@nativesquare/soma 0.17.0 → 0.18.0

package/src/component/strava/webhooks.ts

@@ -1,359 +1,360 @@
-// ─── Strava Webhook Handler ─────────────────────────────────────────────────
-// Single action that handles all Strava webhook event types.
-// Strava sends notification-only payloads to a single endpoint — the handler
-// fetches the actual data from the Strava API, transforms it, and optionally
-// ingests it into the database.
-
-import { v } from "convex/values";
-import { z } from "zod";
-import { action, type ActionCtx } from "../_generated/server";
-import { api, internal } from "../_generated/api";
-import type { Doc } from "../_generated/dataModel";
-import { createStravaClient } from "./client.js";
-import {
-  getLoggedInAthlete,
-  getActivityById,
-  getActivityStreams,
-} from "./types/stravaApi/sdk.gen.js";
-import { transformActivity } from "./transform/activity.js";
-import { transformAthlete } from "./transform/athlete.js";
-import type { SomaError, SomaErrorType, WebhookResult } from "../validators/shared.js";
-
-// ─── Schema ─────────────────────────────────────────────────────────────────
-
-const stravaWebhookPayloadSchema = z.object({
-  object_type: z.string(),
-  object_id: z.number(),
-  aspect_type: z.string(),
-  owner_id: z.number(),
-  subscription_id: z.number(),
-  event_time: z.number(),
-  updates: z.record(z.string(), z.unknown()).optional(),
-});
-
-// ─── Types ──────────────────────────────────────────────────────────────────
-
-const VALID_EVENT_NAMES = new Set([
-  "activity-create",
-  "activity-update",
-  "activity-delete",
-  "athlete-update",
-  "athlete-deauthorize",
-]);
-
-// Strava webhooks use WebhookResult with nullable data (for delete/deauthorize events).
-type StravaWebhookResult = WebhookResult<Record<string, unknown> | null>;
-
-// ─── Handler ────────────────────────────────────────────────────────────────
-
-export const handleStravaWebhook = action({
-  args: {
-    payload: v.any(),
-    clientId: v.string(),
-    clientSecret: v.string(),
-    autoIngest: v.optional(v.boolean()),
-  },
-  handler: async (ctx, args): Promise<StravaWebhookResult> => {
-    const payload = stravaWebhookPayloadSchema.parse(args.payload);
-    const { clientId, clientSecret } = args;
-    const shouldIngest = args.autoIngest !== false;
-    // Strava has no standalone deauthorize event: revocations arrive as
-    // `athlete-update` with `updates.authorized = "false"`. Remap to a
-    // synthetic `athlete-deauthorize` so we dispatch to the disconnect path.
-    const rawEventName = `${payload.object_type}-${payload.aspect_type}`;
-    const isDeauthorize =
-      rawEventName === "athlete-update" &&
-      String(payload.updates?.authorized) === "false";
-    const eventName = isDeauthorize ? "athlete-deauthorize" : rawEventName;
-
-    if (!VALID_EVENT_NAMES.has(eventName)) {
-      console.warn(
-        `[strava:webhook] unknown eventName=${eventName} ownerId=${payload.owner_id} objectId=${payload.object_id}`,
-      );
-      return { errors: [], items: [] };
-    }
-
-    // ── Resolve connection from owner_id ──────────────────────────────────
-    const connection: Doc<"connections"> | null = await ctx.runQuery(
-      internal.private.getConnectionByProviderUserId,
-      { providerUserId: String(payload.owner_id), provider: "STRAVA" },
-    );
-
-    if (!connection) {
-      console.warn(
-        `[strava:webhook] no connection found eventName=${eventName} ownerId=${payload.owner_id}`,
-      );
-      return {
-        errors: [{
-          type: payload.object_type as SomaErrorType,
-          id: String(payload.object_id),
-          message: `No Soma connection found for Strava owner_id "${payload.owner_id}". ` +
-            "The user may need to reconnect to populate the provider user ID.",
-        }],
-        items: [],
-      };
-    }
-
-    // Allow deauthorize to proceed even if connection is inactive
-    if (!connection.active && eventName !== "athlete-deauthorize") {
-      console.warn(
