@acms-subir/core 0.3.29 → 0.3.30

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @acms-subir/core
 
+## 0.3.30
+
+### Patch Changes
+
+- aeaed2c: YouTube **Authorize** (Integrations → Live video) now finishes on sites that use a Clerk development instance. Before, Google's redirect back to `/api/live/oauth/youtube/callback` was always signed out there: development instances set `__client_uat` as `SameSite=Strict`, so the browser drops it from the cross-site return, Clerk answers with a handshake, and the page showed "YouTube authorization didn't finish". The same thing could happen on production when the owner spent more than about a minute on Google's screens and the session token lapsed.
+
+  The callback no longer checks the sign-in. It attaches Google's code, encrypted, to its one-use pending state for up to two minutes. Only the first return counts. It then sends the owner to `/admin/live?live=finish`, where a lapsed sign-in renews like on any admin page. That page finishes with a same-origin request (the new `finishAuthorize` action on `/api/live/settings`, gated like every other owner action), and only the session that started authorization can finish it. The code never appears in a URL again, and nothing changes in Google's setup: the redirect URI is the same. No migration.
+
 ## 0.3.29
 
 ### Patch Changes

package/docs/live-video.md

@@ -28,7 +28,7 @@ ACMS obtains an app token with the client-credentials flow and checks Get Stream
 4. Save the Client ID and Client Secret in ACMS, then choose **Authorize YouTube**. Approve YouTube read-only access using the correct Google/Brand channel identity.
 5. Confirm the available channel, test, and turn the connection on. Selecting another channel requires a new test. A typed channel ID cannot override the authorized identity.
 
-The authorization-code flow uses session-bound, one-use state and PKCE. Access/refresh tokens stay encrypted on the server. ACMS lists active broadcasts, filters to the selected channel and public `live` broadcasts, and checks public video visibility/embedding permission. Private, unlisted and test broadcasts are excluded. Multiple current broadcasts use the latest actual start time with a stable ID tie-break. See [liveBroadcasts.list](https://developers.google.com/youtube/v3/live/docs/liveBroadcasts/list) and [server OAuth](https://developers.google.com/identity/protocols/oauth2/web-server).
+The authorization-code flow uses session-bound, one-use state and PKCE. Google's redirect back is a cross-site request that may arrive without a usable sign-in (a Clerk development instance withholds its `SameSite=Strict` cookie, and a session token can lapse while the owner is on Google's screens). It doesn't need one: it only attaches the code, encrypted, to its pending state for up to two minutes, then sends the owner to `/admin/live?live=finish`. That page finishes with a same-origin request from the signed-in session that began authorization; no other session can finish it, and the code never appears in a URL again. Access/refresh tokens stay encrypted on the server. ACMS lists active broadcasts, filters to the selected channel and public `live` broadcasts, and checks public video visibility/embedding permission. Private, unlisted and test broadcasts are excluded. Multiple current broadcasts use the latest actual start time with a stable ID tie-break. See [liveBroadcasts.list](https://developers.google.com/youtube/v3/live/docs/liveBroadcasts/list) and [server OAuth](https://developers.google.com/identity/protocols/oauth2/web-server).
 
 External OAuth apps left in **Testing** receive refresh tokens for YouTube scopes that expire after seven days. The UI's Testing/Production choice is owner-reported; ACMS cannot verify the app's publishing status. Follow Google's applicable publishing and verification requirements before relying on a long-running connection. A revoked or expired grant requires reauthorization. See [Google token expiration](https://developers.google.com/identity/protocols/oauth2#expiration).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.29",
+  "version": "0.3.30",
   "publishConfig": {
     "access": "public"
   },

