git-fit 0.10.9 → 0.10.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 990b506f035333d622b5112652251ecfb100fe152493439b2573fe002dcf2420
-  data.tar.gz: 8935f8b3f86d62926666ff6fbd37401b230f4182260421c40b7a2e5ecc9e0d03
+  metadata.gz: 49ad8e07b35c5dc5be5cd8e9067fdaa21dc1684a6d5d5bb14ed873243c926de5
+  data.tar.gz: 1b4057796536c438ce997cccf15268fa121f5ad28f19f7ba0af30922c374d2c5
 SHA512:
-  metadata.gz: 8c5306f042f21e18a8f5761342fd70a8ae13a5660fc03e02496b8dd0288e87d8711cb4bf826fa33d3509ac5497da70730708f40bb24d8cf13157ba93e94f52e6
-  data.tar.gz: d5cabbcad852447fc7b0c50489de64f83d8c732f849f0c483704f6565244759b841864d09c72bba840cb2cc265192c1b1f3b364b01c306539dd55d31fc3977e9
+  metadata.gz: c835f47ca63aebfb8e7493fc522dca3f77768469d8b1b73d5293d882c1ccada07e03db64fae6063c5d2628ee579563e4842e75c6c5d1d2a4163a20801c337ec4
+  data.tar.gz: d0858df7943c64dd1ca22089be6eb8bfb09194fe3a2b8124c4b95051315edc095518388e6d76fe9a8d3f5c75b357a0f02cf0a7a9e075b6c9d68bf83a1bf27650

data/lib/git_fit/auth/garmin/login_session.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require_relative '../../sync/garmin_base'
+require 'json'
+require 'fileutils'
+
+module GitFit
+  module Auth
+    module Garmin
+      # Raised when MFA is required and no code is available. The login session
+      # (pre-auth cookie jar / storage_state) has already been persisted so the
+      # user can resume with `--mfa-code` without re-triggering MFA.
+      class MfaRequired < GitFit::Sync::AuthError; end
+
+      # Persists the pre-auth login session created during an interrupted MFA
+      # flow. This is a *temporary* session (30-minute TTL matching the MFA code
+      # validity window), distinct from the long-lived persistent session cookie
+      # (garmin_playwright_session_*.json) that Strategy B keeps after success.
+      module LoginSession
+        DIR = 'data/cache'
+        TTL_SECONDS = 30 * 60
+
+        module_function
+
+        def save(domain, state)
+          FileUtils.mkdir_p(DIR)
+          state['saved_at'] = Time.now.to_f
+          File.write(path(domain), JSON.generate(state))
+        end
+
+        def load(domain)
+          p = path(domain)
+          return nil unless File.exist?(p)
+
+          state = JSON.parse(File.read(p))
+          return nil if (Time.now.to_f - state['saved_at'].to_f) > TTL_SECONDS
+
+          state
+        rescue JSON::ParserError
+          nil
+        end
+
+        def clear(domain)
+          File.delete(path(domain)) if File.exist?(path(domain))
+        end
+
+        def path(domain)
+          File.join(DIR, "garmin_mfa_login_#{domain.tr('.', '_')}.json")
+        end
+      end
+    end
+  end
+end

data/lib/git_fit/auth/garmin/strategy_a.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'di_exchange'
+require_relative 'login_session'
 require_relative '../../sync/garmin_base'
 require 'open3'
 require 'tmpdir'
@@ -36,15 +37,23 @@ module GitFit
         MOBILE_FINGERPRINT = 'safari18_0'
         TLS_FINGERPRINTS = %w[safari18_0 safari17_0 chrome120 edge101 chrome124].freeze
         CURL_BINARY = 'curl-impersonate'
+        AUTH_FLAG = '-A'
 
         module_function
 
         def call(email:, password:, domain: 'garmin.com', mfa_code: nil)
           check_curl_available!
 
