Queen Raida Manager

Queen Raida Manager is a narrowly scoped Devvit Web moderation integration for r/Veydrift. A trusted Prism Gateway service can create text posts, create comments, and approve or remove posts and comments through authenticated Devvit External Endpoints.

All Reddit writes execute explicitly as the Devvit app account. This app does not vote, send private messages, scrape Reddit, or expose general-purpose Reddit API access.

Security boundaries

• Every request is rejected unless its Devvit installation context is r/Veydrift.
• Every payload must also name Veydrift exactly and contain only documented fields.
• Comment and moderation targets are fetched and verified as belonging to r/Veydrift before any write.
• The only moderation actions are approve and remove; removal never marks content as spam.
• Every operation requires a unique, URL-safe requestId of 8-128 characters.
• Redis-backed request and content fingerprints prevent retry and content duplication. A failed operation releases its ten-minute processing lock; successful fingerprints are retained.
• External Endpoint authentication is performed by Devvit using a managed app token. Tokens must never be sent to a webview or committed to this repository.

External API

All requests use POST, Content-Type: application/json, and:

Authorization: Bearer devvit_at_<managed-token>

Managed endpoints are declared with global token scope because Devvit managed tokens currently only support global scope. The application-level context and target checks still restrict all behavior to the r/Veydrift installation.

POST /external/post

Creates an app-account text post.

{
  "requestId": "prism-post-20260805-0001",
  "subreddit": "Veydrift",
  "title": "Post title",
  "body": "Post body"
}

POST /external/comment

Creates an app-account comment on a post or comment that belongs to r/Veydrift.

{
  "requestId": "prism-comment-20260805-0001",
  "subreddit": "Veydrift",
  "targetId": "t3_example",
  "body": "Comment body"
}

POST /external/moderate/post

Approves or removes one post in r/Veydrift.

{
  "requestId": "prism-mod-post-20260805-0001",
  "subreddit": "Veydrift",
  "targetId": "t3_example",
  "action": "approve"
}

POST /external/moderate/comment

Approves or removes one comment in r/Veydrift. The payload is identical to the post moderation payload except that targetId must start with t1_.

Deployment checklist

1. Request Reddit's limited-access External Endpoints capability for the app. Explain all four routes and the r/Veydrift enforcement described above.
2. Publish Terms of Use and Privacy Policy at stable public URLs, then enter those URLs in the app details form. Once these changes are merged to main, use:
   • https://github.com/raid-guild/queenraida-manager/blob/main/docs/TERMS.md
   • https://github.com/raid-guild/queenraida-manager/blob/main/docs/PRIVACY.md
3. If the Devvit server will make outbound requests to Prism Gateway, add only its exact HTTPS hostname to permissions.http.domains in devvit.json. Incoming Prism-to-Devvit External Endpoint calls do not themselves require HTTP Fetch.
4. Playtest with npm run dev. The configured playtest subreddit is r/Veydrift.
5. Upload the app. In Developer Settings, create one managed app token for Prism Gateway and copy its devvit_at_... secret once.
6. Store that secret in Prism Gateway's secret manager. Do not store it in Devvit settings or application source. Send it only as the bearer token to the installation-specific External Endpoint hostname.
7. Exercise each route against disposable test content, including wrong subreddit, wrong target, malformed payload, forbidden action, repeated requestId, and repeated content cases.
8. Install the approved version in r/Veydrift and confirm the app account has the required moderation access.

Development

npm run test:types
npm run lint
npm run test:unit
npm run build

Account attribution

Managed External Endpoint requests execute as the Devvit app account. They will not appear as posts or comments by u/QueenRaida. If that exact attribution is required, this design needs approved traditional Reddit OAuth and a separate security review rather than an attempt to impersonate that account through Devvit.