0360757ae8
Garmin Connect as the third connected-services provider (spec: garmin-import). The interesting parts: - Push-first ingestion: Garmin has no list endpoint. The webhook normalizes ping (callbackURL) and push (inline) notification batches into events; the slow work (authorized FIT download, FIT→GPX via the shared converter, activity creation) runs in a garmin-import-activity pg-boss job so the webhook answers fast. Callback URLs are validated against Garmin's API host before any fetch (SSRF guard). - History via backfill requests: /sync/import/garmin is a date-range requester with honest async progress (no pick list — the concept doesn't exist in a push model). Ranges chunk to Garmin's 90-day cap; overlaps are free via sync_imports dedupe. Requests persist in import_batches via two new nullable columns (range_start/range_end). - OAuth2 + PKCE on the existing oauth credential kind. Design correction from apply: the verifier rides a short-lived httpOnly cookie scoped to the callback path — the state param is visible in redirect URLs and must never carry it. Manifests opt in via pkce:true. - Deregistration notifications flip the connection to 'revoked' (row kept for audit, imports retained, re-connect prompt shown). - Framework evolutions, all additive: parseWebhook returns WebhookEvent[] (Garmin batches; Wahoo adapted), manifest gains configured()/importUrl/pkce, importActivity accepts summary stats for FIT-less imports, manager gains markRevoked. - Env-gated: no GARMIN_CLIENT_ID → provider hidden on /settings/connections. Privacy manifest entry (DE+EN). i18n en+de. Rollout (§6) stays gated on the Garmin Developer Program application (submitted 2026-06-07). Fixtures are doc-shaped; the staging soak swaps in recorded payloads if shapes differ. Gate: typecheck ✓ lint ✓ unit+integration ✓ e2e 70/72 + both known flakes green isolated ✓ openspec validate ✓ Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
61 lines
2.3 KiB
TypeScript
61 lines
2.3 KiB
TypeScript
// PKCE helper tests (RFC 7636 S256) — spec: garmin-import, task 1.2.
|
|
|
|
import { createHash } from "node:crypto";
|
|
import { describe, it, expect } from "vitest";
|
|
import {
|
|
generatePkcePair,
|
|
pkceCookieHeader,
|
|
readPkceVerifier,
|
|
clearPkceCookieHeader,
|
|
encodeOAuthState,
|
|
decodeOAuthState,
|
|
} from "./oauth-state.server.ts";
|
|
|
|
describe("generatePkcePair", () => {
|
|
it("produces an RFC 7636-compliant verifier and matching S256 challenge", () => {
|
|
const { verifier, challenge } = generatePkcePair();
|
|
expect(verifier.length).toBeGreaterThanOrEqual(43);
|
|
expect(verifier.length).toBeLessThanOrEqual(128);
|
|
expect(verifier).toMatch(/^[A-Za-z0-9_-]+$/); // base64url charset
|
|
const expected = createHash("sha256").update(verifier).digest("base64url");
|
|
expect(challenge).toBe(expected);
|
|
});
|
|
|
|
it("is unique per call", () => {
|
|
expect(generatePkcePair().verifier).not.toBe(generatePkcePair().verifier);
|
|
});
|
|
});
|
|
|
|
describe("PKCE cookie round trip", () => {
|
|
it("verifier set on connect is readable on callback", () => {
|
|
const { verifier } = generatePkcePair();
|
|
const setCookie = pkceCookieHeader(verifier);
|
|
// Browser reflects the cookie value back on the callback request.
|
|
const cookieValue = setCookie.split(";")[0]!;
|
|
const request = new Request("https://x.example/api/sync/callback/garmin", {
|
|
headers: { Cookie: `other=1; ${cookieValue}` },
|
|
});
|
|
expect(readPkceVerifier(request)).toBe(verifier);
|
|
});
|
|
|
|
it("returns null without the cookie; clear header expires it", () => {
|
|
const request = new Request("https://x.example/", { headers: { Cookie: "other=1" } });
|
|
expect(readPkceVerifier(request)).toBeNull();
|
|
expect(clearPkceCookieHeader()).toContain("Max-Age=0");
|
|
});
|
|
|
|
it("cookie is httpOnly and scoped to the callback path", () => {
|
|
const header = pkceCookieHeader("v");
|
|
expect(header).toContain("HttpOnly");
|
|
expect(header).toContain("Path=/api/sync/callback");
|
|
});
|
|
});
|
|
|
|
describe("oauth state encoding (pre-existing behavior)", () => {
|
|
it("round-trips and tolerates garbage", () => {
|
|
const encoded = encodeOAuthState({ returnTo: "/settings/connections" });
|
|
expect(decodeOAuthState(encoded)).toEqual({ returnTo: "/settings/connections" });
|
|
expect(decodeOAuthState("%%%not-base64%%%")).toEqual({});
|
|
expect(decodeOAuthState(null)).toEqual({});
|
|
});
|
|
});
|