JavaScript/TS implementation of oauth2 for v3 - MFA

[ekmekcioglu]

Used puppeteer to login and intercept callback to get the code.

call authenticate with a passcode for MFA

import {encode} from "urlsafe-base64";
import crypto from "crypto";
import puppeteer from "puppeteer";
import url from "url";
import axios from 'axios';

interface TeslaToken {
    refresh_token: string,
    id_token: string,
    expires_in: number,
    state: string,
    token_type: string
}

export class TeslaTokenManager {
    private getAuthUrl(codeChallenge: string): URL {
        
        const teslaAuthUrl = new URL("https://auth.tesla.com/oauth2/v3/authorize/");

        teslaAuthUrl.searchParams.append("client_id", "ownerapi");
        teslaAuthUrl.searchParams.append("code_challenge", codeChallenge);
        teslaAuthUrl.searchParams.append("code_challenge_method", "S256");
        teslaAuthUrl.searchParams.append("redirect_uri", "https://auth.tesla.com/void/callback");
        teslaAuthUrl.searchParams.append("response_type", "code");
        teslaAuthUrl.searchParams.append("scope", "openid email offline_access");
        teslaAuthUrl.searchParams.append("state", "myteslaapp");
        return teslaAuthUrl;
    }

    async authenticate(username: string | undefined, password: string | undefined, passcode: string | undefined = undefined) {
        if (username == undefined || password == undefined)
            throw "username and password are required."
        
        return new Promise<TeslaToken>(async (resolve, reject) => {
            let browser = undefined;
            try {
                const codeVerifier = encode(crypto.randomBytes(86)).trim();
                const hash = crypto.createHash('sha256').update(codeVerifier).digest('hex');
                const buf = Buffer.from(hash, 'utf8');
                const codeChallenge = encode(buf).trim();
                
                const authUrl = this.getAuthUrl(codeChallenge);
                browser = await puppeteer.launch();
                const page = await browser.newPage();
            
                page.on('response', async (response) => {
                    if (response.status() === 302) {
                        const queryObject = url.parse(response.url(), true).query;
                        if (queryObject.code) {
                            const data = {
                                "grant_type": "authorization_code",
                                "client_id": "ownerapi",
                                "code": queryObject.code,
                                "code_verifier": codeVerifier,
                                "redirect_uri": "https://auth.tesla.com/void/callback"
                            }
                        
                            const response = await axios.post("https://auth.tesla.com/oauth2/v3/token", JSON.parse(JSON.stringify(data)), {
                                headers: {
                                    'Content-Type': 'application/json'
                                }
                            });
                            resolve(response.data as TeslaToken);
                        }
                    }
                })
                await page.goto(authUrl.href, { waitUntil: "networkidle2" });
                await page.$eval('input[name="identity"]', (el: any, val: any) => el.value = val, username);
                await page.$eval('input[name="credential"]', (el: any, val: any) => el.value = val, password);
                await page.$eval('#form', (form: any) => form.submit());
                
                if (passcode) {
                    await page.waitForSelector('input[name="passcode"]');
                    await page.$eval('input[name="passcode"]', (el: any, val: any) => el.value = val, passcode);
                    await page.click("#form-submit");
                    const passCodeFailurePromise = await page.waitForSelector(".tds-form-item--error");
                    const navPromise = page.waitForNavigation();
                    const x:any = await Promise.race([passCodeFailurePromise, navPromise]);
;                    if ((<any> x)._page)
                        throw "Invalid Passcode";
                }
                else
                    await page.waitForNavigation();
            } catch (error) {
                reject(error);
            }
            finally {
                if(browser) browser.close();
            }
        });
    }

    async refreshToken(teslaToken:TeslaToken) {

        const data = {
            'grant_type': 'refresh_token',
            'client_id': 'ownerapi',
            'refresh_token': teslaToken.refresh_token
        }
            
        const response = await axios.post("https://auth.tesla.com/oauth2/v3/token", data);
        return response.data;
    } 
}

[timdorr]

I would note that Puppeteer may not be functional in all environments, since it's hosting an entire Chromium process. But there is also resilience against changes to the frontend HTML by using that method, so it has its tradeoffs. Thanks for the contribution!

