n8n-nodes-jygse-vw-weconnect 0.1.2 → 0.1.4

package/dist/nodes/VwWeConnect/VwWeConnect.node.js

@@ -141,21 +141,43 @@ class VwWeConnect {
     }
 }
 exports.VwWeConnect = VwWeConnect;
-// VW OAuth2 Configuration
-const VW_CLIENT_ID = '9496332b-ea03-4091-a224-8c746b885068@apps_vw-dilab_com';
-const VW_SCOPE = 'openid profile mbb';
+// VW OAuth2 Configuration (Updated January 2026)
+const VW_CLIENT_ID = 'a24fba63-34b3-4d43-b181-942111e6bda8@apps_vw-dilab_com';
+const VW_SCOPE = 'openid profile badge cars dealers birthdate vin';
 const VW_REDIRECT_URI = 'weconnect://authenticated';
+const VW_RESPONSE_TYPE = 'code id_token token';
+// Generate PKCE code verifier and challenge
+function generateCodeVerifier() {
+    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+    let result = '';
+    for (let i = 0; i < 64; i++) {
+        result += chars.charAt(Math.floor(Math.random() * chars.length));
+    }
+    return result;
+}
+async function generateCodeChallenge(verifier) {
+    // Simple base64url encoding of SHA256 hash
+    // Since we can't use crypto directly, we'll use a simplified approach
+    // For now, use plain verifier (S256 would be better but requires crypto)
+    return verifier;
+}
 async function vwLogin(context, email, password) {
     try {
-        // Step 1: Get authorization page and extract form data
+        // Generate PKCE values
+        const codeVerifier = generateCodeVerifier();
+        const codeChallenge = await generateCodeChallenge(codeVerifier);
+        const stateParam = generateNonce();
+        // Step 1: Get authorization page - this now returns Auth0 login page
         const authorizeUrl = 'https://identity.vwgroup.io/oidc/v1/authorize';
         const authorizeParams = new URLSearchParams({
             client_id: VW_CLIENT_ID,
             scope: VW_SCOPE,
-            response_type: 'code',
+            response_type: VW_RESPONSE_TYPE,
             redirect_uri: VW_REDIRECT_URI,
             nonce: generateNonce(),
-            state: generateNonce(),
+            state: stateParam,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'plain',
         });
         const authorizeResponse = await context.helpers.httpRequest({
             method: 'GET',
@@ -168,15 +190,19 @@ async function vwLogin(context, email, password) {
             returnFullResponse: true,
             ignoreHttpStatusErrors: true,
         });
-        // Extract CSRF token and relay state from the response
-        // Handle both string response and object with body property
+        // Extract response body and check for redirect
         let htmlContent;
+        let currentUrl = '';
         if (typeof authorizeResponse === 'string') {
             htmlContent = authorizeResponse;
         }
         else if (authorizeResponse && typeof authorizeResponse === 'object') {
             const respObj = authorizeResponse;
-            // Try different possible response structures
+            const respHeaders = respObj.headers;
+            // Check for redirect in headers
+            if (respHeaders && respHeaders.location) {
+                currentUrl = respHeaders.location;
+            }
             if (respObj.body && typeof respObj.body === 'string') {
                 htmlContent = respObj.body;
             }
@@ -184,94 +210,172 @@ async function vwLogin(context, email, password) {
                 htmlContent = respObj.data;
             }
             else {
-                // Serialize the object to see its structure in the error
                 htmlContent = JSON.stringify(respObj);
             }
         }
         else {
             htmlContent = String(authorizeResponse);
         }
-        const csrfMatch = htmlContent.match(/name="_csrf"\s+value="([^"]+)"/);
-        const relayStateMatch = htmlContent.match(/name="relayState"\s+value="([^"]+)"/);
-        const hmacMatch = htmlContent.match(/name="hmac"\s+value="([^"]+)"/);
-        if (!csrfMatch) {
-            // Show first 500 chars of response for debugging
-            const preview = htmlContent.substring(0, 500);
-            throw new Error(`Could not extract CSRF token. Response preview: ${preview}`);
-        }
-        const csrf = csrfMatch[1];
-        const relayState = relayStateMatch ? relayStateMatch[1] : '';
-        const hmac = hmacMatch ? hmacMatch[1] : '';
-        // Step 2: Submit email
-        const identifierResponse = await context.helpers.httpRequest({
-            method: 'POST',
-            url: 'https://identity.vwgroup.io/signin-service/v1/signin/login/identifier',
-            headers: {
-                'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
-                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: new URLSearchParams({
-                _csrf: csrf,
