five-on-it / apps/api/src/steam-routes
apps/api/src/steam-routes
Signing in through Steam (TECHNICAL_SPECS §9.6), on whichever Steam the API has (steam.ts: the Web API's, or the fake; none with FOI_STEAM=off, and these routes answer 404):
| Route | What |
|---|---|
POST /auth/steam {ticket} | The desktop app's ticket (GetAuthTicketForWebApi("five-on-it-api"), hex): the session. |
GET /auth/steam/openid/start?return=<address> | A browser's sign-in: sent to Steam's OpenID, to come back to the address (one of the platform's own origins, never another site). |
GET /auth/steam/openid/return | Steam's answer, checked; the browser goes back to its address with a one-time code (steam_code, ten minutes), never a session, or steam_error. |
POST /auth/steam/exchange {code} | The code for the session. |
POST /auth/steam/link {ticket or code, and email and password or a session} | An e-mail account takes a Steam account: signing in through it then lands in the e-mail account, its drafts and games kept. |
GET, POST /auth/steam/fake/openid | The fake's OpenID provider (FOI_STEAM=fake only): a form of a Steam id and a copy. |
A sign-in asks Steam whether the account has a copy and keeps the answer (entitlement.ts); with FOI_ENTITLEMENT=steam, an account without one (or banned) gets no session: 403 with why (code: not-owned, banned) and the store's page (store), no account made for it. A Steam account is an account of its own (steam-<steamid64>) unless an e-mail account linked it first; one that already signed in on its own is never linked (its account would be left behind).
The OAuth sign-in page (oauth.ts) signs creators in through Steam the same way, by the SteamSignIn these routes return.