Add webhooks for OURA #901

toddkazakov · 2025-12-16T14:29:17Z

BACK-4162
BACK-4164
BACK-4165
BACK-4041
BACK-3959
BACK-4166

sequenceDiagram
    actor User
    participant JotForm
    participant Platform
    participant Customer.io
    participant Shopify

    User->>JotForm: Submits survey
    JotForm->>Platform: Webhook call with submission ID
    Platform->>JotForm: Pull submission details
    JotForm-->>Platform: Return submission data
    
    Platform->>Platform: Check eligibility criteria
    Platform->>Customer.io: Check if participant ID exists
    Customer.io-->>Platform: Return participant status
    
    Platform->>Shopify: Generate discount code
    Shopify-->>Platform: Return discount code
    
    Platform->>Customer.io: Send oura_eligibility_survey_completed event
    Customer.io->>Customer.io: Trigger Sizing Kit Campaign
    
    User->>Shopify: Place Sizing Kit Order
    Shopify->>Platform: Send orders/create notification
    Platform->>Customer.io: Send oura_sizing_kit_ordered event
    Shopify->>Platform: Send fulfillments/update or fulfillments/create notification
    Platform->>Shopify: Generate discount code
    Shopify-->>Platform: Return discount code
    Platform->>Shopify: Send oura_sizing_kit_delivered event
    Customer.io->>Customer.io: Trigger Ring Campaign

    User->>Shopify: Place Ring Order
    Shopify->>Platform: Send orders/create notification
    Platform->>Customer.io: Send oura_ring_ordered event
    Shopify->>Platform: Send fulfillments/update or fulfillments/create notification
    Platform->>Shopify: Send oura_ring_delivered event

toddkazakov · 2025-12-16T15:12:30Z

/deploy dev1

toddkazakov · 2025-12-16T15:15:19Z

/deploy dev

tidebot · 2025-12-16T15:15:23Z

toddkazakov updated values.yaml file in dev1

tidebot · 2025-12-16T15:15:24Z

toddkazakov updated flux policies file in dev1

tidebot · 2025-12-16T15:15:25Z

toddkazakov deployed platform tk-oura-webhooks-shopify branch to dev1 namespace

…w subscribing to webhooks from the shopify UI

…orders

ewollesen

A few things small things that I think can be quickly fixed. Nothing majorly blocking, though the use of the platform's error package might take a fair bit of cut and paste, if it's decided that it should be done at all.

In general, while there are tests, they seem to focus on successful completion, i.e. testing that things work, not that things that shouldn't work don't work, or that things that don't work fail in the expected manner. Given the relatively temporary nature of this code, that's not too concerning, but as always, today's hot fix is tomorrow production code. So... Shrug, something to think about maybe.

oura/customerio/customer.go

ewollesen · 2026-01-08T10:38:49Z

oura/customerio/segment.go

+
+type segmentMembershipResponse struct {
+	Identifiers []Identifiers `json:"identifiers"`
+	IDs         []string      `json:"ids"`


Why IDs and Identifiers? Isn't IDs an abbreviation of Identifiers?

This is the response that we get from customer io - we have no control of it.

ewollesen · 2026-01-08T11:00:43Z

oura/jotform/api/router.go

+	ctx := req.Context()
+	responder := request.MustNewResponder(res, req)
+
+	if err := req.ParseMultipartForm(multipartMaxMemory); err != nil {


It would be simpler I think to call to PostFormValue. It will call the appropriate ParseForm method as needed, and return the first matching field.

ewollesen · 2026-01-08T11:24:44Z

oura/shopify/discount.go

+	OuraRingProductID         = "15496765964675" // Todd's test store
+	OuraRingDiscountCodeTitle = "Oura Ring Discount Code"
+
+	DiscountCodeLength = 12


If these aren't being manually input, and I think they're not... is there any reason not to use the full output of rand.Text()?

The result contains at least 128 bits of randomness, enough to prevent brute force guessing attacks and to make the likelihood of collisions vanishingly small.

I don't have a problem with 12 characters, but better safe than sorry, especially if no one needs to copy the codes, right?

We are sending those in emails. I'd prefer to keep them short. The worst that can happen is to generate a duplicate value the shopify rejects. The reconciliation process should retry this.

ewollesen · 2026-01-08T11:28:41Z

oura/shopify/fulfillment.go

+		},
+	}
+
+	return f.customerIOClient.SendEvent(ctx, identifiers.ID, sizingKitDelivered)


I don't see any sort of retry logic here, maybe that'll be covered by the task / job that gets run 1x / day to reconcile?

