@@ -55,7 +73,7 @@ export function WorkoutDetailHrSection({
title={t("insights.workouts.detail.hrChartTitle")}
titleAs="h2"
/>
- {series.source === "pulse_window" ? (
+ {hasCurve && series!.source === "pulse_window" ? (
-
+ {hasCurve ? (
+
+ ) : (
+
+ {t("insights.workouts.detail.hrNoProfile")}
+
+ )}
);
diff --git a/src/lib/workouts/__tests__/hr-series.test.ts b/src/lib/workouts/__tests__/hr-series.test.ts
index 0beab9c57..6e09a7413 100644
--- a/src/lib/workouts/__tests__/hr-series.test.ts
+++ b/src/lib/workouts/__tests__/hr-series.test.ts
@@ -180,3 +180,74 @@ describe("buildWorkoutHrSeries", () => {
expect(findMany).not.toHaveBeenCalled();
});
});
+
+/**
+ * `durationSec` is a denormalised DURATION, and not every source reports
+ * the elapsed one: Strava sends `moving_time` while the row's `endedAt`
+ * is `startedAt + elapsed_time`. A ride with 20 minutes of stops
+ * therefore carries a `durationSec` 20 minutes shorter than its own
+ * wall-clock span, and folding the curve against it drops every reading
+ * after the moving-time mark — the tail of the session vanishes with no
+ * gap, no marker, nothing that reads as missing.
+ */
+describe("buildWorkoutHrSeries — sessions whose duration is not their span", () => {
+ const SPAN_SEC = 3600;
+ const MOVING_SEC = 2400;
+ const strava = {
+ userId: "u1",
+ startedAt: START,
+ endedAt: new Date(startMs + SPAN_SEC * 1000),
+ durationSec: MOVING_SEC,
+ now: new Date(startMs + SPAN_SEC * 1000 + 1000),
+ };
+
+ it("carries a stored series to the end of the session, not to the moving-time mark", async () => {
+ const stored = Array.from({ length: SPAN_SEC / 15 }, (_, i) =>
+ storedSample(i * 15, 120 + (i % 20)),
+ );
+ const result = await buildWorkoutHrSeries({
+ ...strava,
+ storedSamples: stored,
+ });
+ expect(result).not.toBeNull();
+ const lastTSec = result!.points[result!.points.length - 1].tSec;
+ // The final bucket sits within one bucket width of the session end.
+ expect(lastTSec).toBeGreaterThanOrEqual(SPAN_SEC - result!.bucketSec);
+ expect(lastTSec).toBeLessThan(SPAN_SEC);
+ });
+
+ it("carries a pulse-window series past the moving-time mark too", async () => {
+ const rows = Array.from({ length: SPAN_SEC / 20 }, (_, i) => ({
+ value: 125 + (i % 9),
+ measuredAt: new Date(startMs + i * 20_000),
+ externalId: null,
+ }));
+ findMany.mockResolvedValue(rows);
+ const result = await buildWorkoutHrSeries({
+ ...strava,
+ storedSamples: null,
+ });
+ expect(result).not.toBeNull();
+ expect(result!.source).toBe("pulse_window");
+ const lastTSec = result!.points[result!.points.length - 1].tSec;
+ expect(lastTSec).toBeGreaterThan(MOVING_SEC);
+ // The rows sit 20 s apart, so the final one can miss the very last
+ // bucket; landing within a sample interval of the end is the claim.
+ expect(lastTSec).toBeGreaterThanOrEqual(SPAN_SEC - 20 - result!.bucketSec);
+ });
+
+ it("keeps the duration as the floor when the row carries no usable span", async () => {
+ const stored = Array.from({ length: 40 }, (_, i) =>
+ storedSample(i * 15, 130),
+ );
+ const result = await buildWorkoutHrSeries({
+ ...strava,
+ // A row whose end is not after its start: the span is unusable, so
+ // the denormalised duration has to stay the fold window.
+ endedAt: START,
+ storedSamples: stored,
+ });
+ expect(result).not.toBeNull();
+ expect(result!.bucketSec).toBe(adaptiveBucketSec(MOVING_SEC));
+ });
+});
diff --git a/src/lib/workouts/hr-series.ts b/src/lib/workouts/hr-series.ts
index e1db75335..92f4e651c 100644
--- a/src/lib/workouts/hr-series.ts
+++ b/src/lib/workouts/hr-series.ts
@@ -82,27 +82,55 @@ function median(values: number[]): number {
: sorted[mid];
}
+/**
+ * The session's own length on the wall clock.