package/src/components/LiveManager.tsx

@@ -167,11 +167,23 @@ export default function LiveManager() {
     }
   }
 
+  // Google sent the owner back (?live=finish): the callback parked the code; finish it with this
+  // signed-in session (a same-origin POST, so a lapsed sign-in renews on this page first)
+  async function finishAuthorize() {
+    try {
+      adopt(await api<LiveAdminState>({ action: 'finishAuthorize', provider: 'youtube' }));
+      setPageMsg({ ok: 'YouTube is authorized. Confirm your channel below, then test the connection.', err: '' });
+    } catch (e) {
+      setPageMsg({ ok: '', err: `YouTube authorization didn’t finish: ${errText(e)} Try Authorize again.` });
+      await load();
+    }
+  }
+
   useEffect(() => {
     const q = new URLSearchParams(location.search);
     const r = q.get('live');
-    if (r === 'connected') {
-      setPageMsg({ ok: 'YouTube is authorized. Confirm your channel below, then test the connection.', err: '' });
+    if (r === 'finish') {
+      setPageMsg({ ok: 'Finishing YouTube authorization…', err: '' });
     } else if (r === 'error') {
       setPageMsg({ ok: '', err: 'YouTube authorization didn’t finish. Check that the redirect URI in Google matches exactly, then try Authorize again.' });
     }
@@ -182,7 +194,7 @@ export default function LiveManager() {
       const qs = q.toString();
       history.replaceState(history.state, '', location.pathname + (qs ? `?${qs}` : '') + location.hash);
     }
-    void load();
+    void (r === 'finish' ? finishAuthorize() : load());
     const tick = setInterval(() => setNow(Date.now()), 30_000);
     return () => clearInterval(tick);
   }, []);

package/src/lib/live/service.ts

@@ -141,15 +141,32 @@ export async function beginOAuth(repo:ContentRepository,session:string,url:URL,l
   const params={client_id:conn.clientId,redirect_uri:callbackUrl,response_type:'code',scope:'https://www.googleapis.com/auth/youtube.readonly',access_type:'offline',prompt:'consent select_account',state,code_challenge:Buffer.from(hash(verifier),'hex').toString('base64url'),code_challenge_method:'S256'};
   Object.entries(params).forEach(([k,v])=>auth.searchParams.set(k,v));return auth.href;
 }
-export async function finishOAuth(repo:ContentRepository,session:string,url:URL,locals?:unknown) {
+type PendingOAuth={verifier:string;callbackUrl:string;code?:string};
+// Google sends the browser back with a cross-site GET, which often carries no usable sign-in: a
+// Clerk development instance withholds its SameSite=Strict cookie, and a session token can expire
+// while the owner is on Google's screens. So the callback only parks the code on its pending state
+// (found by the state value, which only Google's redirect carries); the signed-in admin page then
+// finishes it with a same-origin POST bound to the session that began it.
+export async function receiveOAuthCallback(repo:ContentRepository,url:URL,locals?:unknown) {
   const state=url.searchParams.get('state')??'';
   if(!/^[\w-]{43}$/.test(state))throw new ApiError(400,'Invalid OAuth state. Start authorization again.');
-  const stored=await repo.live.consumeState(hash(state),hash(session),Date.now());
-  const conn=await repo.live.get('youtube');
-  if(!stored||!conn||stored.revision!==conn.revision)throw new ApiError(400,'Authorization expired or the connection changed. Start again.');
   if(url.searchParams.has('error'))throw new ApiError(400,'YouTube authorization was not completed. Try again and approve read-only access.');
   const code=url.searchParams.get('code');if(!code||code.length>8192)throw new ApiError(400,'Missing authorization code.');
-  const {verifier,callbackUrl}=decrypt<{verifier:string;callbackUrl:string}>(stored.encrypted,'oauth',locals);
+  const now=Date.now(),stored=await repo.live.pendingState(hash(state),now);
+  if(!stored)throw new ApiError(400,'Authorization expired. Start again.');
+  const pending=decrypt<PendingOAuth>(stored.encrypted,'oauth',locals);
+  if(pending.code)throw new ApiError(409,'This authorization already came back. Start again.');
+  if(new URL(pending.callbackUrl).origin!==url.origin)throw new ApiError(400,'The callback origin does not match the saved site.');
+  // the admin page finishes within seconds; a parked code doesn't wait around
+  if(!await repo.live.attachCode(hash(state),stored.encrypted,encrypt({...pending,code},'oauth',locals),Math.min(stored.expiresAt,now+120_000),now))throw new ApiError(409,'This authorization already came back. Start again.');
+}
+/** Exchanges the parked code for tokens. `url` is the signed-in admin request (same origin as the callback). */
+export async function finishOAuth(repo:ContentRepository,session:string,url:URL,locals?:unknown) {
+  const rows=session?await repo.live.consumeSessionStates(hash(session),Date.now()):[];
+  const stored=rows.map(r=>({...r,...decrypt<PendingOAuth>(r.encrypted,'oauth',locals)})).find(r=>r.code);
+  const conn=await repo.live.get('youtube');
+  if(!stored||!conn||stored.revision!==conn.revision)throw new ApiError(400,'Authorization expired or the connection changed. Start again.');
+  const {verifier,callbackUrl,code}=stored as Required<typeof stored>;
   if(new URL(callbackUrl).origin!==url.origin)throw new ApiError(400,'The callback origin does not match the saved site.');
   const old=decrypt<Credentials>(conn.encrypted,'youtube',locals);
   try{

