garsync 0.2.2__tar.gz → 0.2.3__tar.gz

garsync-0.2.3/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Manu Lorente
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{garsync-0.2.2 → garsync-0.2.3}/PKG-INFO

@@ -1,7 +1,8 @@
 Metadata-Version: 2.4
 Name: garsync
-Version: 0.2.2
+Version: 0.2.3
 Summary: 
+License-File: LICENSE
 Author: Manu
 Author-email: mlorentedev@gmail.com
 Requires-Python: >=3.12
@@ -9,16 +10,14 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Requires-Dist: fastapi (>=0.141.1,<1.0.0)
-Requires-Dist: garminconnect (>=0.3.11,<0.4.0)
-Requires-Dist: pandas (<4)
-Requires-Dist: plotly (>=7.0.0,<8.0.0)
+Requires-Dist: garminconnect (>=0.3.16,<0.4.0)
 Requires-Dist: pydantic (>=2.13.5,<3.0.0)
 Requires-Dist: rich (>=15.0.0,<16.0.0)
-Requires-Dist: streamlit (>=1.63.0,<2.0.0)
 Requires-Dist: tenacity (>=9.1.4,<10.0.0)
 Requires-Dist: typer (>=0.27.2,<0.28.0)
-Requires-Dist: uvicorn[standard] (>=0.52.4,<1.0.0)
+Requires-Dist: uvicorn[standard] (>=0.53.0,<1.0.0)
 Description-Content-Type: text/markdown
 
 # GarSync
@@ -46,7 +45,7 @@ Garmin Connect provides great data, but it's locked in a proprietary cloud.
 | **Data Ownership** | Proprietary Cloud | Local SQLite (Full Control) |
 | **Customization** | Fixed Dashboards | Extensible Astro + Chart.js |
 | **Access** | Web/Mobile Only | REST API + SQL + CLI |
-| **Automation** | Manual Export | Scheduled Incremental Sync |
+| **Automation** | Manual Export | CLI sync over any date window on demand (in-process scheduler: [ADR-008](docs/adr/adr-008-ingestion-ledger-and-adapters.md)) |
 
 ## Quick Start
 

{garsync-0.2.2 → garsync-0.2.3}/README.md

@@ -23,7 +23,7 @@ Garmin Connect provides great data, but it's locked in a proprietary cloud.
 | **Data Ownership** | Proprietary Cloud | Local SQLite (Full Control) |
 | **Customization** | Fixed Dashboards | Extensible Astro + Chart.js |
 | **Access** | Web/Mobile Only | REST API + SQL + CLI |
-| **Automation** | Manual Export | Scheduled Incremental Sync |
+| **Automation** | Manual Export | CLI sync over any date window on demand (in-process scheduler: [ADR-008](docs/adr/adr-008-ingestion-ledger-and-adapters.md)) |
 
 ## Quick Start
 

{garsync-0.2.2 → garsync-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "garsync"
-version = "0.2.2"
+version = "0.2.3"
 description = ""
 authors = [
     {name = "Manu",email = "mlorentedev@gmail.com"}
@@ -8,16 +8,13 @@ authors = [
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
-    "garminconnect (>=0.3.11,<0.4.0)",
+    "garminconnect (>=0.3.16,<0.4.0)",
     "pydantic (>=2.13.5,<3.0.0)",
     "tenacity (>=9.1.4,<10.0.0)",
     "typer (>=0.27.2,<0.28.0)",
     "rich (>=15.0.0,<16.0.0)",
-    "pandas (<4)",
-    "streamlit (>=1.63.0,<2.0.0)",
-    "plotly (>=7.0.0,<8.0.0)",
     "fastapi (>=0.141.1,<1.0.0)",
-    "uvicorn[standard] (>=0.52.4,<1.0.0)",
+    "uvicorn[standard] (>=0.53.0,<1.0.0)",
 ]
 
 
@@ -36,7 +33,7 @@ dev = [
     "pytest (>=9.1.1,<10.0.0)",
     "pytest-cov (>=7.1.0,<8.0.0)",
     "mypy (>=2.3.1,<3.0.0)",
-    "ruff (>=0.16.5,<0.17.0)",
+    "ruff (>=0.16.8,<0.17.0)",
     "pytest-mock (>=3.15.1,<4.0.0)",
     "httpx (>=0.28.1,<1.0.0)"
 ]
@@ -56,6 +53,15 @@ disallow_untyped_defs = false
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 addopts = "-q"
+# Markers exist so a slower, end-to-end layer can be excluded from the default
+# run (`-m "not e2e"`) instead of being made faster by deleting it. `make smoke`
+# is today's e2e path and lives outside pytest; the marker is declared here so
+# a future pytest-driven e2e test has somewhere to land.
+markers = [
+    "unit: one layer — repository, schema, parsing, pure helpers",
+    "integration: more than one layer — CLI + database, or API + database over HTTP",
+    "e2e: the deployed shape end to end; excluded from the default run",
+]
 
 [tool.ruff]
 target-version = "py312"

{garsync-0.2.2 → garsync-0.2.3}/src/garsync/__init__.py

@@ -1,3 +1,3 @@
 """Garmin Sync Microservice"""
 
-__version__ = "0.2.2"
+__version__ = "0.2.3"

{garsync-0.2.2 → garsync-0.2.3}/src/garsync/api/auth.py

@@ -120,6 +120,26 @@ def make_session_token(access_password: str, now: float | None = None) -> str:
     return f"{expiry}.{sig}"
 
