@camstack/addon-provider-bosch 0.1.29 → 0.1.30

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.30] - 2026-10-27
+
+### Changed
+
+- Home Connect and HomeCom now sign in through a page served by the hub; no more copying the redirect address out of the browser's developer tools.
+
 ## [0.1.29] - 2026-10-27
 
 ### Changed

package/dist/{account-integration-offline-DMtMWixt.js → account-integration-offline-BMoYdiX2.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CyLs51d2.js");
+const require_dist = require("./dist-BioIJ3NA.js");
 let node_crypto = require("node:crypto");
 //#region src/shared/oauth-callback.ts
 /** A code on its own: no scheme, no query, no separators. */
@@ -118,6 +118,119 @@ function loginFailureForAttempt(reason) {
 	return reason === "expired" ? "code-rejected" : "state-mismatch";
 }
 //#endregion
+//#region src/shared/login-proxy-sign-in.ts
+function createSignInClaims(ttlMs = SIGN_IN_ATTEMPT_TTL_MS) {
+	const parked = /* @__PURE__ */ new Map();
+	return {
+		settle(attemptId, outcome, nowMs) {
+			parked.set(attemptId, {
+				outcome,
+				expiresAtMs: nowMs + ttlMs
+			});
+		},
+		claim(attemptId, nowMs) {
+			const found = parked.get(attemptId);
+			if (found === void 0) return { state: "pending" };
+			parked.delete(attemptId);
+			if (nowMs > found.expiresAtMs) return { state: "pending" };
+			if (!found.outcome.ok) throw new Error(found.outcome.message);
+			return {
+				state: "done",
+				result: found.outcome.result
+			};
+		}
+	};
+}
+/** An `&`-escaped address inside HTML is the same address. */
+function unescapeHtml(text) {
+	return text.replace(/&/g, "&");
+}
+/**
+* Terminal condition for an app-scheme redirect: the `Location` of a response, or — when the
+* vendor's page navigates by script — the first address in its body, that starts with the app
+* scheme.
+*/
+function appSchemeTerminal(scheme) {
+	const inBody = new RegExp(`${scheme.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[^"'<>\\s\\\\]+`);
+	return (view) => {
+		if (view.location !== null && view.location.startsWith(scheme)) return {
+			kind: "done",
+			payload: view.location
+		};
+		const fromBody = view.bodyText === null ? null : inBody.exec(unescapeHtml(view.bodyText));
+		if (fromBody !== null) return {
+			kind: "done",
+			payload: fromBody[0]
+		};
+		return { kind: "continue" };
+	};
+}
+/** The result-page reason code for a sign-in failure reason (`HomeConnectLoginFailure`, …). */
+function landingReasonForLogin(reason) {
+	switch (reason) {
+		case "denied": return "access_denied";
+		case "state-mismatch":
+		case "state-missing": return "invalid_state";
+		case "empty":
+		case "no-code": return "invalid_request";
+		case "code-rejected":
+		case "rejected": return "exchange_failed";
+		case "no-refresh": return "no_refresh_token";
+		default: return "unknown";
+	}
+}
+function reasonOf(err) {
+	if (typeof err === "object" && err !== null && "reason" in err) {
+		const reason = err.reason;
+		if (typeof reason === "string") return reason;
+	}
+	return "unknown";
+}
+/**
+* Open the proxied login for one attempt and return the hub-relative path the browser opens.
+* A failed exchange is parked as an operator-facing message and the browser lands on the
+* result page with a reason code; nothing about the captured address leaves this function.
+*/
+function openSignInProxy(input) {
+	const started = input.nowMs();
+	input.proxy.open({
+		attemptId: input.attemptId,
+		expiresAtMs: started + SIGN_IN_ATTEMPT_TTL_MS,
+		upstreams: input.hosts.map((host) => ({
+			host,
+			scheme: input.scheme ?? "https"
+		})),
+		terminal: appSchemeTerminal(input.appScheme),
+		onDone: async (callback) => {
+			try {
+				const result = await input.finish(callback);
+				input.claims.settle(input.attemptId, {
+					ok: true,
+					result
+				}, input.nowMs());
+				return {
+					status: "success",
+					addonId: input.addonId
+				};
+			} catch (err) {
+				const message = err instanceof Error ? err.message : "The sign-in failed.";
+				input.claims.settle(input.attemptId, {
+					ok: false,
+					message
+				}, input.nowMs());
+				return {
+					status: "error",
+					addonId: input.addonId,
+					reason: landingReasonForLogin(reasonOf(err))
+				};
+			}
+		}
+	});
+	const entry = input.proxy.entryPath(input.attemptId, input.authorizeUrl);
+	if (entry === null) throw new Error("The sign-in page host is not reachable through the proxy.");
+	return entry;
+}
+//#endregion
 //#region src/shared/account-integration-cascade.ts
 async function cascadeRemoveDevicesForIntegration(input) {
 	const { reg, devices, addonId, system, integrationId, logger } = input;
@@ -167,12 +280,24 @@ Object.defineProperty(exports, "createSignInAttemptStore", {
 		return createSignInAttemptStore;
 	}
 });
+Object.defineProperty(exports, "createSignInClaims", {
+	enumerable: true,
+	get: function() {
+		return createSignInClaims;
+	}
+});
 Object.defineProperty(exports, "loginFailureForAttempt", {
 	enumerable: true,
 	get: function() {
 		return loginFailureForAttempt;
 	}
 });
+Object.defineProperty(exports, "openSignInProxy", {
+	enumerable: true,
+	get: function() {
+		return openSignInProxy;
+	}
+});
 Object.defineProperty(exports, "parseOAuthCallback", {
 	enumerable: true,
 	get: function() {

package/dist/{account-integration-offline-C-XbrgLs.mjs → account-integration-offline-pv6cqOKu.mjs}