[Juzzio]

Hello, what shall I do, unfortunately Graphana stopped updating my drives I do not know what is going on, I have been able to login with my username and confirm with a token, but something is wrong

[IMgoRt]

Used puppeteer to login and intercept callback to get the code.

call authenticate with a passcode for MFA

import {encode} from "urlsafe-base64";
import crypto from "crypto";
import puppeteer from "puppeteer";
import url from "url";
import axios from 'axios';

interface TeslaToken {
    refresh_token: string,
    id_token: string,
    expires_in: number,
    state: string,
    token_type: string
}

export class TeslaTokenManager {
    private getAuthUrl(codeChallenge: string): URL {
        
        const teslaAuthUrl = new URL("https://auth.tesla.com/oauth2/v3/authorize/");

        teslaAuthUrl.searchParams.append("client_id", "ownerapi");
        teslaAuthUrl.searchParams.append("code_challenge", codeChallenge);
        teslaAuthUrl.searchParams.append("code_challenge_method", "S256");
        teslaAuthUrl.searchParams.append("redirect_uri", "https://auth.tesla.com/void/callback");
        teslaAuthUrl.searchParams.append("response_type", "code");
        teslaAuthUrl.searchParams.append("scope", "openid email offline_access");
        teslaAuthUrl.searchParams.append("state", "myteslaapp");
        return teslaAuthUrl;
    }

    async authenticate(username: string | undefined, password: string | undefined, passcode: string | undefined = undefined) {
        if (username == undefined || password == undefined)
            throw "username and password are required."
        
        return new Promise<TeslaToken>(async (resolve, reject) => {
            let browser = undefined;
            try {
                const codeVerifier = encode(crypto.randomBytes(86)).trim();
                const hash = crypto.createHash('sha256').update(codeVerifier).digest('hex');
                const buf = Buffer.from(hash, 'utf8');
                const codeChallenge = encode(buf).trim();
                
                const authUrl = this.getAuthUrl(codeChallenge);
                browser = await puppeteer.launch();
                const page = await browser.newPage();
            
                page.on('response', async (response) => {
                    if (response.status() === 302) {
                        const queryObject = url.parse(response.url(), true).query;
                        if (queryObject.code) {
                            const data = {
                                "grant_type": "authorization_code",
                                "client_id": "ownerapi",
                                "code": queryObject.code,
                                "code_verifier": codeVerifier,
                                "redirect_uri": "https://auth.tesla.com/void/callback"
                            }
                        
                            const response = await axios.post("https://auth.tesla.com/oauth2/v3/token", JSON.parse(JSON.stringify(data)), {
                                headers: {
                                    'Content-Type': 'application/json'
                                }
                            });
                            resolve(response.data as TeslaToken);
                        }
                    }
                })
                await page.goto(authUrl.href, { waitUntil: "networkidle2" });
                await page.$eval('input[name="identity"]', (el: any, val: any) => el.value = val, username);
                await page.$eval('input[name="credential"]', (el: any, val: any) => el.value = val, password);
                await page.$eval('#form', (form: any) => form.submit());
                
                if (passcode) {
                    await page.waitForSelector('input[name="passcode"]');
                    await page.$eval('input[name="passcode"]', (el: any, val: any) => el.value = val, passcode);
                    await page.click("#form-submit");
                    const passCodeFailurePromise = await page.waitForSelector(".tds-form-item--error");
                    const navPromise = page.waitForNavigation();
                    const x:any = await Promise.race([passCodeFailurePromise, navPromise]);
;                    if ((<any> x)._page)
                        throw "Invalid Passcode";
                }
                else
                    await page.waitForNavigation();
            } catch (error) {
                reject(error);
            }
            finally {
                if(browser) browser.close();
            }
        });
    }

    async refreshToken(teslaToken:TeslaToken) {

        const data = {
            'grant_type': 'refresh_token',
            'client_id': 'ownerapi',
            'refresh_token': teslaToken.refresh_token
        }
            
        const response = await axios.post("https://auth.tesla.com/oauth2/v3/token", data);
        return response.data;
    } 
}

This looks excellent, but any idea how I would implement this in node?
Is this saved as authentice.js and called with some parameters?

Tanks

[jorenvandeweyer]

@IMgoRt I made a basic implementation without puppeteer for Node.

