Fix bugs and add API key support for Hevy Pro login

Co-authored-by: Bridgey30 <[email protected]>

Author: aree6

DEPLOYMENT.md

@@ -10,6 +10,11 @@ The backend is required for Hevy login because:
 - The Hevy API requires an `x-api-key` header.
 - Browsers will block direct calls due to CORS.
 
+Hevy users can authenticate either by:
+
+- Email/username + password (proxied through the backend)
+- Hevy Pro API key (from https://hevy.com/settings?developer) pasted directly in the UI (proxied through the backend for data fetch)
+
 
 ## 0) What you will deploy
 
@@ -153,6 +158,7 @@ Add:
 Notes:
 
 - `VITE_BACKEND_URL` must be the public URL of your deployed backend (Render/Railway), not `localhost`.
+- `VITE_BACKEND_URL` should be the backend *origin* (no trailing `/api`). The frontend will call `${VITE_BACKEND_URL}/api/...`.
 - Example: `https://liftshift-backend.onrender.com`
 
 ### 3.2 Trigger a deploy
@@ -170,7 +176,7 @@ After both are deployed:
 2. You should see the platform selector
 3. Choose:
    - Strong (CSV) or
-   - Hevy (Login or CSV)
+   - Hevy (Login (email+password or Pro API key) or CSV)
 4. After setup, you should see the dashboard
 
 Backend verification (recommended):
@@ -196,6 +202,7 @@ If you ever want to restart onboarding:
   - `hevy_username_or_email`
   - `hevy_analytics_secret:hevy_password`
   - `hevy_auth_token`
+  - `hevy_pro_api_key`
   - `lyfta_api_key`
 
 If your browser is missing WebCrypto/IndexedDB support (or the page isn't a secure context), the app may fall back to storing passwords in Session Storage.
@@ -204,6 +211,8 @@ If your browser is missing WebCrypto/IndexedDB support (or the page isn't a secu
 ## 5) Notes
 
 - Hevy login is proxied through your backend.
+- Credential login stores a Hevy `auth_token` locally and uses it for subsequent syncs.
+- Pro API key login stores a Hevy Pro `api-key` locally and uses it for subsequent syncs.
 - The app stores the Hevy token in your browser (localStorage).
 - If you choose to use Hevy/Lyfta sync, the app may also store your login inputs locally to prefill onboarding (for example: username/email and API keys). Passwords are stored locally and are encrypted when the browser supports WebCrypto + IndexedDB.
 - Your workouts are processed client-side into `WorkoutSet[]`.

README.md

@@ -108,7 +108,7 @@ By submitting a contribution (code, documentation, or any other material) to thi
 
 
 1. **Select your platform** (Hevy / Strong)  
-2. **Hevy**: Choose your **body type** + **weight unit**, then **Continue** to login/sync (or import CSV). / **Strong**: Choose body type + unit, then import CSV  
+2. **Hevy**: Choose your **body type** + **weight unit**, then **Continue** to login/sync (email+password or Pro API key), or import CSV. / **Strong**: Choose body type + unit, then import CSV  
 3. **Explore** your analytics across Dashboard, Exercises, and History tabs  
 4. **Get insights** with real-time feedback and flexible filtering  
 
@@ -189,4 +189,4 @@ If you find this project helpful, you can support it here:
 
 - The only official deployment is https://liftshift.app.
 - Any other domain is unofficial. Do not enter credentials into an unofficial deployment.
-- LiftShift stores sync credentials locally in your browser (tokens, API keys, and login inputs). Passwords are encrypted at rest when the browser supports WebCrypto + IndexedDB.
+- LiftShift stores sync credentials locally in your browser (auth tokens, API keys, and login inputs). Passwords are encrypted at rest when the browser supports WebCrypto + IndexedDB.

