# SteamTradeX Reporter

Keeps your bot's listing on [SteamTradeX](https://steamtradex.com) up to date:
its rates, how many card sets and games it has, and the highest level it can
take a customer to. It runs next to your bot as its own small program. It does
not change, read or need your bot's code.

Full step by step guide: https://steamtradex.com/guides/reporter

## What it does

- Every 5 minutes it sends the rates you wrote in `reporter.env`.
- Every 30 minutes it reads your bot's **public** Steam inventory, the same
  way any visitor to its profile could, counts the complete card sets per game
  and sends those too. Set sizes come from SteamTradeX
  (`GET /api/v1/card-sets`).
- The max level it sends is the level a level 0 account reaches by crafting
  every normal set in stock, at most 5 per game (foil and event sets do not
  count). 0 means nothing to sell. When `MAX_LEVEL` (or your bot's
  `USER_PERMISSIONS_MAX_LEVEL`) is lower, that is sent instead.
- If an inventory read fails or stops part way, it sends rates only and tries
  the inventory again later, waiting longer each time Steam is busy.
- It prints one line per cycle, for example
  `saved: 5,000 sets in 300 games, max level 250`.

## Setup

1. Node.js 18 or newer, or Docker.
2. Copy `reporter.env.example` to `reporter.env` next to `stx-reporter.mjs`
   and fill it in. Each line says which value of your bot's `.env` it matches.
3. Check it without sending anything:

   ```
   node stx-reporter.mjs --dry-run
   ```

4. Run it.

   With pm2:

   ```
   pm2 start stx-reporter.mjs --name stx-reporter
   pm2 save
   pm2 logs stx-reporter
   ```

   With Docker:

   ```
   docker build -t stx-reporter .
   docker run -d --name stx-reporter --restart unless-stopped --read-only \
     -v "$PWD/reporter.env:/app/reporter.env:ro" stx-reporter
   docker logs -f stx-reporter
   ```

Edits to `reporter.env` are picked up on the next cycle without a restart.

## Following your bot's .env

Instead of copying rates, set `FOLLOW_BOT_ENV=/path/to/your/bot/.env`. The
reporter then uses only these lines from that file. It has to open the file to
find them, but every other line, including your Steam password and secrets, is
dropped at once: never kept, never printed and never sent anywhere. The file
must be on the same machine; a network path is refused.

`RATES_TF2_SELL`, `RATES_TF2_BUY`, `RATES_GEMS_SELL`, `RATES_GEMS_BUY`,
`USER_PERMISSIONS_MAX_LEVEL`, `BOT_ID64`, `BOT_ACCEPTED_CURRENCIES_TF2`,
`BOT_ACCEPTED_CURRENCIES_GEMS`, `BOT_HANDLE_SUPPLIERS`, `BOT_FOILMODE`

With Docker, mount that file read only as well, for example
`-v /path/to/bot/.env:/bot.env:ro` with `FOLLOW_BOT_ENV=/bot.env`.

## Safety

- Never share your Listing API key. If it leaks, issue a new one in Edit Bot.
- The reporter needs no open port and never needs your Steam login.
- It never prints your key or any value from your bot's file.
- Settings: `STEAMTRADEX_API_KEY`, `BOT_STEAMID64`, `RATE_TF2_SETS_PER_KEY`,
  `RATE_TF2_BUY_SETS_PER_KEY`, `RATE_GEMS_PER_SET`, `RATE_GEMS_BUY_PER_SET`,
  `MAX_LEVEL`, `FOIL_MODE`, `FOLLOW_BOT_ENV`. They can also be set as
  environment variables, which win over the file.

With Docker, mount the file read only (`-v /path/to/your/bot/.env:/bot.env:ro`)
and set `FOLLOW_BOT_ENV=/bot.env`. If the reporter cannot read it, do not loosen
the file's permissions: add `--user "$(id -u):$(id -g)"` to the `docker run`
line, so the reporter runs as you and the file stays private.

## Where the key goes

The Listing API key is only ever sent to `https://steamtradex.com`. If `STEAMTRADEX_URL`
is set to anything else, the reporter says so and uses the real site.