mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
e0eaed2251
A guardian finishing a connect for a managed profile could attach their own provider account to the profile. Every OAuth callback (Withings, WHOOP, Fitbit, Google Health, Strava, Polar, Oura) now refuses a provider account another record already holds with reason already_linked, shown as its own message on the integrations page. WHOOP's owner_conflict tag becomes already_linked as well. Oura keeps the account id of a grant (personal_info, migration 0441) so the check has something to compare; existing connections fill it at their next connect. A disconnect leaves Withings webhook subscriptions and the Strava app authorisation in place while another record holds the same account, and the Withings webhook routes an account held twice to the record that linked it first instead of whichever row a lookup returned. The provider app copied from a guardian onto a managed profile is now marked (migration 0442) and removed again on disconnect or when that guardian no longer holds a live MANAGE grant: revoke, renounce, removal, handover, account deletion and data wipe. Each removal is audited as integration.client_app.removed.
13 lines
677 B
SQL
13 lines
677 B
SQL
-- Which provider apps on a record were copied from a guardian, and from whom.
|
|
--
|
|
-- A guardian connecting a provider for a managed profile lends the profile
|
|
-- their own provider app (client id and secret, still sealed). The marker lets
|
|
-- the copy be removed when the provider is disconnected or the guardian's
|
|
-- MANAGE grant ends, instead of the secret staying on the profile for good.
|
|
--
|
|
-- Nullable and unset for every existing row. A copy made before this column
|
|
-- existed carries no marker and is left as it is: there is no reliable way to
|
|
-- tell it from an app the record holds of its own.
|
|
|
|
ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "client_app_shared_by" JSONB;
|