celilo/tango-dj
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add the dj-live app server: sessions, passcodes, guest sign-in #36

Merged
forgejo-admin merged 1 commit from feature/live-app-server into main 2026-09-28 06:18:43 +00:00
Conversation 0 Commits 1 Files changed 16 +651 -1
forgejo-admin commented 2026-09-28 06:18:02 +00:00
Owner
Copy link

Problem

Guests need to follow a set and make requests without ever reaching the DJ console. The console has no auth and drives live playback (see docs/adr/0001). Nothing public exists yet to hold online sessions.

Solution

A standalone tRPC app server under app/server/, run with bun run live:

  • Sessions: a DJ in the incarnadine-djs group opens an online session for a set with a passcode, and can close it. Passcodes are single-use across all sessions. Going online again for the same set with the same passcode reopens that set's session.
  • Guests: a guest signs in with a handle and the passcode and gets a guest token that never expires. Handles are unique per session, ignoring case and surrounding spaces. Ended sessions still admit guests so they can read the history.
  • Auth: DJ tokens are verified against the IdP's JWKS. verifyCaller never throws, and anything it can't verify is treated as anonymous. Authentik doesn't restrict login by group, so the group check here is the only gate. AUTH_MODE=test accepts self-signed DJ tokens so tests need no IdP.
  • Passcode storage: passcodes are stored as an HMAC keyed by the server secret. A unique database constraint enforces single use, and sign-in is an indexed lookup.
  • Serving: HTTP and WebSocket tRPC at /live/trpc and a health check at /live/health share one port, via trpc-bun-adapter.
  • New dependencies: trpc-bun-adapter, jose and zod, matching lunacycle's versions.

This is Slice 1 of projects/2026-09-27-dj-online-companion/plan.md.

Testing

  • bun test app/server: 26 pass. That covers the database constraints, auth, events and the full session lifecycle, plus one test against a real Bun.serve that checks health, the DJ opening a session and the guest signing in.
  • bun test: 131 pass, and bun run check is clean.
  • Smoke run: AUTH_MODE=test GUEST_TOKEN_SECRET=… bun run live, then curl /live/health returns ok.

🤖 Generated with Claude Code

## Problem Guests need to follow a set and make requests without ever reaching the DJ console. The console has no auth and drives live playback (see `docs/adr/0001`). Nothing public exists yet to hold online sessions. ## Solution A standalone tRPC app server under `app/server/`, run with `bun run live`: - **Sessions:** a DJ in the `incarnadine-djs` group opens an online session for a set with a passcode, and can close it. Passcodes are single-use across all sessions. Going online again for the same set with the same passcode reopens that set's session. - **Guests:** a guest signs in with a handle and the passcode and gets a guest token that never expires. Handles are unique per session, ignoring case and surrounding spaces. Ended sessions still admit guests so they can read the history. - **Auth:** DJ tokens are verified against the IdP's JWKS. `verifyCaller` never throws, and anything it can't verify is treated as anonymous. Authentik doesn't restrict login by group, so the group check here is the only gate. `AUTH_MODE=test` accepts self-signed DJ tokens so tests need no IdP. - **Passcode storage:** passcodes are stored as an HMAC keyed by the server secret. A unique database constraint enforces single use, and sign-in is an indexed lookup. - **Serving:** HTTP and WebSocket tRPC at `/live/trpc` and a health check at `/live/health` share one port, via `trpc-bun-adapter`. - **New dependencies:** `trpc-bun-adapter`, `jose` and `zod`, matching lunacycle's versions. This is Slice 1 of `projects/2026-09-27-dj-online-companion/plan.md`. ## Testing - `bun test app/server`: 26 pass. That covers the database constraints, auth, events and the full session lifecycle, plus one test against a real `Bun.serve` that checks health, the DJ opening a session and the guest signing in. - `bun test`: 131 pass, and `bun run check` is clean. - Smoke run: `AUTH_MODE=test GUEST_TOKEN_SECRET=… bun run live`, then `curl /live/health` returns `ok`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
forgejo-admin force-pushed feature/live-app-server from 092fd1235b to 0ce95d02c4 2026-09-28 06:18:39 +00:00 Compare
forgejo-admin deleted branch feature/live-app-server 2026-09-28 06:18:43 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
celilo/tango-dj!36
No description provided.