-        `[strava:webhook] inactive connection eventName=${eventName} ownerId=${payload.owner_id} userId=${connection.userId}`,
-      );
-      return {
-        errors: [{
-          type: payload.object_type as SomaErrorType,
-          id: String(payload.object_id),
-          message: `Strava connection for owner_id "${payload.owner_id}" is inactive`,
-        }],
-        items: [],
-      };
-    }
-
-    console.log(
-      `[strava:webhook] dispatching eventName=${eventName} ownerId=${payload.owner_id} userId=${connection.userId} objectId=${payload.object_id}`,
-    );
-
-    const connectionId = connection._id;
-    const userId = connection.userId;
-
-    // ── Dispatch by event type ───────────────────────────────────────────
-
-    if (eventName === "activity-create" || eventName === "activity-update") {
-      return await handleActivityCreateOrUpdate(
-        ctx, { connectionId, userId, objectId: payload.object_id, clientId, clientSecret, shouldIngest },
-      );
-    }
-
-    if (eventName === "activity-delete") {
-      console.log(
-        `[strava:webhook:activity-delete] received userId=${userId} objectId=${payload.object_id}`,
-      );
-      return {
-        errors: [],
-        items: [{ connectionId, userId, data: null }],
-      };
-    }
-
-    if (eventName === "athlete-update") {
-      return await handleAthleteUpdate(
-        ctx, { connectionId, userId, clientId, clientSecret, shouldIngest },
-      );
-    }
-
-    if (eventName === "athlete-deauthorize") {
-      return await handleAthleteDeauthorize(
-        ctx, { connectionId, userId, shouldIngest },
-      );
-    }
-
-    return { errors: [], items: [] };
-  },
-});
-
-// ─── Event Handlers ─────────────────────────────────────────────────────────
-
-async function handleActivityCreateOrUpdate(
-  ctx: ActionCtx,
-  args: {
-    connectionId: string;
-    userId: string;
-    objectId: number;
-    clientId: string;
-    clientSecret: string;
-    shouldIngest: boolean;
-  },
-): Promise<StravaWebhookResult> {
-  const errors: SomaError[] = [];
-
-  let accessToken: string;
-  try {
-    const resolved = await ctx.runAction(
-      internal.private.resolveConnectionAndAccessToken,
-      { userId: args.userId, provider: "STRAVA", clientId: args.clientId, clientSecret: args.clientSecret },
-    );
-    accessToken = resolved.accessToken;
-  } catch (err) {
-    console.error(
-      `[strava:webhook:activity] token resolution failed userId=${args.userId} objectId=${args.objectId} error=${err instanceof Error ? err.message : String(err)}`,
-    );
-    return {
-      errors: [{
-        type: "activity",
-        id: String(args.objectId),
-        message: `Token resolution failed: ${err instanceof Error ? err.message : String(err)}`,
-      }],
-      items: [],
-    };
-  }
-
-  const client = createStravaClient(accessToken);
-
-  try {
-    const { data: detailed, error: detailError } = await getActivityById({
-      client,
-      path: { id: args.objectId },
-    });
-    if (detailError || !detailed) {
-      throw new Error(detailError ? JSON.stringify(detailError) : "No activity data");
-    }
-
-    const { data: streams } = await getActivityStreams({
-      client,
-      path: { id: args.objectId },
-      query: {
-        keys: ["time", "heartrate", "watts", "cadence", "latlng", "altitude", "velocity_smooth", "grade_smooth", "distance", "temp"],
-        key_by_type: true,
-      },
-    });
-
-    const data = transformActivity(detailed, { streams: streams ?? undefined });
-
-    if (args.shouldIngest) {
-      await ctx.runMutation(api.public.ingestActivity, {
-        connectionId: args.connectionId,
-        userId: args.userId,
-        ...data,
-      } as never);
-      await ctx.runMutation(api.public.updateConnection, {
-        connectionId: args.connectionId,
-        lastDataUpdate: new Date().toISOString(),
-      } as never);
-    }
-
-    console.log(
-      `[strava:webhook:activity] completed userId=${args.userId} objectId=${args.objectId}`,
-    );
-
