carrier-api 3.6.2__tar.gz → 3.7.0__tar.gz

{carrier_api-3.6.2/src/carrier_api.egg-info → carrier_api-3.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: carrier_api
-Version: 3.6.2
+Version: 3.7.0
 Summary: Carrier Api Wrapper
 Author-email: Bren Dahl <dahl.brendan@gmail.com>
 License-Expression: MIT
@@ -179,6 +179,9 @@ Available update helpers include:
 - `set_config_hold(...)`
 - `resume_schedule(...)`
 - `set_config_manual_activity(...)`
+- `set_program_day(...)`
+
+`set_program_day(...)` replaces one day of a zone's program (`updateInfinityProgramDay`). Send every period of the day, enabled or not, with the `etag` the systems query returns (`load_data()` now reads the program's and each day's `etag`). It has not yet been verified against a live system.
 
 These methods can change real HVAC settings. Validate the selected system, zone, mode, and set points before calling them from automation.
 

{carrier_api-3.6.2 → carrier_api-3.7.0}/README.md

@@ -155,6 +155,9 @@ Available update helpers include:
 - `set_config_hold(...)`
 - `resume_schedule(...)`
 - `set_config_manual_activity(...)`
+- `set_program_day(...)`
+
+`set_program_day(...)` replaces one day of a zone's program (`updateInfinityProgramDay`). Send every period of the day, enabled or not, with the `etag` the systems query returns (`load_data()` now reads the program's and each day's `etag`). It has not yet been verified against a live system.
 
 These methods can change real HVAC settings. Validate the selected system, zone, mode, and set points before calling them from automation.
 

{carrier_api-3.6.2 → carrier_api-3.7.0}/src/carrier_api/api_connection_graphql.py

@@ -1,10 +1,11 @@
 """GraphQL client for Carrier authentication, queries, and config updates."""
 
+from asyncio import Lock
 from datetime import UTC, datetime, timedelta
 from logging import getLogger
 from typing import Any, Literal
 
-from aiohttp import ClientError, ClientResponseError, ClientSession
+from aiohttp import ClientError, ClientSession
 from gql import Client, GraphQLRequest, gql
 from gql.transport.aiohttp import AIOHTTPTransport
 from gql.transport.exceptions import (
@@ -34,6 +35,24 @@ GRAPHQL_EXECUTE_TIMEOUT_SECONDS = 60
 
 _CONNECTION_ERRORS = (GraphqlTransportError, ClientError, TimeoutError, OSError)
 _AUTH_HTTP_STATUSES = {401, 403}
+GRAPHQL_NO_AUTH_URL = "https://dataservice.infinity.iot.carrier.com/graphql-no-auth"
+FETCH_ACCESS_TOKEN_MUTATION = gql(
+    """
+    mutation fetchAccessToken($input: FetchAccessTokenInput!) {
+        fetchAccessToken(input: $input) {
+            success
+            errorMessage
+            data {
+                token_type
+                expires_in
+                access_token
+                scope
+                refresh_token
+            }
+        }
+    }
+"""
+)
 
 
 def _is_auth_transport_error(error: BaseException) -> bool:
@@ -49,25 +68,6 @@ def _is_auth_transport_error(error: BaseException) -> bool:
     return isinstance(error, TransportServerError) and error.code in _AUTH_HTTP_STATUSES
 
 
-async def _response_json_object(response: Any) -> dict[str, Any]:
-    """Read a JSON object response body when available.
-
-    Args:
-        response: aiohttp-like response object with an async ``json`` method.
-
-    Returns:
-        The decoded JSON object, or an empty object when the body is malformed
-        or is not a JSON object.
-    """
-    try:
-        data = await response.json()
-    except ClientError, TimeoutError, OSError, TypeError, ValueError:
-        return {}
-    if not isinstance(data, dict):
-        return {}
-    return data
-
-
 class ApiConnectionGraphql:
     """Async Carrier GraphQL API connection with token and websocket support."""
 
@@ -93,6 +93,7 @@ class ApiConnectionGraphql:
         """
         self.username = username
         self.password = password
+        self._auth_lock = Lock()
         if client_session is None:
             self.api_session = ClientSession(raise_for_status=False)
         else:
@@ -112,9 +113,7 @@ class ApiConnectionGraphql:
             CarrierApiAuthError: If the assisted login mutation reports an unsuccessful
                 authentication result.
         """
-        transport = AIOHTTPTransport(
-            url="https://dataservice.infinity.iot.carrier.com/graphql-no-auth", ssl=True
-        )
+        transport = AIOHTTPTransport(url=GRAPHQL_NO_AUTH_URL, ssl=True)
         try:
             async with Client(
                 transport=transport,
@@ -154,6 +153,10 @@ class ApiConnectionGraphql:
                     self.token_type = result["assistedLogin"]["data"]["token_type"]
                     self.access_token = result["assistedLogin"]["data"]["access_token"]
                     self.refresh_token = result["assistedLogin"]["data"]["refresh_token"]
+                    _LOGGER.debug(
+                        "Carrier login succeeded; access token expires at %s",
+                        self.expires_at.isoformat(timespec="seconds"),
+                    )
                     if self.api_websocket is None:
                         self.api_websocket = ApiWebsocket(self)
                 else:
@@ -171,49 +174,90 @@ class ApiConnectionGraphql:
             raise CarrierApiGraphqlError("Carrier authentication GraphQL request failed") from error
 
