How to Integrate Lovable with Fitbit API

1// supabase/functions/fitbit-oauth/index.ts
2import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
3import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
4
5const CLIENT_ID = Deno.env.get("FITBIT_CLIENT_ID") ?? "";
6const CLIENT_SECRET = Deno.env.get("FITBIT_CLIENT_SECRET") ?? "";
7const REDIRECT_URI = Deno.env.get("FITBIT_REDIRECT_URI") ?? "";
8const corsHeaders = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "POST, OPTIONS", "Access-Control-Allow-Headers": "Content-Type, Authorization" };
9
10async function generatePKCE() {
11  const verifier = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(32)))).replace(/[+/=]/g, (c) => ({'+':'-','/':'_','=':''})[c] ?? c);
12  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
13  const challenge = btoa(String.fromCharCode(...new Uint8Array(hash))).replace(/[+/=]/g, (c) => ({'+':'-','/':'_','=':''})[c] ?? c);
14  return { verifier, challenge };
15}
16
17serve(async (req) => {
18  if (req.method === "OPTIONS") return new Response(null, { headers: corsHeaders });
19  const supabase = createClient(Deno.env.get("SUPABASE_URL") ?? "", Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "");
20  const body = await req.json();
21
22  try {
23    if (body.action === "get-auth-url") {
24      const { user_id } = body;
25      const { verifier, challenge } = await generatePKCE();
26      const state = crypto.randomUUID();
27      await supabase.from("pkce_sessions").insert({ user_id, state, code_verifier: verifier, created_at: new Date().toISOString() });
28      const params = new URLSearchParams({ response_type: "code", client_id: CLIENT_ID, scope: "activity heartrate nutrition profile sleep weight", redirect_uri: REDIRECT_URI, code_challenge: challenge, code_challenge_method: "S256", state });
29      return new Response(JSON.stringify({ url: `https://www.fitbit.com/oauth2/authorize?${params}` }), { headers: { ...corsHeaders, "Content-Type": "application/json" } });
30    }
31
32    if (body.action === "exchange") {
33      const { code, state, user_id } = body;
34      const { data: session } = await supabase.from("pkce_sessions").select("code_verifier").eq("user_id", user_id).eq("state", state).single();
35      if (!session) throw new Error("Invalid state parameter");
36
37      const credentials = btoa(`${CLIENT_ID}:${CLIENT_SECRET}`);
38      const res = await fetch("https://api.fitbit.com/oauth2/token", {
39        method: "POST",
40        headers: { "Authorization": `Basic ${credentials}`, "Content-Type": "application/x-www-form-urlencoded" },
41        body: new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: REDIRECT_URI, code_verifier: session.code_verifier }),
42      });
43      const data = await res.json();
44      if (!data.access_token) throw new Error(data.errors?.[0]?.message ?? "Token exchange failed");
45      const expiresAt = new Date(Date.now() + data.expires_in * 1000).toISOString();
46      await supabase.from("fitbit_tokens").upsert({ user_id, access_token: data.access_token, refresh_token: data.refresh_token, expires_at: expiresAt }, { onConflict: "user_id" });
47      await supabase.from("pkce_sessions").delete().eq("state", state);
48      return new Response(JSON.stringify({ success: true }), { headers: { ...corsHeaders, "Content-Type": "application/json" } });
49    }
50
51    return new Response(JSON.stringify({ error: "Unknown action" }), { status: 400, headers: corsHeaders });
52  } catch (err) {
53    return new Response(JSON.stringify({ error: err.message }), { status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" } });
54  }
55});