n8n-nodes-jygse-vw-weconnect 0.1.3 → 0.1.5

package/dist/nodes/VwWeConnect/VwWeConnect.node.js

@@ -166,7 +166,8 @@ async function vwLogin(context, email, password) {
         // Generate PKCE values
         const codeVerifier = generateCodeVerifier();
         const codeChallenge = await generateCodeChallenge(codeVerifier);
-        // Step 1: Get authorization page and extract form data
+        const stateParam = generateNonce();
+        // Step 1: Get authorization page - this now returns Auth0 login page
         const authorizeUrl = 'https://identity.vwgroup.io/oidc/v1/authorize';
         const authorizeParams = new URLSearchParams({
             client_id: VW_CLIENT_ID,
@@ -174,7 +175,7 @@ async function vwLogin(context, email, password) {
             response_type: VW_RESPONSE_TYPE,
             redirect_uri: VW_REDIRECT_URI,
             nonce: generateNonce(),
-            state: generateNonce(),
+            state: stateParam,
             code_challenge: codeChallenge,
             code_challenge_method: 'plain',
         });
@@ -188,16 +189,25 @@ async function vwLogin(context, email, password) {
             encoding: 'text',
             returnFullResponse: true,
             ignoreHttpStatusErrors: true,
+            skipAutoFollowRedirects: true,
         });
-        // Extract CSRF token and relay state from the response
-        // Handle both string response and object with body property
+        // Extract response body and check for redirect
         let htmlContent;
+        let currentUrl = '';
+        let stateToken = '';
         if (typeof authorizeResponse === 'string') {
             htmlContent = authorizeResponse;
         }
         else if (authorizeResponse && typeof authorizeResponse === 'object') {
             const respObj = authorizeResponse;
-            // Try different possible response structures
+            const respHeaders = respObj.headers;
+            // Check for redirect in headers (case-insensitive)
+            if (respHeaders) {
+                const locationHeader = respHeaders.location || respHeaders.Location;
+                if (locationHeader) {
+                    currentUrl = locationHeader;
+                }
+            }
             if (respObj.body && typeof respObj.body === 'string') {
                 htmlContent = respObj.body;
             }
@@ -205,94 +215,220 @@ async function vwLogin(context, email, password) {
                 htmlContent = respObj.data;
             }
             else {
-                // Serialize the object to see its structure in the error
                 htmlContent = JSON.stringify(respObj);
             }
         }
         else {
             htmlContent = String(authorizeResponse);
         }
-        const csrfMatch = htmlContent.match(/name="_csrf"\s+value="([^"]+)"/);
-        const relayStateMatch = htmlContent.match(/name="relayState"\s+value="([^"]+)"/);
-        const hmacMatch = htmlContent.match(/name="hmac"\s+value="([^"]+)"/);
-        if (!csrfMatch) {
-            // Show first 500 chars of response for debugging
-            const preview = htmlContent.substring(0, 500);
-            throw new Error(`Could not extract CSRF token. Response preview: ${preview}`);
+        // Follow redirects manually to capture the state parameter
+        let maxInitialRedirects = 5;
+        while (currentUrl && maxInitialRedirects > 0) {
+            // Extract state from redirect URL
+            const stateMatch = currentUrl.match(/state=([^&]+)/);
+            if (stateMatch) {
+                stateToken = decodeURIComponent(stateMatch[1]);
+            }
+            // If we reached the /u/login page, we have what we need
+            if (currentUrl.includes('/u/login') && stateToken) {
+                break;
+            }
+            // Follow the redirect
+            const followUrl = currentUrl.startsWith('http') ? currentUrl : `https://identity.vwgroup.io${currentUrl}`;
+            const followResponse = await context.helpers.httpRequest({
+                method: 'GET',
+                url: followUrl,
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
+                    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                },
+                encoding: 'text',
+                returnFullResponse: true,
+                ignoreHttpStatusErrors: true,
+                skipAutoFollowRedirects: true,
+            });
+            if (typeof followResponse === 'string') {
+                htmlContent = followResponse;
+                currentUrl = '';
+            }
+            else if (followResponse && typeof followResponse === 'object') {
+                const respObj = followResponse;
+                const respHeaders = respObj.headers;
+                currentUrl = '';
+                if (respHeaders) {
+                    const locationHeader = respHeaders.location || respHeaders.Location;
+                    if (locationHeader) {
+                        currentUrl = locationHeader;
+                    }
+                }
+                if (respObj.body && typeof respObj.body === 'string') {
+                    htmlContent = respObj.body;
+                }
+                else if (respObj.data && typeof respObj.data === 'string') {
+                    htmlContent = respObj.data;
+                }
+            }
