diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 8c918ae..20e7019 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -88,6 +88,10 @@ Do not trust this file for the exact live HEAD. Always check git. local Heimdall account binding and resolves current Spotify access through `/v1/apps/spotiverse/managed-credentials/resolve` without storing provider refresh tokens. +- Public Yggdrasil Heimdall has been deployed with the Spotiverse/Spotify code + path, Spotify provider credentials, a Spotiverse shared secret, and an + allowlisted loopback portal callback at + `http://127.0.0.1:18796/auth/heimdall/callback`. - Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels migration slice; Twitch callback handling has been patched so provider token `scope` can be either a space-delimited string or an array @@ -114,13 +118,13 @@ Do not trust this file for the exact live HEAD. Always check git. Do not continue implementation automatically from a rehydrate-only request. -If the user asks to continue on Spotiverse, configure Heimdall with -`GC_ACCESS_PROVIDER_SPOTIFY_CLIENT_ID`, -`GC_ACCESS_PROVIDER_SPOTIFY_CLIENT_SECRET`, and -`GC_ACCESS_APP_SPOTIVERSE_SHARED_SECRET`, configure Spotiverse with the matching -`HEIMDALL_APP_SECRET`, then run a real browser `/auth/login` and verify -managed credential resolution. Spotiverse should not regain local Spotify -OAuth token storage. +If the user asks to continue on Spotiverse, the current next move is the real +browser `/auth/login` flow through public Heimdall. The Yggdrasil SSH tunnel +must include reverse forward +`spotiverse-callback:18796:127.0.0.1:8796`, and local Spotiverse must point at +`https://heimdall.gamecult.org` with the matching `HEIMDALL_APP_SECRET`. Verify +managed credential resolution after login. Spotiverse should not regain local +Spotify OAuth token storage. If the user asks to continue on StreamPixels, the current next move is real browser verification: diff --git a/state/evidence.jsonl b/state/evidence.jsonl index b7e8318..f8c02d3 100644 --- a/state/evidence.jsonl +++ b/state/evidence.jsonl @@ -25,3 +25,4 @@ {"ts": "2026-05-20T17:56:35+00:00", "type": "deployment", "status": "ok", "note": "Deployed Heimdall refresh-token session support to Yggdrasil and verified heimdall.service active, health/JWKS/discovery checks passing, and /v1/apps/repixelizer/sessions/refresh live with validation."} {"ts": "2026-06-02T15:25:08+00:00", "type": "implementation", "status": "accepted", "note": "Spotiverse now consumes Spotify as a Heimdall-managed credential: Heimdall owns Spotify OAuth/token custody, and Spotiverse resolves current access via /v1/apps/spotiverse/managed-credentials/resolve without storing provider refresh tokens."} {"ts": "2026-06-02T18:25:05+00:00", "type": "implementation", "status": "accepted", "note": "Public Heimdall can now hand Spotiverse OAuth results to a configured portal callback URL via GC_ACCESS_APP_SPOTIVERSE_BACKEND_CALLBACK_URLS; backend_callback handoffs are rejected unless the app callback is trusted, preserving token-bearing handoff boundaries."} +{"ts": "2026-06-02T18:36:46+00:00", "type": "deployment", "status": "ok", "note": "Public Yggdrasil Heimdall was deployed with the Spotify/Spotiverse provider code, Spotify credentials from secrets/spotify.txt, a generated Spotiverse app shared secret, and GC_ACCESS_APP_SPOTIVERSE_BACKEND_CALLBACK_URLS set to the Yggdrasil loopback reverse-forward callback. Local Spotiverse now points at public Heimdall, and the Yggdrasil SSH tunnel exposes 127.0.0.1:18796 back to local Spotiverse :8796."} diff --git a/state/map.yaml b/state/map.yaml index 021a2546..f705898 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -103,5 +103,5 @@ rejected_paths: reason: reusing auth mechanics does not justify centralizing app-domain audience or product data current_status: - summary: Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels auth migration slice. Heimdall has Twitch/YouTube provider credentials, the shared StreamPixels app secret, generic Twitch/YouTube identity and managed-credential custody runtimes, and a live fix for Twitch token responses that return scopes as arrays. Live StreamPixels Twitch sign-in through Heimdall has succeeded and redeemed a completion code. StreamPixels delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes server-side, writes its own httpOnly viewer session, stores local profile/creator connector binding state, and asks Heimdall for current provider access tokens when runtime code needs them. Spotiverse is now added as a Heimdall app profile with Spotify as a managed credential provider; Spotiverse should resolve access tokens from Heimdall and must not own Spotify refresh-token custody. Repixelizer access has a signed Heimdall refresh-token path. The key boundary still holds: Heimdall owns provider OAuth and credential custody; host apps own local sessions, route/resource checks, runtime behavior, and app-domain data. - next_action: Configure Heimdall with Spotify OAuth credentials and `GC_ACCESS_APP_SPOTIVERSE_SHARED_SECRET`, then run a real browser Spotiverse `/auth/login` flow and verify `/v1/apps/spotiverse/managed-credentials/resolve` returns only an access-token projection. After that, return to the remaining StreamPixels browser verification. + summary: Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels auth migration slice. Heimdall has Twitch/YouTube provider credentials, the shared StreamPixels app secret, generic Twitch/YouTube identity and managed-credential custody runtimes, and a live fix for Twitch token responses that return scopes as arrays. Live StreamPixels Twitch sign-in through Heimdall has succeeded and redeemed a completion code. StreamPixels delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes server-side, writes its own httpOnly viewer session, stores local profile/creator connector binding state, and asks Heimdall for current provider access tokens when runtime code needs them. Spotiverse is now added as a Heimdall app profile with Spotify as a managed credential provider, and Yggdrasil Heimdall has Spotify provider credentials plus a Spotiverse shared secret and loopback portal callback allowlist. Spotiverse should resolve access tokens from Heimdall and must not own Spotify refresh-token custody. Repixelizer access has a signed Heimdall refresh-token path. The key boundary still holds: Heimdall owns provider OAuth and credential custody; host apps own local sessions, route/resource checks, runtime behavior, and app-domain data. + next_action: Run a real browser Spotiverse `/auth/login` flow through public Heimdall and the Yggdrasil reverse-forward callback, then verify `/v1/apps/spotiverse/managed-credentials/resolve` returns only an access-token projection. After that, return to the remaining StreamPixels browser verification.