Fix Libre 403 errors and add structured logging improvements

Critical Fixes:
- Fix Libre 403 errors by fetching correct patient ID from connections endpoint
- Add 403 error handling in sync-libre to auto-flag needs_reauth
- Add structured logging for WHOOP token refresh success (was console.log)

Testing Infrastructure:
- Add comprehensive Edge Function test suite (Deno tests)
- Add unit tests for WHOOP/Fitbit transformers and clients
- Add schema contract tests for database operations
- Add orchestrator tests for sync-all-devices
- Add pre-deploy test script and CI/CD runner

Documentation:
- Add Edge Function testing guide (TESTING.md)
- Add phase completion summaries (transformers, tests, contracts)
- Add Jest performance optimization guide
- Update CI/CD documentation with test instructions

Mobile:
- Add ConnectedDeviceCard needs_reauth UI tests
- Optimize Jest setup with mockdate for performance

Web:
- Re-enable SSR in react-router.config.ts after cache clear

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: schwaaamp

.claude/settings.local.json

@@ -121,7 +121,19 @@
       "WebFetch(domain:developer.dexcom.com)",
       "WebFetch(domain:github.com)",
       "Bash(supabase db execute:*)",
-      "Bash(git push:*)"
+      "Bash(git push:*)",
+      "Bash(/tmp/check-sync-errors.sql:*)",
+      "Bash(/tmp/check-ingestion-errors.sql <<'EOF'\n-- Check ingestion_log for recent failures\nSELECT \n  occurred_at,\n  provider,\n  status,\n  message,\n  user_id\nFROM ingestion_log\nWHERE occurred_at > NOW\\(\\) - INTERVAL '2 hours'\n  AND status IN \\('failure', 'warning'\\)\nORDER BY occurred_at DESC\nLIMIT 20;\nEOF)",
+      "Bash(/tmp/check-cron-and-tokens.sql:*)",
+      "Bash(/tmp/diagnose_sync_failure.sql <<'EOF'\n-- ============================================================================\n-- DIAGNOSTIC QUERIES FOR SYNC-ALL-DEVICES 401 ERRORS\n-- ============================================================================\n\n-- 1. Check what cron jobs are currently scheduled\nSELECT \n  jobname, \n  schedule, \n  command, \n  active,\n  jobid\nFROM cron.job\nWHERE jobname LIKE '%sync%' OR jobname LIKE '%fitness%'\nORDER BY jobname;\n\n-- 2. Check recent cron job runs \\(last 3 hours\\)\nSELECT \n  j.jobname,\n  r.status,\n  r.return_message,\n  r.start_time,\n  r.end_time,\n  EXTRACT\\(EPOCH FROM \\(r.end_time - r.start_time\\)\\) as duration_seconds\nFROM cron.job_run_details r\nJOIN cron.job j ON r.jobid = j.jobid\nWHERE r.start_time > NOW\\(\\) - INTERVAL '3 hours'\n  AND \\(j.jobname LIKE '%sync%' OR j.jobname LIKE '%fitness%'\\)\nORDER BY r.start_time DESC;\n\n-- 3. Check if vault secrets are configured\nSELECT \n  name,\n  CASE \n    WHEN decrypted_secret IS NOT NULL THEN 'EXISTS \\(length: ' || LENGTH\\(decrypted_secret\\) || '\\)'\n    ELSE 'MISSING'\n  END as status\nFROM vault.decrypted_secrets\nWHERE name IN \\('service_role_key', 'supabase_url'\\)\nORDER BY name;\n\n-- 4. Check recent sync-all-devices errors from app_logs\nSELECT \n  created_at,\n  level,\n  category,\n  message,\n  metadata->>'error' as error_detail\nFROM app_logs\nWHERE function_name = 'sync-all-devices'\n  AND created_at > NOW\\(\\) - INTERVAL '3 hours'\nORDER BY created_at DESC\nLIMIT 10;\n\n-- 5. Check token expiration status for all connected devices\nSELECT \n  cd.provider,\n  cd.device_id,\n  cd.user_id,\n  cd.needs_reauth,\n  CASE \n    WHEN cd.provider = 'whoop' THEN wt.expires_at\n    WHEN cd.provider = 'fitbit' THEN ft.expires_at\n    WHEN cd.provider = 'oura' THEN ot.expires_at\n    WHEN cd.provider = 'libre' THEN lt.expires_at\n  END as token_expires_at,\n  CASE \n    WHEN cd.provider = 'whoop' THEN wt.expires_at < NOW\\(\\)\n    WHEN cd.provider = 'fitbit' THEN ft.expires_at < NOW\\(\\)\n    WHEN cd.provider = 'oura' THEN ot.expires_at < NOW\\(\\)\n    WHEN cd.provider = 'libre' THEN lt.expires_at < NOW\\(\\)\n  END as is_expired\nFROM connected_devices cd\nLEFT JOIN whoop_tokens wt ON cd.provider = 'whoop' AND cd.user_id = wt.user_id\nLEFT JOIN fitbit_tokens ft ON cd.provider = 'fitbit' AND cd.user_id = ft.user_id\nLEFT JOIN oura_tokens ot ON cd.provider = 'oura' AND cd.user_id = ot.user_id\nLEFT JOIN libre_tokens lt ON cd.provider = 'libre' AND cd.user_id = lt.user_id\nORDER BY cd.provider;\n\n-- 6. Check recent ingestion_log entries\nSELECT \n  occurred_at,\n  provider,\n  status,\n  message\nFROM ingestion_log\nWHERE occurred_at > NOW\\(\\) - INTERVAL '3 hours'\nORDER BY occurred_at DESC\nLIMIT 20;\nEOF)",
+      "Bash(/tmp/fix_cron_job.sql <<'EOF'\n-- ============================================================================\n-- FIX CRON JOB TO USE CORRECT FUNCTION\n-- ============================================================================\n\n-- Unschedule old jobs\nSELECT cron.unschedule\\('hourly-fitness-tracker-sync'\\)\nWHERE EXISTS \\(\n  SELECT 1 FROM cron.job WHERE jobname = 'hourly-fitness-tracker-sync'\n\\);\n\nSELECT cron.unschedule\\('daily-fitness-tracker-sync'\\)\nWHERE EXISTS \\(\n  SELECT 1 FROM cron.job WHERE jobname = 'daily-fitness-tracker-sync'\n\\);\n\n-- Schedule new job with correct function name\nSELECT cron.schedule\\(\n  'hourly-device-sync',           -- New job name\n  '0 * * * *',                    -- Every hour at :00\n  $SELECT trigger_device_sync\\(\\)$\n\\);\n\n-- Verify the job was created\nSELECT jobname, schedule, command, active\nFROM cron.job\nWHERE jobname = 'hourly-device-sync';\nEOF)",
+      "Bash(deno test:*)",
+      "Bash(deno --version:*)",
+      "Bash(psql:*)",
+      "Bash(~/.bash_profile)",
+      "Bash(/Users/schwaaamp/.deno/bin/deno test:*)",
+      "Bash(/Users/schwaaamp/DashMobileApp/supabase/functions/run-tests.sh:*)",
+      "Bash(./run-tests.sh:*)"
     ],
     "additionalDirectories": [
       "/Users/schwaaamp/DashMobileApp/scripts/canonical-pipeline"

