GameCult/Heimdall
Watch
9
0
Fork
You've already forked Heimdall
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Allow Inner Sanctum Repixelizer access

Browse source
This commit is contained in:
Meta Vens 2026-04-29 13:07:44 +01:00
commit c8658ddd91
5 changed files with 12 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

1
state/evidence.jsonl
View file

@ -12,3 +12,4 @@
{"ts": "2026-04-29T10:51:08+00:00", "type": "design", "status": "accepted", "note": "Repixelizer has consumed Heimdall's direct backend callback flow locally, so Heimdall is no longer blocked on Repixelizer auth refactoring. The next Heimdall objective is Discord-only live launch configuration and end-to-end OAuth verification on Yggdrasil; other providers remain catalogued but callback runtimes are not implemented yet."}
{"ts": "2026-04-29T10:53:44+00:00", "type": "design", "status": "accepted", "note": "Repixelizer Discord launch policy is intentionally role-gated: the GameCult guild can remain public, but Heimdall should grant Repixelizer app access only to members with the Cultist role configured in GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS."}
{"ts": "2026-04-29T11:39:36+00:00", "type": "deployment", "status": "accepted", "note": "Heimdall is deployed on Yggdrasil behind nginx at https://heimdall.gamecult.org with Postgres storage, file-backed Ed25519 signing key bootstrap, configured token custody, and public JWKS/discovery/health checks passing. Repixelizer is deployed at https://repixelizer.gamecult.org in Heimdall mode with Discord as the only provider, required access enabled, and queue protection enabled; public auth-start returns a Discord authorization URL using the Heimdall callback and Repixelizer backend handoff."}
{"ts": "2026-04-29T12:06:26+00:00", "type": "config", "status": "accepted", "note": "Repixelizer Discord access now accepts either KLTST (861962027550244914) or the Patreon-synced Inner Sanctum role (1497585425491955894) via GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS."}

2
state/map.yaml
View file

@ -96,4 +96,4 @@ rejected_paths:
current_status:
summary: Heimdall has a live first Yggdrasil deployment for the Discord-only Repixelizer path: TypeScript/Fastify runtime behind nginx/TLS at `https://heimdall.gamecult.org`, Ed25519 JWT signing with bootstrapped file-backed key support, JWKS/discovery exposure, signed OAuth start-state handling, Postgres-backed auth/control-plane persistence, a real Discord callback path, AES-256-GCM token sealing for managed provider credentials at rest, direct backend callback delivery for Repixelizer, and the older one-time completion-code exchange retained as fallback. Repixelizer is deployed at `https://repixelizer.gamecult.org` in Heimdall mode with Discord as the only public provider, required access enabled, and queue protection enabled. Public health/discovery/JWKS/config checks pass, and public auth-start returns a Discord authorization URL using the Heimdall callback plus Repixelizer backend handoff. Patreon, GitHub, Twitch, and YouTube are catalogued providers but their callback runtimes are still not implemented. The key boundary still holds: Heimdall owns auth/control-plane authority and credential custody; app-domain bindings and runtime behavior remain app-owned.
next_action: Run the real browser OAuth flow end to end from `https://repixelizer.gamecult.org/app/` with a Discord account that has the `KLTST` role, confirm Heimdall receives the Discord callback, confirms guild role entitlement, delivers the backend callback to Repixelizer, Repixelizer adopts a local httpOnly session, and hosted/queue routes are gated correctly. The public OAuth start URL should request only `identify guilds.members.read`.
next_action: Run the real browser OAuth flow end to end from `https://repixelizer.gamecult.org/app/` with a Discord account that has the `KLTST` role or the Patreon-synced `Inner Sanctum` role, confirm Heimdall receives the Discord callback, confirms guild role entitlement, delivers the backend callback to Repixelizer, Repixelizer adopts a local httpOnly session, and hosted/queue routes are gated correctly. The public OAuth start URL should request only `identify guilds.members.read`.