iobroker.goodwe-sems 0.1.17 → 0.1.18

package/README.de.md

@@ -151,6 +151,11 @@ Pull Requests willkommen, insbesondere um zusätzliche, vom Portal gelieferte Fe
 -->
 ### **WORK IN PROGRESS**
 
+### 0.1.18 (2026-07-19)
+
+- (Stefan Bühler) Fix: Der SEMS+-Login wurde trotz des Host-Fixes in 0.1.17 weiterhin mit `code=C0602 "account_login_abnormal"` abgelehnt, weil sich der Adapter als iOS-App ausgab (`User-Agent: PVMaster/...`, Token-`client: "ios"`) - der aufgerufene Endpunkt (`eu-semsplus.goodwe.com`) wird laut echtem Browser-Mitschnitt aber ausschließlich vom SEMS+-*Web*-Client genutzt, der `client: "semsPlusWeb"`, einen Browser-User-Agent sowie `Origin`/`Referer`-Header sendet. Der Login-Call baut jetzt eine eigene, passende Header-Identität nur für diesen einen Aufruf; alle anderen (klassischen/Legacy-)Endpunkte nutzen unverändert weiterhin die etablierte iOS-Identität
+- (Stefan Bühler) 1 verschärfter Regressionstest, der die Client-Identität und Header des Login-Calls prüft
+
 ### 0.1.17 (2026-07-19)
 
 - (Stefan Bühler) Fix: Der SEMS+-Login schlug für manche Konten fehl (`code=C0602 "account_login_abnormal"`), weil der Adapter den globalen Endpunkt (`semsplus.goodwe.com`) statt des EU-regionalen (`eu-semsplus.goodwe.com`) aufrief. Bestätigt durch einen echten Browser-HAR-Mitschnitt: derselbe Request-Body und Passwort-Hash war gegen den regionalen Host erfolgreich. Bewusst **ohne** Host-Fallback-Schleife umgesetzt - mehrere Login-Versuche mit denselben Zugangsdaten gegen verschiedene Hosts sehen für das Backend wie Credential-Stuffing aus und riskieren eine echte Kontosperre

package/README.md

@@ -151,6 +151,11 @@ Pull requests are welcome, especially to add further fields delivered by the por
 -->
 ### **WORK IN PROGRESS**
 
+### 0.1.18 (2026-07-19)
+
+- (Stefan Bühler) fix: SEMS+ login still got rejected with `code=C0602 "account_login_abnormal"` even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (`User-Agent: PVMaster/...`, token `client: "ios"`) - but the called endpoint (`eu-semsplus.goodwe.com`) is, per the real browser capture, only ever used by the SEMS+ *web* client, sending `client: "semsPlusWeb"`, a browser User-Agent, and `Origin`/`Referer` headers. The login call now builds its own matching header identity for just that one request; every other (classic/legacy) endpoint keeps using the established iOS identity, unchanged
+- (Stefan Bühler) 1 tightened regression test verifying the login call's client identity and headers
+
 ### 0.1.17 (2026-07-19)
 
 - (Stefan Bühler) fix: SEMS+ login failed for some accounts (`code=C0602 "account_login_abnormal"`) because the adapter called the global endpoint (`semsplus.goodwe.com`) instead of the EU-regional one (`eu-semsplus.goodwe.com`). Confirmed via a real browser HAR capture: the identical request body and password hash succeeded against the regional host. Deliberately implemented **without** a host-fallback loop - repeatedly retrying the same credentials against multiple hosts looks like credential stuffing to the backend and risks a real account lockout

