@camstack/addon-import-alexa 0.2.174 → 0.2.175

package/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.175] - 2026-11-01
+
+### Changed
+
+- Alexa cookie login: the login proxy no longer forwards Amazon's upgrade-insecure-requests directive, which stopped the page from completing over http
+- Echo sign-in through a broker now uses the cookies Amazon returns for the token directly, and a failed sign-in names its step
+
 ## [0.2.174] - 2026-11-01
 
 ### Changed

package/dist/addon.js

@@ -133240,6 +133240,7 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			_options.proxyLogLevel === "debug" && _options.logger && _options.logger(`Alexa-Cookie: Proxy-Request: (modified:${modified})${customStringify(proxyReq, null, 2)}`);
 		}
 		function onProxyRes(proxyRes, req, res) {
+			stripUpgradeInsecureRequestsHeaders(proxyRes);
 			const url = req.originalUrl || req.url;
 			if (url.endsWith(".ico") || url.endsWith(".js") || url.endsWith(".ttf") || url.endsWith(".svg") || url.endsWith(".png") || url.endsWith(".appcache")) return;
 			if (url.startsWith("/ap/uedata")) return;
@@ -133332,7 +133333,18 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			callbackListening = null;
 		});
 	}
+	function stripUpgradeInsecureRequestsHeaders(proxyRes) {
+		const headers = proxyRes && proxyRes.headers;
+		if (!headers) return;
+		for (const name of ["content-security-policy", "content-security-policy-report-only"]) {
+			if (headers[name] === void 0) continue;
+			const kept = (Array.isArray(headers[name]) ? headers[name] : [headers[name]]).map((v) => String(v).split(";").map((d) => d.trim()).filter((d) => d && !/^upgrade-insecure-requests$/i.test(d)).join("; ")).filter((v) => v);
+			if (kept.length) headers[name] = kept.length === 1 ? kept[0] : kept;
+			else delete headers[name];
+		}
+	}
 	module.exports.initAmazonProxy = initAmazonProxy;
+	module.exports.stripUpgradeInsecureRequestsHeaders = stripUpgradeInsecureRequestsHeaders;
 }));
 //#endregion
 //#region ../../node_modules/alexa-cookie2/alexa-cookie.js
@@ -140954,7 +140966,7 @@ var BrokerEcho = class {
 		try {
 			this.currentDevices = [...parseDevices(await this.deps.worker.request({ op: "devices" }))];
 		} catch (err) {
-			this.deps.logger.warn("alexa speak: device refresh failed", {
+			this.deps.logger.warn("alexa speak: step 3 of 3, device list failed after a good sign-in", {
 				tags: { brokerId: this.deps.brokerId },
 				meta: { error: err instanceof Error ? err.message : String(err) }
 			});
@@ -141484,6 +141496,7 @@ function createAlexaNotificationProvider(ports) {
 			return found;
 		},
 		async discoverTargets(input) {
+			for (const broker of ports.brokers()) if (!broker.ready) ports.logger.warn(`alexa echo discovery: no Echo listed for '${broker.name}', the Amazon account is not signed in for this broker`, { tags: { brokerId: broker.id } });
 			const named = readString(input.config ?? {}, "brokerId");
 			if (named.length > 0) {
 				const owner = ports.brokers().find((broker) => broker.id === named);

