mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-12 14:16:12 +00:00
Marc-André Bombeck
062354ab57
The classic Fitbit Web API authorises with PKCE (Authorization Code + S256), so the connect route mints a code_verifier and the callback presents it on the token exchange. Carry it on the short-lived FitbitOAuthState row. Additive + nullable (migration 0191): a legacy in-flight row carries no verifier, so the change is reversible and rerun-safe with no data loss.
9 lines
514 B
SQL
9 lines
514 B
SQL
-- v1.20.0 — classic Fitbit Web API (api.fitbit.com) authorises with PKCE
|
|
-- (Authorization Code + S256). Carry the per-handshake `code_verifier` from the
|
|
-- connect route to the callback on the short-lived OAuth-state ledger row.
|
|
--
|
|
-- Additive + nullable: a legacy in-flight row (or any non-PKCE path) simply
|
|
-- carries no verifier, so this is reversible and rerun-safe with no data loss.
|
|
-- `IF NOT EXISTS` guards a prod rerun.
|
|
ALTER TABLE "fitbit_oauth_states" ADD COLUMN IF NOT EXISTS "code_verifier" TEXT;
|