patch: remove youtubepartner scope from youtube provider

var/docker/docker/create-namespace-default.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+sleep 5
+
+tctl namespace create --namespace "default" --description 'Default namespace' --rd 1
+
+tini -s -- sleep infinity

var/docker/docker/docker-build.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -o xtrace
+
+docker rmi localhost/postiz || true
+docker build --target dist -t localhost/postiz -f Dockerfile.dev .
+docker build --target devcontainer -t localhost/postiz-devcontainer -f Dockerfile.dev .

var/docker/docker/docker-create.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+docker kill postiz || true 
+docker rm postiz || true 
+docker create --name postiz -p 3000:3000 -p 4200:4200 localhost/postiz

var/docker/docker/nginx.conf

@@ -0,0 +1,68 @@
+# Nginx config for Hugging Face Spaces
+# Runs as UID 1000 (app user) on port 7860
+pid /data/nginx.pid;
+error_log /data/nginx-error.log;
+worker_processes 1;
+
+events {
+    worker_connections          1024;
+}
+
+http {
+    include                     /etc/nginx/mime.types;
+    default_type                application/octet-stream;
+    sendfile                    on;
+    access_log                  /data/nginx-access.log;
+    client_max_body_size 2G;
+    server {
+        listen 7860;
+        server_name _;
+        gzip on;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+        # Backend API prefix (strips /api/ prefix)
+        location /api/ {
+            proxy_pass http://localhost:3000/;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Reload $http_reload;
+            proxy_set_header Onboarding $http_onboarding;
+            proxy_set_header Activate $http_activate;
+            proxy_set_header Auth $http_auth;
+            proxy_set_header Showorg $http_showorg;
+            proxy_set_header Impersonate $http_impersonate;
+            proxy_set_header Accept-Language $http_accept_language;
+            proxy_set_header i18next $http_i18next;
+        }
+
+        # Frontend — inject /api prefix into backendUrl at runtime
+        # The official image has NEXT_PUBLIC_BACKEND_URL="" baked in (build-time).
+        # sub_filter rewrites the JS bundles to set backendUrl="/api" so all
+        # frontend API calls go to /api/auth/register, /api/posts, etc.
+        location / {
+            proxy_pass http://localhost:4200/;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Accept-Encoding "";
+            proxy_set_header Reload $http_reload;
+            proxy_set_header Onboarding $http_onboarding;
+            proxy_set_header Activate $http_activate;
+            proxy_set_header Auth $http_auth;
+            proxy_set_header Showorg $http_showorg;
+            proxy_set_header Impersonate $http_impersonate;
+            proxy_set_header Accept-Language $http_accept_language;
+            proxy_set_header i18next $http_i18next;
+
+            # Rewrite backendUrl from "" to "/api" in JS bundles
+            sub_filter 'backendUrl:""' 'backendUrl:"/api"';
+            sub_filter_once off;
+            sub_filter_types application/javascript text/javascript;
+        }
+    }
+}

