Skip to content

Ask Kick who you are in the room, since the channel record cannot say - #29

Merged
JRBlaze merged 1 commit into
mainfrom
kick-moderator-standing
Sep 2, 2026
Merged

Ask Kick who you are in the room, since the channel record cannot say#29
JRBlaze merged 1 commit into
mainfrom
kick-moderator-standing

Conversation

@JRBlaze

@JRBlaze JRBlaze commented Sep 2, 2026

Copy link
Copy Markdown
Owner

The bug

Moderation tools — the username menu's Moderate section and the new hover strip alike — never appeared on Kick for anyone except the broadcaster. Twitch was unaffected.

Both are gated on one flag, and that flag was read off Kick's channel record. That record describes the channel, not the person reading it, so the is_moderator field it was checked for is not there. The only branch that could ever fire was "your account name equals the channel name". Twitch works because it volunteers the answer in USERSTATE after the join.

The fix

Kick answers this at channels/<slug>/me, and only to the browser session that asks — probed directly, a request with no session cookie comes back {"message":"Unauthenticated."}. An OAuth token for Kick's public API is a different credential and that route does not read it, and Chrome withholds a SameSite cookie from an extension's cross-site fetch, so the worker generally cannot ask on its own.

So the page asks. The content script is already on kick.com and its fetches carry the real session; it reports back to the worker. This is the same arrangement the Kick emote list already uses when Cloudflare refuses the background request. The worker still tries first — one request, and the only route with any chance of working when Kick is merged into a Twitch tab.

Deliberate choices

  • The answer only ever turns the tools on. Kick publishes no schema for that endpoint, so the response is read generously (is_moderator, is_broadcaster, is_channel_owner, is_owner, is_super_admin, string or object role/roles, moderator badges, each also nested under chatroom, channel, user or identity) and a "no" is never acted on. A spelling that has moved can cost tools that would have been offered; it can never take away tools already given. This also fixes a reconnect wiping the flag and re-announcing itself.
  • A mismatched account is refused, out loud. If kick.com is signed in as one account while the extension holds a token for another, the tools stay off and the feed names both — a ban sent as somebody else is not worth getting subtly wrong.
  • Moderating with no Kick account connected now says so and points at settings, instead of silently offering nothing.

Notes

  • The endpoint is confirmed real and confirmed cookie-authenticated. The field names are the one unverified part: Kick documents none of them, and no logged-in Kick session was available to observe the payload. The parser covers every plausible spelling and nesting; if a real moderator still sees nothing, the response body is the thing to look at.
  • Kick merged into a Twitch tab still generally cannot offer moderation, because there is no kick.com page to ask. Documented under Known limits.
  • 47 new assertions across kickmod and kickmodworker, plus the positive Kick case for the hover strip. Suite: 1625 passing.
  • Version 1.17.1.

🤖 Generated with Claude Code

The moderation tools never appeared on Kick for anybody but the broadcaster.
The flag was read off the channel record, and that record describes the
channel rather than the person reading it — so the only branch that could
fire was "your name is the channel's name". Twitch works because it
volunteers the answer in USERSTATE.

Kick answers "do you moderate here" at channels/<slug>/me, and only to the
browser session that asks: no cookie is answered Unauthenticated, an OAuth
token for the public API is a different credential, and Chrome withholds a
SameSite cookie from the extension's own cross-site fetch. So the page is
asked, the way it already is when Cloudflare refuses the emote list. The
worker still tries first, because that is the only route with any chance on
a Twitch tab.

Read generously and acted on in one direction only: Kick documents none of
these field names, so a spelling that has moved can cost tools that would
have been offered and can never take away tools already given. A reconnect
can no longer wipe the flag either.

The two ways this can be true and still unusable now say so in the feed:
kick.com signed in as one account while the extension holds a token for
another, and moderating with no account connected at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@JRBlaze
JRBlaze merged commit edb139d into main Sep 2, 2026
3 checks passed
@JRBlaze
JRBlaze deleted the kick-moderator-standing branch September 2, 2026 23:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant