git-fit 0.10.10 → 0.10.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c4cd7d43e318f96dcab83874635c24e7ead0ec772f550f2fdcd9ea7c81a6a44b
-  data.tar.gz: e106683db19d232870990bcbc59bcb35f59be4fec8c33d1141ec858632446522
+  metadata.gz: 49ad8e07b35c5dc5be5cd8e9067fdaa21dc1684a6d5d5bb14ed873243c926de5
+  data.tar.gz: 1b4057796536c438ce997cccf15268fa121f5ad28f19f7ba0af30922c374d2c5
 SHA512:
-  metadata.gz: da0ac336bbe16839be618bb0ddbcc6db7513630231b89cd690249568908d0fbe0f20110ec2904d589e18b3bb2ff14431e7138b846b9c3dd0ed65b4018f033e29
-  data.tar.gz: 101b8bc30d222858e2b61a592027ae701fb4563fdfeb832688929ba01cd7c87588411023cec5057b8af8fe7f81a15c18de62a3b25a2b97577a3f11496de3b672
+  metadata.gz: c835f47ca63aebfb8e7493fc522dca3f77768469d8b1b73d5293d882c1ccada07e03db64fae6063c5d2628ee579563e4842e75c6c5d1d2a4163a20801c337ec4
+  data.tar.gz: d0858df7943c64dd1ca22089be6eb8bfb09194fe3a2b8124c4b95051315edc095518388e6d76fe9a8d3f5c75b357a0f02cf0a7a9e075b6c9d68bf83a1bf27650

data/lib/git_fit/auth/garmin/login_session.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require_relative '../../sync/garmin_base'
+require 'json'
+require 'fileutils'
+
+module GitFit
+  module Auth
+    module Garmin
+      # Raised when MFA is required and no code is available. The login session
+      # (pre-auth cookie jar / storage_state) has already been persisted so the
+      # user can resume with `--mfa-code` without re-triggering MFA.
+      class MfaRequired < GitFit::Sync::AuthError; end
+
+      # Persists the pre-auth login session created during an interrupted MFA
+      # flow. This is a *temporary* session (30-minute TTL matching the MFA code
+      # validity window), distinct from the long-lived persistent session cookie
+      # (garmin_playwright_session_*.json) that Strategy B keeps after success.
+      module LoginSession
+        DIR = 'data/cache'
+        TTL_SECONDS = 30 * 60
+
+        module_function
+
+        def save(domain, state)
+          FileUtils.mkdir_p(DIR)
+          state['saved_at'] = Time.now.to_f
+          File.write(path(domain), JSON.generate(state))
+        end
+
+        def load(domain)
+          p = path(domain)
+          return nil unless File.exist?(p)
+
+          state = JSON.parse(File.read(p))
+          return nil if (Time.now.to_f - state['saved_at'].to_f) > TTL_SECONDS
+
+          state
+        rescue JSON::ParserError
+          nil
+        end
+
+        def clear(domain)
+          File.delete(path(domain)) if File.exist?(path(domain))
+        end
+
+        def path(domain)
+          File.join(DIR, "garmin_mfa_login_#{domain.tr('.', '_')}.json")
+        end
+      end
+    end
+  end
+end

data/lib/git_fit/auth/garmin/strategy_a.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'di_exchange'
+require_relative 'login_session'
 require_relative '../../sync/garmin_base'
 require 'open3'
 require 'tmpdir'
@@ -43,9 +44,16 @@ module GitFit
         def call(email:, password:, domain: 'garmin.com', mfa_code: nil)
           check_curl_available!
 
+          code = mfa_code.to_s.strip
+          if !code.empty? && (saved = LoginSession.load(domain))
+            return resume_login(domain, code, saved)
+          end
+
           errors = []
           begin
             return finish(mobile_login(domain, email, password, mfa_code), domain)
+          rescue MfaRequired
+            raise
           rescue GitFit::Sync::AuthError => e
             errors << "mobile+cffi: #{e.message}"
             warn "[garmin_auth] #{errors.last}"
@@ -56,6 +64,8 @@ module GitFit
 
           begin
             return finish(portal_login(domain, email, password, mfa_code), domain)
+          rescue MfaRequired
+            raise
           rescue GitFit::Sync::AuthError => e
             errors << "portal+cffi: #{e.message}"
             warn "[garmin_auth] #{errors.last}"
@@ -76,11 +86,11 @@ module GitFit
         def mobile_login(domain, email, password, mfa_code)
           sso = "https://sso.#{domain}"
           with_session_files do |jar, body|
-            mobile_login_session(sso, email, password, mfa_code, jar, body)
+            mobile_login_session(sso, domain, email, password, mfa_code, jar, body)
           end
         end
 
