release: DOS shared billing live, upstream sync 90 commits, SSO worker retirement

[JOY (JOY)]

Promote dev to main

• DOS shared billing (PR feat(billing): sell DOS Plus/Pro via shared dos.me billing #38): sell DOS Plus ($9) / Pro ($19) via dos.me internal billing (checkout redirects to dos.me, entitlements from shared user_plans); gated by DOS_SHARED_BILLING=true
• Upstream sync (PR chore(sync): merge upstream main (Mastra 1.67, CopilotKit 1.72, MCP ChatGPT app, provider fixes) #40): Mastra 1.67, CopilotKit 1.72, MCP ChatGPT app + upload widget (requires post.Media.status/processingError — DOS.Me#809 lands the columns on the shared prod project), OAuth client_secret_basic + email claims for DCR, super-admin org scoping, provider fixes
• SSO worker retirement (PR chore(sso): remove deprecated crove-sso Cloudflare Worker #39): deprecated crove-sso Cloudflare Worker removed
• Prod env prerequisites (VM): DOS_SHARED_BILLING=true, DOS_ME_API_URL=https://api.dos.me, DOS_ME_INTERNAL_API_KEY + Media columns migration applied before deploy

Deploy order

1. DOS.Me#809 merged (schema columns on prod)
2. This PR merged → new :latest image
3. VM env + recreate crove-post

[dos]

⏱️ Adversarial Review completed (Model: qwen3.8-27b)

⚠️ Input diff exceeded 30000 chars and was truncated before review.

🔍 Verified Adversarial Review Findings

🟡 IMPORTANT

• apps/backend/src/api/routes/media.controller.ts:167-178: Ghost file creation on successful multipart upload completion
  • Failure Trace:
    1. Client initiates a multipart upload to S3/R2 and completes it via POST /media/upload-server/complete-multipart-upload.
    2. handleR2Upload executes the S3 completeMultipartUpload API call.
    3. In many S3-compatible implementations (or if the library is configured to pipe the response), handleR2Upload may send the response headers/body (e.g., a 200 OK with XML or a 302 redirect) before returning. This sets res.headersSent = true.
    4. The condition if (endpoint !== 'complete-multipart-upload' || res.headersSent) evaluates to true because res.headersSent is true.
    5. The function returns upload immediately.
    6. The code block below (lines 167-178) is skipped. This block is responsible for calling this._mediaService.saveUploadedFile to persist the media record in the database.
    7. Result: The file exists in S3 storage but has no corresponding record in the database. The user cannot see or use the file in the UI, resulting in data loss/orphaned storage.
  • Actionable Fix:
    The logic should ensure that saveUploadedFile is called regardless of whether headers were sent, or the response sending should be deferred until after the database save. A safer pattern is to check if the response was successfully sent with a 2xx status, or to always attempt the save and only send the final JSON response if headers haven't been sent (logging a warning if they have). Alternatively, ensure handleR2Upload does not send the response for complete-multipart-upload and lets the controller handle the final response.

🛡️ Dismissed Claims

• apps/backend/src/api/routes/media.widget.controller.ts:36-40 IDOR risk: The UploadWidgetAuthMiddleware is explicitly applied to MediaWidgetController in api.module.ts (consumer.apply(UploadWidgetAuthMiddleware).forRoutes(MediaWidgetController)). While the middleware implementation is not in the diff, the claim assumes it is insecure or missing. Without evidence that the middleware fails to bind the session to the user/org, this is a speculative concern about unprovided code. The controller correctly uses @GetOrgFromRequest() which relies on the authenticated context established by the middleware.
• apps/backend/src/api/routes/auth.controller.ts:302-310 Missing permission guard: The endpoint is POST /auth/farcaster/signer. The AuthController is part of the authenticatedController list in api.module.ts, meaning it is protected by AuthMiddleware. The claim that it lacks authorization is partially true (no specific role check), but creating a signer is typically a user-level action, not an org-admin action. The throttling (limit: 30, ttl: 3600000) provides rate limiting. Without evidence that signer creation is a privileged operation requiring specific org permissions (e.g., billing or admin), this is a design choice rather than a clear security vulnerability. The primary risk (abuse) is mitigated by throttling.

