Skip to content

v0.1.5 — server-reported username for data requests

Choose a tag to compare

View all tags
@NovaLux12 NovaLux12 released this 19 Jul 18:27
· 25 commits to main since this release
v0.1.5
2f36a0f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

One fix from round 2 of the auth-flow research (findings), which validated the bridge's login-page scraping against Medtronic's live Auth0 Universal Login and cross-checked data fetching against nightscout-connect.

Fix

  • Data POST bodies now use the username CareLink reports from /users/me rather than CARELINK_USERNAME verbatim (#25). If you enter your email in .env while your CareLink username differs, previous versions sent the wrong identifier on every BLE/carepartner data request. Both reference implementations source the username from the server/token; the bridge now does too, with the configured value as fallback. A verbose-mode log notes when the two differ.

Research conclusions shipped as documentation (no code change)

  • Strategy 1 (automated login) assumptions validated against the live Auth0 New Universal Login page: field names, hidden state, action=default submit, and the form-action fallback all match. CAPTCHA is present but dormant (no active siteKey); wrong-credential string detection is untestable without a real failed login.
  • Both CareLink API families are alive; nightscout-connect uses the same patient-portal endpoints with plain Bearer auth — de-risking the endpoint-family watch item.
  • US SSO config verified structurally identical (own client_id/audience); v13 confirmed as current API generation; GB→EU mapping confirmed.

42/42 tests on Node 20 + 22. No new dependencies.

Assets 2
Loading