nixamp.com as an OAuth 2.1 authorization server, and a watch party as a nixamp room

[ralyodio]

bittorrented.com has watch parties. nixamp has rooms, chat, invitations, a directory and five clients that can already open one. This makes them the same thing, with the identity link done by OAuth 2.1.

Which side is the authorization server

nixamp. It already keeps the accounts, the revocable tokens and the provider identities; bittorrented keeps none of those. src/oauth.ts stays what it was -- nixamp signing in with GitHub -- and the new src/oauth-server.ts is the other direction: somebody signing in with nixamp.

What "2.1" actually means here

The things OAuth 2.0 left optional are not optional:

• PKCE (S256) on every request, from every client, public or confidential. No plain.
• Exact redirect URI matching. The only thing allowed to vary is a loopback port (RFC 8252 §7.3), because a CLI cannot know its port before it listens. A prefix, a subdomain and a different path are all refused, and there is a test for each.
• A code is spent once. A second use is treated as theft: everything that code produced is withdrawn.
• Refresh tokens rotate. Each refresh answers a new one and retires the old; a retired one presented again withdraws the whole family, since the only way that happens is two parties holding one secret.
• No implicit grant, no password grant -- refused by name rather than shrugged at.
• RFC 8414 metadata at /.well-known/oauth-authorization-server.

Access tokens are nixamp's own nxa_ tokens with a client's name on them. That is what makes them revocable, and it is why every existing /api/v1 route understands one with no change at all.

An error that cannot be redirected is a page, not a bounce: sending a refusal to an unregistered redirect URI would make this an open redirector.

The bridge

src/watch-party.ts is deliberately thin. A bridged party is a live_events row like any other, plus one row saying which external party it is, where to watch it, and the second the host says everybody is at. That is what makes discovery, invitations, chat, layouts and /live/:slug work with no special case.

• Bridging is idempotent, because the client calls it every time somebody opens the party page.
• A watch link must be on the client's own site, read off the redirect URIs it registered rather than configured twice.
• Playback is advisory and cheap: the host writes it, a late joiner reads it and adds the drift. A paused film reports no drift, or every client would seek away from the frame everybody is looking at.

Surfaces

where	what
web	a Watch parties panel, and Connected apps in the Account panel with a Disconnect button
CLI	nixamp party list / join / host / sync / end
MCP	nixamp mcp -- a new stdio MCP server, JSON-RPC on a pipe, no dependency -- offering those same five as tools
desktop / TV	inherited: both run the same web build, so the panel is already there

The film never crosses over. What nixamp carries is the room.

Testing

bun test test web/test: 545 pass, 1 skip, 0 fail. bun run typecheck clean (root + both web apps). 30 new tests across test/oauth-server.test.ts and test/party-cli.test.ts, including the S256 digest cross-checked against the value the bittorrented client's WebCrypto produces.

Notes

• The version is left at 0.16.0 on purpose: 0.17.0: a channel relayed to another nixamp, losslessly compressed (PRD 0001) #124 is claiming 0.17.0, and two branches both bumping to it is a conflict for nothing. Worth a bump before release.
• NIXAMP_OAUTH_CLIENTS registers a client beyond the built-in bittorrented one; NIXAMP_OAUTH_BITTORRENTED=off removes that one.
• The media-streamer half is Connect nixamp with OAuth 2.1, and put a watch party on it as a room media-streamer#217.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QuUkTrofSjQ15j79mRuy4f