var/docker/docker/start.sh

@@ -0,0 +1,110 @@
+#!/bin/sh
+set -e
+
+echo "=== Postiz HF Space Startup ==="
+
+# Start cloudflared access tcp proxy for PostgreSQL (if configured)
+if [ -n "$TUNNEL_SERVICE_TOKEN_ID" ] && [ -n "$CF_TUNNEL_HOSTNAME" ]; then
+  echo "Starting cloudflared access tcp proxy -> $CF_TUNNEL_HOSTNAME (PG)"
+  cloudflared access tcp \
+    --hostname "$CF_TUNNEL_HOSTNAME" \
+    --url localhost:5432 &
+  for i in $(seq 1 30); do
+    (echo > /dev/tcp/localhost/5432) 2>/dev/null && break
+    sleep 1
+  done
+  echo "cloudflared PostgreSQL proxy ready"
+fi
+
+# Start cloudflared access tcp proxy for Redis (if configured)
+if [ -n "$TUNNEL_SERVICE_TOKEN_ID" ] && [ -n "$CF_REDIS_HOSTNAME" ]; then
+  echo "Starting cloudflared access tcp proxy -> $CF_REDIS_HOSTNAME (Redis)"
+  cloudflared access tcp \
+    --hostname "$CF_REDIS_HOSTNAME" \
+    --url localhost:6379 &
+  for i in $(seq 1 30); do
+    (echo > /dev/tcp/localhost/6379) 2>/dev/null && break
+    sleep 1
+  done
+  echo "cloudflared Redis proxy ready"
+fi
+
+# Patch compiled temporal.module.js to support mTLS client certificates
+# Field names must match @temporalio/common TLSConfig:
+#   serverNameOverride, serverRootCACertificate, clientCertPair: { crt, key }
+PATCH_DIR="/app"
+
+for DIST_DIR in "$PATCH_DIR/apps/backend/dist" "$PATCH_DIR/apps/orchestrator/dist"; do
+  TARGET="$DIST_DIR/libraries/nestjs-libraries/src/temporal/temporal.module.js"
+  if [ -f "$TARGET" ]; then
+    echo "Patching $TARGET for mTLS support..."
+    node -e "
+const fs = require('fs');
+let code = fs.readFileSync('$TARGET', 'utf8');
+
+const oldCode = \"...process.env.TEMPORAL_TLS === 'true' ? { tls: true } : {}\";
+const newCode = \"...(() => { if (process.env.TEMPORAL_TLS !== 'true') return {}; const cp = process.env.TEMPORAL_TLS_CERT; const kp = process.env.TEMPORAL_TLS_KEY; if (cp && kp) { return { tls: { serverNameOverride: process.env.TEMPORAL_TLS_SERVERNAME || undefined, clientCertPair: { crt: require('fs').readFileSync(cp), key: require('fs').readFileSync(kp) } }}; } return { tls: true }; })()\";
+
+if (code.includes(oldCode)) {
+  code = code.replace(oldCode, newCode);
+  fs.writeFileSync('$TARGET', code);
+  console.log('Patched successfully');
+} else {
+  console.log('Pattern not found, skipping');
+}
+"
+  fi
+done
+
+# Also patch health controller in orchestrator
+HEALTH_TARGET="$PATCH_DIR/apps/orchestrator/dist/apps/orchestrator/src/health.controller.js"
+if [ -f "$HEALTH_TARGET" ]; then
+  echo "Patching $HEALTH_TARGET for mTLS support..."
+  node -e "
+const fs = require('fs');
+let code = fs.readFileSync('$HEALTH_TARGET', 'utf8');
+
+const oldCode = \"...(process.env.TEMPORAL_TLS === 'true' ? { tls: true } : {})\";
+const newCode = \"...(() => { if (process.env.TEMPORAL_TLS !== 'true') return {}; const cp = process.env.TEMPORAL_TLS_CERT; const kp = process.env.TEMPORAL_TLS_KEY; if (cp && kp) { return { tls: { serverNameOverride: process.env.TEMPORAL_TLS_SERVERNAME || undefined, clientCertPair: { crt: require('fs').readFileSync(cp), key: require('fs').readFileSync(kp) } }}; } return { tls: true }; })()\";
+
+if (code.includes(oldCode)) {
+  code = code.replace(oldCode, newCode);
+  fs.writeFileSync('$HEALTH_TARGET', code);
+  console.log('Health controller patched successfully');
+} else {
+  console.log('Pattern not found in health controller, skipping');
+}
+"
+fi
+
+# Write Temporal env overrides to .env
+echo "TEMPORAL_ADDRESS=temporal.firela.io:443" >> /app/.env
+echo "TEMPORAL_TLS=true" >> /app/.env
+echo "TEMPORAL_TLS_CERT=/etc/nginx/ssl/client.crt" >> /app/.env
+echo "TEMPORAL_TLS_KEY=/etc/nginx/ssl/client.key" >> /app/.env
+echo "TEMPORAL_TLS_CA=/etc/nginx/ssl/ca.crt" >> /app/.env
+echo "TEMPORAL_TLS_SERVERNAME=temporal.firela.io" >> /app/.env
+
+# Patch no.auth.integrations.controller.js to log OAuth errors
+OAUTH_TARGET="$PATCH_DIR/apps/backend/dist/apps/backend/src/api/routes/no.auth.integrations.controller.js"
+if [ -f "$OAUTH_TARGET" ]; then
+  echo "Patching $OAUTH_TARGET for OAuth error logging..."
+  node -e "
+const fs = require('fs');
+let code = fs.readFileSync('$OAUTH_TARGET', 'utf8');
+const oldCatch = \"catch (err) {\\n                if (err instanceof social_abstract_1.NotEnoughScopes)\";
+const newCatch = \"catch (err) {\\n                console.log('[social-connect] OAuth error for', body ? body.state : 'unknown', ':', err);\\n                if (err instanceof social_abstract_1.NotEnoughScopes)\";
+if (code.includes(oldCatch)) {
+  code = code.replace(oldCatch, newCatch);
+  fs.writeFileSync('$OAUTH_TARGET', code);
+  console.log('OAuth error logging patched');
+} else {
+  console.log('OAuth patch pattern not found, skipping');
+}
+"
+fi
+
+echo "=== Patching complete, starting app ==="
+
+# Delegate to original entrypoint + CMD (nginx && pnpm run pm2)
+exec docker-entrypoint.sh sh -c "nginx && pnpm run pm2"