+          code = mfa_code.to_s.strip
+          if !code.empty? && (saved = LoginSession.load(domain))
+            return resume_login(domain, code, saved)
+          end
+
           errors = []
           begin
             return finish(mobile_login(domain, email, password, mfa_code), domain)
+          rescue MfaRequired
+            raise
           rescue GitFit::Sync::AuthError => e
             errors << "mobile+cffi: #{e.message}"
             warn "[garmin_auth] #{errors.last}"
@@ -55,6 +64,8 @@ module GitFit
 
           begin
             return finish(portal_login(domain, email, password, mfa_code), domain)
+          rescue MfaRequired
+            raise
           rescue GitFit::Sync::AuthError => e
             errors << "portal+cffi: #{e.message}"
             warn "[garmin_auth] #{errors.last}"
@@ -75,11 +86,11 @@ module GitFit
         def mobile_login(domain, email, password, mfa_code)
           sso = "https://sso.#{domain}"
           with_session_files do |jar, body|
-            mobile_login_session(sso, email, password, mfa_code, jar, body)
+            mobile_login_session(sso, domain, email, password, mfa_code, jar, body)
           end
         end
 
-        def mobile_login_session(sso, email, password, mfa_code, jar, body)
+        def mobile_login_session(sso, domain, email, password, mfa_code, jar, body)
           random_delay('mobile+cffi')
           signin_url = "#{sso}/mobile/sso/en_US/sign-in"
           get_params = { clientId: MOBILE_CLIENT_ID, service: MOBILE_SERVICE }
@@ -129,7 +140,8 @@ module GitFit
           if resp_type == 'MFA_REQUIRED'
             method = res.dig('customerMfaInfo', 'mfaLastMethodUsed') || 'email'
             res = handle_mfa(sso, method, login_params, post_headers, mfa_code,
-                             impersonate: MOBILE_FINGERPRINT, jar: jar, output: body)
+                             impersonate: MOBILE_FINGERPRINT, jar: jar, output: body,
+                             email: email, domain: domain, service_url: MOBILE_SERVICE)
             resp_type = res.dig('responseStatus', 'type')
           end
 
@@ -145,19 +157,19 @@ module GitFit
         def portal_login(domain, email, password, mfa_code)
           sso = "https://sso.#{domain}"
           TLS_FINGERPRINTS.each do |imp|
-            result = attempt_portal_fingerprint(sso, imp, email, password, mfa_code)
+            result = attempt_portal_fingerprint(sso, domain, imp, email, password, mfa_code)
             return result if result
           end
           raise GitFit::Sync::AuthError, 'portal+cffi: all TLS fingerprints exhausted'
         end
 
-        def attempt_portal_fingerprint(sso, imp, email, password, mfa_code)
+        def attempt_portal_fingerprint(sso, domain, imp, email, password, mfa_code)
           with_session_files do |jar, body|
-            attempt_portal_in_session(sso, imp, email, password, mfa_code, jar, body)
+            attempt_portal_in_session(sso, domain, imp, email, password, mfa_code, jar, body)
           end
         end
 
-        def attempt_portal_in_session(sso, imp, email, password, mfa_code, jar, body)
+        def attempt_portal_in_session(sso, domain, imp, email, password, mfa_code, jar, body)
           random_delay("portal+cffi/#{imp}")
           signin_url = "#{sso}/portal/sso/en-US/sign-in"
           get_params = { clientId: PORTAL_CLIENT_ID, service: PORTAL_SERVICE }
@@ -215,7 +227,8 @@ module GitFit
           if resp_type == 'MFA_REQUIRED'
             method = res.dig('customerMfaInfo', 'mfaLastMethodUsed') || 'email'
             res = handle_mfa(sso, method, login_params, post_headers, mfa_code,
-                             impersonate: imp, jar: jar, output: body)
+                             impersonate: imp, jar: jar, output: body,
+                             email: email, domain: domain, service_url: PORTAL_SERVICE)
             resp_type = res.dig('responseStatus', 'type')
           end
 
