XjRUdZddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z ddl Z ddl m ZdZn #e$rdZYnwxYw ddlmZdZn #e$rdZYnwxYwd d lmZmZmZejeZd Zd Zd ZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)e*e+dfe,d<dZ-e*e+dfe,d<ej.dZ/ej.dZ0de1e+e+ffd Z2d!Z3d"Z4d#Z5d$Z6d%Z7Gd&d'e8Z9d(e+de+fd)Z:d.d*e1e+e+fdzde1e+e+ffd+Z;Gd,d-Z(.+?)returnctr4t}t|jSdt iS)zGenerate a random browser User-Agent + sec-ch-ua headers. Falls back to a static desktop Chrome UA if ua_generator is not installed. User-Agent) HAS_UA_GEN _generate_uadictheadersgetDESKTOP_USER_AGENT)uas Q/home/lighthouse/health/venv/lib/python3.11/site-packages/garminconnect/client.py_random_browser_headersr ^s; & ^^BJNN$$%%% , --zGCM-Android-5.23zhcom.garmin.android.apps.connectmobile/5.23; ; Google/sdk_gphone64_arm64/google; Android/33; Dalvik/2.1.0z7https://diauth.garmin.com/di-oauth2-service/oauth/tokenzJhttps://connectapi.garmin.com/di-oauth2-service/oauth/grant/service_ticket)'GARMIN_CONNECT_MOBILE_ANDROID_DI_2025Q2'GARMIN_CONNECT_MOBILE_ANDROID_DI_2024Q4 GARMIN_CONNECT_MOBILE_ANDROID_DIGARMIN_CONNECT_MOBILE_IOS_DIceZdZdZdS) _MFARequireduInternal sentinel — raised by login strategies when MFA is needed. Stops the strategy chain immediately (like a credential error). The caller (login()) handles it via prompt_mfa / return_on_mfa. N)__name__ __module__ __qualname____doc__r!rr'r'zsr!r' client_idc~dtj|dzS)NzBasic :)base64 b64encodeencodedecode)r-s r_build_basic_authr4s6 f&)'='='?'?@@GGII IIr!extrac ^ttddddddd}|r|||S)N10861AndroidenGC5en-US,en;q=0.9)rzX-Garmin-User-AgentzX-Garmin-Paired-App-VersionzX-Garmin-Client-Platformz X-App-VerzX-LangzX-GCExperienceAccept-Language)NATIVE_API_USER_AGENTNATIVE_X_GARMIN_USER_AGENTupdate)r5rs r_native_headersr@sG+9'.$-+  G u Nr!c eZdZdZd8dededdfdZedefdZ de eeffd Z d9d ed ed edede edzeff dZ d ed eddfdZd ed eddfdZded ed eddfdZd ed eddfdZdeddfdZd ed eddfdZd ed eddfdZded ed eddfdZdeddfdZ d:dedededzddfdZdededefdZ d;dededzddfd Zdt}%>%>0 )m-1115 55/// # #  ? A,/,@,@G( )r!Femailpassword prompt_mfa return_on_mfacdfdfdfdfdfdfdfdfd fd fg}d }d }|D]\}} td || dS#t$rt$r;|rYdS|r#|} | YdStdt $r-} td|| |dz }| }Yd } ~ d } ~ wt$r(} td|| | }Yd } ~ d } ~ wwxYw|t|krt dtd|)uLog in using a cascading 5-strategy chain (ha-garmin order). Tries each strategy in order. Only credential errors (GarminConnectAuthenticationError) and MFA requirements stop the chain immediately — all other failures (429 rate limits, transport errors, HTML challenges) fall through to the next strategy. Args: email: Garmin account email. password: Garmin account password. prompt_mfa: Callable that returns an MFA code string when invoked. return_on_mfa: When True, return ("needs_mfa", None) instead of calling prompt_mfa; caller must call resume_login(). Returns: (None, None) on success; ("needs_mfa", None) when return_on_mfa=True. z mobile+cffic0Sr_)_mobile_login_cffirorpr[srzClient.login..sD$;$;E8$L$Lr!zmobile+requestsc0Sr_)_mobile_login_requestsrvsrrwzClient.login..s(C(CE8(T(Tr!z widget+cffic0Sr_)_widget_web_loginrvsrrwzClient.login..sD$:$:5($K$Kr!z portal+cffic0Sr_)_portal_web_login_cffirvsrrwzClient.login..sD$?