homebridge-melcloud-control 4.0.0-beta.243 → 4.0.0-beta.245

package/package.json

@@ -1,7 +1,7 @@
 {
   "displayName": "MELCloud Control",
   "name": "homebridge-melcloud-control",
-  "version": "4.0.0-beta.243",
+  "version": "4.0.0-beta.245",
   "description": "Homebridge plugin to control Mitsubishi Air Conditioner, Heat Pump and Energy Recovery Ventilation.",
   "license": "MIT",
   "author": "grzegorz914",

package/src/melcloud.js

@@ -176,7 +176,7 @@ class MelCloud extends EventEmitter {
 
     // MELCloud Home
     async connectToMelCloudHome() {
-        const oauth = new MelCloudHomeToken(this.log);
+        const oauth = new MelCloudHomeToken();
         this.tokens = await oauth.getTokensWithCredentials(this.user, this.passwd);
         this.emit('warn', `Token ${JSON.stringify(this.tokens, null, 2)}`);
         //this.axiosInstance.defaults.headers['Authorization'] = `Bearer ${this.tokens.accessToken}`;

package/src/melcloudhometoken.js

@@ -1,8 +1,7 @@
 // oauth-helper-axios.js
-import axios from 'axios';
-import { CookieJar } from 'tough-cookie';
-import { wrapper } from 'axios-cookiejar-support';
+import https from 'https';
 import crypto from 'crypto';
+import { URL, URLSearchParams } from 'url';
 import { JSDOM } from 'jsdom';
 
 const MOBILE_USER_AGENT = 'MonitorAndControl.App.Mobile/35 CFNetwork/3860.100.1 Darwin/25.0.0';
@@ -23,6 +22,7 @@ class MelCloudHomeToken {
         }));
     }
 
+    // --- PKCE ---
     generatePKCE() {
         const verifier = crypto.randomBytes(32).toString('base64url');
         const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
@@ -33,84 +33,103 @@ class MelCloudHomeToken {
         return crypto.randomBytes(32).toString('hex');
     }
 
+    // --- HTTPS request with cookies ---
+    httpsRequest(url, options = {}, body = undefined, cookies = [], redirectCount = 0) {
+        if (redirectCount > 10) throw new Error('Too many redirects');
+
+        return new Promise((resolve, reject) => {
+            const urlObj = new URL(url);
+            const reqOptions = {
+                ...options,
+                hostname: urlObj.hostname,
+                path: urlObj.pathname + urlObj.search,
+            };
+
+            if (!reqOptions.headers) reqOptions.headers = {};
+            if (cookies.length > 0) reqOptions.headers['Cookie'] = cookies.join('; ');
+
+            const req = https.request(reqOptions, (res) => {
+                // collect Set-Cookie
+                const setCookie = res.headers['set-cookie'];
+                if (setCookie) {
+                    setCookie.forEach(c => {
+                        const name = c.split('=')[0];
+                        const idx = cookies.findIndex(x => x.startsWith(name + '='));
+                        if (idx >= 0) cookies[idx] = c.split(';')[0];
+                        else cookies.push(c.split(';')[0]);
+                    });
+                }
+
+                // follow redirect
+                if ([301, 302, 303].includes(res.statusCode) && res.headers.location) {
+                    const redirectUrl = res.headers.location.startsWith('http')
+                        ? res.headers.location
+                        : `https://${urlObj.hostname}${res.headers.location}`;
+                    return resolve(this.httpsRequest(redirectUrl, options, undefined, cookies, redirectCount + 1));
+                }
+
+                let data = '';
+                res.on('data', chunk => data += chunk);
+                res.on('end', () => resolve({ html: data, cookies, finalUrl: url }));
+            });
+
+            req.on('error', reject);
+            if (body) req.write(body);
+            req.end();
+        });
+    }
+
+    // --- Get login page ---
     async getLoginPage(authUrl) {
         console.log('Getting login page...');
-        const resp = await this.axiosInstance.get(authUrl, {
+        const resp = await this.httpsRequest(authUrl, {
+            method: 'GET',
             headers: {
+                'User-Agent': MOBILE_USER_AGENT,
                 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-                'Accept-Language': 'en-US,en;q=0.9',
-            },
-            validateStatus: () => true
+            }
         });
 
-        const html = resp.data;
-        const formSnippet = html.match(/<form[^>]*>[\s\S]{0,800}/);
-        if (formSnippet) console.log(`Form HTML preview: ${formSnippet[0].replace(/\s+/g, ' ').substring(0, 500)}`);
-
-        const csrfMatch = html.match(/name="_csrf"\s+value="([^"]+)"/);
-        if (!csrfMatch) throw new Error('Could not extract CSRF token from login page');
+        const dom = new JSDOM(resp.html);
+        const form = dom.window.document.querySelector('form');
+        if (!form) throw new Error('Login form not found');
 
-        const cookies = await this.jar.getCookieString(authUrl) || '';
-        return { html, loginUrl: resp.request.res.responseUrl, csrf: csrfMatch[1], cookies };
+        return { formHtml: resp.html, cookies: resp.cookies, form };
     }
 
-    async submitLogin(loginUrl, email, password, cookies) {
+    // --- Submit login ---
+    async submitLogin(form, email, password, cookies, loginPageUrl) {
         console.log('Submitting login credentials...');
 
