mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-11 05:42:19 +00:00
Marc-André Bombeck
b6f45c0d88
`oauth-kit/client.ts` builds a provider's consent URL, code exchange, refresh and deauthorization from a declaration of what differs: endpoints and scope, client authentication (form or HTTP Basic, with or without the client id beside it), the fields a grant adds, how an answer is classified and the refusal named, the error type, and where the token sits in the body. The seven hand-written copies of the redirect URI, authorization URL, token post, Basic header and PKCE pair are gone; each provider keeps an `oauth.ts` with its declaration. Shared behaviour is now uniform: a 2xx without a token object (an empty or non-JSON body) is a transient `empty_token_body` failure for every provider. WHOOP, Strava and Google Health used to return null, and Withings threw an unclassified SyntaxError; the OAuth wire golden records exactly these lines changing and nothing else. Oura's live/legacy endpoint fallback, Google's invalid_grant lift, Strava's Fault summary and Fitbit's errorType are declared per provider.
39 lines
1.2 KiB
TypeScript
39 lines
1.2 KiB
TypeScript
/**
|
|
* Helper to retrieve per-user Fitbit / Google Health OAuth credentials from the
|
|
* database. Mirrors `src/lib/whoop/credentials.ts`.
|
|
*
|
|
* Fitbit ships per-user BYO-keys: each self-hoster registers their own Google
|
|
* Cloud OAuth client and pastes the client id/secret into Settings, stored
|
|
* encrypted on `User` (the Restricted-scope brand verification + annual CASA
|
|
* assessment is per-OAuth-client, so a single shared app is unworkable for a
|
|
* multi-operator product).
|
|
*/
|
|
import { prisma } from "@/lib/db";
|
|
import { decrypt } from "@/lib/crypto";
|
|
import type { FitbitCredentials } from "./oauth";
|
|
|
|
/**
|
|
* Fetch and decrypt the user's Fitbit API credentials.
|
|
* Returns null if the user has not configured credentials.
|
|
*/
|
|
export async function getUserFitbitCredentials(
|
|
userId: string,
|
|
): Promise<FitbitCredentials | null> {
|
|
const user = await prisma.user.findUnique({
|
|
where: { id: userId },
|
|
select: {
|
|
fitbitClientIdEncrypted: true,
|
|
fitbitClientSecretEncrypted: true,
|
|
},
|
|
});
|
|
|
|
if (!user?.fitbitClientIdEncrypted || !user?.fitbitClientSecretEncrypted) {
|
|
return null;
|
|
}
|
|
|
|
return {
|
|
clientId: decrypt(user.fitbitClientIdEncrypted),
|
|
clientSecret: decrypt(user.fitbitClientSecretEncrypted),
|
|
};
|
|
}
|