@@ -230,8 +243,17 @@ module GitFit
           nil
         end
 
-        def handle_mfa(sso, method, login_params, post_headers, mfa_code, impersonate:, jar:, output:)
-          code = resolve_mfa_code(mfa_code)
+        def handle_mfa(sso, method, login_params, post_headers, mfa_code,
+                       impersonate:, jar:, output:, email:, domain:, service_url:)
+          code = resolve_mfa_code(mfa_code, email)
+          if code.nil?
+            save_login_session(domain, sso, method, login_params, post_headers, impersonate, jar, service_url)
+            raise MfaRequired, mfa_required_message(email)
+          end
+          verify_mfa(sso, method, login_params, post_headers, code, impersonate:, jar:, output:)
+        end
+
+        def verify_mfa(sso, method, login_params, post_headers, code, impersonate:, jar:, output:)
           mfa_data = {
             'mfaMethod' => method,
             'mfaVerificationCode' => code,
@@ -266,22 +288,47 @@ module GitFit
           raise GitFit::Sync::AuthError, 'MFA verification failed on all endpoints'
         end
 
-        def resolve_mfa_code(mfa_code)
-          code = mfa_code
-          code = ENV['SYNC__GARMIN__MFA_CODE'] if code.nil? || code.to_s.empty?
-          if (code.nil? || code.to_s.empty?) && $stdin.tty?
-            $stderr.write('Enter MFA code: ')
-            $stderr.flush
-            code = $stdin.gets
+        def save_login_session(domain, sso, method, login_params, post_headers, impersonate, jar, service_url)
+          LoginSession.save(domain, {
+            'strategy' => 'A',
+            'sso' => sso,
+            'method' => method,
+            'login_params' => login_params,
+            'post_headers' => post_headers,
+            'impersonate' => impersonate,
+            'jar' => File.read(jar),
+            'service_url' => service_url,
+          })
+        end
+
+        def resume_login(domain, mfa_code, saved)
+          with_session_files do |jar, body|
+            File.write(jar, saved['jar'])
+            res = verify_mfa(saved['sso'], saved['method'], saved['login_params'],
+                             saved['post_headers'], mfa_code,
+                             impersonate: saved['impersonate'], jar: jar, output: body)
+            LoginSession.clear(domain)
+            finish([res['serviceTicketId'], saved['service_url']], domain)
           end
-          if code.nil? || code.to_s.empty?
-            raise GitFit::Sync::AuthError,
-                  'MFA required but SYNC__GARMIN__MFA_CODE env var not set and stdin unavailable'
+        end
+
+        def resolve_mfa_code(mfa_code, email)
+          code = mfa_code.to_s.strip
+          if code.empty?
+            warn "[garmin_auth] Garmin sent a verification code to #{email}"
+            $stderr.write('Enter the 6-digit code: ') if $stdin.tty?
+            code = $stdin.gets.to_s.strip
           end
-          code = code.strip
-          raise GitFit::Sync::AuthError, 'SYNC__GARMIN__MFA_CODE is empty' if code.empty?
+          code.empty? ? nil : code
+        end
 
-          code
+        def mfa_required_message(email)
+          "MFA required — check your email (#{email}) for the code.\n" \
+            "  This code is valid for a few minutes.\n\n" \
+            "  To continue, choose one:\n" \
+            "    echo \"<CODE>\" | git fit auth garmin #{AUTH_FLAG}\n" \
+            "    git fit auth garmin #{AUTH_FLAG} --mfa-code <CODE>\n\n" \
+            "  If the code has expired, request a new one: git fit auth garmin #{AUTH_FLAG}"
         end
 
         def check_curl_available!