     async def check_auth_expiration(self) -> None:
-        """Ensure the connection has a valid access token before API use."""
-        if self.refresh_token is None:
-            await self.login()
-        if self.expires_at < datetime.now(UTC):
-            await self.refresh_auth_token()
+        """Ensure the connection has a valid access token before API use.
+
+        Checks are serialized so concurrent callers never send the same
+        refresh token twice. When Carrier rejects the refresh token, the
+        connection falls back to one password login. Transient refresh
+        failures keep the stored token for the next attempt.
+
+        Raises:
+            CarrierApiAuthError: If the fallback password login is rejected.
+            CarrierApiTokenRefreshError: If token refresh fails transiently.
+        """
+        async with self._auth_lock:
+            if self.refresh_token is None:
+                await self.login()
+            if self.expires_at < datetime.now(UTC):
+                try:
+                    await self.refresh_auth_token()
+                except CarrierApiAuthError:
+                    _LOGGER.info("Carrier refresh token was rejected; logging in again")
+                    self.refresh_token = None
+                    await self.login()
 
     async def refresh_auth_token(self) -> None:
-        """Refresh the OAuth access token using the stored refresh token.
+        """Refresh the access token through Carrier's ``fetchAccessToken`` mutation.
+
+        Carrier accounts may get tokens from Okta or from Microsoft Entra
+        External ID. Carrier's GraphQL service forwards the refresh to
+        whichever identity provider issued the account's tokens, so the
+        library does not need to know which one an account uses.
 
         Raises:
-            CarrierApiAuthError: If Carrier rejects the refresh token as invalid
-                or unauthorized.
-            CarrierApiTokenRefreshError: If token refresh fails before Carrier
-                returns a valid OAuth response.
+            CarrierApiAuthError: If Carrier rejects the refresh token.
+            CarrierApiTokenRefreshError: If the refresh request fails or
+                returns a malformed token payload.
         """
-        url = "https://sso.carrier.com/oauth2/default/v1/token"
-        json_body = {
-            "client_id": "0oa1ce7hwjuZbfOMB4x7",
-            "grant_type": "refresh_token",
-            "refresh_token": self.refresh_token,
-            "scope": "offline_access",
-        }
-        response: Any | None = None
+        transport = AIOHTTPTransport(url=GRAPHQL_NO_AUTH_URL, ssl=True)
         try:
-            response = await self.api_session.post(url=url, data=json_body)
-            response.raise_for_status()
-            data = await response.json()
-        except ClientResponseError as error:
-            data = {} if response is None else await _response_json_object(response)
-            if error.status in {401, 403} or (
-                error.status == 400 and data.get("error") == "invalid_grant"
-            ):
+            async with Client(
+                transport=transport,
+                fetch_schema_from_transport=False,
+            ) as session:
+                result = await session.execute(
+                    FETCH_ACCESS_TOKEN_MUTATION,
+                    variable_values={
+                        "input": {"username": self.username, "refreshToken": self.refresh_token}
+                    },
+                    operation_name="fetchAccessToken",
+                )
+        except TransportQueryError as error:
+            raise CarrierApiTokenRefreshError("Carrier token refresh failed") from error
+        except _CONNECTION_ERRORS as error:
+            if _is_auth_transport_error(error):
                 raise CarrierApiAuthError("Carrier token refresh was rejected") from error
             raise CarrierApiTokenRefreshError("Carrier token refresh failed") from error
-        except (ClientError, TimeoutError, OSError, TypeError, ValueError) as error:
+        except GraphQLError as error:
             raise CarrierApiTokenRefreshError("Carrier token refresh failed") from error
+
+        response = result.get("fetchAccessToken") if isinstance(result, dict) else None
+        if not isinstance(response, dict):
+            raise CarrierApiTokenRefreshError("Carrier token refresh failed")
+        if not response.get("success"):
+            _LOGGER.debug("Carrier token refresh was rejected: %s", response.get("errorMessage"))
+            raise CarrierApiAuthError("Carrier token refresh was rejected", payload=response)
+
+        data = response.get("data")
+        if not isinstance(data, dict):
+            raise CarrierApiTokenRefreshError("Carrier token refresh failed")
+        previous_refresh_token = self.refresh_token
         try:
-            self.expires_at = datetime.now(UTC) + timedelta(seconds=data["expires_in"])
-            self.token_type = data["token_type"]
-            self.access_token = data["access_token"]
-            self.refresh_token = data["refresh_token"]
+            expires_at = datetime.now(UTC) + timedelta(seconds=data["expires_in"])
+            token_type = data["token_type"]
+            access_token = data["access_token"]
         except (KeyError, TypeError) as error:
             raise CarrierApiTokenRefreshError("Carrier token refresh failed") from error
+        self.expires_at = expires_at
+        self.token_type = token_type
+        self.access_token = access_token
+        # Okta keeps the refresh token; Entra rotates it.
+        self.refresh_token = data.get("refresh_token") or previous_refresh_token
+        _LOGGER.debug(
+            "Carrier token refresh succeeded; access token expires at %s, refresh token %s",
+            self.expires_at.isoformat(timespec="seconds"),
+            "unchanged" if self.refresh_token == previous_refresh_token else "rotated",
+        )
 
     async def authed_query(
         self, operation_name: str, query: GraphQLRequest, variable_values: dict[str, Any]
@@ -434,8 +478,10 @@ class ApiConnectionGraphql:
                     occEnabled
                     program {
                       id
+                      etag
                       day {
                         id
+                        etag
                         zoneId
                         period {
                           id
@@ -811,6 +857,42 @@ class ApiConnectionGraphql:
             _LOGGER.warning("No API websocket connection")
         return response
 
