0360757ae8
Garmin Connect as the third connected-services provider (spec: garmin-import). The interesting parts: - Push-first ingestion: Garmin has no list endpoint. The webhook normalizes ping (callbackURL) and push (inline) notification batches into events; the slow work (authorized FIT download, FIT→GPX via the shared converter, activity creation) runs in a garmin-import-activity pg-boss job so the webhook answers fast. Callback URLs are validated against Garmin's API host before any fetch (SSRF guard). - History via backfill requests: /sync/import/garmin is a date-range requester with honest async progress (no pick list — the concept doesn't exist in a push model). Ranges chunk to Garmin's 90-day cap; overlaps are free via sync_imports dedupe. Requests persist in import_batches via two new nullable columns (range_start/range_end). - OAuth2 + PKCE on the existing oauth credential kind. Design correction from apply: the verifier rides a short-lived httpOnly cookie scoped to the callback path — the state param is visible in redirect URLs and must never carry it. Manifests opt in via pkce:true. - Deregistration notifications flip the connection to 'revoked' (row kept for audit, imports retained, re-connect prompt shown). - Framework evolutions, all additive: parseWebhook returns WebhookEvent[] (Garmin batches; Wahoo adapted), manifest gains configured()/importUrl/pkce, importActivity accepts summary stats for FIT-less imports, manager gains markRevoked. - Env-gated: no GARMIN_CLIENT_ID → provider hidden on /settings/connections. Privacy manifest entry (DE+EN). i18n en+de. Rollout (§6) stays gated on the Garmin Developer Program application (submitted 2026-06-07). Fixtures are doc-shaped; the staging soak swaps in recorded payloads if shapes differ. Gate: typecheck ✓ lint ✓ unit+integration ✓ e2e 70/72 + both known flakes green isolated ✓ openspec validate ✓ Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
66 lines
2.4 KiB
TypeScript
66 lines
2.4 KiB
TypeScript
// Manifest contract tests (spec: garmin-import, "Connect Garmin
|
|
// account" + PKCE parameters + env gating).
|
|
|
|
import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
|
|
|
|
vi.mock("../../manager.ts", () => ({
|
|
getServiceByProviderUser: vi.fn(),
|
|
markRevoked: vi.fn(),
|
|
getServiceById: vi.fn(),
|
|
withFreshCredentials: vi.fn(),
|
|
}));
|
|
vi.mock("../../../boss.server.ts", () => ({ enqueueOptional: vi.fn() }));
|
|
vi.mock("../../../sync/imports.server.ts", () => ({
|
|
isAlreadyImported: vi.fn(),
|
|
importActivity: vi.fn(),
|
|
}));
|
|
vi.mock("../../../db.ts", () => ({ getDb: () => ({}) }));
|
|
|
|
const { garminManifest } = await import("./manifest.ts");
|
|
|
|
const ENV_KEYS = ["GARMIN_CLIENT_ID", "GARMIN_CLIENT_SECRET"] as const;
|
|
const saved: Record<string, string | undefined> = {};
|
|
|
|
beforeEach(() => {
|
|
for (const k of ENV_KEYS) saved[k] = process.env[k];
|
|
});
|
|
afterEach(() => {
|
|
for (const k of ENV_KEYS) {
|
|
if (saved[k] === undefined) delete process.env[k];
|
|
else process.env[k] = saved[k];
|
|
}
|
|
});
|
|
|
|
describe("garminManifest", () => {
|
|
it("declares oauth + PKCE, no pick-list importer, custom import page", () => {
|
|
expect(garminManifest.id).toBe("garmin");
|
|
expect(garminManifest.credentialKind).toBe("oauth");
|
|
expect(garminManifest.pkce).toBe(true);
|
|
expect(garminManifest.importer).toBeUndefined();
|
|
expect(garminManifest.importUrl).toBe("/sync/import/garmin");
|
|
expect(garminManifest.webhookReceiver).toBeDefined();
|
|
});
|
|
|
|
it("is hidden without instance credentials, shown with them", () => {
|
|
delete process.env.GARMIN_CLIENT_ID;
|
|
expect(garminManifest.configured!()).toBe(false);
|
|
process.env.GARMIN_CLIENT_ID = "test-client";
|
|
expect(garminManifest.configured!()).toBe(true);
|
|
});
|
|
|
|
it("buildAuthUrl carries the S256 code challenge", () => {
|
|
process.env.GARMIN_CLIENT_ID = "test-client";
|
|
const url = new URL(
|
|
garminManifest.buildAuthUrl!(
|
|
"https://journal.example/api/sync/callback/garmin",
|
|
"state-123",
|
|
{ codeChallenge: "challenge-abc" },
|
|
),
|
|
);
|
|
expect(url.origin + url.pathname).toBe("https://connect.garmin.com/oauth2Confirm");
|
|
expect(url.searchParams.get("client_id")).toBe("test-client");
|
|
expect(url.searchParams.get("code_challenge")).toBe("challenge-abc");
|
|
expect(url.searchParams.get("code_challenge_method")).toBe("S256");
|
|
expect(url.searchParams.get("state")).toBe("state-123");
|
|
});
|
|
});
|