All Requests are Failing with "Request Failed with status 400 - Bad Request" Even with Updated Key

All requests are failing with "Request Failed with status 400 - Bad Request". Updated key in https://github.com/samrum/OnStarJS/pull/232 does not seem to make a difference.

Why are they SOOO upset that we can interface with their API faster than the terrible MyGMC/Chevrolet app? The apps are so incredibly slow, it is so much faster to bring is all in to HomeAssistant and use that for remote starting and such. We seem to lose access to the API every couple weeks though.
Do we know if this is them shutting us out of the API or simply them changing it? I believe the API is not officially documented or open and this was all reverse engineered right?

I started doing the homeassitant > node red implementation myself because of gm dropping support for google home (big thanks Bigthundersr by the way). The least they can do is is not be insufferable about their API access when their own web developers can't code their website to unhide authenticator elements properly.

Why are they SOOO upset that we can interface with their API faster than the terrible MyGMC/Chevrolet app? The apps are so incredibly slow, it is so much faster to bring is all in to HomeAssistant and use that for remote starting and such. We seem to lose access to the API every couple weeks though.

I also like the API being faster, but it's so much more than that. Integrating into Home Assistant lets me issue a warning if we arm the security system at night while the car is still plugged in (don't want it to catch fire while we're asleep) or early in the morning if I forgot to charge it. It sends me an email to put air in the tires if needed. I'm on my second Bolt, but if GM doesn't want me to use the API, I will switch to a different brand when my lease is up in a couple of months.

@joelvandal @coelho I know you two were a big help with the last big issue we had, anything you guys would be able to take a look at?

Is "appId" and  "appSecret" in src/onStarAppConfig.json something we should be making unique in every deployment of this library like device UUID's? Is it possible that all these unique instances are showing up as one "device" and then that's what causing it to get blocked? (due to the total number and frequency of requests?)
I ask not being too familiar with how the reverse engineering works.
My only other question is, what if we ask GM directly? or is there enough trepidation that they would outright deny this by making it harder for the api requests to function? https://www.onstar.com/business-solutions/api-data-services

All requests are failing with "Request Failed with status 400 - Bad Request". Updated key in #232 does not seem to make a difference.

@BigThunderSR: I think that #232 was updated earlier today (Monday, 10/2/23) with another new key pair. Have you been able to test if that gets it working again?

Bummer!
Thanks for trying!
-Brett
From: BigThunderSR @.>
Sent: Monday, October 2, 2023 6:50 PM
To: samrum/OnStarJS @.>
Cc: Brett Bowman @.>; Manual @.>
Subject: Re: [samrum/OnStarJS] All Requests are Failing with "Request Failed with status 400 - Bad Request" Even with Updated Key (Issue #233)
All requests are failing with "Request Failed with status 400 - Bad Request". Updated key in #232https://github.com/samrum/OnStarJS/pull/232 does not seem to make a difference.
@BigThunderSRhttps://github.com/BigThunderSR: I think that #232https://github.com/samrum/OnStarJS/pull/232 was updated earlier today (Monday, 10/2/23) with another new key pair. Have you been able to test if that gets it working again?
I tried it earlier today even though I knew it wouldn't work either and it did not work as expected.
We need @samrumhttps://github.com/samrum and others to figure out what changed in the API and make the necessary modifications to OnStarJS to make things work again. Thanks.
—
Reply to this email directly, view it on GitHubhttps://github.com/samrum/OnStarJS/issues/233#issuecomment-1743931727, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AEEJW7OMH7WYTFNZSCBY57TX5NHKRAVCNFSM6AAAAAA5J3RWYCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONBTHEZTCNZSG4.
You are receiving this because you are subscribed to this thread.Message ID<EMAIL_ADDRESS>

Between #214 and #208, I am trying to get SSL pinning setup to be able to see the requests in real time. Having issues getting the app just to work on Genymotion

Yea I cant even get the normal app to work on Genymotion before I add anything else to the "device". Any help would be appreciated.

Flespi.com seems to have a [Changelog] general-motors-onstar protocol.
The last entry there (from 4 days ago) says:
general-motors-onstar protocol has been updated, new parameters added:

EHPE - flespi name position.accuracy
AGEIND - flespi name position.valid

That probably does indicate/confirm that there was a recent change to the OnStar API. Those items seems to only relate to getting location, not the authentication call. But maybe it is at least some clue.

I think the reason for the 400 / bad_application is that they now require the X-Firebase-AppCheck header on the auth endpoints for the request to go through.
The value for that header comes from that thing:

https://firebase.google.com/docs/app-check
https://firebase.google.com/docs/app-check/android/play-integrity-provider

@BennyDaBee am trying a physical device. Genymotion out the box wont pass safety net / PI. Have messed around a bit with magisk/zygisk but no luck. Will try physical device.

Im working on getting a Android device to root. I am an iOS person myself so I did not have any on hand. I should have one tonight/tomorrow to be able to test.

I don't think it's all about the Google app-check blocking us. GM does offer partner API access for fleets. I've reached out their business fleet API people and asked if there is any free API access include for personal use with our OnStar membership. We'll if they reply. I seem to recall applying for GM API access before and never hearing back.

The thing is this project uses  (sort of) public client credentials from their android app, fleet customers will have their own credentials that come with their own rules applied to them. I have tried and I know that passing a valid app-check token in that Firebase header will make the token request work again.
My guess is that GM saw that people were using this reverse engineered API for free and they looked for a quick way to put an end to that by adding app check. I guess thats also why its only on the token endpoint. No token, no service.

That is the pits.. It's such a small subset of users you'd really think it shouldn't be a bit deal to them. I'm sure what they are worried about is someone making money off it. What would be nice is if we could get our own private set of client credentials we could use based off our OnStar subscription. That way it would be unique for each of us, and they wouldn't have to worry, and we'd have our own private API access. I can't see them making a code change like that out of the kindness of their hearts for such a small subset of users though.

Just spitballing here, I was able to sign up for the GM developers site for making in vehicle apps, I wonder if we can get a client ID for access to the API by "designing" an in vehicle app? I've requested commercial API access through there as well now, I won't be holding my breath though.

@nilathedragon Just for future issues that may arise, how did you go about the SSL Pinning to grab the request credentials for iOS?

I do all my iOS work using Frida and Objection. You are able to get around their SSL pinning easily using one of the publicly available Frida scripts.
I chose a different route though, I hooked the systems cryptography API's and caught the credentials there. Once again, there are publicly available Frida scripts for this too :)

Thanks @nilathedragon !

Thank you @nilathedragon !! Good job! I can confirm, I recreated my containers and re-pulled with bigthundersr/onstar2mqtt:latest and all is right in the world again. Hopefully one day GM will let us get access to our own personal client id for personal use and we can do this offically,

Also back in business.  Thanks everyone, happy again 👍👍

As far as I can see, there was no update to the iOS app. Last updated Oct. 2nd
So they must flag something else. I will look into it.

I noticed that on some accounts the token we get from logging in does not have the "onstar" scope, even though it was requested. This is also true for the official app though. Could you check your token (using jwt.io or similar) and see if it contains the onstar scope?

Issue has not seemed to have returned to me on my fork.

I noticed that on some accounts the token we get from logging in does not have the "onstar" scope, even though it was requested. This is also true for the official app though. Could you check your token (using jwt.io or similar) and see if it contains the onstar scope?

Here's what I see for scope:
"scope": "gmoc priv"

Its missing the "onstar" scope, what really weirds me out is that not all accounts do this.

My official app is treating me as a new customer this morning. Looks like it's going to require me to press the blue OnStar button in the car to do an initial setup.

Already tried logging out and back in, didn't work. I called Onstar and the "connection specialist" told me that everyone got unlinked from their accounts last night.  They are flooded with calls, and for most of them, at least, there is no alternative but for Onstar to manually relink the account.  They did that for mine, but the app still doesn't work. Right now I am in the process of resetting the car (turn off car, open and close door, sit 3 minutes then turn car back on) and the specialist is supposed to call me back.

Already tried logging out and back in, didn't work. I called Onstar and the "connection specialist" told me that everyone got unlinked from their accounts last night. They are flooded with calls, and for most of them, at least, there is no alternative but for Onstar to manually relink the account. They did that for mine, but the app still doesn't work. Right now I am in the process of resetting the car (turn off car, open and close door, sit 3 minutes then turn car back on) and the specialist is supposed to call me back.

Thank you for sharing! Please do keep us posted about how they are resolving this :)

Following the car reset, both the app and the API are now working again. I didn't have to log out of the app for it to start working.

Well that's interesting.. Got an email from GM this morning saying a password reset is required. My password is still working on the app and the website, but my container is failing with "Request Failed with status 429" now. I have not reset my password yet, but I guess I'll have to give it a try. They really don't like us using the API for "free" I think, even though we pay $15 a month per vehicle to do so.

Well, I'm not sure now. Must not like the number of request coming through or something. I didn't reset the password, but I sent an unlock command and it still went through. So I guess I'll leave it for now.

@BigThunderSR A bit delayed since I was away last week, but here it is: https://github.com/samrum/OnStarJS/pull/237

I'm still seeing 429 errors on the new version (polling every 10 mins).

Got it. Will back off. Has anyone worked out what the maximum polling interval is?

@nilathedragon, it looks like the current keys have expired, so could you please assist? Thanks!

I was setting this up this morning and it worked like 3 hours ago and 2 hours ago stopped working with "Request Failed with status 400 - Bad Request". Not just me then?

I wonder if it's related to this? Might be a casualty to GM terminating access to the vendors.
https://arstechnica.com/cars/2024/03/gm-stops-sharing-driver-data-with-brokers-amid-backlash/

I used my homebridge onstar plugin earlier this afternoon and now it seems it isn’t working. Getting bad request 400 error. Is anyone else having an issue?

Its a common error to happen once in a while. OnStar/GM rotates some secret values every app update and disables the old ones.
Anyways: https://github.com/samrum/OnStarJS/pull/249

Its a common error to happen once in a while. OnStar/GM rotates some secret values every app update and disables the old ones.
Anyways: #249

Will it resolve on its own?

Its a common error to happen once in a while. OnStar/GM rotates some secret values every app update and disables the old ones.

Anyways: #249

Will it resolve on its own?

No, but my pull request will.

Its a common error to happen once in a while. OnStar/GM rotates some secret values every app update and disables the old ones.

Anyways: #249

Will it resolve on its own?

No, but my pull request will.

I’m not sure what that means, I’ve never had to do this before. Can you explain what I need to do to get it working again?

Its a common error to happen once in a while. OnStar/GM rotates some secret values every app update and disables the old ones.

Anyways: #249

Will it resolve on its own?

No, but my pull request will.

I’m not sure what that means, I’ve never had to do this before. Can you explain what I need to do to get it working again?

We need to wait for a new version of OnStarJS to be released which includes the mentioned PR #249.

Ok thanks you for the info. So will the homebridge app show an update when it’s ready?

As requested: #252

Do we have to do an update of the homebridge Onstar plugin?

@nilathedragon, we are two versions behind again, so could you please provide the updated keys? Thanks!

Sure: https://github.com/samrum/OnStarJS/pull/253

@nilathedragon, we are two versions behind again, so could you please provide the updated keys? Thanks!

