test(auth): a linked Steam account signs in through the mobile bridge

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/test/steamSignin.test.js

@@ -306,6 +306,20 @@ test('the same refusal holds on the mobile bridge (D395)', async () => {
   assert.equal(created, null)
 })
 
+test('a linked Steam account signs in to the app through the mobile bridge (M9)', async () => {
+  userIdentities.findByProviderSubject = async () => ({ id: 3, user_id: 7, provider: 'steam' })
+  mobileBridge.getSession = async () => ({
+    session_id: 'm2', status: 'pending', redirect_uri: 'runicgateway://sso', state: 'app-state',
+    expires_at: new Date(Date.now() + 60_000).toISOString(),
+  })
+  mobileBridge.issueAuthCode = async () => ({ code: 'one-time-code' })
+  const tx = ssoState.createTx({ provider: 'steam', mode: 'mobile', mobileSessionId: 'm2' })
+  const res = mockRes()
+  await ssoCtrl.callback(steamReq(tx), res)
+  assert.equal(res.redirectedTo, 'runicgateway://sso?code=one-time-code&state=app-state')
+  assert.equal(res.cookies[token.COOKIE_NAME], undefined, 'the app gets a code, never a cookie')
+})
+
 test('a forged callback (Steam says is_valid:false) is a refused sign-in, not a server error', async () => {
   installSteam({ valid: false })
   userIdentities.findByProviderSubject = async () => ({ id: 3, user_id: 7 })