Merge pull request #7 from Daniel-Ric/feature/2026-01-22/list-missing-user-related-tokens-in-callback

Add PlayFab entity token to auth callback responses

Author: Daniel-Ric

src/routes/auth.routes.js

@@ -4,11 +4,12 @@ import {asyncHandler} from "../utils/async.js";
 import {jwtMiddleware, signJwt} from "../utils/jwt.js";
 import {getTokenFromDeviceCode, refreshMsToken, requestDeviceCode} from "../services/microsoft.service.js";
 import {getXBLToken, getXSTSToken} from "../services/xbox.service.js";
-import {loginWithXbox} from "../services/playfab.service.js";
+import {getEntityToken, loginWithXbox} from "../services/playfab.service.js";
 import {getMCToken} from "../services/minecraft.service.js";
 import {env} from "../config/env.js";
 import {authLimiter} from "../middleware/rateLimit.js";
 import {badRequest} from "../utils/httpError.js";
+import {buildAuthCallbackResponse} from "../utils/authResponse.js";
 
 const router = express.Router();
 
@@ -100,13 +101,28 @@ router.post("/callback", authLimiter, asyncHandler(async (req, res) => {
 
     const {SessionTicket, PlayFabId} = await loginWithXbox(playfabToken, titleId);
     const mcToken = await getMCToken(SessionTicket);
+    const entityData = await getEntityToken(SessionTicket);
     const jwtToken = signJwt({xuid: xid, gamertag: gtg});
 
-    res.json({
-        jwt: jwtToken, xuid: xid, gamertag: gtg, uhs, msAccessToken, msRefreshToken, msExpiresIn, xblToken, xsts: {
-            xbox: xboxTokenInfo, redeem: redeemTokenInfo, playfab: playfabTokenInfo
-        }, xboxliveToken, playfabToken, redeemToken, mcToken, sessionTicket: SessionTicket, playFabId: PlayFabId
-    });
+    res.json(buildAuthCallbackResponse({
+        jwtToken,
+        xuid: xid,
+        gamertag: gtg,
+        uhs,
+        msAccessToken,
+        msRefreshToken,
+        msExpiresIn,
+        xblToken,
+        xsts: {xbox: xboxTokenInfo, redeem: redeemTokenInfo, playfab: playfabTokenInfo},
+        xboxliveToken,
+        playfabToken,
+        redeemToken,
+        mcToken,
+        sessionTicket: SessionTicket,
+        playFabId: PlayFabId,
+        entityToken: entityData.EntityToken,
+        entityTokenExpiresOn: entityData.TokenExpiration
+    }));
 }));
 
 /**
@@ -171,13 +187,28 @@ router.post("/refresh", authLimiter, asyncHandler(async (req, res) => {
 
     const {SessionTicket, PlayFabId} = await loginWithXbox(playfabToken, titleId);
     const mcToken = await getMCToken(SessionTicket);
+    const entityData = await getEntityToken(SessionTicket);
     const jwtToken = signJwt({xuid: xid, gamertag: gtg});
 
-    res.json({
-        jwt: jwtToken, xuid: xid, gamertag: gtg, uhs, msAccessToken, msRefreshToken, msExpiresIn, xblToken, xsts: {
-            xbox: xboxTokenInfo, redeem: redeemTokenInfo, playfab: playfabTokenInfo
-        }, xboxliveToken, playfabToken, redeemToken, mcToken, sessionTicket: SessionTicket, playFabId: PlayFabId
-    });
+    res.json(buildAuthCallbackResponse({
+        jwtToken,
+        xuid: xid,
+        gamertag: gtg,
+        uhs,
+        msAccessToken,
+        msRefreshToken,
+        msExpiresIn,
+        xblToken,
+        xsts: {xbox: xboxTokenInfo, redeem: redeemTokenInfo, playfab: playfabTokenInfo},
+        xboxliveToken,
+        playfabToken,
+        redeemToken,
+        mcToken,
+        sessionTicket: SessionTicket,
+        playFabId: PlayFabId,
+        entityToken: entityData.EntityToken,
+        entityTokenExpiresOn: entityData.TokenExpiration
+    }));
 }));
 