var/docker/docker/temporal/Dockerfile

@@ -0,0 +1,27 @@
+# Temporal Server for Hugging Face Spaces
+# Uses official auto-setup image + nginx gRPC proxy on port 7860
+FROM temporalio/auto-setup:latest
+
+# All build steps run as root
+USER root
+
+# Install nginx for gRPC reverse proxy (port 7860 → 7233)
+RUN apk add --no-cache nginx
+
+# HF Spaces runtime directories
+RUN mkdir -p /data /run/nginx && \
+    chown -R temporal:temporal /data /run/nginx
+
+# nginx config: gRPC proxy on 7860 → Temporal 7233
+COPY nginx.conf /etc/nginx/nginx.conf
+
+# Startup script: nginx + temporal auto-setup
+COPY start.sh /start.sh
+RUN chmod +x /start.sh
+
+# Clear base image ENTRYPOINT so our CMD runs directly
+ENTRYPOINT []
+
+EXPOSE 7860
+
+CMD ["/start.sh"]

var/docker/docker/temporal/nginx.conf

@@ -0,0 +1,25 @@
+# Nginx gRPC proxy for Hugging Face Spaces
+# Proxies gRPC traffic on port 7860 → Temporal Server on 7233
+pid /data/nginx.pid;
+error_log /data/nginx-error.log;
+worker_processes 1;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    access_log /data/nginx-access.log;
+    server {
+        listen 7860 http2;
+        server_name _;
+
+        # Proxy all gRPC traffic to Temporal Server
+        location / {
+            grpc_pass grpc://localhost:7233;
+            grpc_connect_timeout 60s;
+            grpc_read_timeout 300s;
+            grpc_send_timeout 300s;
+        }
+    }
+}

var/docker/docker/temporal/start.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+set -e
+
+echo "=== Temporal Server on HF Spaces ==="
+
+# Start nginx (gRPC proxy: port 7860 → 7233)
+echo "Starting nginx gRPC proxy on port 7860..."
+nginx
+echo "Nginx started."
+
+# Render the config template
+echo "Rendering Temporal config..."
+dockerize -template /etc/temporal/config/config_template.yaml:/etc/temporal/config/docker.yaml
+echo "Config rendered."
+
+# Run auto-setup for schema migration (exits when done)
+export SKIP_DB_CREATE=true
+echo "Running Temporal auto-setup for schema migration..."
+/etc/temporal/auto-setup.sh
+echo "Auto-setup completed."
+
+# Start the Temporal server directly
+echo "Starting Temporal server..."
+exec /etc/temporal/start-temporal.sh

var/docker/docker/temporal/temporal-mtls/ca.crt

@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFMTCCAxmgAwIBAgIUHE8n33VQ5hENc+MWXIjBy1KV/f4wDQYJKoZIhvcNAQEL
+BQAwJzEPMA0GA1UECgwGVG95S2l0MRQwEgYDVQQDDAtUZW1wb3JhbCBDQTAgFw0y
+NjA0MjAwMjQzNDRaGA8yMzI2MDIwNzAyNDM0NFowJzEPMA0GA1UECgwGVG95S2l0
+MRQwEgYDVQQDDAtUZW1wb3JhbCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
+AgoCggIBAImRQd1sgtMdnjysDGC+W2/pywJojYSxvnL7Ke9yv5Q3cDWnoxegXG2l
+DaImLShcCuKyNvYtYpKAq2NLzT8ZcaYICOmK9KqocMDtMEn6QUFFC+VoBSy/4JC9
+CAr5mEg8g1pZ/bV2xqaGoBLirHMvv2RAvWPnfnYINEU477WsOR29XkaeYOzn/xUF
+mMDzgBX7edwvOYeUpLK520+Nn/kYE7XYEOMBNv5d9zP8Vo56wj8rmUZsGhdv6/3n
+aS4YzHV9KrViJzcsJ7aevqNLbNgihftq48oxtk0YKDuZVNFn6X1tmO9XYqEeXqeo
+Xnbl9Qn0oFFYivGR08AKQNs+b21XLTyR+vkFUzC2Eg9xCFJ9NxzheTJwKxTm0iXg
+lr6cfC+hY2Z7i5cKQ1yr5XEcyvIg9ybNupYIX/GS0fxmDmDWskR8CPgQlSXQnW0n
+lipAvLIyeaQM2n949nXV7UAkPtNrksmYO55QeVwxb7UzLymDic7IJXZwUMsaQksK
+R8s8G5El5sBKmncHGMisoajUa0QkOicxL7WIBd9y9/dbxhqhStiYnB/o7VdYTnXL
+9oxDA2SA9xTOXBzv0b/3ItvrXOPjzV2mkbxaKRA0aaZ+/dV0wbpFYBln7kESogqA
+c+RvazsR/8j95wuMinGecgGjEI+bawWvPP39GH+Nq8A/LLigvzwVAgMBAAGjUzBR
+MB0GA1UdDgQWBBSnBwXrR7lOfjmHVLh86DRn1oJa+jAfBgNVHSMEGDAWgBSnBwXr
+R7lOfjmHVLh86DRn1oJa+jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUA
+A4ICAQAIr442UkCGH48B+qmtr7u9tGZuVpc3SL1RIlVO684I52g33u1+AVfBd9vd
+JQnbw+O8zm+5j6+CA72OjP1Ixf/ejSm3MGtQPHa0SNdG757EuvAO7DJw7TJe8uLO
+DAonqIWlv5Q4jw9C2ATqvHSRghn2eHgi2zvOlGSo31v7dVIret0hlyHiTte0urY0
+p8H4kjZyb4SMIAPFgrSaO1XMuFPCEaS210LofZP/Pb6OyOqxYu0o97Bif/jJ55+b
+87uTcghg2xue7qJRS30XoXzct1kt0i8sEe9+VYb1e9JOg0Ktl6kp1UNtDXJCaNrL
+5GWZ7T3rz4usHxFrRl9x1edvZGwjiuleAHEH83P63c/Zwt5Z12WFrxBxv90I7T88
+w3/ElgiK3b9hg7jz1RRO5BHG+anMOxDbYXunbxq5c3jABJpHG02EA1kFbh0b4oo0
+0E02Xq2cIowX2p9KCGhJEjLdMYfSalpq7TilbpB++NP09xi1L0TwmPYEyZjyf4Qw
+QiHwqiV6N/6CXfuDGoh1aCusxLFK5oBosF2uY+aH4lQUnMG4JUpM+DERKyJ/40QS
+JLJQviNbCqvAqdMxajDD+b/hxQK5tUF4LHWGfiWP7CAPM1Ykz9kPCsJLKcqX4IaY
+w4etgtcaaoSWrXB2Pa7aCN1wxNCegmXvexgaU2Dc5Xt74gLx+w==
+-----END CERTIFICATE-----

