homebridge-melcloud-control 4.0.0-beta.400 → 4.0.0-beta.402

package/package.json

@@ -1,7 +1,7 @@
 {
   "displayName": "MELCloud Control",
   "name": "homebridge-melcloud-control",
-  "version": "4.0.0-beta.400",
+  "version": "4.0.0-beta.402",
   "description": "Homebridge plugin to control Mitsubishi Air Conditioner, Heat Pump and Energy Recovery Ventilation.",
   "license": "MIT",
   "author": "grzegorz914",

package/src/melcloudhometoken.js

@@ -4,212 +4,172 @@ import { CookieJar } from 'tough-cookie';
 import { wrapper } from 'axios-cookiejar-support';
 import EventEmitter from 'events';
 
+const MOBILE_USER_AGENT = 'MonitorAndControl.App.Mobile/35 CFNetwork/3860.100.1 Darwin/25.0.0';
+const CLIENT_ID = 'homemobile';
+const REDIRECT_URI = 'melcloudhome://';
+const SCOPE = 'openid profile';
+
 class MelCloudHomeToken extends EventEmitter {
     constructor() {
         super();
-        this.MOBILE_USER_AGENT = 'MonitorAndControl.App.Mobile/35 CFNetwork/3860.100.1 Darwin/25.0.0';
-        this.CLIENT_ID = 'homemobile';
-        this.REDIRECT_URI = 'melcloudhome://';
-        this.SCOPE = 'openid profile email offline_access IdentityServerApi';
-        this.AUTH_URL = 'https://auth.melcloudhome.com/connect/authorize';
-        this.TOKEN_URL = 'https://auth.melcloudhome.com/connect/token';
-
-        // Axios with cookie support
-        const jar = new CookieJar();
-        this.client = wrapper(axios.create({
-            jar,
-            withCredentials: true,
-            maxRedirects: 0, // we’ll handle redirects manually
-            validateStatus: null,
-            headers: {
-                'User-Agent': this.MOBILE_USER_AGENT,
-                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-            },
-        }));
+        this.cookieJar = new CookieJar();
     }
 
-    /**
-     * Entry point: logs in and returns tokens
-     */
     async getTokens(email, password) {
-        const { codeVerifier, codeChallenge } = this.generatePKCE();
-        const state = crypto.randomBytes(32).toString('hex');
-
-        // Step 1: Authorization URL
-        const authUrl = `${this.AUTH_URL}?client_id=${this.CLIENT_ID}` +
-            `&redirect_uri=${encodeURIComponent(this.REDIRECT_URI)}` +
-            `&response_type=code` +
-            `&scope=${encodeURIComponent(this.SCOPE)}` +
-            `&code_challenge=${codeChallenge}` +
-            `&code_challenge_method=S256` +
-            `&state=${state}`;
-
-        console.log('[OAuth] Step 1: GET login page');
-        const loginPage = await this.client.get(authUrl);
-        if (loginPage.status !== 200) {
-            throw new Error(`Unexpected status on login page: ${loginPage.status}`);
-        }
+        const verifier = this._generateCodeVerifier();
+        const challenge = this._generateCodeChallenge(verifier);
+        const authUrl = `https://live-melcloudhome.auth.eu-west-1.amazoncognito.com/login?client_id=3g4d5l5kivuqi7oia68gib7uso&redirect_uri=${encodeURIComponent(
+            'https://auth.melcloudhome.com/signin-oidc-meu'
+        )}&response_type=code&scope=openid%20profile&code_challenge=${challenge}&code_challenge_method=S256`;
 
-        // Extract CSRF token
-        const csrfMatch = loginPage.data.match(/name="_csrf"\s+value="([^"]+)"/);
-        if (!csrfMatch) throw new Error('Could not find CSRF token');
-        const csrf = csrfMatch[1];
-        console.log('[OAuth] Found CSRF token');
+        console.log('[OAuth] Starting MELCloud login flow');
 
-        // Step 2: POST credentials
-        const formData = new URLSearchParams({
+        const html = await this._get(authUrl);
+        const csrf = this._extractCsrf(html);
+        if (!csrf) throw new Error('Cannot find CSRF token');
+
+        console.log('[OAuth] Submitting credentials...');
+
+        const form = new URLSearchParams({
             _csrf: csrf,
             username: email,
-            password: password
+            password: password,
         });
 
-        console.log('[OAuth] Step 2: POST login credentials');
-        const loginResponse = await this.followRedirects(
-            loginPage.request.res.responseUrl,
-            {
-                method: 'POST',
-                data: formData.toString(),
-                headers: {
-                    'User-Agent': this.MOBILE_USER_AGENT,
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    'Origin': 'https://live-melcloudhome.auth.eu-west-1.amazoncognito.com',
-                    'Referer': loginPage.request.res.responseUrl,
-                }
-            }
-        );
+        const loginResp = await this._post('https://live-melcloudhome.auth.eu-west-1.amazoncognito.com/login', form);
+
+        if (loginResp.status === 302 && loginResp.headers.location) {
+            const nextUrl = this._resolveUrl('https://live-melcloudhome.auth.eu-west-1.amazoncognito.com', loginResp.headers.location);
+            console.log('[OAuth] Redirecting to:', nextUrl);
+            return await this._followRedirects(nextUrl, verifier);
+        } else if (loginResp.status === 200) {
+            throw new Error('Login failed — probably wrong credentials');
+        } else {
+            throw new Error(`Unexpected login status: ${loginResp.status}`);
+        }
+    }
+
+    async _followRedirects(url, verifier, depth = 0) {
+        if (depth > 10) throw new Error('Too many redirects');
+
+        const resp = await this._get(url);
+
+        if (resp.status === 302 && resp.headers.location) {
+            const nextUrl = this._resolveUrl(url, resp.headers.location);
+            console.log(`[OAuth] Redirect (${resp.status}) to: ${nextUrl}`);
+            return await this._followRedirects(nextUrl, verifier, depth + 1);
+        }
 
-        if (!loginResponse.url.startsWith('melcloudhome://')) {
-            console.log('[OAuth] ❌ No melcloudhome:// redirect found');
-            console.log('[OAuth] Final URL:', loginResponse.url);
-            throw new Error('OAuth flow failed - did not reach redirect URI');
+        if (typeof resp.data === 'string') {
+            const code = this._extractAuthCode(resp.data);
+            if (code) {
+                console.log('[OAuth] Got authorization code');
+                return await this._exchangeToken(code, verifier);
+            }
         }
 
-        const codeMatch = loginResponse.url.match(/[?&]code=([^&]+)/);
-        if (!codeMatch) throw new Error('No authorization code found');
-        const authCode = codeMatch[1];
-        console.log('[OAuth] ✓ Got authorization code');
+        throw new Error(`No authorization code found (status ${resp.status})`);
+    }
 
-        // Step 3: Exchange code for tokens
-        console.log('[OAuth] Step 3: Exchange code for tokens');
-        const tokenData = new URLSearchParams({
+    async _exchangeToken(code, verifier) {
+        console.log('[OAuth] Exchanging code for tokens...');
+
+        const tokenUrl = 'https://auth.melcloudhome.com/connect/token';
+        const data = new URLSearchParams({
             grant_type: 'authorization_code',
-            code: authCode,
-            redirect_uri: this.REDIRECT_URI,
-            client_id: this.CLIENT_ID,
-            code_verifier: codeVerifier
+            client_id: CLIENT_ID,
+            code: code,
+            redirect_uri: REDIRECT_URI,
+            code_verifier: verifier,
         });
 
-        const tokenResponse = await this.client.post(this.TOKEN_URL, tokenData.toString(), {
+        const resp = await axios.post(tokenUrl, data.toString(), {
             headers: {
+                'User-Agent': MOBILE_USER_AGENT,
                 'Content-Type': 'application/x-www-form-urlencoded',
-                'Authorization': 'Basic aG9tZW1vYmlsZTo=', // homemobile:
-            }
+                'Authorization': 'Basic aG9tZW1vYmlsZTo=',
+            },
+            validateStatus: () => true,
         });
 
-        if (tokenResponse.status !== 200) {
-            console.error('[OAuth] Token error response:', tokenResponse.data);
-            throw new Error(`Token exchange failed (HTTP ${tokenResponse.status})`);
+        if (resp.status !== 200) {
+            console.error('[OAuth] Token exchange failed:', resp.status, resp.data);
+            throw new Error(`Token exchange failed with status ${resp.status}`);
         }
 
-        console.log('[OAuth] ✓ Token exchange successful');
+        console.log('[OAuth] Tokens received!');
         return {
-            refreshToken: tokenResponse.data.refresh_token,
-            accessToken: tokenResponse.data.access_token,
-            expiresIn: tokenResponse.data.expires_in,
+            accessToken: resp.data.access_token,
+            refreshToken: resp.data.refresh_token,
+            expiresIn: resp.data.expires_in,
         };
     }
 
-    /**
-     * Follow redirects manually (handles IdentityServer form_post, /Redirect, etc.)
-     */
-    async followRedirects(url, options = {}, depth = 0) {
-        if (depth > 10) throw new Error('Too many redirects');
-
-        const response = await this.client.request({ url, ...options });
-        const status = response.status;
-
-        // Check for melcloudhome://
-        if (response.headers.location?.startsWith('melcloudhome://')) {
-            return { url: response.headers.location, data: response.data };
+    async _get(url) {
+        const cookies = await this.cookieJar.getCookieString(url);
+        const resp = await axios.get(url, {
+            headers: {
+                'User-Agent': MOBILE_USER_AGENT,
+                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                'Cookie': cookies,
+            },
+            validateStatus: () => true,
+            maxRedirects: 0,
+            responseType: 'text',
+        });
+        if (resp.headers['set-cookie']) {
+            await this.cookieJar.setCookie(resp.headers['set-cookie'].join('; '), url);
         }
+        return resp;
+    }
 
