Steam desktop authentication support (SteamSDK, Auth branch, audience config, username seeding) - #4683
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughAdds Steam bridge access, Steam ticket login, Steam-based username seeding, and a dismissible account-linking signpost. API audience selection now uses injected configuration, with localization and tests covering the new behavior. ChangesSteam integration
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant SteamSDK
participant AuthEndpoint
Client->>SteamSDK: Request Steam ticket
SteamSDK-->>Client: Return ticket
Client->>AuthEndpoint: POST ticket to /auth/steam
AuthEndpoint-->>Client: Return JWT and expiry
Client->>Client: Store session and render Steam UI
Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/client/UsernameInput.ts`:
- Around line 123-134: Update UsernameInput’s Steam seeding flow so
getUsername() is not consumed by handleJoinLobby() until the asynchronous
steamSDK.getUser() lookup has completed. Expose and await a readiness promise in
the join path, preserve the generated anonymous username when lookup fails or
returns no name, and prevent a late Steam result from overwriting a username
entered by the player.
- Around line 123-134: Update the Steam persona seeding in UsernameInput’s
noStoredUsername block to normalize user.name with the same bracket-removal
logic used by handleUsernameChange, then validate the normalized value before
assigning baseUsername or calling validateAndStore. Only replace the generated
fallback when the persona is valid; otherwise leave it unchanged and avoid
setting validationError.
In `@tests/Api.test.ts`:
- Around line 5-18: Update the test lifecycle around setConfig and the
getAudience/getApiBase suite to delete window.BOOTSTRAP_CONFIG before calling
ClientEnv.reset() in both beforeEach and afterEach, ensuring each test starts
and ends without inherited configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d77dbbfb-255d-44bf-b037-d749bef7a2d4
📒 Files selected for processing (14)
index.htmlresources/lang/en.jsonsrc/client/Api.tssrc/client/Auth.tssrc/client/DesktopShell.tssrc/client/Main.tssrc/client/SteamLinkSignpost.tssrc/client/SteamSDK.tssrc/client/UsernameInput.tstests/Api.test.tstests/SteamSDK.test.tstests/client/Auth.steam.test.tstests/client/SteamLinkSignpost.test.tstests/client/UsernameInput.steam.test.ts
github-project-automation
Bot
moved this from Triage
to Development
in OpenFront Release Management
Celant
force-pushed
the
steam-desktop-auth
branch
from
July 23, 2026 10:24
7ff8c7f to
e361a2c
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/client/UsernameInput.steam.test.ts`:
- Around line 49-61: Update the test "keeps a valid generated name when the
persona is invalid" to capture the UsernameInput-generated username before the
asynchronous Steam lookup resolves, then assert the post-resolution username
equals that captured value. Keep the existing checks that the fallback is
non-empty and differs from the invalid Steam name.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b197cab9-b801-4e4e-a431-64ba39a50379
📒 Files selected for processing (5)
src/client/SteamSDK.tssrc/client/UsernameInput.tstests/SteamSDK.test.tstests/client/Auth.steam.test.tstests/client/UsernameInput.steam.test.ts
🚧 Files skipped from review as they are similar to previous changes (4)
- src/client/SteamSDK.ts
- tests/client/Auth.steam.test.ts
- tests/SteamSDK.test.ts
- src/client/UsernameInput.ts
getAudience() previously derived the audience from window.location, which resolves to the unreachable 'api.openfront' on the Electron desktop app (app://openfront). Source it from ClientEnv.jwtAudience() (BOOTSTRAP_CONFIG) instead so the desktop app targets real infra. Behavior-preserving on web, where jwtAudience already equals the hostname-derived audience. getApiBase() is unchanged (still derives from getAudience()); the 'localhost' branch keeps working since jwtAudience() is 'localhost' in local dev.
Adds SteamLinkSignpost, a self-hiding Lit component shown once on first Steam launch to tell existing web players that account linking isn't available yet (a fresh Steam launch creates a new account). Tracked via a localStorage seen-flag, dismissible, and a no-op off Steam so it's safe to mount unconditionally on web too. Registered in Main.ts and mounted in index.html alongside the other top-level toast (marketing-consent-toast). Adds the steam.link_signpost i18n key and a missing common.got_it key (used by the dismiss button; the existing "got_it" string was namespaced under ios_banner, not common).
Addresses review: normalize the Steam persona (strip brackets, trim) and only accept it when it passes validateUsername, else keep the generated name; don't let a late getUser() result overwrite a name the player typed. Prettier-format the Steam files (were ESLint-clean but never formatted).
Celant
force-pushed
the
steam-desktop-auth
branch
from
July 23, 2026 12:20
b9ac9ff to
b541c95
Compare
github-project-automation
Bot
moved this from Development
to Complete
in OpenFront Release Management
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves: n/a — private Steam-release work (see note above)
Description:
Adds the client-side pieces for authenticating the OpenFront Steam desktop build (an Electron shell) against the existing API, mirroring the established CrazyGames integration. The native Steamworks code lives in the desktop shell and is exposed to this client through a
window.openfrontDesktop.steambridge; this PR is the renderer half.SteamSDK.ts(new) — thin wrapper over the desktop shell's Steam bridge (isOnSteam/getTicket/getUser), mirroringCrazyGamesSDK; narrows the loosely-typedwindow.openfrontDesktoplocally rather than re-declaring it.Auth.ts— a Steam branch at the top ofdoRefreshJwt()plusdoSteamLogin(), exchanging a Steam Web-API ticket atPOST /auth/steamfor a session JWT, exactly parallelingdoCrazyGamesLogin. Re-exchanges on expiry (the refresh cookie is cross-site-blocked from theapp://origin); no ticket / not on Steam falls through to the existing flow.Api.ts—getAudience()now sources fromBOOTSTRAP_CONFIG(ClientEnv.jwtAudience()) instead ofwindow.location, so the desktop app (running atapp://openfront) resolves the real API base. Behavior-preserving on web, where the injected audience already equals the hostname-derived one.UsernameInput.ts— seeds the in-game display name from the Steam persona on first launch and persists it (unlike CrazyGames). Writes only the local display name; never the account username.SteamLinkSignpost.ts(new) — a one-time, dismissible notice shown on first Steam launch that account linking is coming.Please complete the following:
translateText()with keys added toresources/lang/en.json(steam.link_signpost,common.got_it).SteamSDK(incl. bridge-throws degradation), theAuth.tsSteam exchange + fall-through, theApi.tsaudience change, username seeding, and the signpost gating. Full suite green (1976) +tsc --noEmitclean.Please put your Discord username so you can be contacted if a bug or regression is found:
🤖 Generated with Claude Code
https://claude.ai/code/session_01BWxUzYb2uqjcBFQuNSJhMy