five-on-it / apps/client/src/ui/steam
apps/client/src/ui/steam
The page's side of signing in through Steam (apps/api/src/steam-routes.ts), without React. The browser leaves a page of the platform for Steam's OpenID (steamSignInUrl, the page's own address its way back, and what it went for: a sign-in, or linking an e-mail account) and comes back with a one-time code (steam_code, never a session) or an error (steam_error). finishSteamReturn takes them as the page starts, before anything else reads the address: the code leaves the address at once (history.replaceState), then is exchanged for a session, or used to link the e-mail account signed in, or kept for the e-mail and password the account bar asks (a platform for the game's owners signs no e-mail in); what came of it is kept for the page to say (steamReturn): a refusal (no copy, a ban) with the store's page, never a guest instead.
The desktop app's pages (file://, which Steam cannot send back to) sign in through the app instead (window.foi.steam, electron/steam.ts, signInThroughApp): with its Steam ticket when Steam runs, else on Steam's page in a window of the app's, whose one-time code the page exchanges; once it has, it signs in again by itself with its ticket whenever its session is gone (appSignedInBefore, signInWithTicket).