-
Notifications
You must be signed in to change notification settings - Fork 5
/
teslaAuth.js
216 lines (200 loc) · 6.56 KB
/
teslaAuth.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
/**
* Bare bone Node.js Tesla Token Exchange API.
*
* @file Functions to communicate with Tesla authentication servers to get bearer and access tokens. Does not authenticate SSO sessions.
* @author Fredrik Lidström
* @copyright 2019-2022 Fredrik Lidström
* @license MIT (MIT)
*/
const TESLA_AUTH_BASE = `https://auth.tesla.com/oauth2/v3`;
const TESLA_AUTH_REDIRECT = `https://auth.tesla.com/void/callback`;
const { TRACE } = process.env;
const https = require("https");
const crypto = require("crypto");
class TeslaAuthException extends Error { };
class TeslaAuthUnauthorized extends Error { };
/**
* Simple base64 to base64url converter.
*
* @param {Buffer} buffer - Byte buffer to convert
* @returns {string} Base64url representation
*/
function bufferBase64url(buffer) {
return buffer.toString("base64").replace(/\+/g, "-")
.replace(/\//g, "_")
.replace(/=/g, "");
}
/**
* Makes sure the base url has a trailing slash and then joins the path
*
* @param {string} url - absolute or relative URL
* @param {string} base - base URL
* @returns {string} combined URL in string format
*/
function joinURL(url, base) {
return (new URL(url, base.endsWith("/") ? base : base + "/")).toString();
}
/**
* Promisified https.request.
*
* If data is provided, Content-Length is added automatically, but the Content-Type
* must be set manually in the provided headers.
*
* @throws {TeslaAuthException} On statusCode >= 500
* @throws {TeslaAuthUnauthorized} On statusCode >= 400
* @throws {Error} On any other error
* @param {Object} opt - Options to pass to https.request
* @param {Object|undefined} data - Data
* @returns {http.ClientRequest}
*/
function request(url, opt, data) {
opt.headers = opt.headers || {};
opt.headers["User-Agent"] = "TeslaAPI-proxy/2.0 (Node.js)";
opt.headers["Accept"] = "application/json, text/plain, */*";
if (data !== undefined) {
opt.headers["Content-Length"] = Buffer.byteLength(data);
}
if (TRACE) console.log(`TRACE -> request(${JSON.stringify(opt)}, ${JSON.stringify(cookieJar)}, ${JSON.stringify(data)})`);
return new Promise((resolve, reject) => {
const req = https.request(url, opt, (res) => {
let body = "";
res.setEncoding("binary");
res.on("error", (e) => reject(e));
res.on("data", chunk => body += chunk)
res.on("end", () => {
if (TRACE) console.log(`TRACE <- ${res.statusCode} ${res.statusMessage} ${JSON.stringify(body)}`);
if (res.statusCode >= 500) {
reject(new TeslaAuthException(`${res.statusCode} ${res.statusMessage}`));
} else if (res.statusCode >= 400) {
reject(new TeslaAuthUnauthorized(`${res.statusCode} ${res.statusMessage}`));
} else {
resolve({
statusCode: res.statusCode,
headers: res.headers,
body: body
});
}
});
});
req.on("error", (e) => reject(e));
if (data) {
req.write(data);
}
req.end();
});
}
/**
* Start a new authentication session and generate the authentication URL
*
* @export
* @throws {TeslaAuthException|Error} On error
* @returns {Object} { url: string, state: string, codeVerifier: string, codeChallenge: string }
*/
function newSession() {
// Generate a random state identifier string (10 bytes = 16 characters)
const state = bufferBase64url(crypto.randomBytes(10));
// Generate a random code verifier string (64 bytes = 86 characters)
const codeVerifier = bufferBase64url(crypto.randomBytes(64));
// SHA-256 hash the codeVerifier string
const hash = crypto.createHash("sha256").update(codeVerifier).digest();
const codeChallenge = bufferBase64url(Buffer.from(hash));
// Generate a Tesla SSO Sign In URL
const url = `${TESLA_AUTH_BASE}/authorize?${new URLSearchParams({
client_id: "ownerapi",
code_challenge: codeChallenge,
code_challenge_method: "S256",
// locale: "en-US",
// prompt: "login",
redirect_uri: TESLA_AUTH_REDIRECT,
response_type: "code",
scope: "openid email offline_access",
state: state,
})}`;
return { url, state, codeVerifier, codeChallenge };
}
/**
* Decodes the callback URL redirected to by the Tesla SSO Authentication server
*
* @export
* @throws {Error} When URL cannot be decoded
* @param {string} url - URL to decode
* @returns {Object} { code:string, state:string|undefined, issuer:string|undefined }
*/
function decodeCallbackURL(url) {
const params = (new URL(url)).searchParams;
const code = params.get("code");
if (!code) {
throw new TeslaAuthException("Incorrect URL, no code detected.");
}
const state = params.get("state") || undefined;
const issuer = params.get("issuer") || undefined;
return { code, state, issuer }
}
/**
* Exchange authorization code for bearer token
*
* @export
* @throws {Error} On error
* @param {string} code - Authorization code from successful Tesla SSO Sign In
* @param {string} code_verifier - codeVerifier from newSession()
* @param {string} [issuer=default_url] - Optional authentication base url
* @returns {Object} bearer token object
*/
async function bearerToken(code, code_verifier, issuer) {
try {
const url = joinURL("token", issuer || TESLA_AUTH_BASE);
const res = await request(
url,
{
method: "POST",
headers: { "Content-Type": "application/json" }
}, JSON.stringify({
grant_type: "authorization_code",
client_id: "ownerapi",
code,
code_verifier,
redirect_uri: TESLA_AUTH_REDIRECT
})
);
const token = JSON.parse(res.body);
token.issuer = issuer;
return token;
} catch (err) {
err.message = "Error fetching Tesla auhtorization token - " + err.message;
throw err;
}
}
/**
* Obtain a new authentication token from a refresh_token
*
* @export
* @throws {Error} On error
* @param {string} refresh_token - refresh_token previously collected from the Tesla authentication API
* @param {string} [issuer=default_url] - Optional authentication base url
* @returns {Object} Returns the Tesla server token response
*/
async function refreshToken(refresh_token, issuer) {
const url = joinURL("token", issuer || TESLA_AUTH_BASE);
const res = await request(
url,
{
method: "POST",
headers: { "Content-Type": "application/json" }
},
JSON.stringify({
grant_type: "refresh_token",
scope: "openid email offline_access",
client_id: "ownerapi",
refresh_token: refresh_token
})
);
return JSON.parse(res.body);
}
module.exports = {
TeslaAuthException,
TeslaAuthUnauthorized,
newSession,
decodeCallbackURL,
bearerToken,
refreshToken
};