Skip to content

v0.1.4 — auth hardening from live-config research

Choose a tag to compare

View all tags
@NovaLux12 NovaLux12 released this 19 Jul 18:19
· 26 commits to main since this release
v0.1.4
ddc09ef
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Two fixes from the 2026-07-19 auth-flow research session (full findings: #12 comment), which validated the implementation against Medtronic's live discovery/SSO/OpenID configs and the carelink-python-client reference.

Fixes

  • Force token refresh on 401/403 (#22, fixes #21). CareLink can invalidate a token before its exp claim — most commonly when the CareLink phone app logs into the same account. The bridge previously retried the dead token until natural expiry; it now refreshes and retries. Expiry margin widened 60s→600s to match the reference client.
  • Endpoint fallback chain now includes v13 (#23). Medtronic's app discovery config advertises the carepartner API at v13; the old hardcoded fallback list only handled v5/v6/v11. Fallbacks are now derived from a version list (13, 11, 6, 5) and degrade sanely for unknown future versions.

Research conclusions (no code change needed)

  • Medtronic completed migration to Auth0 for both US and EU; the bridge implements the correct (Auth0) flow with PKCE, which the tenant explicitly supports (S256).
  • Token refresh parameters and the primary BLE data endpoint match the live config and reference implementation.
  • Remaining validation requires a real account — watch items tracked in #12.

37/37 tests on Node 20 + 22. No new dependencies.

Assets 2
Loading