NodeJS (TS) Implementation for /oauth2/v3 (with optional MFA)

[JulesStringer]

I spent the weekend following and trying to implement this, and have the puppeteer version working under node in a service running under UBuntu.
I have existing code written in js, which runs under node.
The key steps for me were:

1. Put the code in a file say auth.ts
2. Compile to js with tsc
   tsc auth.ts
3. Gives you auth.js
4. Modify your existing code as follows:
   const auth = require('./auth.js');
   .....
   var mgr = new auth.TeslaTokenManager;
   mgr.authenticate(,).then(
   // come here on success
   function(teslatoken){
   // Post a request to https://owner-api.teslamotors.com/oauth/token as before,
   // except that grant_type: 'urn-ietf:params:oauth:grant-type:jwt-bearer'
   // Authorization header is 'Bearer ' + teslatoken.access_token
   },
   // come here on error
   function(error){
   console.log(error.toString());
   }
   );
   This is using the puppeteer version, but I think the non-puppeteer version will be the same in principle,

I used the puppeteer version as it looked simpler, once I had puppeteer installed including lots of missing references it worked correctly run under my user account, however it failed when run as a service using the root account because chrome will not run under root unless call launch with the no sandbox option. Got round this by setting up a separate account too run the service.

Using puppeteer to get the access token is slow because it has to start chrome, so better cache the returned token and only fetch it again when near its expiry time,

[IMgoRt]

... so better cache the returned token and only fetch it again when near its expiry time,

Thanks for this, I have a valid refresh token, is there a simple way to refresh with MFA enabled but without user intervention - I'm guessing there is as TeslaMate has published a version that is expected to work, I had to re-accredit and MFA but the documentation implies that's it?

[claytonn73]

If you have the refresh token then it is a "relatively" simple matter even with MFA enabled to check the expiration of the authentication token every time you use it and if say within 3600 seconds to perform the refresh process and store and use the new authentication token.

The high level process in python roughly based on mlowijs/tesla_api is shown here - not had chance to tidy up and upload anything yet.

async def authenticate(self):
    if self.check_token_expiration() is True:
        await self.refresh_token()
        # Send token to application via callback.
        if self._new_token_callback:
            asyncio.create_task(self._new_token_callback(json.dumps(self._token)))
    return True

async def refresh_token(self):
    # Get tokens from the token file which contains both oauth and authentication tokens
    if self.check_token_expiration() is True:

        access_token = await self.get_access_token(self._token["oauth_token"]["refresh_token"])

        if access_token is not None:
            new_token = await self.get_authentication_token(access_token)

        if new_token is not None:
            self._token["authentication_token"] = new_token

[JulesStringer]

I don't know as my usage is personal only and I haven't set up MFA as it would break my service. I suppose I might be forced to do this in future. According to https://www.tesla.com/en_GB/support/multi-factor-authentication?redirect=no you need to register a mobile device to receive a code, so I don't see practically how it would work without user intervention, In my application I have a web page that interacts with the server, so I could generate a warning when the token was near to expiry and ask the user to initiate the MFA process, including entering the code from the mobile. I see TeslaMate has added a sign out button, which suggests that the solution has to be user interface based.

What I meant by cache the returned token was just keep a copy of the data returned from https://owner-api.teslamotors.com/oauth/token (say in a variable called token) and then compare the time with token.created_at + token.expiresin , if the current time is significantly less that this sum, then you can use token.access_token , otherwise go through the whole process again.

[IMgoRt]

I don't know as my usage is personal only and I haven't set up MFA as it would break my service. I suppose I might be forced to do this in future. According to https://www.tesla.com/en_GB/support/multi-factor-authentication?redirect=no you need to register a mobile device to receive a code, so I don't see practically how it would work without user intervention, In my application I have a web page that interacts with the server, so I could generate a warning when the token was near to expiry and ask the user to initiate the MFA process, including entering the code from the mobile. I see TeslaMate has added a sign out button, which suggests that the solution has to be user interface based.

What I meant by cache the returned token was just keep a copy of the data returned from https://owner-api.teslamotors.com/oauth/token (say in a variable called token) and then compare the time with token.created_at + token.expiresin , if the current time is significantly less that this sum, then you can use token.access_token , otherwise go through the whole process again.

Hi,
I save the token and interrogate with my application, I accidentally expired the token and refresh token yesterday but can regenerate both at https://registration.teslatasks.com/generateTokens without issue and inserting the token.created is straightforward.

TelsaMate asked you to sign out and back in again with MFA but it reads to me that was a one time function, TeslaLogger (which TM is forked from) didn't require a logout/in.
I'm hoping that the refresh token (which is indicated to never expire) will be enough for my purpose.
TeslaJS has been forked by the dev who is working on the problem now (I use potions of the code in my app)

It's not too much to generate new tokens every 44.9 days ;-)