@homebridge-plugins/homebridge-tado 8.8.2 → 9.1.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+# v9.1.0 - 2026-05-06
+- Add support for multiple bridges in Config UI
+- Validate tado account after authentication
+- Improve browser authentication instructions
+- Update got
+
+## v9.0.0 - 2026-05-03
+- Require Node.js 22
+- Update dependencies
+- Update dependencies to fix vulnerabilities
+
 ## v8.8.2 - 2026-03-21
 - Update dependencies due to vulnerability
 

package/homebridge-ui/public/index.html

@@ -33,6 +33,22 @@
     <h6 class="m-0 p-0">Custom UI cannot be displayed. The used Config UI X version is not supported!</h6>
   </div>
 
+  <!-- selectBridge: shown only when this plugin has multiple platform entries
+       (e.g. several child bridges). Lets the user pick which one this UI
+       session will configure so that newly added homes don't all funnel into
+       platforms[0]. -->
+  <div id="selectBridge" style="display:none;">
+    <img src="images/tado_logo.png" alt="tado meets Homebridge" width="150px" class="center-it mt-2 tadoLogo">
+    <h6 class="text-center">You have multiple Tado bridge instances configured.<br>Pick the one you want to configure now.</h6>
+    <div class="container mt-4" style="max-width: 360px;">
+      <div class="form-group">
+        <label for="bridgeSelectChoice">Bridge</label>
+        <select class="custom-select" id="bridgeSelectChoice"></select>
+      </div>
+      <button id="bridgeSelectContinue" type="submit" class="btn btn-primary float-right mt-3 mr-0">Continue</button>
+    </div>
+  </div>
+
   <!-- isConfigured -->
   <div id="isConfigured" style="display:none;">
     <button type="submit" class="btn btn-elegant oldConfig" style="position: absolute;">

package/homebridge-ui/public/js/main.js

@@ -7,8 +7,39 @@ const pageNavigation = {
 
 let customSchemaActive = false;
 let pluginConfig = false;
+let activeIndex = 0;
 let currentHome = false;
 
+function bridgeLabel(entry, i) {
+  const name = entry && entry.name;
+  const childUsername = entry && entry._bridge && entry._bridge.username;
+  if (name && childUsername) return `${name} (child bridge ${childUsername})`;
+  if (name) return name;
+  if (childUsername) return `Child bridge ${childUsername}`;
+  return `Bridge ${i + 1}`;
+}
+
+async function chooseActiveBridge() {
+  if (!pluginConfig || pluginConfig.length <= 1) return;
+  const $select = $('#bridgeSelectChoice');
+  $select.empty();
+  pluginConfig.forEach((entry, i) => {
+    const homeCount = (entry && entry.homes && entry.homes.length) || 0;
+    const homesLabel = `${homeCount} home${homeCount === 1 ? '' : 's'}`;
+    $select.append(`<option value="${i}">${bridgeLabel(entry, i)} — ${homesLabel}</option>`);
+  });
+  $select.val(String(activeIndex));
+  await new Promise(resolve => {
+    $('#bridgeSelectContinue').off('click').on('click', () => {
+      const parsed = parseInt($select.val(), 10);
+      activeIndex = Number.isInteger(parsed) ? parsed : 0;
+      $('#selectBridge').hide();
+      resolve();
+    });
+    $('#selectBridge').fadeIn(250);
+  });
+}
+
 const TIMEOUT = (ms) => new Promise((res) => setTimeout(res, ms));
 
 function toggleContent() {
@@ -130,20 +161,20 @@ async function createCustomSchema(home) {
   //schema.layout.homes.forEach()
 
   customSchemaActive = homebridge.createForm(schema, {
-    name: pluginConfig[0].name,
-    debug: pluginConfig[0].debug,
-    disableHistoryService: pluginConfig[0].disableHistoryService,
-    preferSiriTemperature: pluginConfig[0].preferSiriTemperature,
+    name: pluginConfig[activeIndex].name,
+    debug: pluginConfig[activeIndex].debug,
+    disableHistoryService: pluginConfig[activeIndex].disableHistoryService,
+    preferSiriTemperature: pluginConfig[activeIndex].preferSiriTemperature,
     homes: home
   });
 
   customSchemaActive.onChange(async config => {
 
-    pluginConfig[0].name = config.name;
-    pluginConfig[0].debug = config.debug;
-    pluginConfig[0].disableHistoryService = config.disableHistoryService;
-    pluginConfig[0].preferSiriTemperature = config.preferSiriTemperature;
-    pluginConfig[0].homes = pluginConfig[0].homes.map(myHome => {
+    pluginConfig[activeIndex].name = config.name;
+    pluginConfig[activeIndex].debug = config.debug;
+    pluginConfig[activeIndex].disableHistoryService = config.disableHistoryService;
+    pluginConfig[activeIndex].preferSiriTemperature = config.preferSiriTemperature;
+    pluginConfig[activeIndex].homes = pluginConfig[activeIndex].homes.map(myHome => {
       if (myHome.name === config.homes.name) {
         myHome = config.homes;
       }
@@ -228,21 +259,21 @@ async function addNewDeviceToConfig(config, refresh, resync) {
 
   try {
 
-    for (const i in config[0].homes) {
+    for (const i in config[activeIndex].homes) {
 
       let found = false;
 
