CCS / PRIVATE MANAGEMENT / STAGING

STUDIO ADMIN PORTAL

Secure management starts with verified identity and provider connections. Cloudflare Access guards this custom domain; studio Gmail, Calendar, Drive and YouTube permissions are independently authorized.

Checking protected sessionAuthenticating this browser with the server…

STUDIO INBOX / READ ONLY

GMAIL DASHBOARD

Recent messages from the authorized studio Gmail account. Viewing a message here does not mark it read. HTML and attachments are not rendered.

Verifying studio connection…

SERVICE CONNECTIONS

CONNECTIONS & RECOVERY

SERVER VERIFIED ONLY

Services are unavailable until a backend check confirms valid studio authorization. Expired connections will offer one secure Google reconnection flow when configured.

Google identityChecking

Cloudflare Access login and backend JWT verification.

Studio Google accountNot checked

Studio Gmail read-only connection. Calendar and Drive require separate scope approval; YouTube is on a different Google account.

Loading verified connection status.

YouTube — separate Google accountNot connected

Separate Google authorization and channel identity verification will be required. This account is not the CCS studio Gmail.

PatreonNot connected

Member activity and studio revenue. Independent approval required.

Cloudflare R2Not verified

Private studio assets and usage tracking.

Repair All Connections

One owner action will refresh eligible service tokens and present any necessary provider sign-ins. It must not bypass consent or create new permissions.

TRUST & AUTHORIZATION

SECURITY STATUS

Cloudflare Access: owner-only Google policy registered for this staging hostname.
Application identity: requires a cryptographically verified Access JWT before returning private user details.
Public Pages preview: no private data or secrets, and server endpoints must independently reject unauthorized requests.
Studio Gmail OAuth: read-only grant saved with encrypted refresh token in D1; live renewal verified. Message list and plain-text viewer are owner-only.
YouTube: different Google account; no YouTube authorization has been granted through this connection.

DEPLOYMENT MILESTONES

BUILD PROGRESS

Complete: CCS Google Access identity provider, owner policy, private custom domain, isolated Pages preview.
Verified: owner JWT, Gmail read-only OAuth callback, encrypted token persistence and provider identity.
Ready for owner test: protected manual Gmail refresh check.
Next: validate refresh in the authenticated browser, implement revocation recovery and separate YouTube account authorization.