+    async def _update_infinity_program_day(self, variables: dict[str, Any]) -> dict[str, Any]:
+        """Run the Carrier zone program day mutation.
+
+        Args:
+            variables: GraphQL variables containing an ``InfinityProgramDayInput``.
+
+        Returns:
+            The decoded mutation response.
+        """
+        query = gql(
+            """
+            mutation updateInfinityProgramDay($input: InfinityProgramDayInput!) {
+                updateInfinityProgramDay(input: $input) {
+                    id
+                    etag
+                    zoneId
+                    period {
+                        id
+                        activity
+                        time
+                        enabled
+                    }
+                }
+            }
+            """
+        )
+        _LOGGER.debug("updateInfinityProgramDay: %s", variables)
+        response = await self.authed_query(
+            operation_name="updateInfinityProgramDay", query=query, variable_values=variables
+        )
+        if self.api_websocket is not None:
+            await self.api_websocket.send_reconcile()
+        else:
+            _LOGGER.warning("No API websocket connection")
+        return response
+
     async def set_config_mode(self, system_serial: str, mode: SystemModes) -> dict[str, Any]:
         """Update a Carrier system's operating mode.
 
@@ -1084,3 +1166,54 @@ class ApiConnectionGraphql:
             cool_set_point=cool_set_point,
             fan_mode=fan_mode,
         )
+
+    async def set_program_day(
+        self,
+        system_serial: str,
+        zone_id: str,
+        day_id: str,
+        periods: list[dict[str, str]],
+        etag: str,
+    ) -> dict[str, Any]:
+        """Replace one day of a zone's program.
+
+        The Carrier replaces the day with the periods sent, so pass every period
+        of the day, enabled or not, as the systems query returns them.
+
+        Args:
+            system_serial: Serial number of the system to update.
+            zone_id: Carrier zone identifier.
+            day_id: Carrier day identifier as the program returns it (``"0"`` to
+                ``"6"``).
+            periods: The day's periods, each with ``id`` and ``activity`` and
+                optionally ``time`` (``HH:MM``) and ``enabled`` (``on``/``off``).
+            etag: Etag read from the systems query, which the mutation requires.
+
+        Returns:
+            The decoded mutation response.
+
+        Raises:
+            ValueError: If a period is missing ``id`` or ``activity``, has an
+                unknown key, or names an activity that is not a valid
+                ``ActivityTypes`` value.
+        """
+        activities = {activity.value for activity in ActivityTypes}
+        allowed_keys = {"id", "activity", "time", "enabled"}
+        for period in periods:
+            unknown_keys = set(period) - allowed_keys
+            if unknown_keys:
+                raise ValueError(f"unknown program period keys: {sorted(unknown_keys)}")
+            if not period.get("id"):
+                raise ValueError("program period is missing its id")
+            if period.get("activity") not in activities:
+                raise ValueError(f"{period.get('activity')} is not a valid activity type")
+        variables = {
+            "input": {
+                "serial": system_serial,
+                "etag": etag,
+                "zoneId": zone_id,
+                "dayId": day_id,
+                "period": [dict(period) for period in periods],
+            }
+        }
+        return await self._update_infinity_program_day(variables=variables)

{carrier_api-3.6.2 → carrier_api-3.7.0}/src/carrier_api/const.py

@@ -2,7 +2,7 @@
 
 from enum import Enum
 
-VERSION: str = "3.6.2"
+VERSION: str = "3.7.0"
 
 
 class SystemModes(Enum):

{carrier_api-3.6.2 → carrier_api-3.7.0/src/carrier_api.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: carrier_api
-Version: 3.6.2
+Version: 3.7.0
 Summary: Carrier Api Wrapper
 Author-email: Bren Dahl <dahl.brendan@gmail.com>
 License-Expression: MIT
@@ -179,6 +179,9 @@ Available update helpers include:
 - `set_config_hold(...)`
 - `resume_schedule(...)`
 - `set_config_manual_activity(...)`
+- `set_program_day(...)`
+
+`set_program_day(...)` replaces one day of a zone's program (`updateInfinityProgramDay`). Send every period of the day, enabled or not, with the `etag` the systems query returns (`load_data()` now reads the program's and each day's `etag`). It has not yet been verified against a live system.
 
 These methods can change real HVAC settings. Validate the selected system, zone, mode, and set points before calling them from automation.
 

{carrier_api-3.6.2 → carrier_api-3.7.0}/tests/test_api_connection_graphql.py

@@ -1,9 +1,10 @@
 """Tests for Carrier GraphQL API connection helpers."""
 
