Crazy Carrot Studios
ADMIN PORTALPrivate studio management
STAGING
CCS / PRIVATE MANAGEMENT / STAGING

STUDIO ADMIN PORTAL

Secure management starts with verified identity and provider connections. Cloudflare Access guards this custom domain; studio Gmail, Calendar, Drive and YouTube permissions are independently authorized.

Checking protected sessionAuthenticating this browser with the server…
STUDIO GMAIL / MAIL MANAGEMENT

GMAIL DASHBOARD

Recent messages from the authorized studio Gmail account. Viewing a message here does not mark it read. HTML and attachments are not rendered.

Verifying studio connection…

SERVICE CONNECTIONS

CONNECTIONS & RECOVERY

SERVER VERIFIED ONLY

Services are unavailable until a backend check confirms valid studio authorization. Expired connections will offer one secure Google reconnection flow when configured.

Google identityChecking

Cloudflare Access login and backend JWT verification.

Studio Google accountNot checked

Studio Gmail messages and owner-confirmed actions. Calendar and Drive require separate scope approval; YouTube uses a different Google account.

Loading verified connection status.
YouTube — separate Google accountNot connected

Separate Google authorization and channel identity verification will be required. This account is not the CCS studio Gmail.

PatreonNot connected

Member activity and studio revenue. Independent approval required.

Cloudflare R2Not verified

Private studio assets and usage tracking.

Repair All Connections

One owner action will refresh eligible service tokens and present any necessary provider sign-ins. It must not bypass consent or create new permissions.

TRUST & AUTHORIZATION

SECURITY STATUS

  • Cloudflare Access: owner-only Google policy registered for this staging hostname.
  • Application identity: requires a cryptographically verified Access JWT before returning private user details.
  • Public Pages preview: no private data or secrets, and server endpoints must independently reject unauthorized requests.
  • Studio Gmail OAuth tokens are encrypted in D1; message listing, plain-text viewing, and confirmation-gated actions are owner-only.
  • YouTube: different Google account; no YouTube authorization has been granted through this connection.
DEPLOYMENT MILESTONES

BUILD PROGRESS

  • Complete: CCS Google Access identity provider, owner policy, private custom domain, isolated Pages preview.
  • Verified: owner JWT, studio Gmail OAuth connection, encrypted token persistence and provider identity.
  • Implemented: Gmail filters, custom folders, archive, Trash restore, read/unread actions, and owner-confirmed message management.
  • Next: live-test new Gmail controls, verify recovery flows, and authorize YouTube, Calendar, and Drive separately.
OWNER / HEALTH CHECK

DATABASE HEALTH

Not checked in this session.

OWNER / AUDIT HISTORY

RECENT ACTIONS

Recent logged portal operations. Read-only display; no message content or OAuth secrets.

History has not been loaded.