-        def mobile_login_session(sso, email, password, mfa_code, jar, body)
+        def mobile_login_session(sso, domain, email, password, mfa_code, jar, body)
           random_delay('mobile+cffi')
           signin_url = "#{sso}/mobile/sso/en_US/sign-in"
           get_params = { clientId: MOBILE_CLIENT_ID, service: MOBILE_SERVICE }
@@ -130,7 +140,8 @@ module GitFit
           if resp_type == 'MFA_REQUIRED'
             method = res.dig('customerMfaInfo', 'mfaLastMethodUsed') || 'email'
             res = handle_mfa(sso, method, login_params, post_headers, mfa_code,
-                             impersonate: MOBILE_FINGERPRINT, jar: jar, output: body, email: email)
+                             impersonate: MOBILE_FINGERPRINT, jar: jar, output: body,
+                             email: email, domain: domain, service_url: MOBILE_SERVICE)
             resp_type = res.dig('responseStatus', 'type')
           end
 
@@ -146,19 +157,19 @@ module GitFit
         def portal_login(domain, email, password, mfa_code)
           sso = "https://sso.#{domain}"
           TLS_FINGERPRINTS.each do |imp|
-            result = attempt_portal_fingerprint(sso, imp, email, password, mfa_code)
+            result = attempt_portal_fingerprint(sso, domain, imp, email, password, mfa_code)
             return result if result
           end
           raise GitFit::Sync::AuthError, 'portal+cffi: all TLS fingerprints exhausted'
         end
 
-        def attempt_portal_fingerprint(sso, imp, email, password, mfa_code)
+        def attempt_portal_fingerprint(sso, domain, imp, email, password, mfa_code)
           with_session_files do |jar, body|
-            attempt_portal_in_session(sso, imp, email, password, mfa_code, jar, body)
+            attempt_portal_in_session(sso, domain, imp, email, password, mfa_code, jar, body)
           end
         end
 
-        def attempt_portal_in_session(sso, imp, email, password, mfa_code, jar, body)
+        def attempt_portal_in_session(sso, domain, imp, email, password, mfa_code, jar, body)
           random_delay("portal+cffi/#{imp}")
           signin_url = "#{sso}/portal/sso/en-US/sign-in"
           get_params = { clientId: PORTAL_CLIENT_ID, service: PORTAL_SERVICE }
@@ -216,7 +227,8 @@ module GitFit
           if resp_type == 'MFA_REQUIRED'
             method = res.dig('customerMfaInfo', 'mfaLastMethodUsed') || 'email'
             res = handle_mfa(sso, method, login_params, post_headers, mfa_code,
-                             impersonate: imp, jar: jar, output: body, email: email)
+                             impersonate: imp, jar: jar, output: body,
+                             email: email, domain: domain, service_url: PORTAL_SERVICE)
             resp_type = res.dig('responseStatus', 'type')
           end
 
@@ -231,8 +243,17 @@ module GitFit
           nil
         end
 
-        def handle_mfa(sso, method, login_params, post_headers, mfa_code, impersonate:, jar:, output:, email:)
+        def handle_mfa(sso, method, login_params, post_headers, mfa_code,
+                       impersonate:, jar:, output:, email:, domain:, service_url:)
           code = resolve_mfa_code(mfa_code, email)
+          if code.nil?
+            save_login_session(domain, sso, method, login_params, post_headers, impersonate, jar, service_url)
+            raise MfaRequired, mfa_required_message(email)
+          end
+          verify_mfa(sso, method, login_params, post_headers, code, impersonate:, jar:, output:)
+        end
+
+        def verify_mfa(sso, method, login_params, post_headers, code, impersonate:, jar:, output:)
           mfa_data = {
             'mfaMethod' => method,
             'mfaVerificationCode' => code,
@@ -267,6 +288,30 @@ module GitFit
           raise GitFit::Sync::AuthError, 'MFA verification failed on all endpoints'
         end
 
