homebridge-melcloud-control 4.0.0-beta.397 → 4.0.0-beta.398

package/package.json

@@ -1,7 +1,7 @@
 {
   "displayName": "MELCloud Control",
   "name": "homebridge-melcloud-control",
-  "version": "4.0.0-beta.397",
+  "version": "4.0.0-beta.398",
   "description": "Homebridge plugin to control Mitsubishi Air Conditioner, Heat Pump and Energy Recovery Ventilation.",
   "license": "MIT",
   "author": "grzegorz914",

package/src/melcloud.js

@@ -277,7 +277,7 @@ class MelCloud extends EventEmitter {
         }
     }
 
-    async connectToMelCloudHome1() {
+    async connectToMelCloudHome() {
         try {
             const melCloudHomeToken = new MelCloudHomeToken({
                 user: this.user,
@@ -289,11 +289,11 @@ class MelCloud extends EventEmitter {
                 .on('warn', warn => this.emit('warn', warn))
                 .on('error', error => this.emit('error', error));
 
-            const { codeVerifier, url } = await melCloudHomeToken.buildAuthorizeUrl();
-            const code = await melCloudHomeToken.loginToMelCloudHome(url);
-            const token = await melCloudHomeToken.getTokens(code, codeVerifier);
+            //const { codeVerifier, url } = await melCloudHomeToken.buildAuthorizeUrl();
+            //const code = await melCloudHomeToken.loginToMelCloudHome(url);
+            const token = await melCloudHomeToken.getTokens(this.user, this.passwd);
 
-            const accountInfo = { ContextKey: code, UseFahrenheit: false };
+            const accountInfo = { ContextKey: token, UseFahrenheit: false };
             this.contextKey = code;
 
             return accountInfo
@@ -302,7 +302,7 @@ class MelCloud extends EventEmitter {
         }
     }
 
-    async connectToMelCloudHome(refresh = false) {
+    async connectToMelCloudHome1(refresh = false) {
         if (this.logDebug) this.emit('debug', `Connecting to MELCloud Home`);
 
         let browser;

package/src/melcloudhometoken.js

@@ -1,227 +1,217 @@
 import axios from 'axios';
 import crypto from 'crypto';
-import { wrapper } from 'axios-cookiejar-support';
 import { CookieJar } from 'tough-cookie';
-import { JSDOM } from 'jsdom';
-import EventEmitter from 'events';
-
-const MOBILE_USER_AGENT = 'MonitorAndControl.App.Mobile/35 CFNetwork/3860.100.1 Darwin/25.0.0';
-const CLIENT_ID = 'homemobile';
-const REDIRECT_URI = 'melcloudhome://';
-const SCOPE = 'openid profile email offline_access IdentityServerApi';
-const TOKEN_ENDPOINT = 'https://auth.melcloudhome.com/connect/token';
-const AUTHORIZE_ENDPOINT = 'https://auth.melcloudhome.com/connect/authorize';
-
-class MelCloudHomeToken extends EventEmitter {
-    constructor(config) {
-        super();
-        this.user = config.user;
-        this.passwd = config.passwd;
-        this.logWarn = config.logWarn;
-        this.logError = config.logError;
-
-        const jar = new CookieJar();
-        this.client = wrapper(axios.create({ jar, withCredentials: true }));
-        this.client.defaults.headers['User-Agent'] = MOBILE_USER_AGENT;
-    }
+import { wrapper } from 'axios-cookiejar-support';
 
-    generatePKCE() {
-        const verifier = crypto.randomBytes(32).toString('base64url');
-        const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
-        return { verifier, challenge };
+class MelCloudOAuth {
+  constructor() {
+    this.MOBILE_USER_AGENT = 'MonitorAndControl.App.Mobile/35 CFNetwork/3860.100.1 Darwin/25.0.0';
+    this.CLIENT_ID = 'homemobile';
+    this.REDIRECT_URI = 'melcloudhome://';
+    this.SCOPE = 'openid profile email offline_access IdentityServerApi';
+    this.AUTH_URL = 'https://auth.melcloudhome.com/connect/authorize';
+    this.TOKEN_URL = 'https://auth.melcloudhome.com/connect/token';
+
+    // Axios with cookie support
+    const jar = new CookieJar();
+    this.client = wrapper(axios.create({
+      jar,
+      withCredentials: true,
+      maxRedirects: 0, // we’ll handle redirects manually
+      validateStatus: null,
+      headers: {
+        'User-Agent': this.MOBILE_USER_AGENT,
+        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+      },
+    }));
+  }
+
+  /**
+   * Entry point: logs in and returns tokens
+   */
+  async getTokens(email, password) {
+    const { codeVerifier, codeChallenge } = this.generatePKCE();
+    const state = crypto.randomBytes(32).toString('hex');
+
+    // Step 1: Authorization URL
+    const authUrl = `${this.AUTH_URL}?client_id=${this.CLIENT_ID}` +
+      `&redirect_uri=${encodeURIComponent(this.REDIRECT_URI)}` +
+      `&response_type=code` +
+      `&scope=${encodeURIComponent(this.SCOPE)}` +
+      `&code_challenge=${codeChallenge}` +
+      `&code_challenge_method=S256` +
+      `&state=${state}`;
+
+    console.log('[OAuth] Step 1: GET login page');
+    const loginPage = await this.client.get(authUrl);
+    if (loginPage.status !== 200) {
+      throw new Error(`Unexpected status on login page: ${loginPage.status}`);
     }
 