The job will be run more frequently (every hour or so) and will reprocessed failures.

ewollesen · 2026-01-08T16:18:02Z

oura/jotform/webhook.go

+	return nil
+}
+
+func (w *WebhookProcessor) ensureConsentRecordExists(ctx context.Context, userID string, submission *SubmissionResponse) error {


Question just to confirm:

The fact that we've received a jotform submission means that they've consented, right?

I seem to remember that was the case, but wanted to be sure.

In theory we're not emailing anyone < 18 years of age, but in the event that we did, do we want to perform any double checks here?

If the submission is marked as eligible, then we must upsert a consent record. This is the only value that we check. If we don't want to execute this logic, jotform ought to mark the submission is ineligible.

Now I remembered that if the user is <18 years old, the consent validation will fail because there's no parent/guardian name. So the edge case that you're describing is already handled by the model validation.

In addition to that, the OuraEligibilitySurvey validator explicitly checks for the age

v.String("dateOfBirth", &o.DateOfBirth).NotEmpty().AsTime(time.DateTime).Before(eighteenYearsAgo)

Sounds good, thanks for double checking. For some reason the jotform consent flow makes me feel a little weird, but I'm pretty sure that legal has had a look at it and given it the green light.

ewollesen · 2026-01-08T16:29:44Z

oura/shopify/fulfillment.go

+		}
+	case OuraRingProductID:
+		if err := f.onRingDelivered(ctx, customers.Identifiers[0], event, deliveredProducts.DiscountCode); err != nil {
+			logger.WithError(err).Warn("unable to send ring delivered event")


Typically it's preferable to either log the error, or return it, but not both. When you log then return the error, it tends to get logged multiple times which clutters the log output. Consider using errors.Wrap instead of logging.

The log messages here have more context than the caller has. I could add this context to the error message, but I'm not sure this improves anything. IMO logging in the caller will increase the complexity while reducing the useful output by serializing the context in the error message. The error is returned so the API responds with a non-2xx code.

The log messages here have more context than the caller has. I could add this context to the error message, but I'm not sure this improves anything. IMO logging in the caller will increase the complexity while reducing the useful output by serializing the context in the error message. The error is returned so the API responds with a non-2xx code.

I don't see how two log statements, each with only partial info can possibly be less confusing than one log with all the info (even if some of it isn't useful)? But it's getting logged, and that's the key.

The log message here has structured context, which makes searching and filtering in sumologic easier. There's no established way to pass structured context for logging purposes only to the caller. I could create a new struct and return it, but what's the point? It only needs to know that it has to respond with non-2XX so the request is retried. I could return a completely different error if that helps in any way?

ewollesen · 2026-01-08T16:30:39Z

oura/shopify/fulfillment.go

+			return err
+		}
+	default:
+		logger.Warn("ignoring fulfillment event for unknown product")


What effect will returning nil here have later down the line?

I don't see a test case covering this. Seems like it would be easier to debug this if an error were returned. The error would get logged and the user would likely get some useful message as well.

It's a fulfilment that we can't process, so returning a nil will prevent shopify from resending the event. Returning an error will make shopify retry the webhook delivery.

ewollesen · 2026-01-09T13:26:16Z

I believe there's a typo in your process diagram.

The last event is Send oura_sizing_kit_delivered event, but I think it should be something like Send oura_ring_kit_delivered event?

ewollesen · 2026-01-09T13:30:20Z

oura/jotform/api/router.go

nit: if this file lived in oura/jotformapi/router.go, then it would have a clear name, and not need any special naming when importing, i.e.

import "github.com/tidepool-org/platform/oura/jotformapi"

instead of

import ( jotformAPI "github.com/tidepool-org/platform/oura/jotform/api" )

By convention, go imports are all lowercase, so seeing jotformAPI can throw people off, and make them wonder if it's a variable (the capital letters hint that maybe it is) or an import.

I'd like to adhere to established structure and import aliasing in the project even if it is not perfect

darinkrauss

A few comments for your consideration.

darinkrauss · 2026-01-08T21:43:57Z

oura/customerio/client.go

+	appAPIBaseURL   string
+	appAPIKey       string
+	trackAPIBaseURL string
+	trackAPIKey     string
+	siteID          string


[nit] Why not just capture the Config in the Client?

darinkrauss · 2026-01-08T21:45:22Z

oura/customerio/client.go

+}
+
+type Config struct {
+	AppAPIBaseURL   string `envconfig:"TIDEPOOL_CUSTOMERIO_APP_API_BASE_URL" default:"https://api.customer.io"`


[nit] This implementation is in the oura module, but the environment variable is not. Is this Client and Config specific to ŌURA or not?

