homebridge-nuheat2 1.2.8 → 1.2.10

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to this project should be documented in this file
 
 ## [Unreleased]
 
+## [1.2.10] - 2026-04-21
+
+### Added
+
+- Add non-sensitive OAuth debug logging for configured client ID, requested scopes, consent handling, and refresh-token rotation during local API credential validation
+
+### Changed
+
+- Request the full issued Nuheat OAuth scope set: `openapi openid profile offline_access`
+
+## [1.2.9] - 2026-04-15
+
+### Fixed
+
+- Remove the published `homebridge` peer dependency so verification installs no longer pull in `homebridge` and `hap-nodejs`
+
 ## [1.2.8] - 2026-04-15
 
 ### Fixed

package/lib/NuHeatAPI.js

@@ -8,6 +8,7 @@ const isRedirect = fetchModule.isRedirect;
 const { parse } = htmlParser;
 const settings_1 = require("./settings");
 const NuHeatModels_1 = require("./NuHeatModels");
+const OAUTH_SCOPES = ["openapi", "openid", "profile", "offline_access"];
 class NuHeatAPI {
     email;
     password;
@@ -56,6 +57,16 @@ class NuHeatAPI {
         if (this.usingFallbackCredentials) {
             this.log.warn("NuHeatAPI: Using built-in OAuth client credentials. Request your own Nuheat API client for long-term reliability.");
         }
+        else {
+            this.log.info("NuHeatAPI: Using configured OAuth client ID " + this.oauthClientId + ".");
+        }
+        this.log.debug("NuHeatAPI: OAuth redirect URI " +
+            this.oauthRedirectUri +
+            ". Requested scopes: " +
+            this.getRequestedScope());
+    }
+    getRequestedScope() {
+        return OAUTH_SCOPES.join(" ");
     }
     async setAwayMode(groupId, awayMode) {
         const callURL = "https://api.mynuheat.com/api/v1/Group";
@@ -236,7 +247,9 @@ class NuHeatAPI {
         authEndpoint.searchParams.set("response_type", "code");
         authEndpoint.searchParams.set("client_id", this.oauthClientId);
         authEndpoint.searchParams.set("redirect_uri", this.oauthRedirectUri);
-        authEndpoint.searchParams.set("scope", "openapi openid offline_access");
+        authEndpoint.searchParams.set("scope", this.getRequestedScope());
+        this.log.debug("NuHeatAPI: Requesting OAuth authorization page with scopes: " +
+            this.getRequestedScope());
         const response = await this.fetch(authEndpoint.toString(), {
             redirect: "follow",
         });
@@ -322,9 +335,11 @@ class NuHeatAPI {
                 RememberConsent: "true",
                 __RequestVerificationToken: requestVerificationToken,
             });
+            this.log.debug("NuHeatAPI: OAuth consent required. Confirming scopes: " +
+                this.getRequestedScope());
             const response = await this.fetch(settings_1.NUHEAT_API_CONSENT_URI, {
                 body: loginBody.toString() +
-                    "&ScopesConsented=openid&ScopesConsented=openapi&ScopesConsented=offline_access",
+                    OAUTH_SCOPES.map((scope) => "&ScopesConsented=" + scope).join(""),
                 headers: {
                     "Content-Type": "application/x-www-form-urlencoded",
                     Cookie: cookie + "; " + sessionCookie,
@@ -401,7 +416,12 @@ class NuHeatAPI {
                 return null;
             }
             this.tokenScope = redirectUrl.searchParams.get("scope") ?? "";
-            return (await response.json());
+            const token = (await response.json());
+            this.log.debug("NuHeatAPI: OAuth access token received. Granted scopes: " +
+                (token.scope || this.tokenScope || "unknown") +
+                ". Refresh token present: " +
+                String(!!token.refresh_token));
+            return token;
         }
         return null;
     }
@@ -431,12 +451,19 @@ class NuHeatAPI {
         this.refreshToken = token.refresh_token;
         this.tokenScope = token.scope ?? this.tokenScope;
         this.tokenType = token.token_type;
+        const refreshTokenRotated = token.refresh_token !== this.refreshToken;
         this.refreshInterval -= 420;
         if (this.refreshInterval < 300) {
             this.refreshInterval = 300;
         }
         this.headers.set("Authorization", token.token_type + " " + token.access_token);
-        this.log.debug("NuHeatAPI: Successfully refreshed the NuHeat API access token.");
+        this.log.debug("NuHeatAPI: Successfully refreshed the NuHeat API access token. Scope: " +
+            this.tokenScope +
+            ". Refresh token rotated: " +
+            String(refreshTokenRotated) +
+            ". Expires in: " +
+            token.expires_in +
+            " seconds.");
         return true;
     }
     async returnAccessToken() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "homebridge-nuheat2",
-  "version": "1.2.8",
+  "version": "1.2.10",
   "description": "Homebridge Platform for NuHeat Signature Thermostats",
   "main": "index.js",
   "scripts": {
@@ -42,9 +42,6 @@
     "ws": "^7.5.10",
     "tough-cookie": "^4.1.3"
   },
-  "peerDependencies": {
-    "homebridge": "^1.8.0 || ^2.0.0-beta.0"
-  },
   "engines": {
     "node": "^18.20.4 || ^20.18.0 || ^22.0.0 || ^24.0.0",
     "homebridge": "^1.8.0 || ^2.0.0-beta.0"