var/docker/docker/temporal/temporal-mtls/ca.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCJkUHdbILTHZ48
+rAxgvltv6csCaI2Esb5y+ynvcr+UN3A1p6MXoFxtpQ2iJi0oXArisjb2LWKSgKtj
+S80/GXGmCAjpivSqqHDA7TBJ+kFBRQvlaAUsv+CQvQgK+ZhIPINaWf21dsamhqAS
+4qxzL79kQL1j5352CDRFOO+1rDkdvV5GnmDs5/8VBZjA84AV+3ncLzmHlKSyudtP
+jZ/5GBO12BDjATb+Xfcz/FaOesI/K5lGbBoXb+v952kuGMx1fSq1Yic3LCe2nr6j
+S2zYIoX7auPKMbZNGCg7mVTRZ+l9bZjvV2KhHl6nqF525fUJ9KBRWIrxkdPACkDb
+Pm9tVy08kfr5BVMwthIPcQhSfTcc4XkycCsU5tIl4Ja+nHwvoWNme4uXCkNcq+Vx
+HMryIPcmzbqWCF/xktH8Zg5g1rJEfAj4EJUl0J1tJ5YqQLyyMnmkDNp/ePZ11e1A
+JD7Ta5LJmDueUHlcMW+1My8pg4nOyCV2cFDLGkJLCkfLPBuRJebASpp3BxjIrKGo
+1GtEJDonMS+1iAXfcvf3W8YaoUrYmJwf6O1XWE51y/aMQwNkgPcUzlwc79G/9yLb
+61zj481dppG8WikQNGmmfv3VdMG6RWAZZ+5BEqIKgHPkb2s7Ef/I/ecLjIpxnnIB
+oxCPm2sFrzz9/Rh/javAPyy4oL88FQIDAQABAoICADqv58flD2iuJX/frAYnn01+
+kTctUFZQF53ozWqT6uv5vJp/MiIVrOivtcG7hJ9HqPMuMSlTkk5KqxMY1u441hWN
+LvQm7hrR8gw0A9pDc0w7fwg2mKKPFufYZNJ9yXvjqOvGIWilS7jmDOsRnZ0kPQOx
+ZLp2myoSdO4lDIpV9yXbUBlTXqkijd0zfoeuObHnDwUidmoDPUHr7QYitqDnJx14
+GDgnoATjJF8eovR0pWKaoHB9FKJ0AlrWurXKKYtjwvEPdwhgA28yiMSUHFKWY88u
+ug/bplh8WkmWr6sIKAF03H4aqv5uPNZMi0Qw9RjyreQWIGxPGGVAWovNtm6QdsDU
+q+ezR6U/xUCAEXNOYjelEyTVn6r+ZsXkpIeHAu/Xc13hRaCkniE1HWPYI+/nAjsE
+DgT/3ncX15X9uleclZNcjcIFGWjgkBwWLWeU7qSptUdfsToTcHhLsZ3HL2afapEJ
+PDJz3Lfg1XcmE9iWyw/++rdigQ3h1mIAvPCzyS4usSAkhsU4Ue4jdqaU7Y1djhup
+fT/amjsCtSAONByQWth5PRDt5vgq+WnqBrb7rb6IRHBLAxPSgDAn7WZtIDTNCfZY
+X2xbBs9QKGeieuEGr86bmGy+o6xzCpJhMLPTL60SxVSK8tvvXG2ZzRGftEptd0BQ
+YZvcTRJPB7UlfhPUBZcvAoIBAQC9c/+1haOFtEFIP40ikOYiYSRfeLvIhSHOEwj2
+6sdBNyopFQ6GIz8D5cEskWGdANzqkx80iKRPKelv9CiW2acXJp6yMr+SWxWe51YH
+Zh3YpoaGzMSmVmVnCfwlz779fCGjfM4Z/qlNPI3xQ5cjCsgHP/Tt5f7+6L6a6wDV
+3iYxgAIku8s+6QlmDnUlchBGh7bOvOOfrt4oBcPMbZKioj/EttcwdqnBbffURy4n
+FrH0woyMrrX7/DaLIxsUll1b1FpHhZkgYTZ3sF/ub2eJ26V+awVdWXJ6kGLJy5Jk
+BOxuSU2XDhT3xiLyEkUPj6hlK8R4PUsh+2ZgNhoTdIpM9WHXAoIBAQC545eiQzdH
+jhkxfObi7u8XFHwZo02Td/h4zmWg23rglKSzFg6tre15DrVw7M9z4wFFCA6fsN9k
+u4Tu3/x+xs0uJ7VXfFN2r43JpwZ9W/eZSKkEfBN1xP1rF91uEm/Tm9GGAWD8C8Vj
+DMGK/RF1Ld7MjiZ14fEYYEja2az6SpEUInus6ggqORd4q/g4joSz2jZo5TxMJz+o
+Yt5sz5JOIfQJ6LdYIAoQsqfvwks6wJDs16h1zS+F+Hsa0CQlD84ZoXllAqduZrFx
+06S6/eB0aVl/P5vGkEFlNZqfOuMlwHfZNvd8s0IS6DNr9PpaI6hQZW4Opterj3Tg
+1qMPcmpKtevzAoIBAQC48Mvmf5apptUzmhZEb/64AOxo5osprAzcBmjx4S6x0xAt
+GokbGL0jKN3yi9kmUvlVZFlKBzmereNbjpUw7TfXubOhcTjhvljUzi+E+YKZQ7Z/
+UNWHKz/B3lVu8+YVvV95IRRw+9B5vWsy4jBf3N53dU+8DJFodfvbbx1ZqYrPN47g
+HRLDTuoF3octDrQkpccm+e2arDHiD/6bSTuj1484kORwQuZkFN2hM/sx3U3LCT/6
+9XJhkkwMdzCwYDiytBGNUDWzDjMFk/+R2t7QDML5LbAG+JJwYxKMu1UknknPP2+m
+zfBaD+l9NaiFEE/qs1cPqYX2nlvKAAZkh5eamM/xAoIBADNvbEezvZoJEaOF4gUt
+A+8o9eXKL+78JT6YLbrCwE9gEeqT0d/w3mK+1Sm3/Pcd+v306sb5E/c1g+TtCVqy
++5cn2Z+pgRa4IM2Jb9xEFFDPsCTTiDbwGQcHBXgtlc/Br8oam5FiWG2929fvimMY
+HCwRsUaxDBsomUAlNx3SgC5IFFyWLUgxn/L98qMDnGh/msqPk42m1pBrOwx0qxD/
+iB0tzX2O7/oK1TkcU+Cf4/oE+lIOQnYZeUbEDRxMMUUaTxLKFzYPKE5Mt6oeEXtk
+oyT4nsvkopO0r2Ib0zpg9UifUv+oQkIlCgV3Nca3Ux1b04YuWELaYQbNnTTq/cpK
+aE0CggEBAIXofAjHRHM+mUEXuJig8VGC7seImS2bVmxxM5FWQVfmKM8Ga4DzBmPi
+CtFGMFhC8QZ3gxhqPIYbTq6U30ma2lB4FB7pKkvvw6qUOwy7d4UwW06XZOsixjeS
+Dw+juGqOPGEBVeCn7zghvrnOK6MiTf0h5GJ6U362gJ0JWrUB2EODiL89JBhjv133
+NxitVtrwFZp/IA0bhpdp0tRJ0OqphUgnlIh59v2C0vN/+udLqHJtnCP06W2SxFNa
+Irlv7nYD9h3+Ue8EP8wv30AgMU0/I1RfLmYOaXPfgVga8PUBRyGtjWaSLXrO+xgO
+HD456gOreRjaJ49/b7TWQ9sJWQ5OC4E=
+-----END PRIVATE KEY-----

