Steam desktop authentication support (SteamSDK, Auth branch, audience config, username seeding) (#4683)

> **Maintainer note:** part of the private OpenFront Steam release
(Milestone 2, tracked in Linear), not a public GitHub issue. Per the
contributor policy this needs an approved/assigned issue or a maintainer
label to avoid auto-close — flagging for a maintainer to handle.

Resolves: _n/a — private Steam-release work (see note above)_

## Description:

Adds the client-side pieces for authenticating the OpenFront **Steam
desktop build** (an Electron shell) against the existing API, mirroring
the established CrazyGames integration. The native Steamworks code lives
in the desktop shell and is exposed to this client through a
`window.openfrontDesktop.steam` bridge; this PR is the renderer half.

- **`SteamSDK.ts`** (new) — thin wrapper over the desktop shell's Steam
bridge (`isOnSteam` / `getTicket` / `getUser`), mirroring
`CrazyGamesSDK`; narrows the loosely-typed `window.openfrontDesktop`
locally rather than re-declaring it.
- **`Auth.ts`** — a Steam branch at the top of `doRefreshJwt()` plus
`doSteamLogin()`, exchanging a Steam Web-API ticket at `POST
/auth/steam` for a session JWT, exactly paralleling `doCrazyGamesLogin`.
Re-exchanges on expiry (the refresh cookie is cross-site-blocked from
the `app://` origin); no ticket / not on Steam falls through to the
existing flow.
- **`Api.ts`** — `getAudience()` now sources from `BOOTSTRAP_CONFIG`
(`ClientEnv.jwtAudience()`) instead of `window.location`, so the desktop
app (running at `app://openfront`) resolves the real API base.
Behavior-preserving on web, where the injected audience already equals
the hostname-derived one.
- **`UsernameInput.ts`** — seeds the in-game display name from the Steam
persona on first launch and persists it (unlike CrazyGames). Writes only
the local display name; never the account username.
- **`SteamLinkSignpost.ts`** (new) — a one-time, dismissible notice
shown on first Steam launch that account linking is coming.

## Please complete the following:

- [ ] I have added screenshots for all UI updates — ⚠️ _the new
first-launch link signpost is a UI addition; it renders only inside the
Steam desktop shell. Screenshots to be added by the maintainer._
- [x] I process any text displayed to the user through translateText()
and I've added it to the en.json file — signpost strings go through
`translateText()` with keys added to `resources/lang/en.json`
(`steam.link_signpost`, `common.got_it`).
- [x] I have added relevant tests to the test directory — unit tests for
`SteamSDK` (incl. bridge-throws degradation), the `Auth.ts` Steam
exchange + fall-through, the `Api.ts` audience change, username seeding,
and the signpost gating. Full suite green (1976) + `tsc --noEmit` clean.

## Please put your Discord username so you can be contacted if a bug or
regression is found:

_⚠️ maintainer to fill_

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01BWxUzYb2uqjcBFQuNSJhMy

tests/client/Auth.steam.test.ts

@@ -0,0 +1,71 @@
+import { UnsecuredJWT } from "jose";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { getAuthHeader, logOut } from "../../src/client/Auth";
+import { ClientEnv } from "../../src/client/ClientEnv";
+import { steamSDK } from "../../src/client/SteamSDK";
+
+function setBootstrapConfig() {
+  (window as any).BOOTSTRAP_CONFIG = {
+    gameEnv: "prod",
+    numWorkers: 1,
+    turnstileSiteKey: "x",
+    jwtAudience: "openfront.dev",
+    instanceId: "d",
+    gitCommit: "t",
+  };
+  ClientEnv.reset();
+}
+
+beforeEach(async () => {
+  setBootstrapConfig();
+  await logOut();
+  vi.restoreAllMocks();
+});
+
+describe("Steam login", () => {
+  it("exchanges a Steam ticket for a session JWT via POST /auth/steam", async () => {
+    vi.spyOn(steamSDK, "isOnSteam").mockReturnValue(true);
+    vi.spyOn(steamSDK, "getTicket").mockResolvedValue("ticket123");
+
+    const jwt = new UnsecuredJWT({
+      jti: "some-id",
+      sub: "AAAAAAAAAAAAAAAAAAAAAA",
+      iat: Math.floor(Date.now() / 1000),
+      iss: "https://api.openfront.dev",
+      aud: "openfront.dev",
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    }).encode();
+
+    const fetchMock = vi.spyOn(globalThis, "fetch").mockResolvedValue(
+      new Response(JSON.stringify({ jwt, expiresIn: 900 }), {
+        status: 200,
+      }),
+    );
+
+    const header = await getAuthHeader();
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(String(url)).toContain("/auth/steam");
+    expect(JSON.parse((init as RequestInit).body as string)).toEqual({
+      ticket: "ticket123",
+    });
+    expect(header).toBe(`Bearer ${jwt}`);
+  });
+
+  it("falls through to the guest/refresh flow when no Steam ticket is available", async () => {
+    vi.spyOn(steamSDK, "isOnSteam").mockReturnValue(true);
+    vi.spyOn(steamSDK, "getTicket").mockResolvedValue(null);
+
+    const fetchMock = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValue(new Response(null, { status: 401 }));
+
+    await getAuthHeader();
+
+    expect(fetchMock).toHaveBeenCalled();
+    for (const call of fetchMock.mock.calls) {
+      expect(String(call[0])).not.toContain("/auth/steam");
+    }
+  });
+});