data/lib/git_fit/auth/garmin/strategy_b.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'di_exchange'
+require_relative 'login_session'
 require_relative '../../sync/garmin_base'
 require 'json'
 require 'fileutils'
@@ -19,16 +20,20 @@ module GitFit
         LOGIN_DELAY_MAX = 45.0
         SESSION_CACHE_DIR = 'data/cache'
         REDIRECT_STATUSES = [301, 302, 303, 307, 308].freeze
+        AUTH_FLAG = '-B'
 
         module_function
 
         def call(email:, password:, domain: 'garmin.com', mfa_code: nil)
           mfa_code = mfa_code.to_s.strip
-          mfa_code = ENV['SYNC__GARMIN__MFA_CODE'].to_s.strip if mfa_code.empty?
           sso = "https://sso.#{domain}"
           session_path = _session_file_path(domain)
           chrome_path = _find_chrome
 
+          if !mfa_code.empty? && (saved = LoginSession.load(domain))
+            return resume_login(domain, mfa_code, saved, chrome_path)
+          end
+
           _launch_playwright(chrome_path) do |browser|
             session = _load_session(session_path)
             warn "loaded session cookies (#{session[:age_days].round} days old)" if session
@@ -38,7 +43,7 @@ module GitFit
             context = browser.new_context(**opts)
 
             begin
-              ticket, service_url = _mobile_api_login(context.request, domain, email, password, mfa_code, sso)
+              ticket, service_url = _mobile_api_login(context, domain, email, password, mfa_code, sso)
               token = DIExchange.call(domain, ticket, service_url)
               _save_session(context, session_path)
               token
@@ -48,7 +53,23 @@ module GitFit
           end
         end
 
-        def _mobile_api_login(context, _domain, email, password, mfa_code, sso)
+        def resume_login(domain, mfa_code, saved, chrome_path)
+          _launch_playwright(chrome_path) do |browser|
+            context = browser.new_context(storageState: saved['storage_state'])
+            begin
+              ticket, = verify_mfa(context, saved['sso'], saved['method'], mfa_code)
+              token = DIExchange.call(domain, ticket, MOBILE_SERVICE)
+              _save_session(context, _session_file_path(domain))
+              LoginSession.clear(domain)
+              token
+            ensure
+              context.close
+            end
+          end
+        end
+
+        def _mobile_api_login(context, domain, email, password, mfa_code, sso)
+          req = context.request
           headers = {
             'User-Agent' => MOBILE_UA,
             'Accept' => 'application/json, text/plain, */*',
@@ -59,7 +80,7 @@ module GitFit
           params = { 'clientId' => MOBILE_CLIENT_ID, 'locale' => 'en-US', 'service' => MOBILE_SERVICE }
           referer = "#{sso}/mobile/sso/en_US/sign-in?clientId=#{MOBILE_CLIENT_ID}&service=#{MOBILE_SERVICE}"
 
-          signin_resp = context.get(
+          signin_resp = req.get(
             "#{sso}/mobile/sso/en_US/sign-in",
             params: { 'clientId' => MOBILE_CLIENT_ID, 'service' => MOBILE_SERVICE },
             headers: { 'User-Agent' => MOBILE_UA, 'Accept' => 'text/html,...', 'Accept-Language' => 'en-US,en;q=0.9' },
@@ -78,7 +99,7 @@ module GitFit
 
           _random_delay('mobile')
           warn 'posting login credentials...'
-          resp = context.post(
+          resp = req.post(
             "#{sso}/mobile/api/login",
             params: params,
             headers: headers.merge('Referer' => referer),
@@ -102,18 +123,31 @@ module GitFit
           raise GitFit::Sync::AuthError, "Unexpected login response: #{resp_type}" unless resp_type == 'MFA_REQUIRED'
 
           mfa_method = data.dig('customerMfaInfo', 'mfaLastMethodUsed') || 'email'
-          warn "MFA required (method: #{mfa_method})"
-
-          code = mfa_code.to_s.strip
-          if code.empty? && $stdin.tty?
-            warn 'Enter MFA code: '
-            code = $stdin.gets.to_s.strip
-          end
-          if code.empty?
-            raise GitFit::Sync::AuthError, 'MFA required but no code provided (set SYNC__GARMIN__MFA_CODE or use stdin)'
+          code = resolve_mfa_code(email, mfa_code)
+          if code.nil?
+            LoginSession.save(domain, {
+              'strategy' => 'B',
+              'sso' => sso,
+              'method' => mfa_method,
+              'storage_state' => context.storage_state,
+            })
+            raise MfaRequired, mfa_required_message(email)
           end
 
