Crazy Carrot Studios
ADMIN PORTALPrivate studio management
STAGING
CCS / PRIVATE MANAGEMENT / STAGING

STUDIO ADMIN PORTAL

Secure management starts with verified identity and provider connections. Cloudflare Access guards this custom domain; studio Gmail, Calendar, Drive and YouTube permissions are independently authorized.

Checking protected sessionAuthenticating this browser with the server…
STUDIO GMAIL / MAIL MANAGEMENT

GMAIL DASHBOARD

Recent messages from the authorized studio Gmail account. Viewing a message here does not mark it read. HTML and attachments are not rendered.

Verifying studio connection…

SERVICE CONNECTIONS

CONNECTIONS & RECOVERY

SERVER VERIFIED ONLY

Services are unavailable until a backend check confirms valid studio authorization. Expired connections will offer one secure Google reconnection flow when configured.

Google identityChecking

Cloudflare Access login and backend JWT verification.

Studio Google accountNot checked

Studio Gmail messages and owner-confirmed actions. Calendar and Drive require separate scope approval; YouTube uses a different Google account.

Loading verified connection status.
YouTube — separate Google accountNot connected

Separate Google authorization and channel identity verification will be required. This account is not the CCS studio Gmail.

PatreonNot connected

Member activity and studio revenue. Independent approval required.

Cloudflare R2Not verified

Private studio assets and usage tracking.

Repair All Connections

One owner action will refresh eligible service tokens and present any necessary provider sign-ins. It must not bypass consent or create new permissions.

TRUST & AUTHORIZATION

SECURITY STATUS

  • Cloudflare Access: owner-only Google policy registered for this staging hostname.
  • Application identity: requires a cryptographically verified Access JWT before returning private user details.
  • Public Pages preview: no private data or secrets, and server endpoints must independently reject unauthorized requests.
  • Studio Gmail OAuth tokens are encrypted in D1; message listing, plain-text viewing, and confirmation-gated actions are owner-only.
  • YouTube: different Google account; no YouTube authorization has been granted through this connection.
DEPLOYMENT MILESTONES

BUILD PROGRESS

  • Complete: CCS Google Access identity provider, owner policy, private custom domain, isolated Pages preview.
  • Verified: owner JWT, Gmail read-only OAuth callback, encrypted token persistence and provider identity.
  • Ready for owner test: protected manual Gmail refresh check.
  • Next: validate refresh in the authenticated browser, implement revocation recovery and separate YouTube account authorization.