+ {STRAVA_CONNECT_FAILURE} +
+ )}
diff --git a/src/services/strava/stravaService.ts b/src/services/strava/stravaService.ts
index 78f6dd1..e85daf1 100644
--- a/src/services/strava/stravaService.ts
+++ b/src/services/strava/stravaService.ts
@@ -5,7 +5,13 @@ import {
import { getFunctions, httpsCallable } from 'firebase/functions';
const STRAVA_AUTHORIZE = 'https://www.strava.com/oauth/authorize';
-const STATE_STORAGE_KEY = 'mprc_strava_oauth_state';
+const STRAVA_STATE_PATTERN = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+const STRAVA_AUTHORIZATION_LIFETIME_SECONDS = 600;
+
+export type StravaAuthorizationChallenge = Readonly<{
+ state: string;
+ expiresInSeconds: 600;
+}>;
export interface StravaConnection {
provider: 'strava';
@@ -47,15 +53,51 @@ export interface StravaStatsResult {
} | null;
}
-function randomState() {
- const buf = new Uint8Array(16);
- crypto.getRandomValues(buf);
- return Array.from(buf).map((b) => b.toString(16).padStart(2, '0')).join('');
+function readStravaAuthorizationChallenge(value: unknown): StravaAuthorizationChallenge {
+ try {
+ if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+ throw new Error('invalid');
+ }
+ const prototype = Object.getPrototypeOf(value);
+ if (prototype !== Object.prototype) {
+ throw new Error('invalid');
+ }
+ const keys = Reflect.ownKeys(value);
+ if (
+ keys.length !== 2
+ || !keys.includes('state')
+ || !keys.includes('expiresInSeconds')
+ ) {
+ throw new Error('invalid');
+ }
+ const stateDescriptor = Object.getOwnPropertyDescriptor(value, 'state');
+ const expiryDescriptor = Object.getOwnPropertyDescriptor(value, 'expiresInSeconds');
+ if (
+ stateDescriptor === undefined
+ || expiryDescriptor === undefined
+ || !Object.prototype.hasOwnProperty.call(stateDescriptor, 'value')
+ || !Object.prototype.hasOwnProperty.call(expiryDescriptor, 'value')
+ || typeof stateDescriptor.value !== 'string'
+ || !STRAVA_STATE_PATTERN.test(stateDescriptor.value)
+ || expiryDescriptor.value !== STRAVA_AUTHORIZATION_LIFETIME_SECONDS
+ ) {
+ throw new Error('invalid');
+ }
+ return Object.freeze({
+ state: stateDescriptor.value,
+ expiresInSeconds: STRAVA_AUTHORIZATION_LIFETIME_SECONDS,
+ });
+ } catch {
+ throw new Error('Invalid Strava authorization response.');
+ }
}
-export function buildStravaAuthorizeUrl(clientId: string, redirectUri: string): string {
- const state = randomState();
- sessionStorage.setItem(STATE_STORAGE_KEY, state);
+export function buildStravaAuthorizeUrl(
+ clientId: string,
+ redirectUri: string,
+ challenge: unknown,
+): string {
+ const { state } = readStravaAuthorizationChallenge(challenge);
const params = new URLSearchParams({
client_id: clientId,
redirect_uri: redirectUri,
@@ -67,19 +109,29 @@ export function buildStravaAuthorizeUrl(clientId: string, redirectUri: string):
return `${STRAVA_AUTHORIZE}?${params.toString()}`;
}
-export function verifyStravaState(received: string | null): boolean {
- const expected = sessionStorage.getItem(STATE_STORAGE_KEY);
- sessionStorage.removeItem(STATE_STORAGE_KEY);
- return !!expected && expected === received;
+export async function stravaBeginAuthorization(
+ app: FirebaseApp,
+): Promise