-    generateState() {
-        return crypto.randomBytes(32).toString('hex');
-    }
+    // Extract CSRF token
+    const csrfMatch = loginPage.data.match(/name="_csrf"\s+value="([^"]+)"/);
+    if (!csrfMatch) throw new Error('Could not find CSRF token');
+    const csrf = csrfMatch[1];
+    console.log('[OAuth] Found CSRF token');
+
+    // Step 2: POST credentials
+    const formData = new URLSearchParams({
+      _csrf: csrf,
+      username: email,
+      password: password
+    });
+
+    console.log('[OAuth] Step 2: POST login credentials');
+    const loginResponse = await this.followRedirects(
+      loginPage.request.res.responseUrl,
+      {
+        method: 'POST',
+        data: formData.toString(),
+        headers: {
+          'User-Agent': this.MOBILE_USER_AGENT,
+          'Content-Type': 'application/x-www-form-urlencoded',
+          'Origin': 'https://live-melcloudhome.auth.eu-west-1.amazoncognito.com',
+          'Referer': loginPage.request.res.responseUrl,
+        }
+      }
+    );
 
-    async buildAuthorizeUrl() {
-        const pkce = this.generatePKCE();
-        const state = this.generateState();
+    if (!loginResponse.url.startsWith('melcloudhome://')) {
+      console.log('[OAuth] ❌ No melcloudhome:// redirect found');
+      console.log('[OAuth] Final URL:', loginResponse.url);
+      throw new Error('OAuth flow failed - did not reach redirect URI');
+    }
 
-        const authUrl = new URL(AUTHORIZE_ENDPOINT);
-        authUrl.searchParams.set('client_id', CLIENT_ID);
-        authUrl.searchParams.set('redirect_uri', REDIRECT_URI);
-        authUrl.searchParams.set('response_type', 'code');
-        authUrl.searchParams.set('scope', SCOPE);
-        authUrl.searchParams.set('code_challenge', pkce.challenge);
-        authUrl.searchParams.set('code_challenge_method', 'S256');
-        authUrl.searchParams.set('state', state);
+    const codeMatch = loginResponse.url.match(/[?&]code=([^&]+)/);
+    if (!codeMatch) throw new Error('No authorization code found');
+    const authCode = codeMatch[1];
+    console.log('[OAuth] ✓ Got authorization code');
+
+    // Step 3: Exchange code for tokens
+    console.log('[OAuth] Step 3: Exchange code for tokens');
+    const tokenData = new URLSearchParams({
+      grant_type: 'authorization_code',
+      code: authCode,
+      redirect_uri: this.REDIRECT_URI,
+      client_id: this.CLIENT_ID,
+      code_verifier: codeVerifier
+    });
+
+    const tokenResponse = await this.client.post(this.TOKEN_URL, tokenData.toString(), {
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Authorization': 'Basic aG9tZW1vYmlsZTo=', // homemobile:
+      }
+    });
+
+    if (tokenResponse.status !== 200) {
+      console.error('[OAuth] Token error response:', tokenResponse.data);
+      throw new Error(`Token exchange failed (HTTP ${tokenResponse.status})`);
+    }
 
-        return { url: authUrl.toString(), codeVerifier: pkce.verifier };
+    console.log('[OAuth] ✓ Token exchange successful');
+    return {
+      refreshToken: tokenResponse.data.refresh_token,
+      accessToken: tokenResponse.data.access_token,
+      expiresIn: tokenResponse.data.expires_in,
+    };
+  }
+
+  /**
+   * Follow redirects manually (handles IdentityServer form_post, /Redirect, etc.)
+   */
+  async followRedirects(url, options = {}, depth = 0) {
+    if (depth > 10) throw new Error('Too many redirects');
+
+    const response = await this.client.request({ url, ...options });
+    const status = response.status;
+
+    // Check for melcloudhome://
+    if (response.headers.location?.startsWith('melcloudhome://')) {
+      return { url: response.headers.location, data: response.data };
     }
 
