Fix WHOOP sync Cognito refresh and revoked token handling

Merged
AS
5mo ago
+520-243

Summary

  • Reuse stored WHOOP access tokens during sync when they are still valid, instead of calling Cognito refresh on every sync step.
  • Treat Cognito NotAuthorizedException during refresh as a revoked refresh token: delete stored tokens and surface RefreshTokenRevokedError so the UI prompts reconnect.
  • Add unit and integration coverage for token reuse, refresh failure, and revoked-token cleanup.

Test plan

  • pnpm vitest run src/providers/whoop.test.ts
  • pnpm vitest run src/providers/whoop-sync.integration.test.ts

Made with Cursor

Summary by cubic

Reuse valid WHOOP Cognito access tokens and centralize token handling so sync stops refreshing on every step. Refresh failures now trigger a clean reconnect, WHOOP uses a custom-auth flow (no developer OAuth), and tokens are validated at the boundaries.

  • Bug Fixes

    • Reuse stored access tokens when still valid; skip Cognito refresh and token writes.
    • On Cognito NotAuthorizedException, delete stored tokens and surface RefreshTokenRevokedError so the app prompts WHOOP reconnect.
    • Validate whoopAuth.saveTokens input; reject empty access/refresh tokens with clear errors.
    • Zod-validate Cognito refresh payloads before persisting refreshed credentials.

  • Refactors

    • Centralized WHOOP token logic in resolveWhoopTokens and saveWhoopAuthTokens; extracted WHOOP request logger.
    • Treated WHOOP as custom-auth: moved overrides to src/lib/custom-auth-providers, used providerRequiresStoredTokens in the worker, passed CUSTOM_AUTH_PROVIDERS to ProviderModel, and allowed custom-auth in provider-auth-policy; removed the developer OAuth path and related env checks.
    • CI: Ignore **/skills/stripe-projects symlinks in Stryker and extend integration test timeout to 12 minutes.

Summary by CodeRabbit

  • Bug Fixes

    • Improved WHOOP authentication token refresh and error handling for better reliability during account sync.
    • Enhanced token validation and storage logic for custom authentication providers.

  • Tests

    • Added comprehensive test coverage for custom authentication provider handling and WHOOP token resolution workflows.