-      for (const j in pluginConfig[0].homes)
-        if (config[0].homes[i].name === pluginConfig[0].homes[j].name)
+      for (const j in pluginConfig[activeIndex].homes)
+        if (config[activeIndex].homes[i].name === pluginConfig[activeIndex].homes[j].name)
           found = true;
 
       if (!found) {
-        addDeviceToList(config[0].homes[i]);
-        homebridge.toast.success(config[0].homes[i].name + ' added to config!', 'Success');
+        addDeviceToList(config[activeIndex].homes[i]);
+        homebridge.toast.success(config[activeIndex].homes[i].name + ' added to config!', 'Success');
       } else if (refresh) {
-        homebridge.toast.success(config[0].homes[i].name + ' refreshed!', 'Success');
+        homebridge.toast.success(config[activeIndex].homes[i].name + ' refreshed!', 'Success');
       } else if (resync) {
-        homebridge.toast.success(config[0].homes[i].name + ' resynchronized!', 'Success');
+        homebridge.toast.success(config[activeIndex].homes[i].name + ' resynchronized!', 'Success');
       }
 
     }
@@ -270,7 +301,7 @@ async function removeDeviceFromConfig(name) {
   let foundIndex;
   let pluginConfigBkp = JSON.parse(JSON.stringify(pluginConfig));
 
-  pluginConfig[0].homes.forEach((home, index) => {
+  pluginConfig[activeIndex].homes.forEach((home, index) => {
     if (home.name === currentHome) {
       foundIndex = index;
     }
@@ -280,13 +311,13 @@ async function removeDeviceFromConfig(name) {
 
     try {
 
-      pluginConfig[0].homes.splice(foundIndex, 1);
+      pluginConfig[activeIndex].homes.splice(foundIndex, 1);
       removeDeviceFromList(currentHome);
 
-      if (!pluginConfig[0].homes.length) {
-        delete pluginConfig[0].debug;
-        delete pluginConfig[0].disableHistoryService;
-        delete pluginConfig[0].preferSiriTemperature;
+      if (!pluginConfig[activeIndex].homes.length) {
+        delete pluginConfig[activeIndex].debug;
+        delete pluginConfig[activeIndex].disableHistoryService;
+        delete pluginConfig[activeIndex].preferSiriTemperature;
       }
 
       await homebridge.updatePluginConfig(pluginConfig);
@@ -324,9 +355,13 @@ async function fetchDevices(auth, refresh, resync) {
       homebridge.request('/authenticate', params);
       const instructionsURL = await homebridge.request('/exec', { dest: 'fullAuthentication' });
       if (instructionsURL && instructionsURL !== "") {
-        $("#fetchDevices #authenticationInstructions").html(`Open the following URL in your browser, click "submit" and log in to your tado° account "${params.username}": <a href="${instructionsURL}" target ="_blank">${instructionsURL}</a>`);
+        $("#fetchDevices #authenticationInstructions").html(
+          `Sign in as <strong>${params.username}</strong> and click "Submit":` +
+          `<br><a href="${instructionsURL}" target="_blank" rel="noopener noreferrer">${instructionsURL}</a>` +
+          `<br><span style="font-size:smaller;color:#666;">Tip: if your browser is signed in to tado.com with a different account, open the link in a private/incognito window.</span>`
+        );
         $("#fetchDevices #authenticationInstructions").css("display", "block");
-        homebridge.toast.info("Please follow the instructions above and confirm your login.");
+        homebridge.toast.info("Open the link and confirm your login.");
         const authenticationSuccessful = await homebridge.request('/exec', { dest: 'waitForAuthentication' });
         $("#fetchDevices #authenticationInstructions").html("");
         $("#fetchDevices #authenticationInstructions").css("display", "none");
@@ -348,7 +383,7 @@ async function fetchDevices(auth, refresh, resync) {
       //refresh selected home
 
       //Home Informations
-      let home = config[0].homes.find(home => home && home.name === currentHome);
+      let home = config[activeIndex].homes.find(home => home && home.name === currentHome);
 
       if (!home)
         return homebridge.toast.error('Cannot refresh ' + currentHome + '. Not found in config!', 'Error');
@@ -371,26 +406,26 @@ async function fetchDevices(auth, refresh, resync) {
 
       const homeInfo = await homebridge.request('/exec', { dest: 'getHome', data: home.id });
 
-      for (let [i, home] of config[0].homes.entries()) {
+      for (let [i, home] of config[activeIndex].homes.entries()) {
 
-        if (config[0].homes[i].name === homeInfo.name) {
+        if (config[activeIndex].homes[i].name === homeInfo.name) {
 
