@crvouga/mockingbird-service-oura 1.7.0 → 1.8.0

package/CHANGELOG.md

@@ -1,6 +1,13 @@
 # Changelog — @crvouga/mockingbird-service-oura
 
-## 1.7.0 (2026-10-19)
+## 1.8.0 (2026-10-21)
+
+### Features
+
+- raise the serve and fleet body limit to the S3 maximum ([86b9e2b](https://github.com/crvouga/mockingbird/commit/86b9e2b80bcaaaef57f52edbac50b27da0b42f33))
+- add authorize endpoints that redirect with code and state, and profile endpoints ([a686188](https://github.com/crvouga/mockingbird/commit/a6861889e02552eb31ea7f8c505db12ffc450072))
+
+## 1.7.0 (2026-10-18)
 
 ### Features
 

package/README.md

@@ -32,6 +32,12 @@ Run `mockingbird-oura serve --port 12128`; inject this origin into the consumer'
 
 POST `/oauth/token` accepts URL-encoded authorization code or refresh grants, Basic or body client credentials. Seed `clients`, `codes`, `grants` with constructor options or standard state admin routes. Default local client is `mock_client` / `mock_client_secret`; bearer `mock_oura_token` belongs to `synthetic-user`. Codes bind client, redirect, expiry and optional S256 PKCE challenge. Refresh tokens rotate once, retaining user/scopes; clock controls access expiry.
 
+GET `/oauth/authorize` is the authorization endpoint a browser visits to connect a member (live: `cloud.ouraring.com/oauth/authorize`). There is no consent page: the request is validated, then the `consents` collection answers for the user and the browser is redirected (302) to `redirect_uri` with `code` and `state`, or `error`, `error_description` and `state`. The code is stored in `codes` bound to the client, the granted scopes, the `redirect_uri` when the caller sent one (the token exchange must then repeat it) and an optional S256 `code_challenge` (the exchange then needs the matching `code_verifier`); `POST /oauth/token` redeems it once. `scope` omitted grants every scope; `state` is optional and echoed unchanged at any length. `redirect_uri` may be omitted when the client has exactly one registered. An unknown client (401 `invalid_client`), a missing `client_id`, a missing or unregistered `redirect_uri` (400 `invalid_request`, JSON `{status,error,error_description}`) is answered in place and never redirected to. Clients take optional `redirectUris` (exact match; omitted accepts any absolute http(s) URI so the default `mock_client` works as is) and `scopes` (omitted allows the documented Oura scopes: `email personal daily heartrate workout tag session spo2`). Redirected errors: `invalid_request` (no `response_type`, or a `code_challenge_method` other than `S256`), `unsupported_response_type`, `invalid_scope`.
+
+Consent controls: rows `{id, decision: "approve"|"deny"|"error", userId?, codeTtlSeconds?, error?, errorDescription?}` where `id` is a client id or `*` (every client without its own row). Seed with the `consents` option or `POST /__admin/state/consents {"id":"*","value":{"id":"*","decision":"deny"}}`. No row means approve for `synthetic-user` with a 600 second code. `deny` redirects `access_denied` and `error` redirects `server_error` (override with `error`/`errorDescription`), both with the unchanged `state` and no code. Issued codes are listed at `GET /__admin/state/codes`.
+
+GET `/v2/usercollection/personal_info` returns the token user's personal info (`id`, and as seeded `age`, `weight`, `height`, `biological_sex`, `email`): seed a `records` row with `collection: "personal_info"`, `userId` the token's user and `data` the response object (fake values only). Scope `personal` is required (403 `{detail:"Access forbidden."}` like the collections, 401 with the collections' body for an unknown or expired token, 404 `{detail:"Not Found"}` when the user has no row). `data` is returned as seeded: the `email` scope is not enforced per field. The default grant does not carry `personal`.
+
 GET `/v2/usercollection/{workout,sleep,heartrate,daily_activity,daily_spo2,daily_readiness,daily_sleep}` returns `{data,next_token}`. Heart rate uses `start_datetime/end_datetime`; others use `start_date/end_date` against `day`. Fixture windows include both endpoints, omitted bounds are unbounded. These boundary/default choices are deterministic local fixture semantics, not verified live edge-case parity. Never invent an id for heart-rate samples. Fixtures retain every supplied metric, including nulls. Scope checks use `workout`, `daily`, `heartrate`, `spo2`.
 
