Add captcha to BMW ConfigFlow

[rikroe]

Proposed change

BMW have implemented a captcha solution for the North America and Rest of World regions when logging in for the first time using username & password.
Once logged in and using refresh tokens, the captcha is not required anymore.

This PR adds an additional to the config flow where the user can retrieve the captcha for his region.

If during normal operation, the refresh token flow fails, a reauthentication flow with a captcha-specific error message will be triggered.

Additional information
This PR is a second iteration on this topic, please see #129667 for previous discussions.

Ideally, I would have liked to implement the external captcha page (a simple HTML page with some HTML, see e.g. at bimmer_connected/docs/source/captcha/north_america_form.html to be included as external view, however I am not sure if this would be allowed.

If this change can be accepted by the Core team, I will create a docs PR accordingly.

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New integration (thank you!)
• New feature (which adds functionality to an existing integration)
• Deprecation (breaking change to happen in the future)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code or addition of tests

Additional information

• This PR fixes or closes issue: fixes BMW login failure #128598
• This PR is related to issue:
• Link to documentation pull request: Add documention for BMW captcha during config flow home-assistant.io#36032

Checklist

• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• I have followed the development checklist
• I have followed the perfect PR recommendations
• The code has been formatted using Ruff (ruff format homeassistant tests)
• Tests have been added to verify that the new code works.

If user exposed functionality or configuration variables are added/changed:

• Documentation added/updated for www.home-assistant.io

If the code communicates with devices, web services, or third-party tools:

• The manifest file has all fields filled out correctly.
  Updated and included derived files by running: python3 -m script.hassfest.
• New or updated dependencies have been added to requirements_all.txt.
  Updated by running python3 -m script.gen_requirements_all.
• For the updated dependencies - a link to the changelog, or at minimum a diff between library versions is added to the PR description.

To help with the load of incoming pull requests:

• I have reviewed two other open pull requests in this repository.

[home-assistant]

Hey there @gerard33, mind taking a look at this pull request as it has been labeled with an integration (bmw_connected_drive) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of bmw_connected_drive can trigger bot actions by commenting:

• @home-assistant close Closes the pull request.
• @home-assistant rename Awesome new title Renames the pull request.
• @home-assistant reopen Reopen the pull request.
• @home-assistant unassign bmw_connected_drive Removes the current integration label and assignees on the pull request, add the integration domain after the command.
• @home-assistant add-label needs-more-information Add a label (needs-more-information, problem in dependency, problem in custom component) to the pull request.
• @home-assistant remove-label needs-more-information Remove a label (needs-more-information, problem in dependency, problem in custom component) on the pull request.

[rasika-jay]

This PR adds an additional to the config flow where the user can retrieve the captcha for his region.

How does the user retrieve the capcha for their region?

Update: Nevermind, I figured this out. Tested and working. Thank you!

1. Goto https://bimmer-connected.readthedocs.io/en/stable/captcha/rest_of_world.html (or your specific region).
2. Copy and paste the token in to HA

[pergolafabio]

Tried it also "rest of world" region, but i receive:
ERROR (MainThread) [bimmer_connected.api.authentication] MyBMWAuthError due to HTTPStatusError: invalid_client - Client authentication failed (e.g., login failure, unknown client, no client authentication included or unsupported authentication method)

after copy paste the token:

[rasika-jay]

Tried it also "rest of world" region, but i receive: ERROR (MainThread) [bimmer_connected.api.authentication] MyBMWAuthError due to HTTPStatusError: invalid_client - Client authentication failed (e.g., login failure, unknown client, no client authentication included or unsupported authentication method)

after copy paste the token:

Do you have the latest bimmer_connected installed 0.17.0? https://github.com/home-assistant/core/pull/131351/files#diff-ae66cd41e5a8644fe0cdd7b9a2f0fee97b5deabe5f3793da15b73fa6353d2128R585

[pergolafabio]

yes, i added:

"requirements": ["bimmer-connected[china]==0.17.0"]

[rasika-jay]

yes, i added:

"requirements": ["bimmer-connected[china]==0.17.0"]

try installing the standard (not the china version) in the the root of the bmw_connected_drive directory

[pergolafabio]

hmm, that didnt help , i test later again, thnx

[rikroe]

Thanks for testing.

Some issues I stumbled accross while building/testing:

• You waited too long after generating the captcha token. Unsure how long they are valid, but it is rather shortlived (I guess single digit minutes)
• HA environment doesn't have the correct lib installed (check that manifest is set and restart HA)
• Not using the correct region for captcha (they are different!). The link inside the config flow should point you to the correct one
• The password is wrong (it worked due to refresh tokens, but now that has been revoked). Check on MyBMW website if you are still able to login with the password from HA

@pergolafabio It seems as if your environment isn't fully set up. E.g. you do not have any translations available.

Unfortunately, the BMW API doesn't give any more specific feedback than "Invalid login".

[pergolafabio]

hey @rikroe , indeed its working again! Seems for some reason, the login on mybmw website wasnt working anymore, i had todo a reset there ... strange, cause i was still logged in in the bmw app
after reset, now your PR is working again!

[frenck]

⚠️ This is a pull request.

The discussion happening on these should be about the code and contents of this PR. And not about how to do workaround and things like that. If you have to ask how to apply this, the answer is: You'd have to wait until this has been reviewed and shipped.

Thanks 👍

../Frenck

[therealprof]

How about directing the user how to obtain the token and adding a UI element to add the token? The small indirection shouldn't be a huge trouble in addition to providing the regular user credentials in the configuration dialog and no external JS is required.

[rikroe]

How about directing the user how to obtain the token and adding a UI element to add the token? The small indirection shouldn't be a huge trouble in addition to providing the regular user credentials in the configuration dialog and no external JS is required.

Thats what this PR does.

[therealprof]

Thats what this PR does.

Nerver mind then. I haven't read the PR itself, but the title and the discussion are very misleading.

A captcha is a test whether there's a human on the other end, a token is of proof of validity/identity. Your PR description itself says you weren't sure if the rendering of the captcha page would be permissible (and as it turns out -- this won't be accepted).

Adding an input field for a token is a completely different thing and done by various integrations im HA already. May I humbly suggest changing the title of the PR to avoid confusion about the actual current proposal?

[frenck]

Thanks for all the patience and cooperation @rikroe 👍

Looks good to me; let's ship it.

../Frenck

PS: For the reader who is wondering:

"Cool... but how do I install this?"

Well, it is being merged into the 2024.12 release, which will become generally available on December 4th, 2024. If you want to try it out sooner, you can opt-in to join our beta releases.

[rikroe]

Thanks for the support @frenck!