Unify waitlist and Console with Auth0 and early-access control

.env.example

@@ -30,8 +30,27 @@ PYMTHOUSE_ALLOW_INSECURE_HTTP=
 # MCP_PUBLIC_ORIGIN=https://dashboard.livepeer.org
 # DISCOVERY_SERVICE_URL=https://discovery-service-production-8955.up.railway.app/v1/discovery/raw
 # PYMTHOUSE_SIGNER_URL=https://signer.pymthouse.com
-# Non-prod mint requires PYMTHOUSE_PUBLIC_CLIENT_ID=app_98575870d7ae33589a3f0660
+# Preview credential operations require BOTH staging issuer and app:
+# PYMTHOUSE_ISSUER_URL=https://staging.pymthouse.com/api/v1/oidc
+# PYMTHOUSE_PUBLIC_CLIENT_ID=app_088f2082a8f1161d60179431
 
-# Invite-only Console HTML (/home, /usage, /keys, /calls, /settings).
-# Empty = no gate. Comma-separated emails, matched case-insensitively.
-# CONSOLE_EMAIL_ALLOWLIST=alice@livepeer.org,bob@studio.com
+# Console admission is database-authoritative; no environment email allowlist.
+
+# Waitlist + identity/access + single-use OAuth receipts (migrations 0000-0008).
+# Production must use the existing waitlist database. Previews and tests must
+# use an isolated database branch; never point them at the production branch.
+DATABASE_URL=postgresql://user:password@host/database?sslmode=require
+ATTRIBUTION_HASH_SECRET=replace-with-at-least-32-random-bytes
+RESEND_API_KEY=re_replace_me
+RESEND_NEWSLETTER_SEGMENT_ID=replace-with-resend-segment-id
+EMAIL_FROM=Livepeer Waitlist <waitlist@mail.example.com>
+EMAIL_REPLY_TO=help@example.com
+INTERNAL_OUTBOX_SECRET=replace-with-at-least-32-random-bytes
+NEXT_PUBLIC_SITE_URL=http://localhost:3000
+# Publishable token; analytics safely no-ops when unset.
+NEXT_PUBLIC_POSTHOG_KEY=
+
+# Mandatory on Vercel Preview. Capture only; never write production contacts.
+# EMAIL_DELIVERY_MODE=capture
+# Disposable automated tests additionally require independently supplied
+# TEST_DATABASE_URL, TEST_DATABASE_HOST, TEST_DATABASE_BRANCH_ID and DB marker.

.github/workflows/validate-console.yml

@@ -0,0 +1,25 @@
+name: Validate Console
+on:
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm test
+      - run: pnpm test:console
+      - run: pnpm lint
+      - run: pnpm build
+      - run: pnpm typecheck
+    # No cloud/database/email credentials in untrusted PR jobs. Disposable DB
+    # integration and protected preview evidence are coordinator-run gates.

.gitignore

@@ -10,6 +10,8 @@
 
 # next.js
 /.next/
+/.next-cutover/
+/.agent-worktrees/
 /out/
 
 # production

.prettierignore

@@ -1 +1,4 @@
 pnpm-lock.yaml
+.next/
+.next-cutover/
+.agent-worktrees/

app/(app)/admin/page.tsx

@@ -0,0 +1,52 @@
+import { redirect } from "next/navigation";
+import ConsolePageHeader from "@/components/console/ConsolePageHeader";
+import AccessManager from "@/components/admin/AccessManager";
+import { getAdminWaitlistSummary } from "@/lib/waitlist/admin";
+import { getAdminPrincipal } from "@/lib/admin/auth";
+
+export const dynamic = "force-dynamic";
+
+export default async function AdminPage() {
+  const admin = await getAdminPrincipal();
+  if (!admin) redirect("/waitlist");
+  const summary = await getAdminWaitlistSummary();
+  return (
+    <main
+      id="main-content"
+      className="flex min-h-full flex-1 flex-col bg-dark text-fg"
+    >
+      <ConsolePageHeader
+        title="Waitlist administration"
+        actions={
+          <a
+            href="/api/admin/signups.csv"
+            className="rounded border border-hairline px-3 py-1 text-xs hover:bg-hover"
+          >
+            Export CSV
+          </a>
+        }
+      />
+      <section className="mx-auto w-full max-w-7xl px-5 py-8 sm:px-7">
+        <h1 className="text-2xl font-medium tracking-tight">
+          Waitlist administration
+        </h1>
+        <dl className="mt-8 grid grid-cols-2 gap-x-6 gap-y-8 md:grid-cols-4">
+          {[
+            ["Total signups", summary.totalSignups],
+            ["Verified signups", summary.confirmedSignups],
+            ["Total verified referrals", summary.totalVerifiedReferrals],
+            ["Newsletter opt-ins", summary.newsletterSubscribers],
+          ].map(([label, value]) => (
+            <div key={label}>
+              <dt className="text-xs text-fg-muted">{label}</dt>
+              <dd className="mt-2 text-3xl font-light tabular-nums">
+                {Number(value).toLocaleString()}
+              </dd>
+            </div>
+          ))}
+        </dl>
+        <AccessManager />
+      </section>
+    </main>
+  );
+}

app/(app)/calls/page.tsx

@@ -1,4 +1,5 @@
 import { redirect } from "next/navigation";
+import { requireConsolePage } from "@/lib/access/page";
 
