Repository navigation
OAUTH-001A2J — Safely admit Strava HTTP success markers #604
Description
Officer impact: After a future protected Firebase Functions release, an unexpected internal result while the website talks to Strava will stay behind the existing fixed authorization, refresh, or activity-loading outcomes. There is no current officer-visible change and no new officer action.
Officer documentation: None — this is a server-only transport-object admission boundary. It changes no public page, officer duty, collected field, permission, account, deployment step, or recovery procedure; existing Strava SOURCE ONLY / NOT LIVE failure guidance remains accurate.
Deployment evidence: None at creation. Closure must distinguish source changed, tests passed, code merged, preview/publication, runmprc.com, Firebase deployment, Strava/provider configuration, production data, and live behavior. A green workflow does not prove a Function is live.
Problem
Authorization exchange, refresh, recent-activities, and statistics paths read response.ok directly outside their fixed-error guards. A malformed or instrumented resolved transport object can expose a throwing own/inherited status accessor or Proxy failure instead of the path-specific fixed result. The disconnect path already has a safe plain-record/native-Response success admission helper.
Factual limit: ordinary Strava wire bytes cannot manufacture a JavaScript accessor or Proxy. This is malformed/instrumented transport-object containment and defense in depth, not a claim that a normal provider response can exploit JavaScript reflection.
Invariant
Strava HTTP success is admitted only when either an ordinary plain record has an own data property exactly equal to Boolean true, or a genuine native Response reports ok === true through its captured native getter. Status inspection never invokes own/inherited accessors, coercion hooks, or Proxy traps, and never exposes a thrown value.
Allowed behavior and failure cases
- Existing ordinary
{ ok: true }test transports and genuine successful nativeResponseobjects retain behavior. - Authorization non-success/invalid evidence retains the existing fixed
invalid-argumentauthorization result. - Refresh non-success/invalid evidence retains the existing fixed
failed-preconditionrefresh result. - Activities non-success/invalid evidence retains the existing fixed
internaldata result. - Statistics non-success/invalid evidence remains optional and returns null totals without reading its JSON body.
- Disconnect keeps its current success/failure behavior.
- No response body/status value is logged or returned, and no JSON/body hook runs after rejected status evidence.
Atomic scope
functions/strava.js: generalize the existing disconnect response-success helper and reuse it at every Stravaokdecision.functions/strava.test.js: add separately namedOAUTH-001A2Jfunctional tests for hostile status access plus genuine native/plain compatibility and path-specific outcomes.
Acceptance criteria
- A test-only patch on exact pre-fix source proves a direct status accessor escapes/invokes on old runtime.
- Accessor-backed, inherited, resolved live Proxy, revoked-after-fulfillment Proxy, non-Boolean, and malformed status evidence is rejected without invoking hostile hooks or exposing values. A Proxy already revoked before Promise assimilation is contained by the existing fixed unavailable transport boundary before status admission.
- Exchange, refresh, activities, statistics, and disconnect retain their documented path-specific success/failure semantics.
- Rejected status evidence is handled before JSON/body access and adds no writes, deletes, timestamps, provider calls, or logs beyond existing behavior.
- Focused/full relevant checks and exact diff review pass.
Dependencies and coordination
Parent: #88. #602 is complete, merged, and claim-released. The safe response helper originates in completed OAUTH-001B5/#518. Open #571, #504, #507, and draft PR #462 are disjoint.
Migration and compatibility
No schema, dependency, client type, or data migration. Standard native fetch responses and existing plain test transports retain behavior. Exotic custom response wrappers become fail-closed.
Explicit exclusions / stop conditions
Stop if another claimant owns either Strava file or this exact status-admission outcome, or if work expands into response-byte streaming limits, JSON projection, lossless ID transport, client changes, refresh concurrency, provider policy/configuration, Firebase/website deployment, production data, or live behavior. Never use a real member token or production provider host.
Creation is not a claim. Before editing, assign the issue, create the exact branch, and post the authoritative timestamped CLAIMED marker with branch and exact base.