var/docker/docker/temporal/temporal-mtls/client.crt

@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFNzCCAx+gAwIBAgIUPzS3u6pIJN+Nx8yKmJeCaG2RstUwDQYJKoZIhvcNAQEL
+BQAwJzEPMA0GA1UECgwGVG95S2l0MRQwEgYDVQQDDAtUZW1wb3JhbCBDQTAgFw0y
+NjA0MjAwMjQzNDRaGA8yMzI2MDIwNzAyNDM0NFowKTEPMA0GA1UECgwGVG95S2l0
+MRYwFAYDVQQDDA1wb3N0aXotY2xpZW50MIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
+MIICCgKCAgEAweQD67LuXudFvtdsTj0mOHwXsRg41doU/Lvo/7UohZ7hKiSQ1XNH
+0XdNtXNSHre0CDmnL1W7XibmdpXj1KPfs1Ab7SSCMay+TpeP+kuSA1LstZnqkIkP
+zQz+lxhmVWVIcGBGClnvwGiF4RpHdOO4nmCdC4I9Gu0eoIZpQisZ5KouqvYulaEK
+EboV42b9YHeDzfUT7Wlt0hU9qO+At1sgQiSM52LYHcz3Rvw78xrV9ufwIuXNtIcq
+rSjURzCWzgcpd4HKyDmfIf4wqsR+fey2wlGg2FutXWt3SdK6vZLUk7I1Melxh3PB
+1R2EA5762fXYwqFvB1wFtj/VRXW9noYR19+jp4S6DIvmO3zYx3pCMfe1mguRHciL
+HRlMLuQzJ7PhBY8vBLuFBnG3mpbUlanPoxSpudHZF3u/7RUbiReTvlhCj2/BW+cX
+e8fjcHC6n66Hu9JydPHuABf06eP7DIv1W70w+dShyI3oPsCCW/YD035LZRt9uMJY
+vbiAeXmN7vxsu0Por7WpeG5N1PPDyWPdczUaTudSQErha48zhE0C2GT4eXKwI7WU
+yXEWBLxPkw2hRC0d3DJCccQ7YrfcU//v43BKSIyIWCw19PnTN3Sp1De+50C1TF34
+wbDFvK/oBsjyXNhMyhDhTDsm1b+zLjqzshaieH5uDxQ76ZHo1pf28wkCAwEAAaNX
+MFUwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFCWx9hhlcMg523HTB9sE
+ozwIo1XsMB8GA1UdIwQYMBaAFKcHBetHuU5+OYdUuHzoNGfWglr6MA0GCSqGSIb3
+DQEBCwUAA4ICAQAERGTLMEm7nlYt8OJAvggzyfmdVzLELtbYVTcA3SVQS/lW0+SA
+iYNbLyeXeEuu3SG+pavd97NCxFpDofwm7UN3CCJf2e5RLGZmiC9omVMxk1/ItK5J
+lA0DGN3JdgU0wYinsOhBm0CXgWl7JnGMrYibGlZLeGTRl/El0JSD1j3U41ajA+Df
+I85HVMESEMo+rYEDxTwQEVvYcRQEc+SnOPqIXOx6Hd/f7066mL9kMBTCkRn5I67B
+h02GKAzYiSl4NLZo6xxsD/uH2WkD2l8EbubLteq0yoIvXtwtr8kom4npwwnYj2yL
+eVEbjUzGtoJRbUykcXmSMAdQvDA5b/Gf0szz9ansZLktG/9xR84NwVFAV+snAuDK
+NKcGnV/BdRThlx4aPkb2A58MOnmpwTKXm20iWl0xEWNEk7/w/rx4oTM/uhm9k4hV
+2St9mpfPgzSV+P+R5H8GJbBaUYfJveoMjYySbepho5KMWGdW5Hgy20d1Yf1nWHq8
+K7vKMGf7+mrcSHO9J9qKzy0MrWqGqsl5w212GUoQ8W7Hxiz+QGI3t7nRgqNMAmur
+7z0yy7lWP1zn+X9IvXL1uWZVVAEHGXkn+5j4QNds4KXYuXQdoVyGLxkPk+EbXuYd
+5/ItUty/mwe6l7NXKonFwCoTpao9rF239O+KCDhdh0Z/ew4yntkxkyXW/A==
+-----END CERTIFICATE-----