package/io-package.json

@@ -1,8 +1,21 @@
 {
     "common": {
         "name": "goodwe-sems",
-        "version": "0.1.17",
+        "version": "0.1.18",
         "news": {
+            "0.1.18": {
+                "de": "Fix: SEMS+-Login blieb trotz korrektem Host (0.1.17) weiter mit code=C0602 abgelehnt, weil der Adapter sich als iOS-App ausgab (User-Agent 'PVMaster', Token-Client 'ios') - obwohl der aufgerufene Endpunkt (eu-semsplus.goodwe.com) laut Browser-Mitschnitt nur vom SEMS+-Web-Client mit client:'semsPlusWeb', Browser-User-Agent sowie Origin/Referer-Headern genutzt wird. Der Login-Call sendet jetzt eine eigene, passende Header-Identität nur für diesen einen Aufruf; alle anderen Endpunkte bleiben unverändert bei der iOS-Identität.",
+                "en": "Fix: SEMS+ login still got rejected with code=C0602 even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (User-Agent 'PVMaster', token client 'ios') - even though the called endpoint (eu-semsplus.goodwe.com) is, per the real browser capture, only ever used by the SEMS+ web client with client:'semsPlusWeb', a browser User-Agent, and Origin/Referer headers. The login call now sends its own, matching header identity for just that one request; every other endpoint keeps using the iOS identity as before.",
+                "ru": "Fix: SEMS+ login still got rejected with code=C0602 even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (User-Agent 'PVMaster', token client 'ios') - even though the called endpoint (eu-semsplus.goodwe.com) is, per the real browser capture, only ever used by the SEMS+ web client with client:'semsPlusWeb', a browser User-Agent, and Origin/Referer headers. The login call now sends its own, matching header identity for just that one request; every other endpoint keeps using the iOS identity as before.",
+                "pt": "Fix: SEMS+ login still got rejected with code=C0602 even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (User-Agent 'PVMaster', token client 'ios') - even though the called endpoint (eu-semsplus.goodwe.com) is, per the real browser capture, only ever used by the SEMS+ web client with client:'semsPlusWeb', a browser User-Agent, and Origin/Referer headers. The login call now sends its own, matching header identity for just that one request; every other endpoint keeps using the iOS identity as before.",
+                "nl": "Fix: SEMS+ login still got rejected with code=C0602 even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (User-Agent 'PVMaster', token client 'ios') - even though the called endpoint (eu-semsplus.goodwe.com) is, per the real browser capture, only ever used by the SEMS+ web client with client:'semsPlusWeb', a browser User-Agent, and Origin/Referer headers. The login call now sends its own, matching header identity for just that one request; every other endpoint keeps using the iOS identity as before.",
+                "fr": "Fix: SEMS+ login still got rejected with code=C0602 even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (User-Agent 'PVMaster', token client 'ios') - even though the called endpoint (eu-semsplus.goodwe.com) is, per the real browser capture, only ever used by the SEMS+ web client with client:'semsPlusWeb', a browser User-Agent, and Origin/Referer headers. The login call now sends its own, matching header identity for just that one request; every other endpoint keeps using the iOS identity as before.",
+                "it": "Fix: SEMS+ login still got rejected with code=C0602 even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (User-Agent 'PVMaster', token client 'ios') - even though the called endpoint (eu-semsplus.goodwe.com) is, per the real browser capture, only ever used by the SEMS+ web client with client:'semsPlusWeb', a browser User-Agent, and Origin/Referer headers. The login call now sends its own, matching header identity for just that one request; every other endpoint keeps using the iOS identity as before.",
+                "es": "Fix: SEMS+ login still got rejected with code=C0602 even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (User-Agent 'PVMaster', token client 'ios') - even though the called endpoint (eu-semsplus.goodwe.com) is, per the real browser capture, only ever used by the SEMS+ web client with client:'semsPlusWeb', a browser User-Agent, and Origin/Referer headers. The login call now sends its own, matching header identity for just that one request; every other endpoint keeps using the iOS identity as before.",
+                "pl": "Fix: SEMS+ login still got rejected with code=C0602 even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (User-Agent 'PVMaster', token client 'ios') - even though the called endpoint (eu-semsplus.goodwe.com) is, per the real browser capture, only ever used by the SEMS+ web client with client:'semsPlusWeb', a browser User-Agent, and Origin/Referer headers. The login call now sends its own, matching header identity for just that one request; every other endpoint keeps using the iOS identity as before.",
