Handle auth errors in velux integration and add reauth flow (#159596)

Co-authored-by: Joost Lekkerkerker <joostlek@outlook.com>

homeassistant/components/velux/__init__.py

@@ -13,6 +13,7 @@ from homeassistant.const import (
 )
 from homeassistant.core import HomeAssistant, ServiceCall
 from homeassistant.exceptions import (
+    ConfigEntryAuthFailed,
     ConfigEntryNotReady,
     HomeAssistantError,
     ServiceValidationError,
@@ -85,6 +86,18 @@ async def async_setup_entry(hass: HomeAssistant, entry: VeluxConfigEntry) -> boo
         LOGGER.debug("Retrieving nodes from %s", host)
         await pyvlx.load_nodes()
     except (OSError, PyVLXException) as ex:
+        # Since pyvlx raises the same exception for auth and connection errors,
+        # we need to check the exception message to distinguish them.
+        # Ultimately this should be fixed in pyvlx to raise specialized exceptions,
+        # right now it's been a while since the last pyvlx release, so we do this workaround here.
+        if (
+            isinstance(ex, PyVLXException)
+            and ex.description == "Login to KLF 200 failed, check credentials"
+        ):
+            raise ConfigEntryAuthFailed(
+                f"Invalid authentication for Velux gateway at {host}"
+            ) from ex
+
         # Defer setup and retry later as the bridge is not ready/available
         raise ConfigEntryNotReady(
             f"Unable to connect to Velux gateway at {host}. "

homeassistant/components/velux/config_flow.py

@@ -1,5 +1,6 @@
 """Config flow for Velux integration."""
 
+from collections.abc import Mapping
 from typing import Any
 
 from pyvlx import PyVLX, PyVLXException
@@ -28,6 +29,15 @@ async def _check_connection(host: str, password: str) -> dict[str, Any]:
         await pyvlx.connect()
         await pyvlx.disconnect()
     except (PyVLXException, ConnectionError) as err:
+        # since pyvlx raises the same exception for auth and connection errors,
+        # we need to check the exception message to distinguish them
+        if (
+            isinstance(err, PyVLXException)
+            and err.description == "Login to KLF 200 failed, check credentials"
+        ):
+            LOGGER.debug("Invalid password")
+            return {"base": "invalid_auth"}
+
         LOGGER.debug("Cannot connect: %s", err)
         return {"base": "cannot_connect"}
     except Exception as err:  # noqa: BLE001
@@ -69,6 +79,42 @@ class VeluxConfigFlow(ConfigFlow, domain=DOMAIN):
             errors=errors,
         )
 
+    async def async_step_reauth(
+        self, entry_data: Mapping[str, Any]
+    ) -> ConfigFlowResult:
+        """Handle reauth flow."""
+        return await self.async_step_reauth_confirm()
+
+    async def async_step_reauth_confirm(
+        self, user_input: dict[str, str] | None = None
+    ) -> ConfigFlowResult:
+        """Handle reauth flow when password has changed."""
+        reauth_entry = self._get_reauth_entry()
+        errors: dict[str, str] = {}
+
+        if user_input is not None:
+            errors = await _check_connection(
+                reauth_entry.data[CONF_HOST], user_input[CONF_PASSWORD]
+            )
+            if not errors:
+                return self.async_update_reload_and_abort(
+                    reauth_entry,
+                    data_updates={CONF_PASSWORD: user_input[CONF_PASSWORD]},
+                )
+
+        return self.async_show_form(
+            step_id="reauth_confirm",
+            data_schema=vol.Schema(
+                {
+                    vol.Required(CONF_PASSWORD): cv.string,
+                }
+            ),
+            errors=errors,
+            description_placeholders={
+                "host": reauth_entry.data[CONF_HOST],
+            },
+        )
+
     async def async_step_dhcp(
         self, discovery_info: DhcpServiceInfo
     ) -> ConfigFlowResult:

homeassistant/components/velux/quality_scale.yaml

@@ -30,7 +30,7 @@ rules:
   integration-owner: done
   log-when-unavailable: todo
   parallel-updates: done
-  reauthentication-flow: todo
+  reauthentication-flow: done
   test-coverage:
     status: todo
     comment: add tests where missing

homeassistant/components/velux/strings.json

@@ -1,10 +1,12 @@
 {
   "config": {
     "abort": {
-      "already_configured": "[%key:common::config_flow::abort::already_configured_device%]"
+      "already_configured": "[%key:common::config_flow::abort::already_configured_device%]",
+      "reauth_successful": "[%key:common::config_flow::abort::reauth_successful%]"
     },
     "error": {
       "cannot_connect": "[%key:common::config_flow::error::cannot_connect%]",
+      "invalid_auth": "[%key:common::config_flow::error::invalid_auth%]",
       "unknown": "[%key:common::config_flow::error::unknown%]"
     },
     "step": {
@@ -17,6 +19,15 @@
         },
         "description": "Please enter the password for {name} ({host})"
       },
+      "reauth_confirm": {
+        "data": {
+          "password": "[%key:common::config_flow::data::password%]"
+        },
+        "data_description": {
+          "password": "The password for your KLF200 gateway."
+        },
+        "description": "The password for {host} is incorrect. Please enter the correct password."
+      },
       "user": {
         "data": {
           "host": "[%key:common::config_flow::data::host%]",

tests/components/velux/test_config_flow.py

@@ -60,6 +60,10 @@ async def test_user_flow(
 @pytest.mark.parametrize(
     ("exception", "error"),
     [
+        (
+            PyVLXException("Login to KLF 200 failed, check credentials"),
+            "invalid_auth",
+        ),
         (PyVLXException("DUMMY"), "cannot_connect"),
         (Exception("DUMMY"), "unknown"),
     ],
@@ -138,6 +142,94 @@ async def test_user_flow_duplicate_entry(
     assert result["reason"] == "already_configured"
 
