Workshop section is gated behind the QR login even for a library the plugin can already read offline

[wehrwolfmann]

The only way into the Workshop section is the QR login: main.lua marks steam_sign_in with required_for_browsing = true, and auth.lua then sends the user to IAuthenticationService/BeginAuthSessionViaQR and waits for a confirmation in the Steam mobile app. So somebody who has the Steam client running on the same machine, and who subscribed to their wallpapers years ago, still has to reach for a phone before the section will open at all.

The odd part is that a good half of that section does not need an account. source.scan and workshop.refresh read steamapps and appworkshop_431960.acf off the disk. api.details posts to ISteamRemoteStorage/GetPublishedFileDetails on plain ctx.http, with no token. profile.names reads the Community profile XML the same way. I ran the local half with no network and no session at all: 19 of the 20 directories under content/431960 came back subscribed with the sizes Steam recorded, and the one that did not is an item that no longer exists on the Workshop. Anonymous GetPublishedFileDetails then gave me title, tags, description and preview for every one of them.

What genuinely needs the token is smaller: api.search, because QueryFiles answers 403 to an anonymous request, and subscription.subscribe / unsubscribe. subscription.status sits in between — for anything the .acf already records workshop.state answers before a request goes out, but M.status calls session.ensure_http first, and that throws "Steam sign-in is required" for a signed-out user before the local answer is ever reached.

So I would like to suggest splitting browsing from acting: open the section without a session, show the installed and subscribed items right away since the data is already there, and raise the login at the moment the user searches the catalog or presses subscribe. Catalog search would still ask for an account, and that seems fair to me — it really cannot work without a token.

What I am unsure about is how much of this is the plugin's to fix. required_for_browsing is the only knob it has and it is all or nothing. If the daemon needs a second flag along the lines of "search needs an account, browsing does not", say so and I will file that on the waywallen side, the way I did for #85. Happy to write the plugin half if you like the shape.

Numbers, exact requests and the offline run are in a comment below.

[wehrwolfmann]

Checked against main (ed1e378), plugin org.waywallen.open-wallpaper-engine, waywallen 0.3.5 AppImage, Steam client under ~/.steam/steam, KDE / Arch.

Where the gate is

• main.lua:43 — required_for_browsing = true on the steam_sign_in action. It is the only occurrence of that key in the repository, so the decision is all-or-nothing from the plugin's side.
• auth.lua:13 / auth.lua:49 — BeginAuthSessionViaQR and PollAuthSessionStatus; the flow ends only when the phone confirms.
• session.lua:428 — M.ensure_http starts with validate_saved_session, which errors with Steam sign-in is required whenever platform ~= "web_browser" or the refresh token is empty.

What needs the account

• api.lua:128 — M.search wraps QueryFiles in session.authorized. Anonymously the endpoint refuses:

$ curl -sG -o /dev/null -w '%{http_code}\n' \
    'https://api.steampowered.com/IPublishedFileService/QueryFiles/v1/' \
    --data-urlencode appid=431960 --data-urlencode query_type=3 --data-urlencode days=7 \
    --data-urlencode page=1 --data-urlencode numperpage=3 --data-urlencode format=json
403

The body is Steam's Please verify your key= parameter. So catalog search is genuinely account-only, no argument from me.

• subscription.lua:134 — set_subscription needs the access token for Subscribe/Unsubscribe.
• subscription.lua:100 — M.status calls session.ensure_http(ctx) before the loop, so it throws for a signed-out user even for ids the local record could answer for. The short-circuit that would have answered them is a few lines further down, at subscription.lua:109 (local recorded = workshop.state(key)).

What does not

• source.lua:62 / workshop.lua:152 — the scan and the .acf read touch only ctx.fs.
• api.lua:208 — M.details posts to ISteamRemoteStorage/GetPublishedFileDetails on bare ctx.http.
• profile.lua:60 — fetch reads steamcommunity.com/profiles/<id>/?xml=1 on bare ctx.http.

Offline run

I loaded wallpaper_engine.workshop under a stub ctx that provides fs, env and log and nothing else — no HTTP at all — pointed it at ~/.steam/steam and asked it about every directory in content/431960:

[log] wallpaper_engine: 19 Workshop subscriptions recorded by Steam
3683176053   state=subscribed  size=919126339
2905017768   state=subscribed  size=651461388
1824745852   state=subscribed  size=449750456
...
2589297069   state=nil         size=nil
installed dirs: 20, recorded as subscribed: 19

That is the whole library view, with subscription state and sizes, before anything asks Steam who I am. 2589297069 is the only gap and it is not really one: the item was removed from the Workshop, GetPublishedFileDetails returns result = 9 for it while the other four I spot-checked return result = 1.

Anonymous details, same items

$ curl -s -X POST 'https://api.steampowered.com/ISteamRemoteStorage/GetPublishedFileDetails/v1/' \
    -d itemcount=4 -d 'publishedfileids[0]=1824745852' -d 'publishedfileids[1]=2905017768' \
    -d 'publishedfileids[2]=3425253832' -d 'publishedfileids[3]=860286005'

1824745852 result=1  Metro Exodus                        tags Wallpaper, Video, Retro, 1920 x 1080
2905017768 result=1  Bocchi the Rock! (Album)            tags Web, Anime, Wallpaper, Audio responsive
3425253832 result=1  Star Fox                            tags Scene, Game, Wallpaper, Customizable
860286005  result=1  4K Witcher 3 With Audio Vizualiser  tags Wallpaper, Game, Web, Audio responsive

Title, creator, file size, subscription and view counts, preview URL, full description and tags all come back. The author column fills in the same way: https://steamcommunity.com/profiles/76561198146481716/?xml=1 (the creator of 3683176053) answers ANSEW with no cookie attached.

One thing I looked at and would not build on

https://steamcommunity.com/workshop/browse/?appid=431960&browsesort=trend does render for a logged-out client — I get 30 item ids, preview URLs and titles in the alt attributes out of it. But the page is a generated React tree with hashed class names (_7-YnTYBrWGM-, tK5agp5sRy8-), so scraping it would break on the next Steam deploy. I mention it only so it is on the table; I would rather have search stay behind the login than depend on that.

What I did not propose, on purpose

Reading the desktop client's own token out of loginusers.vdf or config.vdf. I went looking: neither file holds one on my machine, the only JWTs around are in the embedded browser's cache, and pulling a session out of there would mean the plugin taking responsibility for somebody's credentials in an undocumented format. Not worth it.