[gemini-code-assist]

Code Review

This pull request removes the Cloudflare Worker SSO bridge in favor of a centralized PKCE bridge via api.dos.me, integrates a media normalization pipeline using RunPod Serverless and Temporal workflows, and introduces an MCP upload widget toolset. It also adds DOS shared billing integration, improves Farcaster authentication via a QR code/link approval flow, and updates several social providers (Bluesky, Facebook, Instagram, Pinterest, Reddit, TikTok) to enhance error handling and feature support. Feedback on these changes highlights critical runtime issues, including stream type mismatches in the upload validation utility, Prisma compilation errors in the media repository due to non-unique fields in where clauses, potential TypeError crashes in the Facebook and Pinterest providers, and unhandled promise rejections in the TikTok provider.

[gemini-code-assist]

There are two stream type mismatches here that will cause runtime crashes:

1. fileTypeStream expects a Node.js Readable stream, but is passed a web ReadableStream (webStream).
2. sniffed returned by fileTypeStream is a Node.js Readable stream, but is passed to Readable.fromWeb (which expects a web ReadableStream).

To fix this, convert webStream to a Node.js stream first using Readable.fromWeb(webStream as any), pass that to fileTypeStream, and then pass the resulting sniffed stream directly to pipeline without wrapping it in Readable.fromWeb.

export async function uploadStreamToStorage(
  storage: IUploadProvider,
  webStream: ReadableStream,
  declaredSize = 0
) {
  const nodeStream = Readable.fromWeb(webStream as any);
  let sniffed: Readable & { fileType?: { mime: string; ext: string } };
  try {
    sniffed = await fileTypeStream(nodeStream);
  } catch (err) {
    throw new BadRequestException('Failed to read file', { cause: err });
  }
  const detected = sniffed.fileType;
  if (!detected || !UPLOAD_ALLOWED_MIME.has(detected.mime)) {
    sniffed.destroy();
    throw new BadRequestException('Unsupported file type.');
  }

  const maxSize = getMaxSize(detected.mime);
  if (declaredSize > maxSize) {
    sniffed.destroy();
    throw new BadRequestException('File is too large.');
  }

  // pipeline (not pipe) so failing the cap also tears down the source
  const body = pipeline(
    sniffed,
    maxSizeStream(maxSize),
    () => {}
  );

[gemini-code-assist]

Prisma's update method where parameter only accepts unique fields. Since organizationId is not a unique field or part of a unique compound index with id, this will cause a TypeScript compilation error. Since id is already a globally unique CUID, you can safely remove organizationId from the where clause.

Suggested change

	startProcessing(org: string, id: string) {
	return this._media.model.media.update({
	where: { id, organizationId: org },
	data: { status: 'processing', processingError: null },
	select: { id: true, status: true },
	});
	startProcessing(org: string, id: string) {
	return this._media.model.media.update({
	where: { id },
	data: { status: 'processing', processingError: null },
	select: { id: true, status: true },
	});
	}

[gemini-code-assist]

Prisma's update method where parameter only accepts unique fields. Since organizationId is not a unique field or part of a unique compound index with id, this will cause a TypeScript compilation error. Since id is already a globally unique CUID, you can safely remove organizationId from the where clause.