+                "zh-cn": "Fix: SEMS+ login still got rejected with code=C0602 even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (User-Agent 'PVMaster', token client 'ios') - even though the called endpoint (eu-semsplus.goodwe.com) is, per the real browser capture, only ever used by the SEMS+ web client with client:'semsPlusWeb', a browser User-Agent, and Origin/Referer headers. The login call now sends its own, matching header identity for just that one request; every other endpoint keeps using the iOS identity as before.",
+                "uk": "Fix: SEMS+ login still got rejected with code=C0602 even after the host fix in 0.1.17, because the adapter identified itself as the iOS app (User-Agent 'PVMaster', token client 'ios') - even though the called endpoint (eu-semsplus.goodwe.com) is, per the real browser capture, only ever used by the SEMS+ web client with client:'semsPlusWeb', a browser User-Agent, and Origin/Referer headers. The login call now sends its own, matching header identity for just that one request; every other endpoint keeps using the iOS identity as before."
+            },
             "0.1.17": {
                 "de": "Fix: Der SEMS+-Login schlug für manche Konten fehl (code=C0602 'account_login_abnormal'), weil der Adapter den globalen Endpunkt (semsplus.goodwe.com) statt des EU-regionalen (eu-semsplus.goodwe.com) nutzte - bestätigt durch einen echten Browser-Mitschnitt mit identischem Request/Passwort-Hash, der gegen den regionalen Host erfolgreich war. Bewusst OHNE Host-Fallback-Schleife umgesetzt: mehrere Login-Versuche mit denselben Zugangsdaten gegen verschiedene Hosts sehen wie Credential-Stuffing aus und könnten zu einer Kontosperre führen.",
                 "en": "Fix: SEMS+ login failed for some accounts (code=C0602 'account_login_abnormal') because the adapter used the global endpoint (semsplus.goodwe.com) instead of the EU-regional one (eu-semsplus.goodwe.com) - confirmed via a real browser capture with the identical request/password hash succeeding against the regional host. Deliberately implemented WITHOUT a host-fallback loop: retrying the same credentials against multiple hosts looks like credential stuffing and risks a real account lockout.",
@@ -80,19 +93,6 @@
                 "pl": "kolejne poprawki: usunieto wpis news dla 0.1.10 (nigdy nie opublikowano na npm), dodano needs: check-and-lint do zadania adapter-tests, @types/node ustalono na ^22, poprawiono schematy w .vscode/settings.json, dodano automerge dependabot",
                 "uk": "подальші виправлення: видалено запис news для 0.1.10 (ніколи не публікувався на npm), додано needs: check-and-lint для adapter-tests, @types/node зафіксовано на ^22, виправлено схеми в .vscode/settings.json, додано automerge для dependabot",
                 "zh-cn": "进一步修复:移除 0.1.10 的 news 条目(从未发布到 npm),为 adapter-tests 任务添加 needs: check-and-lint,将 @types/node 固定为 ^22,修复 .vscode/settings.json 中的 schema 匹配,添加 dependabot 自动合并"
-            },
-            "0.1.11": {
-                "en": "fix broken CI: remove Node.js 20.x from the adapter-tests matrix - it is incompatible with engines.node >=22 (introduced in 0.1.10) under the official action's engine-strict npm ci, which crashed that matrix job and cancelled all others",
-                "de": "defekte CI behoben: Node.js 20.x aus der adapter-tests-Matrix entfernt - inkompatibel mit engines.node >=22 (seit 0.1.10) unter dem engine-strict npm ci der offiziellen Action, wodurch dieser Matrix-Job abstürzte und alle anderen abgebrochen wurden",
-                "ru": "исправлен неработающий CI: Node.js 20.x удалён из матрицы adapter-tests - несовместим с engines.node >=22 (введено в 0.1.10)",
-                "pt": "corrigido o CI quebrado: Node.js 20.x removido da matriz adapter-tests - incompatível com engines.node >=22 (introduzido em 0.1.10)",
-                "nl": "defecte CI opgelost: Node.js 20.x verwijderd uit de adapter-tests-matrix - incompatibel met engines.node >=22 (geïntroduceerd in 0.1.10)",
-                "fr": "correction du CI cassé : Node.js 20.x retiré de la matrice adapter-tests - incompatible avec engines.node >=22 (introduit en 0.1.10)",
-                "it": "risolto il CI non funzionante: rimosso Node.js 20.x dalla matrice adapter-tests - incompatibile con engines.node >=22 (introdotto in 0.1.10)",
-                "es": "se corrigió el CI roto: se eliminó Node.js 20.x de la matriz adapter-tests - incompatible con engines.node >=22 (introducido en 0.1.10)",
-                "pl": "naprawiono uszkodzone CI: usunięto Node.js 20.x z macierzy adapter-tests - niekompatybilne z engines.node >=22 (wprowadzone w 0.1.10)",
-                "uk": "виправлено зламаний CI: видалено Node.js 20.x з матриці adapter-tests - несумісний з engines.node >=22 (введено в 0.1.10)",
-                "zh-cn": "修复损坏的 CI:从 adapter-tests 矩阵中移除 Node.js 20.x - 与 engines.node >=22(0.1.10 中引入)不兼容"
             }
         },
         "titleLang": {