-        // 1. Pobieramy stronę logowania
-        const resp = await this.axiosInstance.get(loginUrl, {
-            headers: { Cookie: cookies },
-            maxRedirects: 0,
-            validateStatus: s => s >= 200 && s < 400
-        }).catch(err => err.response || err);
-
-        const html = resp.data;
-
-        // 2. Parsujemy formę logowania i zbieramy hidden inputs
-        const dom = new JSDOM(html);
-        const form = dom.window.document.querySelector('form');
-        if (!form) throw new Error('Nie znaleziono formy logowania');
-
+        // Collect all hidden inputs
         const formData = new URLSearchParams();
-        for (const input of form.querySelectorAll('input')) {
+        form.querySelectorAll('input').forEach(input => {
             const name = input.getAttribute('name');
-            const value = input.getAttribute('value') || '';
-            formData.append(name, value);
-        }
+            if (name) formData.append(name, input.getAttribute('value') || '');
+        });
 
-        // 3. Nadpisujemy username i password
+        // Overwrite username/password
         formData.set('username', email);
         formData.set('password', password);
 
-        const actionUrl = new URL(form.getAttribute('action'), loginUrl).toString();
+        const actionUrl = new URL(form.getAttribute('action'), loginPageUrl).toString();
+        const resp = await this.httpsRequest(actionUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
+        }, formData.toString(), cookies);
 
-        // 4. Wysyłamy POST do form action
-        return this.submitFormPost(actionUrl, formData);
-    }
+        // Try to extract code from redirect
+        const codeFromLocation = resp.finalUrl.match(/[?&]code=([^&]+)/);
+        if (codeFromLocation) return codeFromLocation[1];
 
-    async submitFormPost(actionUrl, formData) {
-        const resp = await this.axiosInstance.post(actionUrl, formData.toString(), {
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            maxRedirects: 0,
-            validateStatus: s => s >= 200 && s < 400
-        }).catch(err => err.response || err);
-
-        // 5. Szukamy authorization code w redirect
-        const locationHeader = resp.headers?.location;
-        if (locationHeader && locationHeader.startsWith('melcloudhome://')) {
-            const codeMatch = locationHeader.match(/[?&]code=([^&]+)/);
-            if (codeMatch) return codeMatch[1];
-        }
-
-        // 6. Albo w body (czasami JS redirect)
-        const bodyCodeMatch = resp.data?.match(/melcloudhome:\/\/[^"'\s]*[?&]code=([^&"'\s]+)/);
-        if (bodyCodeMatch) return bodyCodeMatch[1];
+        // Or from body (JS redirect or hidden form_post)
+        const codeFromBody = resp.html.match(/melcloudhome:\/\/[^"'\s]*[?&]code=([^&"'\s]+)/);
+        if (codeFromBody) return codeFromBody[1];
 
         throw new Error('No authorization code found after login');
     }
 
+    // --- Exchange code for tokens ---
     async exchangeCodeForTokens(code, codeVerifier) {
         console.log('Exchanging authorization code for tokens...');
 
@@ -119,28 +138,27 @@ class MelCloudHomeToken {
             code,
             redirect_uri: REDIRECT_URI,
             client_id: CLIENT_ID,
-            code_verifier: codeVerifier
+            code_verifier: codeVerifier,
         });
 
-        const resp = await this.axiosInstance.post(TOKEN_ENDPOINT, tokenData.toString(), {
+        const resp = await this.httpsRequest(TOKEN_ENDPOINT, {
+            method: 'POST',
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded',
-                'Authorization': 'Basic aG9tZW1vYmlsZTo='
+                'Content-Length': tokenData.toString().length,
+                'Authorization': 'Basic aG9tZW1vYmlsZTo=', // base64(homemobile:)
             }
-        });
-
-        if (resp.data.error) throw new Error(`Token exchange failed: ${resp.data.error_description || resp.data.error}`);
+        }, tokenData.toString());
 
-        return {
-            accessToken: resp.data.access_token,
-            refreshToken: resp.data.refresh_token,
-            expiresIn: resp.data.expires_in,
-            idToken: resp.data.id_token
-        };
+        const tokens = JSON.parse(resp.html);
+        if (tokens.error) throw new Error(`Token exchange failed: ${tokens.error_description || tokens.error}`);
+        return tokens;
     }
 
+    // --- Main flow ---
     async getTokensWithCredentials(email, password) {
         console.log('Obtaining OAuth tokens automatically...');
+
         const pkce = this.generatePKCE();
         const state = this.generateState();
 
@@ -153,10 +171,14 @@ class MelCloudHomeToken {
         authUrl.searchParams.set('code_challenge_method', 'S256');
         authUrl.searchParams.set('state', state);
 
-        const loginPage = await this.getLoginPage(authUrl.toString());
-        const authCode = await this.submitLogin(loginPage.loginUrl, loginPage.csrf, email, password, loginPage.cookies);
-        const tokens = await this.exchangeCodeForTokens(authCode, pkce.verifier);
+        // 1️⃣ get login page
+        const { form, cookies } = await this.getLoginPage(authUrl.toString());
 
+        // 2️⃣ submit login
+        const authCode = await this.submitLogin(form, email, password, cookies, authUrl.toString());
+
+        // 3️⃣ exchange code for tokens
+        const tokens = await this.exchangeCodeForTokens(authCode, pkce.verifier);
         console.log('✓ Successfully obtained OAuth tokens');
         return tokens;
     }