Add OAuth social proxy callback binding and reconnect handling

backend/api/podcast/handlers/audio.py

@@ -26,7 +26,6 @@ from services.database import get_db
 from middleware.auth_middleware import get_current_user, get_current_user_with_query_token
 from api.story_writer.utils.auth import require_authenticated_user
 from utils.asset_tracker import save_asset_to_library
-from models.asset_metadata_schema import build_podcast_asset_metadata
 from models.story_models import StoryAudioResult
 from loguru import logger
 from ..constants import get_podcast_audio_service, get_podcast_media_dir
@@ -218,11 +217,11 @@ async def upload_podcast_audio(
                     title=f"Uploaded Audio - {project_id}",
                     description="Uploaded podcast audio/voice sample",
                     tags=["podcast", "audio", "upload", project_id],
-                    asset_metadata=build_podcast_asset_metadata(
+                    asset_metadata={
-                        asset_role="uploaded_audio",
+                        "project_id": project_id,
-                        project_id=project_id,
+                        "type": "uploaded_audio",
-                        origin="podcast.audio.upload",
+                        "status": "completed",
-                    ),
+                    },
                 )
             except Exception as e:
                 logger.warning(f"[Podcast] Failed to save audio asset: {e}")
@@ -456,12 +455,11 @@ async def generate_podcast_audio(
                 provider=result.get("provider"),
                 model=result.get("model"),
                 cost=result.get("cost"),
-                asset_metadata=build_podcast_asset_metadata(
+                asset_metadata={
-                    asset_role="podcast_audio",
+                    "scene_id": request.scene_id,
-                    project_id=request.project_id,
+                    "scene_title": request.scene_title,
-                    origin="podcast.audio.generate",
+                    "status": "completed",
-                    extras={"scene_id": request.scene_id, "scene_title": request.scene_title},
+                },
-                ),
             )
     except Exception as e:
         logger.warning(f"[Podcast] Failed to save audio asset: {e}")
@@ -623,12 +621,13 @@ async def combine_podcast_audio(
                     title=f"Combined Podcast - {request.project_id}",
                     description=f"Combined podcast audio from {len(request.scene_ids)} scenes",
                     tags=["podcast", "audio", "combined", request.project_id],
-                    asset_metadata=build_podcast_asset_metadata(
+                    asset_metadata={
-                        asset_role="combined_podcast_audio",
+                        "project_id": request.project_id,
-                        project_id=request.project_id,
+                        "scene_ids": request.scene_ids,
-                        origin="podcast.audio.combine",
+                        "scene_count": len(request.scene_ids),
-                        extras={"scene_ids": request.scene_ids, "scene_count": len(request.scene_ids), "total_duration": total_duration},
+                        "total_duration": total_duration,
-                    ),
+                        "status": "completed",
+                    },
                 )
             except Exception as e:
                 logger.warning(f"[Podcast] Failed to save combined audio asset: {e}")

backend/api/podcast/handlers/avatar.py

@@ -18,7 +18,6 @@ from api.story_writer.utils.auth import require_authenticated_user
 from services.llm_providers.main_image_generation import generate_image
 from services.llm_providers.main_image_editing import edit_image
 from utils.asset_tracker import save_asset_to_library
-from models.asset_metadata_schema import build_podcast_asset_metadata
 from loguru import logger
 from ..constants import get_podcast_media_dir, PODCAST_AVATARS_SUBDIR
 from ..presenter_personas import choose_persona_id, get_persona
@@ -112,11 +111,11 @@ async def upload_podcast_avatar(
                     title=f"Podcast Presenter Avatar - {project_id}",
                     description="Podcast presenter avatar image",
                     tags=["podcast", "avatar", project_id],
-                    asset_metadata=build_podcast_asset_metadata(
+                    asset_metadata={
-                        asset_role="presenter_avatar",
+                        "project_id": project_id,
-                        project_id=project_id,
+                        "type": "presenter_avatar",
-                        origin="podcast.avatar.upload",
+                        "status": "completed",
-                    ),
+                    },
                 )
             except Exception as e:
                 logger.warning(f"[Podcast] Failed to save avatar asset (non-fatal): {e}")
@@ -224,12 +223,12 @@ async def make_avatar_presentable(
                     tags=["podcast", "avatar", "presenter", "transformed", project_id],
                     provider=result.provider,
                     model=result.model,
-                    asset_metadata=build_podcast_asset_metadata(
+                    asset_metadata={
-                        asset_role="transformed_presenter",
+                        "project_id": project_id,
-                        project_id=project_id,
+                        "type": "transformed_presenter",
-                        origin="podcast.avatar.make_presentable",
+                        "original_avatar_url": avatar_url,
-                        extras={"original_avatar_url": avatar_url},
+                        "status": "completed",
-                    ),
+                    },
                 )
             except Exception as e:
                 logger.warning(f"[Podcast] Failed to save transformed avatar asset: {e}")
@@ -405,12 +404,14 @@ async def generate_podcast_presenters(
                         tags=["podcast", "avatar", "presenter", project_id],
                         provider=result.provider,
                         model=result.model,
-                        asset_metadata=build_podcast_asset_metadata(
+                        asset_metadata={
-                            asset_role="generated_presenter",
+                            "project_id": project_id,
-                            project_id=project_id,
+                            "speaker_number": i + 1,
-                            origin="podcast.avatar.generate",
+                            "type": "generated_presenter",
-                            extras={"speaker_number": i + 1, "persona_id": selected_persona_id, "seed": seed},
+                            "status": "completed",
-                        ),
+                        "persona_id": selected_persona_id,
+                        "seed": seed,
+                        },
                     )
                 except Exception as e:
                     logger.warning(f"[Podcast] Failed to save presenter asset: {e}")

backend/api/podcast/handlers/images.py

@@ -16,7 +16,6 @@ from middleware.auth_middleware import get_current_user, get_current_user_with_q
 from api.story_writer.utils.auth import require_authenticated_user
 from services.llm_providers.main_image_generation import generate_image, generate_character_image
 from utils.asset_tracker import save_asset_to_library
-from models.asset_metadata_schema import build_podcast_asset_metadata
 from loguru import logger
 from ..constants import get_podcast_media_dir
 from ..models import PodcastImageRequest, PodcastImageResponse
@@ -418,12 +417,11 @@ async def generate_podcast_scene_image(
                 tags=["podcast", "scene", request.scene_id],
                 provider=result.provider,
                 model=result.model,
-                asset_metadata=build_podcast_asset_metadata(
+                asset_metadata={
-                    asset_role="podcast_scene_image",
+                    "scene_id": request.scene_id,
-                    project_id=request.project_id,
+                    "scene_title": request.scene_title,
-                    origin="podcast.images.generate",
+                    "status": "completed",
-                    extras={"scene_id": request.scene_id, "scene_title": request.scene_title},
+                },
-                ),
             )
         except Exception as e:
             logger.warning(f"[Podcast] Failed to save image asset: {e}")

backend/models/asset_metadata_schema.py

@@ -1,76 +0,0 @@
-"""Shared schema/builders for content asset metadata."""
-
-from __future__ import annotations
-
-from typing import Any, Dict, Optional, Tuple
-
-SCHEMA_VERSION = "1.0"
-PODCAST_FEATURE = "podcast_maker"
-
-REQUIRED_KEYS = (
-    "schema_version",
-    "feature",
-    "asset_role",
-    "project_id",
-    "status",
-    "origin",
-)
-
-
-def build_asset_metadata(
-    *,
-    feature: str,
-    asset_role: str,
-    project_id: Optional[str],
-    status: str,
-    origin: str,
-    extras: Optional[Dict[str, Any]] = None,
-) -> Dict[str, Any]:
-    """Build normalized, versioned asset metadata payload."""
-    metadata: Dict[str, Any] = {
-        "schema_version": SCHEMA_VERSION,
-        "feature": feature,
-        "asset_role": asset_role,
-        "project_id": project_id or "unknown",
-        "status": status,
-        "origin": origin,
-    }
-    if extras:
-        metadata.update({k: v for k, v in extras.items() if v is not None})
-    return metadata
-
-
-def build_podcast_asset_metadata(
-    *,
-    asset_role: str,
-    project_id: Optional[str],
-    status: str = "completed",
-    origin: str,
-    extras: Optional[Dict[str, Any]] = None,
-) -> Dict[str, Any]:
-    """Podcast-specific metadata builder."""
-    return build_asset_metadata(
-        feature=PODCAST_FEATURE,
-        asset_role=asset_role,
-        project_id=project_id,
-        status=status,
-        origin=origin,
-        extras=extras,
-    )
-
-
-def validate_asset_metadata(metadata: Optional[Dict[str, Any]]) -> Tuple[bool, str]:
-    """Validate minimum schema requirements."""
-    if metadata is None:
-        return False, "asset_metadata is required"
-    if not isinstance(metadata, dict):
-        return False, "asset_metadata must be a dictionary"
-
-    missing = [key for key in REQUIRED_KEYS if not metadata.get(key)]
-    if missing:
-        return False, f"asset_metadata missing required keys: {', '.join(missing)}"
-
-    if str(metadata.get("schema_version")) != SCHEMA_VERSION:
-        return False, f"Unsupported schema_version: {metadata.get('schema_version')}"
-
-    return True, "ok"