Sure: #253

I wonder if there is a way would could implement a web lookup to retrieve the key and use it, instead of having to do a pull request every time GM decides to change it? Could even have a process that checks if it's changed, and if so so restarts with the new key.

Wow, we got like 3 months out of it this time. Maybe their devs are slowing down. lol

@joelvandal I found the same ic_onstar file. It's a webp image. If you add .webp to the end you get this:

(converted to PNG because GitHub doesn't allow WEBPs)

The latest jailbreakable version for iPhone 13 is 16.5 💔

@joelvandal I have a jailbroken iphone 7 running the latest mychevy app. I've successfully disabled ssl pinning and captured data with mitmproxy. Maybe we can collaborate?

It will be a pleasure to collaborate! If you have any trace, you can send it to me by email ? joel[at]vandal.ca

Sent!
It looks like the API's signed JWT is signed remotely now by a microsoft OAUTH2.0 provider. The flow I sent should show the whole process for initial app sign-in through to API requests.
Since this seems to be standards-based (OAUTH2) maybe we have a chance of a more permanent auth solution in the end. Hopefully you or someone else is more familiar with the oauth stuff than I am!

@metheos  @joelvandal
Any progress in getting a current access key?

Any progress in getting a current access key?

I've been able to determine that they're using an openid workflow using PKCE combined with an Azure AD B2C custom policy. I've got a partial auth process built in nodejs using openid-client, but haven't generated a workable token yet.

Ok. I dug in my heels and I have a working proof of concept in a little nodejs project. Who do I need to get this in front of in order to get it integrated into onstarjs? Because I don't have the energy to figure that part out.
 data: {
    commandResponse: {
      requestTime: '2024-11-13T23:49:58.681Z',
      url: 'https://na-mobile-api.gm.com/api/v1/account/vehicles/<VIN REDACTED>/requests/56367644735',
      status: 'inProgress',
      type: 'diagnostics'
    }
  }

I published it here. It's a mess, but it works 😪
https://github.com/metheos/node-oauth2-gm

@metheos Very nice! Do you have a "buy me a coffee" link or something like that?

@CamSoper  Thanks! Yeah! I've added it to my github profile 🙏

@metheos Just to make sure that I am reading this correctly, it is automatically getting the MFA code without user intervention correct?

No, it's prompting with a readline for the mfa code from the user's email.
Not sure how it could be done without user intervention without adding some code to access a user's email account 🙃
The good news is that once you do the MFA part you get a token from the microsoft side of things that is good as long as you keep refreshing it before the refresh token expires. Typically these refresh tokens renew their expiration after each refresh, and this one looks to be good for 90 days.

@metheos Just to make sure that I am reading this correctly, it is automatically getting the MFA code without user intervention correct?

No, it's prompting with a readline for the mfa code from the user's email. Not sure how it could be done without user intervention without adding some code to access a user's email account 🙃 The good news is that once you do the MFA part you get a token from the microsoft side of things that is good as long as you keep refreshing it before the refresh token expires. Typically these refresh tokens renew their expiration after each refresh, and this one looks to be good for 90 days.

I guess im just curious how this going to play out for anyone that implements this into docker containers.

I guess im just curious how this going to play out for anyone that implements this into docker containers.

Yeah, me too! I'm not sure how long the codes are good for, but probably like.. 30 minutes?
It would be a little finnicky, and I'm sure there are better solutions... but there could just be another env var for the MFA code and the docker container stops after requesting the code so that you can enter it and restart it. or something along those lines.

I would assume it has to be like any other terminal implementation of 2fa where it will sit there and ask for the code that it requested from the authpoint. I would hope if your deploying a docker container you are able to access the terminal for it in some capacity.

My idea is to add a kind of "webservice", I send the command to HTTP server, if a MFA code is required, it send it to the client, then on another request, it do a "POST" with the code, and script continue where left and generate the token.

That I would think would be based on implementation at that point no? So for BigThunder's projects for example it would map to whatever the endpoints in OnStarJS is for recognizing an MFA code is needed and than providing the endpoint the code from whatever means are provided by the project. In NodeRed that would be in the config menu where as in Home Assistant that would be a pop up window for example.

I pushed some commits to my code that adds some comments and cleans up the logging to make it clearer where each step is happening. I also moved the variables to a .env file.
I'm not bothering to store the GM API token outside of memory since it's only good for 30 minutes and a new one can be generated at startup using the persistent tokens from the MS oauth part.
MFA should be a one-time thing until something changes on the GM side.

@BigThunderSR  that's all it does, just the initial request to prove that the authentication token is good.

Nice work @joelvandal !
Just FYI I pinned openid-client at the last v5 release because v6 had breaking changes I was too lazy to figure out.

Now I need to figure how to retrieve list of vehicles since we need to pass VIN on getGMAPIToken function.

You should only need the VIN when sending commands, it's not needed to get the GM API Token.
I see you found the API endpoint that returns the available vehicles, but you can also get the available VIN information from the GM API Token without querying the API at all.
{
  ...
  "scope": "gmoc priv user_trailer user role_owner onstar",
  ...
  "vehs": [
    {
      "vin": "<MY MAIN VEHICLE VIN>",
      "per": ...
    },
    {
      "vin": "<SHARED VEHICLE VIN>",
      "per": ...
    }
  ]
}

@joelvandal @metheos
I had posed a question to @BigThunderSR in his own repo for the node-red project to prevent off topic clutter however it rounds back anyways. https://github.com/BigThunderSR/node-red-contrib-onstar2/issues/271
What's the feasibility of modifying both code bases here to either pipe the new auth method into OnStarJS or to reconjigure the new code base to make the functions, file names, and endpoints similar enough that existing projects leveraging OnStarJS don't need to go through complete rewrites?
Apologies if this is already being consider and/or actively being worked on.

pardon my ignorance, this sounds great above, is this something that can/will flow down to things like homebridge-onstar? I appreciate all of you devs and your work with this!

Thank you so much guys for your effort in making this work!
Would it be possible for someone to send me a code snippet on how to use this? Because When I try to run it with<EMAIL_ADDRESS>I'm getting a 400 bad reqeust when fetching "https://na-mobile-api.gm.com/sec/authz/v3/oauth/token"

I just realized we can make the authentication fully hands-off if we use the 3rd party authenticator option for MFA!
It's a standard TOTP SHA1 algorithm. You'd just need to supply the TOTP key from your authenticator app so the codes can be generated during the authentication process.
I'll test this out later today, but I can't see why it wouldn't work. This feels like the way forward for automated implementations like homeassistant, etc.

Updated my test code to use TOTP.
This enables fully automated authentication. This should simplify replacing existing functions in OnStarJS.
You will need to change your account's MFA method to "Third-Party Authenticator App" and use an authenticator app that allows you to view your TOTP secrets so you can provide it in .env.
https://www.chevrolet.com/myaccount/security
Loading existing MS tokens, if they exist.
Doing auth discovery
No existing tokens found or were invalid. Doing full auth sequence.
Starting PKCE auth
Doing auth discovery
got PKCE code verifier: <REDACTED>
Response Status: 200
Sending GM login credentials
Response Status: 200
Loading MFA Page
> Response Status: 200
Submitting OTP Code: <REDACTED>
Response Status: 200
Requesting PKCE code
Doing auth discovery
Access Token: <REDACTED>
ID Token: <REDACTED>
Saving MS tokens to  ./tokens.json
Loading existing MS tokens, if they exist.
Doing auth discovery
MS Access token is still valid
Saving current MS tokens to  ./tokens.json
Requesting GM API Token using MS Access Token
Response Status: 200
Set GM Token expiration to<PHONE_NUMBER>
{
  access_token: 'REDACTED',
  token_type: 'bearer',
  issued_token_type: 'urn:ietf:params:oauth:token-type:access_token',
  expires_in: '1798',
  scope: 'gmoc priv user_trailer user role_owner onstar',
  onstar_account_info: { account_no: 'REDACTED', country_code: 'US' },
  errors: null,
  expires_at:<PHONE_NUMBER>
}
Testing GM API Request
...
  data: {
    commandResponse: {
      requestTime: '2024-11-18T20:39:21.662Z',
      url: 'https://na-mobile-api.gm.com/api/v1/account/vehicles/<REDACTED>/requests/40810864298',
      status: 'inProgress',
      type: 'diagnostics'
    }
  }

@metheos
One thing of note, my Canadian GM account doesn't seem to support an Authenticator App unfortunately.

@metheos
One thing of note, my Canadian GM account doesn't seem to support an Authenticator App unfortunately.

@evilpig Try to log with https://my.gm.ca ... I see 3rd party authentication

Ah, I see it in Desktop mode and on my PC. Something seems to be very wrong with the GM Portal. I was able to disable email 2FA. But when I click on Authenticator to start the process, it directs me to https://accounts.gm.com/delete/review?error=redirect_uri_mismatch&error_description=AADB2C90006%3A+The+redirect+URI+'https%3A%2F%2Fwww.gmccanada.ca%2Fen%2Fmyaccount%2Fsecurity'+provided+in+the+request+is+not+registered+for+the+client+id+.... redacted part of the url. Then it redirects me to www.cadillac.com. Very strange. Just figured I'd share! Thanks for all the work everyone is doing to get this going again.

Just confirming that it was not available for me on mobile but WAS available on desktop (once email 2FA was disabled)

@joelvandal Hi, firstly, thank you for all your hard work.
I've cloned your repo and i am trying to test this in my environment. I am running the server locally and using postman to make the POST calls to the node endpoints.
When I make the POST to /auth with my email and password, I get a 200 response and a success message, but when looking at the Node terminal, it looks like axios received a 500 error from the GM endpoint, is that normal?
As i work through the chain of POST calls, I also see another axios 500 error when submitting my MFA code, and finally when i POST to /vehicles, i get a 404 response and the message says "Tokens not found", so even though i am receiving success messages back from the node endpoints, it doesnt look like the communication with the GM api is successful. Any tips?

@joelvandal Ahh, sorry I skimmed through this thread and thought the OTP method was implemented already. I switched back to email and it looks to be working correctly. I'll keep monitoring to see if you're able to implement OTP, my ideal flow would be to stand this up on its own in a docker container alongside 2fauth. Then, theoretically, i could use Node-Red/Home Assistant to grab the OTP from 2fauth api, and submit during the authentication automatically. Really excited about this, thanks again and thanks @metheos for your hard work too.

require to have an application that allow to view the secret key (Google Authentication dont' allow

FWIW I'm using https://stratumauth.com/
I think it's android only though, not sure which authenticator apps on ios make it simple to view your secrets.
I know with google authenticator you can use the transfer function to get a QR code that contains the secret, then you have to read that QR code to get the key in plaintext.

oh, wow @mdezzi that's a great tip!

👀
 PASS  test/functional/OnStarJs.test.ts (21.812 s)
  OnStarJs
    √ Unupgraded Command Successful (1196 ms)
    √ Upgraded Command Successful (785 ms)
    √ Diagnostics Request Successful (18358 ms)

Test Suites: 1 passed, 1 total
Tests:       3 passed, 3 total
Snapshots:   0 total
Time:        21.916 s

👀 I've got a working fork over here. Does anyone know which commands the PIN is used for? I ran the functional test for an upgraded command and it didn't seem to try and upgrade the token, and it passed. I just have the upgrade function throwing an error for now because I'm not sure what it's supposed to do.
Is this implementation currently only using TOTP?
Also for reference, you can store and copy information for TOTP in and out of Bitwarden/Vaultwarden.

Is this implementation currently only using TOTP?
Also for reference, you can store and copy information for TOTP in and out of Bitwarden/Vaultwarden.

Thanks!
Yes, I'm not currently interested in supporting SMS or Email MFA methods as it will complicate any project already using OnstarJS by requiring user input for MFA.
Good to know for Bitwarden/Vaultwarden users 👍

I've been trying to reverse engineer what @metheos and @joelvandal have accomplished so i can rewrite the auth flow in python (mostly for practice). I am absolutely staggered at what has been reverse engineered in this API without any real documentation. After about 3 hours of hacking away i've received my token!

I must be doing something wrong, i've received tokens by duplicating the steps in @metheos 's OTP flow, and also by spitting out the token after receiving it from @joelvandal 's email OTP flow. They look to be pretty much identical when decoding and inspecting the tokens with jwt.io.
However when i try to use any tokent to send a GET request to https://na-mobile-api.gm.com/api/v1/account/vehicles i just receive a 401: Unauthorized every time. I am sending the Bearer {TOKEN} in the auth header, and I am reusing all the headers that i was able to find in the JS packages.
If i send a call to localhost:3000/vehicles, @joelvandal 's webservice does return data, and it should be using the same exact token, so i'm not sure what i'm missing in my call. Any ideas??

This is certainly sounding very promising.
But something I am noticing from the Canada side of things; we have a lot of the same interactions as US customers; but all our login endpoints are ending in “.ca”. I can’t enable application based MFA since it redirects to the US site and then tries to log me in as a GM employee. It might be worth noting Canada auth procedure is currently different than US auth procedure. There’s other peculiarities throughout with the accounts.
Hopefully we get an upgrade on our side of the border. Maybe even their app will work properly again.

can’t enable application based MFA

I've been thinking about this today, and I think I have a solution.
Once I've got some confirmation that all the kinks are worked out in the totp version I've got going, I could create a companion tool that generates the Microsoft token set (this is the part that requires MFA). Then you would be able to provide that token set to OnStarjs for creating the GM API tokens.
I think this would be fine long term since the MFA is a one time thing on the app. I think the ms tokens don't expire at long as you're using them.

can’t enable application based MFA

I've been thinking about this today, and I think I have a solution. Once I've got some confirmation that all the kinks are worked out in the totp version I've got going, I could create a companion tool that generates the Microsoft token set (this is the part that requires MFA). Then you would be able to provide that token set to OnStarjs for creating the GM API tokens.
I think this would be fine long term since the MFA is a one time thing on the app. I think the ms tokens don't expire as long as you're using them regularly.

Microsoft auth tokens are long lived assuming that they are regularly refreshed (I don't remember the exact window, and it also depends on the application but typically it's no more than 2 weeks before a token can no longer be refreshed) but they also can be invalidated or expired if the return check fails at any point or they are forced de-authed on the portal side.
Federation and the newer changes as of late with the new MFA implementation for third party sso and MFA solutions can and will change these variables.

Even if a user's tokens happen to get revoked or expire it will still probably be easier to generate new ones than wait for one person to extract a symmetric key from an app and update a repo 🤣 every 2 months

Can someone provide an example of what the TOTP looks like? is it just a string of letters and numbers? In the Passwords app on ios, there's an option to view the setup url and it has a secret in it. just not sure what all i have to put in. the secret alone didn't seem to authenticate

I may have spoke too soon, looks like my values are showing up!

@metheos I can confirm that I can obtain the TOTP in iOS Passwords app by tapping "Copy setup URL" and getting the secret from that (if you wanted to add that to your readme :)

Updated my test code to use TOTP. This enables fully automated authentication. This should simplify replacing existing functions in OnStarJS. You will need to change your account's MFA method to "Third-Party Authenticator App" and use an authenticator app that allows you to view your TOTP secrets so you can provide it in .env. https://www.chevrolet.com/myaccount/security
Loading existing MS tokens, if they exist.
Doing auth discovery
No existing tokens found or were invalid. Doing full auth sequence.
Starting PKCE auth
Doing auth discovery
got PKCE code verifier: <REDACTED>
Response Status: 200
Sending GM login credentials
Response Status: 200
Loading MFA Page
> Response Status: 200
Submitting OTP Code: <REDACTED>
Response Status: 200
Requesting PKCE code
Doing auth discovery
Access Token: <REDACTED>
ID Token: <REDACTED>
Saving MS tokens to  ./tokens.json
Loading existing MS tokens, if they exist.
Doing auth discovery
MS Access token is still valid
Saving current MS tokens to  ./tokens.json
Requesting GM API Token using MS Access Token
Response Status: 200
Set GM Token expiration to<PHONE_NUMBER>
{
  access_token: 'REDACTED',
  token_type: 'bearer',
  issued_token_type: 'urn:ietf:params:oauth:token-type:access_token',
  expires_in: '1798',
  scope: 'gmoc priv user_trailer user role_owner onstar',
  onstar_account_info: { account_no: 'REDACTED', country_code: 'US' },
  errors: null,
  expires_at:<PHONE_NUMBER>
}
Testing GM API Request
...
  data: {
    commandResponse: {
      requestTime: '2024-11-18T20:39:21.662Z',
      url: 'https://na-mobile-api.gm.com/api/v1/account/vehicles/<REDACTED>/requests/40810864298',
      status: 'inProgress',
      type: 'diagnostics'
    }
  }

You don't even need an app that sees the secret, if on https://www.chevrolet.com/myaccount/security , after enabling 3rd party authentication, at the QR screen, you can hit a button below that it isnt working which gives you your TOTP account name and key right there.  You can then put that into an authenticator app and your onstarjs config.

Updated my test code to use TOTP. This enables fully automated authentication. This should simplify replacing existing functions in OnStarJS. You will need to change your account's MFA method to "Third-Party Authenticator App" and use an authenticator app that allows you to view your TOTP secrets so you can provide it in .env. https://www.chevrolet.com/myaccount/security

You don't even need an app that sees the secret, if on https://www.chevrolet.com/myaccount/security , after enabling 3rd party authentication, at the QR screen, you can hit a button below that it isnt working which gives you your TOTP account name and key right there. You can then put that into an authenticator app manually and your onstarjs config.

THANKS FOR THIS! I have my secret now. Looking forward to having homebridge-OnStar working again.

I too am having issues setting up 3rd party with my Canadian account. I can disable Email, see the 3rd party option, turn it on, but once "Getting Started" is selected I fall into some sort of Microsoft Account black hole. Using the US website doesn't seem to be an option either.

ing issues setting up 3rd party with my Canadian account. I can disable Email, see the 3rd party option, turn it on, but once "Getting Started" is selected I fall into some sort of Microsoft Account black hole. Using the US website doesn't seem to be an option either.

@joeladria
I have exactly same issue .. worked only 1 time few days ago, now I'm redirected to /detour page (404 not found) or redirected to Microsoft Account but give an error that I don't have a "live" account, etc...

Tried incognito Safari & Chrome
Tried disabling adblockers
Tried allowing 3rd party cookies because GM seems to like those.
Tried logging in with my Live account.
I feel like the IT guy for the Canadian side just didn’t setup his side of the TOTP Azure settings!

@metheos I can confirm that I can obtain the TOTP in iOS Passwords app by tapping "edit" and then "Copy setup URL" and getting the secret from that (if you wanted to add that to your readme :)

Thanks, I've added this info to the readme in my branch.

I've installed the newest version and have included my TOTP, however on startup I'm seeing:
Authentication failed: Error: Invalid base32 character in key     at TOTP.base32tohex (/app/src/deps/index.cjs:34463:23)     at TOTP.generate (/app/src/deps/index.cjs:34439:32)     at GMAuth.<anonymous> (/app/src/deps/index.cjs:34569:34)     at Generator.next (<anonymous>)     at fulfilled (/app/src/deps/index.cjs:43:58)     at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
Anyone else getting this?

I have no option to enable authenticator app. Only SMS & email. I'm in the US. I tried on cadillac.com, chevrolet.com, and my.gm.com. I also tried in incognito mode, no luck.

Same thing here in canada. I try to look on ios password but i have nothing special in the url

Do you know if the topt looking like this ?

Do you know if the topt looking like this ?

Mine was like this
otpauth://totp/General%20Motors%20Security%20Team:**EMAILADDRESS**?secret=**STRINGOFNUMBERSANDLETTERS**&issuer=General+Motors+Security+Team

You only need to enter STRINGOFNUMBERSANDLETTERS - the code handles the rest of the string. I made the same mistake.

Well i not able to get it :(

This is certainly sounding very promising.
But something I am noticing from the Canada side of things; we have a lot of the same interactions as US customers; but all our login endpoints are ending in “.ca”. I can’t enable application based MFA since it redirects to the US site and then tries to log me in as a GM employee. It might be worth noting Canada auth procedure is currently different than US auth procedure. There’s other peculiarities throughout with the accounts.
Hopefully we get an upgrade on our side of the border. Maybe even their app will work properly again.

So I was excited to see this rolled out, and I am impatient waiting for GM and OnStar to do something cool. So I can eliminate one solution > you can’t create a new gm.COM account with a different email and add the vehicle (without calling on-star). I tried to “Family Share”, but that is forbidden across borders too. Definitely suggests we are on different platforms and probably explains why their official app doesn’t work all that well either.

Count me as another victim of a Canadian account that can’t enable MFA apps.
Maybe us Canadians should reach out to OnStar and advise them that their MFA app setup does not work. If I have time this weekend, I’ll call them. Probably will take them a few days to fix it

I called in and had them submit a case for the "offline team". I can deactivate Email authenticator, but when I go to enable the third party app it just redirects to GM site to login, then when I login, redirect to microsoft and then get the AADSTS90072 message. Oddly enough when I try to log directly into the GM account, and go to account details I get a 404 error. He also tried to get me to delete my account, but that 404's as well on my side: www.cadillaccanada.ca/en/delete/review
Guy said I should hear something back in a couple of days. I just called the number that's in the verification email.

I'm struggling to get the OnStar2MQTT Home Assistant Add-on (1.20.0) working for my new Cadillac Lyriq.
I grab the TOTP string and place it in the TOTP Key field, along with what seems to be correct for other inputs. Seems like I should also provide the 6 digit authenticator code too, but I don't see any way to use that in the add-on configuration.
I keep getting "Authentication failed: Error: Failed to extract csrf token or transId during MFA".
What am I doing wrong?
Forgive me if I've not provided enough info, or I've posted in the wrong forum - I'm a newbie here. Really appreciate any advice.

@kelld00 you have to provide just the 16 character totp secret key. If you're pasting the whole string provided under the QR code then that won't work. The code is then able to use the TOTP secret to generate the 6 digit code when required without user interaction.

Thanks @methoes.
I am indeed using only the 16 character letter+number string that I extract out of the link, but still no luck.

Hmm, I see now it's not getting to the MFA portion of the sign in process. That would indicate to me that the email or password is not correct since that's the only step based on user input prior to loading that portion. If you're positive the email and password in your addon config is correct, then I'm not sure what else might be going on there.

I feel so dumb - it was a password issue! Thanks!
I'm getting another error now though:
error: Main function error: {"error":{"code":5}
I want to check some other settings since I've been fumbling around a bit.

I'm working on a companion tool that will generate the MS tokens that require MFA. We've added an optional config parameter in the HA addon that will let users set a persistent storage location for the token storage. You'll be able to put the generated MS token file there and the addon authentication code will load that instead of trying to generate a new one.
This will enable users that can't use TOTP MFA to use the addon. (Including our frozen Canadian friends)
I expect the MS tokens will be long-lived as they can be renewed indefinitely by the code unless MS revokes them or GM changes something down the road.

I've released an initial build with a windows binary over at https://github.com/metheos/node-oauth2-gm/releases
It should definitely work for email MFA, but I can't actually test the SMS code completely since it looks like GM has locked me out of it from all my testing 😅😅😅
This tool will create the microsoft_tokens.json file that needs to be provided to the homeassistant addon using the "token location" option.

You'll need to create this directory and place the microsoft_tokens.json file from the tool into the directory using a file explorer addon or other tool that gives access to your install's root.

@metheos Thanks so much for working on this!
I am trying to use the tool, but feel I am missing some dependencies or something.
 .\GMAuth.exe
(node:32712) Warning: Currently the require() provided to the main script embedded into single-executable applications only supports loading built-in modules.
To load a module from disk after the single executable application is launched, use require("module").createRequire().
Support for bundled module loading or virtual file systems are under discussions in https://github.com/nodejs/single-executable
(Use GMAuth --trace-warnings ... to show where the warning was created)
USER/PASS SECTION
Error in main: Error: Could not find Chrome (ver. 131.0.6778.85). This can occur if either
 1. you did not perform an installation before running the script (e.g. `npx puppeteer browsers install chrome`) or
 2. your cache path is incorrectly configured (which is: C:\Users\jared\.cache\puppeteer).
For (2), check out our guide on configuring puppeteer at https://pptr.dev/guides/configuration.
    at ChromeLauncher.resolveExecutablePath (.\bundle.js:323631:17)
    at ChromeLauncher.executablePath (.\bundle.js:323829:19)
    at ChromeLauncher.computeLaunchArguments (.\bundle.js:323717:31)
    at async ChromeLauncher.launch (.\bundle.js:323427:24)
    at async main (.\bundle.js:324635:19)`

@metheos Thanks so much for working on this!
I am trying to use the tool, but feel I am missing some dependencies or something.
 .\GMAuth.exe
(node:32712) Warning: Currently the require() provided to the main script embedded into single-executable applications only supports loading built-in modules.
To load a module from disk after the single executable application is launched, use require("module").createRequire().
Support for bundled module loading or virtual file systems are under discussions in https://github.com/nodejs/single-executable
(Use GMAuth --trace-warnings ... to show where the warning was created)
USER/PASS SECTION
Error in main: Error: Could not find Chrome (ver. 131.0.6778.85). This can occur if either
 1. you did not perform an installation before running the script (e.g. `npx puppeteer browsers install chrome`) or
 2. your cache path is incorrectly configured (which is: C:\Users\USER\.cache\puppeteer).
For (2), check out our guide on configuring puppeteer at https://pptr.dev/guides/configuration.
    at ChromeLauncher.resolveExecutablePath (.\bundle.js:323631:17)
    at ChromeLauncher.executablePath (.\bundle.js:323829:19)
    at ChromeLauncher.computeLaunchArguments (.\bundle.js:323717:31)
    at async ChromeLauncher.launch (.\bundle.js:323427:24)
    at async main (.\bundle.js:324635:19)`

Cool, I probably did something wrong bundling it 😬
If anyone has any tips on that front, lmk

@metheos
What would I put in the required TOTP section? Since if I leave it empty I get this error.
Error: "ONSTAR_TOTP" is not defined

Oh, just put anything I guess. It won't actually be used by the code if the Microsoft token exists and is valid

[17:36:05] INFO: Starting OnStar2MQTT for CAR...
><EMAIL_ADDRESS>start
> node src/index.js
info: OnStar Config: {"onstarConfig":{"allowCommands":true,"checkRequestStatus":true,"deviceId":"*****************","onStarPin":"####","onStarTOTP":"***************","password":"********","refreshInterval":1800000,"requestPollingIntervalSeconds":6,"requestPollingTimeoutSeconds":90,"tokenLocation":"/ssl/vehicle1","username":"*****************","vin":"*****************"},"timestamp":"2024-11-25 17:36:06"}
info: MQTT Config: {"mqttConfig":{"host":"homeassistant.local","listAllSensorsTogether":false,"namePrefix":"","password":"********","pollingStatusTopic":"","port":1883,"prefix":"homeassistant","rejectUnauthorized":true,"tls":false,"username":"mqtt"},"timestamp":"2024-11-25 17:36:06"}
info: !-- Starting OnStar2MQTT Polling --! {"timestamp":"2024-11-25 17:36:06"}
info: Requesting vehicles {"timestamp":"2024-11-25 17:36:06"}
Authentication failed: Error: Invalid base32 character in key
    at TOTP.base32tohex (/app/node_modules/onstarjs2/dist/index.cjs:34421:23)
    at TOTP.generate (/app/node_modules/onstarjs2/dist/index.cjs:34397:32)
    at GMAuth.<anonymous> (/app/node_modules/onstarjs2/dist/index.cjs:34535:34)
    at Generator.next (<anonymous>)
    at fulfilled (/app/node_modules/onstarjs2/dist/index.cjs:43:58)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
error: Main function error: {"error":{"message":"Invalid base32 character in key"},"timestamp":"2024-11-25 17:36:09"}
s6-rc: info: service legacy-services: stopping
s6-rc: info: service legacy-services successfully stopped
s6-rc: info: service legacy-cont-init: stopping
s6-rc: info: service legacy-cont-init successfully stopped
s6-rc: info: service fix-attrs: stopping
s6-rc: info: service fix-attrs successfully stopped
s6-rc: info: service s6rc-oneshot-runner: stopping
s6-rc: info: service s6rc-oneshot-runner successfully stopped
s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service legacy-services: starting
s6-rc: info: service legacy-services successfully started

Getting stuck here.

Looks like it's still trying to generate the ms tokens. Can you post a directory listing of /ssl/vehicle1 ?

I've tried with just /ssl/vehicle1 and /homeassistant/ssl/vehicle1. Addon just keeps crashing immediately.

It definitely needs to be in the root ssl directory as far as I've tested

It definitely needs to be in the root ssl directory as far as I've tested
/ssl/vehicle1/

It works! Had to use SMB to get into my VM to get to the root/ssl directory as the file editor HA addon wouldn't let me. Thanks so much for everyone's work! Can finally start my car again (just in time as we hit -35 degrees haha)

@evilpig that's great! Glad it's working for ya!
I think you just need to toggle the enforcement to allow root access in the file editor addon

@metheos Frozen Canadian here ! :D
Thanks for working on this !
Got the binary, installed node.js and npm, the thing times out :
Loading existing MS tokens, if they exist.
Doing auth discovery
No existing tokens found or were invalid. Doing full auth sequence.
Starting PKCE auth
Doing auth discovery
got PKCE code verifier: KMMCCz9IELdlBtOgQtSd4n3b0J_tUugEnwtqoaVdF7k
Loading Auth URL
Submitting user email and password
Determined MFA Type is EMAIL
Enter MFA Code from Email Message:173985
Waiting for auth redirect
Authentication sequence failed: Timeout waiting for auth code redirect
Any ideas ?

@LeBizz333 I can only think that part would time out if the MFA code was invalid.
I can push some updates tomorrow to add a check for that and log it.

@metheos Tried several times with no success... Pretty confident I am getting the email MFA code right. Will be on the lookout for the updates tomorrow.
Thanks again for working on this for us all !

Hi ! thanks for all your effort ! I have a different issue.. ( I'm not totally sure i know what i'm doing to be honest )
C:\Users\Dom&Eli\Downloads>GMAuth.exe (node:12828) Warning: Currently the require() provided to the main script embedded into single-executable applications only supports loading built-in modules. To load a module from disk after the single executable application is launched, use require("module").createRequire(). Support for bundled module loading or virtual file systems are under discussions in https://github.com/nodejs/single-executable (Use GMAuth --trace-warnings ... to show where the warning was created) Enter OnStar account email address:-------EMAIL-------- Enter OnStar account password: -----PASSWORD---- Loading existing MS tokens, if they exist. Doing auth discovery No existing tokens found or were invalid. Doing full auth sequence. Starting PKCE auth Doing auth discovery got PKCE code verifier: xI0zbAz21AQsdzvjLZh0dtLP98wSMTWKMfl4BG7WJRA Loading Auth URL Submitting user email and password Determined MFA Type is EMAIL Enter MFA Code from Email Message:218990 Waiting for auth redirect Doing auth discovery Failed to obtain access token: RPError: JWT not active yet, now<PHONE_NUMBER>, nbf<PHONE_NUMBER>     at Client.validateJWT (.\bundle.js:8313:19)     at Client.validateIdToken (.\bundle.js:8152:64)     at Client.callback (.\bundle.js:7950:22)     at process.processTicksAndRejections (node:internal/process/task_queues:105:5)     at async getAccessToken (.\bundle.js:324908:22)     at async doFullAuthSequence (.\bundle.js:324753:24)     at async main (.\bundle.js:324659:7) {   now:<PHONE_NUMBER>,   tolerance: 0,   nbf:<PHONE_NUMBER>,   jwt: 'eyJhbGciOiJSUzI1NiIsImtpZCI6ImVVbHVtc28yYWVrUExFbnd1NEt3TTVLOG0ybVJTRHN2SGprajNhY3lCc3ciLCJ0eXAiOiJKV1QifQ.eyJleHAiOjE3MzI1OTE0OTQsIm5iZiI6MTczMjU4Nzg5NCwidmVyIjoiMS4wIiwiaXNzIjoiaHR0cHM6Ly9jdXN0bG9naW4uZ20uY29tLzk0OGY0NDNkLWI1ODgtNDgyYS04ZmZhLTJlNDllZTEzNjg5YS92Mi4wLyIsInN1YiI6IjIyNmVlNTgwLTlhNjItNDEwYS04MWE4LWEzNGRmNGE4ZDQ3ZiIsImF1ZCI6IjNmZjMwNTA2LWQyNDItNGJlZC04MzViLTQyMmJmOTkyNjIyZSIsImFjciI6ImIyY18xYV9zZWFtbGVzc19tb2JpbGVfc2lnbnVwb3JzaWduaW4iLCJpYXQiOjE3MzI1ODc4OTQsImF1dGhfdGltZSI6MTczMjU4Nzg5NCwidXBuIjoiMjI2ZWU1ODAtOWE2Mi00MTBhLTgxYTgtYTM0ZGY0YThkNDdmQGdtYjJjcHJvZC5vbm1pY3Jvc29mdC5jb20iLCJlbWFpbCI6ImRvbS5ib25vQGdtYWlsLmNvbSIsIm9pZCI6IjIyNmVlNTgwLTlhNjItNDEwYS04MWE4LWEzNGRmNGE4ZDQ3ZiIsImxhc3RMb2dvblRpbY2VzIjoiTi9BIiwidG90cElkZW50aWZpZXIiOiJOL0EiLCJhdF9oYXNoIjoiN1Z1bGN5ZGc1OUxwWDhRTnFTYURRUSJ9.5VltzJFEn0HaGCbXw7U1CCvlLl5KmhHiYDU1C3NVaks0dLEgKhyKiW6_aCAlE_wRrjvmAFCojYQIQawudMpuscDTer-GMBVSCqi_joUB3HSejQGtqH1Th8cKr64JXLiJMHLa1a2rR5pFA8zD2lk_A98ry2_X-aaGjKx9Z9H2ISwuKjNZybKoHdLpVTgFWyS5SLR7S3tDryt8mQ0p112fjm58ofUFFdSHsWfigVZY1a5nteT-5vK2RtFxOPv60jpQXfL3MiWyUt8fyPr0HAtNwRVbfNzbVKKg_Y81B1m0NAyL7tdDVHufIfrOU0HZfWU0LB6p0EzxxtOyRixMBL10hQ' } Authentication sequence failed: JWT not active yet, now<PHONE_NUMBER>, nbf<PHONE_NUMBER>
( i delete some code in the jwt while posting here did'nt know if it was dangerous to post )

@metheos I figured my problem out. A password change on my account fixed it. Not sure why it fixed it, I have a few guesses but eh! it works now so... :)
Cheers for your fine work !

@LeBizz333 awesome!
@thib5 I've fixed this same problem on the addon side, I'll push a fix for it tomorrow 👍 looks like you're doing everything right. It's a clock sync issue that I can adjust the tolerance for.

@LeBizz333 awesome!
@thib5 I've fixed this same problem on the addon side, I'll push a fix for it tomorrow 👍 looks like you're doing everything right. It's a clock sync issue that I can adjust the tolerance for.

I @metheos another frozen canadian ! was able to obtain also my token by changing my password ! But now im a little bit confuse, do we still using the add on by @BigThunderSR or they have a new one to use ?

I was wondering the same thing at first but am just using the BigThunder add-on and it's working.

@LeBizz333 awesome!
@thib5 I've fixed this same problem on the addon side, I'll push a fix for it tomorrow 👍 looks like you're doing everything right. It's a clock sync issue that I can adjust the tolerance for.

I @metheos another frozen canadian ! was able to obtain also my token by changing my password ! But now im a little bit confuse, do we still using the add on by @BigThunderSR or they have a new one to use ?

I was wondering the same thing at first but am just using the BigThunder add-on and it's working.

I got this :   info: Button Configs Published! {"timestamp":"2024-11-26 10:15:08"} error: Error Polling Data: {"error":{"error":{"message":"Request Failed with status 504 - Gateway Timeout","request":{"method":"POST"},"response":{"data":"","headers":{"cache-control":"no-store","connection":"keep-alive","content-length":"0","date":"Tue, 26 Nov 2024 15:15:18 GMT","pragma":"no-cache","request-context":"appId=cid-v1:a7e19842-5b19-4b47-a9cf-85cc6e87a746"},"status":504,"statusText":"Gateway Timeout"},"stack":"Error: Request Failed with status 504 - Gateway Timeout\n    at RequestService.<anonymous> (/app/node_modules/onstarjs2/dist/index.cjs:35171:32)\n    at Generator.throw (<anonymous>)\n    at rejected (/app/node_modules/onstarjs2/dist/index.cjs:44:65)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"}},"timestamp":"2024-11-26 10:15:18"}

@Frazou1 that's a normal transient error. Looks like your tokens are working!

As a Canadian, I’m still stuck with not being able to setup MFA third party app without the redirect to GM USA and some MS login portal.
How has other fellow Canadians gotten past this?

Here's an idea: What if I create a website where users can log in using their username and password, then enter a verification code received via email, SMS, or TOTP? Once verified, the website would generate a unique and secure URL containing the MS Token.
In Home Assistant (HA), you would only need to define a "Token URL" in the configuration. HA would then automatically download the token from this URL to authenticate GM requests. What do you think?

I don't know if this helps or not, but the HACS arlo integration handles two factor authentication by providing access to email and scrubbing the code somehow. Here's it's github https://github.com/twrecked/hass-aarlo?tab=readme-ov-file#two-factor-authentication

@stamanf  @glassbase
Have you try the tool of @metheos. They work for me. i change my password run the tool and give me the token. I put into /ssl/vehicle1 folder i create and add it into token part on Bigthunder add-on. I have the 504 error sometime but i receive data now after i took a ride with my car

@stamanf @glassbase @thib5
I've released alpha 2 with the clock tolerance fix and a (hopefully) working standalone windows executable.
https://github.com/metheos/node-oauth2-gm/releases

Do any of the new working forks allow me to skip having MQTT username and password?  I've always used the michael runner version for this, and I think last time I checked Bigthunder's build required them.

I created a simple PHP web interface that allows users to authenticate, verify a code, and retrieve an access token via a URL.
The generated URL can be used to fetch the token for external applications.
At the moment, only email-based authentication is supported.
Repository: https://github.com/joelvandal/onstar-token-gen
You can install the interface on your own server or test it live at: https://token.mondemarreur.com/

I have a question for all who are still lurking here : any of you are getting random command failures with the following error :
{"commandResponse":{"body":{"error":{"code":"ONS-217","description":"Unable to initiate request through SMS","subCode":null,"subCodeDescription":null}},
The same request will eventually go through without problems later on.
Anyway, I'm just puzzled by this error code, I am not expecting flawless communications with OnStar's infrastructure !

@LeBizz333  An Equinox EV ? It look like to be a trouble with the OnStar module.
Here the list of code that I've collect on my system:
+----------+--------------------------------------------------------------+---------+------------------------------------------------------------------------------------------------+
|   Code   |                        Description                           | SubCode |                                  SubCode Description                                          |
+----------+--------------------------------------------------------------+---------+------------------------------------------------------------------------------------------------+
| ONS-220  | Failed to execute vehicle request.                           | 220_12  | Remote Start could not be completed. The vehicle can only be Remote Started twice per        |
|          |                                                              |         | ignition cycle. Drive the vehicle before attempting Remote Start again. (220_12)             |
+----------+--------------------------------------------------------------+---------+------------------------------------------------------------------------------------------------+
| ONS-217  | Unable to initiate request through SMS                       | NULL    | NULL                                                                                |
+----------+--------------------------------------------------------------+---------+------------------------------------------------------------------------------------------------+
| ONS-216  | Unable to establish packet session to the vehicle            | N/A     | N/A                                                                                |
+----------+--------------------------------------------------------------+---------+------------------------------------------------------------------------------------------------+
| ONS-211  | Vehicle command cannot be executed due to invalid vehicle state | NULL    | NULL                                                                                |
+----------+--------------------------------------------------------------+---------+------------------------------------------------------------------------------------------------+

It is indeed an Equinox EV (in Canada)... I have pretty much seen only errors 216 and 217 so far...
OnStar's infrastructure seems to be held together with duct tape and cable ties.... Kind of a shame they still use such shoddy stuff in 2024 ! Maybe they should invest a bit into some upgrades ?
Merci pour tes réponses et ton travail, Joel ! :)

It is indeed an Equinox EV (in Canada)... I have pretty much seen only errors 216 and 217 so far...
OnStar's infrastructure seems to be held together with duct tape and cable ties.... Kind of a shame they still use such shoddy stuff in 2024 ! Maybe they should invest a bit into some upgrades ?
Merci pour tes réponses et ton travail, Joel ! :)

Did you try a key cycle/drive the vehicle?  You only get 2 remote starts between driving sessions.

Did you try a key cycle/drive the vehicle? You only get 2 remote starts between driving sessions.

In this case, the command will return this error :
Error 220 : Remote Start could not be completed. The vehicle can only be Remote Started twice per ignition cycle. Drive the vehicle before attempting Remote Start again. (220_12)
I've seen error 217 (Unable to initiate request through SMS) only with Equinox EV.  At exact same location, the command work with Bolt.
IMHO this is an issue with module / antenna on Equinox EV.

Canada Update.
Got a new phone today. Had to sign in again. I can't help but notice where our emails come from when signing into the app. This is different because the emails used to come from a GM domain only a week ago.

I've noticed that as well. The MFA still are coming from the<EMAIL_ADDRESS>address instead of the microsoft on behalf of GM. Maybe they are halfway through transitioning over?

@joelvandal I am wondering what could explain such behaviour... How much of AAOS (Android Automotive) is related to the OnStar system. Also wondering if people in the US with Equinox EV's are seeing those errors... If not, could be related to Telus' cellular link ?
If the problem is with the vehicle itself, I hope a software update could fix it !

@LeBizz333
I wanst try yet the start command but i got the same error as you with my trailblazer so im not sure is related by a car modal..  Im also in Canada. warn: Command sent: {"command":"startVehicle","timestamp":"2024-11-28 15:21:51"} warn: Command Status Topic: homeassistant/xxxxxxxx/command/startVehicle/state {"timestamp":"2024-11-28 15:21:51"} error: Command Error! {"command":"startVehicle","error":{"error":{"message":"Command Failure","request":{"body":"{}","contentType":"application/json; charset=UTF-8","headers":{},"method":0,"url":"https://na-mobile-api.gm.com:443/api/v1/account/vehicles/xxxxxxxx/requests/start1630291631732825312079"},"response":{"data":{"commandResponse":{"body":{"error":{"code":"ONS-220","description":"Failed to execute vehicle request.","subCode":"220_99","subCodeDescription":"Remote Start could not be completed. Attempt Remote Start from the Key Fob. (220_99)"}},"completionTime":"2024-11-28T20:22:45.971Z","requestTime":"2024-11-28T20:21:52.079Z","status":"failure","type":"start",

@Frazou1 The ONS-220 is more in line with what joelvandal and almoney were talking about here earlier today. I never had that specific error on my side... Did you try to start the engine, drive around for a fewminutes and turn off the engine to reset that specific counter ?

@LeBizz333  oh yes you right !  Yes already try. Other think strange. I try with the remote apps on my cellphone and wont start either.

@Frazou1 De mon coté aussi, si ca ne fonctionne pas dans Home Assistant, ca ne fonctionne pas non plus sur mon cell. Ce qui me fait croire que le trouble est l'infrastructure de OnStar...