package/src/lib/live/store.ts

@@ -40,9 +40,19 @@ export class LiveStore {
   async state(hash: string, sessionHash: string, revision: number, encrypted: string, expiresAt: number) {
     await (await this.driver()).batch([{sql:'DELETE FROM live_oauth_states WHERE expires_at<? OR session_hash=?',args:[Date.now(),sessionHash]}, {sql:'INSERT INTO live_oauth_states (hash,session_hash,revision,encrypted,expires_at) VALUES (?,?,?,?,?)',args:[hash,sessionHash,revision,encrypted,expiresAt]}]);
   }
-  async consumeState(hash: string, sessionHash: string, now: number) {
-    const rows = await (await this.driver()).all('DELETE FROM live_oauth_states WHERE hash=? AND session_hash=? AND expires_at>? RETURNING revision,encrypted', [hash,sessionHash,now]);
-    return rows[0] ? {revision:Number(rows[0].revision),encrypted:String(rows[0].encrypted)} : null;
+  // Google's redirect finds its pending state by the state value alone (it often arrives without a
+  // usable sign-in); only the signed-in admin who began it can finish it (consumeSessionStates).
+  async pendingState(hash: string, now: number) {
+    const rows = await (await this.driver()).all('SELECT encrypted,expires_at FROM live_oauth_states WHERE hash=? AND expires_at>?', [hash,now]);
+    return rows[0] ? {encrypted:String(rows[0].encrypted),expiresAt:Number(rows[0].expires_at)} : null;
+  }
+  /** Swaps in the payload with Google's code. Compare-and-swap on the old ciphertext: only the first callback counts. */
+  async attachCode(hash: string, before: string, after: string, expiresAt: number, now: number) {
+    return (await (await this.driver()).all('UPDATE live_oauth_states SET encrypted=?,expires_at=? WHERE hash=? AND encrypted=? AND expires_at>? RETURNING hash', [after,expiresAt,hash,before,now])).length > 0;
+  }
+  async consumeSessionStates(sessionHash: string, now: number) {
+    const rows = await (await this.driver()).all('DELETE FROM live_oauth_states WHERE session_hash=? AND expires_at>? RETURNING revision,encrypted', [sessionHash,now]);
+    return rows.map(r => ({revision:Number(r.revision),encrypted:String(r.encrypted)}));
   }
   async heartbeat(now: number) { await (await this.driver()).run('UPDATE live_health SET last_at=? WHERE id=1',[now]); }
   async lastHeartbeat() { return Number((await (await this.driver()).all('SELECT last_at FROM live_health WHERE id=1'))[0]?.last_at ?? 0); }