backend/src/hevyProApi.ts

@@ -0,0 +1,76 @@
+import type { HevyProWorkout } from './types';
+
+const HEVY_PRO_BASE_URL = 'https://api.hevyapp.com';
+
+const buildHeaders = (apiKey: string): Record<string, string> => {
+  return {
+    'content-type': 'application/json',
+    'api-key': apiKey,
+  };
+};
+
+const parseErrorBody = async (res: Response): Promise<string> => {
+  try {
+    const text = await res.text();
+    return text || `${res.status} ${res.statusText}`;
+  } catch {
+    return `${res.status} ${res.statusText}`;
+  }
+};
+
+export interface HevyProWorkoutsPageResponse {
+  page: number;
+  page_count: number;
+  workouts: HevyProWorkout[];
+}
+
+export const hevyProGetWorkoutsPage = async (
+  apiKey: string,
+  opts: { page: number; pageSize?: number }
+): Promise<HevyProWorkoutsPageResponse> => {
+  const pageSize = Math.min(Math.max(opts.pageSize ?? 10, 1), 10);
+  const params = new URLSearchParams({
+    page: String(Math.max(opts.page, 1)),
+    pageSize: String(pageSize),
+  });
+
+  const res = await fetch(`${HEVY_PRO_BASE_URL}/v1/workouts?${params.toString()}`, {
+    method: 'GET',
+    headers: buildHeaders(apiKey),
+  });
+
+  if (!res.ok) {
+    const msg = await parseErrorBody(res);
+    const err = new Error(msg);
+    (err as any).statusCode = res.status;
+    throw err;
+  }
+
+  return (await res.json()) as HevyProWorkoutsPageResponse;
+};
+
+export const hevyProValidateApiKey = async (apiKey: string): Promise<boolean> => {
+  try {
+    await hevyProGetWorkoutsPage(apiKey, { page: 1, pageSize: 1 });
+    return true;
+  } catch (err) {
+    const status = (err as any)?.statusCode;
+    if (status === 401 || status === 403) return false;
+    return false;
+  }
+};
+
+export const hevyProGetAllWorkouts = async (apiKey: string): Promise<HevyProWorkout[]> => {
+  const out: HevyProWorkout[] = [];
+  let page = 1;
+  let pageCount = 1;
+
+  while (page <= pageCount) {
+    const resp = await hevyProGetWorkoutsPage(apiKey, { page, pageSize: 10 });
+    pageCount = Number(resp.page_count ?? 1) || 1;
+    out.push(...(resp.workouts ?? []));
+    page += 1;
+  }
+
+  return out;
+};

backend/src/index.ts

@@ -3,8 +3,10 @@ import express from 'express';
 import cors from 'cors';
 import rateLimit from 'express-rate-limit';
 import { hevyGetAccount, hevyGetWorkoutsPaged, hevyLogin, hevyValidateAuthToken } from './hevyApi';
-import { lyfatGetAllWorkouts, lyfatValidateApiKey } from './lyfta';
+import { hevyProGetAllWorkouts, hevyProValidateApiKey } from './hevyProApi';
+import { lyfatGetAllWorkouts, lyfatGetAllWorkoutSummaries, lyfatValidateApiKey } from './lyfta';
 import { mapHevyWorkoutsToWorkoutSets } from './mapToWorkoutSets';
+import { mapHevyProWorkoutsToWorkoutSets } from './mapHevyProWorkoutsToWorkoutSets';
 import { mapLyfataWorkoutsToWorkoutSets } from './mapLyfataWorkoutsToWorkoutSets';
 
 const PORT = Number(process.env.PORT ?? 5000);
@@ -102,6 +104,34 @@ app.post('/api/hevy/login', loginLimiter, async (req, res) => {
   }
 });
 
+// Hevy Pro API key endpoints
+app.post('/api/hevy/api-key/validate', loginLimiter, async (req, res) => {
+  const apiKey = String(req.body?.apiKey ?? '').trim();
+  if (!apiKey) return res.status(400).json({ error: 'Missing apiKey' });
+
+  try {
+    const valid = await hevyProValidateApiKey(apiKey);
+    res.json({ valid });
+  } catch (err) {
+    const status = (err as any).statusCode ?? 500;
+    res.status(status).json({ error: (err as Error).message || 'Validate failed' });
+  }
+});
+
+app.post('/api/hevy/api-key/sets', async (req, res) => {
+  const apiKey = String(req.body?.apiKey ?? '').trim();
+  if (!apiKey) return res.status(400).json({ error: 'Missing apiKey' });
+
+  try {
+    const workouts = await hevyProGetAllWorkouts(apiKey);
+    const sets = mapHevyProWorkoutsToWorkoutSets(workouts);
+    res.json({ sets, meta: { workouts: workouts.length } });
+  } catch (err) {
+    const status = (err as any).statusCode ?? 500;
+    res.status(status).json({ error: (err as Error).message || 'Failed to fetch sets' });
+  }
+});
+
 app.post('/api/hevy/validate', async (req, res) => {
   const authToken = String(req.body?.auth_token ?? '').trim();
   if (!authToken) return res.status(400).json({ error: 'Missing auth_token' });
@@ -202,8 +232,13 @@ app.post('/api/lyfta/sets', async (req, res) => {
   if (!apiKey) return res.status(400).json({ error: 'Missing apiKey' });
 
