Merge pull request #8 from Daniel-Ric/feature/2026-01-22/list-missing-user-related-tokens-in-callback

Return both PlayFab entity tokens in auth callbacks

Author: Daniel-Ric

src/routes/auth.routes.js

@@ -102,6 +102,9 @@ router.post("/callback", authLimiter, asyncHandler(async (req, res) => {
     const {SessionTicket, PlayFabId} = await loginWithXbox(playfabToken, titleId);
     const mcToken = await getMCToken(SessionTicket);
     const entityData = await getEntityToken(SessionTicket);
+    const masterEntityData = PlayFabId ? await getEntityToken(SessionTicket, {
+        Type: "master_player_account", Id: PlayFabId
+    }) : null;
     const jwtToken = signJwt({xuid: xid, gamertag: gtg});
 
     res.json(buildAuthCallbackResponse({
@@ -121,7 +124,9 @@ router.post("/callback", authLimiter, asyncHandler(async (req, res) => {
         sessionTicket: SessionTicket,
         playFabId: PlayFabId,
         entityToken: entityData.EntityToken,
-        entityTokenExpiresOn: entityData.TokenExpiration
+        entityTokenExpiresOn: entityData.TokenExpiration,
+        entityTokenMaster: masterEntityData?.EntityToken,
+        entityTokenMasterExpiresOn: masterEntityData?.TokenExpiration
     }));
 }));
 
@@ -188,6 +193,9 @@ router.post("/refresh", authLimiter, asyncHandler(async (req, res) => {
     const {SessionTicket, PlayFabId} = await loginWithXbox(playfabToken, titleId);
     const mcToken = await getMCToken(SessionTicket);
     const entityData = await getEntityToken(SessionTicket);
+    const masterEntityData = PlayFabId ? await getEntityToken(SessionTicket, {
+        Type: "master_player_account", Id: PlayFabId
+    }) : null;
     const jwtToken = signJwt({xuid: xid, gamertag: gtg});
 
     res.json(buildAuthCallbackResponse({
@@ -207,7 +215,9 @@ router.post("/refresh", authLimiter, asyncHandler(async (req, res) => {
         sessionTicket: SessionTicket,
         playFabId: PlayFabId,
         entityToken: entityData.EntityToken,
-        entityTokenExpiresOn: entityData.TokenExpiration
+        entityTokenExpiresOn: entityData.TokenExpiration,
+        entityTokenMaster: masterEntityData?.EntityToken,
+        entityTokenMasterExpiresOn: masterEntityData?.TokenExpiration
     }));
 }));
 

src/routes/debug.routes.js

@@ -157,6 +157,7 @@ router.post("/decode-callback", jwtMiddleware, asyncHandler(async (req, res) =>
         sessionTicket: bundle.sessionTicket,
         playFabId: bundle.playFabId,
         entityToken: bundle.entityToken,
+        entityTokenMaster: bundle.entityTokenMaster,
         xstsXbox: bundle.xstsXbox,
         xstsRedeem: bundle.xstsRedeem,
         xstsPlayFab: bundle.xstsPlayFab
@@ -208,6 +209,7 @@ router.post("/decode-callback", jwtMiddleware, asyncHandler(async (req, res) =>
     add("mcToken", extracted.mcToken);
     add("sessionTicket", extracted.sessionTicket);
     add("entityToken", extracted.entityToken);
+    add("entityTokenMaster", extracted.entityTokenMaster);
 
     const user = {
         xuid: extracted.xuid || decoded.jwt?.payload?.xuid || get(bundle, "xsts.xbox.DisplayClaims.xui.0.xid") || null,

src/utils/authResponse.js

@@ -16,6 +16,8 @@ export function buildAuthCallbackResponse(data) {
         sessionTicket: data.sessionTicket,
         playFabId: data.playFabId,
         entityToken: data.entityToken,
-        entityTokenExpiresOn: data.entityTokenExpiresOn
+        entityTokenExpiresOn: data.entityTokenExpiresOn,
+        entityTokenMaster: data.entityTokenMaster,
+        entityTokenMasterExpiresOn: data.entityTokenMasterExpiresOn
     };
 }

src/utils/swagger.js

@@ -82,7 +82,9 @@ const options = {
                         sessionTicket: {type: "string"},
                         playFabId: {type: "string"},
                         entityToken: {type: "string"},
-                        entityTokenExpiresOn: {type: "string"}
+                        entityTokenExpiresOn: {type: "string"},
+                        entityTokenMaster: {type: "string"},
+                        entityTokenMasterExpiresOn: {type: "string"}
                     }
                 }, ProfileOverviewRequest: {
                     type: "object", properties: {

tests/authResponse.test.js

@@ -21,7 +21,9 @@ test("buildAuthCallbackResponse maps callback payload", () => {
         sessionTicket: "ticket",
         playFabId: "pfid",
         entityToken: "entity-token",
-        entityTokenExpiresOn: "2025-01-01T00:00:00Z"
+        entityTokenExpiresOn: "2025-01-01T00:00:00Z",
+        entityTokenMaster: "entity-master",
+        entityTokenMasterExpiresOn: "2025-01-01T01:00:00Z"
     });
 
     assert.deepEqual(result, {
@@ -41,6 +43,8 @@ test("buildAuthCallbackResponse maps callback payload", () => {
         sessionTicket: "ticket",
         playFabId: "pfid",
         entityToken: "entity-token",
-        entityTokenExpiresOn: "2025-01-01T00:00:00Z"
+        entityTokenExpiresOn: "2025-01-01T00:00:00Z",
+        entityTokenMaster: "entity-master",
+        entityTokenMasterExpiresOn: "2025-01-01T01:00:00Z"
     });
 });