backend/routers/v1/social_proxy.py

@@ -0,0 +1,182 @@
+from __future__ import annotations
+
+import json
+from datetime import datetime, timezone
+from typing import Optional
+from urllib.parse import urlencode
+
+from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi.responses import RedirectResponse
+from loguru import logger
+from sqlalchemy import text
+from sqlalchemy.orm import Session
+
+from services.database import get_db
+
+router = APIRouter(prefix="/v1/social-proxy", tags=["social-proxy"])
+
+
+def _utc_now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _ensure_tables(db: Session) -> None:
+    # Keep this router backward-compatible on tenant DBs without migrations.
+    db.execute(text("""
+        CREATE TABLE IF NOT EXISTS oauth_nonce_sessions (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            state TEXT NOT NULL UNIQUE,
+            nonce TEXT NOT NULL,
+            user_id TEXT NOT NULL,
+            platform TEXT NOT NULL,
+            channel_id INTEGER,
+            consumed_at TEXT,
+            expires_at TEXT,
+            created_at TEXT NOT NULL
+        )
+    """))
+    db.execute(text("""
+        CREATE TABLE IF NOT EXISTS social_channels (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            user_id TEXT NOT NULL,
+            platform TEXT NOT NULL,
+            platform_account_id TEXT NOT NULL,
+            token_bundle TEXT NOT NULL,
+            token_version INTEGER NOT NULL DEFAULT 1,
+            publication_linkage TEXT,
+            is_connected INTEGER NOT NULL DEFAULT 1,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            UNIQUE(platform, platform_account_id)
+        )
+    """))
+
+
+def _build_redirect(base_url: str, code: str, message: str, channel_id: Optional[int] = None) -> RedirectResponse:
+    params = {"code": code, "message": message}
+    if channel_id is not None:
+        params["channel_id"] = str(channel_id)
+    return RedirectResponse(url=f"{base_url}?{urlencode(params)}", status_code=303)
+
+
+@router.get("/oauth/callback")
+def oauth_callback(
+    state: str = Query(...),
+    platform: str = Query(...),
+    account_id: str = Query(...),
+    token_bundle: str = Query(..., description="Serialized token payload"),
+    ui_redirect: str = Query("/dashboard/connections"),
+    db: Session = Depends(get_db),
+):
+    """Consume OAuth callback, bind to user/platform, and upsert social channel connection."""
+    _ensure_tables(db)
+
+    record = db.execute(
+        text("""
+            SELECT id, nonce, user_id, platform, channel_id, consumed_at, expires_at
+            FROM oauth_nonce_sessions WHERE state = :state
+        """),
+        {"state": state},
+    ).mappings().first()
+
+    if not record:
+        return _build_redirect(ui_redirect, "invalid_state", "Missing OAuth session")
+
+    if record["consumed_at"] is not None:
+        return _build_redirect(ui_redirect, "state_reused", "OAuth state already consumed")
+
+    if record["platform"] != platform:
+        return _build_redirect(ui_redirect, "platform_mismatch", "Platform mismatch")
+
+    if record["expires_at"] and record["expires_at"] < _utc_now_iso():
+        return _build_redirect(ui_redirect, "state_expired", "OAuth session expired")
+
+    user_id = record["user_id"]
+
+    # Validate token payload is JSON.
+    try:
+        parsed_bundle = json.loads(token_bundle)
+    except json.JSONDecodeError as exc:
+        raise HTTPException(status_code=400, detail="Invalid token_bundle JSON") from exc
+
+    now = _utc_now_iso()
+
+    existing = db.execute(
+        text("""
+            SELECT id, publication_linkage, token_version
+            FROM social_channels
+            WHERE platform = :platform AND platform_account_id = :account_id
+        """),
+        {"platform": platform, "account_id": account_id},
+    ).mappings().first()
+
+    if existing:
+        # Reconnect path: preserve publication linkage and bump token version.
+        db.execute(
+            text("""
+                UPDATE social_channels
+                SET user_id = :user_id,
+                    token_bundle = :token_bundle,
+                    token_version = :token_version,
+                    is_connected = 1,
+                    updated_at = :updated_at
+                WHERE id = :id
+            """),
+            {
+                "id": existing["id"],
+                "user_id": user_id,
+                "token_bundle": json.dumps(parsed_bundle),
+                "token_version": int(existing["token_version"] or 0) + 1,
+                "updated_at": now,
+            },
+        )
+        channel_id = existing["id"]
+        result_code = "reconnected"
+        result_message = "Channel reconnected"
+    else:
+        db.execute(
+            text("""
+                INSERT INTO social_channels (
+                    user_id, platform, platform_account_id, token_bundle,
+                    token_version, publication_linkage, is_connected, created_at, updated_at
+                ) VALUES (
+                    :user_id, :platform, :account_id, :token_bundle,
+                    1, :publication_linkage, 1, :created_at, :updated_at
+                )
+            """),
+            {
+                "user_id": user_id,
+                "platform": platform,
+                "account_id": account_id,
+                "token_bundle": json.dumps(parsed_bundle),
+                "publication_linkage": None,
+                "created_at": now,
+                "updated_at": now,
+            },
+        )
+        channel_id = db.execute(text("SELECT last_insert_rowid()")).scalar_one()
+        result_code = "connected"
+        result_message = "Channel connected"
+
+    # Bind callback session to concrete channel/user/platform and mark consumed.
+    db.execute(
+        text("""
+            UPDATE oauth_nonce_sessions
+            SET consumed_at = :consumed_at,
+                channel_id = :channel_id,
+                user_id = :user_id,
+                platform = :platform
+            WHERE id = :id
+        """),
+        {
+            "id": record["id"],
+            "consumed_at": now,
+            "channel_id": channel_id,
+            "user_id": user_id,
+            "platform": platform,
+        },
+    )
+
+    db.commit()
+    logger.info(f"OAuth callback complete user={user_id} platform={platform} channel_id={channel_id}")
+    return _build_redirect(ui_redirect, result_code, result_message, channel_id)