 Seed `records` rows `{key,userId,collection,data}`. Keys identify storage rows, not vendor ids; distinct keys can deliberately carry duplicate provider data. `pageSize` controls deterministic insertion-order pages. Consumers must retain the same collection/window while paginating; the emulator's row-key cursors do not bind or validate the query. No promised vendor cursor format/order. Set `tokenTtlSeconds` for newly issued tokens.
@@ -44,14 +50,16 @@ Standard `/__admin/health`, `/state`, `/reset`, `/requests`, `/clock`, Timeline
 
 Contract: [official Oura OpenAPI 1.41](https://cloud.ouraring.com/v2/static/json/openapi-1.41.json) and [OAuth documentation](https://cloud.ouraring.com/docs/authentication). Synthetic invalid credentials were checked live: token endpoint returned HTTP 400 `invalid_client`, collection endpoint HTTP 401 with the documented detail. Authorized collection data and refresh were not checked live.
 
+**Best guess, not oracle-verified:** the authorization endpoint and `personal_info` are not observed live, and the vendor OpenAPI JSON was not downloadable (HTTP 404) when this was added. The parameters, the all-scopes default and the single-registered-URI default follow the [Oura authentication page](https://cloud.ouraring.com/docs/authentication). The redirect status (302), the `error`/`error_description`/`state` redirect shape, the statuses and bodies for an unknown client or unregistered `redirect_uri`, the `invalid_scope` allow-list, S256-only PKCE, `access_denied`/`server_error` for consent controls and the 403 for a missing `personal` scope are the emulator's choices, not observed vendor responses. The `personal_info` fields (`id`, `age`, `weight`, `height`, `biological_sex`, `email`) come from the Oura v2 API documentation and third-party client documentation; whether the live response carries `id` is unconfirmed.
+
 `bun test` runs acceptance and every-operation self-parity including divergence detection. `bun run parity` needs `OURA_ACCESS_TOKEN`, performs safe read-only envelope checks, and never prints health data or credentials.
 
 ## Deliberately not modelled
 
-No real health data, account signup, consent UI, device pairing, sensor simulation, hardware SDK, webhooks, subscription lifecycle, field projection, statistical computation or full vendor metric validation. Records are synthetic pass-through fixtures; partial metrics can be seeded deliberately. Date boundary/default behavior, cursor internals and quota-body details are local stand-ins, not claims of exact vendor edge-case parity. No Python runtime dependency or claim that the private consumer itself was exercised.
+No real health data, account signup, a consent page (the `consents` rows stand in for the user's answer), device pairing, sensor simulation, hardware SDK, webhooks, subscription lifecycle, field projection, statistical computation or full vendor metric validation. Records are synthetic pass-through fixtures; partial metrics can be seeded deliberately. Date boundary/default behavior, cursor internals and quota-body details are local stand-ins, not claims of exact vendor edge-case parity. No Python runtime dependency or claim that the private consumer itself was exercised.
 
 ## API
 
-Root runtime exports: `OuraAPI`, `OURA_NAMESPACE`, `COLLECTION_SCOPES`, `createRuntime`, `OURA_PRESETS`, `document`, `operationIds`, `supportedOperationIds`. Types include `OuraAPIOptions`, `Grant`, `OAuthCode`, `Client`, `DataRecord`, `CollectionName`, `OuraRuntimeOptions`, `OuraRuntime`, `OperationId`, `SupportedOperationId`.
+Root runtime exports: `OuraAPI`, `OURA_NAMESPACE`, `COLLECTION_SCOPES`, `KNOWN_SCOPES`, `createRuntime`, `OURA_PRESETS`, `document`, `operationIds`, `supportedOperationIds`. Types include `OuraAPIOptions`, `Grant`, `OAuthCode`, `Client`, `Consent`, `DataRecord`, `CollectionName`, `OuraRuntimeOptions`, `OuraRuntime`, `OperationId`, `SupportedOperationId`.
 