-                relayState: relayState,
-                hmac: hmac,
-                email: email,
-            }).toString(),
-            encoding: 'text',
-            returnFullResponse: true,
-            ignoreHttpStatusErrors: true,
-        });
-        // Extract new CSRF for password submission
-        let identifierHtml;
-        if (typeof identifierResponse === 'string') {
-            identifierHtml = identifierResponse;
+        // Try to extract state token from Auth0 page (new flow)
+        // Look for state in URL or in hidden form field
+        let stateToken = '';
+        // Check if we were redirected to /u/login
+        const stateUrlMatch = currentUrl.match(/state=([^&]+)/);
+        if (stateUrlMatch) {
+            stateToken = decodeURIComponent(stateUrlMatch[1]);
         }
-        else if (identifierResponse && typeof identifierResponse === 'object') {
-            const respObj = identifierResponse;
-            identifierHtml = respObj.body || JSON.stringify(respObj);
+        // Also try to find state in the HTML
+        if (!stateToken) {
+            const stateHtmlMatch = htmlContent.match(/name="state"\s+value="([^"]+)"/);
+            if (stateHtmlMatch) {
+                stateToken = stateHtmlMatch[1];
+            }
         }
-        else {
-            identifierHtml = String(identifierResponse);
+        // Try to find state in form action URL
+        if (!stateToken) {
+            const formActionMatch = htmlContent.match(/action="[^"]*\?state=([^"&]+)/);
+            if (formActionMatch) {
+                stateToken = decodeURIComponent(formActionMatch[1]);
+            }
         }
-        const csrf2Match = identifierHtml.match(/name="_csrf"\s+value="([^"]+)"/);
-        const relayState2Match = identifierHtml.match(/name="relayState"\s+value="([^"]+)"/);
-        const hmac2Match = identifierHtml.match(/name="hmac"\s+value="([^"]+)"/);
-        const csrf2 = csrf2Match ? csrf2Match[1] : csrf;
-        const relayState2 = relayState2Match ? relayState2Match[1] : relayState;
-        const hmac2 = hmac2Match ? hmac2Match[1] : hmac;
-        // Step 3: Submit password
-        const authResponse = await context.helpers.httpRequest({
-            method: 'POST',
-            url: 'https://identity.vwgroup.io/signin-service/v1/signin/login/authenticate',
-            headers: {
-                'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
-                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: new URLSearchParams({
-                _csrf: csrf2,
-                relayState: relayState2,
-                hmac: hmac2,
-                email: email,
-                password: password,
-            }).toString(),
-            encoding: 'text',
-            returnFullResponse: true,
-            ignoreHttpStatusErrors: true,
-        });
-        // Get the redirect URL which contains the authorization code
+        // Try legacy CSRF-based flow first
+        const csrfMatch = htmlContent.match(/name="_csrf"\s+value="([^"]+)"/);
+        const relayStateMatch = htmlContent.match(/name="relayState"\s+value="([^"]+)"/);
+        const hmacMatch = htmlContent.match(/name="hmac"\s+value="([^"]+)"/);
         let redirectUrl = '';
         let authHtml = '';
-        if (typeof authResponse === 'string') {
-            authHtml = authResponse;
+        if (csrfMatch) {
+            // Legacy flow with CSRF token
+            const csrf = csrfMatch[1];
+            const relayState = relayStateMatch ? relayStateMatch[1] : '';
+            const hmac = hmacMatch ? hmacMatch[1] : '';
+            // Step 2: Submit email
+            const identifierResponse = await context.helpers.httpRequest({
+                method: 'POST',
+                url: 'https://identity.vwgroup.io/signin-service/v1/signin/login/identifier',
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
+                    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: new URLSearchParams({
+                    _csrf: csrf,
+                    relayState: relayState,
+                    hmac: hmac,
+                    email: email,
+                }).toString(),
+                encoding: 'text',
+                returnFullResponse: true,
+                ignoreHttpStatusErrors: true,
+            });
+            let identifierHtml;
+            if (typeof identifierResponse === 'string') {
+                identifierHtml = identifierResponse;
+            }
+            else if (identifierResponse && typeof identifierResponse === 'object') {
+                const respObj = identifierResponse;
+                identifierHtml = respObj.body || JSON.stringify(respObj);
+            }
+            else {
+                identifierHtml = String(identifierResponse);
+            }