Activity
daliu commentedon Aug 2, 2026
CLAIMED by
/rootat2026-08-02T05:21:51Z; branchcodex/issue-604-strava-response-status; exact basedff1a40194bd1f25938ac16564a6ce27bbb9eab5.Exact ownership is only the response-success helper/call-site hunks in
functions/strava.jsand separately namedOAUTH-001A2Jfunctional test hunks infunctions/strava.test.js. No response-byte limit, JSON projection, client, refresh concurrency, provider policy, documentation, deployment, data, or live outcome is claimed. No tracked edit preceded this marker.Timestamp correction: GitHub createdAt 2026-08-02T05:21:51Z is authoritative and supersedes the earlier typed 05:21:33Z. No tracked edit preceded the durable marker.
daliu commentedon Aug 2, 2026
TRUSTWORTHY RED on exact base
dff1a40194bd1f25938ac16564a6ce27bbb9eab5. Test-only diff SHA-256:c4c73b8cbfc4d6f3b65e066e271c91e1678f365852d6f463eaf24a54907d660f.Pinned Node 20 focused Strava run: 692 total, 691 passed, exactly one failed. The sole failure is
OAUTH-001A2J Strava response-status admission > rejects an activities ok accessor without invoking or exposing it: old runtime returns the exact hostile accessor error by identity. All existing tests pass. No runtime edit preceded this RED.Factual boundary remains narrow: this proves malformed/instrumented resolved-object containment, not ordinary Strava wire-byte exploitability.
daliu commentedon Aug 2, 2026
IMPLEMENTATION CANDIDATE — exact base dff1a40; exact two-file diff SHA-256 6d740feb8f55d9ce2afc2db56f1ddfeabf7fdc8a193e7be54127dbf5a837881f.
Invariant and failure boundaries:
Trustworthy RED: on the exact base, test-only diff c4c73b8cbfc4d6f3b65e066e271c91e1678f365852d6f463eaf24a54907d660f produced 692 total / 691 passed / exactly the new activities-accessor test failed because old runtime invoked and returned the hostile error by identity.
Exact-candidate verification:
Officer impact: After a future protected Firebase Functions release, an unexpected internal result while the website talks to Strava will remain behind the existing fixed outcomes. There is no current officer-visible change or action.
Officer documentation: None — server-only transport-object admission changes no public page, duty, collected field, permission, account, deployment step, or recovery procedure. Existing Strava SOURCE ONLY / NOT LIVE guidance remains accurate.
Deployment evidence: Source candidate and local tests only. Nothing is merged or live yet. No website publication, runmprc.com change, Firebase deployment, Strava/provider configuration or contact, production-data change, or live-behavior verification occurred.
daliu commentedon Aug 2, 2026
FINAL COMPLETE / CLOSED / CLAIM RELEASED — 2026-08-02T05:45Z.
PR #605 squash-merged exact reviewed head 604e51c as exact main a62c147. Parent: dff1a40. Head and merge tree: 77715f25ff475a572fa4a8ad3bd676d6f8ec1333. Patch SHA-256: 6d740feb8f55d9ce2afc2db56f1ddfeabf7fdc8a193e7be54127dbf5a837881f.
Officer impact: After a future protected Firebase Functions release, unexpected internal response objects while the website talks to Strava will remain behind the existing fixed authorization, refresh, activity-loading, optional-statistics, or disconnect outcome. There is no current officer-visible change and no new officer action.
Officer documentation: None — this server-only transport-object admission boundary changes no public page, duty, collected field, permission, account, deployment step, or recovery procedure. Existing Strava SOURCE ONLY / NOT LIVE guidance remains accurate.
Deployment evidence:
Trustworthy RED, exact local/full checks, dependency audit, exact remote diff review, self-review, and three independent reviews are recorded above and on PR #605. No reviewer finding remains. Response-byte streaming limits, JSON projection, lossless ID transport, refresh concurrency, provider policy/configuration, deployment, production data, and live verification remain outside this issue.
Every #604 file/hunk and outcome claim is RELEASED.