-          config[0].homes[i].id = homeInfo.id;
-          config[0].homes[i].username = auth.username;
-          config[0].homes[i].tadoApiUrl = auth.tadoApiUrl;
-          config[0].homes[i].skipAuth = auth.skipAuth;
-          config[0].homes[i].temperatureUnit = homeInfo.temperatureUnit || 'CELSIUS';
-          config[0].homes[i].zones = config[0].homes[i].zones || [];
+          config[activeIndex].homes[i].id = homeInfo.id;
+          config[activeIndex].homes[i].username = auth.username;
+          config[activeIndex].homes[i].tadoApiUrl = auth.tadoApiUrl;
+          config[activeIndex].homes[i].skipAuth = auth.skipAuth;
+          config[activeIndex].homes[i].temperatureUnit = homeInfo.temperatureUnit || 'CELSIUS';
+          config[activeIndex].homes[i].zones = config[activeIndex].homes[i].zones || [];
 
           if (homeInfo.geolocation)
-            config[0].homes[i].geolocation = {
+            config[activeIndex].homes[i].geolocation = {
               longitude: homeInfo.geolocation.longitude.toString(),
               latitude: homeInfo.geolocation.latitude.toString()
             };
 
           //init devices for childLock
-          config[0].homes[i].extras = config[0].homes[i].extras || {};
-          config[0].homes[i].extras.childLockSwitches = config[0].homes[i].extras.childLockSwitches || [];
+          config[activeIndex].homes[i].extras = config[activeIndex].homes[i].extras || {};
+          config[activeIndex].homes[i].extras.childLockSwitches = config[activeIndex].homes[i].extras.childLockSwitches || [];
 
           let allFoundDevices = [];
 
@@ -401,15 +436,15 @@ async function fetchDevices(auth, refresh, resync) {
           //Mobile Devices Informations
           const mobileDevices = await homebridge.request('/exec', { dest: 'getMobileDevices', data: home.id });
 
-          if (!config[0].homes[i].presence)
-            config[0].homes[i].presence = {
+          if (!config[activeIndex].homes[i].presence)
+            config[activeIndex].homes[i].presence = {
               anyone: false,
               accTypeAnyone: 'OCCUPANCY',
               user: []
             };
 
           //Remove not registred devices
-          config[0].homes[i].presence.user.forEach((user, index) => {
+          config[activeIndex].homes[i].presence.user.forEach((user, index) => {
             let found = false;
             mobileDevices.forEach(foundUser => {
               if (foundUser.name === user.name) {
@@ -418,21 +453,21 @@ async function fetchDevices(auth, refresh, resync) {
             });
             if (!found) {
               homebridge.toast.info(user.name + ' removed from config!', auth.username);
-              config[0].homes[i].presence.user.splice(index, 1);
+              config[activeIndex].homes[i].presence.user.splice(index, 1);
             }
           });
 
           //Check for new registred devices
-          if (config[0].homes[i].presence.user.length) {
+          if (config[activeIndex].homes[i].presence.user.length) {
             for (const foundUser of mobileDevices) {
               let userIndex;
-              config[0].homes[i].presence.user.forEach((user, index) => {
+              config[activeIndex].homes[i].presence.user.forEach((user, index) => {
                 if (user.name === foundUser.name) {
                   userIndex = index;
                 }
               });
               if (userIndex === undefined) {
-                config[0].homes[i].presence.user.push({
+                config[activeIndex].homes[i].presence.user.push({
                   active: false,
                   name: foundUser.name,
                   accType: 'OCCUPANCY'
@@ -440,7 +475,7 @@ async function fetchDevices(auth, refresh, resync) {
               }
             }
           } else {
-            config[0].homes[i].presence.user = mobileDevices.map(user => {
+            config[activeIndex].homes[i].presence.user = mobileDevices.map(user => {
               return {
                 active: false,
                 name: user.name,
@@ -457,7 +492,7 @@ async function fetchDevices(auth, refresh, resync) {
           const zones = await homebridge.request('/exec', { dest: 'getZones', data: home.id });
 
           //Remove not available zones
-          config[0].homes[i].zones.forEach((zone, index) => {
+          config[activeIndex].homes[i].zones.forEach((zone, index) => {
             let found = false;
             zones.forEach(foundZone => {
               if (foundZone.name === zone.name) {
@@ -466,12 +501,12 @@ async function fetchDevices(auth, refresh, resync) {
             });
             if (!found) {
               homebridge.toast.info(zone.name + ' removed from config!', auth.username);
-              config[0].homes[i].zones.splice(index, 1);
+              config[activeIndex].homes[i].zones.splice(index, 1);
             }
           });
 