-    async loginToMelCloudHome(authUrl) {
-        try {
-            const getResp = await this.client.get(authUrl, { headers: { 'Accept': 'text/html' } });
-            const cookies = getResp.headers['set-cookie'] || [];
-            const dom = new JSDOM(getResp.data);
-            const csrf = dom.window.document.querySelector('input[name="_csrf"]')?.value;
-
-            if (!csrf) {
-                this.emit('warn', 'CSRF token not found');
-                return null;
-            }
-
-            const formData = new URLSearchParams({
-                _csrf: csrf,
-                username: this.user,
-                password: this.passwd
-            });
-
-            const response = await this.client.post(authUrl, formData.toString(), {
-                headers: {
-                    'User-Agent': MOBILE_USER_AGENT,
-                    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-                    'Accept-Language': 'en-US,en;q=0.9',
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    'Content-Length': formData.toString().length,
-                    'Cookie': cookies.join('; '),
-                    'Origin': 'https://live-melcloudhome.auth.eu-west-1.amazoncognito.com',
-                    'Referer': authUrl
-                },
-                maxRedirects: 0,
-                validateStatus: status => [200, 302, 400].includes(status)
-            });
-
-            if (response.status === 400) {
-                this.emit('warn', `Login failed: ${response.data}`);
-                return null;
-            }
-
-            // Extract authorization code
-            const code = await this.extractCodeFromResponse(
-                response.data,
-                response.headers,
-                async (url) => {
-                    const r = await this.client.get(url, {
-                        maxRedirects: 0,
-                        validateStatus: status => [200, 302, 303].includes(status)
-                    });
-                    return this.extractCodeFromResponse(r.data, r.headers, async u => this.extractCodeFromResponse(r.data, r.headers, u));
-                }
-            );
-
-            if (code) this.emit('warn', `Authorization code obtained: ${code}`);
-            return code || null;
-
-        } catch (err) {
-            this.emit('warn', `loginToMelCloudHome error: ${err}`);
-            return null;
+    // Handle form_post response (HTML with hidden inputs)
+    if (status === 200 && typeof response.data === 'string' && response.data.includes('<form')) {
+      const formMatch = response.data.match(/action="([^"]+)"/);
+      if (formMatch) {
+        const formAction = this.makeAbsoluteUrl(url, formMatch[1]);
+        const inputs = [...response.data.matchAll(/<input[^>]+>/g)];
+        const form = new URLSearchParams();
+
+        for (const input of inputs) {
+          const nameMatch = input[0].match(/name="([^"]+)"/);
+          const valueMatch = input[0].match(/value="([^"]*)"/);
+          if (nameMatch) {
+            form.append(nameMatch[1], valueMatch ? valueMatch[1] : '');
+          }
         }
-    }
 
-    async extractCodeFromResponse(data, headers, followRedirect) {
-        return new Promise(async (resolve, reject) => {
-            try {
-                const locationHeader = headers['location'] || headers['Location'];
-
-                // 1️⃣ Location header
-                if (locationHeader && locationHeader.startsWith('melcloudhome://')) {
-                    const match = locationHeader.match(/[?&]code=([^&]+)/);
-                    if (match) {
-                        this.emit('warn', `Found code in Location header: ${match[1]}`);
-                        resolve(match[1]);
-                        return;
-                    }
-                }
-
-                // 2️⃣ form_post HTML
-                const formCodeMatch = data.match(/name="code"\s+value="([^"]+)"/);
-                const formStateMatch = data.match(/name="state"\s+value="([^"]+)"/);
-                const formActionMatch = data.match(/action="([^"]+)"/);
-
-                if (formCodeMatch && formStateMatch && formActionMatch) {
-                    this.emit('warn', 'Found form_post, submitting...');
-                    try {
-                        const code = await this.submitFormPost(formActionMatch[1], formCodeMatch[1], formStateMatch[1]);
-                        this.emit('warn', `submitFormPost returned code: ${code}`);
-                        resolve(code);
-                        return;
-                    } catch (err) {
-                        this.emit('warn', `submitFormPost failed: ${err}`);
-                        reject(err);
-                        return;
-                    }
-                }
-
-                // 3️⃣ JS redirect in body
-                const bodyCodeMatch = data.match(/melcloudhome:\/\/[^"'\s]*[?&]code=([^&"'\s]+)/);
-                if (bodyCodeMatch) {
-                    this.emit('warn', `Found code in body: ${bodyCodeMatch[1]}`);
-                    resolve(bodyCodeMatch[1]);
-                    return;
-                }
-
-                // 4️⃣ Follow redirect
-                if (locationHeader && ['301', '302', '303'].includes(headers['status'] || '')) {
-                    this.emit('warn', `Following redirect to ${locationHeader}`);
-                    try {
-                        const code = await followRedirect(locationHeader);
-                        resolve(code);
-                        return;
-                    } catch (err) {
-                        this.emit('warn', `Follow redirect failed: ${err}`);
-                        reject(err);
-                        return;
-                    }
-                }
-
-                this.emit('warn', 'Authorization code not found in response');
-                reject(new Error('Authorization code not found'));
-            } catch (err) {
-                this.emit('warn', `extractCodeFromResponse error: ${err}`);
-                reject(err);
-            }
-        });
+        console.log('[OAuth] Submitting hidden form →', formAction);
+        return await this.followRedirects(formAction, {
+          method: 'POST',
+          data: form.toString(),
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            'Referer': url,
+            'User-Agent': this.MOBILE_USER_AGENT
+          }
+        }, depth + 1);
+      }
     }
 