 
+def constant_time_equals(candidate: str, expected: str) -> bool:
+    """Constant-time string comparison that survives any input a client can send.
+
+    `hmac.compare_digest` refuses `str` arguments that contain non-ASCII characters and
+    raises `TypeError: comparing strings with non-ASCII characters is not supported`.
+    On an auth check that turns attacker-controlled input into an unhandled 500: sending
+    `password=ñ` to `POST /login` (percent-encoded UTF-8, which is what any browser
+    sends), a non-ASCII `X-API-KEY` header (latin-1 on the wire) or a non-ASCII session
+    cookie crashed the request **before** the failed attempt was recorded, so it was an
+    unauthenticated denial of service that also bypassed the login rate limiter.
+    Independent adversarial review of specs/SEC-001, 2026-09-25 (`agy/gemini-3.1-pro-high`),
+    filed it as a Blocker and the spec was refused until it was fixed.
+
+    Encoding both sides to UTF-8 keeps the constant-time property (the comparison is over
+    the encoded bytes) and removes the crash. Length is still observable, as it is for
+    `compare_digest` on equal-length inputs; that is not the property this protects.
+    """
+    return hmac.compare_digest(candidate.encode("utf-8"), expected.encode("utf-8"))
+
+
 def verify_session_token(token: str | None, access_password: str, now: float | None = None) -> bool:
     """Constant-time token verification; False on tamper, bad format or expiry."""
     if not token or not access_password:
@@ -133,7 +153,7 @@ def verify_session_token(token: str | None, access_password: str, now: float | N
         f"garsync-session|{expiry_str}".encode(),
         hashlib.sha256,
     ).hexdigest()
-    if not hmac.compare_digest(provided_sig, expected):
+    if not constant_time_equals(provided_sig, expected):
         return False
     current = time.time() if now is None else now
     return int(expiry_str) > current

{garsync-0.2.2 → garsync-0.2.3}/src/garsync/api/main.py

@@ -1,6 +1,5 @@
 """FastAPI application factory for garsync."""
 
-import hmac
 import logging
 import os
 import sqlite3
@@ -18,6 +17,7 @@ from garsync.api.auth import (
     SESSION_COOKIE_NAME,
     SESSION_TTL_SECONDS,
     LoginRateLimiter,
+    constant_time_equals,
     make_session_token,
     render_login_page,
     verify_session_token,
@@ -28,6 +28,11 @@ from garsync.db.schema import init_db
 
 logger = logging.getLogger("garsync.auth")
 
+# Largest login body the app will buffer before treating the attempt as failed. The
+# URL-encoded form is a handful of bytes; anything past this is a client trying to spend
+# the server's memory, and the endpoint needs no credentials to reach it.
+MAX_LOGIN_BODY_BYTES = 4096
+
 
 @asynccontextmanager
 async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
@@ -91,7 +96,7 @@ def create_app(conn: sqlite3.Connection | None = None) -> FastAPI:
             if api_key:
                 provided = request.headers.get("X-API-KEY")
                 if provided is not None:
-                    if hmac.compare_digest(provided, api_key):
+                    if constant_time_equals(provided, api_key):
                         return await call_next(request)
                     return JSONResponse(
                         status_code=status.HTTP_403_FORBIDDEN,
@@ -127,10 +132,36 @@ def create_app(conn: sqlite3.Connection | None = None) -> FastAPI:
                 status_code=status.HTTP_429_TOO_MANY_REQUESTS,
             )
 
-        form = parse_qs((await request.body()).decode())
+        # Cap what an unauthenticated endpoint will buffer: `await request.body()` read
+        # whatever the client sent, so `POST /login` was a free memory lever for anyone
+        # who could reach it. The proxy's body limit is a second line of defence, not the
+        # first one on the app's only unauthenticated write path. Independent review of
+        # specs/SEC-001 (2026-09-25) raised it as speculative; it is cheap to close, and an
+        # oversized body counts as a failed attempt rather than a distinct status, so the
+        # response is not an oracle for how the body was rejected.
+        #
+        # This cap holds only while nothing upstream has consumed the body: FastAPI does not
+        # parse one for a handler that declares no body parameter, and the auth middleware
+        # never reads it, so the request arrives unconsumed (verified: `_stream_consumed` is
+        # False at entry and the loop receives chunks). If a future middleware starts reading
+        # the body, the proxy's size limit is the remaining backstop.
+        body = b""
+        async for chunk in request.stream():
+            body += chunk
+            if len(body) > MAX_LOGIN_BODY_BYTES:
+                limiter.record_failure(client_ip)
+                return HTMLResponse(
+                    render_login_page("Invalid password. Try again."),
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                )
+
+        # errors="replace": a body that is not valid UTF-8 is a wrong password, not a
+        # 500. A bare `.decode()` raised UnicodeDecodeError on `password=\xff` —
+        # reachable unauthenticated, and the same crash class the compare fix addresses.
+        form = parse_qs(body.decode("utf-8", errors="replace"))
         supplied = form.get("password", [""])[0]
 
-        if access_password and hmac.compare_digest(supplied, access_password):
+        if access_password and constant_time_equals(supplied, access_password):
             limiter.reset(client_ip)
             response = RedirectResponse("/", status_code=status.HTTP_303_SEE_OTHER)
             response.set_cookie(