           //Check for new zones or refresh exist one
-          if (config[0].homes[i].zones.length) {
+          if (config[activeIndex].homes[i].zones.length) {
             for (const foundZone of zones) {
 
               const capabilities = await homebridge.request('/exec', { dest: 'getZoneCapabilities', data: [home.id, foundZone.id] }) || {};
@@ -516,19 +551,19 @@ async function fetchDevices(auth, refresh, resync) {
                 });
 
               let zoneIndex;
-              config[0].homes[i].zones.forEach((zone, index) => {
+              config[activeIndex].homes[i].zones.forEach((zone, index) => {
                 if (zone.name === foundZone.name) {
                   zoneIndex = index;
                 }
               });
               if (zoneIndex !== undefined) {
-                config[0].homes[i].zones[zoneIndex].id = foundZone.id;
-                config[0].homes[i].zones[zoneIndex].type = foundZone.type;
-                config[0].homes[i].zones[zoneIndex].minValue = minTempValue;
-                config[0].homes[i].zones[zoneIndex].maxValue = maxTempValue;
-                config[0].homes[i].zones[zoneIndex].minStep = minTempStep;
+                config[activeIndex].homes[i].zones[zoneIndex].id = foundZone.id;
+                config[activeIndex].homes[i].zones[zoneIndex].type = foundZone.type;
+                config[activeIndex].homes[i].zones[zoneIndex].minValue = minTempValue;
+                config[activeIndex].homes[i].zones[zoneIndex].maxValue = maxTempValue;
+                config[activeIndex].homes[i].zones[zoneIndex].minStep = minTempStep;
               } else {
-                config[0].homes[i].zones.push({
+                config[activeIndex].homes[i].zones.push({
                   active: true,
                   id: foundZone.id,
                   name: foundZone.name,
@@ -595,7 +630,7 @@ async function fetchDevices(auth, refresh, resync) {
                   });
                 });
 
-              config[0].homes[i].zones.push({
+              config[activeIndex].homes[i].zones.push({
                 active: true,
                 id: zone.id,
                 name: zone.name,
@@ -621,7 +656,7 @@ async function fetchDevices(auth, refresh, resync) {
           }
 
           //remove non existing childLockSwitches
-          config[0].homes[i].extras.childLockSwitches.forEach((childLockSwitch, index) => {
+          config[activeIndex].homes[i].extras.childLockSwitches.forEach((childLockSwitch, index) => {
             let found = false;
             allFoundDevices.forEach(foundDevice => {
               if (foundDevice.serialNumber === childLockSwitch.serialNumber) {
@@ -630,21 +665,21 @@ async function fetchDevices(auth, refresh, resync) {
             });
             if (!found) {
               homebridge.toast.info(childLockSwitch.name + ' removed from config!', auth.username);
-              config[0].homes[i].extras.childLockSwitches.splice(index, 1);
+              config[activeIndex].homes[i].extras.childLockSwitches.splice(index, 1);
             }
           });
 
           //check for new childLockSwitches
-          if (config[0].homes[i].extras.childLockSwitches.length) {
+          if (config[activeIndex].homes[i].extras.childLockSwitches.length) {
             for (const foundDevice of allFoundDevices) {
               let found = false;
-              config[0].homes[i].extras.childLockSwitches.forEach(childLockSwitch => {
+              config[activeIndex].homes[i].extras.childLockSwitches.forEach(childLockSwitch => {
                 if (childLockSwitch.serialNumber === foundDevice.serialNumber) {
                   found = true;
                 }
               });
               if (!found) {
-                config[0].homes[i].extras.childLockSwitches.push({
+                config[activeIndex].homes[i].extras.childLockSwitches.push({
                   active: false,
                   name: foundDevice.name,
                   serialNumber: foundDevice.serialNumber
@@ -652,7 +687,7 @@ async function fetchDevices(auth, refresh, resync) {
               }
             }
           } else {
-            config[0].homes[i].extras.childLockSwitches = allFoundDevices.map(device => {
+            config[activeIndex].homes[i].extras.childLockSwitches = allFoundDevices.map(device => {
               return {
                 active: false,
                 name: device.name,
@@ -671,7 +706,7 @@ async function fetchDevices(auth, refresh, resync) {
 
       const availableHomesInApis = [];
 
-      for (let home of config[0].homes) {
+      for (let home of config[activeIndex].homes) {
 
         if (home.name && home.username) {
 
@@ -710,7 +745,7 @@ async function fetchDevices(auth, refresh, resync) {
       let removedHomes = 0;
 
       //remove non exist homes from config that doesnt exist in api
-      for (let [i, home] of config[0].homes.entries()) {
+      for (let [i, home] of config[activeIndex].homes.entries()) {
 
         if (home.name && home.username) {
 
@@ -734,7 +769,7 @@ async function fetchDevices(auth, refresh, resync) {
             homebridge.toast.info(home.name + ' removed from config!', home.username);
 
             await removeDeviceFromConfig(home.name);
-            config[0].homes.splice(i, 1);
+            config[activeIndex].homes.splice(i, 1);
 
             removedHomes += 1;
 
@@ -754,7 +789,7 @@ async function fetchDevices(auth, refresh, resync) {
       await TIMEOUT(2000);
 