-    return {
-      errors,
-      items: [{ connectionId: args.connectionId, userId: args.userId, data }],
-    };
-  } catch (err) {
-    console.error(
-      `[strava:webhook:activity] errored userId=${args.userId} objectId=${args.objectId} error=${err instanceof Error ? err.message : String(err)}`,
-    );
-    errors.push({
-      type: "activity",
-      id: String(args.objectId),
-      message: err instanceof Error ? err.message : String(err),
-    });
-    return { errors, items: [] };
-  }
-}
-
-async function handleAthleteUpdate(
-  ctx: ActionCtx,
-  args: {
-    connectionId: string;
-    userId: string;
-    clientId: string;
-    clientSecret: string;
-    shouldIngest: boolean;
-  },
-): Promise<StravaWebhookResult> {
-  let accessToken: string;
-  try {
-    const resolved = await ctx.runAction(
-      internal.private.resolveConnectionAndAccessToken,
-      { userId: args.userId, provider: "STRAVA", clientId: args.clientId, clientSecret: args.clientSecret },
-    );
-    accessToken = resolved.accessToken;
-  } catch (err) {
-    console.error(
-      `[strava:webhook:athlete-update] token resolution failed userId=${args.userId} error=${err instanceof Error ? err.message : String(err)}`,
-    );
-    return {
-      errors: [{
-        type: "athlete",
-        id: "fetch",
-        message: `Token resolution failed: ${err instanceof Error ? err.message : String(err)}`,
-      }],
-      items: [],
-    };
-  }
-
-  const client = createStravaClient(accessToken);
-
-  try {
-    const { data: athlete, error } = await getLoggedInAthlete({ client });
-    if (error || !athlete) {
-      throw new Error(error ? JSON.stringify(error) : "No athlete data");
-    }
-
-    const data = transformAthlete(athlete);
-
-    if (args.shouldIngest) {
-      await ctx.runMutation(api.public.ingestAthlete, {
-        connectionId: args.connectionId,
-        userId: args.userId,
-        ...data,
-      } as never);
-      await ctx.runMutation(api.public.updateConnection, {
-        connectionId: args.connectionId,
-        lastDataUpdate: new Date().toISOString(),
-      } as never);
-    }
-
-    console.log(
-      `[strava:webhook:athlete-update] completed userId=${args.userId}`,
-    );
-
-    return {
-      errors: [],
-      items: [{ connectionId: args.connectionId, userId: args.userId, data }],
-    };
-  } catch (err) {
-    console.error(
-      `[strava:webhook:athlete-update] errored userId=${args.userId} error=${err instanceof Error ? err.message : String(err)}`,
-    );
-    return {
-      errors: [{
-        type: "athlete",
-        id: "fetch",
-        message: err instanceof Error ? err.message : String(err),
-      }],
-      items: [],
-    };
-  }
-}
-
-async function handleAthleteDeauthorize(
-  ctx: ActionCtx,
-  args: {
-    connectionId: string;
-    userId: string;
-    shouldIngest: boolean;
-  },
-): Promise<StravaWebhookResult> {
-  if (args.shouldIngest) {
-    try {
-      await ctx.runMutation(internal.private.deleteTokens, {
-        connectionId: args.connectionId,
-      } as never);
-      await ctx.runMutation(api.public.disconnect, {
-        userId: args.userId,
-        provider: "STRAVA",
-      });
-      console.log(
-        `[strava:webhook:deauthorize] completed userId=${args.userId}`,
-      );
-    } catch (err) {
-      console.error(
-        `[strava:webhook:deauthorize] errored userId=${args.userId} error=${err instanceof Error ? err.message : String(err)}`,
-      );
-      return {
-        errors: [{
-          type: "athlete",
-          id: "deauthorize",
-          message: err instanceof Error ? err.message : String(err),
-        }],
-        items: [{ connectionId: args.connectionId, userId: args.userId, data: null }],
-      };
-    }
-  }
-
-  return {
-    errors: [],
-    items: [{ connectionId: args.connectionId, userId: args.userId, data: null }],
-  };
-}
+// ─── Strava Webhook Handler ─────────────────────────────────────────────────
+// Single action that handles all Strava webhook event types.
