GameCult/Heimdall
Watch
9
0
Fork
You've already forked Heimdall
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Record StreamPixels Twitch verification

Browse source
This commit is contained in:
Meta Vens 2026-04-29 16:25:35 +01:00
commit 185a30fbd8
3 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
notes/fresh-workspace-handoff.md
View file

@ -81,6 +81,9 @@ Do not trust this file for the exact live HEAD. Always check git.
- Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels
migration slice; Twitch callback handling has been patched so provider token
`scope` can be either a space-delimited string or an array
- live StreamPixels Twitch sign-in through Heimdall has succeeded on Yggdrasil
and Heimdall audit showed callback success, completion creation, and
completion redemption
- the ignored local `secrets/heimdall-service.env` artifact now has
`GC_ACCESS_PROVIDER_TWITCH_*` and `GC_ACCESS_PROVIDER_YOUTUBE_*` populated
for the StreamPixels migration slice
@ -105,6 +108,8 @@ If the user asks to continue on StreamPixels, the current next move is real
browser verification:
- verify viewer claim/link through `https://streampixels.gamecult.org/auth/connect`
- Twitch viewer sign-in has already passed once; continue with YouTube and
connector attachment verification
- verify creator connector attach from an admin creator session
- confirm StreamPixels persists local profile/connector binding state while
Heimdall retains provider token custody

1
state/evidence.jsonl
View file

@ -18,3 +18,4 @@
{"ts": "2026-04-29T13:56:56+00:00", "type": "design", "status": "accepted", "note": "StreamPixels viewer and creator Twitch/YouTube OAuth now delegates to Heimdall. Heimdall owns provider OAuth, identity resolution, encrypted token custody, and app-authenticated access-token resolution; StreamPixels owns viewer profiles, creator memberships, connector bindings, diagnostics, EventSub/live-chat runtime behavior, and audience data."}
{"ts": "2026-04-29T14:16:59+00:00", "type": "config", "status": "accepted", "note": "Local Heimdall deployment env artifact now contains StreamPixels Twitch and YouTube OAuth client credentials under secrets/heimdall-service.env as GC_ACCESS_PROVIDER_TWITCH_* and GC_ACCESS_PROVIDER_YOUTUBE_*; values remain ignored and unprinted. Google callback URI in the downloaded secret file was ignored in favor of the configured Heimdall callback."}
{"ts": "2026-04-29T15:23:01+00:00", "type": "implementation", "status": "accepted", "note": "Twitch token exchange can return scope as an array; Heimdall now normalizes provider token scopes from string or array before storing managed credentials."}
{"ts": "2026-04-29T15:25:08+00:00", "type": "verification", "status": "accepted", "note": "Live StreamPixels Twitch sign-in through Heimdall succeeded on Yggdrasil: Heimdall audit shows oauth_callback_succeeded, auth_completion_created, and auth_completion_redeemed for twitch after the scope normalization deploy."}

4
state/map.yaml
View file

@ -98,5 +98,5 @@ rejected_paths:
reason: reusing auth mechanics does not justify centralizing app-domain audience or product data
current_status:
summary: Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels auth migration slice. Heimdall has Twitch/YouTube provider credentials, the shared StreamPixels app secret, generic Twitch/YouTube identity and managed-credential custody runtimes, and a live fix for Twitch token responses that return scopes as arrays. StreamPixels delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes through its service, writes its own httpOnly viewer session, stores local profile/creator connector binding state, and asks Heimdall for current provider access tokens when runtime code needs them. The key boundary still holds: Heimdall owns provider OAuth and credential custody; StreamPixels owns viewer profiles, creator memberships, connector config, diagnostics, EventSub/live-chat runtime behavior, and audience data.
next_action: Complete real browser verification for StreamPixels viewer sign-in/link and creator Twitch/YouTube connector attach from `https://streampixels.gamecult.org/auth/connect`. If Twitch or YouTube fails, inspect Heimdall audit events and StreamPixels service logs first; do not move provider-specific app state into Heimdall while debugging.
summary: Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels auth migration slice. Heimdall has Twitch/YouTube provider credentials, the shared StreamPixels app secret, generic Twitch/YouTube identity and managed-credential custody runtimes, and a live fix for Twitch token responses that return scopes as arrays. Live StreamPixels Twitch sign-in through Heimdall has succeeded and redeemed a completion code. StreamPixels delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes through its service, writes its own httpOnly viewer session, stores local profile/creator connector binding state, and asks Heimdall for current provider access tokens when runtime code needs them. The key boundary still holds: Heimdall owns provider OAuth and credential custody; StreamPixels owns viewer profiles, creator memberships, connector config, diagnostics, EventSub/live-chat runtime behavior, and audience data.
next_action: Complete the remaining real browser verification for StreamPixels: YouTube sign-in/link, creator Twitch/YouTube connector attach from an admin creator session, and local StreamPixels persistence checks. If a provider callback fails, inspect Heimdall audit events and StreamPixels service logs first; do not move provider-specific app state into Heimdall while debugging.