+        def save_login_session(domain, sso, method, login_params, post_headers, impersonate, jar, service_url)
+          LoginSession.save(domain, {
+            'strategy' => 'A',
+            'sso' => sso,
+            'method' => method,
+            'login_params' => login_params,
+            'post_headers' => post_headers,
+            'impersonate' => impersonate,
+            'jar' => File.read(jar),
+            'service_url' => service_url,
+          })
+        end
+
+        def resume_login(domain, mfa_code, saved)
+          with_session_files do |jar, body|
+            File.write(jar, saved['jar'])
+            res = verify_mfa(saved['sso'], saved['method'], saved['login_params'],
+                             saved['post_headers'], mfa_code,
+                             impersonate: saved['impersonate'], jar: jar, output: body)
+            LoginSession.clear(domain)
+            finish([res['serviceTicketId'], saved['service_url']], domain)
+          end
+        end
+
         def resolve_mfa_code(mfa_code, email)
           code = mfa_code.to_s.strip
           if code.empty?
@@ -274,15 +319,16 @@ module GitFit
             $stderr.write('Enter the 6-digit code: ') if $stdin.tty?
             code = $stdin.gets.to_s.strip
           end
-          return code unless code.empty?
-
-          raise GitFit::Sync::AuthError,
-                "MFA required — check your email (#{email}) for the code.\n" \
-                "  This code is valid for a few minutes.\n\n" \
-                "  To continue, choose one:\n" \
-                "    echo \"<CODE>\" | git fit auth garmin #{AUTH_FLAG}\n" \
-                "    git fit auth garmin #{AUTH_FLAG} --mfa-code <CODE>\n\n" \
-                "  If the code has expired, request a new one: git fit auth garmin #{AUTH_FLAG}"
+          code.empty? ? nil : code
+        end
+
+        def mfa_required_message(email)
+          "MFA required — check your email (#{email}) for the code.\n" \
+            "  This code is valid for a few minutes.\n\n" \
+            "  To continue, choose one:\n" \
+            "    echo \"<CODE>\" | git fit auth garmin #{AUTH_FLAG}\n" \
+            "    git fit auth garmin #{AUTH_FLAG} --mfa-code <CODE>\n\n" \
+            "  If the code has expired, request a new one: git fit auth garmin #{AUTH_FLAG}"
         end
 
         def check_curl_available!

data/lib/git_fit/auth/garmin/strategy_b.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'di_exchange'
+require_relative 'login_session'
 require_relative '../../sync/garmin_base'
 require 'json'
 require 'fileutils'
@@ -29,6 +30,10 @@ module GitFit
           session_path = _session_file_path(domain)
           chrome_path = _find_chrome
 
+          if !mfa_code.empty? && (saved = LoginSession.load(domain))
+            return resume_login(domain, mfa_code, saved, chrome_path)
+          end
+
           _launch_playwright(chrome_path) do |browser|
             session = _load_session(session_path)
             warn "loaded session cookies (#{session[:age_days].round} days old)" if session
@@ -38,7 +43,7 @@ module GitFit
             context = browser.new_context(**opts)
 
             begin
-              ticket, service_url = _mobile_api_login(context.request, domain, email, password, mfa_code, sso)
+              ticket, service_url = _mobile_api_login(context, domain, email, password, mfa_code, sso)
               token = DIExchange.call(domain, ticket, service_url)
               _save_session(context, session_path)
               token
@@ -48,7 +53,23 @@ module GitFit
           end
         end
 
-        def _mobile_api_login(context, _domain, email, password, mfa_code, sso)
+        def resume_login(domain, mfa_code, saved, chrome_path)
+          _launch_playwright(chrome_path) do |browser|
+            context = browser.new_context(storageState: saved['storage_state'])
+            begin
+              ticket, = verify_mfa(context, saved['sso'], saved['method'], mfa_code)
+              token = DIExchange.call(domain, ticket, MOBILE_SERVICE)
+              _save_session(context, _session_file_path(domain))
+              LoginSession.clear(domain)
+              token
+            ensure
+              context.close
+            end
+          end
+        end
+
+        def _mobile_api_login(context, domain, email, password, mfa_code, sso)
+          req = context.request
           headers = {
             'User-Agent' => MOBILE_UA,
             'Accept' => 'application/json, text/plain, */*',
@@ -59,7 +80,7 @@ module GitFit
           params = { 'clientId' => MOBILE_CLIENT_ID, 'locale' => 'en-US', 'service' => MOBILE_SERVICE }
           referer = "#{sso}/mobile/sso/en_US/sign-in?clientId=#{MOBILE_CLIENT_ID}&service=#{MOBILE_SERVICE}"
 
