SteamApiClient.cs

using System.Collections.Concurrent;
using System.Text.Json;
using Microsoft.Extensions.Logging;

namespace PrimeGuard;

/// <summary>
/// Steam profile data relevant to deciding whether to let a player in.
/// Note: NONE of these fields is "has Prime" — Prime cannot be read reliably
/// from the server. They are proxy signals to filter F2P accounts / smurfs.
///
/// Key convention: an "unknown" value (null for bool?/int?, or -1 for level)
/// means "could not be queried" and must NEVER cause a kick. Players are only
/// kicked on verified data, so a Steam API failure/rate-limit won't boot legit users.
/// </summary>
public sealed class SteamUserInfo
{
    /// <summary>true = private, false = public, null = could not be determined.</summary>
    public bool? IsProfilePrivate { get; set; }

    /// <summary>Steam level, or -1 if it could not be read.</summary>
    public int SteamLevel { get; set; } = -1;

    /// <summary>Account age in days, or null if it could not be determined.</summary>
    public int? AccountAgeDays { get; set; }

    /// <summary>CS2 playtime in minutes, or null when Steam won't reveal it.
    /// Steam reports playtime_forever as 0 for every game when the player enables
    /// "Always keep my total playtime private", which is indistinguishable from a real 0 —
    /// so 0 is treated as unknown rather than as "never played".</summary>
    public int? CS2PlaytimeMinutes { get; set; }
    public int? CS2PlaytimeHours => CS2PlaytimeMinutes / 60;

    /// <summary>true/false per Steam, null = ban status could not be queried.</summary>
    public bool? IsVacBanned { get; set; }
    public bool? IsGameBanned { get; set; }

    /// <summary>Days since the player's most recent ban, or null if unknown.
    /// NOTE: Steam only reports this for the latest ban of ANY type (VAC or game) —
    /// there is no per-ban date, so this can't distinguish an old VAC from a recent game ban.</summary>
    public int? DaysSinceLastBan { get; set; }

    // Per-endpoint success flags. Used to decide whether the lookup is worth caching:
    // caching a half-failed result would disable those checks for the whole TTL.
    internal bool SummaryOk { get; set; }
    internal bool BansOk { get; set; }
    internal bool LevelOk { get; set; }
    internal bool PlaytimeOk { get; set; }

    /// <summary>True when every endpoint this profile needed actually answered.
    /// Level and playtime are only required for public profiles (they can't be read otherwise).</summary>
    internal bool IsComplete =>
        SummaryOk && BansOk && (IsProfilePrivate != false || (LevelOk && PlaytimeOk));

    private static string Show(bool? b) => b?.ToString() ?? "?";

    public override string ToString() =>
        $"private={Show(IsProfilePrivate)} level={(SteamLevel < 0 ? "?" : SteamLevel.ToString())} " +
        $"age={(AccountAgeDays?.ToString() ?? "?")}d cs2Hours={(CS2PlaytimeHours?.ToString() ?? "hidden")} " +
        $"vac={Show(IsVacBanned)} gameBan={Show(IsGameBanned)} " +
        $"daysSinceLastBan={(DaysSinceLastBan?.ToString() ?? "?")}";
}

/// <summary>
/// Thin Steam Web API client. Makes only the calls it needs and never throws
/// outward: on any failure it leaves the field "unknown" (null / -1) so the
/// caller fails open instead of kicking because of an error.
/// </summary>
public sealed class SteamApiClient
{
    private const int Cs2AppId = 730;

    private readonly HttpClient _http;
    private readonly string _key;
    private readonly ILogger _logger;

    // Per-SteamID cache so the same player reconnecting doesn't re-query the API.
    private readonly TimeSpan _cacheTtl;
    private readonly ConcurrentDictionary<ulong, CacheEntry> _cache = new();

    public SteamApiClient(HttpClient http, string apiKey, ILogger logger, TimeSpan cacheTtl)
    {
        _http = http;
        _key = apiKey;
        _logger = logger;
        _cacheTtl = cacheTtl;
    }

    private bool CacheEnabled => _cacheTtl > TimeSpan.Zero;

    /// <summary>Drops every cached lookup. Lets admins re-check a player who just fixed
    /// their profile instead of waiting out the TTL. Returns how many entries were dropped.</summary>
    public int ClearCache()
    {
        int count = _cache.Count;
        _cache.Clear();
        return count;
    }

    public async Task<SteamUserInfo> FetchAsync(ulong steamId)
    {
        if (CacheEnabled &&
            _cache.TryGetValue(steamId, out var cached) &&
            DateTime.UtcNow - cached.Timestamp < _cacheTtl)
        {
            return cached.Info;
        }

        var info = await FetchFreshAsync(steamId);

        // Only cache lookups where EVERY endpoint answered. Caching a half-failed result
        // (e.g. the ban endpoint timed out) would disable that check for the whole TTL,
        // so partial results are left uncached and retried on the next connect.
        if (CacheEnabled && info.IsComplete)
        {
            Prune();
            _cache[steamId] = new CacheEntry(DateTime.UtcNow, info);
        }

        return info;
    }

    private async Task<SteamUserInfo> FetchFreshAsync(ulong steamId)
    {
        var info = new SteamUserInfo();

        // Privacy/account age and bans are independent: run them in parallel.
        await Task.WhenAll(
            FetchSummaryAsync(steamId, info),
            FetchBansAsync(steamId, info));

        // Level and hours only make sense (and can only be read) when the profile
        // is confirmed public. If it's private or unknown, we don't query them.
        if (info.IsProfilePrivate == false)
        {
            await Task.WhenAll(
                FetchSteamLevelAsync(steamId, info),
                FetchPlaytimeAsync(steamId, info));
        }

        return info;
    }

    /// <summary>Drops expired entries once the cache grows, to bound memory from
    /// one-off visitors who never reconnect.</summary>
    private void Prune()
    {
        if (_cache.Count < 256) return;

        var now = DateTime.UtcNow;
        foreach (var kv in _cache)
        {
            if (now - kv.Value.Timestamp >= _cacheTtl)
                _cache.TryRemove(kv.Key, out _);
        }
    }

    private readonly record struct CacheEntry(DateTime Timestamp, SteamUserInfo Info);

    private async Task<JsonDocument?> GetAsync(string url)
    {
        try
        {
            using var resp = await _http.GetAsync(url);
            if (!resp.IsSuccessStatusCode)
            {
                _logger.LogWarning("PrimeGuard: Steam Web API returned {code} for {url}", (int)resp.StatusCode, Redact(url));
                return null;
            }

            var body = await resp.Content.ReadAsStringAsync();
            return JsonDocument.Parse(body);
        }
        catch (Exception ex)
        {
            _logger.LogError("PrimeGuard: failed querying {url}: {msg}", Redact(url), ex.Message);
            return null;
        }
    }

    private string Redact(string url) => string.IsNullOrEmpty(_key) ? url : url.Replace(_key, "***");

    private async Task FetchSummaryAsync(ulong steamId, SteamUserInfo info)
    {
        var url = $"https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key={_key}&steamids={steamId}";
        using var doc = await GetAsync(url);

        // No valid response => IsProfilePrivate stays null (unknown) => fail open.
        // NOTE: we never mark "private" on failure; only when Steam says so explicitly.
        if (doc is null ||
            !doc.RootElement.TryGetProperty("response", out var response) ||
            !response.TryGetProperty("players", out var players) ||
            players.ValueKind != JsonValueKind.Array ||
            players.GetArrayLength() == 0)
        {
            return;
        }

        info.SummaryOk = true;
        var player = players[0];

        // Only decide privacy when Steam actually reports it (3 = public, anything else = private).
        // If the field is absent/unparseable, leave IsProfilePrivate null (unknown => fail open),
        // so a limited/edge-case account is never kicked on missing data.
        if (player.TryGetProperty("communityvisibilitystate", out var vis) && vis.TryGetInt32(out var v))
            info.IsProfilePrivate = v != 3;

        if (player.TryGetProperty("timecreated", out var tc) && tc.TryGetInt64(out var created))
        {
            var createdUtc = DateTimeOffset.FromUnixTimeSeconds(created).UtcDateTime;
            info.AccountAgeDays = Math.Max(0, (int)(DateTime.UtcNow - createdUtc).TotalDays);
        }
    }

    private async Task FetchSteamLevelAsync(ulong steamId, SteamUserInfo info)
    {
        var url = $"https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key={_key}&steamid={steamId}";
        using var doc = await GetAsync(url);

        // On failure, SteamLevel stays -1 (unknown) and the check is skipped.
        if (doc is not null &&
            doc.RootElement.TryGetProperty("response", out var r) &&
            r.TryGetProperty("player_level", out var lvl) &&
            lvl.TryGetInt32(out var level))
        {
            info.SteamLevel = level;
            info.LevelOk = true;
        }
    }

    private async Task FetchPlaytimeAsync(ulong steamId, SteamUserInfo info)
    {
        // include_played_free_games=1 is MANDATORY: CS2 is free-to-play, and without it
        // accounts that didn't buy it won't show up and would report 0 hours.
        var url = $"https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key={_key}&steamid={steamId}&include_played_free_games=1&format=json";
        using var doc = await GetAsync(url);

        if (doc is null)
            return; // request failed => PlaytimeOk stays false so this lookup isn't cached

        // A valid response with no "games" array means the player hides their game details:
        // that's a definitive answer, so the lookup still counts as complete.
        info.PlaytimeOk = true;

        // No games array => the player hides their game details, so playtime stays unknown.
        if (!doc.RootElement.TryGetProperty("response", out var r) ||
            !r.TryGetProperty("games", out var games) ||
            games.ValueKind != JsonValueKind.Array)
        {
            return;
        }

        foreach (var g in games.EnumerateArray())
        {
            if (g.TryGetProperty("appid", out var appid) && appid.TryGetInt32(out var id) && id == Cs2AppId)
            {
                // A reported 0 means Steam is hiding the number (see CS2PlaytimeMinutes),
                // so it's left null instead of being read as "never played".
                if (g.TryGetProperty("playtime_forever", out var pt) && pt.TryGetInt32(out var minutes) && minutes > 0)
                    info.CS2PlaytimeMinutes = minutes;

                break;
            }
        }
    }

    private async Task FetchBansAsync(ulong steamId, SteamUserInfo info)
    {
        var url = $"https://api.steampowered.com/ISteamUser/GetPlayerBans/v1/?key={_key}&steamids={steamId}";
        using var doc = await GetAsync(url);

        // No response => bans stay null (unknown) => no kick for bans.
        if (doc is null ||
            !doc.RootElement.TryGetProperty("players", out var players) ||
            players.ValueKind != JsonValueKind.Array ||
            players.GetArrayLength() == 0)
        {
            return;
        }

        info.BansOk = true;
        var p = players[0];
        info.IsVacBanned = p.TryGetProperty("VACBanned", out var vac) && vac.ValueKind == JsonValueKind.True;
        info.IsGameBanned = p.TryGetProperty("NumberOfGameBans", out var gb) && gb.TryGetInt32(out var n) && n > 0;

        if (p.TryGetProperty("DaysSinceLastBan", out var days) && days.TryGetInt32(out var d))
            info.DaysSinceLastBan = d;
    }
}