fix: use iOS service URL in widget SSO flow to fix 401 token rejection

Since ~2026-06-01 Garmin's API tier rejects DI bearer tokens whose
audience is sso.garmin.com/sso/embed (issued by the widget login
strategy). Mobile-path tokens (audience: mobile.integration.garmin.com)
are still accepted.

Root cause: _widget_web_login used service=sso_embed in the SSO signin
params, so the CAS ticket was scoped to that URL. The DI exchange also
used service_url=sso_embed, minting a token with the wrong audience for
connectapi.garmin.com.

Fix: set service=_ios_service_url in the widget signin params and pass
_ios_service_url to _establish_session, matching what the mobile
strategies do. Also broadens the ticket extraction regex from the
hardcoded embed? prefix to ?ticket=(ST-...) so it matches any
service URL.

Same fix applied to _complete_mfa_widget.

Closes #369

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: cyberjunky

garminconnect/client.py

@@ -159,7 +159,9 @@ def __init__(self, domain: str = "garmin.com", **kwargs: Any) -> None:
         # Portal service URL is domain-aware for CN support
         # Mobile service URLs are domain-aware for CN support
         self._ios_service_url = f"https://mobile.integration.{domain}/gcm/ios"
-        self._mobile_sso_service_url = f"https://mobile.integration.{domain}/gcm/android"
+        self._mobile_sso_service_url = (
+            f"https://mobile.integration.{domain}/gcm/android"
+        )
         self._portal_service_url = f"https://connect.{domain}/app"
         # DI auth host is domain-aware too — CN users live on diauth.garmin.cn
         # and don't exist in the .com user database. Without this, token refresh
@@ -409,7 +411,9 @@ def _do_mobile_login(self, sess: Any, email: str, password: str) -> None:
 
         if resp_type == "SUCCESSFUL":
             ticket = res["serviceTicketId"]
-            self._establish_session(ticket, sess=sess, service_url=self._ios_service_url)
+            self._establish_session(
+                ticket, sess=sess, service_url=self._ios_service_url
+            )
             return
 
         if resp_type == "INVALID_USERNAME_PASSWORD":
@@ -443,10 +447,13 @@ def _widget_web_login(self, email: str, password: str) -> None:
             "embedWidget": "true",
             "gauthHost": sso_base,
         }
+        # Use the iOS mobile service URL as the SSO service so the CAS ticket
+        # is issued for mobile.integration.garmin.com.  Since ~2026-06-01
+        # Garmin's API tier rejects DI tokens whose audience is sso/embed.
         signin_params = {
             **embed_params,
             "gauthHost": sso_embed,
-            "service": sso_embed,
+            "service": self._ios_service_url,
             "source": sso_embed,
             "redirectAfterAccountLoginUrl": sso_embed,
             "redirectAfterAccountCreationUrl": sso_embed,
@@ -545,12 +552,14 @@ def _widget_web_login(self, email: str, password: str) -> None:
                 f"Widget login: unexpected title '{title}'"
             )
 
-        # Step 4: Extract service ticket
-        ticket_match = re.search(r'embed\?ticket=([^"]+)"', r.text)
+        # Step 4: Extract service ticket — ticket may appear under any service URL
+        ticket_match = re.search(r'\?ticket=(ST-[^"&\s]+)', r.text)
         if not ticket_match:
             raise GarminConnectConnectionError("Widget login: missing service ticket")
 
-        self._establish_session(ticket_match.group(1), sess=sess, service_url=sso_embed)
+        self._establish_session(
+            ticket_match.group(1), sess=sess, service_url=self._ios_service_url
+        )
 
     def _complete_mfa_widget(self, mfa_code: str) -> None:
         """Complete MFA for widget flow."""
@@ -585,14 +594,14 @@ def _complete_mfa_widget(self, mfa_code: str) -> None:
         if title != "Success":
             raise GarminConnectAuthenticationError(f"Widget MFA failed: {title}")
 
-        ticket_match = re.search(r'embed\?ticket=([^"]+)"', r.text)
+        ticket_match = re.search(r'\?ticket=(ST-[^"&\s]+)', r.text)
         if not ticket_match:
             raise GarminConnectAuthenticationError("Widget MFA: missing service ticket")
 
         self._establish_session(
             ticket_match.group(1),
             sess=sess,
-            service_url=f"{self._sso}/sso/embed",
+            service_url=self._ios_service_url,
         )
 
     # ------------------------------------------------------------------ #