tests/client/SteamLinkSignpost.test.ts

@@ -0,0 +1,24 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { SteamLinkSignpost } from "../../src/client/SteamLinkSignpost";
+import { steamSDK } from "../../src/client/SteamSDK";
+
+beforeEach(() => {
+  localStorage.clear();
+  vi.restoreAllMocks();
+});
+
+describe("SteamLinkSignpost", () => {
+  it("is visible on first Steam launch, hidden after dismiss", () => {
+    vi.spyOn(steamSDK, "isOnSteam").mockReturnValue(true);
+    const el = new SteamLinkSignpost();
+    expect(el.shouldShow()).toBe(true);
+    el.dismiss();
+    expect(localStorage.getItem("steam_link_signpost_seen")).toBe("1");
+    expect(el.shouldShow()).toBe(false);
+  });
+
+  it("never shows off Steam", () => {
+    vi.spyOn(steamSDK, "isOnSteam").mockReturnValue(false);
+    expect(new SteamLinkSignpost().shouldShow()).toBe(false);
+  });
+});

tests/client/UsernameInput.steam.test.ts

@@ -0,0 +1,67 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { steamSDK } from "../../src/client/SteamSDK";
+import { UsernameInput } from "../../src/client/UsernameInput";
+
+beforeEach(() => {
+  localStorage.clear();
+  vi.restoreAllMocks();
+});
+
+describe("UsernameInput Steam seeding", () => {
+  it("seeds and persists the Steam persona when nothing is stored", async () => {
+    vi.spyOn(steamSDK, "isOnSteam").mockReturnValue(true);
+    vi.spyOn(steamSDK, "getUser").mockResolvedValue({
+      steamId: "77",
+      name: "Ada",
+    });
+    const el = new UsernameInput();
+    el.connectedCallback();
+    await new Promise((r) => setTimeout(r, 0));
+    expect(el.getUsername()).toBe("Ada");
+    expect(localStorage.getItem("username")).toBe("Ada"); // usernameKey
+  });
+
+  it("keeps an already-stored username", async () => {
+    localStorage.setItem("username", "MyName");
+    vi.spyOn(steamSDK, "isOnSteam").mockReturnValue(true);
+    vi.spyOn(steamSDK, "getUser").mockResolvedValue({
+      steamId: "77",
+      name: "Ada",
+    });
+    const el = new UsernameInput();
+    el.connectedCallback();
+    await new Promise((r) => setTimeout(r, 0));
+    expect(el.getUsername()).toBe("MyName");
+  });
+
+  it("strips brackets from the Steam persona", async () => {
+    vi.spyOn(steamSDK, "isOnSteam").mockReturnValue(true);
+    vi.spyOn(steamSDK, "getUser").mockResolvedValue({
+      steamId: "77",
+      name: "[Ada]",
+    });
+    const el = new UsernameInput();
+    el.connectedCallback();
+    await new Promise((r) => setTimeout(r, 0));
+    expect(el.getUsername()).toBe("Ada");
+  });
+
+  it("keeps a valid generated name when the persona is invalid", async () => {
+    vi.spyOn(steamSDK, "isOnSteam").mockReturnValue(true);
+    vi.spyOn(steamSDK, "getUser").mockResolvedValue({
+      steamId: "77",
+      name: "x".repeat(100),
+    });
+    const el = new UsernameInput();
+    el.connectedCallback();
+    // Captured synchronously, before the async getUser() seed resolves: this is
+    // the generated anon name loadStoredUsername() just produced.
+    const generated = el.getUsername();
+    await new Promise((r) => setTimeout(r, 0));
+    // The invalid persona must be rejected and the exact generated name kept —
+    // not merely replaced by some other valid name.
+    expect(el.getUsername()).toBe(generated);
+    expect(generated).not.toBe("x".repeat(100));
+    expect(generated.length).toBeGreaterThan(0);
+  });
+});

tests/client/components/FeaturedStream.test.ts

@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import featuredStream from "../../../resources/featured-stream.json";
 import { getFeaturedStream } from "../../../src/client/Api";
+import { ClientEnv } from "../../../src/client/ClientEnv";
 import { cornerFromCenter } from "../../../src/client/FeaturedStream";
 import { FeaturedStreamSchema } from "../../../src/core/ApiSchemas";
 
@@ -65,10 +66,25 @@ describe("FeaturedStream", () => {
     beforeEach(() => {
       vi.unstubAllGlobals();
       vi.spyOn(console, "warn").mockImplementation(() => {});
+      // getApiBase() → getAudience() now reads the JWT audience from
+      // BOOTSTRAP_CONFIG (ClientEnv), so getFeaturedStream needs it present or
+      // it throws before fetch and silently falls back. The value is irrelevant
+      // here since fetch is stubbed; we only need a well-formed config.
+      (window as any).BOOTSTRAP_CONFIG = {
+        gameEnv: "prod",
+        numWorkers: 1,
+        turnstileSiteKey: "x",
+        jwtAudience: "openfront.io",
+        instanceId: "desktop",
+        gitCommit: "test",
+      };
+      ClientEnv.reset();
     });
     afterEach(() => {
       vi.restoreAllMocks();
       vi.unstubAllGlobals();
+      delete (window as any).BOOTSTRAP_CONFIG;
+      ClientEnv.reset();
     });
 
     const stubFetch = (impl: () => unknown) =>