 `/server` exports `createServer`, `serveTarget`, `DEFAULT_PORT` and types `OuraServerOptions`, `OuraServer`.

package/SUPPORT.md

@@ -2,9 +2,9 @@
 
 Generated from `openapi.yaml`; do not edit by hand.
 
-- operations in spec: **8**
-- supported by the emulator: **8**
-- parity enabled: **8**
+- operations in spec: **10**
+- supported by the emulator: **10**
+- parity enabled: **10**
 
 | operationId | route | emulator | parity | notes |
 | --- | --- | --- | --- | --- |
@@ -15,4 +15,6 @@ Generated from `openapi.yaml`; do not edit by hand.
 | `ListDailySpo2` | `GET /v2/usercollection/daily_spo2` | ✅ supported | ✅ |  |
 | `ListDailyReadiness` | `GET /v2/usercollection/daily_readiness` | ✅ supported | ✅ |  |
 | `ListDailySleep` | `GET /v2/usercollection/daily_sleep` | ✅ supported | ✅ |  |
+| `GetPersonalInfo` | `GET /v2/usercollection/personal_info` | ✅ supported | ✅ |  |
 | `OAuthToken` | `POST /oauth/token` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `OAuthAuthorize` | `GET /oauth/authorize` | ✅ supported | ⚠️ unsafe (opt-in) |  |

package/dist/{chunk-ZMBSHFPY.js → chunk-NXZZD2JL.js}

@@ -9,7 +9,7 @@ import {
   parseFaultHeader,
   resolveAdminPrefix,
   restoreClock
-} from "./chunk-IK2IQ5CW.js";
+} from "./chunk-ZPLFTMD7.js";
 
 // ../../adapters/node/dist/cli.js
 import { readFile as readFile5 } from "node:fs/promises";
@@ -3057,7 +3057,7 @@ async function preflightFleet(config, options) {
             break;
         }
       }
-      targets.set(name, { ...target, packageVersion: packageVersion ?? "1.7.0" });
+      targets.set(name, { ...target, packageVersion: packageVersion ?? "1.8.0" });
     } catch (error) {
       throw new Error(`service ${name}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -3283,7 +3283,11 @@ var serve = async (api, options = {}) => {
 // ../../adapters/node/dist/listen.js
 var listen = async (api, options = {}) => {
   const host = options.host ?? "127.0.0.1";
-  const server = await serve(api, { port: options.port ?? 0, host });
+  const server = await serve(api, {
+    port: options.port ?? 0,
+    host,
+    ...options.maxBodyBytes !== void 0 ? { maxBodyBytes: options.maxBodyBytes } : {}
+  });
   const address = server.address();
   const port = typeof address === "object" && address !== null ? address.port : options.port ?? 0;
   const shown = host.includes(":") ? `[${host}]` : host;
@@ -3482,7 +3486,8 @@ var httpChild = async (target, entry, options, admission, generation, privateAcc
   try {
     server = await listen(api, {
       port: entry.port ?? target.defaultPort,
-      host: entry.host ?? "127.0.0.1"
+      host: entry.host ?? "127.0.0.1",
+      ...target.maxBodyBytes !== void 0 ? { maxBodyBytes: target.maxBodyBytes } : {}
     });
     target.listening?.(server);
   } catch (error) {
@@ -4873,7 +4878,11 @@ var start = async (target, values, config) => {
   });
   if (config.idBase !== void 0)
     runtime.setIdBase?.(config.idBase);
-  const listening = await listen(runtime, { port: config.port, host: config.host });
+  const listening = await listen(runtime, {
+    port: config.port,
+    host: config.host,
+    ...target.maxBodyBytes !== void 0 ? { maxBodyBytes: target.maxBodyBytes } : {}
+  });
   target.listening?.(listening);
   console.log(`${target.name} emulator listening on ${listening.url}`);
   console.log(`${target.name} health: GET ${listening.url}${adminPrefix}/health`);
@@ -5002,4 +5011,4 @@ export {
   createServer2 as createServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-ZMBSHFPY.js.map
+//# sourceMappingURL=chunk-NXZZD2JL.js.map