@nativesquare/soma 0.16.5 → 0.16.7

package/src/component/garmin/webhooks.ts

@@ -6,7 +6,9 @@
 import { v } from "convex/values";
 import { action, type ActionCtx } from "../_generated/server";
 import { api, internal } from "../_generated/api";
+import type { Doc } from "../_generated/dataModel";
 import type { SomaError, WebhookResult } from "../validators/shared.js";
+import { garminDeregistrationPayloadSchema } from "./schemas/deregistration.js";
 import {
   garminSkinTemperaturePingPayloadSchema,
   garminSkinTemperaturePushPayloadSchema,
@@ -873,4 +875,92 @@ export const handleGarminWebhookRespiration = action({
     );
     return { errors: [], items: [] };
   },
+});
+
+// Deregistration uses WebhookResult with nullable data (terminal event with no
+// payload to ingest), mirroring Strava's athlete-deauthorize convention.
+type GarminDeregistrationResult = WebhookResult<Record<string, unknown> | null>;
+
+/**
+ * Handle a Garmin deregistration notification.
+ *
+ * Garmin POSTs this when a user revokes access at connect.garmin.com. We mirror
+ * Strava's `athlete-deauthorize`: clear stored tokens and mark the connection
+ * inactive. Proceeds even when the connection is already inactive (e.g. a user
+ * who deregisters after a prior in-app disconnect).
+ */
+export const handleGarminWebhookDeregistration = action({
+  args: { payload: v.any(), autoIngest: v.optional(v.boolean()) },
+  handler: async (ctx, args): Promise<GarminDeregistrationResult> => {
+    const shouldIngest = args.autoIngest !== false;
+
+    const parsed = garminDeregistrationPayloadSchema.safeParse(args.payload);
+    if (!parsed.success) {
+      console.warn(
+        `[garmin:webhook:deregistration] Payload did not match schema`,
+      );
+      return { errors: [], items: [] };
+    }
+
+    const errors: SomaError[] = [];
+    const items: GarminDeregistrationResult["items"] = [];
+
+    for (const entry of parsed.data.deregistrations) {
+      const garminUserId = entry.userId;
+
+      const connection: Doc<"connections"> | null = await ctx.runQuery(
+        internal.private.getConnectionByProviderUserId,
+        { providerUserId: garminUserId, provider: "GARMIN" },
+      );
+
+      if (!connection) {
+        errors.push({
+          type: "deregistration",
+          id: garminUserId,
+          message:
+            `No Soma connection found for Garmin userId "${garminUserId}". ` +
+            "The user may have been disconnected already, or never finished OAuth.",
+        });
+        continue;
+      }
+
+      if (shouldIngest) {
+        try {
+          await ctx.runMutation(internal.private.deleteTokens, {
+            connectionId: connection._id,
+          });
+          await ctx.runMutation(api.public.disconnect, {
+            userId: connection.userId,
+            provider: "GARMIN",
+          });
+          console.log(
+            `[garmin:webhook:deregistration] completed garminUserId=${garminUserId} userId=${connection.userId}`,
+          );
+        } catch (err) {
+          console.error(
+            `[garmin:webhook:deregistration] errored garminUserId=${garminUserId} userId=${connection.userId} error=${err instanceof Error ? err.message : String(err)}`,
+          );
+          errors.push({
+            type: "deregistration",
+            id: garminUserId,
+            message: err instanceof Error ? err.message : String(err),
+          });
+          items.push({
+            connectionId: connection._id,
+            userId: connection.userId,
+            data: null,
+          });
+          continue;
+        }
+      }
+
+      items.push({
+        connectionId: connection._id,
+        userId: connection.userId,
+        data: null,
+      });
+    }
+
+    return { errors, items };
+  },
 });

package/src/component/strava/webhooks.ts

@@ -60,6 +60,9 @@ export const handleStravaWebhook = action({
     const eventName = `${payload.object_type}-${payload.aspect_type}`;
 
     if (!VALID_EVENT_NAMES.has(eventName)) {
+      console.warn(
+        `[strava:webhook] unknown eventName=${eventName} ownerId=${payload.owner_id} objectId=${payload.object_id}`,
+      );
       return { errors: [], items: [] };
     }
 