var/docker/docker/temporal/temporal-mtls/client.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQDB5APrsu5e50W+
+12xOPSY4fBexGDjV2hT8u+j/tSiFnuEqJJDVc0fRd021c1Iet7QIOacvVbteJuZ2
+lePUo9+zUBvtJIIxrL5Ol4/6S5IDUuy1meqQiQ/NDP6XGGZVZUhwYEYKWe/AaIXh
+Gkd047ieYJ0Lgj0a7R6ghmlCKxnkqi6q9i6VoQoRuhXjZv1gd4PN9RPtaW3SFT2o
+74C3WyBCJIznYtgdzPdG/DvzGtX25/Ai5c20hyqtKNRHMJbOByl3gcrIOZ8h/jCq
+xH597LbCUaDYW61da3dJ0rq9ktSTsjUx6XGHc8HVHYQDnvrZ9djCoW8HXAW2P9VF
+db2ehhHX36OnhLoMi+Y7fNjHekIx97WaC5EdyIsdGUwu5DMns+EFjy8Eu4UGcbea
+ltSVqc+jFKm50dkXe7/tFRuJF5O+WEKPb8Fb5xd7x+NwcLqfroe70nJ08e4AF/Tp
+4/sMi/VbvTD51KHIjeg+wIJb9gPTfktlG324wli9uIB5eY3u/Gy7Q+ivtal4bk3U
+88PJY91zNRpO51JASuFrjzOETQLYZPh5crAjtZTJcRYEvE+TDaFELR3cMkJxxDti
+t9xT/+/jcEpIjIhYLDX0+dM3dKnUN77nQLVMXfjBsMW8r+gGyPJc2EzKEOFMOybV
+v7MuOrOyFqJ4fm4PFDvpkejWl/bzCQIDAQABAoICACWeY2JaQ6SXM7GM438knyNL
+dF9QZ0qatwK4RMNEN1oBkwdVs+IuLUuHXcTsXI0IMH5+DSGCfUmNu55bg6pQp0kH
+rHts33Pa48uk3XL/MZPChZnQhLHJXg73S/gt7ED6Vz0yeLRucbV/siYULrQPsNTN
+wvqmKMvuIMide5OygCIdINPb0vsGFUmONMv7wgJy/dg6ikTAdWXS6DU8TtmEbTRY
+GhyU0YCqsXmM2+bVmJkAtFdZBfnWVeHl75XmaAQOYK3GuXzyrRzv0Cp52F7/TBBU
+vSPtWawr+yeQItpAQE1twKNv+y6AN6XtRZ1cPaiHaiiNINkpMhSDuxHwf7tfoNtO
+m/k1ZFUFLkpFNfHrOjh5fKJcZ1hqgtIrVlgQfyYDd5rUB5Ol6KHotsOarBTQ2vmz
+9hi4VJvQnlB4E/1nossfxQlceUPxsjKXUVVYR8ql+0DnS0qCZh3/G/Kv6VV59qzh
+N+v6D1E/WBXA82c9771NXExDBB2VxESs2stUYVng9Q6KkzIuyAy8ptkIw1w9ciWN
+5Ymmdancg1L2aqZMVvlOEp9simI+mssl65o4O/k5fKnksi0qgW0lLOavh9DZMEag
+Bi0eUJwGoEg2RdjNeExHwaTD8LBwHkMqmI3ySjCtZfUlv4rIknCSIyNMZL+GS8xs
+qdVqUCgYopzJh0yLlVOvAoIBAQDhODPkt+vdCWnCKzlBC1r35Jh+kmff6MJ7C9x+
+lmSyUGy7Waj+MTyhJk6opYZ1gHld57rYiRqhNr0RF708GVHYyQLdf8wP1FMjHQ6Y
+RolE8XEjEOuG+QhQVzIgK2czMbbcXQXHX36hpisEQvKCbBYVqZ/2RTfOGZo/af48
+SLuJFhdU1s8T2moRjfWIErvcTdRr0gxLT9Qz2iAq6WIrzcTAcAyFwxvxZCD/DUMP
+YK0hYjFM1F+8TXp9m4+Nbn59b04Agg2Jb43I1s2jW/IzZjaJcVJxFzFaKP9Gocm8
+vaCwh0kSkuMdKIo4bbab7IxvMX+B0++GPq4k7Pky74hb7lGjAoIBAQDcY7RDsrcV
+79NhTbr5uOeIx0ZdQXRt6MZ3i6QcCtu8sBGfSdgCnn7DJ9Lu0wg4MGN8jr54MYik
+VeMcMf3a2aCKTZYVetd250Qx+oXudLu1TIHHH7TFK3/+lH2xwGCY0GQu6txTVe6q
+zzTxoH+97H6fSm5bLev+ObbDTF+dDIqwtwRB0kW9b8GxL2pV48mnxBEE/p+F2M0R
+Diud/5EXqz5xv8VbIybkXyuENYyopqwSXDfxkdtQNLGQSimB0N7H6HFu1wPok8P9
+wTRFpMeJ5tF957LBzBoDGlYILedljtzY+gzXrlClwzld9hXbm8pz1VT9OyFfZR1+
+ZhfmLLan/StjAoIBAHOpwnTOw9HTeL3gJtoxs7kla+9szu3eAqrgj49vOy2cQgsB
+Y9mPfbyhCLpxr5j+rtW8IWf9GXD7xKNXlrabpj34FYGdlTX36+5XiNxJNUvz1w+U
+K/E4Sb3A2hxNTgWrnWaUW1hlwYnQ5bydiR/T1I+xelYmfB9bZKz2iTt6et1PPBI0
+80oV3G1Bg3wratEcI2BwEiJHUAqFFgoTq3glh8rwgG3doqcYrh1uOSdXlfJUFE+J
+rdTt0V9amaGfwlQ26k82ey8+3Ajtz9P6b2tYLd/uE9HCgHT2IwuqIQnONQ0TnUJt
+rzeVT07lgWeYVxLvz7TkG9nMrPCHxv8SpuvXe5MCggEAIe8sM3xSGouZ5ZKdZpQk
++neMixFoBwBfhsq2kybM3MnTfM5W91hGNnBsVx+hVV2GBAjKpSEjZAJhfNbpuofl
+40W9BUOr54AGjReBBc1tlaXZGbr1D6L6C0376KGxffYgZuT81cwWerB6+3V2Fd1T
+Rd2lDl8MxlFGpd2dn0XuGPWlLylcWaXakhi169GuHCnhYP5/u5E9ShH/f015nsZc
+UBFyJu1LsMBCqBHCvbkkJ5ORfZ2ywi/K42e36mgp1WgiByoOTQJrnCfij5KmssIa
+oaNKb/KoUq/8bTf8ODP+J16hGZiajFt5+tDIXs8nJhzEAFXZdqHQH8VCist5uHYP
+9wKCAQA0AgsC8MO1GO9IFUMDTTcU0L96vSJKXX+JaC0TQFbbxzh7EfI4sPpRzUn3
+JB/fdroEASc8yDixK+VqonC+ns2mZKU8+97EXAYeFFt9tBmhKygnishtbI84Hqx+
+m6JQRcj8Or1eyhpwL4bjovTT9jp7rUvoTAkUz8soeHfWWibxePHrq/8RIvqcTph9
+c5wF8mCXI5E99S/3bakfdlIxOhcztBoqCt3t4EODTAY4OTGB/iybRAcLvycOPCYB
+jPigiID045aEkejZc8NemMBeIIgGaP+lZeQ/oetG8M+v6zE9A6nPweCDWfXUHVDi
+3yLdOa7h/8e15N+x55L8z6vwmA/S
+-----END PRIVATE KEY-----

