GameCult/Heimdall
Watch
9
0
Fork
You've already forked Heimdall
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Persist StreamPixels credential handoff state

Browse source
This commit is contained in:
Meta Vens 2026-04-29 15:18:25 +01:00
commit 475ee59e13
4 changed files with 25 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
state/evidence.jsonl
View file

@ -16,3 +16,4 @@
{"ts": "2026-04-29T12:19:57+00:00", "type": "design", "status": "accepted", "note": "Repixelizer Discord role policy moved out of Heimdall app-specific env. Repixelizer owns the GameCult guild and role list through REPIXELIZER_ACCESS_DISCORD_* and sends a caller-owned discord_role_access policy in the trusted backend-callback OAuth start; Heimdall keeps provider OAuth credentials/callback mechanics and evaluates the supplied policy."}
{"ts": "2026-04-29T13:37:17+00:00", "type": "provider", "status": "accepted", "note": "Patreon OAuth for Repixelizer is enabled through Heimdall with API v2 identity lookup. Repixelizer owns the access rule and sends patreon_membership_access with requiredTierTitle=Inner Sanctum; Heimdall evaluates the signed-in user's currently entitled Patreon tiers by title instead of currency amount."}
{"ts": "2026-04-29T13:56:56+00:00", "type": "design", "status": "accepted", "note": "StreamPixels viewer and creator Twitch/YouTube OAuth now delegates to Heimdall. Heimdall owns provider OAuth, identity resolution, encrypted token custody, and app-authenticated access-token resolution; StreamPixels owns viewer profiles, creator memberships, connector bindings, diagnostics, EventSub/live-chat runtime behavior, and audience data."}
{"ts": "2026-04-29T14:16:59+00:00", "type": "config", "status": "accepted", "note": "Local Heimdall deployment env artifact now contains StreamPixels Twitch and YouTube OAuth client credentials under secrets/heimdall-service.env as GC_ACCESS_PROVIDER_TWITCH_* and GC_ACCESS_PROVIDER_YOUTUBE_*; values remain ignored and unprinted. Google callback URI in the downloaded secret file was ignored in favor of the configured Heimdall callback."}

4
state/map.yaml
View file

@ -98,5 +98,5 @@ rejected_paths:
reason: reusing auth mechanics does not justify centralizing app-domain audience or product data
current_status:
summary: Heimdall has a live Yggdrasil deployment for the Repixelizer auth path and now a local StreamPixels integration slice. The service has Ed25519 JWT signing/JWKS, signed OAuth state, Postgres-backed auth/control-plane persistence, encrypted managed provider token custody, real Discord and Patreon callback runtimes for Repixelizer, and generic Twitch/YouTube callback runtimes for StreamPixels identity and managed creator connections. StreamPixels now delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes through its service, writes its own httpOnly viewer session, stores local profile/creator connector binding state, and asks Heimdall for current provider access tokens when runtime code needs them. The key boundary still holds: Heimdall owns provider OAuth and credential custody; StreamPixels owns viewer profiles, creator memberships, connector config, diagnostics, EventSub/live-chat runtime behavior, and audience data.
next_action: Deploy/configure the StreamPixels-Heimdall slice with Heimdall Twitch/YouTube provider credentials plus `GC_ACCESS_APP_SHARED_SECRET` on both sides, then run real browser flows for viewer claim/link and creator Twitch/YouTube connector attach. Confirm StreamPixels stores only local binding/runtime state for Heimdall-managed connector credentials and still gates creator/operator routes from local memberships.
summary: Heimdall has a live Yggdrasil deployment for the Repixelizer auth path and now a local StreamPixels integration slice. The service has Ed25519 JWT signing/JWKS, signed OAuth state, Postgres-backed auth/control-plane persistence, encrypted managed provider token custody, real Discord and Patreon callback runtimes for Repixelizer, and generic Twitch/YouTube callback runtimes for StreamPixels identity and managed creator connections. StreamPixels now delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes through its service, writes its own httpOnly viewer session, stores local profile/creator connector binding state, and asks Heimdall for current provider access tokens when runtime code needs them. Twitch and YouTube OAuth client credentials have been staged into the ignored local Heimdall service env artifact. The key boundary still holds: Heimdall owns provider OAuth and credential custody; StreamPixels owns viewer profiles, creator memberships, connector config, diagnostics, EventSub/live-chat runtime behavior, and audience data.
next_action: Deploy/configure the StreamPixels-Heimdall slice using the staged Heimdall Twitch/YouTube provider credentials plus `GC_ACCESS_APP_SHARED_SECRET` on both Heimdall and StreamPixels, then run real browser flows for viewer claim/link and creator Twitch/YouTube connector attach. Confirm StreamPixels stores only local binding/runtime state for Heimdall-managed connector credentials and still gates creator/operator routes from local memberships.

17
state/scratch-compaction-d44a230f-4396-40bc-bade-8540321fc091.md Normal file
View file

@ -0,0 +1,17 @@
# Imminent Compaction Scratch
Live context from memory, written before inspection.
- User asked to prepare for imminent compaction after StreamPixels auth surgery.
- Heimdall repo: E:\Projects\Heimdall.
- StreamPixels repo: E:\Projects\StreamPixels.
- We migrated StreamPixels auth direction so Heimdall owns Twitch/YouTube OAuth, identity resolution, encrypted provider token custody, and app-authenticated managed access-token resolution.
- StreamPixels owns viewer profiles, local httpOnly viewer session, creator memberships, operator roles, connector binding, EventSub/live-chat runtime behavior, diagnostics, and audience data.
- Heimdall commit was created and pushed: f22db66 Add StreamPixels managed auth seams.
- StreamPixels commit was created locally but not pushed because the repo was already ahead by five commits before our work: 0183163 Delegate StreamPixels auth to Heimdall. After that, StreamPixels was ahead by 6.
- Verification completed before commits: Heimdall pnpm typecheck and pnpm test passed; StreamPixels pnpm typecheck and pnpm test passed.
- Twitch credentials were added from E:\Projects\Heimdall\secrets\streampixels_twitch_oauth.txt into E:\Projects\Heimdall\secrets\heimdall-service.env as GC_ACCESS_PROVIDER_TWITCH_CLIENT_ID and GC_ACCESS_PROVIDER_TWITCH_CLIENT_SECRET. Values were not printed.
- YouTube Google client secret JSON was added under E:\Projects\Heimdall\secrets\client_secret_*.json. I ignored its callback URI and copied client_id/client_secret into E:\Projects\Heimdall\secrets\heimdall-service.env as GC_ACCESS_PROVIDER_YOUTUBE_CLIENT_ID and GC_ACCESS_PROVIDER_YOUTUBE_CLIENT_SECRET. Values were not printed.
- Secrets folder is gitignored in Heimdall.
- Next action persisted in Heimdall state should be deploy/configure StreamPixels-Heimdall slice with Heimdall Twitch/YouTube provider credentials plus GC_ACCESS_APP_SHARED_SECRET on both sides, then real browser viewer claim/link and creator connector attach verification.
- Need now: run Heimdall compaction helper, update any state changed by credential setup if needed, rerun helper, commit persistence if changed. Do not commit secrets.