package/lib/semsApi.js

@@ -98,6 +98,16 @@ const DEFAULT_CLIENT_TOKEN = JSON.stringify({
     language: "en",
 });
 
+// The SEMS+ login endpoint is web-only (eu-semsplus.goodwe.com) and, unlike
+// the classic/legacy endpoints, is only ever called by the SEMS+ *web* app -
+// there is no mobile-app equivalent. Sending it the iOS identity above
+// (wrong client, non-browser User-Agent, no Origin/Referer) is a plausible
+// explanation for the persistent "C0602 account_login_abnormal" rejections:
+// confirmed real browser traffic for this exact endpoint always used a
+// browser User-Agent and client:"semsPlusWeb".
+const SEMS_PLUS_WEB_USER_AGENT =
+    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36";
+
 /**
  * Thin wrapper around fetch() with a hard timeout and JSON handling.
  *
@@ -270,11 +280,27 @@ class SemsApi {
             isChinese: false,
             isLocal: false,
         });
-        // The real web app sends an x-signature header even on the login
-        // call itself (with empty uid/token, since no session exists yet).
-        // Harmless to include and matches observed real traffic exactly.
+        // Dedicated headers matching the real semsPlusWeb browser client
+        // exactly (see SEMS_PLUS_WEB_USER_AGENT comment above) - NOT the
+        // iOS-app identity _defaultHeaders()/_authHeaders() use for the
+        // classic/legacy endpoints. Includes an x-signature header even on
+        // the login call itself (with empty uid/token, since no session
+        // exists yet), matching observed real traffic exactly.
+        const tokenPayload = {
+            uid: "",
+            timestamp: 0,
+            token: "",
+            client: GATEWAY_CLIENT,
+            version: "",
+            language: "en",
+        };
         const headers = {
-            ...this._defaultHeaders(),
+            "Content-Type": "application/json",
+            Accept: "application/json, text/plain, */*",
+            "User-Agent": SEMS_PLUS_WEB_USER_AGENT,
+            Origin: "https://eu-semsplus.goodwe.com",
+            Referer: "https://eu-semsplus.goodwe.com/",
+            token: JSON.stringify(tokenPayload),
             "x-signature": this._gatewaySignature("", ""),
         };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iobroker.goodwe-sems",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "ioBroker adapter to read GoodWe inverter data from the SEMS Portal cloud API (for installations without local/LAN access to the inverter).",
   "author": {
     "name": "bueste",