Differences between token in the database and using username/password for logging in

[ssherlock]

I am trying to add Garmin conenctivity to a PWA web app. It basically checks the database for a token and uses it if it exists but otherwise prompts the user for usernname and password before then saving the token produced in the database for future use.
What I am finding is that the token returned is in base64, which is no problem as it can still be used and refreshed etc but when using the token in future sessions I get some profile data but not things like name and other stats.
If I force the user to login with username and password every time I get everything.

So, I am wondering how others have handled this situation? I don't want to prompt for username/password every time and I don't particularly want to store the token as json in a directory on the server, as should surely be able to store the json in the database?
I'm also a bit confused with how, if stored in ~/.garminconnect you get the two .json files but when storing in the database you get a base64 encoded string that only gives access to basic information.

[ssherlock]

I've been digigng around this for a few days and it looks like GarminConnect (and more likely just Garmin) doesn't restore everything from the token that is returned from a full login. So yes you can connect, refresh expired tokens and get some data but not get at anything useful like step count data etc without first logging in with the username and password (making the whole token thing pretty much a complete waste of time).
I'm hoping I am wrong and/or missing something?

[cyberjunky]

I think you simply using it wrong, this package was made by me to get Garmin Connect data in home assistant, and that's also storing the tokens to re-login every x minutes without having to use password nor MFA... When a user installs the integration it saves the token data in one field, (or when re-auth is needed) https://github.com/cyberjunky/home-assistant-garmin_connect/blob/main/custom_components/garmin_connect/config_flow.py#L129 and later uses that over and over: https://github.com/cyberjunky/home-assistant-garmin_connect/blob/main/custom_components/garmin_connect/__init__.py#L203 you also have two example programs to look at example.py and demo.py

[ssherlock]

Thanks for replying. The examples store the token files on disk and I am wanting to use it in a web app (so store the token in the database). When getting the token after user/pass login it gets stored in the database as a base64 string. I can retrieve this OK but only get some of the profile as it looks like it only restores some of the data and not the full session (so cannot get things like name or steps data).
I've also tried using a tmp directory to recreate oauth2_token.json from the token stored in the database but it still only gives me a partial profile.
I will carry on playing and see if I can spot where I am going wrong. Thanks

[ssherlock]

@cyberjunky I got there (painfully slowly). All works fine as long as I ignore the profile (which does not get fully brought back after a token login, so no display name etc). If I stick to steps and things like get_user_summary() I get the data I need.
Thanks again for the reply and pointers

[cyberjunky]

@cyberjunky I got there (painfully slowly). All works fine as long as I ignore the profile (which does not get fully brought back after a token login, so no display name etc). If I stick to steps and things like get_user_summary() I get the data I need. Thanks again for the reply and pointers

I need to look into this, I use the profile in my integration as well if i'm not mistaken.

[ssherlock]

There's no need. It was user error after all. I was looking for the name in the profile and getting muddled up between garmin and garth.
Going back and retrying things I was positive I had tried yesterday, I am getting the data I need from a token login as well as username/pass
Got there in the end and hope you haven't wasted too much time. Thanks

[cyberjunky]

No, no worries, its not easy working with a closed source API, garth is doing a lot of the hard work, but yeah sometimes unclear what does what, maybe i create a graphic to explain it.

[cyberjunky]

Simply use the token to login if you have it, otherwise (at new fresh usage of your script or if you get an auth error) ask for user/passwd and store returned token, its running like that for years..