+            const csrf2Match = identifierHtml.match(/name="_csrf"\s+value="([^"]+)"/);
+            const relayState2Match = identifierHtml.match(/name="relayState"\s+value="([^"]+)"/);
+            const hmac2Match = identifierHtml.match(/name="hmac"\s+value="([^"]+)"/);
+            const csrf2 = csrf2Match ? csrf2Match[1] : csrf;
+            const relayState2 = relayState2Match ? relayState2Match[1] : relayState;
+            const hmac2 = hmac2Match ? hmac2Match[1] : hmac;
+            // Step 3: Submit password
+            const authResponse = await context.helpers.httpRequest({
+                method: 'POST',
+                url: 'https://identity.vwgroup.io/signin-service/v1/signin/login/authenticate',
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
+                    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: new URLSearchParams({
+                    _csrf: csrf2,
+                    relayState: relayState2,
+                    hmac: hmac2,
+                    email: email,
+                    password: password,
+                }).toString(),
+                encoding: 'text',
+                returnFullResponse: true,
+                ignoreHttpStatusErrors: true,
+            });
+            if (typeof authResponse === 'string') {
+                authHtml = authResponse;
+            }
+            else if (authResponse && typeof authResponse === 'object') {
+                const respObj = authResponse;
+                const respHeaders = respObj.headers;
+                if (respHeaders && respHeaders.location) {
+                    redirectUrl = respHeaders.location;
+                }
+                authHtml = respObj.body || '';
+            }
         }
-        else if (authResponse && typeof authResponse === 'object') {
-            const respObj = authResponse;
-            const respHeaders = respObj.headers;
-            if (respHeaders && respHeaders.location) {
-                redirectUrl = respHeaders.location;
+        else if (stateToken || htmlContent.includes('auth0.com') || htmlContent.includes('/u/login')) {
+            // New Auth0-based flow
+            // Extract state from the login page URL if not already found
+            if (!stateToken) {
+                // Try to get state from the response URL or form
+                const loginFormMatch = htmlContent.match(/action="([^"]*\/u\/login[^"]*)"/);
+                if (loginFormMatch) {
+                    const formUrl = loginFormMatch[1];
+                    const formStateMatch = formUrl.match(/state=([^&"]+)/);
+                    if (formStateMatch) {
+                        stateToken = decodeURIComponent(formStateMatch[1]);
+                    }
+                }
+            }
+            if (!stateToken) {
+                // Last resort: extract from any state parameter in the HTML
+                const anyStateMatch = htmlContent.match(/state=([a-zA-Z0-9_-]+)/);
+                if (anyStateMatch) {
+                    stateToken = anyStateMatch[1];
+                }
+            }
+            if (!stateToken) {
+                throw new Error(`Could not extract state token from Auth0 login page. Response preview: ${htmlContent.substring(0, 500)}`);
+            }
+            // Submit credentials to Auth0 /u/login endpoint
+            const loginResponse = await context.helpers.httpRequest({
+                method: 'POST',
+                url: `https://identity.vwgroup.io/u/login?state=${encodeURIComponent(stateToken)}`,
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
+                    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'Origin': 'https://identity.vwgroup.io',
+                    'Referer': `https://identity.vwgroup.io/u/login?state=${encodeURIComponent(stateToken)}`,
+                },
+                body: new URLSearchParams({
+                    state: stateToken,
+                    username: email,
+                    password: password,
+                    action: 'default',
+                }).toString(),
+                encoding: 'text',
+                returnFullResponse: true,
+                ignoreHttpStatusErrors: true,
+            });
+            if (typeof loginResponse === 'string') {
+                authHtml = loginResponse;
             }
-            authHtml = respObj.body || '';
+            else if (loginResponse && typeof loginResponse === 'object') {
+                const respObj = loginResponse;
+                const respHeaders = respObj.headers;
+                if (respHeaders && respHeaders.location) {
+                    redirectUrl = respHeaders.location;
+                }
+                authHtml = respObj.body || '';
+            }
+        }
+        else {