Je vais essayer avec ma clé,on vas voir qu'est ce que ca va dire !

i can't start the addon anymore... i have this message :
Should I generate a new token ?
s6-rc: info: service fix-attrs: stopping
s6-rc: info: service fix-attrs successfully stopped
s6-rc: info: service s6rc-oneshot-runner: stopping
s6-rc: info: service s6rc-oneshot-runner successfully stopped
s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service legacy-services: starting
s6-rc: info: service legacy-services successfully started
[20:23:23] INFO: Starting OnStar2MQTT for Vehicle 1...
><EMAIL_ADDRESS>start
> node src/index.js
info: OnStar Config: {"onstarConfig":{"allowCommands":true,"checkRequestStatus":true,"deviceId":"1b1b2f54-4887-44bb-b916-c6e85eaf878f","onStarPin":"####","onStarTOTP":"***************","password":"********","refreshInterval":1800000,"requestPollingIntervalSeconds":6,"requestPollingTimeoutSeconds":90,"tokenLocation":"/ssl/vehicule1","username":"[dom.bono@gmail.com](mailto:dom.bono@gmail.com)","vin":"3XXXXXXX3555"},"timestamp":"2024-12-04 20:23:33"}
info: MQTT Config: {"mqttConfig":{"host":"<IP_ADDRESS>","listAllSensorsTogether":false,"namePrefix":"","password":"********","pollingStatusTopic":"","port":1883,"prefix":"homeassistant","rejectUnauthorized":false,"tls":false,"username":"thib5_admin"},"timestamp":"2024-12-04 20:23:33"}
info: !-- Starting OnStar2MQTT Polling --! {"timestamp":"2024-12-04 20:23:33"}
info: Requesting vehicles {"timestamp":"2024-12-04 20:23:33"}
Stored GM API token was for different user, getting new token
Stored MS token was for different user, getting new token
reqer
Response data: <html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="msauth.com.gm.mychevrolet%3a%2f%2fauth%2f%3ferror%3dserver_error%26error_description%3dAADB2C90255%253a%2bThe%2bclaims%2bexchange%2bspecified%2bin%2btechnical%2bprofile%2b%2527SelfAsserted-LocalAccountSignin-Email%2527%2bdid%2bnot%2bcomplete%2bas%2bexpected.%2bYou%2bmight%2bwant%2bto%2btry%2bstarting%2byour%2bsession%2bover%2bfrom%2bthe%2bbeginning.%250d%250aCorrelation%2bID%253a%2b5e972cf1-a058-4d5a-8fb2-8053fb0e60a4%250d%250aTimestamp%253a%2b2024-12-05%2b01%253a23%253a36Z%250d%250a">here</a>.</h2>
</body></html>
HTTP Error 302: Moved Temporarily
Authentication failed: Error: Failed to extract csrf token or transId during MFA

@thib5 Oh, that's interesting. I wonder if they're sanitizing your email and removing the dots? Could you try it without the periods in the username portion? e.g. dombono instead of dom.bono ?
If that doesn't work, please generate a token and send it to me in a DM so I can see what it's showing as your email on their end.
We added the account validation this week to prevent some other issues.

ok I will redo the add on config to be sure my username is ok and recreate the token
thanks

We added the account validation this week to prevent some other issues.

what you mean by that ?

what you mean by that ?

This week an update was published that adds account validation between the provided user email and the email contained in any persistent tokens. This prevents issues that might arise by a valid token existing in persistent storage for an account other than the one currently configured in the app config.

@metheos Sorry I'm a bit of a newb to all of this but your package seems to be the only one here that I can run on homebridge within a container on my QNAP. Or am I wrong about that? I'm not using MQTT so BigThunder's seems overly complex.
If I'm right, I'm wondering if you can add onto your package the ability to use an email auth token that I've acquired using JoelVandal's PHP app. I can't use the authenticator app cause I'm in Canada and GM has not figured things out yet.

I have this appear any solution : Stored MS token was not parseable, getting new token
Authentication failed: Error: Only TOTP via "Third-Party Authenticator" is currently supported by this implementation. Please update your OnStar account to use this method, if possible.
at GMAuth. (/app/node_modules/onstarjs2/dist/index.cjs:40666:23)
at Generator.next ()
at fulfilled (/app/node_modules/onstarjs2/dist/index.cjs:43:58)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
error: Main function error: {"error":{"message":"Only TOTP via "Third-Party Authenticator" is currently supported by this implementation. Please update your OnStar account to use this method, if possible."},"timestamp":"2024-12-15 13:31:04"}
s6-rc: info: service legacy-services: stopping
s6-rc: info: service legacy-services successfully stopped
s6-rc: info: service legacy-cont-init: stopping
s6-rc: info: service legacy-cont-init successfully stopped
s6-rc: info: service fix-attrs: stopping
s6-rc: info: service fix-attrs successfully stopped
s6-rc: info: service s6rc-oneshot-runner: stopping
s6-rc: info: service s6rc-oneshot-runner successfully stopped

I have this appear any solution : Stored MS token was not parseable, getting new token Authentication failed: Error: Only TOTP via "Third-Party Authenticator" is currently supported by this implementation. Please update your OnStar account to use this method, if possible. at GMAuth. (/app/node_modules/onstarjs2/dist/index.cjs:40666:23) at Generator.next () at fulfilled (/app/node_modules/onstarjs2/dist/index.cjs:43:58) at process.processTicksAndRejections (node:internal/process/task_queues:95:5) error: Main function error: {"error":{"message":"Only TOTP via "Third-Party Authenticator" is currently supported by this implementation. Please update your OnStar account to use this method, if possible."},"timestamp":"2024-12-15 13:31:04"} s6-rc: info: service legacy-services: stopping s6-rc: info: service legacy-services successfully stopped s6-rc: info: service legacy-cont-init: stopping s6-rc: info: service legacy-cont-init successfully stopped s6-rc: info: service fix-attrs: stopping s6-rc: info: service fix-attrs successfully stopped s6-rc: info: service s6rc-oneshot-runner: stopping s6-rc: info: service s6rc-oneshot-runner successfully stopped

I had this issue too. I just generated a new token to get by. It doesn't appear that the token is properly refreshing the token perhaps such that we don't need to do this; but I haven't looked into it too deeply after creating a new token.

and can we have the exact form of the microsoft_tokens.json.  ?

I got mine using this project.
https://github.com/metheos/node-oauth2-gm/releases

Ok, I found a solution! I installed Parallels Desktop on my Mac, ran the .exe file from [https://github.com/metheos/node-oauth2-gm/releases], got my .json file, and placed it in the /ssl/vehicle1 directory. Everything is now working perfectly! Thank you so much, everyone. Incredible work—you’ve done an amazing job!

@BigThunderSR  How i can implement a alert when token are expired ?

I have been getting this problem more frequently too (Only TOTP via ...). It seems when it comes to the token needing to be refreshed. The refresh token looks to be valid for 90 days, so it is interesting that this is about a weekly task. So it refreshes many of the time, but not all of the time.

I made a new json file and am just getting this error too.

info: !-- Starting OnStar2MQTT Polling --! {"timestamp":"2024-12-18 13:36:40"}
info: Requesting vehicles {"timestamp":"2024-12-18 13:36:40"}
Authentication failed: Error: Only TOTP via "Third-Party Authenticator" is currently supported by this implementation. Please update your OnStar account to use this method, if possible.
    at GMAuth.<anonymous> (/app/node_modules/onstarjs2/dist/index.cjs:40666:23)
    at Generator.next (<anonymous>)
    at fulfilled (/app/node_modules/onstarjs2/dist/index.cjs:43:58)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
error: Main function error: {"error":{"message":"Only TOTP via \"Third-Party Authenticator\" is currently supported by this implementation. Please update your OnStar account to use this method, if possible."},"timestamp":"2024-12-18 13:36:43"}
s6-rc: info: service legacy-services: stopping
s6-rc: info: service legacy-services successfully stopped
s6-rc: info: service legacy-cont-init: stopping

I ran the exe, this was the output. Created a new token json which I uploaded to the server to replace the old one. Not sure what I am doing wrong.
Loading existing MS tokens, if they exist.
Doing auth discovery
MS Access token is still valid
Saving current MS tokens to  ./microsoft_tokens.json
Existing tokens loaded!

Disregard. Seems like since I had an existing json file in the directory it didn't replace it (but it updated the timestamp of the file so I assumed it did). Deleted it and then then it generated a new json file. Now the HA addon just crashes.

The "Authentication failed" errors should only happen if the loaded microsoft tokens are invalid. It falls back to recreating them using the automatic method that requires TOTP to be configured on the account with the secret provided to the addon.

I certainly am willing to bet that this is a problem downstream that uses this library. It does rename the token file with an extension .old. It is possible the service restarts and then it can't load the old token.

Yeah, seems whether or not I have a token file in the /ssl/vehicle1 folder I am just getting this error.

Error: Only TOTP via "Third-Party Authenticator" is currently supported by this implementation. Please update your OnStar account to use this method, if possible.

Yeah, seems whether or not I have a token file in the /ssl/vehicle1 folder I am just getting this error.

Error: Only TOTP via "Third-Party Authenticator" is currently supported by this implementation. Please update your OnStar account to use this method, if possible.

I cannot replicate your issue even though I refreshed my tokens manually just to see what happens.

I have even made a completely new folder (/ssl/vehicle) and no luck. Does the filename matter? It's microsoft_tokens.json
I am also just putting the folder not the direct path which was working and I assume is also correct?
(rather than /ssl/vehicle/microsoft_tokens.json)
Also I believe you replied a month ago and said to use anything if we are using a token, but I am just using "1234" in the required "Onstar TOTP Key" section in the configuration. Just making sure that isn't affecting it.
Might uninstall and reinstall the addon and try again.

I have even made a completely new folder (/ssl/vehicle) and no luck. Does the filename matter? It's microsoft_tokens.json

The paths are /ssl/vehicle1 for the vehicle 1 addon and /ssl/vehicle2 for the vehicle 2 addon
Filename does matter, microsoft_tokens.json is the correct filename.

Okay yeah, everything was working fine yesterday and just stopped today. Haven't changed anything, other than now uploading a new microsoft_tokens file. Don't see a gm_tokens.json though.
I deleted all files and even tried a new folder.
Reinstalled the addon, still no luck.
I appreciate all the work you guys do. Not sure whats wrong here.

Okay yeah, everything was working fine yesterday and just stopped today. Haven't changed anything, other than now uploading a new microsoft_tokens file. Don't see a gm_tokens.json though.
I deleted all files and even tried a new folder.
Reinstalled the addon, still no luck.
I appreciate all the work you guys do. Not sure whats wrong here.

@evilpig see below: !)
@BigThunderSR

Here you go. Same folders I've been using for a month so not much has changed. Unless I need to use that full path in the plugin? /root/homeassistant/ssl/vehicle1

Same thing, i run into a VM HA.

Oh found something, the file rename as .OLD !

Perhaps this is helpful. When this happens, this is what I start to get:
error: Error Polling Data: {"error":{"error":{"message":"Request Failed with status 504 - Gateway Timeout","request":{"method":"POST"},"response":{"data":"","headers":{"cache-control":"no-store","connection":"keep-alive","content-length":"0","date":"Wed, 18 Dec 2024 07:03:21 GMT","pragma":"no-cache","request-context":"appId=cid-v1:UUID"},"status":504,"statusText":"Gateway Timeout"},"stack":"Error: Request Failed with status 504 - Gateway Timeout\n    at RequestService.<anonymous> (/app/node_modules/onstarjs2/dist/index.cjs:41321:32)\n    at Generator.throw (<anonymous>)\n    at rejected (/app/node_modules/onstarjs2/dist/index.cjs:44:65)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"}},"timestamp":"2024-12-18 02:03:21"}
info: pollingStatusTopicState: homeassistant/VIN/polling_status/state {"timestamp":"2024-12-18 02:33:04"}
info: pollingStatusTopicTF, homeassistant/VIN/polling_status/lastpollsuccessful {"timestamp":"2024-12-18 02:33:04"}
info: Requesting diagnostics {"timestamp":"2024-12-18 02:33:04"}
Returned GM API token was missing vehicle information. Deleting existing tokens for reauth.
Authentication failed: Error: Only TOTP via "Third-Party Authenticator" is currently supported by this implementation. Please update your OnStar account to use this method, if possible.
    at GMAuth.<anonymous> (/app/node_modules/onstarjs2/dist/index.cjs:40666:23)
    at Generator.next (<anonymous>)
    at fulfilled (/app/node_modules/onstarjs2/dist/index.cjs:43:58)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
Request Error: Only TOTP via "Third-Party Authenticator" is currently supported by this implementation. Please update your OnStar account to use this method, if possible.
Authentication failed: Error: Only TOTP via "Third-Party Authenticator" is currently supported by this implementation. Please update your OnStar account to use this method, if possible.
    at GMAuth.<anonymous> (/app/node_modules/onstarjs2/dist/index.cjs:40666:23)
    at Generator.next (<anonymous>)
    at fulfilled (/app/node_modules/onstarjs2/dist/index.cjs:43:58)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)

I am not entirely sure either. It is pretty stable and the refresh token looks fairly long lived that I shouldn't be recreating tokens to have it continue to work approximately weekly. I do have long periods of 504 gateway timeouts in the evening. I tried adjusting the polling from 30 minutes to 1 hour in case I was hitting limits; but 504 is a pretty consistent problem in the evening.