-    async submitFormPost(actionUrl, code, state) {
-        const formData = new URLSearchParams({ code, state });
-        this.emit('warn', `Submitting form_post to ${actionUrl}`);
-        const res = await this.client.post(actionUrl, formData.toString(), {
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            maxRedirects: 0,
-            validateStatus: status => [200, 302, 303].includes(status)
-        });
-
-        const location = res.headers['location'];
-        if (location) {
-            const match = location.match(/[?&]code=([^&]+)/);
-            if (match) return match[1];
-        }
+    // Handle redirect (302, 303)
+    if ([301, 302, 303].includes(status) && response.headers.location) {
+      const nextUrl = this.makeAbsoluteUrl(url, response.headers.location);
+      console.log('[OAuth] Following redirect →', nextUrl);
+      return await this.followRedirects(nextUrl, { method: 'GET' }, depth + 1);
+    }
 
-        this.emit('warn', 'Code not found after form_post submission');
-        throw new Error('Code not found after form_post submission');
+    // /Redirect pages may contain melcloudhome:// in body
+    if (url.includes('/Redirect') && typeof response.data === 'string') {
+      const match = response.data.match(/melcloudhome:\/\/[^"'\s<>]*/);
+      if (match) {
+        console.log('[OAuth] Found melcloudhome:// in HTML body');
+        return { url: match[0], data: response.data };
+      }
     }
 
-    async getTokens(code, codeVerifier) {
-        const tokenData = new URLSearchParams({
-            grant_type: 'authorization_code',
-            code: code,
-            redirect_uri: REDIRECT_URI,
-            client_id: CLIENT_ID,
-            code_verifier: codeVerifier
-        });
-
-        try {
-            const tokenResponse = await this.client.post(TOKEN_ENDPOINT, tokenData.toString(), {
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    'Authorization': 'Basic aG9tZW1vYmlsZTo='
-                }
-            });
-
-            const tokens = tokenResponse.data;
-            this.emit('warn', `Token obtained: ${JSON.stringify(tokens)}`);
-            return tokens;
-
-        } catch (err) {
-            throw new Error(`Failed to obtain OAuth token: ${err}`);
-        }
+    // No redirect, return final response
+    return { url, data: response.data };
+  }
+
+  /**
+   * Generate PKCE code verifier/challenge
+   */
+  generatePKCE() {
+    const verifier = crypto.randomBytes(32)
+      .toString('base64')
+      .replace(/\+/g, '-')
+      .replace(/\//g, '_')
+      .replace(/=/g, '');
+    const challenge = crypto.createHash('sha256')
+      .update(verifier)
+      .digest('base64')
+      .replace(/\+/g, '-')
+      .replace(/\//g, '_')
+      .replace(/=/g, '');
+    return { codeVerifier: verifier, codeChallenge: challenge };
+  }
+
+  /**
+   * Make absolute URL from relative one
+   */
+  makeAbsoluteUrl(base, relative) {
+    if (relative.startsWith('http')) return relative;
+    const baseUrl = new URL(base);
+    if (relative.startsWith('/')) {
+      return `${baseUrl.origin}${relative}`;
     }
+    return `${baseUrl.origin}${baseUrl.pathname.replace(/\/[^/]*$/, '/')}${relative}`;
+  }
 }
 
+
 export default MelCloudHomeToken;