+            throw new Error(`Unknown login page format. Response preview: ${htmlContent.substring(0, 500)}`);
         }
         if (!redirectUrl && authHtml) {
             // Check if we got a redirect in the response HTML
@@ -280,17 +384,35 @@ async function vwLogin(context, email, password) {
                 redirectUrl = redirectMatch[1];
             }
         }
-        // Follow redirects to get the auth code
+        // Follow redirects to get the auth code, id_token, and access_token
         let authCode = '';
+        let idToken = '';
+        let accessToken = '';
         let maxRedirects = 10;
         while (maxRedirects > 0 && redirectUrl && !authCode) {
+            // Extract tokens from URL fragment or query params
+            // The response_type 'code id_token token' returns all three
             if (redirectUrl.includes('code=')) {
-                const codeMatch = redirectUrl.match(/code=([^&]+)/);
+                const codeMatch = redirectUrl.match(/code=([^&#]+)/);
                 if (codeMatch) {
                     authCode = codeMatch[1];
-                    break;
                 }
             }
+            if (redirectUrl.includes('id_token=')) {
+                const idTokenMatch = redirectUrl.match(/id_token=([^&#]+)/);
+                if (idTokenMatch) {
+                    idToken = idTokenMatch[1];
+                }
+            }
+            if (redirectUrl.includes('access_token=')) {
+                const accessTokenMatch = redirectUrl.match(/access_token=([^&#]+)/);
+                if (accessTokenMatch) {
+                    accessToken = accessTokenMatch[1];
+                }
+            }
+            if (authCode) {
+                break;
+            }
             const followResponse = await context.helpers.httpRequest({
                 method: 'GET',
                 url: redirectUrl.startsWith('http') ? redirectUrl : `https://identity.vwgroup.io${redirectUrl}`,
@@ -320,21 +442,48 @@ async function vwLogin(context, email, password) {
             throw new Error('Could not obtain authorization code. Please check your credentials.');
         }
         // Step 4: Exchange auth code for tokens
-        const tokenResponse = await context.helpers.httpRequest({
-            method: 'POST',
-            url: 'https://tokenrefreshservice.apps.emea.vwapps.io/exchangeAuthCode',
-            headers: {
-                'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
-                'Accept': 'application/json',
-                'Content-Type': 'application/json',
-                'X-Client-Id': VW_CLIENT_ID,
-            },
-            body: {
-                auth_code: authCode,
-                id_token: '',
-                brand: 'vw',
-            },
-        });
+        // Try the new CARIAD login endpoint first
+        let tokenResponse;
+        try {
+            const cariadResponse = await context.helpers.httpRequest({
+                method: 'POST',
+                url: 'https://emea.bff.cariad.digital/user-login/login/v1',
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
+                    'Accept': 'application/json',
+                    'Content-Type': 'application/json',
+                },
+                body: {
+                    state: authorizeParams.get('state'),
+                    id_token: idToken,
+                    redirect_uri: VW_REDIRECT_URI,
+                    region: 'emea',
+                    access_token: accessToken,
+                    authorizationCode: authCode,
+                    code_verifier: codeVerifier,
+                },
+            });
+            tokenResponse = cariadResponse;
+        }
+        catch {
+            // Fallback to old token exchange endpoint
+            tokenResponse = await context.helpers.httpRequest({
+                method: 'POST',
+                url: 'https://tokenrefreshservice.apps.emea.vwapps.io/exchangeAuthCode',
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
+                    'Accept': 'application/json',
+                    'Content-Type': 'application/json',
+                    'X-Client-Id': VW_CLIENT_ID,
+                },
+                body: {
+                    auth_code: authCode,
+                    id_token: idToken || '',
+                    brand: 'vw',
+                    code_verifier: codeVerifier,
+                },
+            });
+        }
         return {
             accessToken: tokenResponse.access_token,
             refreshToken: tokenResponse.refresh_token,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-jygse-vw-weconnect",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "n8n community node for VW We Connect - Control your Volkswagen T6.1 and other VW vehicles",
   "keywords": [
     "n8n-community-node-package",