joaovitoriasilva / endurain

Endurain is a self-hosted fitness tracking service designed to give users full control over their data and hosting environment
https://docs.endurain.com/
GNU General Public License v3.0
656 stars 15 forks source link

Strava Client ID hardcoded? #20

Closed neonmaus closed 3 months ago

neonmaus commented 3 months ago

Hello I have just set up Endurain and wanted to test the Strava integration but I could not connect to Strava although STRAVA_CLIENT_ID, STRAVA_CLIENT_SECRET and STRAVA_AUTH_CODE were entered correctly in the docker-compose.yml. I kept getting this error from the Strava API: "{"message": "Bad Request", "errors":[{"resource": "Application", "field": "redirect_uri", "code": "invalid"}]}"

Then I noticed that the request to the Strava API is not sent with my STRAVA_CLIENT_ID but with the client ID "115321" and I also found this client ID in the source code of Endurain, could it be that this is perhaps a mistake and this hardcoded ID is used for OAuth instead of the one specified in the docker-compose? After I manually changed the client ID in the request to my client ID, I was able to set up the integration without any problems

The place in the code where I found the hardcoded client ID: https://github.com/joaovitoriasilva/endurain/blob/6a4fbc631369449494c9d9836454bd7ac82924dc/frontend/app/src/services/stravaService.js#L11

Greetings

joaovitoriasilva commented 3 months ago

Hello. Thanks for reaching out.

Yep clearly a mistake. I will fix it later today. There is also an issue that the Strava refresh token logic is failing but it also be fixed later today.

neonmaus commented 3 months ago

Thanks for the quick reply and I'm glad to have helped with the tip :) I think the software is really great and hope for a great future with lots of cool analysis functions

joaovitoriasilva commented 3 months ago

Thanks for the feedback. Any new features, recommendations, whatever that you find relevant, please reach out.

Regarding this issue, I just released v0.3.2 with a fix for this. There is a new ENV variable for the frontend. I recommend you re read the README and the release notes to check what changed.

jrhbcn commented 3 months ago

Hi, I am sorry to use this close issue, but I am not able to make the strava integration work as this issue suggests. I am using the latest v0.3.2 version, and I have added the required MY_APP_STRAVA_CLIENT_ID variable In the frontend part of the docker compose file. I have also added the STRAVA_CLIENT_ID, STRAVA_CLIENT_SECRET and STRAVA_AUTH_CODE in the backend all filled with the data from the strava my API application.

I get a similar but slightly different error message: {"message":"Bad Request","errors":[{"resource":"Application","field":"client_id","code":"invalid"}]}

Any ideas how to solve this? Thanks.

joaovitoriasilva commented 3 months ago

Hello @jrhbcn thanks for reaching out.

When does the error occur? In what phase of the link process?

I need to better understand what is wrong in the Strava Auth flow.

When you click on the Strava link button on the settings you should be redirected to a Strava page to accept the link. In that page can you please paste the link here so I can see the call the frontend does to Strava?

Then after accepting the link on the Strava page, the Strava should redirect you to the backend based on the settings you configured on the API settings of your account? Can you please share the redirect link?

In any of the links do you see the client ID "115321"?

Also can you share your docker compose file? So I can check what is being placed on the variables?

Please omit any details that may contain secrets.

jrhbcn commented 3 months ago

Hi @joaovitoriasilva,

Thanks for looking into this but I managed to make it work!! When looking at the redirect link I realized it was using the backend domain, not the frontend. I just changed the "authorization callback domain" in the strava API settings page to the backend (I was using the frontend) and it worked!

Is there a way to retrieve activities older than last week? I just see that button in the ndurain page?

Many thanks!

joaovitoriasilva commented 3 months ago

Awesome, glad it is fixed. I am gonna close this issue again. For it to retrieve more than 7 days, currently in the GUI it is not possible. However if you navigate to your backend url /docs, for example "http://192.168.1.10:8080/docs", you can make the call to the API with more days.

Currently I am on vacation but when I get back I can add a button to specify the number of days or a timeframe.