var/docker/start.sh

@@ -104,6 +104,28 @@ if (code.includes(oldCatch)) {
 "
 fi
 
+# Patch youtube.provider.js to remove youtubepartner scope
+# The youtubepartner scope requires YouTube Content ID access which normal accounts don't have.
+# Google silently drops it from granted scopes, causing checkScopes to fail.
+YT_TARGET="$PATCH_DIR/libraries/nestjs-libraries/dist/integrations/social/youtube.provider.js"
+if [ -f "$YT_TARGET" ]; then
+  echo "Patching $YT_TARGET to remove youtubepartner scope..."
+  node -e "
+const fs = require('fs');
+let code = fs.readFileSync('$YT_TARGET', 'utf8');
+const scope = 'https://www.googleapis.com/auth/youtubepartner';
+if (code.includes(scope)) {
+  code = code.replace(\"'\" + scope + \"'\", \"/* removed: '\" + scope + \"' */''\");
+  // Also remove from the generated auth URL scope list
+  code = code.replace('\"' + scope + '\"', \"/* removed: '\" + scope + \"' */''\");
+  fs.writeFileSync('$YT_TARGET', code);
+  console.log('youtubepartner scope removed');
+} else {
+  console.log('youtubepartner not found in youtube provider, skipping');
+}
+"
+fi
+
 # Write a global Node.js preload script to extend undici fetch timeout
 # HF Spaces has intermittent connectivity to external APIs (e.g. Discord)
 # Default undici connect timeout is 10s; we extend to 30s