   try {
-    const workouts = await lyfatGetAllWorkouts(apiKey);
-    const sets = mapLyfataWorkoutsToWorkoutSets(workouts);
+    // Fetch both workout details and summaries in parallel
+    const [workouts, summaries] = await Promise.all([
+      lyfatGetAllWorkouts(apiKey),
+      lyfatGetAllWorkoutSummaries(apiKey)
+    ]);
+    
+    const sets = mapLyfataWorkoutsToWorkoutSets(workouts, summaries);
     res.json({ sets, meta: { workouts: workouts.length } });
   } catch (err) {
     const status = (err as any).statusCode ?? 500;

backend/src/lyfta.ts

@@ -51,6 +51,23 @@ export interface LyfatGetWorkoutsResponse {
   }>;
 }
 
+export interface LyfatGetWorkoutSummaryResponse {
+  status: boolean;
+  count: number;
+  total_records: number;
+  total_pages: number;
+  current_page: number;
+  limit: number;
+  workouts: Array<{
+    id: string;
+    title: string;
+    description: string | null;
+    workout_duration: string; // e.g. "01:06:25"
+    total_volume: string;
+    workout_perform_date: string;
+  }>;
+}
+
 export const lyfatGetWorkouts = async (
   apiKey: string,
   opts: { limit?: number; page?: number } = {}
@@ -111,3 +128,47 @@ export const lyfatGetAllWorkouts = async (apiKey: string): Promise<LyfatGetWorko
 
   return allWorkouts;
 };
+
+export const lyfatGetWorkoutSummaries = async (
+  apiKey: string,
+  opts: { limit?: number; page?: number } = {}
+): Promise<LyfatGetWorkoutSummaryResponse> => {
+  const { limit = 1000, page = 1 } = opts;
+  const params = new URLSearchParams({
+    limit: String(Math.min(limit, 1000)), // Cap at 1000 for summary endpoint
+    page: String(page),
+  });
+
+  const res = await fetch(`${LYFTA_BASE_URL}/api/v1/workouts/summary?${params.toString()}`, {
+    method: 'GET',
+    headers: buildHeaders(apiKey),
+  });
+
+  if (!res.ok) {
+    const msg = await parseErrorBody(res);
+    const err = new Error(msg);
+    (err as any).statusCode = res.status;
+    throw err;
+  }
+
+  return (await res.json()) as LyfatGetWorkoutSummaryResponse;
+};
+
+export const lyfatGetAllWorkoutSummaries = async (apiKey: string): Promise<LyfatGetWorkoutSummaryResponse['workouts']> => {
+  const allSummaries: LyfatGetWorkoutSummaryResponse['workouts'] = [];
+  let page = 1;
+  let hasMore = true;
+
+  while (hasMore) {
+    const response = await lyfatGetWorkoutSummaries(apiKey, { limit: 1000, page });
+    allSummaries.push(...response.workouts);
+
+    if (page >= response.total_pages) {
+      hasMore = false;
+    } else {
+      page++;
+    }
+  }
+
+  return allSummaries;
+};

