feat(linked-roles): Discord OAuth, BFF enqueue, account UX

example.env

@@ -8,11 +8,15 @@ BUNGIE_CLIENT_SECRET="" # Required for login
 # RaidHub API 
 RAIDHUB_API_URL="http://localhost:8000" # Defaults to https://api.raidhub.io when not set
 RAIDHUB_API_KEY="" # Required for accessing public domain, not required if self-hosting
-RAIDHUB_CLIENT_SECRET="" # Required for accessing admin routes, can be set to a string of choice if self-hosting
+RAIDHUB_CLIENT_SECRET="" # Admin/internal calls: sent as x-raidhub-client-secret (not in JSON). Match API CLIENT_SECRET if using linked-role sync.
 
 # Additional OAuth Providers for account linking
 # DISCORD_CLIENT_ID=""
 # DISCORD_CLIENT_SECRET=""
+# Same Discord application as OAuth client (for linked-role PUT). Defaults to DISCORD_CLIENT_ID if unset.
+# DISCORD_APPLICATION_ID=""
+# Metadata key registered in Discord Developer Portal (integer field → string value in API).
+# DISCORD_LINKED_ROLES_METADATA_KEY=raidhub_total_clears
 
 # TWITCH_CLIENT_ID=""
 # TWITCH_CLIENT_SECRET=""

prisma/migrations/20260503213000_discord_linked_roles_sync/migration.sql

@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "account" ADD COLUMN "discord_role_metadata_synced_at" DATETIME;
+ALTER TABLE "account" ADD COLUMN "discord_role_metadata_sync_error" TEXT;

prisma/schema.prisma

@@ -76,22 +76,26 @@ model Session {
 }
 
 model Account {
-  id                String  @id @default(uuid())
-  userId            String  @map("bungie_membership_id")
-  type              String
-  provider          String
-  providerAccountId String  @map("provider_account_id")
-  displayName       String? @map("display_name")
-  url               String? @map("url")
-  refreshToken      String? @map("refresh_token")
-  accessToken       String? @map("access_token")
-  expiresAt         Int?    @map("expires_at")
-  refreshExpiresAt  Int?    @map("refresh_expires_at")
-  tokenType         String? @map("token_type")
-  scope             String?
-  idToken           String? @map("id_token")
-  sessionState      String? @map("session_state")
-  user              User    @relation("UserToAccount", fields: [userId], references: [id], onDelete: Cascade)
+  id                           String    @id @default(uuid())
+  userId                       String    @map("bungie_membership_id")
+  type                         String
+  provider                     String
+  providerAccountId            String    @map("provider_account_id")
+  displayName                  String?   @map("display_name")
+  url                          String?   @map("url")
+  refreshToken                 String?   @map("refresh_token")
+  accessToken                  String?   @map("access_token")
+  expiresAt                    Int?      @map("expires_at")
+  refreshExpiresAt             Int?      @map("refresh_expires_at")
+  tokenType                    String?   @map("token_type")
+  scope                        String?
+  idToken                      String?   @map("id_token")
+  sessionState                 String?   @map("session_state")
+  /// Last successful push of Discord linked-role metadata (Hermes or BFF).
+  discordRoleMetadataSyncedAt  DateTime? @map("discord_role_metadata_synced_at")
+  /// Short machine-readable error from last failed push (if any).
+  discordRoleMetadataSyncError String?   @map("discord_role_metadata_sync_error")
+  user                         User      @relation("UserToAccount", fields: [userId], references: [id], onDelete: Cascade)
 
   @@unique([provider, providerAccountId], name: "uniqueProviderAccountId")
   @@unique([provider, userId], name: "uniqueProviderUser")

src/app/account/Client.tsx

@@ -1,8 +1,8 @@
 "use client"
 
 import { Collection } from "@discordjs/collection"
+import { AccountPage } from "~/components/account/AccountPage"
 import { ForceClientSideBungieSignIn } from "~/components/ForceClientSideBungieSignIn"
-import Account from "~/components/__deprecated__/account/Account"
 
 export const Client = ({
     providers
@@ -15,13 +15,19 @@ export const Client = ({
 }) => (
     <ForceClientSideBungieSignIn
         whenSignedIn={session => (
-            <>
-                <h1>Welcome, {session.user.name}</h1>
-                <Account
+            <div className="space-y-8">
+                <header className="space-y-1">
+                    <h1 className="text-3xl font-semibold tracking-tight">Account</h1>
+                    <p className="text-muted-foreground max-w-2xl text-sm text-pretty">
+                        Profiles, profile icon, and linked services for{" "}
+                        <span className="text-foreground font-medium">{session.user.name}</span>.
+                    </p>
+                </header>
+                <AccountPage
                     session={session}
                     providers={new Collection(providers.map(p => [p.id, p]))}
                 />
-            </>
+            </div>
         )}
     />
 )