ci-cd/EDGE-FUNCTION-TESTS.md

@@ -2,9 +2,9 @@
 
 ## Quick Reference
 
-**Status**: ✅ 67 tests implemented and passing, ready for CI/CD
-**Runtime**: ~145ms (fast enough for pre-commit hooks)
-**Coverage**: Unit tests (44) + Integration tests (11) + Regression tests (12)
+**Status**: ✅ 86 tests implemented and passing, ready for CI/CD
+**Runtime**: ~184ms (fast enough for pre-commit hooks)
+**Coverage**: Unit tests (44) + Integration tests (11) + Regression tests (12) + Contract tests (19)
 
 ---
 
@@ -55,13 +55,15 @@ jobs:
           echo "  • Fitbit client integration tests: 6 tests"
           echo "  • Fitbit transformer unit tests: 28 tests"
           echo "  • WHOOP transformer unit tests: 16 tests"
+          echo "  • Schema contract tests: 19 tests"
           echo ""
-          echo "Total: 67 tests"
+          echo "Total: 86 tests"
           echo ""
           echo "Coverage:"
           echo "  ✅ All data transformation functions (100%)"
           echo "  ✅ Critical API client behavior"
           echo "  ✅ Production bug regressions"
+          echo "  ✅ Database schema contracts (4 tables)"
           echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 ```
 
@@ -181,6 +183,26 @@ Now PRs cannot merge without passing tests.
 - Filtering devices that need reauth
 - Batching by provider for rate limiting
 
+#### 4. Schema Contracts (19 tests)
+
+**Purpose**: Prevent schema drift and ensure transformers produce valid database records
+
+**All Fitness Tables**:
+- ✅ Use `device_id` (not `tracker_id`) - REGRESSION: Column rename
+- ✅ Have all required fields (`device_id`, `vendor_metadata`, etc.)
+- ✅ Allow null for optional fields (steps, distance, calories)
+- ✅ Preserve 0 values (0 ≠ null)
+
+**Data Type Contracts**:
+- ✅ Timestamps are ISO 8601 strings (not Date objects)
+- ✅ Dates are YYYY-MM-DD format (not full timestamps)
+- ✅ Numeric fields accept 0 as valid value
+
+**Cross-Table Consistency**:
+- ✅ All tables use `device_id` consistently
+- ✅ All tables have `vendor_metadata` for extensibility
+- ✅ Naming conventions enforced (FK ends with `_id`, timestamps with `_time`)
+
 ### Critical Bugs Caught
 