+import asyncio
 from datetime import UTC, datetime, timedelta
-from typing import Any, Self, cast
+from typing import Any, ClassVar, Self, cast
 
-from aiohttp import ClientConnectionError, ClientError, ClientResponseError, ClientSession
+from aiohttp import ClientConnectionError, ClientError, ClientSession
 from gql import GraphQLRequest, gql
 from gql.transport.exceptions import TransportQueryError, TransportServerError
 import pytest
@@ -15,86 +16,17 @@ from carrier_api.const import ActivityTypes, FanModes, HeatSourceTypes, SystemMo
 from carrier_api.system import System
 
 
-class FakeResponse:
-    """Minimal aiohttp response double for token refresh tests."""
-
-    def __init__(
-        self,
-        payload: object,
-        status_error: ClientResponseError | None = None,
-        json_error: BaseException | None = None,
-    ) -> None:
-        """Initialize the fake response with JSON payload data.
-
-        Args:
-            payload: Data returned from ``json``.
-            status_error: Optional error raised by ``raise_for_status``.
-            json_error: Optional error raised by ``json``.
-        """
-        self.payload = payload
-        self.status_error = status_error
-        self.json_error = json_error
-        self.raise_for_status_called = False
-
-    def raise_for_status(self) -> None:
-        """Record status validation and raise the configured status error.
-
-        Raises:
-            ClientResponseError: When ``status_error`` is configured.
-        """
-        self.raise_for_status_called = True
-        if self.status_error is not None:
-            raise self.status_error
-
-    async def json(self) -> object:
-        """Return the configured JSON payload.
-
-        Returns:
-            The fake response payload.
-
-        Raises:
-            BaseException: When ``json_error`` is configured.
-        """
-        if self.json_error is not None:
-            raise self.json_error
-        return self.payload
-
-
 class FakeSession:
     """Minimal session double used by connection tests."""
 
     def __init__(self) -> None:
         """Initialize captured session state."""
         self.closed = False
-        self.post_url: str | None = None
-        self.post_data: dict[str, Any] | None = None
-        self.response = FakeResponse(
-            {
-                "expires_in": 3600,
-                "token_type": "Bearer",
-                "access_token": "new-access",
-                "refresh_token": "new-refresh",
-            }
-        )
 
     async def close(self) -> None:
         """Record that the session was closed."""
         self.closed = True
 
-    async def post(self, url: str, data: dict[str, Any]) -> FakeResponse:
-        """Capture a token refresh request.
-
-        Args:
-            url: Requested URL.
-            data: Submitted form data.
-
-        Returns:
-            The fake token refresh response.
-        """
-        self.post_url = url
-        self.post_data = data
-        return self.response
-
 
 class FakeGraphQLClient:
     """Minimal gql client double that captures constructor arguments."""
@@ -436,254 +368,256 @@ async def test_cleanup_wraps_session_close_errors(
     assert error.value.__cause__ is cleanup_error
 
 
-@pytest.mark.asyncio
-async def test_refresh_auth_token_updates_token_state() -> None:
-    """Refresh auth tokens from the OAuth response payload."""
-    session = FakeSession()
-    connection = ApiConnectionGraphql(
-        username="user@example.com",
-        password="password",
-        client_session=cast("ClientSession", session),
-    )
-    connection.refresh_token = "old-refresh"
+class FetchAccessTokenClient:
+    """GraphQL client double for ``fetchAccessToken`` refresh calls."""
 
-    await connection.refresh_auth_token()
+    calls: ClassVar[list[dict[str, Any]]] = []
+    result: ClassVar[object] = None
+    error: ClassVar[BaseException | None] = None
 
-    assert session.response.raise_for_status_called
-    assert session.post_url == "https://sso.carrier.com/oauth2/default/v1/token"
-    assert session.post_data == {
-        "client_id": "0oa1ce7hwjuZbfOMB4x7",
-        "grant_type": "refresh_token",
-        "refresh_token": "old-refresh",
-        "scope": "offline_access",
-    }
-    assert connection.token_type == "Bearer"
-    assert connection.access_token == "new-access"
-    assert connection.refresh_token == "new-refresh"
-    assert connection.expires_at > datetime.now(UTC)
+    def __init__(self, *args: Any, **kwargs: Any) -> None:
+        """Accept GraphQL client construction arguments."""
 
+    async def __aenter__(self) -> Self:
+        """Return the fake session.
 
-@pytest.mark.asyncio
-@pytest.mark.parametrize(
-    "refresh_error",
-    [
-        ClientConnectionError("token refresh connection failed"),
-        TimeoutError("token refresh timed out"),
-        OSError("token refresh socket failed"),
-    ],
-)
-async def test_refresh_auth_token_wraps_refresh_failures(
-    refresh_error: ClientError | TimeoutError | OSError,
-) -> None:
-    """Raise Carrier token refresh errors instead of raw HTTP exceptions."""
+        Returns:
+            The fake GraphQL session.
+        """
+        return self
 
-    class FailingSession(FakeSession):
-        """Session double that fails token refresh requests."""
+    async def __aexit__(self, *args: object) -> None:
+        """Exit the fake session context.
 
-        async def post(self, url: str, data: dict[str, Any]) -> FakeResponse:
-            """Raise the configured refresh error.
+        Args:
+            args: Context manager exception details.
+        """
 
-            Args:
-                url: Requested URL.
-                data: Submitted form data.
+    async def execute(
+        self,
+        query: GraphQLRequest,
+        *,
+        variable_values: dict[str, Any],
+        operation_name: str,
+    ) -> object:
+        """Record the refresh call and return or raise the configured outcome.
 
-            Raises:
-                ClientError | TimeoutError | OSError: Always raised for this
-                    failing session.
-            """
-            raise refresh_error
+        Args:
+            query: GraphQL request.
+            variable_values: Variables supplied to the mutation.
+            operation_name: GraphQL operation name.
 
