homebridge-nuheat2 1.2.9 → 1.2.11

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to this project should be documented in this file
 
 ## [Unreleased]
 
+## [1.2.11] - 2026-04-21
+
+### Fixed
+
+- Relax the optional `devices` and `groups` array item schema so Homebridge Config UI no longer shows validation errors for blank rows
+- Ignore blank `devices` rows at runtime so they do not interfere with thermostat auto-discovery
+
+## [1.2.10] - 2026-04-21
+
+### Added
+
+- Add non-sensitive OAuth debug logging for configured client ID, requested scopes, consent handling, and refresh-token rotation during local API credential validation
+
+### Changed
+
+- Request the full issued Nuheat OAuth scope set: `openapi openid profile offline_access`
+
 ## [1.2.9] - 2026-04-15
 
 ### Fixed

package/README.md

@@ -67,11 +67,11 @@ Most users should configure the plugin through Homebridge Config UI X, but the e
 - `email`: MyNuheat account email address
 - `Email`: Legacy alias still accepted for backward compatibility, but `email` is the preferred documented field
 - `password`: MyNuheat account password
-- `devices`: Optional list of thermostats to expose. If omitted or empty, every thermostat on the account will be discovered automatically
+- `devices`: Optional list of thermostats to expose. If omitted or empty, every thermostat on the account will be discovered automatically. Blank rows in the UI are ignored
 - `serialNumber`: Thermostat serial number from MyNuheat
 - `autoPopulateAwayModeSwitches`: Automatically expose away-mode switches for all groups on the account
 - `exposeScheduleSwitches`: Optionally expose a switch per thermostat that reflects whether the thermostat is following its schedule and can be turned on to resume the schedule
-- `groups`: Optional allow-list of groups to expose as away-mode switches. This only affects group/away-mode accessories
+- `groups`: Optional allow-list of groups to expose as away-mode switches. This only affects group/away-mode accessories. Blank rows in the UI are ignored
 - `groupName`: Group name as shown in MyNuheat
 - `holdLength`: Hold duration in minutes
 - `refresh`: Poll interval in seconds, default `60`
@@ -138,10 +138,12 @@ npm test
 GitHub Actions now handles two jobs for this repository:
 
 - `.github/workflows/ci.yml` runs `npm ci`, `npm run typecheck`, and `npm test` on pushes and pull requests across Node 20, 22, and 24
-- `.github/workflows/publish.yml` runs on pushes to `master` when `package.json` changes, re-runs the checks on Node 24, and publishes to npm only when the `package.json` version is not already on the registry
+- `.github/workflows/publish.yml` runs on pushes to `master` when `package.json` changes, re-runs the checks on Node 24, publishes to npm only when the `package.json` version is not already on the registry, and creates or updates the matching GitHub Release
 
 The publish workflow also maps prerelease versions to npm dist-tags automatically. For example, `1.2.7-beta.1` publishes with the `beta` tag, while stable versions publish to `latest`.
 
+Release notes are expected in `docs/release-notes/<version>.md`. The publish workflow will fail if that file is missing for the version in `package.json`, which makes the GitHub Release step part of the normal release checklist instead of a manual follow-up.
+
 ### Recommended npm Setup
 
 Use npm trusted publishing rather than a long-lived automation token.

package/config.schema.json

@@ -43,11 +43,9 @@
       "devices": {
         "title": "Devices",
         "type": "array",
+        "description": "Optional allow-list of thermostats to expose. Leave empty to auto-discover all thermostats on the account.",
         "items": {
           "type": "object",
-          "required": [
-            "serialNumber"
-          ],
           "properties": {
             "serialNumber": {
               "title": "Serial Number",
@@ -72,11 +70,9 @@
       "groups": {
         "title": "Groups",
         "type": "array",
+        "description": "Optional allow-list of groups to expose as away-mode switches. Leave empty unless you want to add specific groups manually.",
         "items": {
           "type": "object",
-          "required": [
-            "groupName"
-          ],
           "properties": {
             "groupName": {
               "title": "Group Name",

package/index.js

@@ -74,6 +74,11 @@ class NuHeatPlatform {
             typeof group.groupName === "string" &&
             group.groupName.trim().length > 0);
     }
+    getConfiguredDevices() {
+        return (this.config.devices || []).filter((device) => !!device &&
+            typeof device.serialNumber === "string" &&
+            device.serialNumber.trim().length > 0);
+    }
     shouldManageGroups() {
         return (!!this.config.autoPopulateAwayModeSwitches ||
             this.getConfiguredGroups().length > 0);
@@ -154,7 +159,7 @@ class NuHeatPlatform {
         }));
     }
     async setupThermostats() {
-        const deviceArray = this.config.devices || [];
+        const deviceArray = this.getConfiguredDevices();
         const response = await this.NuHeatAPI.refreshThermostats();
         if (!response || !Array.isArray(response)) {
             this.log.error("Error getting data from NuHeatAPI");