@@ -70,6 +73,9 @@ export const handleStravaWebhook = action({
     );
 
     if (!connection) {
+      console.warn(
+        `[strava:webhook] no connection found eventName=${eventName} ownerId=${payload.owner_id}`,
+      );
       return {
         errors: [{
           type: payload.object_type as SomaErrorType,
@@ -83,6 +89,9 @@ export const handleStravaWebhook = action({
 
     // Allow deauthorize to proceed even if connection is inactive
     if (!connection.active && eventName !== "athlete-deauthorize") {
+      console.warn(
+        `[strava:webhook] inactive connection eventName=${eventName} ownerId=${payload.owner_id} userId=${connection.userId}`,
+      );
       return {
         errors: [{
           type: payload.object_type as SomaErrorType,
@@ -93,6 +102,10 @@ export const handleStravaWebhook = action({
       };
     }
 
+    console.log(
+      `[strava:webhook] dispatching eventName=${eventName} ownerId=${payload.owner_id} userId=${connection.userId} objectId=${payload.object_id}`,
+    );
+
     const connectionId = connection._id;
     const userId = connection.userId;
 
@@ -105,6 +118,9 @@ export const handleStravaWebhook = action({
     }
 
     if (eventName === "activity-delete") {
+      console.log(
+        `[strava:webhook:activity-delete] received userId=${userId} objectId=${payload.object_id}`,
+      );
       return {
         errors: [],
         items: [{ connectionId, userId, data: null }],
@@ -150,6 +166,9 @@ async function handleActivityCreateOrUpdate(
     );
     accessToken = resolved.accessToken;
   } catch (err) {
+    console.error(
+      `[strava:webhook:activity] token resolution failed userId=${args.userId} objectId=${args.objectId} error=${err instanceof Error ? err.message : String(err)}`,
+    );
     return {
       errors: [{
         type: "activity",
@@ -194,11 +213,18 @@ async function handleActivityCreateOrUpdate(
       } as never);
     }
 
+    console.log(
+      `[strava:webhook:activity] completed userId=${args.userId} objectId=${args.objectId}`,
+    );
+
     return {
       errors,
       items: [{ connectionId: args.connectionId, userId: args.userId, data }],
     };
   } catch (err) {
+    console.error(
+      `[strava:webhook:activity] errored userId=${args.userId} objectId=${args.objectId} error=${err instanceof Error ? err.message : String(err)}`,
+    );
     errors.push({
       type: "activity",
       id: String(args.objectId),
@@ -226,6 +252,9 @@ async function handleAthleteUpdate(
     );
     accessToken = resolved.accessToken;
   } catch (err) {
+    console.error(
+      `[strava:webhook:athlete-update] token resolution failed userId=${args.userId} error=${err instanceof Error ? err.message : String(err)}`,
+    );
     return {
       errors: [{
         type: "athlete",
@@ -258,11 +287,18 @@ async function handleAthleteUpdate(
       } as never);
     }
 
+    console.log(
+      `[strava:webhook:athlete-update] completed userId=${args.userId}`,
+    );
+
     return {
       errors: [],
       items: [{ connectionId: args.connectionId, userId: args.userId, data }],
     };
   } catch (err) {
+    console.error(
+      `[strava:webhook:athlete-update] errored userId=${args.userId} error=${err instanceof Error ? err.message : String(err)}`,
+    );
     return {
       errors: [{
         type: "athlete",
@@ -291,7 +327,13 @@ async function handleAthleteDeauthorize(
         userId: args.userId,
         provider: "STRAVA",
       });
+      console.log(
+        `[strava:webhook:deauthorize] completed userId=${args.userId}`,
+      );
     } catch (err) {
+      console.error(
+        `[strava:webhook:deauthorize] errored userId=${args.userId} error=${err instanceof Error ? err.message : String(err)}`,
+      );
       return {
         errors: [{
           type: "athlete",

package/src/component/validators/shared.ts

@@ -26,6 +26,7 @@ export type SomaErrorType =
   // Operation types
   | "deleteSchedule"
   | "deleteWorkout"
+  | "deregistration"
   | "ingest"
   | "pushSchedule"
   | "pushWorkout";