-    connection = ApiConnectionGraphql(
-        username="user@example.com",
-        password="password",
-        client_session=cast("ClientSession", FailingSession()),
-    )
-    connection.refresh_token = "old-refresh"
+        Returns:
+            The configured GraphQL result.
 
-    with pytest.raises(errors.CarrierApiTokenRefreshError) as error:
-        await connection.refresh_auth_token()
+        Raises:
+            BaseException: When ``error`` is configured.
+        """
+        FetchAccessTokenClient.calls.append(
+            {"operation_name": operation_name, "variables": variable_values}
+        )
+        if FetchAccessTokenClient.error is not None:
+            raise FetchAccessTokenClient.error
+        return FetchAccessTokenClient.result
 
-    assert error.value.__cause__ is refresh_error
 
+@pytest.fixture
+def fetch_access_token(monkeypatch: pytest.MonkeyPatch) -> type[FetchAccessTokenClient]:
+    """Route GraphQL clients to the ``fetchAccessToken`` double.
 
-@pytest.mark.asyncio
-@pytest.mark.parametrize(
-    ("status", "payload"),
-    [(401, {}), (400, {"error": "invalid_grant"})],
-)
-async def test_refresh_auth_token_treats_auth_rejections_as_auth_error(
-    status: int,
-    payload: object,
-) -> None:
-    """Raise auth errors for rejected token refresh responses.
+    Args:
+        monkeypatch: Pytest helper for replacing the GraphQL client.
+
+    Returns:
+        The configured client double class.
+    """
+    FetchAccessTokenClient.calls = []
+    FetchAccessTokenClient.result = None
+    FetchAccessTokenClient.error = None
+    monkeypatch.setattr("carrier_api.api_connection_graphql.Client", FetchAccessTokenClient)
+    return FetchAccessTokenClient
+
+
+def _fetch_result(**data: object) -> dict[str, Any]:
+    """Build a successful ``fetchAccessToken`` result.
 
     Args:
-        status: HTTP status returned by the fake token endpoint.
-        payload: JSON payload returned by the fake token endpoint.
+        data: Token fields overriding the defaults.
+
+    Returns:
+        A GraphQL result payload.
     """
-    refresh_error = ClientResponseError(
-        request_info=None,  # type: ignore[arg-type]
-        history=(),
-        status=status,
-        message="token rejected",
-    )
+    token_data: dict[str, object] = {
+        "token_type": "Bearer",
+        "expires_in": 3600,
+        "access_token": "new-access",
+        "scope": "login",
+        "refresh_token": "new-refresh",
+        **data,
+    }
+    return {"fetchAccessToken": {"success": True, "errorMessage": None, "data": token_data}}
 
-    session = FakeSession()
-    session.response = FakeResponse(payload, status_error=refresh_error)
+
+def _refresh_connection() -> ApiConnectionGraphql:
+    """Build a connection holding a stored refresh token.
+
+    Returns:
+        A connection ready for ``refresh_auth_token``.
+    """
     connection = ApiConnectionGraphql(
         username="user@example.com",
         password="password",
-        client_session=cast("ClientSession", session),
+        client_session=cast("ClientSession", FakeSession()),
     )
     connection.refresh_token = "old-refresh"
+    return connection
 
-    with pytest.raises(errors.CarrierApiAuthError) as error:
-        await connection.refresh_auth_token()
 
-    assert error.value.__cause__ is refresh_error
+@pytest.mark.asyncio
+async def test_refresh_auth_token_uses_fetch_access_token(
+    fetch_access_token: type[FetchAccessTokenClient],
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Refresh through Carrier's mutation and store the rotated token state.
+
+    Args:
+        fetch_access_token: GraphQL client double for the refresh mutation.
+        caplog: Pytest log capture fixture.
+    """
+    caplog.set_level("DEBUG", logger="carrier_api.api_connection_graphql")
+    fetch_access_token.result = _fetch_result()
+    connection = _refresh_connection()
+
+    await connection.refresh_auth_token()
+
+    assert fetch_access_token.calls == [
+        {
+            "operation_name": "fetchAccessToken",
+            "variables": {"input": {"username": "user@example.com", "refreshToken": "old-refresh"}},
+        }
+    ]
+    assert connection.token_type == "Bearer"
+    assert connection.access_token == "new-access"
+    assert connection.refresh_token == "new-refresh"
+    assert connection.expires_at > datetime.now(UTC)
+    assert "refresh token rotated" in caplog.text
+    assert "new-refresh" not in caplog.text
+    assert "new-access" not in caplog.text
 
 
 @pytest.mark.asyncio
-@pytest.mark.parametrize(
-    "json_error",
-    [
-        TimeoutError("refresh error body timed out"),
-        OSError("refresh error body socket failed"),
-    ],
-)
-async def test_refresh_auth_token_normalizes_unreadable_error_payloads(
-    json_error: TimeoutError | OSError,
+@pytest.mark.parametrize("refresh_token", ["old-refresh", None])
+async def test_refresh_auth_token_keeps_unrotated_refresh_token(
+    fetch_access_token: type[FetchAccessTokenClient],
+    caplog: pytest.LogCaptureFixture,
+    refresh_token: str | None,
 ) -> None:
-    """Raise Carrier errors when refresh error payload reads fail.
+    """Keep the stored refresh token when the provider does not rotate it.
 
