[tasks] Fix Todoist callback to lookup by user

vrobbler/apps/tasks/todoist.py

@@ -1,5 +1,4 @@
 import logging
-
 import secrets
 
 import requests
@@ -16,6 +15,7 @@ TODOIST_OAUTH_START_URL = "https://todoist.com/oauth/authorize?client_id={id}&sc
     id=TODOIST_CLIENT_ID
 )
 TODOIST_OAUTH_TOKEN_URL = "https://todoist.com/oauth/access_token"
+TODOIST_API_URL = "https://api.todoist.com/api/v1/sync"
 
 
 def generate_todoist_oauth_url(user_id: int) -> str:
@@ -28,12 +28,29 @@ def generate_todoist_oauth_url(user_id: int) -> str:
 def get_todoist_access_token(user_id: int, state: str, code: str):
     logger.info(
         "[get_todoist_access_token] called",
-        extra={"state": state, "code": code},
+        extra={
+            "user_id": user_id,
+            "state": state,
+            "state_repr": repr(state),
+            "code": code,
+        },
     )
-    user_profile = UserProfile.objects.filter(todoist_state=state).first()
 
-    if not user_profile:
-        raise Exception("Could not find profile")
+    user_profile = UserProfile.objects.filter(user_id=user_id).first()
+
+    logger.info(
+        "[get_todoist_access_token] found profile",
+        extra={
+            "user_id": user_id,
+            "profile_state": user_profile.todoist_state if user_profile else None,
+            "passed_state": state,
+            "match": user_profile.todoist_state == state if user_profile else False,
+        },
+    )
+
+    if not user_profile or user_profile.todoist_state != state:
+        logger.error("[get_todoist_access_token] profile not found or state mismatch")
+        raise Exception("Could not find profile or state mismatch")
 
     post_data = {
         "client_id": settings.TODOIST_CLIENT_ID,
@@ -44,11 +61,27 @@ def get_todoist_access_token(user_id: int, state: str, code: str):
     response = requests.post(TODOIST_OAUTH_TOKEN_URL, data=post_data)
 
     if response.status_code == 200:
-        user_profile.todoist_auth_key = response.json().get("access_token")
+        access_token = response.json().get("access_token")
+        user_profile.todoist_auth_key = access_token
         user_profile.todoist_state = None
-        user_profile.save()
+        user_profile.save(update_fields=["todoist_auth_key", "todoist_state"])
+
+        sync_response = requests.post(
+            TODOIST_API_URL,
+            data={"sync_token": "*", "resource_types": '["user"]'},
+            headers={"Authorization": f"Bearer {access_token}"},
+        )
+        if sync_response.status_code == 200:
+            todoist_user_id = sync_response.json().get("user", {}).get("id")
+            if todoist_user_id:
+                user_profile.todoist_user_id = todoist_user_id
+                user_profile.save(update_fields=["todoist_user_id"])
+                logger.info(
+                    "[get_todoist_access_token] set todoist_user_id",
+                    extra={"todoist_user_id": todoist_user_id},
+                )
 
     logger.info(
         "[get_todoist_access_token] finished",
-        extra={"user_id": user_profile.user.id},
+        extra={"user_id": user_id},
     )