track owned inventions

apps/auth/src/auth.app.ts

@@ -58,6 +58,17 @@ import type { PlatformLink } from './platform-db'
 const TOKEN_SCOPE =
 	'offline_access profile rn rn.accounts rn.accounts.gc rn.api rn.chat rn.clubs rn.commerce rn.match.read rn.match.write rn.notify rn.rooms rn.storage'
 
+/**
+ * The platform id a SIDELOADED Oculus APK reports. It is not an identity: a sideloaded
+ * build has no Meta SDK to ask, so it has nothing real to report — and every sideloaded
+ * headset reports this same value. Two things follow, and both are enforced below:
+ *  - it is never verifiable (`verifyPlatformProof` refuses it outright), and
+ *  - it is therefore never LINKED to an account. A link is a password-free way in, so
+ *    one link on a shared id would open that account to every sideloaded build.
+ * It exists only to get such a client onto the username/password login screen.
+ */
+const SIDELOAD_PLATFORM_ID = '1'
+
 /**
  * The canned entry served for the one Oculus cached-login lookup below — the sideloaded
  * APK's way onto the password login screen. Not backed by a link, an account or a
@@ -65,7 +76,7 @@ const TOKEN_SCOPE =
  */
 const FAKE_OCULUS_CACHED_LOGIN = {
 	platform: PlatformType.Oculus,
-	platformId: '1',
+	platformId: SIDELOAD_PLATFORM_ID,
 	accountId: 1,
 	lastLoginTime: '2026-07-19T17:13:29.225Z',
 	requirePassword: true,
@@ -306,6 +317,20 @@ async function verifyPlatformProof(
 	platformAuth: string,
 	postedPlatformId: string
 ): Promise<PlatformProof> {
+	// A sideloaded APK reports the placeholder id (see SIDELOAD_PLATFORM_ID) because it
+	// has no Meta SDK behind it. Refuse it here, before anything is asked of Meta, so no
+	// caller downstream can treat it as an identity — above all `linkLoginIdentity` on the
+	// password grant, which is the path such a client actually takes. Linking it would
+	// hand every sideloaded headset a password-free login into that account, since they
+	// all report this same id.
+	//
+	// Refusing costs a sideloaded player nothing: their password login still succeeds (a
+	// password grant carries its own credential and only *links* on a verified proof), it
+	// just never gets a cached login, so they type their password each launch. That is
+	// the intended shape of the sideload flow.
+	if (platform === PlatformType.Oculus && postedPlatformId === SIDELOAD_PLATFORM_ID) {
+		return { status: 'rejected', reason: 'sideload placeholder platform id is never an identity' }
+	}
 	if (platform === PlatformType.Steam) {
 		const verified = platformAuth ? await verifySteamTicket(platformAuth) : null
 		if (!verified) return { status: 'rejected', reason: 'invalid or missing Steam ticket' }
@@ -418,7 +443,7 @@ const app = new Hono<App>()
 			// Scoped to that ONE identity rather than to all of platform 1 — store builds do
 			// real Meta logins, and shadowing the whole platform would hide genuine links from
 			// their pickers.
-			if (platformInt === PlatformType.Oculus && id === '1') {
+			if (platformInt === PlatformType.Oculus && id === SIDELOAD_PLATFORM_ID) {
 				return c.json([FAKE_OCULUS_CACHED_LOGIN])
 			}
 			// Listed straight from the link table, which is also what the `cached_login`
@@ -506,6 +531,11 @@ const app = new Hono<App>()
 				'when it is unset. The first identity linked also becomes the account’s primary',
 				'(what the account DTO and a refreshed token report); later ones only link.',
 				'',
+				'The one platform id that is never verified and never linked is `1` on platform `1`',
+				'— what a SIDELOADED Oculus APK reports, having no Meta SDK to ask. Every such',
+				'build reports it, so it identifies nobody. A password login that carries it still',
+				'succeeds; it simply links nothing, and the player types their password each launch.',
+				'',
 				'**Roles.** The token embeds a `role` claim from the account, so developer/moderator',
 				'powers refresh on every login and every refresh grant.',
 			].join('\n'),

apps/auth/src/test/integration/api.test.ts

@@ -893,6 +893,26 @@ describe('auth worker routes', () => {
 			expect(await getLinksForAccount(env.DB, 7103)).toEqual([])
 		})
 
+		test('a sideloaded APK (platform id 1) logs in but is never linked', async () => {
+			// The sideload placeholder identifies nobody — every sideloaded headset reports
+			// `1`, so a link on it would be a password-free way into this account from any of
+			// them. The password login still stands; Meta is never even asked, since there is
+			// nothing there to validate.
+			await seedPasswordAccount(7105, 'sideloader')
+			const login = await metaLogin(
+				`grant_type=password&username=sideloader&password=${LOGIN_PASSWORD}` +
+					`&platform=1&platform_id=1` +
+					`&platform_auth=${encodeURIComponent(metaPlatformAuth())}`,
+				true // even with Meta answering yes to everything
+			)
+			expect(login.status).toBe(200)
+			expect(login.graphCalls).toHaveLength(0)
+			expect(await getLinksForAccount(env.DB, 7105)).toEqual([])
+			// And so the picker never offers this account off the placeholder — only the
+			// canned stub entry is there.
+			expect((await cachedLogins(1, '1')).map((a) => a.accountId)).toEqual([1])
+		})
+
 		test('linking obeys the per-identity account cap, without failing the login', async () => {
 			// Otherwise the signup cap would be trivially bypassable: create accounts with a
 			// password, then link the capped identity into all of them.