What I will try to do is catch it when it needs a new token because the old one fails. My logs don't go back far enough to view what happened before I needed a new token and that might provide more insight. TBF, this is more of a nuisance, but the Microsoft token is so much handier than being dead in the water until the keys were update and the fix is relatively easy to rectify.

I think they are working on trying to get the Third Party App piece working for Canadian Customers. I got an email from the case I started a while back about it that it's been referred to Tier 3 support a couple of days ago. I tried to enable it today, and the site is no longer linking out to the microsoft site when trying to enable third party auth app. It's also not reenabling the email authentication like it used to. I've also been needing to update my token file every couple of days for the last week due to "Failed to extract csrf token or transId during MFA" errors. Deleting the "gm_tokens.json" and "microsoft_tokens.json" and placing the new token file resolves it.

@dexameth I think you're right that they are working on the Canadian side of their service. I have had the same behaviour where they seem to be revoking my token every 2-3 days. I even had high hopes a few days ago when I had a 48 hour period where every single request went through without errors. Reaction time was pretty snappy too (around 15 seconds).

@dexameth This is a great news. I tried myself to change the MFA option for my account, but I was redirected to the microsoft site like usual. Just for the record, i have communicated with GM last week, and I have received this feedback: "J'apprécie beaucoup vos efforts. Je comprends l'importance de cette fonction pour vous. Sur base des informations fournies, il m'a été suggèré que vous en discutiez avec le département OnStar. Ils seront en mesure de clarifier les détails de cette fonction. Vous pouvez les joindre au 1-888-466-7827. Je reste à votre disposition en cas de besoin ultérieur". Do you thinks I should reply back, or I am wasting my time?

@BigThunderSR   i found a command to grep info in a log and put a put a binary sensor on and off. ```binary_sensor:

platform: command_line
command: if grep -i 'Fatal read error on socket transport' .homeassistant/home-assistant.log >/dev/null; then echo ON; else echo OFF; fi```   Where is located the log file of the addon ?

If you haven't escalated it to a level 2 or level 3 support, it wouldn't
hurt to call again and ask them to do that. It might help them prioritize
it. I did it, but haven't heard back. Don't spend time doing any
troubleshooting with a level 1 support person, just tell them you have an
issue that needs to be escalated.
On Fri, 20 Dec 2024 at 07:24, sargelavoie @.***> wrote:

@dexameth https://github.com/dexameth This is a great news. I tried
myself to change the MFA option for my account, but I was redirected to the
microsoft site like usual. Just for the record, i have communicated with GM
last week, and I have received this feedback: "J'apprécie beaucoup vos
efforts. Je comprends l'importance de cette fonction pour vous. Sur base
des informations fournies, il m'a été suggèré que vous en discutiez avec le
département OnStar. Ils seront en mesure de clarifier les détails de cette
fonction. Vous pouvez les joindre au 1-888-466-7827. Je reste à votre
disposition en cas de besoin ultérieur". Do you thinks I should reply back,
or I am wasting my time?
—
Reply to this email directly, view it on GitHub
https://github.com/samrum/OnStarJS/issues/233#issuecomment-2557009322,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ADHTKDKO54OLF23PDMQQMET2GQK77AVCNFSM6AAAAAA5J3RWYCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNJXGAYDSMZSGI
.
You are receiving this because you were mentioned.Message ID:
@.***>

@metheos Does your token that gets generated contain your VIN in the string in plain text? My error is a bit different than Eric's
Returned GM API token was missing vehicle information. Deleting existing tokens for reauth.
reqer
Response data: Object moved
Object moved to here.

HTTP Error 302: Moved Temporarily
Authentication failed: Error: Failed to extract csrf token or transId during MFA
    at GMAuth. (/app/node_modules/onstarjs2/dist/index.cjs:40648:23)
    at Generator.next ()
    at fulfilled (/app/node_modules/onstarjs2/dist/index.cjs:43:58)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
Request Error: Failed to extract csrf token or transId during MFA
Authentication failed: Error: Failed to extract csrf token or transId during MFA
    at GMAuth. (/app/node_modules/onstarjs2/dist/index.cjs:40648:23)
    at Generator.next ()
    at fulfilled (/app/node_modules/onstarjs2/dist/index.cjs:43:58)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)

The gm token contains the vin in the jwt payload. Not exactly plaintext, but not encrypted.

So I've been out of the loop and there is a lot of back and forth and troubleshooting here. Is there a guide somewhere on what we need to do to get things working again? If I understand things, GM is forcing OAUTH now, so we need to use some external method to generate a refresh token OnStarJS can use to send requests and receive data. Is that the gist of it?

OK, so to answer my own question it's fairly summed up here: https://github.com/BigThunderSR/OnStarJS?tab=readme-ov-file#new-requirement-as-of-2024-11-19
The basics of it are enable authenticator app through the OnStar web portal (I had to disable email before I could enable anything else), use an authenticator app that allows you to copy the secret, I used Stratum. Then add that key to the config either in the HA Addon or the OnStar2MQTT app. Poof it works again! Thanks everyone!

I can't seem to get it to work.  Canadian account using email MFA.  Generated the Microsoft token and stored it in /ssl/vehicle1 verified it's in the root folder.  I get this error when starting the addon.
[13:59:38] INFO: Starting OnStar2MQTT for ****...

<EMAIL_ADDRESS>start
node src/index.js
info: OnStar Config: {"onstarConfig":{"allowCommands":true,"checkRequestStatus":true,"deviceId":""","onStarPin":"####","onStarTOTP":"","password":"","refreshInterval":2500000,"requestPollingIntervalSeconds":600,"requestPollingTimeoutSeconds":90,"tokenLocation":"/ssl/vehicle1","username":"mail@mail.com","vin":""},"timestamp":"2024-12-23 13:59:39"}
info: MQTT Config: {"mqttConfig":{"host":"homeassistant.local","listAllSensorsTogether":false,"namePrefix":"","password":"********","pollingStatusTopic":"","port":1883,"prefix":"homeassistant","rejectUnauthorized":true,"tls":false,"username":"**"},"timestamp":"2024-12-23 13:59:39"}
info: !-- Starting OnStar2MQTT Polling --! {"timestamp":"2024-12-23 13:59:39"}
info: Requesting vehicles {"timestamp":"2024-12-23 13:59:39"}
Authentication failed: Error: Token expired and no refresh token available.
at GMAuth. (/app/node_modules/onstarjs2/dist/index.cjs:41007:27)
at Generator.next ()
at /app/node_modules/onstarjs2/dist/index.cjs:46:71
at new Promise ()
at __awaiter (/app/node_modules/onstarjs2/dist/index.cjs:42:12)
at GMAuth.loadMSToken (/app/node_modules/onstarjs2/dist/index.cjs:40959:16)
at GMAuth. (/app/node_modules/onstarjs2/dist/index.cjs:40578:49)
at Generator.next ()
at /app/node_modules/onstarjs2/dist/index.cjs:46:71
at new Promise ()
error: Main function error: {"error":{"message":"Token expired and no refresh token available."},"timestamp":"2024-12-23 13:59:39"}

Hey it work great on my side but i have to regenerate the token about once a week... do you know how could i fix that ? ( reminder: i'm Canadian and can't use totp )


updated device sync manager to null check current sync to fix NPEs fr…

…om sync request when there is nothing to sync

Vlad is faster than me


zulu17, zulu21: init

Description of changes
These Zulu packages were previously only available on Darwin as openjdk17 and openjdk21, this PR adds the Linux sources and exposes the packages.
Things done

Built on platform(s)

[ ] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

[ ] For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[ ] Tested basic functionality of all binary files (usually in ./result/bin/)
23.11 Release Notes (or backporting 23.05 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module

[x] Fits CONTRIBUTING.md.

Result of nixpkgs-review pr 259825 run on x86_64-darwin 1

2 packages built:

zulu17
zulu21


add login urls to robots.txt ignore

We are getting a lot of errors from bots trying out 'http://grand-challenge.org/socialauth/login/yahoo/', and similar.

Done in #342


babel7 object destructing fails in test cases

🐛 Bug Report
I have a react project which I recently migrated to bable7. everything works fine but when I tried to run my test cases it started failing.  all of the other issue I was able to resolve except this one.
it seems like object destructuring seems to be failing when running jest
here is my component that fails.
import React from 'react';
import PropTypes from 'prop-types';
import { Input } from 'antd';

const { Search } = Input;  // jest fails here....

class TextBoxWithButton extends React.Component {
  static propTypes = {
    placeholder: PropTypes.string.isRequired,
    onAction: PropTypes.func.isRequired,
    buttonText: PropTypes.string,
  }

  static defaultProps = {
    buttonText: '',
  }

  constructor(props) {
    super(props);
    this.state = {
      value: '',
    };
  }

  onSubmit = (value) => {
    const { onAction } = this.props;
    this.setState({
      value: '',
    });
    onAction(value);
  }

  handleChange = (ev) => {
    this.setState({
      value: ev.target.value,
    });
  }

  render() {
    const { placeholder, buttonText } = this.props;
    const { value } = this.state;
    return (
      <React.Fragment>
        <Search
          placeholder={placeholder}
          onSearch={this.onSubmit}
          enterButton={buttonText}
          value={value}
          onChange={this.handleChange}
        />
      </React.Fragment>