     Args:
-        json_error: Error raised while reading the refresh error response body.
+        fetch_access_token: GraphQL client double for the refresh mutation.
+        caplog: Pytest log capture fixture.
+        refresh_token: Refresh token returned by the mutation.
     """
-    refresh_error = ClientResponseError(
-        request_info=None,  # type: ignore[arg-type]
-        history=(),
-        status=401,
-        message="unauthorized",
-    )
-
-    session = FakeSession()
-    session.response = FakeResponse(
-        {},
-        status_error=refresh_error,
-        json_error=json_error,
-    )
-    connection = ApiConnectionGraphql(
-        username="user@example.com",
-        password="password",
-        client_session=cast("ClientSession", session),
-    )
-    connection.refresh_token = "old-refresh"
+    caplog.set_level("DEBUG", logger="carrier_api.api_connection_graphql")
+    fetch_access_token.result = _fetch_result(refresh_token=refresh_token)
+    connection = _refresh_connection()
 
-    with pytest.raises(errors.CarrierApiAuthError) as error:
-        await connection.refresh_auth_token()
+    await connection.refresh_auth_token()
 
-    assert error.value.__cause__ is refresh_error
+    assert connection.refresh_token == "old-refresh"
+    assert connection.access_token == "new-access"
+    assert "refresh token unchanged" in caplog.text
 
 
 @pytest.mark.asyncio
-@pytest.mark.parametrize("payload", [None, ["invalid_grant"], "invalid_grant"])
-async def test_refresh_auth_token_ignores_non_object_error_payloads(
-    payload: object,
+async def test_refresh_auth_token_treats_unsuccessful_result_as_auth_error(
+    fetch_access_token: type[FetchAccessTokenClient],
 ) -> None:
-    """Keep non-object refresh error payloads in the refresh-failure bucket.
+    """Raise auth errors when Carrier reports the refresh as unsuccessful.
 
     Args:
-        payload: Non-object JSON payload returned by the fake response.
+        fetch_access_token: GraphQL client double for the refresh mutation.
     """
-    refresh_error = ClientResponseError(
-        request_info=None,  # type: ignore[arg-type]
-        history=(),
-        status=400,
-        message="bad request",
-    )
-
-    session = FakeSession()
-    session.response = FakeResponse(payload, status_error=refresh_error)
-    connection = ApiConnectionGraphql(
-        username="user@example.com",
-        password="password",
-        client_session=cast("ClientSession", session),
-    )
-    connection.refresh_token = "old-refresh"
+    rejection = {
+        "success": False,
+        "errorMessage": "AADSTS9002313: Invalid request.",
+        "data": None,
+    }
+    fetch_access_token.result = {"fetchAccessToken": rejection}
+    connection = _refresh_connection()
 
-    with pytest.raises(errors.CarrierApiTokenRefreshError) as error:
+    with pytest.raises(errors.CarrierApiAuthError) as error:
         await connection.refresh_auth_token()
 
-    assert error.value.__cause__ is refresh_error
+    assert error.value.payload == rejection
+    assert connection.refresh_token == "old-refresh"
 
 
 @pytest.mark.asyncio
-async def test_refresh_auth_token_normalizes_malformed_error_payload() -> None:
-    """Keep malformed refresh error payloads normalized as Carrier errors."""
-    refresh_error = ClientResponseError(
-        request_info=None,  # type: ignore[arg-type]
-        history=(),
-        status=400,
-        message="bad request",
-    )
+@pytest.mark.parametrize(
+    ("refresh_error", "expected"),
+    [
+        (TransportQueryError("refresh failed"), errors.CarrierApiTokenRefreshError),
+        (ClientConnectionError("connection failed"), errors.CarrierApiTokenRefreshError),
+        (TimeoutError("timed out"), errors.CarrierApiTokenRefreshError),
+        (OSError("socket failed"), errors.CarrierApiTokenRefreshError),
+        (TransportServerError("server error", 500), errors.CarrierApiTokenRefreshError),
+        (TransportServerError("unauthorized", 401), errors.CarrierApiAuthError),
+    ],
+)
+async def test_refresh_auth_token_normalizes_request_failures(
+    fetch_access_token: type[FetchAccessTokenClient],
+    refresh_error: BaseException,
+    expected: type[errors.CarrierApiError],
+) -> None:
+    """Map refresh request failures to Carrier errors.
 
-    session = FakeSession()
-    session.response = FakeResponse(
-        {},
-        status_error=refresh_error,
-        json_error=ValueError("invalid json"),
-    )
-    connection = ApiConnectionGraphql(
-        username="user@example.com",
-        password="password",
-        client_session=cast("ClientSession", session),
-    )
-    connection.refresh_token = "old-refresh"
+    Args:
+        fetch_access_token: GraphQL client double for the refresh mutation.
+        refresh_error: Error raised by the GraphQL client.
+        expected: Carrier error expected from the refresh.
+    """
+    fetch_access_token.error = refresh_error
+    connection = _refresh_connection()
 
-    with pytest.raises(errors.CarrierApiTokenRefreshError) as error:
+    with pytest.raises(expected) as error:
         await connection.refresh_auth_token()
 
+    assert type(error.value) is expected
     assert error.value.__cause__ is refresh_error
 
 
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
-    ("payload", "cause_type"),
+    "result",
     [
-        (
-            {
-                "expires_in": 3600,
-                "token_type": "Bearer",
-                "access_token": "new-access",
-            },
-            KeyError,
-        ),
-        (None, TypeError),
+        None,
+        {},
+        {"fetchAccessToken": None},
+        {"fetchAccessToken": {"success": True, "errorMessage": None, "data": None}},
+        {"fetchAccessToken": {"success": True, "data": {}}},
+        {"fetchAccessToken": {"success": True, "data": {"token_type": "Bearer"}}},
     ],
 )
-async def test_refresh_auth_token_normalizes_malformed_success_payloads(
-    payload: object,
-    cause_type: type[BaseException],
+async def test_refresh_auth_token_rejects_malformed_results(
+    fetch_access_token: type[FetchAccessTokenClient],
+    result: object,
 ) -> None:
-    """Raise token refresh errors for malformed successful OAuth responses.
+    """Raise token refresh errors for malformed mutation results.
 
