feat(routes-f): clip auto-tag, VOD playlist, rerun loop, stream cover

.claude/settings.json

@@ -0,0 +1,7 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm test *)"
+    ]
+  }
+}

.github/workflows/block-main-prs.yml

@@ -0,0 +1,46 @@
+name: Block PRs targeting main
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+    branches: [main]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  block:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login != 'davedumto'
+    steps:
+      - name: Comment and close PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const message = [
+              `Hi @${pr.user.login} — thanks for the contribution!`,
+              ``,
+              `This repo uses \`dev\` as the integration branch. PRs targeting \`main\` are not accepted.`,
+              ``,
+              `Please re-open this PR against \`dev\` instead. From your branch:`,
+              ``,
+              `1. Click **Edit** on this PR title area`,
+              `2. Change the base branch from \`main\` to \`dev\``,
+              ``,
+              `Or open a fresh PR from the GitHub UI with \`dev\` selected as the base.`,
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              body: message,
+            });
+
+            await github.rest.pulls.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.number,
+              state: 'closed',
+            });

.gitignore

@@ -48,3 +48,6 @@ package-lock.json
 dev
 bun.*
 bun.lock
+fix.md
+issue.md
+pr.md

.prettierignore

@@ -104,3 +104,6 @@ pnpm-lock.yaml
 # Generated files
 *.min.js
 *.min.css
+
+# TypeScript cache
+*.tsbuildinfo   

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "kiroAgent.configureMCP": "Disabled"
+}

app/[username]/watch/page.tsx

@@ -1,11 +1,12 @@
 "use client";
 
-import { use, useEffect, useState, useRef } from "react";
-import { notFound, useSearchParams } from "next/navigation";
+import { use, useCallback, useEffect, useState, useRef } from "react";
+import { notFound } from "next/navigation";
 import ViewStream from "@/components/stream/view-stream";
 import { ViewStreamSkeleton } from "@/components/skeletons/ViewStreamSkeleton";
+import AccessGate from "@/components/stream/AccessGate";
 import { toast } from "sonner";
-import PrivateStreamGate from "@/components/stream/private-stream-gate";
+import { useStellarWallet } from "@/contexts/stellar-wallet-context";
 
 interface PageProps {
   params: Promise<{ username: string }>;
@@ -24,26 +25,27 @@ interface UserData {
   follower_count: number;
   is_following: boolean;
   stellar_address: string | null;
+  is_password_protected: boolean;
+  stream_access_type: "public" | "password" | "subscription" | null;
+  subscription_price_usdc: number | null;
   latency_mode: string | null;
-  stream_privacy: string | null;
-}
-
-interface AccessInfo {
-  allowed: boolean;
-  reason: string | null;
 }
 
 const WatchPage = ({ params }: PageProps) => {
   const { username } = use(params);
-  const searchParams = useSearchParams();
-  const shareKey = searchParams?.get("key") ?? null;
+  const { publicKey, privyWallet } = useStellarWallet();
+  const viewerPublicKey = publicKey || privyWallet?.wallet || null;
   const [userData, setUserData] = useState<UserData | null>(null);
-  const [access, setAccess] = useState<AccessInfo | null>(null);
   const [loading, setLoading] = useState(true);
   const [notFound404, setNotFound404] = useState(false);
   const [isFollowing, setIsFollowing] = useState(false);
   const [followLoading, setFollowLoading] = useState(false);
   const [loggedInUsername, setLoggedInUsername] = useState<string | null>(null);
+  const [accessGranted, setAccessGranted] = useState(false);
+
+  const handleAccessGranted = useCallback(() => {
+    setAccessGranted(true);
+  }, []);
 
   // Viewer tracking: one unique ID per page visit
   const viewerSessionId = useRef<string | null>(null);
@@ -64,15 +66,10 @@ const WatchPage = ({ params }: PageProps) => {
           setLoading(true);
         }
 
