fix(skoda): correct VW authorize params — native login now works live - #223
Merged
Conversation
The native login was built from synthetic fixtures and failed live with HTTP 401 invalid_token on /oidc/v1/authorize. Verified against the real Skoda API and the python-myskoda reference: - response_type must be 'code' (not 'code id_token') - code_challenge_method must be lowercase 's256' - prompt=login is required - with response_type=code the auth code returns as a QUERY param, not the #fragment, so parseFragment now reads query first, fragment as fallback Confirmed end-to-end against the live API: full flow now yields an access token.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Live login failed with status
login_failed(detail:SKODA_AUTH_FLOW_CHANGED: cannot parse identity page). Root cause traced systematically: the very first request to/oidc/v1/authorizereturned HTTP 401{"error":"invalid_token"}— the native flow was built from synthetic fixtures and never verified against the real API, so the authorize request was malformed.Fix (verified against the live Skoda API + the python-myskoda reference)
response_type:code id_token→codecode_challenge_method:S256→s256(lowercase)prompt=loginresponse_type=codethe auth code returns as a query param (?code=), not the#fragment→parseFragmentnow reads query first, fragment as fallbackVerification
Ran the full corrected flow end-to-end against the real API using the operator's stored credential (nothing sensitive logged): authorize 200 → email page parsed → password page parsed → reached
myskoda://redirect → code extracted via query → token exchange 200, access token obtained. Unit tests updated (authorize params asserted, query-based code extraction covered); all 61 skoda tests pass.Trivy's HIGH (grpc-go GHSA-hrxh-6v49-42gf) is a pre-existing Caddy/Go base-image CVE, unrelated to this change.
🤖 Generated with Claude Code
https://claude.ai/code/session_01NACNfM9Uv6hwZwzXpEkHXQ