package/dist/addon.mjs

@@ -133238,6 +133238,7 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			_options.proxyLogLevel === "debug" && _options.logger && _options.logger(`Alexa-Cookie: Proxy-Request: (modified:${modified})${customStringify(proxyReq, null, 2)}`);
 		}
 		function onProxyRes(proxyRes, req, res) {
+			stripUpgradeInsecureRequestsHeaders(proxyRes);
 			const url = req.originalUrl || req.url;
 			if (url.endsWith(".ico") || url.endsWith(".js") || url.endsWith(".ttf") || url.endsWith(".svg") || url.endsWith(".png") || url.endsWith(".appcache")) return;
 			if (url.startsWith("/ap/uedata")) return;
@@ -133330,7 +133331,18 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			callbackListening = null;
 		});
 	}
+	function stripUpgradeInsecureRequestsHeaders(proxyRes) {
+		const headers = proxyRes && proxyRes.headers;
+		if (!headers) return;
+		for (const name of ["content-security-policy", "content-security-policy-report-only"]) {
+			if (headers[name] === void 0) continue;
+			const kept = (Array.isArray(headers[name]) ? headers[name] : [headers[name]]).map((v) => String(v).split(";").map((d) => d.trim()).filter((d) => d && !/^upgrade-insecure-requests$/i.test(d)).join("; ")).filter((v) => v);
+			if (kept.length) headers[name] = kept.length === 1 ? kept[0] : kept;
+			else delete headers[name];
+		}
+	}
 	module.exports.initAmazonProxy = initAmazonProxy;
+	module.exports.stripUpgradeInsecureRequestsHeaders = stripUpgradeInsecureRequestsHeaders;
 }));
 //#endregion
 //#region ../../node_modules/alexa-cookie2/alexa-cookie.js
@@ -140952,7 +140964,7 @@ var BrokerEcho = class {
 		try {
 			this.currentDevices = [...parseDevices(await this.deps.worker.request({ op: "devices" }))];
 		} catch (err) {
-			this.deps.logger.warn("alexa speak: device refresh failed", {
+			this.deps.logger.warn("alexa speak: step 3 of 3, device list failed after a good sign-in", {
 				tags: { brokerId: this.deps.brokerId },
 				meta: { error: err instanceof Error ? err.message : String(err) }
 			});
@@ -141482,6 +141494,7 @@ function createAlexaNotificationProvider(ports) {
 			return found;
 		},
 		async discoverTargets(input) {
+			for (const broker of ports.brokers()) if (!broker.ready) ports.logger.warn(`alexa echo discovery: no Echo listed for '${broker.name}', the Amazon account is not signed in for this broker`, { tags: { brokerId: broker.id } });
 			const named = readString(input.config ?? {}, "brokerId");
 			if (named.length > 0) {
 				const owner = ports.brokers().find((broker) => broker.id === named);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-import-alexa",
-  "version": "0.2.174",
+  "version": "0.2.175",
   "description": "Alexa device-import provider for CamStack — imports the smart-home devices in a user's Alexa account via the unofficial alexa-remote2 cookie/token client (the inverse of the Alexa exporter)",
   "keywords": [
     "camstack",
@@ -68,7 +68,7 @@
       }
     ],
     "requires": {
-      "server": ">=1.2.719"
+      "server": ">=1.2.723"
     }
   },
   "files": [

package/python/alexa_gateway.py

@@ -119,14 +119,32 @@ class AlexaPyGateway:
             bare_domain(domain), label, "", session_output(session_path), False, oauth=oauth
         )
         self._login = login
+        cookies: dict = {}
         if refresh_token != "":
             exchanged = await _exchange_refresh_token(login, device_app_name)
             if not exchanged:
-                return {"status": "failed", "error": "Amazon did not accept the broker's token"}
+                return {
+                    "status": "failed",
+                    "error": "step 1 of 3, token exchange: Amazon refused the broker's token",
+                }
             await login.save_cookiefile()
-        cookies = await login.load_cookie()
-        if not cookies:
-            return {"status": "failed", "error": "no Amazon session to start from"}
+            # The exchange put its cookies in the live session; use them as they are. Reading
+            # them back through the cookie file filters them by host and can come back empty.
+            cookies = _session_cookies(login)
+            if not cookies:
+                cookies = await login.load_cookie() or {}
+            if not cookies:
+                return {
+                    "status": "failed",
+                    "error": "step 2 of 3, cookies: the token exchange was accepted but returned no cookies",
+                }
+        else:
+            cookies = await login.load_cookie() or {}
+            if not cookies:
+                return {
+                    "status": "failed",
+                    "error": "step 2 of 3, cookies: no stored Amazon session and no broker token to start from",
+                }
         await login.login(cookies=cookies)
         await self._persist_session()
         return self._status_result()
@@ -213,6 +231,22 @@ def _import_alexapy():
     return AlexaLogin, AlexaAPI
 