-          signin_resp = context.get(
+          signin_resp = req.get(
             "#{sso}/mobile/sso/en_US/sign-in",
             params: { 'clientId' => MOBILE_CLIENT_ID, 'service' => MOBILE_SERVICE },
             headers: { 'User-Agent' => MOBILE_UA, 'Accept' => 'text/html,...', 'Accept-Language' => 'en-US,en;q=0.9' },
@@ -78,7 +99,7 @@ module GitFit
 
           _random_delay('mobile')
           warn 'posting login credentials...'
-          resp = context.post(
+          resp = req.post(
             "#{sso}/mobile/api/login",
             params: params,
             headers: headers.merge('Referer' => referer),
@@ -103,8 +124,30 @@ module GitFit
 
           mfa_method = data.dig('customerMfaInfo', 'mfaLastMethodUsed') || 'email'
           code = resolve_mfa_code(email, mfa_code)
+          if code.nil?
+            LoginSession.save(domain, {
+              'strategy' => 'B',
+              'sso' => sso,
+              'method' => mfa_method,
+              'storage_state' => context.storage_state,
+            })
+            raise MfaRequired, mfa_required_message(email)
+          end
 
+          verify_mfa(context, sso, mfa_method, code)
+        end
+
+        def verify_mfa(context, sso, mfa_method, code)
           warn 'verifying MFA code...'
+          headers = {
+            'User-Agent' => MOBILE_UA,
+            'Accept' => 'application/json, text/plain, */*',
+            'Content-Type' => 'application/json',
+            'Origin' => sso,
+            'Accept-Language' => 'en-US,en;q=0.9',
+          }
+          params = { 'clientId' => MOBILE_CLIENT_ID, 'locale' => 'en-US', 'service' => MOBILE_SERVICE }
+          referer = "#{sso}/mobile/sso/en_US/sign-in?clientId=#{MOBILE_CLIENT_ID}&service=#{MOBILE_SERVICE}"
           mfa_data = {
             'mfaMethod' => mfa_method,
             'mfaVerificationCode' => code,
@@ -113,7 +156,7 @@ module GitFit
             'mfaSetup' => false,
           }
 
-          resp = context.post(
+          resp = context.request.post(
             "#{sso}/mobile/api/mfa/verifyCode",
             params: params,
             headers: headers.merge('Referer' => referer),
@@ -143,15 +186,16 @@ module GitFit
             $stderr.write('Enter the 6-digit code: ') if $stdin.tty?
             code = $stdin.gets.to_s.strip
           end
-          return code unless code.empty?
+          code.empty? ? nil : code
+        end
 
-          raise GitFit::Sync::AuthError,
-                "MFA required — check your email (#{email}) for the code.\n" \
-                "  This code is valid for a few minutes.\n\n" \
-                "  To continue, choose one:\n" \
-                "    echo \"<CODE>\" | git fit auth garmin #{AUTH_FLAG}\n" \
-                "    git fit auth garmin #{AUTH_FLAG} --mfa-code <CODE>\n\n" \
-                "  If the code has expired, request a new one: git fit auth garmin #{AUTH_FLAG}"
+        def mfa_required_message(email)
+          "MFA required — check your email (#{email}) for the code.\n" \
+            "  This code is valid for a few minutes.\n\n" \
+            "  To continue, choose one:\n" \
+            "    echo \"<CODE>\" | git fit auth garmin #{AUTH_FLAG}\n" \
+            "    git fit auth garmin #{AUTH_FLAG} --mfa-code <CODE>\n\n" \
+            "  If the code has expired, request a new one: git fit auth garmin #{AUTH_FLAG}"
         end
 
         def _random_delay(label)