+          verify_mfa(context, sso, mfa_method, code)
+        end
+
+        def verify_mfa(context, sso, mfa_method, code)
           warn 'verifying MFA code...'
+          headers = {
+            'User-Agent' => MOBILE_UA,
+            'Accept' => 'application/json, text/plain, */*',
+            'Content-Type' => 'application/json',
+            'Origin' => sso,
+            'Accept-Language' => 'en-US,en;q=0.9',
+          }
+          params = { 'clientId' => MOBILE_CLIENT_ID, 'locale' => 'en-US', 'service' => MOBILE_SERVICE }
+          referer = "#{sso}/mobile/sso/en_US/sign-in?clientId=#{MOBILE_CLIENT_ID}&service=#{MOBILE_SERVICE}"
           mfa_data = {
             'mfaMethod' => mfa_method,
             'mfaVerificationCode' => code,
@@ -122,7 +156,7 @@ module GitFit
             'mfaSetup' => false,
           }
 
-          resp = context.post(
+          resp = context.request.post(
             "#{sso}/mobile/api/mfa/verifyCode",
             params: params,
             headers: headers.merge('Referer' => referer),
@@ -145,6 +179,25 @@ module GitFit
           url[/[?&]ticket=(ST-[^&\s]+)/, 1]
         end
 
+        def resolve_mfa_code(email, mfa_code)
+          code = mfa_code.to_s.strip
+          if code.empty?
+            warn "[garmin_auth_pw] Garmin sent a verification code to #{email}"
+            $stderr.write('Enter the 6-digit code: ') if $stdin.tty?
+            code = $stdin.gets.to_s.strip
+          end
+          code.empty? ? nil : code
+        end
+
+        def mfa_required_message(email)
+          "MFA required — check your email (#{email}) for the code.\n" \
+            "  This code is valid for a few minutes.\n\n" \
+            "  To continue, choose one:\n" \
+            "    echo \"<CODE>\" | git fit auth garmin #{AUTH_FLAG}\n" \
+            "    git fit auth garmin #{AUTH_FLAG} --mfa-code <CODE>\n\n" \
+            "  If the code has expired, request a new one: git fit auth garmin #{AUTH_FLAG}"
+        end
+
         def _random_delay(label)
           delay = rand(LOGIN_DELAY_MIN..LOGIN_DELAY_MAX)
           warn "[garmin_auth_pw] #{label}: waiting #{delay.round}s for Cloudflare..."

data/lib/git_fit/auth/garmin.rb

@@ -3,6 +3,7 @@
 require_relative 'garmin/strategy_a'
 require_relative 'garmin/strategy_b'
 require_relative 'garmin/di_exchange'
+require_relative 'garmin/login_session'
 require_relative '../config'
 require_relative '../cli/gh_cli'
 require 'json'
@@ -48,10 +49,10 @@ module GitFit
           if chosen.size > 1
             raise GitFit::Sync::AuthError,
                   'git fit auth garmin: -A/-B/--auto/--sync are mutually exclusive — ' \
-                  'use exactly one (default: -B)'
+                  'use exactly one (default: --auto)'
           end
 
-          chosen.first || :B
+          chosen.first || :auto
         end
 
         def flag_enabled?(flag)
@@ -61,6 +62,7 @@ module GitFit
         def sso_token(mode)
           email, password = sso_credentials
           creds = { email: email, password: password, domain: domain }
+          creds[:mfa_code] = @options[:mfa_code] if mfa_code_provided?
           case mode
           when :A then single_strategy(:A, creds)
           when :B then single_strategy(:B, creds)
@@ -68,6 +70,11 @@ module GitFit
           end
         end
 
