Tactical Media Broadcast Hub — initial release

Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.

MIT licensed. See README.md and docs/.

apps/api/src/connections/connections.controller.ts

@@ -0,0 +1,84 @@
+import { Body, Controller, Delete, Get, Inject, Param, Post, Query, Req, Res, UseGuards } from "@nestjs/common";
+import type { Request, Response } from "express";
+import { RbacGuard, RequirePermission, type AuthenticatedRequest } from "../rbac/rbac.guard.js";
+import { optionalString, parseId, requireObject, requireSession, requireString } from "../http/validation.js";
+import { ConnectionsService, type ConnectionSummary } from "./connections.service.js";
+import { AUTH_TTL_MS, stateCookieName, validState } from "./pending.js";
+
+@Controller("connections")
+export class ConnectionsController {
+  constructor(@Inject(ConnectionsService) private readonly connections: ConnectionsService) {}
+
+  @Get()
+  @UseGuards(RbacGuard)
+  @RequirePermission("connection.view")
+  async list(@Req() request: Request & AuthenticatedRequest): Promise<ConnectionSummary[]> {
+    return this.connections.list(requireSession(request).workspaceId);
+  }
+
+  @Get("providers")
+  @UseGuards(RbacGuard)
+  @RequirePermission("connection.view")
+  providers() { return this.connections.providers(); }
+
+  private redirectResponse(response: Response, authorization: { redirectUrl: string; state: string; binding: string }) {
+    response.setHeader("Cache-Control", "no-store");
+    response.cookie(stateCookieName(authorization.state), authorization.binding, {
+      httpOnly: true, secure: process.env.NODE_ENV === "production", sameSite: "lax",
+      path: "/connections/callback", maxAge: AUTH_TTL_MS,
+    });
+    return { redirectUrl: authorization.redirectUrl };
+  }
+
+  @Post("authorize")
+  @UseGuards(RbacGuard)
+  @RequirePermission("connection.manage")
+  async authorize(@Req() request: Request & AuthenticatedRequest, @Body() body: unknown, @Res({ passthrough: true }) response: Response) {
+    const input = requireObject(body, "authorization");
+    const authorization = await this.connections.authorize(requireSession(request), requireString(input.provider, "provider"), optionalString(input.instanceUrl, "instanceUrl"));
+    return this.redirectResponse(response, authorization);
+  }
+
+  /** Deliberately outside RbacGuard: the provider's browser redirect carries no bearer header. */
+  @Get("callback")
+  async callback(@Req() request: Request, @Query() query: Record<string, unknown>, @Res() response: Response): Promise<void> {
+    const state = typeof query.state === "string" ? query.state : "";
+    const name = validState(state) ? stateCookieName(state) : "";
+    const cookie = name ? (request.headers.cookie ?? "").split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`))?.slice(name.length + 1) : undefined;
+    let binding = "";
+    try { binding = decodeURIComponent(cookie ?? ""); } catch { /* Malformed cookies fail state validation. */ }
+    const location = await this.connections.callback(state, binding, typeof query.code === "string" ? query.code : undefined, typeof query.error === "string" ? query.error : undefined);
+    if (name) response.clearCookie(name, { path: "/connections/callback", httpOnly: true, secure: process.env.NODE_ENV === "production", sameSite: "lax" });
+    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("Referrer-Policy", "no-referrer");
+    response.redirect(303, location);
+  }
+
+  // Public endpoint spelling is API routing, not provider behavior branching.
+  // eslint-disable-next-line no-restricted-syntax
+  @Post("telegram/bot-token")
+  @UseGuards(RbacGuard)
+  @RequirePermission("connection.manage")
+  async botToken(@Req() request: Request & AuthenticatedRequest, @Body() body: unknown): Promise<{ connected: true; token: string }> {
+    const input = requireObject(body, "bot token");
+    const id = optionalString(input.connectionId, "connectionId");
+    const channelId = optionalString(input.channelId, "channelId");
+    const token = await this.connections.botToken(requireSession(request), requireString(input.token, "token"), channelId ? { channelId } : {}, id ? parseId(id) : undefined);
+    return { connected: true, token };
+  }
+
+  @Post(":connectionId/reconnect")
+  @UseGuards(RbacGuard)
+  @RequirePermission("connection.manage")
+  async reconnect(@Req() request: Request & AuthenticatedRequest, @Param("connectionId") id: string, @Res({ passthrough: true }) response: Response) {
+    return this.redirectResponse(response, await this.connections.reconnect(requireSession(request), parseId(id)));
+  }
+
+  @Delete(":connectionId")
+  @UseGuards(RbacGuard)
+  @RequirePermission("connection.manage")
+  async remove(@Req() request: Request & AuthenticatedRequest, @Param("connectionId") id: string): Promise<{ removed: true; token: string }> {
+    const token = await this.connections.remove(requireSession(request), parseId(id));
+    return { removed: true, token };
+  }
+}