SteamAPI Desktop v0.1.0

SteamAPI Desktop v0.1.0

First Windows x64 desktop release. The installer is the recommended download.

Recommended: SteamAPI-Desktop-Setup-v0.1.0-win-x64.exe — standard Windows per-user installation with shortcuts and uninstaller.

Alternative: SteamAPI-Desktop-v0.1.0-win-x64.zip — portable version without installation.

Includes game search using the existing six-field SteamAPI backend contract, API Inspector, local companion API management, Settings, offline Demo Mode and About. The v0.2.0 backend API remains unchanged.

The installer is unsigned; Windows SmartScreen may show an Unknown Publisher warning. Compatible with Windows x64 and includes the .NET 10 runtime.

SteamAPI v0.2.0 - .NET 10 Modernization

SteamAPI v0.2.0 — .NET 10 Modernization

PRE-RELEASE NOTICE:
SteamAPI v0.2.0 is an official pre-release milestone following the completion and merge of Milestone M-001B. This release modernizes the application architecture and hardens networking and error handling. It is not yet production-ready and should be deployed behind an API gateway or reverse proxy with appropriate rate limiting and observability.

---

1. Overview & Modernization Summary

SteamAPI v0.2.0 represents a foundational modernization of the application, transitioning from an unmaintained .NET 6 prototype using obsolete synchronous networking primitives to a modernized .NET 10 service with asynchronous networking, formal request validation, standardized error handling, and resource limits.

Key Modernization Accomplishments

• Runtime Modernization (.NET 10): Migrated all projects (Core, SteamAPI, SteamAPI.Tests) from net6.0 to net10.0.
• Modernized Asynchronous HttpClient Pipeline: Replaced obsolete synchronous WebClient and global ServicePointManager with an asynchronous HttpClient registered as a typed client (SteamService) via dependency injection (IHttpClientFactory). Sockets management and connection pooling are handled by SocketsHttpHandler.
• Dependency Injection & Cancellation Propagation: Full CancellationToken flow across controller actions, service methods, and HTTP client requests.
• Request Validation: Enforced search term length bounds (1–200 UTF-16 code units), non-empty/non-whitespace validation, and supported culture validation (1 = Turkish, 2 = English, 3 = Spanish).
• Standardized RFC 9457 ProblemDetails: Replaced unhandled 500 exceptions and legacy string errors with standardized ProblemDetails / ValidationProblemDetails for HTTP 400, 502, and 504.
• Controlled Upstream Timeout: Strict 30-second HttpClient.Timeout with full body read coverage (HttpCompletionOption.ResponseContentRead) protecting against slowloris-style payload streams.
• Disabled Automatic Redirects: Configured SocketsHttpHandler.AllowAutoRedirect = false to prevent unexpected cross-host redirect following.
• Upstream Response Buffering Limit: Configured MaxResponseContentBufferSize = 1,048,576 (1 MiB) to guard against memory exhaustion from oversized upstream payloads.
• Preserved Successful Contract: The successful JSON response contract is 100% backward-compatible, returning a top-level array of Listing objects with the exact six camelCase fields: name, storeLink, imageLink, price, saleType, appId.

---

2. Breaking Changes & Migration Requirements

While successful POST /steam responses remain structurally identical, several breaking changes have been introduced for invalid or failing requests:

1. Runtime Requirement (.NET 10):
   • Hosting environments and build systems must have the .NET 10.0 Runtime / SDK installed.
2. Search Input Length Limit (200 UTF-16 Code Units):
   • In v0.1.x, search terms of unbounded length were accepted.
   • In v0.2.0, requests with game.Length > 200 are rejected with HTTP 400 Bad Request.
3. Structured RFC 9457 Error Payloads:
   • Error responses now return ProblemDetails and ValidationProblemDetails JSON payloads. Clients parsing legacy error strings or status codes must update error-handling routines.
4. Upstream Error Status Codes:
   • Identifiable upstream Steam failures (non-success HTTP codes, network connectivity faults, refused redirects, payload overflow, and unrecognized match markup) are now mapped to HTTP 502 Bad Gateway (previously causing unhandled 500 exceptions or empty collections).
   • Upstream timeouts now return HTTP 504 Gateway Timeout.

---

3. Verification & Quality Evidence

3.1. Remote Cross-Platform Post-Merge CI Verification

• GitHub Actions Run: 38737417044
• Commit: 04ee2b1b2a1f1dae96d62ac5b5219955f346b197
• Scope: 157 unique automated tests executed across 4 matrix jobs:
  • Ubuntu Latest (Debug): 157 passed, 0 failed, 0 skipped
  • Ubuntu Latest (Release): 157 passed, 0 failed, 0 skipped
  • Windows Latest (Debug): 157 passed, 0 failed, 0 skipped
  • Windows Latest (Release): 157 passed, 0 failed, 0 skipped
  • Total CI Executions: 628 passed, 0 failed, 0 skipped.
• Test Suites: Comprehensive coverage across contract tests, HTML suggestion parser tests, and risk regression test suites.

3.2. Controlled Live Steam Integration Verification

Following GitHub Actions CI validation, empirical point-in-time smoke tests were executed against Valve's live suggestion service (https://store.steampowered.com/search/suggest) under a strict 15-request budget ceiling (Phases 3B & 3D):

• SMOKE-01 (English Paid Title — Portal, culture 2): Returns HTTP 200 with 5 parsed listings (Portal 2 appId 620, price 9.99, saleType: 0; Portal appId 400, price 9.99, saleType: 0). Verified 6-field JSON contract.
• SMOKE-02 (Turkish Regional Search — Counter-Strike, culture 1): Returns HTTP 200 with 5 parsed listings (cc=tr&lang=turkish). Correctly handled Counter-Strike 2 (saleType: 1 FreeToPlay, price: null) and paid titles priced numerically in USD (7.19).
• SMOKE-03 (Spanish Regional Search — Half-Life, culture 3): Returns HTTP 200 with 5 parsed listings (cc=es&lang=spanish). Successfully parsed European decimal-comma pricing (9,69€ -> numeric 9.69) for Half-Life 2 and handled unpurchasable/F2P entries.
• SMOKE-04 (Free-to-Play Title — Dota 2, culture 2): Returns HTTP 200 with 4 parsed listings. Identified Dota 2 (appId 570, saleType: 1, price: null).
• SMOKE-05 (Legitimate No-Results Search — XZYNonExistentGameTerm999888, culture 2): Returns HTTP 200 with empty top-level JSON array []. Confirmed no synthetic records or errors on genuine empty results.
• SMOKE-06 (Encoded Multiword Search — Portal 2, culture 2): Returns HTTP 200 with 5 parsed listings. Confirmed RFC 3986 percent-encoding (Portal%202).
• Local Validation Negative Scenarios: Oversized term (201 chars), unsupported culture (culture: 99), and whitespace-only term were rejected locally by the ASP.NET Core pipeline with HTTP 400 Bad Request and zero outgoing requests dispatched to Steam.

3.3. Phase 3D Live Request Accounting Audit

• Authorized Budget: 15 outgoing requests ceiling.
• Completed Outgoing Requests to Steam: 7 confirmed requests (6 API smoke queries + 1 direct curl.exe preflight).
• Conservative Total Outgoing Attempts: At most 8 (including 1 terminated PowerShell preflight that may have opened a TCP connection).
• Local Validation Requests: 3 requests handled entirely by local validation (0 outgoing requests).
• Audit Conclusion: Successfully completed well within budget (under conservative accounting, at most 8 attempted, 7 requests / ~46.7% remaining unused; under confirmed completed, 8 requests / ~53.3% remaining unused).

---

4. Known Limitations & Residual Risks

1. HTML Scraping Fragility: The application relies on parsing HTML from Steam's web search suggestion endpoint. A major DOM overhaul by Valve that removes the .match CSS class would cause the endpoint to return [] (empty results) rather than an error.
2. Missing Currency Metadata: The price property is numeric only and carries no ISO currency code. In regions such as Turkey, prices may be denominated in USD rather than local currency.
3. No Application-Level Rate Limiting: The service does not implement in-memory request throttling or outbound rate limiting against Steam. Deployments must sit behind a managed reverse proxy or API gateway configured with rate limiting to prevent upstream IP bans.
4. No Production Observability: Distributed tracing, health checks, OpenTelemetry, and Prometheus metrics are not yet configured in this milestone.
5. Compiler Warnings: Four pre-existing CS8618 nullability warnings remain unresolved in CultureValue.cs and GetSteamGameInfoRequestModel.cs.
6. Pre-Release Status: This milestone is not yet production-ready. Further hardening, observability, and contract evolution will occur in subsequent milestones.

SteamAPI v0.1.1 - Automated Quality Gate

• Added GitHub Actions CI.
• Automated Debug and Release builds.
• Added Ubuntu and Windows verification.
• All 196 test executions passed.
• Preserved existing API behavior.
• No application source code modifications.
• Based on SteamAPI v0.1.0.
• Not yet production-ready.

SteamAPI v0.1.0 - Search Recovery

• Restored Steam Store search parsing.
• Added structured HTML parsing.
• Improved regional price handling.
• Added 49 deterministic regression tests.
• Verified Portal searches for US and Turkey.
• Preserved existing API compatibility.
• Known limitations: .NET 6 EOL, synchronous WebClient, undocumented Steam endpoint.
• Not yet production-ready.