five-on-it / apps/api/src/steam

apps/api/src/steam

Steam, as the platform API asks it (TECHNICAL_SPECS §9.6): who a player is, and whether they own the game. Two implementations behind SteamApi:

webSteam (FOI_STEAM=web): Steam's Web API on partner.steam-api.com with the publisher key (STEAM_PUBLISHER_KEY) and the app id (FOI_STEAM_APP_ID): ISteamUserAuth/AuthenticateUserTicket/v1 checks a ticket the desktop app made with GetAuthTicketForWebApi("five-on-it-api") (hex), ISteamUser/CheckAppOwnership/v4 says whether an account has a copy (its own for good, or one lent), and ISteamUser/GetPlayerSummaries/v2 its name; a browser signs in through Steam's OpenID 2.0 provider (steamcommunity.com/openid/login), its assertion checked here (from Steam, for this return address, a nonce never seen and fresh) and then by Steam itself (check_authentication). The key never leaves the API.
fakeSteam (FOI_STEAM=fake, development and the tests): tickets that say who and what copy they are (fake:<steamid64>:<own|shared|none>, :banned after them for a publisher ban), and an OpenID provider of its own that the API serves (/auth/steam/fake/openid: a form of a Steam id and a copy), whose assertions it signs and checks the same way. It is never there with FOI_STEAM=web or off.

Neither is asked by the tests over the network: the real one's tests feed it Steam's answers as recorded (steam.test.ts).

Classes