$?x$P$Pr!zportal+requestsc0Sr_)_portal_web_login_requestsrvsrrwzClient.login..s77xHHr!NrzTrying login strategy: %sNN) needs_mfaNz1MFA Required but no prompt_mfa mechanism suppliedz%s returned 429: %srz %s failed: %szRAll login strategies rate limited (429). Try again later or check your IP/network.z All login strategies exhausted: ) _LOGGERdebugrr' _complete_mfar warning Exceptionlenr ) r[rorprqrr strategieslast_errrate_limited_countnamerunmfa_codees ``` rloginz Client.logins,4LLLLLL M  T T T T T T U KKKKKK L PPPPPP Q!HHHHHH  - &*#  ID#  94@@@!zz3       -,,,,&)z||H&&x000%:::6G5    5tQ???"a'"   q999  Z 0 03< + 9x 9 9   s/%A""Dz+Client._widget_web_login..s<    K        r!)z bad gatewayzservice unavailable cloudflare502503zWidget login: server error ''c3 K|]}|vV dSr_r,rs rrz+Client._widget_web_login..s<   K       r!)lockedinvalid incorrectz account errorzWidget authentication failed: 'MFAwidgetSuccessz Widget login: unexpected title 'embed\?ticket=([^"]+)"z$Widget login: missing service ticketrN)#rr rrUrLrrr ok_CSRF_REsearchtextrandomuniformWIDGET_DELAY_MIN_SWIDGET_DELAY_MAX_Srrtimesleeprurlgroup _TITLE_REloweranyrrrrr_widget_last_respr'rer)r[rorprsso_base sso_embed embed_params signin_paramsr csrf_matchdelay_s title_matchtitle ticket_matchrs @rr{zClient._widget_web_logins  J./HII I!)hKKKi%%%'''  !!    " ,5/8     HHY|H 4 4 =C  34STT Tt Y./W /W/WXX X HH   *    =C  34TUU U__QV,,  S./QRR R.!35GHH EwOOO 7 II  &!$#))!,,     =C  34UVV V&&qv.. (3; !!!$$$kkmm          X//Ve/V/V/VWW W     K      3:%:::  E>> $D %2D "&/%7D "%DN%&D ".. I  .;5;;;  y!:AFCC  W./UVV V  2 21 5 5DiXXXXXr!rc t|dd}t|dd}|r|stdt|j}|std||jdt|dit|di|d |d d d d }|jdkrtdt|j}|r|d nd}|dkrtd|tjd|j}|std| |d ||jddS)zComplete MFA for widget flow.rNrzMissing widget MFA contextzWidget MFA: missing CSRF tokenz /sso/verifyMFA/loginEnterMfaCoderrrrsetupEnterMfaCode)zmfa-coderrfromPagerrrzWidget MFA verify returned 429rrzWidget MFA failed: rz"Widget MFA: missing service ticketz /sso/embedr) getattrrrrrrrLrrr rrr)r[rrrrrr r s r_complete_mfa_widgetzClient._complete_mfa_widgetst^T22 D-t 4 4 Q1 Q23OPP P__QV,,  U23STT T IIy : : :4!4b99D"5r::$#))!,,/     =C  34TUU U&&qv.. (3; !!!$$$ I  23P3P3PQQ Qy!:AFCC  Y23WXX X    q ! !9000      r!ctstdd}tD]} td|t j|}||||dS#ttf$rt$r(}td|||}Yd}~d}~wt$r(}td|||}Yd}~d}~wwxYw|r|td)zPortal login with curl_cffi TLS fingerprint rotation. Different TLS fingerprints land in different Cloudflare rate-limit buckets, so rotating through them gives multiple shots. rNz#portal+cffi trying impersonation=%srzportal+cffi(%s) 429: %szportal+cffi(%s) failed: %sz(portal+cffi: no impersonations available) rr rrrrrU_do_portal_web_loginrr'r rrs rr}zClient._portal_web_login_cffi4s7  J./HII I%)(  C  CSIII)1cBBB))$x@@@4lC   4    7a@@@    :CCCC   N*+UVVVrcZtj}||||dS)z9Portal login with plain requests (no TLS fingerprinting).N)rrUrrs rrz!Client._portal_web_login_requestsUs.!! !!