users/UserManager.cs

@@ -19,7 +19,7 @@ public sealed class UserManager {
 	}
 
 	public async Task<Result<CreateUserResult, UserActionFailure>> Create(AuthenticatedUser? authenticatedUser, string username, string password, CancellationToken cancellationToken) {
-		if (authenticatedUser != null && authenticatedUser.CheckPermission(Permission.EditUsers)) {
+		if (authenticatedUser != null && authenticatedUser.Info.CheckPermission(Permission.EditUsers)) {
 			return await controllerConnection.Send<CreateUserMessage, Result<CreateUserResult, UserActionFailure>>(new CreateUserMessage(authenticatedUser.Token, username, password), cancellationToken);
 		}
 		else {
@@ -28,7 +28,7 @@ public sealed class UserManager {
 	}
 	
 	public async Task<Result<DeleteUserResult, UserActionFailure>> DeleteByGuid(AuthenticatedUser? authenticatedUser, Guid userGuid, CancellationToken cancellationToken) {
-		if (authenticatedUser != null && authenticatedUser.CheckPermission(Permission.EditUsers)) {
+		if (authenticatedUser != null && authenticatedUser.Info.CheckPermission(Permission.EditUsers)) {
 			return await controllerConnection.Send<DeleteUserMessage, Result<DeleteUserResult, UserActionFailure>>(new DeleteUserMessage(authenticatedUser.Token, userGuid), cancellationToken);
 		}
 		else {

Web/Phantom.Web.Services/Users/UserRoleManager.cs

@@ -23,7 +23,7 @@ public sealed class UserRoleManager {
 	}
 
 	public async Task<Result<ChangeUserRolesResult, UserActionFailure>> ChangeUserRoles(AuthenticatedUser? authenticatedUser, Guid subjectUserGuid, ImmutableHashSet<Guid> addToRoleGuids, ImmutableHashSet<Guid> removeFromRoleGuids, CancellationToken cancellationToken) {
-		if (authenticatedUser != null && authenticatedUser.CheckPermission(Permission.EditUsers)) {
+		if (authenticatedUser != null && authenticatedUser.Info.CheckPermission(Permission.EditUsers)) {
 			return await controllerConnection.Send<ChangeUserRolesMessage, Result<ChangeUserRolesResult, UserActionFailure>>(new ChangeUserRolesMessage(authenticatedUser.Token, subjectUserGuid, addToRoleGuids, removeFromRoleGuids), cancellationToken);
 		}
 		else {

Web/Phantom.Web/Pages/Agents.razor

@@ -1,4 +1,5 @@
 @page "/agents"
+@using System.Collections.Immutable
 @using Phantom.Common.Data.Web.Agent
 @using Phantom.Utils.Collections
 @using Phantom.Web.Services.Agents
@@ -46,33 +47,45 @@
         <Cell class="fw-semibold text-center text-success">Online</Cell>
         <Cell class="text-end">-</Cell>
         break;
+
       case AgentIsOffline:
         <Cell class="fw-semibold text-center">Offline</Cell>
         <Cell class="text-end">N/A</Cell>
         break;
+
       case AgentIsDisconnected status:
         <Cell class="fw-semibold text-center">Offline</Cell>
         <Cell class="text-end">
           <TimeWithOffset Time="status.LastPingTime" />
         </Cell>
         break;
+
       default:
         <Cell class="fw-semibold text-center">N/A</Cell>
         break;
     }
   </ItemRow>
   <NoItemsRow>
-    No agents registered.
+    No agents found.
   </NoItemsRow>
 </Table>
 
 @code {
 
-  private readonly TableData<Agent, Guid> agentTable = new();
+  private TableData<Agent, Guid>? agentTable;
+
+  protected override async Task OnInitializedAsync() {
+    var authenticatedUser = await GetAuthenticatedUser();
+    if (authenticatedUser == null) {
+      return;
+    }
 
-  protected override void OnInitialized() {
     AgentManager.AgentsChanged.Subscribe(this, agents => {
-      var sortedAgents = agents.Sort(static (a1, a2) => a1.Configuration.AgentName.CompareTo(a2.Configuration.AgentName));
+      var sortedAgents = agents.Where(agent => authenticatedUser.Info.HasAccessToAgent(agent.AgentGuid))
+                               .OrderBy(static agent => agent.Configuration.AgentName)
+                               .ToImmutableArray();
+
+      agentTable ??= new TableData<Agent, Guid>();
       agentTable.UpdateFrom(sortedAgents, static agent => agent.AgentGuid, static agent => agent, static (agent, _) => agent);
       InvokeAsync(StateHasChanged);
     });

Web/Phantom.Web/Pages/InstanceDetail.razor

@@ -7,9 +7,15 @@
 @using Phantom.Common.Data.Instance
 @using Phantom.Web.Services.Instances
 @using Phantom.Web.Services.Authorization
-@inherits Phantom.Web.Components.PhantomComponent
+@inherits PhantomComponent
 @inject InstanceManager InstanceManager
 
+@if (isLoading) {
+  <h1>Instance</h1>
+  <p>Loading...</p>
+  return;
+}
+
 @if (Instance == null) {
   <h1>Instance Not Found</h1>
   <p>Return to <a href="instances">all instances</a>.</p>
@@ -54,19 +60,25 @@
   [Parameter]
   public Guid InstanceGuid { get; init; }
 
+  private Instance? Instance { get; set; }
+  private bool isLoading = true;
+
   private string? lastError = null;
   private bool isLaunchingInstance = false;
 
