0360757ae8
Garmin Connect as the third connected-services provider (spec: garmin-import). The interesting parts: - Push-first ingestion: Garmin has no list endpoint. The webhook normalizes ping (callbackURL) and push (inline) notification batches into events; the slow work (authorized FIT download, FIT→GPX via the shared converter, activity creation) runs in a garmin-import-activity pg-boss job so the webhook answers fast. Callback URLs are validated against Garmin's API host before any fetch (SSRF guard). - History via backfill requests: /sync/import/garmin is a date-range requester with honest async progress (no pick list — the concept doesn't exist in a push model). Ranges chunk to Garmin's 90-day cap; overlaps are free via sync_imports dedupe. Requests persist in import_batches via two new nullable columns (range_start/range_end). - OAuth2 + PKCE on the existing oauth credential kind. Design correction from apply: the verifier rides a short-lived httpOnly cookie scoped to the callback path — the state param is visible in redirect URLs and must never carry it. Manifests opt in via pkce:true. - Deregistration notifications flip the connection to 'revoked' (row kept for audit, imports retained, re-connect prompt shown). - Framework evolutions, all additive: parseWebhook returns WebhookEvent[] (Garmin batches; Wahoo adapted), manifest gains configured()/importUrl/pkce, importActivity accepts summary stats for FIT-less imports, manager gains markRevoked. - Env-gated: no GARMIN_CLIENT_ID → provider hidden on /settings/connections. Privacy manifest entry (DE+EN). i18n en+de. Rollout (§6) stays gated on the Garmin Developer Program application (submitted 2026-06-07). Fixtures are doc-shaped; the staging soak swaps in recorded payloads if shapes differ. Gate: typecheck ✓ lint ✓ unit+integration ✓ e2e 70/72 + both known flakes green isolated ✓ openspec validate ✓ Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
93 lines
3 KiB
TypeScript
93 lines
3 KiB
TypeScript
import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
|
|
|
|
const mocks = vi.hoisted(() => ({
|
|
parseWebhook: vi.fn(),
|
|
handle: vi.fn(),
|
|
}));
|
|
const { parseWebhook, handle } = mocks;
|
|
|
|
vi.mock("~/lib/connected-services", () => ({
|
|
getManifest: (id: string) =>
|
|
id === "test"
|
|
? {
|
|
id: "test",
|
|
webhookReceiver: { parseWebhook: mocks.parseWebhook, handle: mocks.handle },
|
|
}
|
|
: null,
|
|
}));
|
|
|
|
import { action } from "./api.sync.webhook.$provider.ts";
|
|
|
|
function makeRequest(body: string | object, method = "POST"): Request {
|
|
const init: RequestInit = { method, headers: { "content-type": "application/json" } };
|
|
if (method !== "GET" && method !== "HEAD") {
|
|
init.body = typeof body === "string" ? body : JSON.stringify(body);
|
|
}
|
|
return new Request("http://test.local/api/sync/webhook/test", init);
|
|
}
|
|
|
|
describe("POST /api/sync/webhook/:provider", () => {
|
|
beforeEach(() => {
|
|
parseWebhook.mockReset();
|
|
handle.mockReset();
|
|
parseWebhook.mockReturnValue([]);
|
|
vi.unstubAllEnvs();
|
|
});
|
|
|
|
afterEach(() => {
|
|
vi.unstubAllEnvs();
|
|
});
|
|
|
|
function statusOf(result: unknown): number {
|
|
if (result instanceof Response) return result.status;
|
|
const init = (result as { init?: { status?: number } } | undefined)?.init;
|
|
return init?.status ?? 200;
|
|
}
|
|
|
|
async function call(body: string | object, opts: { method?: string; provider?: string } = {}) {
|
|
return action({
|
|
request: makeRequest(body, opts.method ?? "POST"),
|
|
params: { provider: opts.provider ?? "test" },
|
|
context: {} as unknown,
|
|
} as never);
|
|
}
|
|
|
|
it("returns 405 for non-POST", async () => {
|
|
const res = await call({}, { method: "GET" });
|
|
expect(statusOf(res)).toBe(405);
|
|
});
|
|
|
|
it("returns 200 silently for unknown provider", async () => {
|
|
const res = await call({}, { provider: "no-such-provider" });
|
|
expect(statusOf(res)).toBe(200);
|
|
expect(parseWebhook).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("returns 200 silently and does not invoke parseWebhook on malformed JSON", async () => {
|
|
const res = await call("not-json{");
|
|
expect(statusOf(res)).toBe(200);
|
|
expect(parseWebhook).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("returns 200 silently and does not invoke parseWebhook on a non-object body", async () => {
|
|
const res = await call("42");
|
|
expect(statusOf(res)).toBe(200);
|
|
expect(parseWebhook).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("rejects when webhook_token does not match", async () => {
|
|
vi.stubEnv("TEST_WEBHOOK_TOKEN", "expected");
|
|
const res = await call({ webhook_token: "wrong" });
|
|
expect(statusOf(res)).toBe(200);
|
|
expect(parseWebhook).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("invokes parseWebhook with a valid object body", async () => {
|
|
parseWebhook.mockReturnValue([{ eventType: "x", providerUserId: "1", workoutId: "9" }]);
|
|
handle.mockResolvedValue(undefined);
|
|
const res = await call({ event_type: "x" });
|
|
expect(statusOf(res)).toBe(200);
|
|
expect(parseWebhook).toHaveBeenCalledTimes(1);
|
|
expect(handle).toHaveBeenCalledTimes(1);
|
|
});
|
|
});
|