Skip to content

fix(Legendary): don't treat a user.json without device_id as signed out - #295

Open
exadeci wants to merge 3 commits into
MythicApp:devfrom
exadeci:fix/epic-signin
Open

exadeci wants to merge 3 commits into
MythicApp:devfrom
exadeci:fix/epic-signin

Conversation

@exadeci

@exadeci exadeci commented Oct 10, 2026

Copy link
Copy Markdown

Legendary saves Epic's OAuth token response as user.json exactly as received. A fresh sign-in can produce one with no device_id.
User.init(from:) required that key, so decoding failed and isSignedIn came back false even though legendary was signed in.
It's unclear whether Epic dropped the field for everyone or only for some accounts or clients; the model was written in Nov 2025 against files that did have it.
Mythic then logged "You aren't signed in to Epic Games" and kept reopening the sign-in window.
That window jumped straight to the raw auth-code JSON page because the web view still had the Epic session.

  • Make User.deviceID optional. Nothing else uses it.
  • When sign-in fails, show legendary's actual error instead of a generic one.
  • In EpicWebAuthView, parse only the {…} object from the page text, and log an error instead of returning silently.

Epic's token response no longer includes `device_id`, so legendary's
`user.json` lacks it. `User.init(from:)` required the key, decoding failed,
and `retrieveUser()` returned nil — making `isSignedIn` false for accounts
that are signed in. Mythic then reported "You aren't signed in to Epic Games"
and kept reopening the sign-in window.

`deviceID` is unused elsewhere, so it is now decoded/encoded only if present.
`signIn(authKey:)` discarded legendary's stderr and threw a generic
`SignInError` whenever the success line was missing, so the alert never said
why sign-in failed (e.g. an expired or rejected authorization code). Run the
output through `handleCLIErrorOutput` first so the actual error is shown.
…th code page

The page text was parsed as JSON as-is, and any failure returned silently,
leaving the user on the raw JSON page with no alert or log. Parse only the
`{…}` object so surrounding text (e.g. WebKit's JSON viewer) doesn't break it,
and log an error when an authorization code is present but can't be parsed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant