Implement the new authentication and scope changes as described here: https://developers.strava.com/docs/oauth-updates/

Important Dates
October 15, 2018
New OAuth endpoints for acquiring short-lived access tokens and refresh tokens are available. New scopes are available.

January 15, 2019
Email address is no longer part of the profile:read_all scope and is removed from the athlete model.

October 15, 2019
Forever tokens are rejected by the server. Old OAuth endpoints for obtaining forever tokens are removed.

Comments

basvredeling created an issue. See original summary.

basvredeling’s picture

basvredeling
Primary language Dutch
Location Amsterdam
commented
Issue summary: View changes
basvredeling’s picture

basvredeling
Primary language Dutch
Location Amsterdam
commented

Starting tomorrow, the email address will be removed from the athlete data. So onwards it will be problematic trying to couple Drupal users to Strava athletes based on email. This issue urgently needs some attention.

Problem 1:

strava_user_login() will no longer work.

Problem 2:

The AthleteUserHandler no longer works as designed, especially: userExists() & userCreate().

Problem 3:

I think the "write" scope is already invalid.

Problem 4:

The Athlete and AthleteInterface needs to be reworked (is the email property still valid?).

Problem 5:

The StravaPHP library is not up-to-date.

Problem 6:

UserManager class looks obsolete.

basvredeling’s picture

basvredeling
Primary language Dutch
Location Amsterdam
commented

I've added some partial work on the issues mentioned in comment #3 in the current 1.x-dev branch.

Coupling a Strava profile / athlete to a Drupal user is off the table for now, since we no longer can connect those entities via an email address.

basvredeling’s picture

basvredeling
Primary language Dutch
Location Amsterdam
commented

Problem 3 and 5 mentioned in #3 have been addressed.

basvredeling’s picture

basvredeling
Primary language Dutch
Location Amsterdam
commented
Assigned: basvredeling » Unassigned

Contributions appreciated

f0ns’s picture

f0ns commented

Parts of this are resolved in 3.x:

  • New granular scopes are used (read, activity:read), the invalid write scope is gone.
  • StravaPHP is updated to ^2, which supports the new OAuth endpoints.
  • Login for existing users no longer depends on the email field.

Still open:

  • Refresh tokens are not handled. Only the bare access token string is stored, discarding the refresh token and expiry. Since access tokens expire after 6 hours, stored tokens go stale and users must re-authenticate.
  • Creating a Drupal user from a Strava login is still disabled (@TODO in AthleteUserHandler::connect()) since email is no longer available.
  • Leftover email-based code (UserManager::getUserByEmail(), userExists()) and outdated scope docs should be removed.

Moving this to 3.x, remaining work (refresh token support first) will land here.

f0ns’s picture

f0ns commented
Version: 8.x-1.x-dev » 3.0.0-alpha1
Status: Active » Needs work
markconroy’s picture

markconroy commented

I've created 3 separate issues for each of these, which might make it easier to get people to work on each.

  1. #3611129: Add support for refresh tokens
  2. #3611130: Create a new user from a Strava login
  3. #3611131: Remove redundant email-related code

Will we close this issue in favour of those 3 issues?

f0ns’s picture

f0ns commented

Good idea, closing this down.

Thank you for making the splits. Should have done that right away now that I think about it.

f0ns’s picture

f0ns commented
Status: Needs work » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.