-        const qs = new URLSearchParams();
-        if (loggedInUsername) {
-          qs.set("viewer_username", loggedInUsername);
-        }
-        if (shareKey) {
-          qs.set("key", shareKey);
-        }
-        qs.set("t", String(Date.now()));
-        const response = await fetch(`/api/users/${username}?${qs.toString()}`);
+        const viewerParam = loggedInUsername
+          ? `?viewer_username=${encodeURIComponent(loggedInUsername)}&t=${Date.now()}`
+          : `?t=${Date.now()}`;
+        const response = await fetch(`/api/users/${username}${viewerParam}`);
 
         if (response.status === 404) {
           setNotFound404(true);
@@ -88,7 +85,6 @@ const WatchPage = ({ params }: PageProps) => {
 
         const data = await response.json();
         setUserData(data.user);
-        setAccess(data.access ?? { allowed: true, reason: null });
         setIsFollowing(!!data.user.is_following);
       } catch (error) {
         console.error("Failed to fetch user data:", error);
@@ -106,7 +102,7 @@ const WatchPage = ({ params }: PageProps) => {
     fetchUserData();
     const interval = setInterval(fetchUserData, 5000);
     return () => clearInterval(interval);
-  }, [username, loggedInUsername, shareKey]);
+  }, [username, loggedInUsername]);
 
   // Register viewer once when stream goes live; guard against re-registration on every poll
   useEffect(() => {
@@ -220,14 +216,26 @@ const WatchPage = ({ params }: PageProps) => {
 
   const isOwner = loggedInUsername?.toLowerCase() === username.toLowerCase();
 
-  // Private stream + viewer not authorized: show gate instead of player
-  if (access && !access.allowed && !isOwner) {
+  // Show access gate if stream is password protected and viewer isn't the owner
+  const needsPassword =
+    userData.is_password_protected &&
+    userData.stream_access_type !== "subscription" &&
+    !isOwner &&
+    !accessGranted;
+  const needsSubscription =
+    userData.stream_access_type === "subscription" &&
+    !isOwner &&
+    !accessGranted;
+
+  if ((needsPassword || needsSubscription) && userData.mux_playback_id) {
     return (
-      <PrivateStreamGate
+      <AccessGate
+        playbackId={userData.mux_playback_id}
         username={username}
-        privacy={(userData.stream_privacy as any) || "unlisted"}
-        reason={access.reason}
-        avatar={userData.avatar}
+        onAccessGranted={handleAccessGranted}
+        accessType={needsSubscription ? "subscription" : "password"}
+        monthlyPrice={userData.subscription_price_usdc}
+        viewerPublicKey={viewerPublicKey}
       />
     );
   }
@@ -247,8 +255,6 @@ const WatchPage = ({ params }: PageProps) => {
     playbackId: userData.mux_playback_id,
     latencyMode: userData.latency_mode || "low",
     isLive: userData.is_live,
-    privacy: userData.stream_privacy || "public",
-    shareKey: shareKey,
   };
 
   return (

app/api/admin/feature-flags/route.ts

@@ -0,0 +1,82 @@
+import { NextRequest, NextResponse } from "next/server";
+import { sql } from "@vercel/postgres";
+import { verifySession } from "@/lib/auth/verify-session";
+import { isAdmin } from "@/lib/admin-auth";
+
+/**
+ * Admin-only CRUD for feature flags.
+ *
+ * GET    /api/admin/feature-flags          – list all flags
+ * POST   /api/admin/feature-flags          – create a flag
+ * PATCH  /api/admin/feature-flags          – update a flag (body: { key, ...fields })
+ * DELETE /api/admin/feature-flags?key=xxx  – delete a flag
+ */
+
+async function guardAdmin(req: NextRequest) {
+  const session = await verifySession(req);
+  if (!session.ok) return { ok: false as const, response: session.response };
+  if (!isAdmin(session.userId)) {
+    return {
+      ok: false as const,
+      response: NextResponse.json({ error: "Forbidden" }, { status: 403 }),
+    };
+  }
+  return { ok: true as const };
+}
+
+export async function GET(req: NextRequest) {
+  const guard = await guardAdmin(req);
+  if (!guard.ok) return guard.response;
+
+  const { rows } = await sql`SELECT * FROM feature_flags ORDER BY key`;
+  return NextResponse.json({ flags: rows });
+}
+
+export async function POST(req: NextRequest) {
+  const guard = await guardAdmin(req);
+  if (!guard.ok) return guard.response;
+
+  const { key, description, enabled = false, rollout_percentage = 0, allowed_user_ids = [] } = await req.json();
+  if (!key) return NextResponse.json({ error: "key is required" }, { status: 400 });
+
+  const { rows } = await sql`
+    INSERT INTO feature_flags (key, description, enabled, rollout_percentage, allowed_user_ids)
+    VALUES (${key}, ${description ?? null}, ${enabled}, ${rollout_percentage}, ${allowed_user_ids})
+    ON CONFLICT (key) DO NOTHING
+    RETURNING *
+  `;
+  if (!rows.length) return NextResponse.json({ error: "Flag already exists" }, { status: 409 });
+  return NextResponse.json({ flag: rows[0] }, { status: 201 });
+}
+
+export async function PATCH(req: NextRequest) {
+  const guard = await guardAdmin(req);
+  if (!guard.ok) return guard.response;
+
+  const { key, enabled, rollout_percentage, allowed_user_ids, description } = await req.json();
+  if (!key) return NextResponse.json({ error: "key is required" }, { status: 400 });
+
+  const { rows } = await sql`
+    UPDATE feature_flags SET
+      enabled             = COALESCE(${enabled ?? null}, enabled),
+      rollout_percentage  = COALESCE(${rollout_percentage ?? null}, rollout_percentage),
+      allowed_user_ids    = COALESCE(${allowed_user_ids ?? null}, allowed_user_ids),
+      description         = COALESCE(${description ?? null}, description),
+      updated_at          = CURRENT_TIMESTAMP
+    WHERE key = ${key}
+    RETURNING *
+  `;
+  if (!rows.length) return NextResponse.json({ error: "Flag not found" }, { status: 404 });
+  return NextResponse.json({ flag: rows[0] });
+}
+
+export async function DELETE(req: NextRequest) {
+  const guard = await guardAdmin(req);
+  if (!guard.ok) return guard.response;
+
+  const key = new URL(req.url).searchParams.get("key");
+  if (!key) return NextResponse.json({ error: "key is required" }, { status: 400 });
+
+  await sql`DELETE FROM feature_flags WHERE key = ${key}`;
+  return NextResponse.json({ ok: true });
+}