If this is non-specific, then suggest pulling outside of oura. If specific to ŌURA, then suggest using TIDEPOOL_OURA_ prefix to be clear.

darinkrauss · 2026-01-08T21:51:00Z

oura/customerio/customer.go

+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)


[nit] errors.Wrap?

darinkrauss · 2026-01-09T18:20:31Z

oura/customerio/customer.go

+}
+
+func (c *Client) GetCustomer(ctx context.Context, cid string, typ IDType) (*Customer, error) {
+	url := fmt.Sprintf("%s/v1/customers/%s/attributes", c.appAPIBaseURL, cid)


[nit] Consider using the client module.

darinkrauss · 2026-01-09T18:23:14Z

oura/customerio/customer.go

+	}
+
+	// Add the authorization header (Basic Auth for Track API)
+	req.SetBasicAuth(c.siteID, c.trackAPIKey)


[comment] Weird that some use Basic and other Bearer auth.

darinkrauss · 2026-01-09T18:44:01Z

auth/service/service/service.go

 		return errors.Wrap(err, "unable to create consent router")
 	}

+	s.Logger().Debug("Creating jotform router")


[nit] Consider pushing clients into various init*Client functions. Also, you can pull out the common userClient found in initializeConsentService.

toddkazakov added 7 commits December 5, 2025 12:23

Add jotform webhooks for Oura

61a0934

Use the configured jotform API base url

599118c

Ensure user exists before creating consent

48c809f

Parse date time fields correctly

01c769f

Add tests for jotform webhooks

aea76a4

Process oura sizing kit fulfillment webhooks from shopify

e29bcbf

Add tests for fulfillment event webhooks

da418c4

toddkazakov force-pushed the tk-oura-webhooks-shopify branch from 8e9edd8 to 3935ecd Compare December 16, 2025 14:31

Add shopify webhook routes

9a99e16

toddkazakov force-pushed the tk-oura-webhooks-shopify branch from 3935ecd to 9a99e16 Compare December 16, 2025 14:49

toddkazakov added 6 commits December 17, 2025 10:53

Use fulfillment created/updated instead of fulfillment_events to allo…

80d6b51

…w subscribing to webhooks from the shopify UI

Use test store product id

0242687

Use product GID when creating discount code

20a5de8

Configure discount codes correctly

a4b8333

Fix default customer.io track api base url

a951e35

Use id instead of cid when sending events to customer io

27ec01d

toddkazakov force-pushed the tk-oura-webhooks-shopify branch from 37d1eac to 27ec01d Compare December 17, 2025 15:03

Remove some of the unused fields of the fulfillment event

d0d7ec6

toddkazakov force-pushed the tk-oura-webhooks-shopify branch 6 times, most recently from 91c0bc2 to 6c322c7 Compare December 18, 2025 20:34

Add webhook for orders create events to notify customer.io of placed …

a3aa538

…orders

toddkazakov force-pushed the tk-oura-webhooks-shopify branch from 6c322c7 to a3aa538 Compare December 18, 2025 21:19

toddkazakov changed the base branch from tk-oura-webhooks to master December 23, 2025 09:50

toddkazakov force-pushed the tk-oura-webhooks-shopify branch 3 times, most recently from 3997ec3 to 22aae96 Compare December 23, 2025 10:21

Add tests for shopify orders

9995641

toddkazakov force-pushed the tk-oura-webhooks-shopify branch from 22aae96 to 9995641 Compare December 23, 2025 14:44

toddkazakov added 2 commits January 5, 2026 13:22

Generate account linking code when ring is delivered

a9e257a

Add oura account linking token expiration time

6b33383

toddkazakov requested a review from ewollesen January 7, 2026 13:00

toddkazakov mentioned this pull request Jan 8, 2026

[BACK-4163] Add jotform webhooks for Oura #900

Closed

toddkazakov changed the title ~~Add shopify webhooks for OURA~~ Add webhooks for OURA Jan 8, 2026

ewollesen reviewed Jan 8, 2026

View reviewed changes

Address code review feedback

8af6266

ewollesen reviewed Jan 9, 2026

View reviewed changes

ewollesen approved these changes Jan 9, 2026

View reviewed changes

darinkrauss reviewed Jan 9, 2026

View reviewed changes

Uh oh!

Add webhooks for OURA #901

Are you sure you want to change the base?

Add webhooks for OURA #901

Uh oh!

Conversation

toddkazakov commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

toddkazakov commented Dec 16, 2025

Uh oh!

toddkazakov commented Dec 16, 2025

Uh oh!

tidebot commented Dec 16, 2025

Uh oh!

tidebot commented Dec 16, 2025

Uh oh!

tidebot commented Dec 16, 2025

Uh oh!

ewollesen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

toddkazakov Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ewollesen commented Jan 9, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

darinkrauss left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

toddkazakov commented Dec 16, 2025 •

edited

Loading

toddkazakov Jan 9, 2026 •

edited

Loading