    );
  }
}

export default TextBoxWithButton;

here is my .babelrc
{
  "presets": [
    ["@babel/preset-env", {  "modules": false, "useBuiltIns":"usage"  }],
    "@babel/preset-react"
  ],
  "plugins": [
    "react-hot-loader/babel",
    "@babel/plugin-proposal-object-rest-spread",
    "@babel/plugin-proposal-class-properties",
    "@babel/plugin-syntax-dynamic-import",
    ["import", {  "libraryName": "antd", "libraryDirectory": "es", "style": false }],
    [
      "module-resolver",
      {
        "root": [
          "./src"
        ],
        "alias": {
          "App": "./src/App",
          "Common": "./src/App/Common",
          "Elements": "./src/App/Elements",
          "Router": "./src/App/Router",
          "Constants": "./src/Constants",
          "Services": "./src/Services",
          "Store": "./src/Store",
          "Styles": "./src/Styles",
          "Assets": "./src/Assets"
        }
      }
    ]
  ],
  "env": {
    "test": {
      "presets": [
        ["@babel/preset-env"],
        "@babel/preset-react"
      ],
      "plugins": [
        "@babel/plugin-transform-modules-commonjs",
        "@babel/plugin-proposal-object-rest-spread",
        "@babel/plugin-proposal-class-properties",
        "@babel/plugin-syntax-dynamic-import",
        ["import", {  "libraryName": "antd", "style": "css" }]
      ]
    }
  }
}

here is my jest.config.js
const jestConfig = {
  verbose: true,
  moduleNameMapper: {
    '\\.(jpg|jpeg|png|gif|eot|otf|webp|svg|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga)$': '<rootDir>/__mocks__/fileMock.js',
    '\\.(css|scss)$': '<rootDir>/__mocks__/styleMock.js',
  },
  transform: {
    '^.+\\.jsx?$': '<rootDir>/node_modules/babel-jest',
    '^.+\\.js?$': '<rootDir>/node_modules/babel-jest',
    '\\.(jpg|jpeg|png|gif|eot|otf|webp|svg|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga)$': '<rootDir>/__mocks__/fileMock.js',
  },
  moduleFileExtensions: [
    'js',
    'jsx',
  ],
  unmockedModulePathPatterns: [
    '<rootDir>/node_modules/react/',
    '<rootDir>/node_modules/react-dom/',
  ],
  moduleDirectories: [
    'node_modules',
  ],
  transformIgnorePatterns: [
    '/node_modules/',
  ],
  coveragePathIgnorePatterns: [
    '/node_modules/',
  ],
  modulePathIgnorePatterns: [
    '/node_modules/',
  ],
  collectCoverage: true,
  coverageReporters: [
    'json',
    'lcov',
    'text',
  ],
};

module.exports = jestConfig // eslint-disable-line

here is my package.json
{
  "name": "react-app",
  "version": "1.0.0",
  "main": "index.jsx",
  "license": "MIT",
  "scripts": {
    "start": "npm run start:dev",
    "start:dev": "npm run dev-server --   --mode development --env.NODE_ENV=development --env.PROXY_ORIGIN=http://localhost:3000",
    "start:stage": "npm run dev-server --  --mode development --env.NODE_ENV=development --env.PROXY_ORIGIN=http://localhost:3001",
    "start:dev-min": "npm run start:dev -- --env.MIN_STATS=true",
    "start:analyze-speed": "npm run start:dev -- --env.addons=speedmeasure",
    "build": "npm run test && webpack --optimize-minimize --mode production --env.NODE_ENV=production --env.PUBLIC_PATH=/",
    "build:analyze-bundle": "npm run build -- --env.addons=bundleanalyzer",
    "build:analyze-buddy": "npm run build -- --env.addons=bundlebuddy",
    "dev-server": "webpack-dev-server --inline",
    "test:watch": "npm run test -- --watchAll",
    "test": "export BABEL_ENV=test&&NODE_ENV=test&& jest",
    "profile": "webpack --env.NODE_ENV=production --progress -c --profile --json  > stats.json"
  },
  "description": "this tool will be used to book consultation for clients.",
  "dependencies": {
    "@babel/polyfill": "^7.0.0",
    "antd": "^3.9.0",
    "axios": "^0.18.0",
    "moment": "^2.22.2",
    "prop-types": "^15.6.2",
    "react": "^16.4.2",
    "react-asynchronous-component": "^1.0.2",
    "react-dom": "^16.4.2",
    "react-hot-loader": "^4.3.5",
    "react-redux": "^5.0.7",
    "react-router-dom": "^4.3.1",
    "redux": "^4.0.0",
    "regenerator-runtime": "^0.12.1",
    "redux-saga": "^0.16.0"
  },
  "devDependencies": {
    "@babel/core": "^7.0.0",
    "@babel/plugin-proposal-class-properties": "^7.0.0",
    "@babel/plugin-proposal-object-rest-spread": "^7.0.0",
    "@babel/plugin-syntax-dynamic-import": "^7.0.0",
    "@babel/plugin-transform-modules-commonjs": "^7.0.0",
    "@babel/preset-env": "^7.0.0",
    "@babel/preset-react": "^7.0.0",
    "antd-scss-theme-plugin": "^1.0.7",
    "autoprefixer": "^9.1.3",
    "babel-core": "7.0.0-bridge.0",
    "babel-eslint": "^8.2.6",
    "babel-jest": "^23.4.2",
    "babel-loader": "^8.0.0",
    "babel-plugin-import": "^1.8.0",
    "babel-plugin-module-resolver": "^3.1.1",
    "bundle-buddy-webpack-plugin": "^0.3.0",
    "clean-webpack-plugin": "^0.1.19",
    "css-loader": "^1.0.0",
    "cssnano": "^4.1.0",
    "enzyme": "^3.5.0",
    "enzyme-adapter-react-16": "^1.3.1",
    "error-overlay-webpack-plugin": "^0.1.5",
    "eslint": "^5.5.0",
    "eslint-config-airbnb": "^17.1.0",
    "eslint-import-resolver-babel-module": "^5.0.0-beta.1",
    "eslint-loader": "^2.1.0",
    "eslint-plugin-css-modules": "^2.8.1",
    "eslint-plugin-import": "^2.14.0",
    "eslint-plugin-jsx-a11y": "^6.1.1",
    "eslint-plugin-react": "^7.11.1",
    "extract-text-webpack-plugin": "*",
    "fast-sass-loader": "^1.4.6",
    "file-loader": "^1.1.11",
    "glob": "^7.1.3",
    "hard-source-webpack-plugin": "^0.12.0",
    "html-webpack-plugin": "^3.2.0",
    "jest": "^23.5.0",
    "jest-cli": "^23.5.0",
    "less-loader": "^4.1.0",
    "mini-css-extract-plugin": "^0.4.2",
    "node-sass": "^4.9.3",
    "optimize-css-assets-webpack-plugin": "^5.0.1",
    "postcss-loader": "^3.0.0",
    "purify-css": "^1.2.5",
    "purifycss-webpack": "^0.7.0",
    "sass-loader": "^7.1.0",
    "speed-measure-webpack-plugin": "^1.2.2",
    "style-loader": "^0.22.1",
    "system-bell-webpack-plugin": "*",
    "uglifyjs-webpack-plugin": "^1.3.0",
    "webpack": "^4.17.1",
    "webpack-bundle-analyzer": "^2.13.1",
    "webpack-bundle-tracker": "^0.3.0",
    "webpack-cli": "^3.1.0",
    "webpack-dev-server": "^3.1.7",
    "webpack-manifest-plugin": "^2.0.3",
    "webpack-merge": "^4.1.4"
  }
}

here is the jest test runner fail output
 FAIL  src/App/Elements/__tests__/index.spec.js
  ● Test suite failed to run

    ReferenceError: Input is not defined

      3 | import { Input } from 'antd';
      4 |
    > 5 | const { Search } = Input;
        |                    ^
      6 |
      7 | class TextBoxWithButton extends React.Component {
      8 |   static propTypes = {

      at Object.Input (src/App/Elements/TextBox/TextBoxWithButton/TextBoxWithButton.component.jsx:5:20)
      at Object.<anonymous> (src/App/Elements/index.js:2:1)
      at Object.<anonymous> (src/App/Elements/__tests__/index.spec.js:1:1)

To Reproduce
install bable7
install babel-core = 7.0.0-bridge.0
use object destructring in any component.
and run jest
Expected behavior
jest should be able to use babel-jest and transform  es6 and process it.

Looks like Input is undefined because e.g. antd is mocked by a manual mock (inside __mocks__ dir) or Babel is wrongly configured for test environment.

@thymikee i have not mocked antd anywhere and .babelrc is also added in my post. the strange thing is it was working fine on babel6 . after upgrading to babel7, this issue started after that.

@thymikee i also tried without destructuring and it works..
import React from 'react';
import PropTypes from 'prop-types';
import { Input } from 'antd';

const Search = Input.Search;  // this works fine

Reopening for now, I guess we need to find out better solutions for babel 7, as it currently causes a lot of confusion

The easiest here would be to create reproduction repos we can pull down. While pasting the content of different files is pretty good, doing a quick clone, install, test is way quicker and approachable and we can be sure we haven't missed any detail 🙂
Babel 7 works fine in my experience, so good reproduction cases for bug reports is essential

Excuse me. Is there any solution now?😂

Same with jest 24.8.0

It's might be not jest related.
Removing babel-plugin-import
['import', { libraryName: 'antd', style: 'css' }]
from babel env test configuration resolves the issue.
So it's either babel-plugin-import issue, or babel-plugin-import conflicting with some other plugin.

@artlaman It work for me! thanks 👏🏻

I have in config @babel/plugin-transform-regenerator. Removing it also helps with this issue


Uncaught TypeError: this.ById is not a function

I have taken latest version of Serene from git
following error shows in console window of browser when we click on Sign In button on login page
Uncaught TypeError: this.ById is not a function

It's work in progress, stay on stable versions, it should be byId not ById

thanks


refactor(transformer/react-refresh): using SemanticInjector to insert statements

[!WARNING]
This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

#6881  👈
#6877
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @Dunqing and the rest of your teammates on  Graphite

He's done it again!

Do you @overlookmotel  think we need to wait until https://github.com/oxc-project/backlog/issues/140 is completed before proceeding with this? I am fine anyway.

No let's not wait. Leave the impl GetAddress for Function as it is, and we can remove it later once https://github.com/oxc-project/backlog/issues/140 is done.
Please can you add a comment above that impl though saying why you have to be careful using it? (maybe link to our conversation above)

Merge activity

Oct 26, 9:02 AM EDT: The merge label '0-merge' was detected. This PR will be added to the Graphite merge queue once it meets the requirements.


Request: Double click to open commit in github in changelog of updater

It would be nice to only make a double click to open commit in github in changelog, instead of doing a right click and select  "View on github"

open commit in github

Haven't you been traumatised enough without having to also look at the code? 😅

Added to latest nightly build 👍🏿

works fine 👍


Convert timestamp with nanoseconds JSON attribute to MongoDB ISODate

Describe the bug
I am trying to push JSON message with createdAt (timestamp with nanoseconds) field to MongoDB. I want to save this field as timestamp with nanoseconds in MongoDB - exactly in the same way as time field is saved. Either am I doing something wrong or it seems not to work. I tried to:

define type of this field to time, but nanoseconds are cut off in MongoDB
define time field to take value from createdAt (time_key) - I get strange values for time.

To Reproduce
Post this to http source:
curl -X POST -d '{"createdAt": "2018-05-14T11:37:30.339593", "count": 78, "status": "Sent", "dataId": "332"}' http://localhost:9090/flex
With the configuration:
<source>
  @type http
  port 9090
  bind <IP_ADDRESS>
  <parse>
    @type json
    types createdAt:time:%Y-%m-%dT%H:%M:%S.%N, count:integer, status:string, dataId:string
  </parse>
</source>

I get
createdAt:<PHONE_NUMBER>
time: 2020-04-15T20:30:32.499+00:00

And when I try to define createdAt as time_key:
<source>
  @type http
  port 9090
  bind <IP_ADDRESS>
  <parse>
    @type json
    time_key createdAt
    keep_time_key true
  </parse>
</source>

I get:
createdAt: "2018-05-14T11:37:30.339593"
time: 1970-01-01T00:33:38.339+00:00

So, createdAt is saved as string (correct), but time has strange value.
Expected behavior

I would expect to have createdAt with nanoseconds stored like time field.
I would expect time field to have value of createdAt.