Skip to content

Add support for GetAuthTicketForWebApi #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rnels wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add support for GetAuthTicketForWebApi #43

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b14e658
Add user init and teardown to core
rnels Jul 16, 2024
bc65782
Add GetAuthTicketForWebApi to user
rnels Jul 16, 2024
a430724
Merge pull request #1 from rnels/add-web-api-auth
rnels Jul 17, 2024
9ddd06b
Merge branch 'master' into master
rnels Dec 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions src/user.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ int user_ref = LUA_NOREF;
class CallbackListener {
private:
STEAM_CALLBACK(CallbackListener, OnAuthSessionTicketResponse, GetAuthSessionTicketResponse_t);
STEAM_CALLBACK(CallbackListener, OnTicketForWebApiResponse, GetTicketForWebApiResponse_t);
};

void CallbackListener::OnAuthSessionTicketResponse(GetAuthSessionTicketResponse_t *data) {
Expand All @@ -51,6 +52,36 @@ void CallbackListener::OnAuthSessionTicketResponse(GetAuthSessionTicketResponse_
}
}

void CallbackListener::OnTicketForWebApiResponse(GetTicketForWebApiResponse_t *data) {
if (data == nullptr) {
return;
}
lua_State* L = luasteam::global_lua_state;
if (!lua_checkstack(L, 4)) {
return;
}
lua_rawgeti(L, LUA_REGISTRYINDEX, user_ref);
lua_getfield(L, -1, "OnTicketForWebApiResponse");
Copy link

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The callback name uses PascalCase "OnTicketForWebApiResponse" while the existing callback "onAuthSessionTicketResponse" on line 41 uses camelCase. For consistency with the existing codebase, this should be "onTicketForWebApiResponse" (with lowercase 'o').

Copilot uses AI. Check for mistakes.
if (lua_isnil(L, -1)) {
lua_pop(L, 2);
} else {
EResult result = data->m_eResult;
uint32 handle = data->m_hAuthTicket;
uint8 *authTicket = data->m_rgubTicket;
const char *hexTicket = bufferToHex(authTicket, 2560).c_str();
Copy link

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using c_str() on a temporary string returned by bufferToHex() creates a dangling pointer. The temporary string object is destroyed at the end of the statement, making hexTicket point to deallocated memory. Store the result in a std::string variable first, similar to how it's done in luasteam_getAuthSessionTicket on line 110.

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The buffer size 2560 is hardcoded and appears to be a magic number. According to Steamworks documentation, GetTicketForWebApiResponse_t contains m_rgubTicket with size defined by k_cubAuthTicketForWebApiSizeMax (typically 512 bytes). The actual size of the ticket should be obtained from the m_cubTicket field in the callback data structure. Using a hardcoded value of 2560 will read beyond the actual buffer bounds, potentially causing memory safety issues.

Copilot uses AI. Check for mistakes.
Copy link
Collaborator

@yancouto yancouto Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot hallucinated here a little about the constant name that doesn't exist.

I see where you're coming, it returns an array with maximum size 2560. However, it does seem the data has a m_cubTicket with the actual length, can't you use that?


lua_createtable(L, 0, 1);
Copy link

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The table is created with a hint of 1 field (lua_createtable(L, 0, 1)) but actually stores 3 fields (handle, hexTicket, result). The second parameter should be 3 to properly hint the table size to the Lua allocator for better performance.

Copilot uses AI. Check for mistakes.
lua_pushinteger(L, handle);
lua_setfield(L, -2, "handle");
lua_pushstring(L, hexTicket);
lua_setfield(L, -2, "hexTicket");
lua_pushstring(L, steam_result_code[result]);
lua_setfield(L, -2, "result");
lua_call(L, 1, 0);
lua_pop(L, 1);
}
}

} // namespace

// int GetPlayerSteamLevel();
Expand Down Expand Up @@ -88,6 +119,20 @@ EXTERN int luasteam_getAuthSessionTicket(lua_State *L) {
return 1;
}

// HAuthTicket GetAuthTicketForWebApi( const char *pchIdentity );
EXTERN int luasteam_getAuthTicketForWebApi(lua_State *L) {
const char *pchIdentity = luaL_checkstring(L, 1);
HAuthTicket ticket = SteamUser()->GetAuthTicketForWebApi(pchIdentity);
if (ticket != k_HAuthTicketInvalid) {
lua_newtable(L);
lua_pushinteger(L, ticket);
lua_setfield(L, -2, "handle");
Copy link

Copilot AI Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The return field is named "handle" but in the similar function luasteam_getAuthSessionTicket (line 113), the ticket is returned as "ticket". For API consistency, consider using "ticket" as the field name here as well, or if "handle" is intentionally different, ensure this naming difference is clearly documented.

Copilot uses AI. Check for mistakes.
Copy link
Collaborator

@yancouto yancouto Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are you returning a table with a single field? https://partner.steamgames.com/doc/api/ISteamUser#GetAuthTicketForWebApi just returns an integer.

Well it seems our luasteam_getAuthSessionTicket also breaks convention and returns a table with ticket and hexTicket (not sure why). At least follow that.

return 1;
}
lua_pushnil(L);
return 1;
}

// void CancelAuthTicket( HAuthTicket hAuthTicket )
EXTERN int luasteam_cancelAuthTicket(lua_State *L) {
HAuthTicket ticket = luaL_checkinteger(L, 1);
Expand All @@ -102,6 +147,7 @@ void add_user(lua_State *L) {
add_func(L, "getPlayerSteamLevel", luasteam_getPlayerSteamLevel);
add_func(L, "getSteamID", luasteam_getSteamID);
add_func(L, "getAuthSessionTicket", luasteam_getAuthSessionTicket);
add_func(L, "getAuthTicketForWebApi", luasteam_getAuthTicketForWebApi);
add_func(L, "cancelAuthTicket", luasteam_cancelAuthTicket);
lua_pushvalue(L, -1);
user_ref = luaL_ref(L, LUA_REGISTRYINDEX);
Expand Down
Loading