+// Strava sends notification-only payloads to a single endpoint — the handler
+// fetches the actual data from the Strava API, transforms it, and optionally
+// ingests it into the database.
+
+import { v } from "convex/values";
+import { z } from "zod";
+import { action, type ActionCtx } from "../_generated/server";
+import { api, internal } from "../_generated/api";
+import type { Doc } from "../_generated/dataModel";
+import { createStravaClient } from "./client.js";
+import {
+  getLoggedInAthlete,
+  getActivityById,
+  getActivityStreams,
+} from "./types/stravaApi/sdk.gen.js";
+import { transformActivity } from "./transform/activity.js";
+import { transformAthlete } from "./transform/athlete.js";
+import type { SomaError, SomaErrorType, WebhookResult } from "../validators/shared.js";
+
+// ─── Schema ─────────────────────────────────────────────────────────────────
+
+const stravaWebhookPayloadSchema = z.object({
+  object_type: z.string(),
+  object_id: z.number(),
+  aspect_type: z.string(),
+  owner_id: z.number(),
+  subscription_id: z.number(),
+  event_time: z.number(),
+  updates: z.record(z.string(), z.unknown()).optional(),
+});
+
+// ─── Types ──────────────────────────────────────────────────────────────────
+
+const VALID_EVENT_NAMES = new Set([
+  "activity-create",
+  "activity-update",
+  "activity-delete",
+  "athlete-update",
+  "athlete-deauthorize",
+]);
+
+// Strava webhooks use WebhookResult with nullable data (for delete/deauthorize events).
+type StravaWebhookResult = WebhookResult<Record<string, unknown> | null>;
+
+// ─── Handler ────────────────────────────────────────────────────────────────
+
+export const handleStravaWebhook = action({
+  args: {
+    payload: v.any(),
+    clientId: v.string(),
+    clientSecret: v.string(),
+    autoIngestByEvent: v.optional(v.record(v.string(), v.boolean())),
+  },
+  handler: async (ctx, args): Promise<StravaWebhookResult> => {
+    const payload = stravaWebhookPayloadSchema.parse(args.payload);
+    const { clientId, clientSecret } = args;
+    // Strava has no standalone deauthorize event: revocations arrive as
+    // `athlete-update` with `updates.authorized = "false"`. Remap to a
+    // synthetic `athlete-deauthorize` so we dispatch to the disconnect path.
+    const rawEventName = `${payload.object_type}-${payload.aspect_type}`;
+    const isDeauthorize =
+      rawEventName === "athlete-update" &&
+      String(payload.updates?.authorized) === "false";
+    const eventName = isDeauthorize ? "athlete-deauthorize" : rawEventName;
+
+    if (!VALID_EVENT_NAMES.has(eventName)) {
+      console.warn(
+        `[strava:webhook] unknown eventName=${eventName} ownerId=${payload.owner_id} objectId=${payload.object_id}`,
+      );
+      return { errors: [], items: [] };
+    }
+
+    const shouldIngest = args.autoIngestByEvent?.[eventName] ?? true;
+
+    // ── Resolve connection from owner_id ──────────────────────────────────
+    const connection: Doc<"connections"> | null = await ctx.runQuery(
+      internal.private.getConnectionByProviderUserId,
+      { providerUserId: String(payload.owner_id), provider: "STRAVA" },
+    );
+
+    if (!connection) {
+      console.warn(
+        `[strava:webhook] no connection found eventName=${eventName} ownerId=${payload.owner_id}`,
+      );
+      return {
+        errors: [{
+          type: payload.object_type as SomaErrorType,
+          id: String(payload.object_id),
+          message: `No Soma connection found for Strava owner_id "${payload.owner_id}". ` +
+            "The user may need to reconnect to populate the provider user ID.",
+        }],
+        items: [],
+      };
+    }
+
+    // Allow deauthorize to proceed even if connection is inactive
+    if (!connection.active && eventName !== "athlete-deauthorize") {
+      console.warn(
+        `[strava:webhook] inactive connection eventName=${eventName} ownerId=${payload.owner_id} userId=${connection.userId}`,
+      );
+      return {
+        errors: [{
+          type: payload.object_type as SomaErrorType,
+          id: String(payload.object_id),
+          message: `Strava connection for owner_id "${payload.owner_id}" is inactive`,
+        }],
+        items: [],
+      };
+    }
+
+    console.log(
+      `[strava:webhook] dispatching eventName=${eventName} ownerId=${payload.owner_id} userId=${connection.userId} objectId=${payload.object_id}`,
+    );
+
+    const connectionId = connection._id;
+    const userId = connection.userId;
+
+    // ── Dispatch by event type ───────────────────────────────────────────
+
+    if (eventName === "activity-create" || eventName === "activity-update") {
+      return await handleActivityCreateOrUpdate(
+        ctx, { connectionId, userId, objectId: payload.object_id, clientId, clientSecret, shouldIngest },
+      );
+    }
+
+    if (eventName === "activity-delete") {
+      console.log(
+        `[strava:webhook:activity-delete] received userId=${userId} objectId=${payload.object_id}`,
+      );
+      return {
+        errors: [],
+        items: [{ connectionId, userId, data: null }],
+      };
+    }
+
+    if (eventName === "athlete-update") {
+      return await handleAthleteUpdate(
+        ctx, { connectionId, userId, clientId, clientSecret, shouldIngest },
+      );
+    }
+
+    if (eventName === "athlete-deauthorize") {
+      return await handleAthleteDeauthorize(
+        ctx, { connectionId, userId, shouldIngest },
+      );
+    }
+
+    return { errors: [], items: [] };
+  },
+});
+
+// ─── Event Handlers ─────────────────────────────────────────────────────────
+
+async function handleActivityCreateOrUpdate(
+  ctx: ActionCtx,
+  args: {
+    connectionId: string;
+    userId: string;
+    objectId: number;
+    clientId: string;
+    clientSecret: string;
+    shouldIngest: boolean;
+  },
+): Promise<StravaWebhookResult> {
+  const errors: SomaError[] = [];
+
+  let accessToken: string;
+  try {
+    const resolved = await ctx.runAction(
+      internal.private.resolveConnectionAndAccessToken,
+      { userId: args.userId, provider: "STRAVA", clientId: args.clientId, clientSecret: args.clientSecret },
+    );
+    accessToken = resolved.accessToken;
+  } catch (err) {
+    console.error(
+      `[strava:webhook:activity] token resolution failed userId=${args.userId} objectId=${args.objectId} error=${err instanceof Error ? err.message : String(err)}`,
+    );
+    return {
+      errors: [{
+        type: "activity",
+        id: String(args.objectId),
+        message: `Token resolution failed: ${err instanceof Error ? err.message : String(err)}`,
+      }],
+      items: [],
+    };
+  }
+
+  const client = createStravaClient(accessToken);
+
+  try {
+    const { data: detailed, error: detailError } = await getActivityById({
+      client,
+      path: { id: args.objectId },
+    });
+    if (detailError || !detailed) {
+      throw new Error(detailError ? JSON.stringify(detailError) : "No activity data");
+    }
+
+    const { data: streams } = await getActivityStreams({
+      client,
+      path: { id: args.objectId },
+      query: {
+        keys: ["time", "heartrate", "watts", "cadence", "latlng", "altitude", "velocity_smooth", "grade_smooth", "distance", "temp"],
+        key_by_type: true,
+      },
+    });
+
+    const data = transformActivity(detailed, { streams: streams ?? undefined });
+
+    if (args.shouldIngest) {
+      await ctx.runMutation(api.public.ingestActivity, {
+        connectionId: args.connectionId,
+        userId: args.userId,
+        ...data,
+      } as never);
+      await ctx.runMutation(api.public.updateConnection, {
+        connectionId: args.connectionId,
+        lastDataUpdate: new Date().toISOString(),
+      } as never);
+    }
+
+    console.log(
+      `[strava:webhook:activity] completed userId=${args.userId} objectId=${args.objectId}`,