package/src/pages/api/live/oauth/youtube/callback.ts

@@ -1,18 +1,15 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../../../../lib/repo';
-import { ApiError } from '../../../../../lib/api';
-import { requestSessionBinding } from '../../../../../lib/auth/request';
-import { accessFor } from '../../../../../lib/permissions/access';
-import { finishOAuth } from '../../../../../lib/live/service';
-export const GET:APIRoute=async({request,cookies,locals,url})=>{
+import { receiveOAuthCallback } from '../../../../../lib/live/service';
+// Google's redirect back is a cross-site GET that may carry no usable sign-in (Clerk development
+// instances, a session token that expired on Google's screens), so it doesn't check one: it parks
+// the code on its one-use pending state, and the signed-in admin page finishes with a same-origin
+// POST (finishAuthorize) bound to the session that began it. The code never enters a URL again.
+export const GET:APIRoute=async({locals,url})=>{
   const headers={'Cache-Control':'no-store','Referrer-Policy':'no-referrer'};
   try{
-    const repo=await getRepo(locals),session=await requestSessionBinding(request,cookies,locals);
-    // OAuth is intentionally a cross-site GET. Session-bound, one-use state provides CSRF protection.
-    const access=await accessFor(request,cookies,repo);
-    if(!session||!access?.can('services.manage'))throw new ApiError(403,'Sign in as someone who manages connected services and start authorization again.');
-    await finishOAuth(repo,session,url,locals);
-    return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=connected'}});
+    await receiveOAuthCallback(await getRepo(locals),url,locals);
+    return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=finish'}});
   }catch{
     // Never reflect callback codes, tokens or provider error bodies into an HTML page or URL.
     return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=error'}});

package/src/pages/api/live/settings.ts

@@ -4,7 +4,7 @@ import { getRepo } from '../../../lib/repo';
 import { ApiError, apiError, json, readJson } from '../../../lib/api';
 import { requestSessionBinding } from '../../../lib/auth/request';
 import { Provider } from '../../../lib/live/types';
-import { adminState, beginOAuth, disconnect, saveConnection, syncConnection, validateConfig } from '../../../lib/live/service';
+import { adminState, beginOAuth, disconnect, finishOAuth, saveConnection, syncConnection, validateConfig } from '../../../lib/live/service';
 import { requirePermission } from '../../../lib/permissions/access';
 import { sendManualLiveNotice } from '../../../lib/push/service';
 const Input=z.discriminatedUnion('action',[
@@ -13,6 +13,8 @@ const Input=z.discriminatedUnion('action',[
   z.object({action:z.literal('selectChannel'),provider:z.literal('youtube'),channelId:z.string().min(1).max(200)}).strict(),
   z.object({action:z.literal('enable'),provider:Provider,enabled:z.boolean()}).strict(),
   z.object({action:z.literal('authorize'),provider:z.literal('youtube')}).strict(),
+  // after Google's redirect (?live=finish): exchange the parked code for this signed-in session
+  z.object({action:z.literal('finishAuthorize'),provider:z.literal('youtube')}).strict(),
   z.object({action:z.literal('disconnect'),provider:Provider}).strict(),
   // notify: "Notify app users" on a manual link (sends once per link; needs push)
   z.object({action:z.literal('saveConfig'),config:z.unknown(),notify:z.boolean().default(false)}).strict(),
@@ -30,6 +32,7 @@ export const POST:APIRoute=async({request,cookies,locals,url})=>{
       case 'saveConnection':await saveConnection(repo,input,locals);break;
       case 'test':await syncConnection(repo,input.provider,locals,true);break;
       case 'authorize':return json({authorizationUrl:await beginOAuth(repo,await requestSessionBinding(request,cookies,locals),url,locals)});
+      case 'finishAuthorize':await finishOAuth(repo,await requestSessionBinding(request,cookies,locals),url,locals);break;
       case 'disconnect':await disconnect(repo,input.provider,locals);break;
       case 'saveConfig':{
         await repo.updateSettings({live:validateConfig(input.config)});