Ship Steam login, D1 player sync, and cached「我」dashboard.

Players get a fast TTL-backed homepage (local profile / Cloudflare D1) with dense UI polish; login unlocks /home without blocking on every OpenDota refresh. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-01 01:24:30 +08:00
parent 4a61aeeb26
commit f5b7011c45
65 changed files with 7304 additions and 552 deletions
@@ -0,0 +1,56 @@
+/**
+ * GET /api/auth/steam/callback — Steam OpenID return_to.
+ */
+import {
+  createSessionToken,
+  envOf,
+  fetchSteamPersona,
+  sessionCookieHeaderForRequest,
+  steamId64ToAccountId,
+  verifySteamOpenId,
+} from "../_steam_common.js";
+
+export async function onRequestGet(context) {
+  const env = envOf(context);
+  const secret = (env.SESSION_SECRET || "").trim();
+  const apiKey = (env.STEAM_API_KEY || "").trim();
+  const origin = new URL(context.request.url).origin;
+
+  if (!secret || !apiKey) {
+    return Response.redirect(`${origin}/?auth=unconfigured`, 302);
+  }
+
+  const url = new URL(context.request.url);
+  let verified;
+  try {
+    verified = await verifySteamOpenId(url.searchParams);
+  } catch {
+    return Response.redirect(`${origin}/?auth=error`, 302);
+  }
+  if (!verified.ok) {
+    return Response.redirect(`${origin}/?auth=denied`, 302);
+  }
+
+  const steamid = verified.steamid;
+  const accountId = steamId64ToAccountId(steamid);
+  if (!accountId) {
+    return Response.redirect(`${origin}/?auth=error`, 302);
+  }
+
+  const persona = await fetchSteamPersona(apiKey, steamid);
+  const token = await createSessionToken(secret, {
+    steamid,
+    account_id: accountId,
+    personaname: persona.personaname,
+    avatar: persona.avatar,
+  });
+
+  return new Response(null, {
+    status: 302,
+    headers: {
+      Location: `${origin}/home`,
+      "Set-Cookie": sessionCookieHeaderForRequest(context.request, token),
+      "Cache-Control": "no-store",
+    },
+  });
+}