@@ -1,4 +1,4 @@
-import { E as errMsg } from "./dist-DzSesBKb.mjs";
+import { D as errMsg } from "./dist-DBUnIovD.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/shared/oauth-callback.ts
 /** A code on its own: no scheme, no query, no separators. */
@@ -118,6 +118,119 @@ function loginFailureForAttempt(reason) {
 	return reason === "expired" ? "code-rejected" : "state-mismatch";
 }
 //#endregion
+//#region src/shared/login-proxy-sign-in.ts
+function createSignInClaims(ttlMs = SIGN_IN_ATTEMPT_TTL_MS) {
+	const parked = /* @__PURE__ */ new Map();
+	return {
+		settle(attemptId, outcome, nowMs) {
+			parked.set(attemptId, {
+				outcome,
+				expiresAtMs: nowMs + ttlMs
+			});
+		},
+		claim(attemptId, nowMs) {
+			const found = parked.get(attemptId);
+			if (found === void 0) return { state: "pending" };
+			parked.delete(attemptId);
+			if (nowMs > found.expiresAtMs) return { state: "pending" };
+			if (!found.outcome.ok) throw new Error(found.outcome.message);
+			return {
+				state: "done",
+				result: found.outcome.result
+			};
+		}
+	};
+}
+/** An `&`-escaped address inside HTML is the same address. */
+function unescapeHtml(text) {
+	return text.replace(/&/g, "&");
+}
+/**
+* Terminal condition for an app-scheme redirect: the `Location` of a response, or — when the
+* vendor's page navigates by script — the first address in its body, that starts with the app
+* scheme.
+*/
+function appSchemeTerminal(scheme) {
+	const inBody = new RegExp(`${scheme.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[^"'<>\\s\\\\]+`);
+	return (view) => {
+		if (view.location !== null && view.location.startsWith(scheme)) return {
+			kind: "done",
+			payload: view.location
+		};
+		const fromBody = view.bodyText === null ? null : inBody.exec(unescapeHtml(view.bodyText));
+		if (fromBody !== null) return {
+			kind: "done",
+			payload: fromBody[0]
+		};
+		return { kind: "continue" };
+	};
+}
+/** The result-page reason code for a sign-in failure reason (`HomeConnectLoginFailure`, …). */
+function landingReasonForLogin(reason) {
+	switch (reason) {
+		case "denied": return "access_denied";
+		case "state-mismatch":
+		case "state-missing": return "invalid_state";
+		case "empty":
+		case "no-code": return "invalid_request";
+		case "code-rejected":
+		case "rejected": return "exchange_failed";
+		case "no-refresh": return "no_refresh_token";
+		default: return "unknown";
+	}
+}
+function reasonOf(err) {
+	if (typeof err === "object" && err !== null && "reason" in err) {
+		const reason = err.reason;
+		if (typeof reason === "string") return reason;
+	}
+	return "unknown";
+}
+/**
+* Open the proxied login for one attempt and return the hub-relative path the browser opens.
+* A failed exchange is parked as an operator-facing message and the browser lands on the
+* result page with a reason code; nothing about the captured address leaves this function.
+*/
+function openSignInProxy(input) {
+	const started = input.nowMs();
+	input.proxy.open({
+		attemptId: input.attemptId,
+		expiresAtMs: started + SIGN_IN_ATTEMPT_TTL_MS,
+		upstreams: input.hosts.map((host) => ({
+			host,
+			scheme: input.scheme ?? "https"
+		})),
+		terminal: appSchemeTerminal(input.appScheme),
+		onDone: async (callback) => {
+			try {
+				const result = await input.finish(callback);
+				input.claims.settle(input.attemptId, {
+					ok: true,
+					result
+				}, input.nowMs());
+				return {
+					status: "success",
+					addonId: input.addonId
+				};
+			} catch (err) {
+				const message = err instanceof Error ? err.message : "The sign-in failed.";
+				input.claims.settle(input.attemptId, {
+					ok: false,
+					message
+				}, input.nowMs());
+				return {
+					status: "error",
+					addonId: input.addonId,
+					reason: landingReasonForLogin(reasonOf(err))
+				};
+			}
+		}
+	});
+	const entry = input.proxy.entryPath(input.attemptId, input.authorizeUrl);
+	if (entry === null) throw new Error("The sign-in page host is not reachable through the proxy.");
+	return entry;
+}
+//#endregion
 //#region src/shared/account-integration-cascade.ts
 async function cascadeRemoveDevicesForIntegration(input) {
 	const { reg, devices, addonId, system, integrationId, logger } = input;
@@ -155,4 +268,4 @@ function setIntegrationDevicesOnline(devices, system, integrationId, online) {
 	return count;
 }
 //#endregion
-export { parseOAuthCallback as a, loginFailureForAttempt as i, cascadeRemoveDevicesForIntegration as n, createSignInAttemptStore as r, setIntegrationDevicesOnline as t };
+export { createSignInAttemptStore as a, openSignInProxy as i, cascadeRemoveDevicesForIntegration as n, loginFailureForAttempt as o, createSignInClaims as r, parseOAuthCallback as s, setIntegrationDevicesOnline as t };