 /**

src/routes/debug.routes.js

@@ -156,6 +156,7 @@ router.post("/decode-callback", jwtMiddleware, asyncHandler(async (req, res) =>
         mcToken: bundle.mcToken,
         sessionTicket: bundle.sessionTicket,
         playFabId: bundle.playFabId,
+        entityToken: bundle.entityToken,
         xstsXbox: bundle.xstsXbox,
         xstsRedeem: bundle.xstsRedeem,
         xstsPlayFab: bundle.xstsPlayFab
@@ -206,6 +207,7 @@ router.post("/decode-callback", jwtMiddleware, asyncHandler(async (req, res) =>
 
     add("mcToken", extracted.mcToken);
     add("sessionTicket", extracted.sessionTicket);
+    add("entityToken", extracted.entityToken);
 
     const user = {
         xuid: extracted.xuid || decoded.jwt?.payload?.xuid || get(bundle, "xsts.xbox.DisplayClaims.xui.0.xid") || null,

src/utils/authResponse.js

@@ -0,0 +1,21 @@
+export function buildAuthCallbackResponse(data) {
+    return {
+        jwt: data.jwtToken,
+        xuid: data.xuid,
+        gamertag: data.gamertag,
+        uhs: data.uhs,
+        msAccessToken: data.msAccessToken,
+        msRefreshToken: data.msRefreshToken,
+        msExpiresIn: data.msExpiresIn,
+        xblToken: data.xblToken,
+        xsts: data.xsts,
+        xboxliveToken: data.xboxliveToken,
+        playfabToken: data.playfabToken,
+        redeemToken: data.redeemToken,
+        mcToken: data.mcToken,
+        sessionTicket: data.sessionTicket,
+        playFabId: data.playFabId,
+        entityToken: data.entityToken,
+        entityTokenExpiresOn: data.entityTokenExpiresOn
+    };
+}

src/utils/swagger.js

@@ -80,7 +80,9 @@ const options = {
                         redeemToken: {type: "string"},
                         mcToken: {type: "string"},
                         sessionTicket: {type: "string"},
-                        playFabId: {type: "string"}
+                        playFabId: {type: "string"},
+                        entityToken: {type: "string"},
+                        entityTokenExpiresOn: {type: "string"}
                     }
                 }, ProfileOverviewRequest: {
                     type: "object", properties: {

tests/authResponse.test.js

@@ -0,0 +1,46 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {buildAuthCallbackResponse} from "../src/utils/authResponse.js";
+
+test("buildAuthCallbackResponse maps callback payload", () => {
+    const result = buildAuthCallbackResponse({
+        jwtToken: "jwt",
+        xuid: "xuid",
+        gamertag: "tag",
+        uhs: "uhs",
+        msAccessToken: "ms-access",
+        msRefreshToken: "ms-refresh",
+        msExpiresIn: 3600,
+        xblToken: "xbl",
+        xsts: {xbox: {Token: "xsts"}},
+        xboxliveToken: "XBL3.0 x=uhs;xsts",
+        playfabToken: "XBL3.0 x=uhs;pf",
+        redeemToken: "XBL3.0 x=uhs;redeem",
+        mcToken: "MCToken mc",
+        sessionTicket: "ticket",
+        playFabId: "pfid",
+        entityToken: "entity-token",
+        entityTokenExpiresOn: "2025-01-01T00:00:00Z"
+    });
+
+    assert.deepEqual(result, {
+        jwt: "jwt",
+        xuid: "xuid",
+        gamertag: "tag",
+        uhs: "uhs",
+        msAccessToken: "ms-access",
+        msRefreshToken: "ms-refresh",
+        msExpiresIn: 3600,
+        xblToken: "xbl",
+        xsts: {xbox: {Token: "xsts"}},
+        xboxliveToken: "XBL3.0 x=uhs;xsts",
+        playfabToken: "XBL3.0 x=uhs;pf",
+        redeemToken: "XBL3.0 x=uhs;redeem",
+        mcToken: "MCToken mc",
+        sessionTicket: "ticket",
+        playFabId: "pfid",
+        entityToken: "entity-token",
+        entityTokenExpiresOn: "2025-01-01T00:00:00Z"
+    });
+});