Testing the dev branch, login with steam and itad don't work

[mihalycsaba]

I have managed to build the app without issues, added my own secrets. The logins don't work, I'm not sure if they're still wip or they only work with your secrets.
The steam login doesn't redirect from the observatory site.
The ITAD login just gives client authentication failed error on the site.

[benjamindean]

Yes, unfortunately, ITAD have specific redirect URLs built into credentials. It's https://getobservatory.app/app/auth/itad. You can test it out.

With Steam, however, it should work out of the box. If you're testing on an Android emulator, you have to go into the app settings on Android side and manually enable "Open links with the app" (don't remember how it's actually called).

[mihalycsaba]

It was enabled by default. I think you are missing something from your deep link configuration. I just started implementing deep linking in my app and saw something, that you need to specify the domains or something too. Have to look it up, because it looks like it doesn't have any verified links.

I'm not sure what you mean by the specific ITAD credentials. It doesn't get redirected to your site. It throws an error on the ITAD site.

I have added my igdb client id (I think it's the correct one, but I don't know where to put my secret or access key... It doesn't load game details, just the ones from the steam API. Same problem with the 1.3 version.

[mihalycsaba]

I don't know how you handle these api authentications, I'm novice with these auth stuff. But if you already have a server, maybe some of these secrets especially the one for ITAD should be on your server? I don't know if it's the best approach, but it seems unsafe to have secret things in a client app.

[benjamindean]

It was enabled by default. I think you are missing something from your deep link configuration. I just started implementing deep linking in my app and saw something, that you need to specify the domains or something too. Have to look it up, because it looks like it doesn't have any verified links.

I think you have to tap Add and there will be a domain with a checkbox next to it. Or is it empty?

[benjamindean]

I don't know how you handle these api authentications, I'm novice with these auth stuff. But if you already have a server, maybe some of these secrets especially the one for ITAD should be on your server? I don't know if it's the best approach, but it seems unsafe to have secret things in a client app.

Ideally, yes. I just didn't bother yet, because those API keys are not that important. The worst that can happen is the app get's blocked on ITAD or something. But yes, I'll try to make it more centralized in the future.

[mihalycsaba]

Okay, it had the domain. Steam login worked. ITAD is still the same.

I saw something where you can automatically verify a domain if you add some file to your server and/or modify something in the manifest file. I will try to find this.

The steam import has an issue, the 1.3 version had the same issue, it only imported ~500 out of ~3000 games from my wishlist. Yes I have a big wishlist... For reference ITAD imports almost everything from my wishlist.

About the secrets, maybe the ITAD key is not that critical, they might ban your account who knows, not a big issue. But the steam api key seems more critical, with that key they can do a lot stuff with your account. Also it wouldn't be fun if you get banned for API abuse.

For app longevity, it would be nice if you published the server side things too in the future.

Great app though, I feel like I would learn a lot once I understand more about how it works.

[benjamindean]

About the secrets, maybe the ITAD key is not that critical, they might ban your account who knows, not a big issue. But the steam api key seems more critical, with that key they can do a lot stuff with your account. Also it wouldn't be fun if you get banned for API abuse.

Actually, you warned me just in time, before I released an app with a key in it, Thanks for that! I'll do the proxy on Supabase side first.

I also prepared a dev project there so the contributors won't have to use secrets.env file at all. But it's in progress for now.

[benjamindean]

The steam import has an issue, the 1.3 version had the same issue, it only imported ~500 out of ~3000 games from my wishlist. Yes I have a big wishlist... For reference ITAD imports almost everything from my wishlist.

That's an artificial limit, really. I can increase it any time. It's just going to be a way longer import.

[mihalycsaba]

The steam import has an issue, the 1.3 version had the same issue, it only imported ~500 out of ~3000 games from my wishlist. Yes I have a big wishlist... For reference ITAD imports almost everything from my wishlist.

That's an artificial limit, really. I can increase it any time. It's just going to be a way longer import.

Let's stress test this baby! I know a few people with bigger wishlists :p

[benjamindean]

Ah, I remembered why it's limited. ITAD has a hard limit on prices returned per request. It's 200. So, for 3000 waitlist items it's 15 requests, which is far from optimal. Can be paginated in the app, but then sorting by price-related fields is out of the question. I'll ask if it's possible to raise the limit.

[mihalycsaba]

You could put a disclaimer in the app for ~500-1000+ wishlists, I'm willing to live with a slower sorting. Right now the sorting is like 1 second. It wouldn't be too slow if it lasts 6x longer.

[benjamindean]

@mihalycsaba Hey! So, I moved quite a lot of endpoint calls to the Supabase and the changes are on the dev branch now. I also prepared the Staging env for developing, so you'll need following things in your secrets.env:

ITAD_API_KEY=
ITAD_API_SECRET=
ITAD_API_IDENTIFIER=
SUPABASE_URL=
SUPABASE_ANON_KEY=

ITAD is still needed, since I want to test how it would work with Supabase, since they have a limit for free plans. If you're interested in testing it out - let me know and I'll give you Supabase project credentials. They should be fine to commit to Git, but I want to research it a bit first.

The good part is that I was able to move some logic to backend, so the UI is a bit less demanding now.

[benjamindean]

Only 2 endpoints left to move to Supabase. The dev project is ready, so after that, the only thing that you'll need will be credentials to Supabase dev project that I'll add to the repo. For ITAD sync you'll still need all ITAD credentials, but that's only until I figure out how to implement OAuth2 on Supabase side as well.

[mihalycsaba]

Supabase, since they have a limit for free plans.

What does this mean, is it a good idea to use it for public development? Maybe you could describe what you did on supabase so contributors could use their own supabase accounts. It would be great if the backend stuff is open source too.

By the way I know of two open source self hosted app platforms, might be better than use some limited commercial service since you already have a server.
https://pocketbase.io/ this was released in 2022 should be quite stable.
https://trailbase.io/ just found this, it was released yesterday, claims to be faster than pocketbase. The license is weird though. I just leave it here for the future.

[mihalycsaba]

https://github.com/pocketbase/dart-sdk
https://pub.dev/packages/trailbase