app/api/auth/session/route.ts

@@ -3,6 +3,7 @@ import { PrivyClient } from "@privy-io/server-auth";
 import { sql } from "@vercel/postgres";
 import { createRateLimiter } from "@/lib/rate-limit";
 import { getRandomProfileIcon } from "@/lib/profile-icons";
+import { createSession } from "@/lib/sessions/user-sessions";
 
 // 10 Privy session exchanges per IP per 60 s
 const isRateLimited = createRateLimiter(60_000, 10);
@@ -131,8 +132,10 @@ export async function POST(req: NextRequest) {
     //    We store the privy_id (opaque, server-verified) — never the raw JWT
     const isProduction = process.env.NODE_ENV === "production";
     const cookieMaxAge = 24 * 60 * 60; // 24 h in seconds
+    // The raw token for a Privy session is the privy_id itself
+    const rawToken = privyUserId;
     const cookieValue = [
-      `privy_session=${privyUserId}`,
+      `privy_session=${rawToken}`,
       `Path=/`,
       `Max-Age=${cookieMaxAge}`,
       `HttpOnly`,
@@ -157,6 +160,21 @@ export async function POST(req: NextRequest) {
     });
 
     res.headers.set("Set-Cookie", cookieValue);
+
+    // Record the session in user_sessions (fire-and-forget — don't block the response)
+    createSession({
+      userId: dbUser.id,
+      rawToken,
+      ipAddress:
+        req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
+        req.headers.get("x-real-ip") ??
+        null,
+      userAgent: req.headers.get("user-agent") ?? null,
+      ttlSeconds: cookieMaxAge,
+    }).catch((err) =>
+      console.error("[session] Failed to record user_session row:", err)
+    );
+
     return res;
   } catch (err) {
     console.error("[session] DB error:", err);

app/api/auth/wallet-session/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { sql } from "@vercel/postgres";
 import { signToken } from "@/lib/auth/sign-token";
 import { createRateLimiter } from "@/lib/rate-limit";
+import { createSession } from "@/lib/sessions/user-sessions";
 
 const isRateLimited = createRateLimiter(60_000, 20); // 20 requests/min per IP
 
@@ -89,6 +90,20 @@ export async function POST(req: NextRequest) {
 
     const res = NextResponse.json({ ok: true });
     res.headers.set("Set-Cookie", cookieValue);
+
+    // Record the session in user_sessions (fire-and-forget)
+    // getIp() may return "unknown" — normalise to null so the INET cast doesn't fail
+    const rawIp = getIp(req);
+    createSession({
+      userId: u.id,
+      rawToken: token,
+      ipAddress: rawIp === "unknown" ? null : rawIp,
+      userAgent: req.headers.get("user-agent") ?? null,
+      ttlSeconds: COOKIE_MAX_AGE,
+    }).catch((err) =>
+      console.error("[wallet-session] Failed to record user_session row:", err)
+    );
+
     return res;
   } catch (err) {
     console.error("[wallet-session] DB error:", err);