$x88888r!c  |jd}t}||t|jdi|dddd}|jdkrt d tjtt}t d |tj|td |jd }i|d dd|j|dtd|jd} ||jd|| ||dddd} | jdkrt d | } n*#t"$r} t%d| j| d} ~ wwxYw| did} | dkre| didd|_||_||_| |_|j|_d |_t3| d!kr'| d"}||||j#dS| d$krt7d%| d&id'd(krt d)t%d*| )+u5Login via /portal/api/login — desktop browser flow.z/portal/sso/en-US/sign-inrrz?text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8r;)rfr<r)rrrruCPortal login GET returned 429 — Cloudflare blocking this request.z@Portal login: waiting %.0fs to avoid Cloudflare rate limiting...rrrrdz ?clientId=z &service=)rfr<rrjrkz/portal/api/loginTrrruDPortal login POST returned 429 — Cloudflare blocking this request.z%Portal login failed (non-JSON): HTTP NrrrrrroportalrrrrrrrrzPortal login: 429 in JSON bodyzPortal web login failed: )rLr rPORTAL_SSO_CLIENT_IDrOrr rrLOGIN_DELAY_MIN_SLOGIN_DELAY_MAX_Srinforrrrrr rrrrrrr'rr)r[rrorp signin_url browser_hdrsget_resprr post_headersrrrrrs rrzClient._do_portal_web_login^sV <<< .00 88 03V#3     3 & &3U  .!24EFF N     7-/     9/.i77)=77 477     IIy + + + !$" "     =C  3V  &&((CC   .G GG   GG,b1155f==  & &"ww'8"==AA#W  D !%D %1D "%1D "$($>#+!% $ $ !% HH4 9==y===&& K   "iCCCL0!3**JJ #iCCCL-!*J lJ8NOPPP (5) 1) 1 $GVW II!#!    7 B Bq B BCCC }##7 6 6 6777"a'" ffhh   7 K K1= K K KLLL  www##'' 66%??7 > > >???"a'"ww',,0088LHH./u}}$O '94;STT ''Tw'OOO OOw//#// 0 0 0 0 ]!3!3 3 33M8MM //U8/U/UVVVs*C33 D!=DD!E##*FFrrc |||dS#t$r%}td|Yd}~nd}~wwxYw|||_|pt }|j|d|iddd}|jjjD]}|j dkr |j }n|std ||_ dS) ulConsume a CAS service ticket — DI token exchange first, fall back to JWT_WEB cookie auth. )rNz6DI token exchange failed (%s), falling back to JWT_WEBrTrrallow_redirectsrJWT_WEBz/JWT_WEB cookie not set after ticket consumption) _exchange_service_ticketrrrrVrrcookiesjarrvaluerrS)r[rrrrsvcrScs rrzClient._establish_session:s  Y  ) )&k ) J J J F Y Y Y OOTVW X X X X X X X X Y  DG,_  f%     $  Av""'# 2A  s A AA rc \trtj|fddi|Stj|fi|S)z7POST using curl_cffi if available, else plain requests.rr)rrrr)r[rrEs r _http_postzClient._http_post^sA  K %cJJxJ6JJ J}S++F+++r!c |pt}d}d}d}tD]}|tt t |dddd||t |dd}|jd krtd |j s0t d ||j|j dd  | } | d }| d}||p|}n4#t $r'} t d|| Yd} ~ d} ~ wwxYw|st#d||_||_||_dS)zExchange a CAS service ticket for native DI + IT Bearer tokens. POST to diauth.garmin.com to get a DI OAuth2 token, then exchange for an IT token via services.garmin.com. Nz*application/json,text/html;q=0.9,*/*;q=0.8!application/x-www-form-urlencodedno-cachererfrz Cache-Control)r-service_ticket grant_typerrrrrrzDI token exchange rate limitedz DI exchange failed for %s: %s %s access_token refresh_tokenz DI token parse failed for %s: %sz+DI token exchange failed for all client IDs)MOBILE_SSO_SERVICE_URL DI_CLIENT_IDSr; DI_TOKEN_URLr@r4 DI_GRANT_TYPErr rrrrrr_extract_client_id_from_jwtrrrPrQrR) r[rrr/rP di_refreshrRr-rrrs rr4zClient._exchange_service_ticketds7!7  &' ' I'):9)E)E"N(K)3 "+&,"/#*  ! A$}##744  6MF4C4L   vvxx/!XXo66 #??IIVY     @)QOOO  2= ! *(s3AC== D.D))D.c  |jr|jstd|tt t |jddddd|j|jdd }|js'td |jd |j d d | }|d|_ | d|j|_| |j p|j|_d S)z;Refresh the DI Bearer token using the stored refresh token.zNo DI refresh token availablerdr=r>r?rE)rAr-rErrBzDI token refresh failed:  NrCrD)rQrRrr;rHr@r4rrrrrPrrJ)r[rrs r_refresh_di_tokenzClient._refresh_di_tokens+$ TD,= T23RSS S OO #%6t7H%I%I0$G%/ .!.!%!6    "t 2JAMJJAF4C4LJJ vvxx^, $$:O P P  , ,T] ; ; Pt?P r!tokenc |d}t|dkrdS|ddt|d dzzz}tjt j|}|d}|rt|ndS#t$rYdSwxYw)N.r=r-) splitrrloadsr0urlsafe_b64decoder3rrmr)r[rOparts payload_b64payloadr7s rrJz"Client._extract_client_id_from_jwts KK$$E5zzA~~t(SSq]]NQ,>%??Kj!9+!F!F!M!M!O!OPPGKK ,,E!&03u:::D 0   44 s(B1BB11 B?>B?cT|jp|j}|sdS ddl}t|d}t |dkr|ddt |d dzzz}t jtj |  }| d}|r*|t|d z krd Sn*#t$rtd YnwxYwdS) NFrrQrRrrSrTexpiTzFailed to check token expiry)rPrSrrmrUrrrVr0rWr2r3rintrrr)r[rO_timerXrYrZr\s r_token_expires_soonzClient._token_expires_soons' - 5 : JJ$$S))E5zzQ#AhU1X0B)CC *,[-?-?-A-ABBIIKKkk%(( 5::<<3s88c>::4 : : : MM8 9 9 9 9 9 :usC'C>>$D%$D%c|jr ||jrKtjt 5||jdddn #1swxYwYn2#t $r%}td|Yd}~nd}~wwxYwdS|j sdS |j |j dttddd|j jjD]}|jdkr{|j|_td |jrKtjt 5||jdddn #1swxYwYdStjt 5|j |jd d d |jd dddddn #1swxYwY|j jjD]}|jdkr|j|_dSdS#t $r&}td|Yd}~dSd}~wwxYw)u@Refresh auth — DI token refresh or legacy JWT_WEB CAS refresh.NzDI token refresh failed: %sz/mobile/sso/en_US/sign-inrTr1r3zSession refreshed via CAS TGTz%/services/auth/token/di-oauth/refreshrdrgrh)rfrirk )rrzRefresh failed: %s)rPrNrZ contextlibsuppressrdumprrrbrVrrLMOBILE_SSO_CLIENT_IDrFr5r6rr7rSrrM)r[rr9s r_refresh_sessionzClient._refresh_sessionsf =  B&&((((9#,Y7799 $"7888999999999999999 B B B ;SAAAAAAAA B F$  F" 5 GKK9777 45!%    W_(  6Y&&#$7DLMM"ABBB,='0;;== IId&;<<<===============FF '$Y//   }KKK"4"&*m#=#=#=                W_(  6Y&&#$7DLEE'   5 5 5 MM. 4 4 4 4 4 4 4 4 4 5s4A0A$ A0$A((A0+A(,A00 B:BB.BH E, H ,E0 0H 3E0 4H :H 2G H GH G.H H H=H88H=cT|j|j|jd}tj|S)z'Serialize session state to JSON string.)rPrQrR)rPrQrRrdumps)r[rs rriz Client.dumpss3 $ 5 -   z$r!pathc4t|}|s|jds|dz }|jdd||dS)zWrite tokens safely to disk..jsongarmin_tokens.jsonT)parentsexist_okN) r expanduseris_dirrendswithparentmkdir write_textri)r[rjps rrez Client.dump!s JJ ! ! # # 88:: )QV__W55 )((A td333 TZZ\\"""""r!cV ||_t|}|s|jds|dz }||dS#t$r}td||d}~wwxYw)Nrlrmz Token path not loading cleanly: ) rZrrprqrrrrV read_textrr )r[rjrvrs rloadz Client.load)s $(D !T %%''Axxzz -!9!9 -,, JJq{{}} % % % % %   .6166  sBB B(B##B( tokenstorecB tj|}|d|_|d|_|d|_|jstddS#t$r}td||d}~wwxYw)NrPrQrRzMissing tokens from dict loadz.Token extraction loads() structurally failed: ) rrVrrPrQrRrbrrr )r[rzrrs rrVz Client.loads5s :j))D HHZ00DM$(HH-?