       //refresh existing homes
-      for (let [i, home] of config[0].homes.entries()) {
+      for (let [i, home] of config[activeIndex].homes.entries()) {
 
         if (home.name && home.username) {
 
@@ -780,37 +815,37 @@ async function fetchDevices(auth, refresh, resync) {
 
             const homeInfo = await homebridge.request('/exec', { dest: 'getHome', data: home.id });
 
-            config[0].homes[i].id = homeInfo.id;
-            config[0].homes[i].username = foundHome.username;
-            config[0].homes[i].tadoApiUrl = foundHome.tadoApiUrl;
-            config[0].homes[i].skipAuth = foundHome.skipAuth;
-            config[0].homes[i].temperatureUnit = homeInfo.temperatureUnit || 'CELSIUS';
-            config[0].homes[i].zones = config[0].homes[i].zones || [];
+            config[activeIndex].homes[i].id = homeInfo.id;
+            config[activeIndex].homes[i].username = foundHome.username;
+            config[activeIndex].homes[i].tadoApiUrl = foundHome.tadoApiUrl;
+            config[activeIndex].homes[i].skipAuth = foundHome.skipAuth;
+            config[activeIndex].homes[i].temperatureUnit = homeInfo.temperatureUnit || 'CELSIUS';
+            config[activeIndex].homes[i].zones = config[activeIndex].homes[i].zones || [];
 
             if (homeInfo.geolocation)
-              config[0].homes[i].geolocation = {
+              config[activeIndex].homes[i].geolocation = {
                 longitude: homeInfo.geolocation.longitude.toString(),
                 latitude: homeInfo.geolocation.latitude.toString()
               };
 
             //init devices for childLock
-            config[0].homes[i].extras = config[0].homes[i].extras || {};
-            config[0].homes[i].extras.childLockSwitches = config[0].homes[i].extras.childLockSwitches || [];
+            config[activeIndex].homes[i].extras = config[activeIndex].homes[i].extras || {};
+            config[activeIndex].homes[i].extras.childLockSwitches = config[activeIndex].homes[i].extras.childLockSwitches || [];
 
             let allFoundDevices = [];
 
             //Mobile Devices Informations
             const mobileDevices = await homebridge.request('/exec', { dest: 'getMobileDevices', data: home.id });
 
-            if (!config[0].homes[i].presence)
-              config[0].homes[i].presence = {
+            if (!config[activeIndex].homes[i].presence)
+              config[activeIndex].homes[i].presence = {
                 anyone: false,
                 accTypeAnyone: 'OCCUPANCY',
                 user: []
               };
 
             //Remove not registred devices
-            config[0].homes[i].presence.user.forEach((user, index) => {
+            config[activeIndex].homes[i].presence.user.forEach((user, index) => {
               let found = false;
               mobileDevices.forEach(foundUser => {
                 if (foundUser.name === user.name) {
@@ -819,21 +854,21 @@ async function fetchDevices(auth, refresh, resync) {
               });
               if (!found) {
                 homebridge.toast.info(user.name + ' removed from config!', home.username);
-                config[0].homes[i].presence.user.splice(index, 1);
+                config[activeIndex].homes[i].presence.user.splice(index, 1);
               }
             });
 
             //Check for new registred devices
-            if (config[0].homes[i].presence.user.length) {
+            if (config[activeIndex].homes[i].presence.user.length) {
               for (const foundUser of mobileDevices) {
                 let userIndex;
-                config[0].homes[i].presence.user.forEach((user, index) => {
+                config[activeIndex].homes[i].presence.user.forEach((user, index) => {
                   if (user.name === foundUser.name) {
                     userIndex = index;
                   }
                 });
                 if (userIndex === undefined) {
-                  config[0].homes[i].presence.user.push({
+                  config[activeIndex].homes[i].presence.user.push({
                     active: false,
                     name: foundUser.name,
                     accType: 'OCCUPANCY'
@@ -841,7 +876,7 @@ async function fetchDevices(auth, refresh, resync) {
                 }
               }
             } else {
-              config[0].homes[i].presence.user = mobileDevices.map(user => {
+              config[activeIndex].homes[i].presence.user = mobileDevices.map(user => {
                 return {
                   active: false,
                   name: user.name,
@@ -854,7 +889,7 @@ async function fetchDevices(auth, refresh, resync) {
             const zones = await homebridge.request('/exec', { dest: 'getZones', data: home.id });
 
             //Remove not available zones
-            config[0].homes[i].zones.forEach((zone, index) => {
+            config[activeIndex].homes[i].zones.forEach((zone, index) => {
               let found = false;
               zones.forEach(foundZone => {
                 if (foundZone.name === zone.name) {
@@ -863,12 +898,12 @@ async function fetchDevices(auth, refresh, resync) {
               });
               if (!found) {
                 homebridge.toast.info(zone.name + ' removed from config!', home.username);
-                config[0].homes[i].zones.splice(index, 1);
+                config[activeIndex].homes[i].zones.splice(index, 1);
               }
             });
 
