feat: Steam profile display and admin auth improvements#234
Merged
Conversation
Machine uploads keep using the shared `secret` form field. Human admin login now goes through Steam OpenID 2.0: the browser redirects to Steam, returns to /api/v1/auth/steam/callback, and the backend verifies the response, checks the Steam ID against an allowlist, and issues a JWT with the Steam ID as subject. - Add github.com/yohcop/openid-go dependency - Add AllowedSteamIDs config (setting.json + OCAP_ADMIN_ALLOWEDSTEAMIDS env) - JWT Create() now accepts a subject parameter for Steam ID embedding - Replace POST /auth/login with GET /auth/steam + GET /auth/steam/callback - Auth errors redirect to frontend with ?auth_error= for user-friendly display - Frontend: remove LoginModal, add "Sign in with Steam" button + cookie handoff - Update all backend and frontend tests
The Vite dev server proxies /api requests to the Go backend, but the backend was using c.Request().Host (the proxy target) to build Steam callback URLs and the final redirect. This caused Steam to redirect back to localhost:5000 instead of localhost:5173, landing on a 404. - Vite proxy now sends X-Forwarded-Host header for /api routes - Backend reads X-Forwarded-Host when building callback URL, OpenID verification URL, and auth redirect target
Replace the inline red text next to the sign-in button with a centered toast that slides in from the top, auto-dismisses after 5 seconds, and has a manual close button.
- Add optional Steam Web API key to fetch player display names and avatars - Store Steam profile data (name, avatar) in JWT custom claims - Show Steam avatar and display name in admin badge (falls back to Steam ID) - Fix comma-separated env var parsing for AllowedSteamIDs - Update README with admin authentication documentation - Add comprehensive test coverage for JWT claims, Steam API, and splitCSV
Contributor
Summary of ChangesHello @fank, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly overhauls the admin authentication mechanism by integrating Steam OpenID, moving away from a simple shared secret. The change not only enhances security by leveraging Steam's robust authentication but also enriches the admin user experience by displaying personalized Steam profile information. Additionally, it addresses a critical configuration parsing bug and updates documentation to ensure clarity for deployment and setup. Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Coverage Report for ui
File Coverage
|
||||||||||||||||||||||||||||||||||||||||||||||||||
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request significantly enhances the authentication mechanism by migrating from a simple secret-based login to a more robust Steam OpenID integration for admin access. The changes span both the backend (Go) and frontend (SolidJS/TypeScript), introducing new API endpoints, JWT claims for Steam profile data, and UI elements to display user avatars and names. The documentation and configuration examples have been updated to reflect these new settings. Overall, the implementation appears solid, with good attention to detail in handling OpenID flows, cookie management, and error reporting. All review comments provided are valid and contribute to the quality of the pull request.
Cover handler_auth.go gaps (requestHost, requestScheme, authRedirect with prefix, SteamCallback error/invalid paths), useAuth.tsx gaps (auth_error URL handling, dismissAuthError, steamName/steamAvatar population and clearing on logout), and MissionSelector Toast component.
Rename nonceCookie/tokenCookie → cookieNonce/cookieToken for cleaner grouping. Add comment explaining the 30s token cookie design. Note comma-separated env var format for allowedSteamIds in README.
The cookie was just shuttling the JWT from the Steam callback redirect to the frontend. Simpler to pass it as ?auth_token= in the redirect URL — same pattern already used for ?auth_error=. The frontend reads both params on mount and cleans the URL.
Merging this branch will increase overall coverage
Coverage by fileChanged files (no unit tests)
Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code. Changed unit test files
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
admin.steamApiKeyconfig to fetch Steam player display names and avatars via the Steam Web API (GetPlayerSummaries/v2)/auth/mereturns them without extra API callsOCAP_ADMIN_ALLOWEDSTEAMIDS— viper doesn't split strings into slices automaticallyTest plan
go test ./internal/server/...— all pass (27 new test cases)npx vitest run— all 777 frontend tests passgo build ./cmd/ocap-webserver— builds cleansteamApiKey, login via Steam, verify avatar + name in admin badgesteamApiKey, verify fallback to Steam IDOCAP_ADMIN_ALLOWEDSTEAMIDS=id1,id2env var, verify both IDs are authorized