 
+async def test_reauth_flow(
+    hass: HomeAssistant,
+    mock_config_entry: MockConfigEntry,
+    mock_pyvlx: AsyncMock,
+) -> None:
+    """Test that reauth flow works with valid credentials."""
+
+    mock_config_entry.add_to_hass(hass)
+
+    result = await mock_config_entry.start_reauth_flow(hass)
+
+    assert result["type"] is FlowResultType.FORM
+    assert result["step_id"] == "reauth_confirm"
+    assert result["errors"] == {}
+
+    result = await hass.config_entries.flow.async_configure(
+        result["flow_id"],
+        user_input={
+            CONF_PASSWORD: "New Password",
+        },
+    )
+
+    assert result["type"] is FlowResultType.ABORT
+    assert result["reason"] == "reauth_successful"
+
+    assert mock_config_entry.data[CONF_PASSWORD] == "New Password"
+
+    mock_pyvlx.connect.assert_called_once()
+    mock_pyvlx.disconnect.assert_called_once()
+
+
+@pytest.mark.parametrize(
+    ("exception", "error"),
+    [
+        (
+            PyVLXException("Login to KLF 200 failed, check credentials"),
+            "invalid_auth",
+        ),
+        (PyVLXException("DUMMY"), "cannot_connect"),
+        (Exception("DUMMY"), "unknown"),
+    ],
+)
+async def test_reauth_errors(
+    hass: HomeAssistant,
+    mock_pyvlx: AsyncMock,
+    mock_config_entry: MockConfigEntry,
+    exception: Exception,
+    error: str,
+) -> None:
+    """Test error handling in reauth flow."""
+    mock_config_entry.add_to_hass(hass)
+
+    result = await mock_config_entry.start_reauth_flow(hass)
+
+    assert result["type"] is FlowResultType.FORM
+    assert result["step_id"] == "reauth_confirm"
+
+    mock_pyvlx.connect.side_effect = exception
+
+    result = await hass.config_entries.flow.async_configure(
+        result["flow_id"],
+        user_input={
+            CONF_PASSWORD: "New Password",
+        },
+    )
+
+    assert result["type"] is FlowResultType.FORM
+    assert result["step_id"] == "reauth_confirm"
+    assert result["errors"] == {"base": error}
+
+    mock_pyvlx.connect.assert_called_once()
+    mock_pyvlx.disconnect.assert_not_called()
+
+    mock_pyvlx.connect.side_effect = None
+
+    result = await hass.config_entries.flow.async_configure(
+        result["flow_id"],
+        user_input={CONF_PASSWORD: "New Password"},
+    )
+
+    assert result["type"] is FlowResultType.ABORT
+    assert result["reason"] == "reauth_successful"
+
+    assert mock_config_entry.data[CONF_PASSWORD] == "New Password"
+
+    mock_pyvlx.disconnect.assert_called_once()
+
+
 async def test_dhcp_discovery(
     hass: HomeAssistant,
     mock_pyvlx: AsyncMock,
@@ -175,6 +267,10 @@ async def test_dhcp_discovery(
 @pytest.mark.parametrize(
     ("exception", "error"),
     [
+        (
+            PyVLXException("Login to KLF 200 failed, check credentials"),
+            "invalid_auth",
+        ),
         (PyVLXException("DUMMY"), "cannot_connect"),
         (Exception("DUMMY"), "unknown"),
     ],

tests/components/velux/test_init.py

@@ -64,6 +64,30 @@ async def test_setup_retry_on_oserror_during_scenes(
     mock_pyvlx.load_nodes.assert_not_called()
 
 
+async def test_setup_auth_error(
+    mock_config_entry: ConfigEntry, hass: HomeAssistant, mock_pyvlx: AsyncMock
+) -> None:
+    """Test that PyVLXException with auth message raises ConfigEntryAuthFailed and starts reauth flow."""
+
+    mock_pyvlx.load_scenes.side_effect = PyVLXException(
+        "Login to KLF 200 failed, check credentials"
+    )
+    mock_config_entry.add_to_hass(hass)
+
+    await hass.config_entries.async_setup(mock_config_entry.entry_id)
+    await hass.async_block_till_done()
+
+    # ConfigEntryAuthFailed results in SETUP_ERROR state
+    assert mock_config_entry.state is ConfigEntryState.SETUP_ERROR
+
+    flows = hass.config_entries.flow.async_progress()
+    assert len(flows) == 1
+    assert flows[0]["step_id"] == "reauth_confirm"
+
+    mock_pyvlx.load_scenes.assert_awaited_once()
+    mock_pyvlx.load_nodes.assert_not_called()
+
+
 @pytest.fixture
 def platform() -> Platform:
     """Fixture to specify platform to test."""