             //Check for new zones or refresh exist one
-            if (config[0].homes[i].zones.length) {
+            if (config[activeIndex].homes[i].zones.length) {
               for (const foundZone of zones) {
 
                 const capabilities = await homebridge.request('/exec', { dest: 'getZoneCapabilities', data: [home.id, foundZone.id] }) || {};
@@ -913,19 +948,19 @@ async function fetchDevices(auth, refresh, resync) {
                   });
 
                 let zoneIndex;
-                config[0].homes[i].zones.forEach((zone, index) => {
+                config[activeIndex].homes[i].zones.forEach((zone, index) => {
                   if (zone.name === foundZone.name) {
                     zoneIndex = index;
                   }
                 });
                 if (zoneIndex !== undefined) {
-                  config[0].homes[i].zones[zoneIndex].id = foundZone.id;
-                  config[0].homes[i].zones[zoneIndex].type = foundZone.type;
-                  config[0].homes[i].zones[zoneIndex].minValue = minTempValue;
-                  config[0].homes[i].zones[zoneIndex].maxValue = maxTempValue;
-                  config[0].homes[i].zones[zoneIndex].minStep = minTempStep;
+                  config[activeIndex].homes[i].zones[zoneIndex].id = foundZone.id;
+                  config[activeIndex].homes[i].zones[zoneIndex].type = foundZone.type;
+                  config[activeIndex].homes[i].zones[zoneIndex].minValue = minTempValue;
+                  config[activeIndex].homes[i].zones[zoneIndex].maxValue = maxTempValue;
+                  config[activeIndex].homes[i].zones[zoneIndex].minStep = minTempStep;
                 } else {
-                  config[0].homes[i].zones.push({
+                  config[activeIndex].homes[i].zones.push({
                     active: true,
                     id: foundZone.id,
                     name: foundZone.name,
@@ -993,7 +1028,7 @@ async function fetchDevices(auth, refresh, resync) {
                       });
                   });
 
-                config[0].homes[i].zones.push({
+                config[activeIndex].homes[i].zones.push({
                   active: true,
                   id: zone.id,
                   name: zone.name,
@@ -1019,7 +1054,7 @@ async function fetchDevices(auth, refresh, resync) {
             }
 
             //remove non existing childLockSwitches
-            config[0].homes[i].extras.childLockSwitches.forEach((childLockSwitch, index) => {
+            config[activeIndex].homes[i].extras.childLockSwitches.forEach((childLockSwitch, index) => {
               let found = false;
               allFoundDevices.forEach(foundDevice => {
                 if (foundDevice.serialNumber === childLockSwitch.serialNumber) {
@@ -1028,21 +1063,21 @@ async function fetchDevices(auth, refresh, resync) {
               });
               if (!found) {
                 homebridge.toast.info(childLockSwitch.serialNumber + ' removed from config!', home.username);
-                config[0].homes[i].extras.childLockSwitches.splice(index, 1);
+                config[activeIndex].homes[i].extras.childLockSwitches.splice(index, 1);
               }
             });
 
             //check for new childLockSwitches
-            if (config[0].homes[i].extras.childLockSwitches.length) {
+            if (config[activeIndex].homes[i].extras.childLockSwitches.length) {
               for (const foundDevice of allFoundDevices) {
                 let found = false;
-                config[0].homes[i].extras.childLockSwitches.forEach(childLockSwitch => {
+                config[activeIndex].homes[i].extras.childLockSwitches.forEach(childLockSwitch => {
                   if (childLockSwitch.serialNumber === foundDevice.serialNumber) {
                     found = true;
                   }
                 });
                 if (!found) {
-                  config[0].homes[i].extras.childLockSwitches.push({
+                  config[activeIndex].homes[i].extras.childLockSwitches.push({
                     active: false,
                     name: foundDevice.name,
                     serialNumber: foundDevice.serialNumber
@@ -1050,7 +1085,7 @@ async function fetchDevices(auth, refresh, resync) {
                 }
               }
             } else {
-              config[0].homes[i].extras.childLockSwitches = allFoundDevices.map(device => {
+              config[activeIndex].homes[i].extras.childLockSwitches = allFoundDevices.map(device => {
                 return {
                   active: false,
                   name: device.name,
@@ -1083,7 +1118,7 @@ async function fetchDevices(auth, refresh, resync) {
 
         let found = false;
 
-        config[0].homes.forEach(home => {
+        config[activeIndex].homes.forEach(home => {
           if (home.name === foundHome.name || home.id === foundHome.id)
             found = true;
         });
@@ -1227,7 +1262,7 @@ async function fetchDevices(auth, refresh, resync) {
 
           }
 
-          config[0].homes.push(homeConfig);
+          config[activeIndex].homes.push(homeConfig);
 
           await TIMEOUT(2000);
 
@@ -1253,7 +1288,7 @@ async function fetchDevices(auth, refresh, resync) {
       for (const foundHome of me.homes) {
 
         let homeIndex;
-        config[0].homes.forEach((home, index) => {
+        config[activeIndex].homes.forEach((home, index) => {
           if (home.name === foundHome.name || home.id === foundHome.id) {
             homeIndex = index;
           }
@@ -1400,7 +1435,7 @@ async function fetchDevices(auth, refresh, resync) {
           }
 
