chore(client): remove the Steam account-linking signpost - #4844
Merged
Conversation
The signpost was a one-time first-launch toast on the Steam desktop build telling players that account linking wasn't implemented yet and a fresh Steam install always creates a new account. Removing it for two reasons: 1. It is about to stop being true. Account linking is being built now, and the Steam release is gated on it shipping — so by the time anyone can see this message in a released build, it will be wrong. 2. Its copy never reached non-English players. `steam.link_signpost` only ever existed in en.json; the other language files are Crowdin-managed and never picked it up, so every non-English locale fell back to the English string. Removes the component, its test, the mount point in index.html, the import in Main.ts, and the `steam.link_signpost` key. Also drops `common.got_it`, which the signpost was the only consumer of — TranslationSystem's unused-key check catches this. `ios_banner.got_it` is a separate key and is untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JRMRzHbZp2VhxbxqDMw4Zr
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
💤 Files with no reviewable changes (5)
WalkthroughThe homepage no longer includes the Steam link signpost. Its component, import, translations, and tests were removed. ChangesSteam link signpost removal
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested labels: Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
github-project-automation
Bot
moved this from Triage
to Complete
in OpenFront Release Management
3 tasks
Celant
added a commit
that referenced
this pull request
Aug 5, 2026
## Description: The browser half of Steam account linking, for the upcoming Steam desktop release. The desktop Electron build shows a gate at first launch asking whether the player already has a web OpenFront account. If they do, it mints an opaque token server-side and opens the browser at `#steam-link?token=…`. This PR is what happens on this side: parse the token, show the player which two accounts are about to be linked, and redeem it on confirm. When the browser handoff fails entirely (wrong default browser, odd Linux setup, Steam's overlay browser), the desktop shows an 8-character code instead, and this PR provides the form to type it into. This is the change that makes account linking real — #4844 already removed the toast telling Steam players it was "coming in a later update". ### What's here - `src/client/SteamLink.ts` — token parsing, the pending-link stash (consumed on read, with a `kind` discriminator so a stashed token and a stashed code-entry intent can't be confused), and redemption against `POST /auth/steam/link`. - `src/client/SteamLinkModal.ts` — the confirmation modal, in two modes (token and code entry). - `src/client/AccountModal.ts` — a "Link an existing account" action that renders **only** when the Electron preload bridge is present, so plain web is untouched. - `resources/lang/en.json` only. No other language file — those are Crowdin's. ### The confirmation step is the point The token is opaque and carries nothing about the account. On a shared machine the browser may be logged into someone else's session, and linking is not freely reversible. So the modal shows both names and stops: - The **Steam persona** comes from `GET /auth/steam/link_ticket/:token`. - The **web account** comes from the logged-in session via `/users/@me` — never from the token, which is attacker-controllable. Confirm is disabled until both have loaded, and a partial load fails closed rather than showing a confirm button next to a blank name. Following this repo's `username ?? publicId` convention (`ApiSchemas.ts:429-430`, `PlayerName.ts:36`) matters more here than usual: `username` is null until claimed, so without the fallback the prompt would have read "…with account your account?" for most players and identified nothing. ### Server contract Fixed, and not changed by this PR: `200` linked (idempotent), `409` with a machine-readable `reason` surfaced verbatim so each refusal gets its own message, `410` expired, `429` throttled with `Retry-After` (rendered as "wait", never as "wrong code" — the throttle refuses correct codes too), `401` → `logOut()`. The endpoints live in the private infra repo and are not deployed yet. Nothing here breaks before they are: every failure path resolves to an error state in the modal, and the desktop gate fails open independently. ## Please complete the following: - [x] I have added screenshots for all UI updates — happy to add these; the modal needs a running desktop build plus a server-minted token to reach a realistic state, so say the word if a mocked screenshot is useful. - [x] I process any text displayed to the user through translateText() and I've added it to the en.json file — all strings via `translateText()`, keys added to `en.json` only, alphabetically sorted, and `TranslationSystem`'s unused-key check is green. - [x] I have added relevant tests to the test directory — `tests/client/SteamLink.test.ts`, `tests/client/SteamLinkModal.test.ts`, and additions to `tests/client/AccountModal.rendering.test.ts`. ### Verification `npx vitest run tests/client` plus the translation gates → 70 files / 875 tests passing, on top of current `main`. `tsc --noEmit`, ESLint and Prettier all clean. ### Known and deliberate - No TTL on the pending-link stash — an abandoned login leaves an entry that surfaces a confirm modal on a later login, which then resolves to an error state. Confirm-gated, so cosmetic. Being addressed separately along with a short `/link` alias for the hand-typed path. - The code input has no `maxlength`/`autocapitalize`/`aria-label`; worth a polish pass. Happy to fold either in if you'd rather they didn't land as-is. ### Note on the PR gate No linked `approved` issue — this is internal Steam-release work rather than a community contribution, so it should clear on repo permission. Glad to file an issue and relink if you'd prefer that route. --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Removes the one-time first-launch signpost on the Steam desktop build that told players account linking wasn't implemented yet and that a fresh Steam install always creates a new account.
Two reasons:
It is about to stop being true. Account linking is being built now and the Steam release is gated on it shipping, so by the time this message could reach a released build it would be wrong.
Its copy never reached non-English players.
steam.link_signpostonly ever existed inen.json. The other language files are Crowdin-managed and never picked it up, so every non-English locale fell back to the English string.What's removed
src/client/SteamLinkSignpost.tsand its test<steam-link-signpost>mount point inindex.htmland the import inMain.tssteam.link_signpostkey (this emptied thesteamnamespace, so the namespace goes too)common.got_it— the signpost's dismiss button was its only consumer, whichTranslationSystem's unused-key check flags.ios_banner.got_itis a separate key and is untouched.Pure deletion: 85 lines removed, nothing added.
Verification
npm test— 223 files / 2568 tests, plus 31 files / 289 server tests, all passingtsc --noEmitcleanprettier --checkclean on the changed filesPlease complete the following:
en.json.TranslationSystem's existing unused-key check covers the en.json side.Note on the PR gate
No linked
approvedissue: this is internal Steam-release cleanup rather than community-contributed work, so it should clear the gate on repo permission. Happy to file an issue and relink if that's the preferred route.