Refactor oura events, enhance webhook security, and create separate raw data for each data fetched

[darinkrauss]

• Refactor oura events
• Enhance security of webhook callbacks
• Create separate raw data for each data fetched to reduce size issues
• Handle recovery of interrupted historic data fetch
• Update webhook callback to ensure expected event and data type
• Update oura client to fix bugs
• Ensure correct Prometheus code path patterns
• Refactor raw data metadata for oura
• Refactor oura data dependencies to common struct
• Update oura types
• Update tests

[Copilot]

Pull request overview

This PR refactors Oura webhook and data ingestion flows to use event/data-type-specific callback URLs, centralized Oura event metadata, and per-data-type raw data creation with historic-fetch recovery support.

Changes:

• Moves webhook event metadata into core Oura types and adds data type/scope helpers.
• Updates webhook subscription/event routes to include event and data type path parameters with derived verification tokens.
• Refactors Oura historic/event processors and client/test helpers around shared dependencies, per-data raw creation, and next-token recovery.

Reviewed changes

Copilot reviewed 34 out of 34 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
oura/work/processors/processors.go	Uses shared Oura data work dependencies for event and historic processor factories.
oura/webhook/work/subscribe/processor.go	Builds event/data-specific callback URLs and verification tokens for subscriptions.
oura/webhook/work/subscribe/processor_test.go	Updates subscription tests for new callback URL/token behavior.
oura/webhook/webhook.go	Replaces webhook event types with callback URL and verification-token helpers.
oura/webhook/webhook_test.go	Tests new webhook helper functions.
oura/webhook/test/webhook.go	Removes old webhook event test helpers.
oura/test/oura.go	Adds core Oura event/data helpers and updates test data generation.
oura/service/api/v1/v1.go	Changes Oura webhook routes to include event/data path parameters.
oura/service/api/v1/v1_test.go	Updates route tests for new webhook path constant.
oura/service/api/v1/subscription.go	Validates path parameters and derived verification tokens for subscription challenges.
oura/service/api/v1/subscription_test.go	Adds subscription path parameter and token validation tests.
oura/service/api/v1/event.go	Validates webhook path parameters against signed event body content.
oura/service/api/v1/event_test.go	Adds event path mismatch and validation tests.
oura/oura.go	Adds Oura data types, scope mapping, event metadata, data containers, and hashing helpers.
oura/oura_test.go	Expands tests for new Oura types, scopes, data, and metadata behavior.
oura/data/work/work.go	Replaces common metadata with shared Oura data work dependencies.
oura/data/work/work_test.go	Updates tests for shared dependency validation.
oura/data/work/test/work.go	Removes obsolete Oura data work metadata test helpers.
oura/data/work/historic/test/processor.go	Adds historic next-token metadata test helpers.
oura/data/work/historic/processor.go	Refactors historic fetch to per-data-type raw creation with next-token recovery.
oura/data/work/historic/processor_test.go	Updates historic processor tests for pagination, recovery, and per-type raw data.
oura/data/work/historic/factory.go	Uses shared dependencies and updated serial IDs for historic work.
oura/data/work/historic/factory_test.go	Updates historic factory tests for shared deps and serial ID behavior.
oura/data/work/event/test/processor.go	Moves event metadata test helpers to core Oura test helpers.
oura/data/work/event/processor.go	Refactors event processing to per-event raw data with core Oura metadata.
oura/data/work/event/processor_test.go	Updates event processor tests for new raw metadata and data map format.
oura/data/work/event/factory.go	Uses core Oura events and hash-based deduplication for event work.
oura/data/work/event/factory_test.go	Updates event work factory tests for new event hash/dedup metadata.
oura/data/test/data.go	Adds Oura data metadata test helpers.
oura/data/data.go	Adds Oura raw data metadata model.
oura/data/data_test.go	Adds tests for Oura raw data metadata parsing/validation.
oura/data/data_suite_test.go	Adds test suite entry point for Oura data package.
oura/client/client.go	Updates Oura client path mapping, query parameters, revoke handling, and metrics patterns.
oura/client/client_test.go	Updates client tests for query parameters, revoke behavior, path mapping, and metrics patterns.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[toddkazakov]

Just one potentially blocking issue with scope authorization

[toddkazakov]

Should this be false?

[darinkrauss]

The Oura documentation says that an empty scope means "all", but after reviewing the documentation again, that may only apply to initial authentication (what we send to Oura, not what Oura returns back). Let me check...

[darinkrauss]

Okay, yes, this should be false. I'll change it. While we do send an empty scope (well, no scope at all) to mean "all" on the initial authorize call, it is possible for a user to disable all scopes (which makes no sense, but that is separate issue I pinged Oura about).