 
+def _session_cookies(login) -> dict:
+    """Every cookie the login's live session holds, by name. Values only leave this process
+    inside the library; nothing here logs them."""
+    session = getattr(login, "_session", None)
+    jar = getattr(session, "cookie_jar", None)
+    found: dict = {}
+    if jar is None:
+        return found
+    for morsel in jar:
+        name = getattr(morsel, "key", None)
+        value = getattr(morsel, "value", None)
+        if isinstance(name, str) and isinstance(value, str) and name != "":
+            found[name] = value.strip('"')
+    return found
+
+
 async def _exchange_refresh_token(login, device_app_name: str) -> bool:
     """Trade the broker's refresh token for cookies, under the name that token was registered with."""
     import alexapy.alexalogin as module

package/python/test_alexa_gateway.py

@@ -19,7 +19,9 @@ sys.path.insert(0, str(Path(__file__).resolve().parent))
 from alexa_gateway import AlexaPyGateway, bare_domain, normalize_device, session_output
 
 
-def install_fake_alexapy(exchange_ok: bool = True, stored_cookies: dict | None = None):
+def install_fake_alexapy(
+    exchange_ok: bool = True, stored_cookies: dict | None = None, file_readback: bool = True
+):
     """Put a fake `alexapy` (and `alexapy.alexalogin`) in sys.modules; return the call log."""
     calls: dict = {"exchange_app_names": [], "logins": [], "saved": 0}
     module = types.ModuleType("alexapy.alexalogin")
@@ -34,10 +36,13 @@ def install_fake_alexapy(exchange_ok: bool = True, stored_cookies: dict | None =
             calls["jar_path"] = outputpath(".storage/alexa_media.x.pickle")
             self.status = {"login_successful": True}
             self.refresh_token = (oauth or {}).get("refresh_token")
+            self._session = types.SimpleNamespace(cookie_jar=[])
 
         async def exchange_token_for_cookies(self):
             calls["exchange_app_names"].append(module.APP_NAME)
             calls["exchanged_token"] = self.refresh_token
+            if exchange_ok:
+                self._session.cookie_jar.append(types.SimpleNamespace(key="session-id", value="1"))
             return exchange_ok
 
         async def save_cookiefile(self):
@@ -45,7 +50,9 @@ def install_fake_alexapy(exchange_ok: bool = True, stored_cookies: dict | None =
             Path(calls["jar_path"]).write_bytes(b"jar")
 
         async def load_cookie(self):
-            return {"session-id": "1"} if (exchange_ok or stored_cookies) else {}
+            if stored_cookies:
+                return stored_cookies
+            return {"session-id": "1"} if (exchange_ok and file_readback) else {}
 
         async def login(self, cookies=None, data=None):
             calls["logins"].append(cookies)
@@ -68,6 +75,10 @@ def run(coro):
     return asyncio.run(coro)
 
 
+async def _accept_without_cookies(self):
+    return True
+
+
 class GatewayTests(unittest.TestCase):
     def tearDown(self) -> None:
         remove_fake_alexapy()
@@ -113,6 +124,27 @@ class GatewayTests(unittest.TestCase):
         self.assertEqual(calls["logins"], [])
         self.assertEqual(module.APP_NAME, "Alexa Media Player")
 
+    def test_cookies_from_the_exchange_are_used_when_the_file_reads_back_empty(self) -> None:
+        calls, _ = install_fake_alexapy(file_readback=False)
+        with tempfile.TemporaryDirectory() as directory:
+            result = run(
+                AlexaPyGateway().login_broker("alexa_002", "t", "", "amazon.com", "NA", str(Path(directory) / "s"))
+            )
+        self.assertEqual(result, {"status": "ok"})
+        self.assertEqual(calls["logins"], [{"session-id": "1"}])
+
+    def test_an_exchange_that_yields_no_cookies_names_its_step(self) -> None:
+        calls, _ = install_fake_alexapy(file_readback=False)
+        sys.modules["alexapy"].AlexaLogin.exchange_token_for_cookies = _accept_without_cookies
+        with tempfile.TemporaryDirectory() as directory:
+            result = run(
+                AlexaPyGateway().login_broker("alexa_002", "t", "", "amazon.com", "NA", str(Path(directory) / "s"))
+            )
+        self.assertEqual(result["status"], "failed")
+        self.assertIn("cookies", result["error"])
+        self.assertIn("exchange was accepted", result["error"])
+        self.assertEqual(calls["logins"], [])
+
     def test_with_no_token_only_the_stored_jar_is_tried(self) -> None:
         calls, _ = install_fake_alexapy(stored_cookies={"session-id": "1"})
         with tempfile.TemporaryDirectory() as directory: