37073eafd7
Drift (specs aligned to shipped code): - social-follows: locked-account access rule for /users/:u/followers and /users/:u/following (owner + accepted-follower see; non-followers of private get 404). Adds the follow→notification lifecycle requirement. Fills the placeholder Purpose. - public-profiles: counts degrade to plain text (not anchors) for viewers who can't see the lists. Cross-references social-follows. Fills the placeholder Purpose. - journal-auth slimmed to cookie session + Terms gate. Auth methods moved out (see authentication-methods). Splits: - account-settings (14-line stub) deleted, content split into: - profile-settings (display name, bio, profile_visibility) - account-management (email change with verification, account deletion) - connected-services (Wahoo + future external integrations) - authentication-methods split out of journal-auth: passkeys (register/login/add/delete), magic links, 6-digit codes (login + register), method toggle on register/login forms, dev-console fallback. New specs: - sse-broker: /api/events, in-process broker, useUnreadNotifications hook, Caddy passthrough, multi-process forward-compat contract. Archived: notifications change → openspec/changes/archive/2026-04-26-notifications. Promoted the four delta spec files into top-level specs: - specs/notifications/ (new capability) - specs/activity-feed/ (added: public activity fan-out) - specs/journal-landing/ (added: Notifications navbar entry) - specs/social-follows/ (added: follow→notification lifecycle) Added openspec/CAPABILITIES.md grouped index covering all 40 specs with a Conventions section explaining cross-references, naming, and the catch-up-vs-change rule. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
30 lines
2.2 KiB
Markdown
30 lines
2.2 KiB
Markdown
# connected-services Specification
|
|
|
|
## Purpose
|
|
Third-party service connections (Wahoo today; future Strava, Garmin, etc.) that the user opts into from the Journal's settings page. Covers OAuth-based connect / disconnect flows and the storage layout for tokens. Token refresh behavior, webhook ingestion, and the per-service import rules live with each service's own change (e.g. `wahoo-import`).
|
|
|
|
## Requirements
|
|
|
|
### Requirement: Connected Services section on the settings page
|
|
The settings page SHALL include a "Connected Services" section listing each external integration the Journal supports, each row showing the connection state (Connect / Disconnect) and the link to start the OAuth flow when not connected.
|
|
|
|
#### Scenario: Wahoo connection status renders both states
|
|
- **WHEN** a user views the settings page
|
|
- **THEN** a "Connected Services" section shows Wahoo as connected or disconnected
|
|
- **AND** connected state shows a "Disconnect" button that POSTs to `/api/sync/disconnect/<provider>`
|
|
- **AND** disconnected state shows a "Connect Wahoo" button that begins the OAuth handshake
|
|
|
|
### Requirement: OAuth token storage in `sync_connections`
|
|
External-service OAuth tokens SHALL be stored in the `journal.sync_connections` table keyed by `(user_id, provider)`. Each row SHALL persist `access_token`, `refresh_token`, `expires_at`, and the provider-side user id (`provider_user_id`). Disconnecting SHALL delete the row, severing the user's link to the external service without affecting any imported activities.
|
|
|
|
#### Scenario: Wahoo connect persists tokens
|
|
- **WHEN** a user completes the Wahoo OAuth flow
|
|
- **THEN** a `sync_connections` row is upserted with `provider = 'wahoo'`, the access/refresh tokens, the provider user id, and `expires_at`
|
|
|
|
#### Scenario: Disconnect removes the row but keeps imports
|
|
- **WHEN** a user clicks "Disconnect" on a Wahoo connection
|
|
- **THEN** the matching `sync_connections` row is deleted; previously imported activities are not deleted (they remain owned by the user, just no longer auto-syncing)
|
|
|
|
#### Scenario: Each user has at most one row per provider
|
|
- **WHEN** a user reconnects an already-connected provider
|
|
- **THEN** the existing `sync_connections` row is updated in place with the fresh tokens; no duplicate row is created
|