Add login_with_refresh_token() for token-only authentication - #26
Merged
Conversation
Lets an application persist a session across restarts without storing the account password. Previously the only way was to set the private _refresh_token attribute and call authentication_refresh().
Owner
|
Looks good to me, thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently the only public way to authenticate is
login(username, password), so anything that wants to keep a session across restarts has to reach into a private attribute:This adds
login_with_refresh_token(token)and a publicrefresh_tokenproperty, so the round trip has a supported path.Why it matters beyond tidiness. Lucid permits one account per car and the mobile app has no secondary logins, so a stored password is the primary account credential — it unlocks the doors and opens the frunk, and it can't be revoked without a password change. A refresh token can be revoked with "log out all devices." Letting integrations store the weaker secret is a meaningful difference for anything unattended.
One caveat, documented in the docstring:
GetNewJWTTokenResponsecarries onlysession_info— nouser_profileand nouser_vehicle_data— soapi.userstaysNoneafter a token login untilfetch_vehicles()is called. Worth knowing for downstreams that assert onapi.userafter authenticating.Tested against a real vehicle (Gravity,
1.4.1+ this patch):black --checkclean.A behavioural note you may want to document separately: the refresh token does not appear to rotate. Three consecutive
authentication_refresh()calls returned a byte-identical token, and replaying an earlier one still worked. That's convenient — several processes can share a stored token without coordination — but it does mean it's a long-lived bearer credential rather than a self-rotating one, andSessionInfocarries no expiry field for it, so its lifetime isn't discoverable from the API. I've described it that way in the property docstring; happy to soften or drop that wording if it doesn't match your understanding.