     Args:
-        payload: Malformed successful OAuth payload returned by the fake response.
-        cause_type: Expected original exception type preserved as the cause.
+        fetch_access_token: GraphQL client double for the refresh mutation.
+        result: Malformed GraphQL result.
     """
-    session = FakeSession()
-    session.response = FakeResponse(payload)
-    connection = ApiConnectionGraphql(
-        username="user@example.com",
-        password="password",
-        client_session=cast("ClientSession", session),
-    )
-    connection.refresh_token = "old-refresh"
+    fetch_access_token.result = result
+    connection = _refresh_connection()
 
-    with pytest.raises(errors.CarrierApiTokenRefreshError) as error:
+    with pytest.raises(errors.CarrierApiTokenRefreshError):
         await connection.refresh_auth_token()
 
-    assert isinstance(error.value.__cause__, cause_type)
+    assert connection.refresh_token == "old-refresh"
+    assert connection.access_token is None
 
 
 @pytest.mark.asyncio
@@ -704,6 +638,107 @@ async def test_check_auth_expiration_logs_in_then_refreshes_when_expired(
     assert connection.refresh_count == 1
 
 
+class RefreshSpyConnection(ApiConnectionGraphql):
+    """Connection double whose token refresh outcome is configurable."""
+
+    def __init__(self, refresh_error: BaseException | None = None) -> None:
+        """Initialize an expired connection with a stored refresh token.
+
+        Args:
+            refresh_error: Optional error raised by every token refresh.
+        """
+        super().__init__(
+            username="user@example.com",
+            password="password",
+            client_session=cast("ClientSession", FakeSession()),
+        )
+        self.refresh_error = refresh_error
+        self.login_error: BaseException | None = None
+        self.refresh_token = "stored-refresh"
+        self.expires_at = datetime.now(UTC) - timedelta(seconds=1)
+        self.login_count = 0
+        self.refreshed_tokens: list[str | None] = []
+
+    async def login(self) -> None:
+        """Record login calls and seed fresh token state.
+
+        Raises:
+            BaseException: When ``login_error`` is configured.
+        """
+        self.login_count += 1
+        if self.login_error is not None:
+            raise self.login_error
+        self.refresh_token = "login-refresh"
+        self.expires_at = datetime.now(UTC) + timedelta(hours=1)
+
+    async def refresh_auth_token(self) -> None:
+        """Record the refresh token used and rotate it like Okta.
+
+        Raises:
+            BaseException: When ``refresh_error`` is configured.
+        """
+        self.refreshed_tokens.append(self.refresh_token)
+        await asyncio.sleep(0)
+        if self.refresh_error is not None:
+            raise self.refresh_error
+        self.refresh_token = f"rotated-{len(self.refreshed_tokens)}"
+        self.expires_at = datetime.now(UTC) + timedelta(hours=1)
+
+
+@pytest.mark.asyncio
+async def test_check_auth_expiration_logs_in_when_refresh_is_rejected() -> None:
+    """Fall back to one password login when Carrier rejects the refresh token."""
+    connection = RefreshSpyConnection(errors.CarrierApiAuthError("rejected"))
+
+    await connection.check_auth_expiration()
+
+    assert connection.refreshed_tokens == ["stored-refresh"]
+    assert connection.login_count == 1
+    assert connection.refresh_token == "login-refresh"
+    assert connection.expires_at > datetime.now(UTC)
+
+
+@pytest.mark.asyncio
+async def test_check_auth_expiration_raises_when_fallback_login_is_rejected() -> None:
+    """Surface auth errors when the fallback password login is also rejected."""
+    connection = RefreshSpyConnection(errors.CarrierApiAuthError("rejected"))
+    login_error = errors.CarrierApiAuthError("bad password")
+    connection.login_error = login_error
+
+    with pytest.raises(errors.CarrierApiAuthError) as error:
+        await connection.check_auth_expiration()
+
+    assert error.value is login_error
+    assert connection.refresh_token is None
+
+
+@pytest.mark.asyncio
+async def test_check_auth_expiration_keeps_token_on_transient_refresh_failure() -> None:
+    """Do not log in again when token refresh fails for transient reasons."""
+    connection = RefreshSpyConnection(errors.CarrierApiTokenRefreshError("network"))
+
+    with pytest.raises(errors.CarrierApiTokenRefreshError):
+        await connection.check_auth_expiration()
+
+    assert connection.login_count == 0
+    assert connection.refresh_token == "stored-refresh"
+
+
+@pytest.mark.asyncio
+async def test_check_auth_expiration_serializes_concurrent_refreshes() -> None:
+    """Send a single-use refresh token only once when callers race after expiry."""
+    connection = RefreshSpyConnection()
+
+    await asyncio.gather(
+        connection.check_auth_expiration(),
+        connection.check_auth_expiration(),
+        connection.check_auth_expiration(),
+    )
+
+    assert connection.refreshed_tokens == ["stored-refresh"]
+    assert connection.refresh_token == "rotated-1"
+
+
 @pytest.mark.asyncio
 async def test_login_wraps_graphql_query_errors(monkeypatch: pytest.MonkeyPatch) -> None:
     """Raise Carrier GraphQL errors instead of raw GraphQL query exceptions.
@@ -1189,6 +1224,7 @@ async def test_update_methods_send_reconcile_when_websocket_exists() -> None:
     config_variables: dict[str, Any] = {"input": {"serial": "SERIAL"}}
     zone_activity_variables: dict[str, Any] = {"input": {"serial": "SERIAL"}}
     zone_config_variables: dict[str, Any] = {"input": {"serial": "SERIAL"}}
+    program_day_variables: dict[str, Any] = {"input": {"serial": "SERIAL"}}
 