 /**
  * `/calls` folded into `/home` for the creator pilot — the call log now
@@ -17,5 +18,8 @@ export default async function CallsPage({
   const params = await searchParams;
   const request = params.request;
   const id = Array.isArray(request) ? request[0] : request;
+  await requireConsolePage(
+    id ? `/calls?request=${encodeURIComponent(id)}` : "/calls"
+  );
   redirect(id ? `/home?request=${encodeURIComponent(id)}` : "/home");
 }

app/(app)/device/DeviceApproveForm.tsx

@@ -32,24 +32,29 @@ export default function DeviceApproveForm({
   async function approve() {
     setError("");
     setPhase("submitting");
-    const response = await fetch("/api/v1/auth/device/approve", {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        iss,
-        target_link_uri: targetLinkUri,
-      }),
-    });
-    const json = (await response.json()) as {
-      ok?: boolean;
-      error?: string;
-    };
-    if (!response.ok || !json.ok) {
+    try {
+      const response = await fetch("/api/v1/auth/device/approve", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          iss,
+          target_link_uri: targetLinkUri,
+        }),
+      });
+      const json = (await response.json()) as {
+        ok?: boolean;
+        error?: string;
+      };
+      if (!response.ok || !json.ok) {
+        setPhase("error");
+        setError(json.error ?? "Approval failed");
+        return;
+      }
+      setPhase("ok");
+    } catch {
       setPhase("error");
-      setError(json.error ?? "Approval failed");
-      return;
+      setError("We couldn’t confirm device approval. Please try again.");
     }
-    setPhase("ok");
   }
 
   if (phase === "ok") {
@@ -78,7 +83,11 @@ export default function DeviceApproveForm({
       >
         {phase === "submitting" ? "Approving…" : "Approve device"}
       </Button>
-      {error ? <p className="text-sm text-red-400">{error}</p> : null}
+      {error ? (
+        <p role="alert" className="text-sm text-red-400">
+          {error}
+        </p>
+      ) : null}
     </div>
   );
 }

app/(app)/device/page.tsx

@@ -1,6 +1,4 @@
-import { redirect } from "next/navigation";
-
-import { auth0 } from "@/lib/auth0";
+import { requireConsolePage } from "@/lib/access/page";
 import { parseDeviceInitiateParams } from "@/lib/console/device-approval";
 import DeviceApproveForm, { DevicePageChrome } from "./DeviceApproveForm";
 
@@ -18,20 +16,19 @@ export default async function DevicePage({
   const params = await searchParams;
   const query = new URLSearchParams();
   if (params.iss) query.set("iss", params.iss);
-  if (params.target_link_uri) query.set("target_link_uri", params.target_link_uri);
+  if (params.target_link_uri)
+    query.set("target_link_uri", params.target_link_uri);
   if (params.login_hint) query.set("login_hint", params.login_hint);
   const returnTo = `/device${query.size ? `?${query.toString()}` : ""}`;
 
-  const session = await auth0.getSession();
-  if (!session?.user?.sub) {
-    redirect(`/auth/login?returnTo=${encodeURIComponent(returnTo)}`);
-  }
+  await requireConsolePage(returnTo);
 
   let parsed;
   try {
     parsed = parseDeviceInitiateParams(query);
   } catch (error) {
-    const message = error instanceof Error ? error.message : "Invalid device request";
+    const message =
+      error instanceof Error ? error.message : "Invalid device request";
     return (
       <DevicePageChrome>
         <p className="text-sm text-red-400">{message}</p>

app/(app)/home/page.tsx

@@ -1,34 +1,18 @@
-"use client";
-
 import { Suspense } from "react";
-import { useAuth } from "@/components/console/AuthContext";
+import { requireConsolePage } from "@/lib/access/page";
 import ConsolePageSkeleton from "@/components/console/ConsolePageSkeleton";
-import SignInWall from "@/components/console/SignInWall";
 import UsageView from "@/components/console/UsageView";
 
-export default function HomePage() {
+export const dynamic = "force-dynamic";
+export default async function HomePage() {
+  await requireConsolePage("/home");
   return (
     <Suspense fallback={<ConsolePageSkeleton kpiCount={4} withChart />}>
-      <HomeContent />
+      <main id="main-content" className="flex flex-1 flex-col bg-dark">
+        <div className="flex flex-1 flex-col">
+          <UsageView />
+        </div>
+      </main>
     </Suspense>
   );
 }
-
-function HomeContent() {
-  const { isConnected, isLoading } = useAuth();
-
-  // Avoid flashing the wall while auth hydrates.
-  if (isLoading) return null;
-
-  // Organization-only route — logged-out users see the in-shell sign-in wall
-  // instead of a hard redirect.
-  if (!isConnected) return <SignInWall route="home" />;
-
-  return (
-    <main id="main-content" className="flex flex-1 flex-col bg-dark">
-      <div className="flex flex-1 flex-col">
-        <UsageView />
-      </div>
-    </main>
-  );
-}