Closed uzlonewolf closed 1 year ago
With the "associated-users" API endpoint getting blocked I can see an argument where an empty DeviceID should also kick off a scan, but I do hope we can eventually find another way to get the device list without needing a device ID.
I wonder why they would restrict this? My only thought is that there could be an attack vector they are trying to harden a bit (e.g. bad actor trying to fetch all of your devices after somehow gaining access somehow to your IoT API credentials).
I have no idea.
I was looking through the "official" Python API implementation at https://github.com/tuya/tuya-iot-python-sdk/blob/main/example/api.py and they get the device list by calling /v1.0/iot-03/users/assets
followed by /v1.0/iot-02/assets/{}/devices
, but of course they return "permission deny" as well. Looking at the "Quick Start Guide" at https://developer.tuya.com/en/docs/iot/quick-start1?id=K95ztz9u9t89n I wonder if there's an API Service we need to add authorization for to get access to these.
Going a bit off topic here, but while looking through that repository I noticed PROTOCOL_DEVICE_REPORT = 4
and thought "hmmm, 'protocol: 4' looks familiar." A bit more digging reveals while 4 and 20 are the only protocols defined there, https://github.com/tuya/tuya-connect-kit-for-mqtt-embedded-c/blob/without-submodules/include/mqtt_service.h lists a bunch more. So, it turns out protocol: 4
means dev -> cloud push dp data
and protocol: 5
is cloud -> dev send dp data
. Mystery from #308 solved!
Wow! Amazing find!! I wonder how we could capture this info gold? Maybe add it to https://github.com/jasonacox/tinytuya/discussions/260 ?
PR merged. Love the scan function! I'll push this as v1.12.4 as a minor patch.