     assert await connection._update_infinity_config(config_variables) == {
         "operation": "updateInfinityConfig",
@@ -1202,7 +1238,11 @@ async def test_update_methods_send_reconcile_when_websocket_exists() -> None:
         "operation": "updateInfinityZoneConfig",
         "variables": zone_config_variables,
     }
-    assert websocket.calls == 3
+    assert await connection._update_infinity_program_day(program_day_variables) == {
+        "operation": "updateInfinityProgramDay",
+        "variables": program_day_variables,
+    }
+    assert websocket.calls == 4
 
 
 @pytest.mark.asyncio
@@ -1275,3 +1315,107 @@ async def test_load_entry_level_data_parses_systems(
     assert len(systems) == 1
     assert systems[0].serial == "SERIALXXX"
     assert systems[0].zones[0].mode == "cool"
+
+
+PROGRAM_DAY_PERIODS: list[dict[str, str]] = [
+    {"id": "1", "activity": "wake", "time": "06:00", "enabled": "on"},
+    {"id": "2", "activity": "away", "time": "08:00", "enabled": "on"},
+    {"id": "3", "activity": "home", "time": "18:00", "enabled": "on"},
+    {"id": "4", "activity": "sleep", "time": "22:00", "enabled": "on"},
+    {"id": "5", "activity": "home", "time": "00:00", "enabled": "off"},
+]
+
+
+@pytest.mark.asyncio
+async def test_set_program_day_sends_the_day_with_its_etag(connection: SpyConnection) -> None:
+    """Send every period of the day unchanged with the caller's etag.
+
+    Args:
+        connection: Spy connection under test.
+    """
+    await connection.set_program_day(
+        system_serial="SERIAL",
+        zone_id="1",
+        day_id="3",
+        periods=PROGRAM_DAY_PERIODS,
+        etag="ETAG",
+    )
+
+    assert connection.authed_calls == [
+        (
+            "updateInfinityProgramDay",
+            {
+                "input": {
+                    "serial": "SERIAL",
+                    "etag": "ETAG",
+                    "zoneId": "1",
+                    "dayId": "3",
+                    "period": PROGRAM_DAY_PERIODS,
+                }
+            },
+        )
+    ]
+
+
+@pytest.mark.asyncio
+async def test_set_program_day_omits_optional_period_fields(connection: SpyConnection) -> None:
+    """Send only the period fields the caller supplied.
+
+    Args:
+        connection: Spy connection under test.
+    """
+    await connection.set_program_day("SERIAL", "1", "0", [{"id": "1", "activity": "home"}], "E")
+
+    assert connection.authed_calls[0][1]["input"]["period"] == [{"id": "1", "activity": "home"}]
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "period",
+    [
+        {"activity": "home", "time": "06:00"},
+        {"id": "1", "time": "06:00"},
+        {"id": "1", "activity": "nap", "time": "06:00"},
+        {"id": "1", "activity": "home", "colour": "blue"},
+    ],
+)
+async def test_set_program_day_rejects_invalid_periods(
+    connection: SpyConnection, period: dict[str, str]
+) -> None:
+    """Reject periods the Carrier schema would refuse before sending anything.
+
+    Args:
+        connection: Spy connection under test.
+        period: Invalid period payload.
+    """
+    with pytest.raises(ValueError):
+        await connection.set_program_day("SERIAL", "1", "0", [period], "ETAG")
+
+    assert connection.authed_calls == []
+
+
+@pytest.mark.asyncio
+async def test_set_program_day_surfaces_a_stale_etag(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Raise a Carrier GraphQL error when the server refuses the day.
+
+    Args:
+        monkeypatch: Pytest helper for replacing the GraphQL client.
+    """
+    transport_error = TransportQueryError("etag mismatch")
+    monkeypatch.setattr(
+        "carrier_api.api_connection_graphql.Client", graphql_client_double(error=transport_error)
+    )
+    connection = ApiConnectionGraphql(
+        username="user@example.com",
+        password="password",
+        client_session=cast("ClientSession", FakeSession()),
+    )
+    connection.refresh_token = "refresh"
+    connection.token_type = "Bearer"
+    connection.access_token = "access"
+    connection.expires_at = datetime.now(UTC) + timedelta(hours=1)
+
+    with pytest.raises(errors.CarrierApiGraphqlError) as error:
+        await connection.set_program_day("SERIAL", "1", "0", PROGRAM_DAY_PERIODS, "STALE")
+
+    assert error.value.__cause__ is transport_error