Move admin connection and backfill UI into the plugin settings page #5

Merged

troed merged 16 commits from admin-plugin-rework into main

2026-08-07 22:09:57 +02:00

troed commented

2026-08-07 22:09:22 +02:00

Owner

Summary

Fixes the 403 on direct navigation to the backfill / OAuth pages: PeerTube only authenticates plugin router requests carrying an Authorization header, so plain browser navigation always failed the admin gate.
Moved the admin UI (YouTube connect + status + backfill) into the admin panel Plugins → peertube-plugin-peeryou → Settings page via a new client script (scope admin-plugin) that fetches the plugin router with getAuthHeader().
Converted /backfill and the OAuth endpoints to authenticated JSON APIs; OAuth connect now uses the state parameter (a random single-use nonce) to carry the admin user id back through the Google redirect.
Hardenings: connection-displacement guard (a different user can no longer re-point the instance's YouTube target), nonce-based OAuth state, validated backfill video ids.

Test Plan

16 suites / 112 tests pass
npm run build emits both client bundles
npm pack ships both dist bundles + all src at version 0.1.3
After merge: tag v0.1.3, reinstall plugin, verify Connect + Backfill work in the settings page

## Summary - Fixes the 403 on direct navigation to the backfill / OAuth pages: PeerTube only authenticates plugin router requests carrying an Authorization header, so plain browser navigation always failed the admin gate. - Moved the admin UI (YouTube connect + status + backfill) into the admin panel **Plugins → peertube-plugin-peeryou → Settings** page via a new client script (scope `admin-plugin`) that fetches the plugin router with `getAuthHeader()`. - Converted `/backfill` and the OAuth endpoints to authenticated JSON APIs; OAuth connect now uses the `state` parameter (a random single-use nonce) to carry the admin user id back through the Google redirect. - Hardenings: connection-displacement guard (a different user can no longer re-point the instance's YouTube target), nonce-based OAuth state, validated backfill video ids. ## Test Plan - [x] 16 suites / 112 tests pass - [x] npm run build emits both client bundles - [x] npm pack ships both dist bundles + all src at version 0.1.3 - [ ] After merge: tag v0.1.3, reinstall plugin, verify Connect + Backfill work in the settings page

troed added 16 commits

2026-08-07 22:09:22 +02:00