$@$@D ! $ 8 8D ( X67VWWW X X   .DDD  sA8A<< BBBc D|jd|fi|S)NGET) _run_requestrr[rjrEs r connectapizClient.connectapiBs+ t 7777<<>>>r!method_domainc L|dd|j||fi|S)Napi)popr~)r[rrrjrEs rrequestzClient.requestEs3 5$ t 88888r!c |dd}|jd|fi|}|r&t|dr|ndS|S)NrFPOSTrrr~hasattrrr[rrjrErresps rrz Client.postIs`jj&& t 8888  B")$"7"7A499;;;T A r!c |dd}|jd|fi|}|r&t|dr|ndS|S)NrFPUTrrrs rputz Client.putPs`jj&& t 7777  B")$"7"7A499;;;T A r!c |dd}|jd|fi|}|r&t|dr|ndS|S)NrFDELETErrrs rdeletez Client.deleteWs`jj&& t 4::6::  B")$"7"7A499;;;T A r! _client_statec0||dS)z*Complete a previously initiated MFA login.r)r)r[rrs r resume_loginzClient.resume_login^s 8$$$zr!c vd|vri|d<|dddi|jd|fi|jS)Nrrfz*/*r})r?r~contentrs rdownloadzClient.downloadcsU F " " "F9 y  (E!2333 t 7777??r!ctj}tjdd}|d||S)z8Create a fresh plain requests.Session for each API call.rHrJrK)rrUrWrXrY)r[rr\s r_fresh_api_sessionzClient._fresh_api_sessionisE!!#//RT/UU :w''' r!c `|jr(|r||jd|d}d|vrd|d<|}|di}|||}|j ||fd|i|}|j dkr7||j ||fd|i|}|j dkrGdd} | S|j d krd |j } | } t| tr| d p`| d pK| d idigdddgd} | r | d| z } n| d| z } n5#t$r(t!|jdkr | d|jz } YnwxYwt%| |S)Nr%rraric:eZdZdZdZdefdZdefdZdefdZ dS)*Client._run_request..EmptyJSONResprr!rciSr_r,ras rrz/Client._run_request..EmptyJSONResp.jsonsIr!cdSNz{}r,ras r__repr__z3Client._run_request..EmptyJSONResp.__repr__4r!cdSrr,ras r__str__z2Client._run_request..EmptyJSONResp.__str__rr!N) r(r)r*rrrrrmrrr,r!r EmptyJSONResprso! # c     S      r!riz API Error messagerdetailedImportResultr-rmessagesrz - i)rbr_rgrNlstriprnrr?rrrr isinstancerrrrrr ) r[rrjrErrcustom_headersrrr error_msg error_datamsgs rr~zClient._run_requestps   $T%=%=%?%? $  ! ! # # #!66DKK$4$466 F " " "F9 &&((Ir22~&&&&&((t|FCCCCFCC  s " "  ! ! # # #4<VVT5I5I5K5KVvVVD  s " " !=?? "  s " "7T%577I 3!YY[[ j$// 8"y112%>>)442%>>*@"EEZ"..q2Z"..q28![3[[0 !%7:%7%77  3 3 3ty>>C''!2ty!2!22I 3/y99 9 s7B2G**/HH)rC)NFrr_)rN).r(r)r*r+rmrr]propertyr`rbrrntuplerruryrr{rr}rrrrr;r4rNrJr_rgrireryrVrrrrrrbytesrrrUrr~r,r!rrBrBs6611s1S1T111163$333X3c3h6# L L L L  L  L sTz3  L L L L dWWsWtWWWWB5C53545555CJSCJCJCJCJCJCJCJRoYsoYcoYdoYoYoYoYb) S) T) ) ) ) ^WCW3W4WWWWB99s9t9999kNkNSkNCkNDkNkNkNkNbeWceWdeWeWeWeWXHL"""!$":=*" """"H,c,S,S,,,,6:?)?)?)(+d ?) ?)?)?)?)B    @  t    T(15151515f s    ######            ?s?c?c????9c9C9s9c9c9999Cscc3cSSc#sTzSVAW @S@C@E@@@@ H$4:3:c:S:S::::::r!rBr_)=r+r0rcrloggingrrrpathlibrtypingrr curl_cffirr ImportError ua_generatorrrr exceptionsrr r getLoggerr(rrrrrfrFMOBILE_SSO_USER_AGENTrPORTAL_SSO_SERVICE_URLrrrrrrrrm__annotations__rcompilerrrr r=r>rHrIrGrr'r4r@rBr,r!rrs)   333333HHHHH555555JJJJJ ' H % %#A= *L,'9%*OuS#XNNN*uS#X 2:5 6 6 BJ. / / .c3h....+I P 9JJJJJJ  4S>D0 DcN     TTTTTTTTTTs!:AAAAA