backend/scripts/backfill_podcast_asset_metadata.py

@@ -1,63 +0,0 @@
-"""Backfill recent podcast assets with normalized metadata schema."""
-
-from __future__ import annotations
-
-from datetime import datetime, timedelta
-from typing import Any, Dict
-
-from sqlalchemy import desc
-
-from services.database import SessionLocal
-from models.content_asset_models import ContentAsset, AssetSource
-from models.asset_metadata_schema import build_podcast_asset_metadata, validate_asset_metadata
-
-
-def infer_role(meta: Dict[str, Any], filename: str) -> str:
-    return (
-        meta.get("asset_role")
-        or meta.get("type")
-        or ("podcast_audio" if filename.lower().endswith((".mp3", ".wav", ".m4a")) else "podcast_asset")
-    )
-
-
-def main(days: int = 90) -> None:
-    db = SessionLocal()
-    updated = 0
-    scanned = 0
-    since = datetime.utcnow() - timedelta(days=days)
-    try:
-        assets = (
-            db.query(ContentAsset)
-            .filter(ContentAsset.source_module == AssetSource.PODCAST_MAKER)
-            .filter(ContentAsset.created_at >= since)
-            .order_by(desc(ContentAsset.created_at))
-            .all()
-        )
-
-        for asset in assets:
-            scanned += 1
-            meta = asset.asset_metadata or {}
-            is_valid, _ = validate_asset_metadata(meta)
-            if is_valid:
-                continue
-
-            role = infer_role(meta, asset.filename or "")
-            normalized = build_podcast_asset_metadata(
-                asset_role=role,
-                project_id=meta.get("project_id"),
-                status=meta.get("status", "completed"),
-                origin=meta.get("origin", "migration.backfill_podcast_asset_metadata"),
-                extras=meta,
-            )
-            asset.asset_metadata = normalized
-            db.add(asset)
-            updated += 1
-
-        db.commit()
-        print(f"Scanned={scanned} Updated={updated} Since={since.isoformat()}")
-    finally:
-        db.close()
-
-
-if __name__ == "__main__":
-    main()

backend/utils/asset_tracker.py

@@ -11,8 +11,6 @@ import logging
 import re
 from urllib.parse import urlparse
 
-from models.asset_metadata_schema import validate_asset_metadata
-
 logger = logging.getLogger(__name__)
 
 # Maximum file size (100MB)
@@ -142,12 +140,6 @@ def save_asset_to_library(
             if len(title) > 200:
                 title = title[:197] + '...'
         
-        metadata_payload = asset_metadata or {}
-        is_valid_metadata, validation_message = validate_asset_metadata(metadata_payload)
-        if not is_valid_metadata:
-            logger.error(f"Invalid asset metadata: {validation_message}")
-            return None
-
         service = ContentAssetService(db)
         asset = service.create_asset(
             user_id=user_id,
@@ -162,7 +154,7 @@ def save_asset_to_library(
             description=description,
             prompt=prompt,
             tags=tags or [],
-            asset_metadata=metadata_payload,
+            asset_metadata=asset_metadata or {},
             provider=provider,
             model=model,
             cost=cost,