Suggested change

	finishProcessing(
	org: string,
	id: string,
	data: { name?: string; path?: string; fileSize?: number; error?: string }
	) {
	return this._media.model.media.update({
	where: { id, organizationId: org },
	data: {
	...(data.name ? { name: data.name } : {}),
	...(data.path ? { path: data.path } : {}),
	...(data.fileSize ? { fileSize: data.fileSize } : {}),
	status: data.error ? 'failed' : 'ready',
	processingError: data.error || null,
	},
	select: { id: true, status: true },
	});
	finishProcessing(
	org: string,
	id: string,
	data: { name?: string; path?: string; fileSize?: number; error?: string }
	) {
	return this._media.model.media.update({
	where: { id },
	data: {
	...(data.name ? { name: data.name } : {}),
	...(data.path ? { path: data.path } : {}),
	...(data.fileSize ? { fileSize: data.fileSize } : {}),
	status: data.error ? 'failed' : 'ready',
	processingError: data.error || null,
	},
	select: { id: true, status: true },
	});
	}

[gemini-code-assist]

If postId is null or undefined (which is possible since releaseId is nullable in the database), postId.includes will throw a TypeError and crash the analytics worker. We should add a defensive check to return [] immediately if postId is falsy.

    if (!postId) {
      return [];
    }

    if (!postId.includes('_')) {
      return this.videoPostAnalytics(accessToken, postId, today);
    }

[gemini-code-assist]

If process.env.FRONTEND_URL is undefined, the array will contain undefined, which is invalid for CORS origin configuration and can cause runtime errors or unexpected CORS behavior. It is safer to conditionally add it only if defined.

Suggested change

	origin: [
	process.env.FRONTEND_URL,
	'http://localhost:6274',
	...(process.env.MAIN_URL ? [process.env.MAIN_URL] : []),
	],
	origin: [
	...(process.env.FRONTEND_URL ? [process.env.FRONTEND_URL] : []),
	'http://localhost:6274',
	...(process.env.MAIN_URL ? [process.env.MAIN_URL] : []),
	],

[gemini-code-assist]

If multiple customers share the same name, using key={name} will result in duplicate key warnings in React, which can cause rendering bugs. It is safer to use the map index or a unique ID as the key.

Suggested change

	<datalist id="customer-name-options">
	{(data?.map((p: any) => p.name) || []).map((name: string) => (
	<option key={name} value={name} />
	))}
	</datalist>
	<datalist id="customer-name-options">
	{(data?.map((p: any) => p.name) || []).map((name: string, index: number) => (
	<option key={index} value={name} />
	))}
	</datalist>

[gemini-code-assist]

If data or data.all is null/undefined, accessing metrics.summary_metrics will throw a TypeError. We should use optional chaining data?.all and metrics?.summary_metrics to prevent runtime crashes.

Suggested change

	const metrics = data.all;
	if (metrics.lifetime_metrics) {
	const lifetimeMetrics = metrics.lifetime_metrics;
	// The requested metric types are period metrics: Pinterest returns them
	// in summary_metrics, never in lifetime_metrics (that only ever carries
	// TOTAL_COMMENTS / TOTAL_REACTIONS).
	if (metrics.summary_metrics) {
	const metrics = data?.all;
	// The requested metric types are period metrics: Pinterest returns them
	// in summary_metrics, never in lifetime_metrics (that only ever carries
	// TOTAL_COMMENTS / TOTAL_REACTIONS).
	if (metrics?.summary_metrics) {

[gemini-code-assist]

If getImageDimensions throws an error (e.g., if the file is not found, corrupt, or network fails), Promise.all will reject and crash the entire validation/publishing process. We should wrap the call in a try-catch block to handle individual rejections gracefully, and update the tooBig check to handle null values.

    if (firstItems?.every((p) => (p?.path?.indexOf?.('mp4') ?? -1) === -1)) {
      const dimensions = await Promise.all(
        firstItems?.map(async (p) => {
          try {
            return await this.getImageDimensions(p?.path);
          } catch {
            return null;
          }
        }) ?? []
      );
      const tooBig = dimensions.findIndex(
        (p) => p && Math.min(p.width ?? 0, p.height ?? 0) > 1080
      );

[JOY (JOY)]

Same code-scanning caveat as #40 (commented there): CodeQL 1 critical = SSRF false positive (runtime guarded by ssrfSafeDispatcher), ESLint 3 errors = upstream farcaster lint debt. All build/test/branding gates green (verified on the same commits via #40 and dev push runs).