+ *
+ * `durationSec` is a denormalised DURATION, and not every source reports
+ * the elapsed one — Strava sends `moving_time` while the row's `endedAt`
+ * is `startedAt + elapsed_time` (`src/lib/strava/client.ts`). A ride with
+ * twenty minutes of stops therefore carries a `durationSec` twenty
+ * minutes shorter than its own span, and a curve folded against it ends
+ * at the moving-time mark with no gap and no marker: the tail of the
+ * session simply is not there. The curve covers the session, so the span
+ * is what it folds over.
+ *
+ * The duration stays the floor. A row whose `endedAt` is not after its
+ * `startedAt` (a manual entry saved with one timestamp, a provider that
+ * shipped an end it could not resolve) has no usable span, and every
+ * source that computes `endedAt` from the duration lands on the same
+ * number either way.
+ */
+export function sessionSpanSec(
+ startedAt: Date,
+ endedAt: Date,
+ durationSec: number,
+): number {
+ const floor = Math.max(0, durationSec);
+ const span = Math.round((endedAt.getTime() - startedAt.getTime()) / 1000);
+ return Number.isFinite(span) && span > floor ? span : floor;
+}
+
/**
* Fold raw HR samples into session-grain buckets. Samples outside the
- * session window `[0, durationSec)` are dropped from the curve (they
- * only widen the DB query so a boundary reading still lands in bucket
- * 0 / the last bucket). Empty buckets stay as gaps — no interpolation.
+ * session window `[0, spanSec)` are dropped from the curve (they only
+ * widen the DB query so a boundary reading still lands in bucket 0 / the
+ * last bucket). Empty buckets stay as gaps — no interpolation.
* Pure; exported for unit testing.
*/
export function foldHrBuckets(
samples: readonly RawHrSample[],
startMs: number,
- durationSec: number,
+ spanSec: number,
bucketSec: number,
): { points: HrSeriesPoint[]; bucketCount: number; medianDensity: number } {
- const bucketCount = Math.max(1, Math.ceil(durationSec / bucketSec));
+ const bucketCount = Math.max(1, Math.ceil(spanSec / bucketSec));
const acc = new Map<
number,
{ sum: number; min: number; max: number; n: number }
>();
for (const s of samples) {
const rel = (s.tMs - startMs) / 1000;
- if (rel < 0 || rel >= durationSec) continue;
+ if (rel < 0 || rel >= spanSec) continue;
const idx = Math.floor(rel / bucketSec);
const bucket = acc.get(idx);
if (bucket) {
@@ -171,7 +199,11 @@ export async function buildWorkoutHrSeries(
const { userId, startedAt, endedAt, durationSec, storedSamples } = input;
const now = input.now ?? new Date();
const startMs = startedAt.getTime();
- const bucketSec = adaptiveBucketSec(durationSec);
+ // Fold over the session's span, not its duration — see `sessionSpanSec`.
+ // The bucket width tracks the span too, so a stop-heavy ride keeps the
+ // same on-screen point density as a continuous one of the same length.
+ const spanSec = sessionSpanSec(startedAt, endedAt, durationSec);
+ const bucketSec = adaptiveBucketSec(spanSec);
// 1. Stored series — the native, highest-fidelity path.
const stored = parseStoredSamples(storedSamples);
@@ -179,7 +211,7 @@ export async function buildWorkoutHrSeries(
const { points, medianDensity } = foldHrBuckets(
stored,
startMs,
- durationSec,
+ spanSec,
bucketSec,
);
if (points.length >= 2) {
@@ -222,7 +254,7 @@ export async function buildWorkoutHrSeries(
const { points, bucketCount, medianDensity } = foldHrBuckets(
raw,
startMs,
- durationSec,
+ spanSec,
bucketSec,
);
diff --git a/tests/integration/workout-detail-hr-series.test.ts b/tests/integration/workout-detail-hr-series.test.ts
new file mode 100644
index 000000000..fff801a84
--- /dev/null
+++ b/tests/integration/workout-detail-hr-series.test.ts
@@ -0,0 +1,270 @@
+/**
+ * Integration suite for the heart-rate curve on `GET /api/workouts/{id}`.