+        def mfa_code_provided?
+          code = @options[:mfa_code]
+          !code.nil? && !code.to_s.strip.empty?
+        end
+
         def sso_credentials
           cfg = @config.sync_config('garmin')
           email = cfg['email'].to_s
@@ -82,7 +89,7 @@ module GitFit
 
         def single_strategy(label, creds)
           token, error = run_strategy(label, creds)
-          exit_with_error("Garmin auth failed: #{error}") unless token
+          exit_with_error("Garmin auth failed: #{error.message}") unless token
 
           token
         end
@@ -91,22 +98,35 @@ module GitFit
           token, b_error = run_strategy(:B, creds)
           return token if token
 
+          if b_error.is_a?(MfaRequired)
+            # B triggered MFA and saved the login session. Falling back to A
+            # would re-trigger a second MFA — stop and ask the user for the code.
+            exit_with_error(b_error.message)
+          end
+
           warn '[auto] B failed, falling back to A'
           token, a_error = run_strategy(:A, creds)
           return token if token
 
-          exit_with_error("Garmin auth failed: B: #{b_error}; A: #{a_error}")
+          exit_with_error(a_error.message) if a_error.is_a?(MfaRequired)
+
+          exit_with_error("Garmin auth failed: B: #{b_error.message}; A: #{a_error.message}")
         end
 
         def run_strategy(label, creds)
           token = STRATEGIES.fetch(label).call(**creds)
-          return [token, nil] if json_round_trips?(token)
-
-          [nil, "Strategy #{label} returned a token that fails JSON round-trip"]
+          return [token, nil] if token && json_round_trips?(token)
+
+          message = if token.nil?
+                      "Strategy #{label} failed (no token returned)"
+                    else
+                      "Strategy #{label} returned a token that fails JSON round-trip"
+                    end
+          [nil, RuntimeError.new(message)]
         rescue GitFit::Sync::AuthError => e
-          [nil, e.message]
+          [nil, e]
         rescue StandardError => e
-          [nil, "unexpected error: #{e.message}"]
+          [nil, e]
         end
 
         def json_round_trips?(token)

data/lib/git_fit/cli.rb

@@ -74,9 +74,10 @@ module GitFit
 
     desc 'auth SOURCE', 'Authenticate with a sync source (strava, garmin, garmin_cn)'
     option :A, type: :boolean, desc: 'Garmin Strategy A: curl-impersonate shellout'
-    option :B, type: :boolean, desc: 'Garmin Strategy B: Playwright (default)'
-    option :auto, type: :boolean, desc: 'Garmin auto: B first, fallback to A'
+    option :B, type: :boolean, desc: 'Garmin Strategy B: Playwright'
+    option :auto, type: :boolean, desc: 'Garmin auto: B first, fallback to A (default)'
     option :sync, type: :boolean, desc: 'Garmin: promote cached token to auth_seed'
+    option :mfa_code, type: :string, desc: 'Garmin MFA code (from email), re-run to continue'
     def auth(source)
       if source == 'garmin'
         GitFit::Auth::Garmin.new(options, git_fit_config).call

data/lib/git_fit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module GitFit
-  VERSION = '0.10.9'
+  VERSION = '0.10.11'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: git-fit
 version: !ruby/object:Gem::Version
-  version: 0.10.9
+  version: 0.10.11
 platform: ruby
 authors:
 - Lax
@@ -248,6 +248,7 @@ files:
 - lib/git-fit.rb
 - lib/git_fit/auth/garmin.rb
 - lib/git_fit/auth/garmin/di_exchange.rb
+- lib/git_fit/auth/garmin/login_session.rb
 - lib/git_fit/auth/garmin/strategy_a.rb
 - lib/git_fit/auth/garmin/strategy_b.rb
 - lib/git_fit/auth/garmin_token.rb