 #### Zero Value Handling Bug
@@ -249,6 +271,7 @@ supabase/functions/
 ├── _shared/
 │   ├── transformers.ts                   # Fitbit transformers
 │   ├── transformers.test.ts              # 28 tests ✅
+│   ├── schema-contracts.test.ts          # 19 tests ✅ (NEW)
 │   ├── whoop-client-simple.test.ts       # 5 tests ✅
 │   └── fitbit-client-simple.test.ts      # 6 tests ✅
 └── sync-all-devices/
@@ -359,11 +382,12 @@ Check test results: `https://github.com/YOUR_ORG/DashMobileApp/actions`
 
 | Metric | Target | Actual | Status |
 |--------|--------|--------|--------|
-| Test Pass Rate | 100% | 100% (67/67) | ✅ |
-| Runtime | < 500ms | ~145ms | ✅ |
+| Test Pass Rate | 100% | 100% (86/86) | ✅ |
+| Runtime | < 500ms | ~184ms | ✅ |
 | Flaky Tests | 0 | 0 | ✅ |
 | Transformer Coverage | 100% | 100% (10/10 functions) | ✅ |
-| Critical Bugs Found | N/A | 1 (zero value handling) | ✅ Fixed |
+| Schema Contract Coverage | All tables | 4/4 fitness tables | ✅ |
+| Critical Bugs Found | N/A | 5 (zero values, tracker_id, timestamps, required fields, 0→null) | ✅ Fixed |
 
 ---
 
@@ -390,6 +414,6 @@ Check test results: `https://github.com/YOUR_ORG/DashMobileApp/actions`
 ---
 
 **Last Updated**: February 3, 2026
-**Test Suite Version**: Phase 1 + Phase 2 Complete
-**Total Tests**: 67 (all passing)
+**Test Suite Version**: Phases 1-4 Complete
+**Total Tests**: 86 (all passing)
 **Ready for Production**: ✅ Yes

ci-cd/README.md

@@ -140,12 +140,13 @@ All CI/CD configuration is version controlled:
 
 ### Overview
 
-A comprehensive test suite for Supabase Edge Functions has been implemented with **67 tests** covering:
+A comprehensive test suite for Supabase Edge Functions has been implemented with **86 tests** covering:
 - **Unit Tests (44 tests)**: Pure transformer functions with 100% coverage
 - **Integration Tests (11 tests)**: API client behavior (WHOOP, Fitbit)
 - **Regression Tests (12 tests)**: Critical bugs that occurred in production
+- **Contract Tests (19 tests)**: Database schema validation and drift prevention
 
-**Status**: ✅ All 67 tests passing, ~145ms runtime, ready for CI/CD integration
+**Status**: ✅ All 86 tests passing, ~184ms runtime, ready for CI/CD integration
 
 ### Running Tests Locally
 
@@ -305,9 +306,10 @@ fi
 
 ### Documentation
 
-- **Testing Plan**: `docs/edge-functions-testing-plan.md` - Full 4-phase plan
-- **Phase 1 Complete**: `docs/phase-1-transformers-complete.md` - Transformer tests
-- **Phase 2 Complete**: `docs/phase-2-tests-fixed.md` - Integration tests
+- **Testing Plan**: `docs/edge-functions-testing-plan.md` - Full 5-phase plan
+- **Phase 1 Complete**: `docs/phase-1-transformers-complete.md` - Transformer tests (44 tests)
+- **Phase 2 Complete**: `docs/phase-2-tests-fixed.md` - Integration tests (23 tests)
+- **Phase 4 Complete**: `docs/phase-4-contract-tests-complete.md` - Schema contract tests (19 tests)
 - **Quick Reference**: `supabase/functions/TESTING.md` - Commands and examples
 - **Test Files**: All tests include inline documentation and comments
 
@@ -337,11 +339,11 @@ fi
 | **Transformers** | 100% | 44 | ✅ Complete |
 | **API Clients** | Critical paths | 11 | ✅ Complete |
 | **Orchestrator** | All regressions | 12 | ✅ Complete |
-| **Overall** | Phase 1+2 complete | 67 | ✅ 100% passing |
+| **Overall** | Phases 1-4 complete | 86 | ✅ 100% passing |
 
 **Remaining Phases**:
-- Phase 4: Contract tests (database schema) - TODO
-- Phase 5: E2E tests with test database - TODO
+- Phase 4: Contract tests (database schema) - ✅ COMPLETE (19 tests)
+- Phase 5: E2E tests with test database - TODO (optional)
 
 ## 📈 Recommended Activation Order