home-assistant-js-websocket - npm Package Compare versions

Comparing version 8.1.0 to 8.2.0

dist/auth.d.ts

@@ -18,2 +18,3 @@ export type AuthData = {
     loadTokens?: LoadTokensFunc;
+    limitHassInstance?: boolean;
 };
@@ -20,0 +21,0 @@ export declare const genClientId: () => string;

dist/auth.js

 import { parseQuery } from "./util.js";
-import { ERR_HASS_HOST_REQUIRED, ERR_INVALID_AUTH, ERR_INVALID_HTTPS_TO_HTTP, } from "./errors.js";
+import { ERR_HASS_HOST_REQUIRED, ERR_INVALID_AUTH, ERR_INVALID_AUTH_CALLBACK, ERR_INVALID_HTTPS_TO_HTTP, } from "./errors.js";
 export const genClientId = () => `${location.protocol}//${location.host}/`;
@@ -144,4 +144,5 @@ export const genExpires = (expires_in) => {
     const clientId = options.clientId !== undefined ? options.clientId : genClientId();
+    const limitHassInstance = options.limitHassInstance === true;
     // Use auth code if it was passed in
-    if (!data && options.authCode && hassUrl) {
+    if (options.authCode && hassUrl) {
         data = await fetchToken(hassUrl, clientId, options.authCode);
@@ -159,2 +160,6 @@ if (options.saveTokens) {
             const state = decodeOAuthState(query.state);
+            if (limitHassInstance &&
+                (state.hassUrl !== hassUrl || state.clientId !== clientId)) {
+                throw ERR_INVALID_AUTH_CALLBACK;
+            }
             data = await fetchToken(state.hassUrl, state.clientId, query.code);
@@ -161,0 +166,0 @@ if (options.saveTokens) {

dist/errors.d.ts

@@ -6,1 +6,2 @@ export declare const ERR_CANNOT_CONNECT = 1;
 export declare const ERR_INVALID_HTTPS_TO_HTTP = 5;
+export declare const ERR_INVALID_AUTH_CALLBACK = 6;

dist/errors.js

@@ -6,1 +6,2 @@ export const ERR_CANNOT_CONNECT = 1;
 export const ERR_INVALID_HTTPS_TO_HTTP = 5;
+export const ERR_INVALID_AUTH_CALLBACK = 6;

dist/haws.umd.js

@@ -12,2 +12,3 @@ (function (global, factory) {
     const ERR_INVALID_HTTPS_TO_HTTP = 5;
+    const ERR_INVALID_AUTH_CALLBACK = 6;
 
@@ -679,4 +680,5 @@ function auth(accessToken) {
         const clientId = options.clientId !== undefined ? options.clientId : genClientId();
+        const limitHassInstance = options.limitHassInstance === true;
         // Use auth code if it was passed in
-        if (!data && options.authCode && hassUrl) {
+        if (options.authCode && hassUrl) {
             data = await fetchToken(hassUrl, clientId, options.authCode);
@@ -694,2 +696,6 @@ if (options.saveTokens) {
                 const state = decodeOAuthState(query.state);
+                if (limitHassInstance &&
+                    (state.hassUrl !== hassUrl || state.clientId !== clientId)) {
+                    throw ERR_INVALID_AUTH_CALLBACK;
+                }
                 data = await fetchToken(state.hassUrl, state.clientId, query.code);
@@ -1082,2 +1088,3 @@ if (options.saveTokens) {
     exports.ERR_INVALID_AUTH = ERR_INVALID_AUTH;
+    exports.ERR_INVALID_AUTH_CALLBACK = ERR_INVALID_AUTH_CALLBACK;
     exports.ERR_INVALID_HTTPS_TO_HTTP = ERR_INVALID_HTTPS_TO_HTTP;
@@ -1084,0 +1091,0 @@ exports.MSG_TYPE_AUTH_INVALID = MSG_TYPE_AUTH_INVALID;

package.json

@@ -5,3 +5,3 @@ {
   "sideEffects": false,
-  "version": "8.1.0",
+  "version": "8.2.0",
   "description": "Home Assistant websocket client",
@@ -8,0 +8,0 @@ "source": "lib/index.ts",

README.md

@@ -66,10 +66,11 @@ # :aerial_tramway: JavaScript websocket client for Home Assistant
 
-| Option      | Description                                                                                                                                                                                              |
-| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| hassUrl     | The url where the Home Assistant instance can be reached. This option is needed so we know where to redirect the user for authentication. Once redirected back, it is not needed to pass this option in. |
-| clientId    | Client ID to use. Client IDs for Home Assistant is the url of your application. Defaults to domain of current page. Pass `null` if you are making requests on behalf of a system user.                   |
-| redirectUrl | The url to redirect back to when the user has logged in. Defaults to current page.                                                                                                                       |
-| saveTokens  | Function to store an object containing the token information.                                                                                                                                            |
-| loadTokens  | Function that returns a promise that resolves to previously stored token information object or undefined if no info available.                                                                           |
-| authCode    | If you have an auth code received via other means, you can pass it in and it will be used to fetch tokens instead of going through the OAuth2 flow.                                                      |
+| Option            | Description                                                                                                                                                                                              |
+| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| hassUrl           | The url where the Home Assistant instance can be reached. This option is needed so we know where to redirect the user for authentication. Once redirected back, it is not needed to pass this option in. |
+| clientId          | Client ID to use. Client IDs for Home Assistant is the url of your application. Defaults to domain of current page. Pass `null` if you are making requests on behalf of a system user.                   |
+| redirectUrl       | The url to redirect back to when the user has logged in. Defaults to current page.                                                                                                                       |
+| saveTokens        | Function to store an object containing the token information.                                                                                                                                            |
+| loadTokens        | Function that returns a promise that resolves to previously stored token information object or undefined if no info available.                                                                           |
+| authCode          | If you have an auth code received via other means, you can pass it in and it will be used to fetch tokens instead of going through the OAuth2 flow.                                                      |
+| limitHassInstance | If set to true, allow only authentication credentials for the passed in `hassUrl` and `clientId`. Defaults to false.                                                                                     |
 
@@ -94,2 +95,3 @@ In certain instances `getAuth` will raise an error. These errors can be imported from the package:
 | `ERR_INVALID_HTTPS_TO_HTTP` | This error is raised if your code is being run from a secure context (hosted via https) and you're trying to fetch tokens from a Home Assistant instance via a non secure context (http). This is called [mixed active content](https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content#Mixed_active_content) and the browser forbids this. |
+| `ERR_INVALID_AUTH_CALLBACK` | This error is raised if only credentials for the specified Home Assistant instance are allowed and the client ID or hassURL in the auth callback state do not match the expected ones.                                                                                                                                                                  |
 | Other errors                | Unknown error!                                                                                                                                                                                                                                                                                                                                          |
@@ -96,0 +98,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

176778

increased by0.99%

Lines of code

3718

increased by0.6%

Number of lines in readme file

463

increased by0.43%

No dependency changes