package/lib/NuHeatAPI.js

@@ -8,6 +8,7 @@ const isRedirect = fetchModule.isRedirect;
 const { parse } = htmlParser;
 const settings_1 = require("./settings");
 const NuHeatModels_1 = require("./NuHeatModels");
+const OAUTH_SCOPES = ["openapi", "openid", "profile", "offline_access"];
 class NuHeatAPI {
     email;
     password;
@@ -56,6 +57,16 @@ class NuHeatAPI {
         if (this.usingFallbackCredentials) {
             this.log.warn("NuHeatAPI: Using built-in OAuth client credentials. Request your own Nuheat API client for long-term reliability.");
         }
+        else {
+            this.log.info("NuHeatAPI: Using configured OAuth client ID " + this.oauthClientId + ".");
+        }
+        this.log.debug("NuHeatAPI: OAuth redirect URI " +
+            this.oauthRedirectUri +
+            ". Requested scopes: " +
+            this.getRequestedScope());
+    }
+    getRequestedScope() {
+        return OAUTH_SCOPES.join(" ");
     }
     async setAwayMode(groupId, awayMode) {
         const callURL = "https://api.mynuheat.com/api/v1/Group";
@@ -236,7 +247,9 @@ class NuHeatAPI {
         authEndpoint.searchParams.set("response_type", "code");
         authEndpoint.searchParams.set("client_id", this.oauthClientId);
         authEndpoint.searchParams.set("redirect_uri", this.oauthRedirectUri);
-        authEndpoint.searchParams.set("scope", "openapi openid offline_access");
+        authEndpoint.searchParams.set("scope", this.getRequestedScope());
+        this.log.debug("NuHeatAPI: Requesting OAuth authorization page with scopes: " +
+            this.getRequestedScope());
         const response = await this.fetch(authEndpoint.toString(), {
             redirect: "follow",
         });
@@ -322,9 +335,11 @@ class NuHeatAPI {
                 RememberConsent: "true",
                 __RequestVerificationToken: requestVerificationToken,
             });
+            this.log.debug("NuHeatAPI: OAuth consent required. Confirming scopes: " +
+                this.getRequestedScope());
             const response = await this.fetch(settings_1.NUHEAT_API_CONSENT_URI, {
                 body: loginBody.toString() +
-                    "&ScopesConsented=openid&ScopesConsented=openapi&ScopesConsented=offline_access",
+                    OAUTH_SCOPES.map((scope) => "&ScopesConsented=" + scope).join(""),
                 headers: {
                     "Content-Type": "application/x-www-form-urlencoded",
                     Cookie: cookie + "; " + sessionCookie,
@@ -401,7 +416,12 @@ class NuHeatAPI {
                 return null;
             }
             this.tokenScope = redirectUrl.searchParams.get("scope") ?? "";
-            return (await response.json());
+            const token = (await response.json());
+            this.log.debug("NuHeatAPI: OAuth access token received. Granted scopes: " +
+                (token.scope || this.tokenScope || "unknown") +
+                ". Refresh token present: " +
+                String(!!token.refresh_token));
+            return token;
         }
         return null;
     }
@@ -431,12 +451,19 @@ class NuHeatAPI {
         this.refreshToken = token.refresh_token;
         this.tokenScope = token.scope ?? this.tokenScope;
         this.tokenType = token.token_type;
+        const refreshTokenRotated = token.refresh_token !== this.refreshToken;
         this.refreshInterval -= 420;
         if (this.refreshInterval < 300) {
             this.refreshInterval = 300;
         }
         this.headers.set("Authorization", token.token_type + " " + token.access_token);
-        this.log.debug("NuHeatAPI: Successfully refreshed the NuHeat API access token.");
+        this.log.debug("NuHeatAPI: Successfully refreshed the NuHeat API access token. Scope: " +
+            this.tokenScope +
+            ". Refresh token rotated: " +
+            String(refreshTokenRotated) +
+            ". Expires in: " +
+            token.expires_in +
+            " seconds.");
         return true;
     }
     async returnAccessToken() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "homebridge-nuheat2",
-  "version": "1.2.9",
+  "version": "1.2.11",
   "description": "Homebridge Platform for NuHeat Signature Thermostats",
   "main": "index.js",
   "scripts": {