 
-          config[0].homes.push(homeConfig);
+          config[activeIndex].homes.push(homeConfig);
 
         }
 
@@ -1459,12 +1494,18 @@ async function fetchDevices(auth, refresh, resync) {
 
     } else {
 
-      if (!pluginConfig[0].homes || (pluginConfig[0].homes && !pluginConfig[0].homes.length)) {
-        pluginConfig[0].homes = [];
+      // When the user runs this plugin as multiple platform entries (typical
+      // with child bridges), let them pick which one this UI session will
+      // configure. Otherwise every "+" still goes to platforms[0] and the
+      // other entries silently stay empty.
+      await chooseActiveBridge();
+
+      if (!pluginConfig[activeIndex].homes || (pluginConfig[activeIndex].homes && !pluginConfig[activeIndex].homes.length)) {
+        pluginConfig[activeIndex].homes = [];
         return transPage(false, $('#notConfigured'));
       }
 
-      pluginConfig[0].homes.forEach(home => {
+      pluginConfig[activeIndex].homes.forEach(home => {
         $('#deviceSelect').append('<option value="' + home.name + '">' + home.name + ' &lt;' + home.username + '&gt;</option>');
       });
 
@@ -1561,7 +1602,7 @@ $('#editDevice').on('click', () => {
   resetUI();
 
   currentHome = $('#deviceSelect option:selected').val();
-  let home = pluginConfig[0].homes.find(home => home.name === currentHome);
+  let home = pluginConfig[activeIndex].homes.find(home => home.name === currentHome);
 
   if (!home)
     return homebridge.toast.error('Can not find selected home!', 'Error');
@@ -1578,7 +1619,7 @@ $('#refreshDevice').on('click', async () => {
 
     resetSchema();
 
-    let home = pluginConfig[0].homes.find(home => home.name === currentHome);
+    let home = pluginConfig[activeIndex].homes.find(home => home.name === currentHome);
 
     if (!home)
       return homebridge.toast.error('Can not find home in config!', 'Error');
@@ -1613,7 +1654,7 @@ $('#removeDevice').on('click', async () => {
 
     resetUI();
 
-    transPage(false, pluginConfig[0].homes.length ? $('#isConfigured') : $('#notConfigured'));
+    transPage(false, pluginConfig[activeIndex].homes.length ? $('#isConfigured') : $('#notConfigured'));
 
   } catch (err) {
 

package/homebridge-ui/server.js

@@ -10,64 +10,77 @@ class UiServer extends HomebridgePluginUiServer {
     this.onRequest('/exec', this.exec.bind(this));
     this.onRequest('/reset', this.reset.bind(this));
 
-    this.tado = false;
+    // Track instances per username so two concurrent settings panels
+    // (or two child-bridge configurations) don't clobber each other's API.
+    this.tadoInstances = new Map();
+    this.activeUsername = undefined;
 
     this.ready();
   }
 
   authenticate(config) {
 
-    this.tado = new TadoApi('Config UI X', {
-      username: config.username,
+    const username = config?.username;
+    if (!username) throw new RequestError('Username is required for authentication.');
+
+    const instance = new TadoApi('Config UI X', {
+      username: username,
       tadoApiUrl: config.tadoApiUrl,
       skipAuth: config.skipAuth
     }, this.homebridgeStoragePath, false);
 
+    this.tadoInstances.set(username, instance);
+    this.activeUsername = username;
+
     return;
   }
 
-  reset() {
+  reset(payload) {
 
-    this.tado = false;
+    const username = payload?.username;
+    if (username) {
+      this.tadoInstances.delete(username);
+      if (this.activeUsername === username) this.activeUsername = undefined;
+    } else {
+      this.tadoInstances.clear();
+      this.activeUsername = undefined;
+    }
 
     return;
   }
 
   async exec(payload) {
 
-    if (this.tado) {
-
-      try {
+    const username = payload?.username || this.activeUsername;
+    const tado = username ? this.tadoInstances.get(username) : undefined;
 
-        console.log('Executing /' + payload.dest);
+    if (!tado) throw new RequestError('API not initialized!');
 
-        let value1, value2, value3;
+    try {
 
-        if (payload.data) {
-          if (typeof payload.data === 'object') {
-            value1 = payload.data[0];
-            value2 = payload.data[1];
-            value3 = payload.data[2];
-          } else {
-            value1 = payload.data;
-          }
-        }
+      console.log('Executing /' + payload.dest + (username ? ` for ${username}` : ''));
 
-        const data = await this.tado[payload.dest](value1, value2, value3);
+      let value1, value2, value3;
 
-        return data;
+      if (payload.data) {
+        if (typeof payload.data === 'object') {
+          value1 = payload.data[0];
+          value2 = payload.data[1];
+          value3 = payload.data[2];
+        } else {
+          value1 = payload.data;
+        }
+      }
 
-      } catch (err) {
+      const data = await tado[payload.dest](value1, value2, value3);
 
