Add SMS MFA support and refactor auth constants#86
Merged
Conversation
Adds support for SMS-based MFA in the Auth0 web login flow.
Detection: _handle_post_password_response() now raises
EcobeeAuthMfaRequiredError with mfa_type="sms" when Auth0
redirects to /u/mfa-sms-challenge, instead of the previous
EcobeeAuthUnknownError (unsupported) path.
Wrong-code handling: Auth0 returns HTTP 400 for a bad SMS code
(unlike TOTP which redirects back to the challenge URL). submit_mfa_code()
now checks resp.status_code == 400 before following redirects; the
redirect-back check is also widened to catch the SMS challenge path.
HAR analysis (sms.har, not committed): POST body is {state, code},
identical to TOTP. Wrong code: 400. Correct code: 302 to
/authorize/resume. No library changes needed for the token exchange step.
Updated unsupported-MFA message to reflect TOTP + SMS are now handled.
Added 3 tests: SMS challenge detection, SMS code submission success,
SMS wrong-code 400 mapped to EcobeeAuthFailedError.
pike00
commented
May 28, 2026
| ) | ||
| from .util import config_from_file, convert_to_bool | ||
|
|
||
| ECOBEE_REDIRECT_URI = "https://www.ecobee.com/home/authCallback" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/u/mfa-otp-challengeand/u/mfa-sms-challengelandings and routes to the appropriate Auth0 endpoint, raisingEcobeeAuthMfaRequiredErrorso callers can prompt the user.pyecobee/const.pyand addFinaltype annotations to every constant in the module.pyecobee/errors.py: section comments grouping auth / token / sensor errors and drop redundantpassstatements.scripts/manual_e2e.pyfor exercising the auth flow locally (including a wrong-code negative gate). Useful for verifying behavior against the live Auth0 endpoints without standing up the full test fixture..gitignoreto cover.venv/, HAR captures, local conf files, and notes generated during auth-flow debugging.Test plan
tests/test_auth.pycovers both OTP and SMS challenge paths, wrong-code rejection, and the token-exchange steppytest) against this branchscripts/manual_e2e.pyshould ship with the library or be dropped — happy to split that out if preferred