+            maxInitialRedirects--;
         }
-        const csrf = csrfMatch[1];
-        const relayState = relayStateMatch ? relayStateMatch[1] : '';
-        const hmac = hmacMatch ? hmacMatch[1] : '';
-        // Step 2: Submit email
-        const identifierResponse = await context.helpers.httpRequest({
-            method: 'POST',
-            url: 'https://identity.vwgroup.io/signin-service/v1/signin/login/identifier',
-            headers: {
-                'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
-                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: new URLSearchParams({
-                _csrf: csrf,
-                relayState: relayState,
-                hmac: hmac,
-                email: email,
-            }).toString(),
-            encoding: 'text',
-            returnFullResponse: true,
-            ignoreHttpStatusErrors: true,
-        });
-        // Extract new CSRF for password submission
-        let identifierHtml;
-        if (typeof identifierResponse === 'string') {
-            identifierHtml = identifierResponse;
+        // Try to extract state token from the final HTML if not found in URL
+        if (!stateToken) {
+            const stateHtmlMatch = htmlContent.match(/name="state"\s+value="([^"]+)"/);
+            if (stateHtmlMatch) {
+                stateToken = stateHtmlMatch[1];
+            }
         }
-        else if (identifierResponse && typeof identifierResponse === 'object') {
-            const respObj = identifierResponse;
-            identifierHtml = respObj.body || JSON.stringify(respObj);
+        // Try to find state in form action URL
+        if (!stateToken) {
+            const formActionMatch = htmlContent.match(/action="[^"]*\?state=([^"&]+)/);
+            if (formActionMatch) {
+                stateToken = decodeURIComponent(formActionMatch[1]);
+            }
         }
-        else {
-            identifierHtml = String(identifierResponse);
+        // Try to extract state from any URL in the page
+        if (!stateToken) {
+            const anyStateMatch = htmlContent.match(/state=([a-zA-Z0-9_.-]+)/);
+            if (anyStateMatch) {
+                stateToken = anyStateMatch[1];
+            }
         }
-        const csrf2Match = identifierHtml.match(/name="_csrf"\s+value="([^"]+)"/);
-        const relayState2Match = identifierHtml.match(/name="relayState"\s+value="([^"]+)"/);
-        const hmac2Match = identifierHtml.match(/name="hmac"\s+value="([^"]+)"/);
-        const csrf2 = csrf2Match ? csrf2Match[1] : csrf;
-        const relayState2 = relayState2Match ? relayState2Match[1] : relayState;
-        const hmac2 = hmac2Match ? hmac2Match[1] : hmac;
-        // Step 3: Submit password
-        const authResponse = await context.helpers.httpRequest({
-            method: 'POST',
-            url: 'https://identity.vwgroup.io/signin-service/v1/signin/login/authenticate',
-            headers: {
-                'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
-                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: new URLSearchParams({
-                _csrf: csrf2,
-                relayState: relayState2,
-                hmac: hmac2,
-                email: email,
-                password: password,
-            }).toString(),
-            encoding: 'text',
-            returnFullResponse: true,
-            ignoreHttpStatusErrors: true,
-        });
-        // Get the redirect URL which contains the authorization code
+        // Try legacy CSRF-based flow first
+        const csrfMatch = htmlContent.match(/name="_csrf"\s+value="([^"]+)"/);
+        const relayStateMatch = htmlContent.match(/name="relayState"\s+value="([^"]+)"/);
+        const hmacMatch = htmlContent.match(/name="hmac"\s+value="([^"]+)"/);
         let redirectUrl = '';
         let authHtml = '';
-        if (typeof authResponse === 'string') {
-            authHtml = authResponse;
+        if (csrfMatch) {
+            // Legacy flow with CSRF token
+            const csrf = csrfMatch[1];
+            const relayState = relayStateMatch ? relayStateMatch[1] : '';
+            const hmac = hmacMatch ? hmacMatch[1] : '';
+            // Step 2: Submit email
+            const identifierResponse = await context.helpers.httpRequest({
+                method: 'POST',
+                url: 'https://identity.vwgroup.io/signin-service/v1/signin/login/identifier',
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
+                    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: new URLSearchParams({
+                    _csrf: csrf,
+                    relayState: relayState,
+                    hmac: hmac,
+                    email: email,
+                }).toString(),
+                encoding: 'text',
+                returnFullResponse: true,
+                ignoreHttpStatusErrors: true,
+            });
+            let identifierHtml;
+            if (typeof identifierResponse === 'string') {
+                identifierHtml = identifierResponse;
+            }
+            else if (identifierResponse && typeof identifierResponse === 'object') {
+                const respObj = identifierResponse;
+                identifierHtml = respObj.body || JSON.stringify(respObj);
+            }
+            else {
+                identifierHtml = String(identifierResponse);
