homebridge-nuheat2 1.2.16 → 1.2.17

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project should be documented in this file
 
 ## [Unreleased]
 
+## [1.2.17] - 2026-04-29
+
+### Fixed
+
+- Treat the built-in Nuheat public client ID as PKCE-only even when it is explicitly saved in Advanced OAuth settings
+- Ignore and clear stale saved client secrets when users return to the built-in PKCE public client
+
 ## [1.2.16] - 2026-04-29
 
 ### Changed

package/homebridge-ui/public/index.js

@@ -1,4 +1,5 @@
 const PLATFORM_NAME = "NuHeat";
+const BUILT_IN_CLIENT_ID = "homebridge-nuheat2_260421";
 
 const elements = {
   name: document.getElementById("name"),
@@ -139,7 +140,9 @@ function renderConfig(config) {
 
   elements.clientId.value = config.clientId || "";
   elements.clientSecret.value = "";
-  state.hasClientSecret = Boolean(config.clientSecret);
+  state.hasClientSecret = Boolean(
+    config.clientSecret && config.clientId !== BUILT_IN_CLIENT_ID,
+  );
   elements.clientSecret.placeholder = state.hasClientSecret
     ? "Saved secret (leave blank to keep)"
     : "Optional client secret";
@@ -313,6 +316,7 @@ async function saveOauth() {
   const clientId = elements.clientId.value.trim();
   const clientSecret = elements.clientSecret.value;
   const redirectUri = elements.redirectUri.value.trim();
+  const usesBuiltInClient = !clientId || clientId === BUILT_IN_CLIENT_ID;
 
   if (!clientId && clientSecret) {
     showToast("error", "A client secret requires a Nuheat client ID.");
@@ -321,24 +325,25 @@ async function saveOauth() {
   }
 
   const patch = {
-    clientId: clientId || undefined,
+    clientId: usesBuiltInClient ? undefined : clientId,
     redirectUri: redirectUri && redirectUri !== "http://localhost" ? redirectUri : undefined,
   };
 
-  if (clientSecret) {
+  if (clientSecret && !usesBuiltInClient) {
     patch.clientSecret = clientSecret;
-  } else if (!clientId || clientId !== (state.config?.clientId || "")) {
+  } else if (usesBuiltInClient || clientId !== (state.config?.clientId || "")) {
     patch.clientSecret = undefined;
   }
 
   await persistPatch(patch);
-  if (clientSecret) {
-    state.hasClientSecret = true;
-    elements.clientSecret.value = "";
-    elements.clientSecret.placeholder = "Saved secret (leave blank to keep)";
-    updateStatuses();
-    renderDiagnostics();
-  }
+  state.hasClientSecret = Boolean(state.config?.clientSecret);
+  elements.clientId.value = state.config?.clientId || "";
+  elements.clientSecret.value = "";
+  elements.clientSecret.placeholder = state.hasClientSecret
+    ? "Saved secret (leave blank to keep)"
+    : "Optional client secret";
+  updateStatuses();
+  renderDiagnostics();
   showToast("success", "OAuth settings saved.");
 }
 
@@ -437,8 +442,9 @@ function updateBehaviorStatus() {
 }
 
 function updateOauthStatus() {
-  const hasClientId = elements.clientId.value.trim().length > 0;
-  const hasClientSecret = hasUsableClientSecret(elements.clientId.value.trim());
+  const clientId = elements.clientId.value.trim();
+  const hasClientId = clientId.length > 0 && clientId !== BUILT_IN_CLIENT_ID;
+  const hasClientSecret = hasUsableClientSecret(clientId);
   const text = hasClientId
     ? hasClientSecret
       ? "Custom legacy OAuth"
@@ -448,6 +454,10 @@ function updateOauthStatus() {
 }
 
 function hasUsableClientSecret(clientId) {
+  if (!clientId || clientId === BUILT_IN_CLIENT_ID) {
+    return false;
+  }
+
   if (elements.clientSecret.value) {
     return true;
   }
@@ -577,13 +587,16 @@ function getHoldSummary(value) {
 }
 
 function getOauthMode(config) {
+  if (!config.clientId || config.clientId === BUILT_IN_CLIENT_ID) {
+    return "built-in PKCE public client";
+  }
+
   if (config.clientId && hasUsableClientSecret(config.clientId)) {
     return "configured confidential client";
   }
   if (config.clientId) {
     return "configured PKCE public client";
   }
-  return "built-in PKCE public client";
 }
 
 function normalizeHoldLength(value) {

package/lib/NuHeatAPI.js

@@ -33,15 +33,16 @@ class NuHeatAPI {
         this.log = log;
         const configuredClientId = options.clientId || process.env.NUHEAT_API_CLIENT_ID || "";
         const configuredClientSecret = options.clientSecret || process.env.NUHEAT_API_CLIENT_SECRET || "";
+        const usingBuiltInPublicClient = !configuredClientId || configuredClientId === settings_1.NUHEAT_API_CLIENT_ID;
         this.oauthClientId = configuredClientId || settings_1.NUHEAT_API_CLIENT_ID;
-        this.oauthClientSecret = configuredClientId
-            ? configuredClientSecret || settings_1.NUHEAT_API_CLIENT_SECRET
-            : "";
+        this.oauthClientSecret = usingBuiltInPublicClient
+            ? ""
+            : configuredClientSecret || settings_1.NUHEAT_API_CLIENT_SECRET;
         this.oauthRedirectUri =
             options.redirectUri ||
                 process.env.NUHEAT_API_REDIRECT_URI ||
                 settings_1.NUHEAT_API_REDIRECT_URI;
-        this.usingBuiltInClient = !configuredClientId;
+        this.usingBuiltInClient = usingBuiltInPublicClient;
         this.usePkce = !this.oauthClientSecret;
         this.pkceCodeVerifier = "";
         this.headers = new HeadersCtor();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "homebridge-nuheat2",
-  "version": "1.2.16",
+  "version": "1.2.17",
   "description": "Homebridge Platform for NuHeat Signature Thermostats",
   "main": "index.js",
   "scripts": {