-  private Instance? Instance { get; set; }
+  protected override async Task OnInitializedAsync() {
+    Instance = InstanceManager.GetByGuid(await GetAuthenticatedUser(), InstanceGuid);
+    isLoading = false;
 
-  protected override void OnInitialized() {
-    InstanceManager.InstancesChanged.Subscribe(this, instances => {
-      var newInstance = instances.TryGetValue(InstanceGuid, out var instance) ? instance : null;
-      if (newInstance != Instance) {
-        Instance = newInstance;
-        InvokeAsync(StateHasChanged);
-      }
-    });
+    if (Instance != null) {
+      InstanceManager.InstancesChanged.Subscribe(this, instances => {
+        var newInstance = instances.TryGetValue(InstanceGuid, out var instance) ? instance : null;
+        if (newInstance != Instance) {
+          Instance = newInstance;
+          InvokeAsync(StateHasChanged);
+        }
+      });
+    }
   }
 
   private async Task LaunchInstance() {

Web/Phantom.Web/Pages/InstanceEdit.razor

@@ -6,14 +6,20 @@
 @inherits PhantomComponent
 @inject InstanceManager InstanceManager
 
+@if (isLoading) {
+  <h1>Edit Instance</h1>
+  <p>Loading...</p>
+  return;
+}
+
 @if (Instance == null) {
   <h1>Instance Not Found</h1>
   <p>Return to <a href="instances">all instances</a>.</p>
+  return;
 }
-else {
-  <h1>Edit Instance: @Instance.Configuration.InstanceName</h1>
-  <InstanceAddOrEditForm EditedInstance="Instance" />
-}
+
+<h1>Edit Instance: @Instance.Configuration.InstanceName</h1>
+<InstanceAddOrEditForm EditedInstance="Instance" />
 
 @code {
 
@@ -21,9 +27,11 @@ else {
   public Guid InstanceGuid { get; init; }
 
   private Instance? Instance { get; set; }
+  private bool isLoading = true;
 
-  protected override void OnInitialized() {
-    Instance = InstanceManager.GetByGuid(InstanceGuid);
+  protected override async Task OnInitializedAsync() {
+    Instance = InstanceManager.GetByGuid(await GetAuthenticatedUser(), InstanceGuid);
+    isLoading = false;
   }
 
 }

Web/Phantom.Web/Pages/Instances.razor

@@ -21,6 +21,7 @@
     <Column Width="40%">Agent</Column>
     <Column Width="40%">Name</Column>
     <Column MinWidth="215px">Status</Column>
+    <Column Class="text-center" MinWidth="120px">Players</Column>
     <Column Width="20%">Version</Column>
     <Column Class="text-center" MinWidth="110px">Server Port</Column>
     <Column Class="text-center" MinWidth="110px">Rcon Port</Column>
@@ -40,6 +41,14 @@
     <Cell>
       <InstanceStatusText Status="instance.Status" />
     </Cell>
+    <Cell class="text-center">
+      @if (instance.PlayerCounts is var (online, maximum)) {
+	      <p class="font-monospace">@online.ToString() / @maximum.ToString()</p>
+      }
+      else {
+	      <p class="font-monospace">-</p>
+      }
+    </Cell>
     <Cell>@configuration.MinecraftServerKind @configuration.MinecraftVersion</Cell>
     <Cell class="text-center">
       <p class="font-monospace">@configuration.ServerPort.ToString()</p>
@@ -69,9 +78,18 @@
       this.agentNamesByGuid = agents.ToImmutableDictionary(static agent => agent.AgentGuid, static agent => agent.Configuration.AgentName);
       InvokeAsync(StateHasChanged);
     });
+  }
+
+  protected override async Task OnInitializedAsync() {
+    var authenticatedUser = await GetAuthenticatedUser();
+    if (authenticatedUser == null) {
+      instances = ImmutableArray<Instance>.Empty;
+      return;
+    }
 
     InstanceManager.InstancesChanged.Subscribe(this, instances => {
       this.instances = instances.Values
+                                .Where(instance => authenticatedUser.Info.HasAccessToAgent(instance.Configuration.AgentGuid))
                                 .OrderBy(instance => agentNamesByGuid.TryGetValue(instance.Configuration.AgentGuid, out var agentName) ? agentName : string.Empty)
                                 .ThenBy(static instance => instance.Configuration.InstanceName)
                                 .ToImmutableArray();

Web/Phantom.Web/Shared/InstanceAddOrEditForm.razor

@@ -278,10 +278,11 @@
   }
 
   protected override async Task OnInitializedAsync() {
+    var authenticatedUser = await GetAuthenticatedUser();
     var agentJavaRuntimesTask = ControllerConnection.Send<GetAgentJavaRuntimesMessage, ImmutableDictionary<Guid, ImmutableArray<TaggedJavaRuntime>>>(new GetAgentJavaRuntimesMessage(), TimeSpan.FromSeconds(30));
     var minecraftVersionsTask = ControllerConnection.Send<GetMinecraftVersionsMessage, ImmutableArray<MinecraftVersion>>(new GetMinecraftVersionsMessage(), TimeSpan.FromSeconds(30));
 
-    allAgentsByGuid = AgentManager.ToDictionaryByGuid();
+    allAgentsByGuid = AgentManager.ToDictionaryByGuid(authenticatedUser);
     allAgentJavaRuntimes = await agentJavaRuntimesTask;
     allMinecraftVersions = await minecraftVersionsTask;