+            }
+            const csrf2Match = identifierHtml.match(/name="_csrf"\s+value="([^"]+)"/);
+            const relayState2Match = identifierHtml.match(/name="relayState"\s+value="([^"]+)"/);
+            const hmac2Match = identifierHtml.match(/name="hmac"\s+value="([^"]+)"/);
+            const csrf2 = csrf2Match ? csrf2Match[1] : csrf;
+            const relayState2 = relayState2Match ? relayState2Match[1] : relayState;
+            const hmac2 = hmac2Match ? hmac2Match[1] : hmac;
+            // Step 3: Submit password
+            const authResponse = await context.helpers.httpRequest({
+                method: 'POST',
+                url: 'https://identity.vwgroup.io/signin-service/v1/signin/login/authenticate',
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
+                    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: new URLSearchParams({
+                    _csrf: csrf2,
+                    relayState: relayState2,
+                    hmac: hmac2,
+                    email: email,
+                    password: password,
+                }).toString(),
+                encoding: 'text',
+                returnFullResponse: true,
+                ignoreHttpStatusErrors: true,
+            });
+            if (typeof authResponse === 'string') {
+                authHtml = authResponse;
+            }
+            else if (authResponse && typeof authResponse === 'object') {
+                const respObj = authResponse;
+                const respHeaders = respObj.headers;
+                if (respHeaders && respHeaders.location) {
+                    redirectUrl = respHeaders.location;
+                }
+                authHtml = respObj.body || '';
+            }
         }
-        else if (authResponse && typeof authResponse === 'object') {
-            const respObj = authResponse;
-            const respHeaders = respObj.headers;
-            if (respHeaders && respHeaders.location) {
-                redirectUrl = respHeaders.location;
+        else if (stateToken || htmlContent.includes('auth0.com') || htmlContent.includes('/u/login')) {
+            // New Auth0-based flow
+            // Extract state from the login page URL if not already found
+            if (!stateToken) {
+                // Try to get state from the response URL or form
+                const loginFormMatch = htmlContent.match(/action="([^"]*\/u\/login[^"]*)"/);
+                if (loginFormMatch) {
+                    const formUrl = loginFormMatch[1];
+                    const formStateMatch = formUrl.match(/state=([^&"]+)/);
+                    if (formStateMatch) {
+                        stateToken = decodeURIComponent(formStateMatch[1]);
+                    }
+                }
+            }
+            if (!stateToken) {
+                // Last resort: extract from any state parameter in the HTML
+                const anyStateMatch = htmlContent.match(/state=([a-zA-Z0-9_-]+)/);
+                if (anyStateMatch) {
+                    stateToken = anyStateMatch[1];
+                }
+            }
+            if (!stateToken) {
+                throw new Error(`Could not extract state token from Auth0 login page. Response preview: ${htmlContent.substring(0, 500)}`);
+            }
+            // Submit credentials to Auth0 /u/login endpoint
+            const loginResponse = await context.helpers.httpRequest({
+                method: 'POST',
+                url: `https://identity.vwgroup.io/u/login?state=${encodeURIComponent(stateToken)}`,
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Linux; Android 12; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.120 Mobile Safari/537.36',
+                    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'Origin': 'https://identity.vwgroup.io',
+                    'Referer': `https://identity.vwgroup.io/u/login?state=${encodeURIComponent(stateToken)}`,
+                },
+                body: new URLSearchParams({
+                    state: stateToken,
+                    username: email,
+                    password: password,
+                    action: 'default',
+                }).toString(),
+                encoding: 'text',
+                returnFullResponse: true,
+                ignoreHttpStatusErrors: true,
+            });
+            if (typeof loginResponse === 'string') {
+                authHtml = loginResponse;
+            }
+            else if (loginResponse && typeof loginResponse === 'object') {
+                const respObj = loginResponse;
+                const respHeaders = respObj.headers;
+                if (respHeaders && respHeaders.location) {
+                    redirectUrl = respHeaders.location;
+                }
+                authHtml = respObj.body || '';
             }
-            authHtml = respObj.body || '';
+        }
+        else {
+            throw new Error(`Unknown login page format. Response preview: ${htmlContent.substring(0, 500)}`);
         }
         if (!redirectUrl && authHtml) {
             // Check if we got a redirect in the response HTML

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-jygse-vw-weconnect",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "n8n community node for VW We Connect - Control your Volkswagen T6.1 and other VW vehicles",
   "keywords": [
     "n8n-community-node-package",