+ *
+ * The curve is the one part of the workout-detail envelope that is
+ * assembled from rows the workout does not own: when a session carries no
+ * stored sensor stream, the server reconstructs it from the account's raw
+ * `PULSE` measurements around the session. Two boundaries decide whether
+ * that reconstruction is honest, and neither is provable from a unit test
+ * with a mocked Prisma:
+ *
+ * - the WINDOW. A reading taken after the session ended is not part of
+ * the session. The query pads by five minutes so a boundary reading
+ * still lands in the first / last bucket, and the fold then clamps to
+ * the session itself — a pad reading must not extend the curve past
+ * the finish.
+ * - the OWNER. The measurement read is scoped to the calling account.
+ * Another account's pulse at the same wall-clock minute must not
+ * enter this curve.
+ *
+ * Both run through the real route against a real Postgres, and the
+ * fixture places a reading on the far side of each boundary with a bpm
+ * value no in-window reading has, so a leak is visible in the numbers
+ * rather than only in a count.
+ */
+import { NextRequest } from "next/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { cookieJar, headerJar } from "./mock-next-headers";
+import { getPrismaClient, truncateAllTables } from "./setup";
+
+process.env.ENCRYPTION_KEY =
+ "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+
+const TEST_USER_ID = "user-workout-hr-series";
+const OTHER_USER_ID = "user-workout-hr-series-other";
+
+vi.mock("next/headers", async () => {
+ const { cookieJar, headerJar } = await import("./mock-next-headers");
+ return {
+ headers: vi.fn(async () => ({
+ get: (name: string) => headerJar.get(name.toLowerCase()) ?? null,
+ })),
+ cookies: vi.fn(async () => ({
+ get: (name: string) => {
+ const value = cookieJar.get(name);
+ return value ? { name, value } : undefined;
+ },
+ set: (name: string, value: string) => {
+ cookieJar.set(name, value);
+ },
+ delete: (name: string) => {
+ cookieJar.delete(name);
+ },
+ })),
+ };
+});
+
+vi.mock("@/lib/db-compat", () => ({
+ ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
+}));
+
+const { GET } = await import("@/app/api/workouts/[id]/route");
+
+/** Session window: 07:00 → 07:30 on a fixed day. */
+const STARTED_AT = new Date("2026-05-15T07:00:00.000Z");
+const ENDED_AT = new Date("2026-05-15T07:30:00.000Z");
+const SPAN_SEC = 1800;
+
+/**
+ * In-window readings sit in this band; every out-of-window reading is
+ * placed outside it, so an assertion on the curve's bpm bounds names any
+ * leak directly.
+ */
+const IN_WINDOW_LOW = 120;
+const IN_WINDOW_HIGH = 168;
+/** After the finish but inside the query's five-minute pad. */
+const PAD_TAIL_BPM = 44;
+/** Well outside the padded window on either side. */
+const FAR_BEFORE_BPM = 201;
+const FAR_AFTER_BPM = 51;
+/** Another account's reading in the middle of this session. */
+const FOREIGN_BPM = 199;
+
+interface HrSeriesPoint {
+ tSec: number;
+ mean: number;
+ min: number;
+ max: number;
+}
+
+interface WorkoutDetailBody {
+ data: {
+ id: string;
+ hrSeries: {
+ source: string;
+ bucketSec: number;
+ envelope: boolean;
+ points: HrSeriesPoint[];
+ } | null;
+ } | null;
+ error: string | null;
+}
+
+async function createUser(id: string, username: string) {
+ await getPrismaClient().user.create({
+ data: { id, username, email: `${username}@example.test` },
+ });
+}
+
+beforeEach(async () => {
+ await truncateAllTables(getPrismaClient());
+ cookieJar.clear();
+ headerJar.clear();
+ await createUser(TEST_USER_ID, "workout-hr-series");
+ await createUser(OTHER_USER_ID, "workout-hr-series-other");
+ const session = await getPrismaClient().session.create({
+ data: {
+ userId: TEST_USER_ID,
+ expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+ },
+ });
+ cookieJar.set("healthlog_session", session.id);
+});
+
+/**
+ * The session under test, with no stored sample stream — so the route has
+ * to reconstruct the curve from `PULSE` rows and the boundaries above are
+ * the ones that decide what it sees.
+ */
+async function createWorkout(): Promise