Sign in with Steam (a built-in provider, as Google and Discord) #214

New Issue

wtclaude · 2026-10-14T10:09:11Z

wtclaude commented

2026-10-14 10:09:11 +00:00

The org lead, 2026-10-14: "we need to support steam logins in the same manner as the others". This stays on the website's plan (PLAN_FIXES D171, PLAN_REDESIGNS D360).

Plan: docs/website/STEAM_SIGNIN.md (in docs#345, so the link works once that merges). It has four questions for the org lead before code.

Scope, per repo

website (core):
- a steam provider class, OpenID 2.0, verified server to server with check_authentication;
- a built-in registry entry and auth_providers.kind steam;
- the SSO callback accepting Steam's openid.* fields;
- the Admin → Auth entry, with an optional Web API key (Q3);
- account page link and unlink;
- MODULE_API 1.15.0: a module can read a user's verified identities per provider, and a linked/unlinked hook;
- OpenAPI spec, tests, and the Module-uo proof.
Android-app: the Steam button, and a check of the M9 mobile SSO bridge with Steam's callback.
Module-Rust: a Steam identity as a linked Rust player beside the in-game /link code (Q1, Q2).
docs: BACKEND_DESIGN §3/§4/§6, MODULE_API.md, the Rust docs.

Rules that don't change: link-only, with opt-in sign-up (Q4); one session service; the TOTP gate and trusted devices.

AI-assisted: written with Claude Code (Claude Opus 5.5)

The org lead, 2026-10-14: *"we need to support steam logins in the same manner as the others"*. This stays on the website's plan (PLAN_FIXES D171, PLAN_REDESIGNS D360). **Plan:** [`docs/website/STEAM_SIGNIN.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/website/STEAM_SIGNIN.md) (in docs#345, so the link works once that merges). It has four questions for the org lead before code. ## Scope, per repo - **website (core):** - a `steam` provider class, OpenID 2.0, verified server to server with `check_authentication`; - a built-in registry entry and `auth_providers.kind` `steam`; - the SSO callback accepting Steam's `openid.*` fields; - the Admin → Auth entry, with an optional Web API key (Q3); - account page link and unlink; - **MODULE_API 1.15.0**: a module can read a user's verified identities per provider, and a linked/unlinked hook; - OpenAPI spec, tests, and the Module-uo proof. - **Android-app:** the Steam button, and a check of the M9 mobile SSO bridge with Steam's callback. - **Module-Rust:** a Steam identity as a linked Rust player beside the in-game `/link` code (Q1, Q2). - **docs:** BACKEND_DESIGN §3/§4/§6, MODULE_API.md, the Rust docs. Rules that don't change: link-only, with opt-in sign-up (Q4); one session service; the TOTP gate and trusted devices. - [x] AI-assisted: written with Claude Code (Claude Opus 5.5)

wtclaude added this to the Steam sign-in milestone 2026-10-14 10:09:11 +00:00

wtclaude referenced a pull request that will close this issue

2026-10-20 01:34:18 +00:00

feat(auth): sign in with Steam (MODULE_API 1.17.0) #218

whitlocktech closed this issue

2026-10-20 15:26:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/website#214