-        // Handle form_post response (HTML with hidden inputs)
-        if (status === 200 && typeof response.data === 'string' && response.data.includes('<form')) {
-            const formMatch = response.data.match(/action="([^"]+)"/);
-            if (formMatch) {
-                const formAction = this.makeAbsoluteUrl(url, formMatch[1]);
-                const inputs = [...response.data.matchAll(/<input[^>]+>/g)];
-                const form = new URLSearchParams();
-
-                for (const input of inputs) {
-                    const nameMatch = input[0].match(/name="([^"]+)"/);
-                    const valueMatch = input[0].match(/value="([^"]*)"/);
-                    if (nameMatch) {
-                        form.append(nameMatch[1], valueMatch ? valueMatch[1] : '');
-                    }
-                }
-
-                console.log('[OAuth] Submitting hidden form →', formAction);
-                return await this.followRedirects(formAction, {
-                    method: 'POST',
-                    data: form.toString(),
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded',
-                        'Referer': url,
-                        'User-Agent': this.MOBILE_USER_AGENT
-                    }
-                }, depth + 1);
-            }
+    async _post(url, formData) {
+        const cookies = await this.cookieJar.getCookieString(url);
+        const resp = await axios.post(url, formData.toString(), {
+            headers: {
+                'User-Agent': MOBILE_USER_AGENT,
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'Accept': 'text/html,application/xhtml+xml',
+                'Cookie': cookies,
+                'Content-Length': Buffer.byteLength(formData.toString()),
+            },
+            validateStatus: () => true,
+            maxRedirects: 0,
+            responseType: 'text',
+        });
+        if (resp.headers['set-cookie']) {
+            await this.cookieJar.setCookie(resp.headers['set-cookie'].join('; '), url);
         }
+        return resp;
+    }
 
-        // Handle redirect (302, 303)
-        if ([301, 302, 303].includes(status) && response.headers.location) {
-            const nextUrl = this.makeAbsoluteUrl(url, response.headers.location);
-            console.log('[OAuth] Following redirect →', nextUrl);
-            return await this.followRedirects(nextUrl, { method: 'GET' }, depth + 1);
-        }
+    _extractCsrf(html) {
+        const match = html.match(/name="_csrf" value="([^"]+)"/);
+        return match ? match[1] : null;
+    }
 
-        // /Redirect pages may contain melcloudhome:// in body
-        if (url.includes('/Redirect') && typeof response.data === 'string') {
-            const match = response.data.match(/melcloudhome:\/\/[^"'\s<>]*/);
-            if (match) {
-                console.log('[OAuth] Found melcloudhome:// in HTML body');
-                return { url: match[0], data: response.data };
-            }
-        }
+    _extractAuthCode(html) {
+        const urlMatch = html.match(/[?&]code=([^&]+)/);
+        if (urlMatch) return urlMatch[1];
+        const formMatch = html.match(/name="code"\s+value="([^"]+)"/);
+        return formMatch ? formMatch[1] : null;
+    }
 
-        // No redirect, return final response
-        return { url, data: response.data };
+    _generateCodeVerifier() {
+        return crypto.randomBytes(32).toString('base64url');
     }
 
-    /**
-     * Generate PKCE code verifier/challenge
-     */
-    generatePKCE() {
-        const verifier = crypto.randomBytes(32)
-            .toString('base64')
-            .replace(/\+/g, '-')
-            .replace(/\//g, '_')
-            .replace(/=/g, '');
-        const challenge = crypto.createHash('sha256')
-            .update(verifier)
-            .digest('base64')
-            .replace(/\+/g, '-')
-            .replace(/\//g, '_')
-            .replace(/=/g, '');
-        return { codeVerifier: verifier, codeChallenge: challenge };
+    _generateCodeChallenge(verifier) {
+        const hash = crypto.createHash('sha256').update(verifier).digest();
+        return hash.toString('base64url');
     }
 
-    /**
-     * Make absolute URL from relative one
-     */
-    makeAbsoluteUrl(base, relative) {
-        if (relative.startsWith('http')) return relative;
-        const baseUrl = new URL(base);
-        if (relative.startsWith('/')) {
-            return `${baseUrl.origin}${relative}`;
+    _resolveUrl(base, relative) {
+        try {
+            return new URL(relative, base).toString();
+        } catch {
+            return relative;
         }
-        return `${baseUrl.origin}${baseUrl.pathname.replace(/\/[^/]*$/, '/')}${relative}`;
     }
 }