feat: deauthorize strava

2026-05-21 20:47:10 +02:00
parent 2f33919f8b
commit eda0ffd199
5 changed files with 131 additions and 3 deletions
@@ -96,6 +96,89 @@ it('stores strava tokens from an authorization code', function () {
    ]);
 });

+it('revokes strava access before deleting the local connection', function () {
+    Http::preventStrayRequests();
+    Http::fake([
+        'https://www.strava.com/oauth/deauthorize*' => Http::response([
+            'access_token' => 'access-token',
+        ]),
+    ]);
+
+    $user = User::factory()->create();
+    StravaConnection::create([
+        'user_id' => $user->id,
+        'athlete_id' => 123456,
+        'access_token' => 'access-token',
+        'refresh_token' => 'refresh-token',
+        'expires_at' => now()->addHour(),
+        'scopes' => ['read', 'activity:read'],
+        'athlete' => ['id' => 123456],
+    ]);
+
+    Sanctum::actingAs($user);
+
+    $this->deleteJson('/api/strava/connection')->assertNoContent();
+
+    expect($user->fresh()->stravaConnection)->toBeNull();
+
+    Http::assertSent(fn ($request): bool => $request->url() === 'https://www.strava.com/oauth/deauthorize?access_token=access-token');
+});
+
+it('deletes the local strava connection when strava already rejects the token', function () {
+    Http::preventStrayRequests();
+    Http::fake([
+        'https://www.strava.com/oauth/deauthorize*' => Http::response([
+            'message' => 'Authorization Error',
+        ], 401),
+    ]);
+
+    $user = User::factory()->create();
+    StravaConnection::create([
+        'user_id' => $user->id,
+        'athlete_id' => 123456,
+        'access_token' => 'access-token',
+        'refresh_token' => 'refresh-token',
+        'expires_at' => now()->addHour(),
+        'scopes' => ['read', 'activity:read'],
+        'athlete' => ['id' => 123456],
+    ]);
+
+    Sanctum::actingAs($user);
+
+    $this->deleteJson('/api/strava/connection')->assertNoContent();
+
+    expect($user->fresh()->stravaConnection)->toBeNull();
+});
+
+it('keeps the local strava connection when strava revocation fails temporarily', function () {
+    Http::preventStrayRequests();
+    Http::fake([
+        'https://www.strava.com/oauth/deauthorize*' => Http::response([
+            'message' => 'temporary failure',
+        ], 503),
+    ]);
+
+    $user = User::factory()->create();
+    StravaConnection::create([
+        'user_id' => $user->id,
+        'athlete_id' => 123456,
+        'access_token' => 'access-token',
+        'refresh_token' => 'refresh-token',
+        'expires_at' => now()->addHour(),
+        'scopes' => ['read', 'activity:read'],
+        'athlete' => ['id' => 123456],
+    ]);
+
+    Sanctum::actingAs($user);
+
+    $this
+        ->deleteJson('/api/strava/connection')
+        ->assertStatus(502)
+        ->assertJsonPath('message', __('api.strava.disconnect_failed'));
+
+    expect($user->fresh()->stravaConnection)->not->toBeNull();
+});
+
 it('syncs strava activities into workouts', function () {
    Http::preventStrayRequests();
    Http::fake([