Send validated hardware_id in request_login header (fixes 406 on token refresh)

blinkpy/api.py

@@ -130,7 +130,7 @@ async def request_login(
     headers = {
         "Content-Type": "application/x-www-form-urlencoded",
         "User-Agent": DEFAULT_USER_AGENT,
-        "hardware_id": login_data.get("device_id", "Blinkpy"),
+        "hardware_id": auth.hardware_id,
         "2fa-code": login_data.get("2fa_code") or "",
     }
 

tests/test_auth.py

@@ -277,7 +277,7 @@ async def test_query_refresh_token_exists(
             headers={
                 "Content-Type": "application/x-www-form-urlencoded",
                 "User-Agent": const.DEFAULT_USER_AGENT,
-                "hardware_id": const.DEVICE_ID,
+                "hardware_id": self.auth.hardware_id,
                 "2fa-code": "",
             },
             timeout=10,
@@ -308,7 +308,7 @@ async def test_query_auth_expired(
             headers={
                 "Content-Type": "application/x-www-form-urlencoded",
                 "User-Agent": const.DEFAULT_USER_AGENT,
-                "hardware_id": const.DEVICE_ID,
+                "hardware_id": self.auth.hardware_id,
                 "2fa-code": "",
             },
             timeout=10,

tests/test_oauth.py

@@ -366,6 +366,21 @@ async def test_complete_2fa_login():
                 assert not hasattr(auth, "_oauth_code_verifier")
 
 
+@pytest.mark.asyncio
+async def test_request_login_sends_auth_hardware_id_header():
+    """Test that request_login sends auth.hardware_id as the hardware_id header."""
+    auth = Mock()
+    auth.query = AsyncMock(return_value=Mock(status=200))
+    auth.refresh_token = "refresh_token"
+    auth.hardware_id = "726D586E-6A27-49E4-B61B-1BB070908899"
+
+    login_data = {"username": "foo", "password": "bar"}
+    await api.request_login(auth, "https://example.com", login_data, is_refresh=True)
+
+    headers = auth.query.call_args.kwargs["headers"]
+    assert headers["hardware_id"] == auth.hardware_id
+
+
 @pytest.mark.asyncio
 async def test_oauth_refresh_token_failure():
     """Test refresh token request failing with a non-200 status."""