data/lib/git_fit/auth/garmin.rb

@@ -3,6 +3,7 @@
 require_relative 'garmin/strategy_a'
 require_relative 'garmin/strategy_b'
 require_relative 'garmin/di_exchange'
+require_relative 'garmin/login_session'
 require_relative '../config'
 require_relative '../cli/gh_cli'
 require 'json'
@@ -48,10 +49,10 @@ module GitFit
           if chosen.size > 1
             raise GitFit::Sync::AuthError,
                   'git fit auth garmin: -A/-B/--auto/--sync are mutually exclusive — ' \
-                  'use exactly one (default: -B)'
+                  'use exactly one (default: --auto)'
           end
 
-          chosen.first || :B
+          chosen.first || :auto
         end
 
         def flag_enabled?(flag)
@@ -88,7 +89,7 @@ module GitFit
 
         def single_strategy(label, creds)
           token, error = run_strategy(label, creds)
-          exit_with_error("Garmin auth failed: #{error}") unless token
+          exit_with_error("Garmin auth failed: #{error.message}") unless token
 
           token
         end
@@ -97,22 +98,35 @@ module GitFit
           token, b_error = run_strategy(:B, creds)
           return token if token
 
+          if b_error.is_a?(MfaRequired)
+            # B triggered MFA and saved the login session. Falling back to A
+            # would re-trigger a second MFA — stop and ask the user for the code.
+            exit_with_error(b_error.message)
+          end
+
           warn '[auto] B failed, falling back to A'
           token, a_error = run_strategy(:A, creds)
           return token if token
 
-          exit_with_error("Garmin auth failed: B: #{b_error}; A: #{a_error}")
+          exit_with_error(a_error.message) if a_error.is_a?(MfaRequired)
+
+          exit_with_error("Garmin auth failed: B: #{b_error.message}; A: #{a_error.message}")
         end
 
         def run_strategy(label, creds)
           token = STRATEGIES.fetch(label).call(**creds)
-          return [token, nil] if json_round_trips?(token)
-
-          [nil, "Strategy #{label} returned a token that fails JSON round-trip"]
+          return [token, nil] if token && json_round_trips?(token)
+
+          message = if token.nil?
+                      "Strategy #{label} failed (no token returned)"
+                    else
+                      "Strategy #{label} returned a token that fails JSON round-trip"
+                    end
+          [nil, RuntimeError.new(message)]
         rescue GitFit::Sync::AuthError => e
-          [nil, e.message]
+          [nil, e]
         rescue StandardError => e
-          [nil, "unexpected error: #{e.message}"]
+          [nil, e]
         end
 
         def json_round_trips?(token)

data/lib/git_fit/cli.rb

@@ -74,8 +74,8 @@ module GitFit
 
     desc 'auth SOURCE', 'Authenticate with a sync source (strava, garmin, garmin_cn)'
     option :A, type: :boolean, desc: 'Garmin Strategy A: curl-impersonate shellout'
-    option :B, type: :boolean, desc: 'Garmin Strategy B: Playwright (default)'
-    option :auto, type: :boolean, desc: 'Garmin auto: B first, fallback to A'
+    option :B, type: :boolean, desc: 'Garmin Strategy B: Playwright'
+    option :auto, type: :boolean, desc: 'Garmin auto: B first, fallback to A (default)'
     option :sync, type: :boolean, desc: 'Garmin: promote cached token to auth_seed'
     option :mfa_code, type: :string, desc: 'Garmin MFA code (from email), re-run to continue'
     def auth(source)

data/lib/git_fit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module GitFit
-  VERSION = '0.10.10'
+  VERSION = '0.10.11'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: git-fit
 version: !ruby/object:Gem::Version
-  version: 0.10.10
+  version: 0.10.11
 platform: ruby
 authors:
 - Lax
@@ -248,6 +248,7 @@ files:
 - lib/git-fit.rb
 - lib/git_fit/auth/garmin.rb
 - lib/git_fit/auth/garmin/di_exchange.rb
+- lib/git_fit/auth/garmin/login_session.rb
 - lib/git_fit/auth/garmin/strategy_a.rb
 - lib/git_fit/auth/garmin/strategy_b.rb
 - lib/git_fit/auth/garmin_token.rb