GameCult/Heimdall
Watch
9
0
Fork
You've already forked Heimdall
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Clarify Repixelizer Discord role policy

Browse source
This commit is contained in:
Meta Vens 2026-04-29 11:54:01 +01:00
commit ccc713b911
5 changed files with 11 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/implementation-plan.md
View file

@ -79,7 +79,7 @@ Goals:
- configure the Discord OAuth app redirect URI to
`https://heimdall.gamecult.org/v1/oauth/discord/callback`
- configure Heimdall's Discord client credentials, Repixelizer guild id, and
allowed role ids
the Cultist role id in `GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS`
- configure Repixelizer for `GC_ACCESS_MODE=heimdall` and
`GC_ACCESS_ALLOWED_PROVIDERS=discord`
- run the live browser OAuth flow and confirm Repixelizer receives the backend
@ -90,8 +90,8 @@ Current Discord policy:
- Heimdall grants Repixelizer `entitlement.app_access` only when the Discord
member has one of the configured allowed role ids
- if launch policy should be "any member of the GameCult Discord," change the
Discord entitlement rule before deploying
- launch policy is intentionally role-gated: the GameCult Discord can remain
public, but Repixelizer access is limited to members with the Cultist role
### 4. Migrate StreamPixels without flattening its good local seams

4
docs/service-contract.md
View file

@ -476,5 +476,5 @@ Deploy and verify the hardened slice in the first real app binding:
- confirm direct backend callback delivery to Repixelizer
- confirm Repixelizer verifies the Heimdall access token locally and gates
hosted routes from the adopted session
- decide whether Repixelizer launch policy is role-gated Discord access or any
guild member access before deployment
- configure Repixelizer access as role-gated Discord access: the GameCult guild
may be public, but the allowed role list should contain the Cultist role id

8
notes/fresh-workspace-handoff.md
View file

@ -91,16 +91,16 @@ Repixelizer launch path:
- configure the Discord OAuth app redirect URI as
`https://heimdall.gamecult.org/v1/oauth/discord/callback`
- configure Heimdall with Discord client id/secret, Repixelizer guild id,
allowed role ids, Postgres storage, token encryption, and stable signing keys
the Cultist role id in `GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS`,
Postgres storage, token encryption, and stable signing keys
- configure Repixelizer to use `GC_ACCESS_MODE=heimdall` and
`GC_ACCESS_ALLOWED_PROVIDERS=discord`
- run the real browser OAuth flow end to end and confirm Repixelizer receives
the backend callback, verifies the token, adopts a local session, and gates
hosted routes
Important wrinkle: Heimdall currently grants Repixelizer access from Discord
role matches, not bare guild membership. If launch policy is "any GameCult
Discord member can enter," update the Discord entitlement rule before deploy.
Launch policy is role-gated on purpose: the GameCult Discord can remain public,
but Repixelizer access is limited to members with the Cultist role.
## Immediate Re-entry Instruction

1
state/evidence.jsonl
View file

@ -10,3 +10,4 @@
{"ts": "2026-04-26T15:22:58+00:00", "type": "implementation", "status": "accepted", "note": "Heimdall now supports file-backed signing-key loading/bootstrap, AES-256-GCM token sealing for managed provider credentials at rest, and a local JWT verifier seam in src/verifier.ts; the next move shifts from custody hardening to the first real Repixelizer consumer integration."}
{"ts": "2026-04-26T16:00:35+00:00", "type": "design", "status": "accepted", "note": "Heimdall now supports direct backend callback delivery as the preferred same-host or Yggdrasil-reachable app handoff path; the browser completion-code redeem flow remains as fallback, not the primary consumer contract."}
{"ts": "2026-04-29T10:51:08+00:00", "type": "design", "status": "accepted", "note": "Repixelizer has consumed Heimdall's direct backend callback flow locally, so Heimdall is no longer blocked on Repixelizer auth refactoring. The next Heimdall objective is Discord-only live launch configuration and end-to-end OAuth verification on Yggdrasil; other providers remain catalogued but callback runtimes are not implemented yet."}
{"ts": "2026-04-29T10:53:44+00:00", "type": "design", "status": "accepted", "note": "Repixelizer Discord launch policy is intentionally role-gated: the GameCult guild can remain public, but Heimdall should grant Repixelizer app access only to members with the Cultist role configured in GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS."}

2
state/map.yaml
View file

@ -94,4 +94,4 @@ rejected_paths:
current_status:
summary: Heimdall has a hardened first provider slice plus a direct app-backend handoff path: TypeScript/Fastify runtime, Ed25519 JWT signing with file-backed key support, JWKS/discovery exposure, signed OAuth start-state handling, durable auth/control-plane persistence, a real Discord callback path, AES-256-GCM token sealing for managed provider credentials at rest, a local JWT verifier seam for app backends, direct backend callback delivery for same-host consumers, and the older one-time completion-code exchange retained as fallback. Repixelizer has now consumed that flow locally in its hosted web layer, so Heimdall is no longer blocked on Repixelizer refactoring. The live launch path should start Discord-only; Patreon, GitHub, Twitch, and YouTube are catalogued providers but their callback runtimes are still not implemented. The key boundary still holds: Heimdall owns auth/control-plane authority and credential custody; app-domain bindings and runtime behavior remain app-owned.
next_action: Prepare and verify the live Discord-only Repixelizer launch on Yggdrasil: configure the Discord OAuth app redirect to `https://heimdall.gamecult.org/v1/oauth/discord/callback`, set Heimdall env for Discord client credentials, Repixelizer guild/allowed role ids, Postgres storage, token encryption, and stable signing keys, set Repixelizer to `GC_ACCESS_ALLOWED_PROVIDERS=discord`, then run the real browser OAuth flow end to end. If access should allow any guild member rather than specific role ids, change Heimdall's Discord entitlement rule before deployment.
next_action: Prepare and verify the live Discord-only Repixelizer launch on Yggdrasil: configure the Discord OAuth app redirect to `https://heimdall.gamecult.org/v1/oauth/discord/callback`, set Heimdall env for Discord client credentials, Repixelizer guild id, the Cultist role id in `GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS`, Postgres storage, token encryption, and stable signing keys, set Repixelizer to `GC_ACCESS_ALLOWED_PROVIDERS=discord`, then run the real browser OAuth flow end to end. The GameCult guild can remain public; Repixelizer access is intentionally limited to members with the Cultist role.