-        console.log(err);
+      return data;
 
-        throw new RequestError(err.message);
+    } catch (err) {
 
-      }
-
-    } else {
+      console.log(err);
 
-      throw new RequestError('API not initialized!');
+      throw new RequestError(err.message);
 
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homebridge-plugins/homebridge-tado",
-  "version": "8.8.2",
+  "version": "9.1.0",
   "description": "Homebridge plugin for controlling tado° devices.",
   "main": "index.js",
   "scripts": {
@@ -29,21 +29,21 @@
     "heat"
   ],
   "engines": {
-    "node": ">=20",
+    "node": ">=22",
     "homebridge": "^1.6.0||^2.0.0-beta.0"
   },
   "dependencies": {
-    "@homebridge/plugin-ui-utils": "^2.2.1",
+    "@homebridge/plugin-ui-utils": "^2.2.3",
     "fakegato-history": "^0.6.7",
     "form-data": "^4.0.5",
     "fs-extra": "^11.3.4",
-    "got": "^14.6.6",
+    "got": "^15.0.5",
     "moment": "^2.30.1"
   },
   "devDependencies": {
-    "eslint": "^10.1.0",
+    "eslint": "^10.3.0",
     "@eslint/js": "^10.0.1",
-    "globals": "^17.4.0",
-    "prettier": "^3.8.1"
+    "globals": "^17.6.0",
+    "prettier": "^3.8.3"
   }
 }

package/src/tado/tado-api.js

@@ -145,7 +145,6 @@ export default class Tado {
       await access(this._tadoInternalTokenFilePath);
       const refresh_token = await this._retrieveRefreshTokenFromInternalFile();
       return this._refreshToken(refresh_token);
-
     } catch (_err) {
       return this._authenticateUser();
     }
@@ -201,7 +200,10 @@ export default class Tado {
     await this._increaseCounter();
     const { device_code, verification_uri_complete } = authResponse.body;
     if (!device_code) throw new Error("Failed to retrieve device code.");
-    Logger.info(`Open the following URL in your browser, click "submit" and log in to your tado° account "${this.username}": ${verification_uri_complete}`);
+    Logger.info(
+      `Open the following URL and sign in as "${this.username}" to authorize the plugin (tip: if your browser is signed in to tado.com with a different account, use a private/incognito window). ` +
+      `URL: ${verification_uri_complete}`
+    );
     if (this._tadoAuthenticationCallback) this._tadoAuthenticationCallback(verification_uri_complete);
     const maxRetries = 30;
     for (let attempt = 1; attempt <= maxRetries; attempt++) {
@@ -223,6 +225,7 @@ export default class Tado {
       if (tokenResponse?.body) {
         const { access_token, refresh_token } = tokenResponse.body;
         if (access_token && refresh_token) {
+          await this._verifyAuthenticatedIdentity();
           await writeFile(this._tadoInternalTokenFilePath, JSON.stringify({ access_token, refresh_token }));
           this._tadoBearerToken = { access_token, refresh_token, timestamp: Date.now() };
           Logger.info("Authentication successful!");
@@ -234,6 +237,44 @@ export default class Tado {
     throw new Error(`Failed to authenticate after ${maxRetries} attempts.`);
   }
 
+  /* 
+   * Tado's device-code "Submit" page silently confirms whichever account is
+   * already signed in to tado.com, so a user trying to authenticate account B
+   * can end up granting tokens for account A without noticing. Verify the
+   * identity that actually came back matches the one we asked for, and abort
+   * if it doesn't - better a loud failure than a silent account mix-up that
+   * poisons a token file. Uses got directly because apiCall -> getToken would
+   * re-enter the in-flight token promise and deadlock.
+   */
+  async _verifyAuthenticatedIdentity() {
+    if (!this.username) return;
+    const access_token = this._tadoBearerToken?.access_token;
+    if (!access_token) throw new Error('No access token available for identity verification.');
+    const url = `${this.tadoApiUrl}/api/v2/me`;
+    let me;
+    try {
+      const response = await got(url, {
+        method: 'GET',
+        responseType: 'json',
+        headers: { Authorization: `Bearer ${access_token}` },
+        timeout: { request: 15000 }
+      });
+      await this._increaseCounter();
+      me = response.body;
+    } catch (error) {
+      throw new Error(`Could not verify identity after authentication: ${error.message || JSON.stringify(error)}`);
+    }
+    const actual = (me?.email || me?.username || '').toLowerCase();
+    const expected = this.username.toLowerCase();
+    if (actual && actual !== expected) {
+      throw new Error(
+        `Authenticated identity "${actual}" does not match the configured username "${this.username}". ` +
+        `This usually means tado.com was logged in as a different account when you clicked "Submit". ` +
+        `Sign out of tado.com (or use a private/incognito window) and try again.`
+      );
+    }
+  }
+
   async _retrieveTokenFromExternalFile() {
     const maxRetries = 3;
     for (let attempt = 1; attempt <= maxRetries; attempt++) {