@nativesquare/soma 0.5.0 → 0.6.0

package/src/garmin/client.ts

@@ -1,7 +1,6 @@
 // ─── Garmin Health API Client ────────────────────────────────────────────────
 // Lightweight, fetch-based client for the Garmin Health API.
-// Every request is signed with OAuth 1.0a using the consumer and user tokens.
-// Uses the Web Crypto API for HMAC-SHA1 signing and global `fetch`.
+// Authenticates requests with an OAuth 2.0 Bearer token.
 
 import type {
   GarminActivity,
@@ -10,27 +9,15 @@ import type {
   GarminBodyComposition,
   GarminMenstrualCycleData,
 } from "./types.js";
-import {
-  generateNonce,
-  getTimestamp,
-  buildOAuthSignature,
-  buildOAuthHeader,
-} from "./auth.js";
 
 const DEFAULT_BASE_URL = "https://apis.garmin.com";
 
 export interface GarminClientOptions {
-  /** Your application's consumer key (from Garmin Developer Portal). */
-  consumerKey: string;
-  /** Your application's consumer secret. */
-  consumerSecret: string;
-  /** The user's permanent OAuth access token. */
+  /** The user's OAuth 2.0 access token. */
   accessToken: string;
-  /** The user's permanent OAuth token secret. */
-  tokenSecret: string;
   /**
    * Base URL of the Garmin Health API.
-   * Defaults to `https://apis.garmin.com`.
+   * @default "https://apis.garmin.com"
    */
   baseUrl?: string;
 }
@@ -38,17 +25,14 @@ export interface GarminClientOptions {
 /**
  * A lightweight client for the Garmin Health API.
  *
- * All requests are signed with OAuth 1.0a. Time-range parameters
+ * All requests are authenticated with a Bearer token. Time-range parameters
  * use Unix epoch seconds for `uploadStartTimeInSeconds` and
  * `uploadEndTimeInSeconds`.
  *
  * @example
  * ```ts
  * const client = new GarminClient({
- *   consumerKey: "your_key",
- *   consumerSecret: "your_secret",
- *   accessToken: "user_token",
- *   tokenSecret: "user_secret",
+ *   accessToken: "user_access_token",
  * });
  *
  * const dailies = await client.getDailies({
@@ -58,17 +42,11 @@ export interface GarminClientOptions {
  * ```
  */
 export class GarminClient {
-  private readonly consumerKey: string;
-  private readonly consumerSecret: string;
   private readonly accessToken: string;
-  private readonly tokenSecret: string;
   private readonly baseUrl: string;
 
   constructor(opts: GarminClientOptions) {
-    this.consumerKey = opts.consumerKey;
-    this.consumerSecret = opts.consumerSecret;
     this.accessToken = opts.accessToken;
-    this.tokenSecret = opts.tokenSecret;
     this.baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
   }
 
@@ -168,6 +146,33 @@ export class GarminClient {
     );
   }
 
+  // ─── User Deregistration ──────────────────────────────────────────────
+
+  /**
+   * Delete the user's registration with Garmin.
+   *
+   * Must be called when the user disconnects or deletes their account
+   * to comply with Garmin's API requirements.
+   */
+  async deleteUserRegistration(): Promise<void> {
+    const url = `${this.baseUrl}/wellness-api/rest/user/registration`;
+    const response = await fetch(url, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Bearer ${this.accessToken}`,
+      },
+    });
+
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      throw new GarminApiError(
+        `Garmin API error: ${response.status} ${response.statusText}`,
+        response.status,
+        body,
+      );
+    }
+  }
+
   // ─── Internal ─────────────────────────────────────────────────────────
 
   private async get<T>(
@@ -180,33 +185,10 @@ export class GarminClient {
       : "";
     const requestUrl = `${fullUrl}${qs}`;
 
-    const nonce = generateNonce();
-    const timestamp = getTimestamp();
-
-    const oauthParams: Record<string, string> = {
-      oauth_consumer_key: this.consumerKey,
-      oauth_nonce: nonce,
-      oauth_signature_method: "HMAC-SHA1",
-      oauth_timestamp: timestamp,
-      oauth_token: this.accessToken,
-      oauth_version: "1.0",
-    };
-
-    // OAuth signature must include both OAuth params and query params
-    const allParams = { ...oauthParams, ...(queryParams ?? {}) };
-    const signature = await buildOAuthSignature(
-      "GET",
-      fullUrl,
-      allParams,
-      this.consumerSecret,
-      this.tokenSecret,
-    );
-    oauthParams.oauth_signature = signature;
-
     const response = await fetch(requestUrl, {
       method: "GET",
       headers: {
-        Authorization: buildOAuthHeader(oauthParams),
+        Authorization: `Bearer ${this.accessToken}`,
         Accept: "application/json",
       },
     });

package/src/garmin/index.ts

@@ -1,7 +1,7 @@
 // ─── @nativesquare/soma/garmin ───────────────────────────────────────────────
-// Garmin Health API → Soma schema transformers, API client, OAuth helpers, and sync.
+// Garmin Health API → Soma schema transformers, API client, OAuth 2.0 PKCE helpers, and sync.
 //
-// Uses the Web Crypto API for OAuth 1.0a HMAC-SHA1 signing.
+// Uses the Web Crypto API for PKCE code challenge generation.
 // Compatible with both the Convex V8 runtime and Node.js environments.
 
 // ── Transformers ─────────────────────────────────────────────────────────────
@@ -28,19 +28,19 @@ export { mapSleepLevel } from "./maps/sleep-level.js";
 export { GarminClient, GarminApiError } from "./client.js";
 export type { GarminClientOptions, TimeRangeParams } from "./client.js";
 
-// ── OAuth Helpers ────────────────────────────────────────────────────────────
+// ── OAuth 2.0 PKCE Helpers ───────────────────────────────────────────────────
 export {
-  getRequestToken,
-  getAccessToken,
-  buildOAuthSignature,
-  buildOAuthHeader,
-  percentEncode,
-  generateNonce,
-  getTimestamp,
+  generateCodeVerifier,
+  generateCodeChallenge,
+  generateState,
+  buildAuthUrl,
+  exchangeCode,
+  refreshToken,
 } from "./auth.js";
 export type {
-  GetRequestTokenOptions,
-  GetAccessTokenOptions,
+  BuildAuthUrlOptions,
+  ExchangeCodeOptions,
+  RefreshTokenOptions,
 } from "./auth.js";
 
 // ── Sync Helpers ─────────────────────────────────────────────────────────────
@@ -70,7 +70,6 @@ export type {
   GarminMenstrualCycleData,
   GarminUserProfile,
   GarminActivityType,
-  GarminOAuthRequestTokenResponse,
-  GarminOAuthAccessTokenResponse,
+  GarminOAuth2TokenResponse,
   GarminWebhookPayload,
 } from "./types.js";

package/src/garmin/types.ts

@@ -314,16 +314,15 @@ export type GarminActivityType =
   | "FITNESS_EQUIPMENT"
   | (string & {});
 
-// ─── OAuth ──────────────────────────────────────────────────────────────────
-
-export interface GarminOAuthRequestTokenResponse {
-  oauthToken: string;
-  oauthTokenSecret: string;
-}
-
-export interface GarminOAuthAccessTokenResponse {
-  oauthToken: string;
-  oauthTokenSecret: string;
+// ─── OAuth 2.0 ──────────────────────────────────────────────────────────────
+
+export interface GarminOAuth2TokenResponse {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  token_type: string;
+  scope: string;
+  refresh_token_expires_in: number;
 }
 
 // ─── API Response Wrappers ──────────────────────────────────────────────────