+    );
+
+    return {
+      errors,
+      items: [{ connectionId: args.connectionId, userId: args.userId, data }],
+    };
+  } catch (err) {
+    console.error(
+      `[strava:webhook:activity] errored userId=${args.userId} objectId=${args.objectId} error=${err instanceof Error ? err.message : String(err)}`,
+    );
+    errors.push({
+      type: "activity",
+      id: String(args.objectId),
+      message: err instanceof Error ? err.message : String(err),
+    });
+    return { errors, items: [] };
+  }
+}
+
+async function handleAthleteUpdate(
+  ctx: ActionCtx,
+  args: {
+    connectionId: string;
+    userId: string;
+    clientId: string;
+    clientSecret: string;
+    shouldIngest: boolean;
+  },
+): Promise<StravaWebhookResult> {
+  let accessToken: string;
+  try {
+    const resolved = await ctx.runAction(
+      internal.private.resolveConnectionAndAccessToken,
+      { userId: args.userId, provider: "STRAVA", clientId: args.clientId, clientSecret: args.clientSecret },
+    );
+    accessToken = resolved.accessToken;
+  } catch (err) {
+    console.error(
+      `[strava:webhook:athlete-update] token resolution failed userId=${args.userId} error=${err instanceof Error ? err.message : String(err)}`,
+    );
+    return {
+      errors: [{
+        type: "athlete",
+        id: "fetch",
+        message: `Token resolution failed: ${err instanceof Error ? err.message : String(err)}`,
+      }],
+      items: [],
+    };
+  }
+
+  const client = createStravaClient(accessToken);
+
+  try {
+    const { data: athlete, error } = await getLoggedInAthlete({ client });
+    if (error || !athlete) {
+      throw new Error(error ? JSON.stringify(error) : "No athlete data");
+    }
+
+    const data = transformAthlete(athlete);
+
+    if (args.shouldIngest) {
+      await ctx.runMutation(api.public.ingestAthlete, {
+        connectionId: args.connectionId,
+        userId: args.userId,
+        ...data,
+      } as never);
+      await ctx.runMutation(api.public.updateConnection, {
+        connectionId: args.connectionId,
+        lastDataUpdate: new Date().toISOString(),
+      } as never);
+    }
+
+    console.log(
+      `[strava:webhook:athlete-update] completed userId=${args.userId}`,
+    );
+
+    return {
+      errors: [],
+      items: [{ connectionId: args.connectionId, userId: args.userId, data }],
+    };
+  } catch (err) {
+    console.error(
+      `[strava:webhook:athlete-update] errored userId=${args.userId} error=${err instanceof Error ? err.message : String(err)}`,
+    );
+    return {
+      errors: [{
+        type: "athlete",
+        id: "fetch",
+        message: err instanceof Error ? err.message : String(err),
+      }],
+      items: [],
+    };
+  }
+}
+
+async function handleAthleteDeauthorize(
+  ctx: ActionCtx,
+  args: {
+    connectionId: string;
+    userId: string;
+    shouldIngest: boolean;
+  },
+): Promise<StravaWebhookResult> {
+  if (args.shouldIngest) {
+    try {
+      await ctx.runMutation(internal.private.deleteTokens, {
+        connectionId: args.connectionId,
+      } as never);
+      await ctx.runMutation(api.public.disconnect, {
+        userId: args.userId,
+        provider: "STRAVA",
+      });
+      console.log(
+        `[strava:webhook:deauthorize] completed userId=${args.userId}`,
+      );
+    } catch (err) {
+      console.error(
+        `[strava:webhook:deauthorize] errored userId=${args.userId} error=${err instanceof Error ? err.message : String(err)}`,
+      );
+      return {
+        errors: [{
+          type: "athlete",
+          id: "deauthorize",
+          message: err instanceof Error ? err.message : String(err),
+        }],
+        items: [{ connectionId: args.connectionId, userId: args.userId, data: null }],
+      };
+    }
+  }
+
+  return {
+    errors: [],
+    items: [{ connectionId: args.connectionId, userId: args.userId, data: null }],
+  };
+}