Crazy Carrot Studios
ADMIN PORTALPrivate studio management
STAGING
CCS / PRIVATE MANAGEMENT / STAGING

STUDIO ADMIN PORTAL

Secure management starts with verified identity and provider connections. Cloudflare Access guards this custom domain; studio Gmail, Calendar, Drive and YouTube permissions are independently authorized.

Checking protected sessionAuthenticating this browser with the server…
STUDIO GMAIL / MAIL MANAGEMENT

STUDIO MAILBOX

← Back to Gmail Cockpit

Recent messages from the authorized studio Gmail account. Viewing a message here does not mark it read. HTML and attachments are not rendered.

Verifying studio connection…

SERVICE CONNECTIONS

CONNECTIONS & RECOVERY

← Back to Connections Cockpit
SERVER VERIFIED ONLY

Services are unavailable until a backend check confirms valid studio authorization. Expired connections will offer one secure Google reconnection flow when configured.

Google identityChecking

Cloudflare Access login and backend JWT verification.

Studio Google accountNot checked

Studio Gmail messages and owner-confirmed actions. Calendar and Drive require separate scope approval; YouTube uses a different Google account.

Loading verified connection status.
YouTube — separate Google accountNot connected

Separate Google authorization and channel identity verification will be required. This account is not the CCS studio Gmail.

PatreonNot connected

Member activity and studio revenue. Independent approval required.

Cloudflare R2Not verified

Private studio assets and usage tracking.

Repair All Connections

One owner action will refresh eligible service tokens and present any necessary provider sign-ins. It must not bypass consent or create new permissions.

TRUST & AUTHORIZATION

SECURITY STATUS

← Back to Security Cockpit
  • Cloudflare Access: owner-only Google policy registered for this staging hostname.
  • Application identity: requires a cryptographically verified Access JWT before returning private user details.
  • Public Pages preview: no private data or secrets, and server endpoints must independently reject unauthorized requests.
  • Studio Gmail OAuth tokens are encrypted in D1; message listing, plain-text viewing, and confirmation-gated actions are owner-only.
  • YouTube: different Google account; no YouTube authorization has been granted through this connection.
DEPLOYMENT MILESTONES

BUILD PROGRESS

← Back to Build Cockpit
  • Complete: CCS Google Access identity provider, owner policy, private custom domain, isolated Pages preview.
  • Verified: owner JWT, studio Gmail OAuth connection, encrypted token persistence and provider identity.
  • Implemented: Gmail filters, custom folders, archive, Trash restore, read/unread actions, and owner-confirmed message management.
  • Next: live-test new Gmail controls, verify recovery flows, and authorize YouTube, Calendar, and Drive separately.
OWNER / PLANNED NOTIFICATIONS

INCIDENT CENTER

← Back to Incident Cockpit

Incident status and acknowledgement controls. Notification delivery and team access remain disabled until authorization is verified.

No escalation timer preview loaded; delivery disabled.

Incident data not loaded.

Notification preferences (owner-editable; delivery disabled)

Settings not checked. No delivery is enabled.

Default settings: Email ON · Push ON · SMS OFF · Critical ON. Unresolved incidents: 30-minute follow-up, plus six-hour escalation policy. Preferences can be saved, but no alerts are being sent.

Load saved preferences to enable editing. Delivery remains disabled.

Team roster (read-only, access disabled)

No roster loaded.

Prepare disabled team member (no invitation)

Saving a draft does not grant access or send an invitation.

Draft permission override

Only disabled member drafts. This does not grant sign-in or application access.

No override saved.

Proposed team roles (not yet granting access)

Admin: management rights · Editor: preparation and editing rights · Viewer: read-only rights. Owner invitation and permission overrides require a verified access-management workflow.

OWNER / HEALTH CHECK

DATABASE HEALTH

← Back to Database Cockpit

Not checked in this session.

OWNER / AUDIT HISTORY

RECENT ACTIONS

← Back to Audit Cockpit

Recent logged portal operations. Read-only display; no message content or OAuth secrets.

History has not been loaded.