backend/src/mapHevyProWorkoutsToWorkoutSets.ts

@@ -0,0 +1,59 @@
+import { format, isValid, parseISO } from 'date-fns';
+import type { HevyProWorkout, WorkoutSetDTO } from './types';
+
+const DATE_FORMAT_HEVY = 'd MMM yyyy, HH:mm';
+
+const formatIsoDate = (iso: string | undefined): string => {
+  if (!iso) return '';
+  try {
+    const d = parseISO(iso);
+    return isValid(d) ? format(d, DATE_FORMAT_HEVY) : '';
+  } catch {
+    return '';
+  }
+};
+
+const toNumber = (v: unknown, fallback = 0): number => {
+  if (typeof v === 'number' && Number.isFinite(v)) return v;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : fallback;
+};
+
+export const mapHevyProWorkoutsToWorkoutSets = (workouts: HevyProWorkout[]): WorkoutSetDTO[] => {
+  const out: WorkoutSetDTO[] = [];
+
+  for (const w of workouts) {
+    const title = String(w.title ?? 'Workout');
+    const start_time = formatIsoDate(w.start_time);
+    const end_time = formatIsoDate(w.end_time);
+    const description = String(w.description ?? '');
+
+    for (const ex of w.exercises ?? []) {
+      const exercise_title = String(ex.title ?? '').trim();
+      const exercise_notes = String(ex.notes ?? '');
+      const superset_id = String(ex.supersets_id ?? '');
+
+      for (const s of ex.sets ?? []) {
+        const distanceMeters = s.distance_meters == null ? 0 : toNumber(s.distance_meters, 0);
+        out.push({
+          title,
+          start_time,
+          end_time,
+          description,
+          exercise_title,
+          superset_id,
+          exercise_notes,
+          set_index: toNumber(s.index, 0),
+          set_type: String(s.type ?? 'normal'),
+          weight_kg: s.weight_kg == null ? 0 : toNumber(s.weight_kg, 0),
+          reps: s.reps == null ? 0 : toNumber(s.reps, 0),
+          distance_km: distanceMeters > 0 ? distanceMeters / 1000 : 0,
+          duration_seconds: s.duration_seconds == null ? 0 : toNumber(s.duration_seconds, 0),
+          rpe: s.rpe == null ? null : toNumber(s.rpe, 0),
+        });
+      }
+    }
+  }
+
+  return out;
+};

backend/src/mapLyfataWorkoutsToWorkoutSets.ts

@@ -1,6 +1,6 @@
 import { format } from 'date-fns';
 import type { WorkoutSetDTO } from './types';
-import type { LyfatGetWorkoutsResponse } from './lyfta';
+import type { LyfatGetWorkoutsResponse, LyfatGetWorkoutSummaryResponse } from './lyfta';
 
 const DATE_FORMAT_LYFTA = 'd MMM yyyy, HH:mm';
 
@@ -15,19 +15,54 @@ const parseDate = (dateStr: string | undefined): string => {
   }
 };
 
+const parseDurationToMinutes = (durationStr: string | undefined): number => {
+  if (!durationStr) return 0;
+  try {
+    const parts = durationStr.split(':');
+    if (parts.length !== 3) return 0;
+    
+    const hours = parseInt(parts[0], 10);
+    const minutes = parseInt(parts[1], 10);
+    const seconds = parseInt(parts[2], 10);
+    
+    if (isNaN(hours) || isNaN(minutes) || isNaN(seconds)) return 0;
+    
+    return hours * 60 + minutes + Math.round(seconds / 60);
+  } catch {
+    return 0;
+  }
+};
+
 const toNumber = (v: unknown, fallback = 0): number => {
   if (typeof v === 'number' && Number.isFinite(v)) return v;
   const n = Number(v);
   return Number.isFinite(n) ? n : fallback;
 };
 
-export const mapLyfataWorkoutsToWorkoutSets = (workouts: LyfatGetWorkoutsResponse['workouts']): WorkoutSetDTO[] => {
+export const mapLyfataWorkoutsToWorkoutSets = (
+  workouts: LyfatGetWorkoutsResponse['workouts'],
+  summaries: LyfatGetWorkoutSummaryResponse['workouts'] = []
+): WorkoutSetDTO[] => {
   const out: WorkoutSetDTO[] = [];
+  
+  // Create a map of workout ID to duration for quick lookup
+  const durationMap = new Map<number, number>();
+  for (const summary of summaries) {
+    const workoutId = parseInt(summary.id, 10);
+    const duration = parseDurationToMinutes(summary.workout_duration);
+    durationMap.set(workoutId, duration);
+  }
 
   for (const w of workouts) {
     const title = String(w.title ?? 'Workout');
     const start_time = parseDate(w.workout_perform_date);
-    const end_time = start_time; // Lyfta doesn't provide end time
+    
+    // Calculate end_time based on duration from summary data
+    const durationMinutes = durationMap.get(w.id) ?? 0;
+    const end_time = durationMinutes > 0 
+      ? format(new Date(new Date(w.workout_perform_date).getTime() + durationMinutes * 60 * 1000), DATE_FORMAT_LYFTA)
+      : start_time; // Fallback to start_time if no duration available
+    
     const description = '';
 
     for (const ex of w.exercises ?? []) {