Login fails

[viaConBodhi]

upgraded to latest package today to see if that would fix and still having issues...all was running fine last Friday and today I'm getting a

400 Client Error: Bad Request for url: https://api.robinhood.com/oauth2/token/

log into Fast_Arrow

  2 client = Client(username=XXXXX, password=XXXXXX)

----> 3 client.authenticate()
4 #login_oauth2
5 # client = Client.login_oauth2(self,username=XXXXX, password=XXXXX)
~\AppData\Local\Continuum\anaconda3\envs\py3.6\lib\site-packages\fast_arrow\client.py in authenticate(self)
32 '''
33 if "username" in self.options and "password" in self.options:
---> 34 self.login_oauth2(self.options["username"], self.options["password"], self.options.get('mfa_code'))
35 elif "access_token" in self.options and "refresh_token" in self.options:
36 self.access_token = self.options["access_token"]

~\AppData\Local\Continuum\anaconda3\envs\py3.6\lib\site-packages\fast_arrow\client.py in login_oauth2(self, username, password, mfa_code)
117 data['mfa_code'] = mfa_code
118 url = "https://api.robinhood.com/oauth2/token/"
--> 119 res = self.post(url, payload=data, retry=False)
120
121 if res is None:

~\AppData\Local\Continuum\anaconda3\envs\py3.6\lib\site-packages\fast_arrow\client.py in post(self, url, payload, retry)
78 attempts += 1
79 if res.status_code in [400]:
---> 80 raise e
81 elif retry and res.status_code in [403]:
82 self.relogin_oauth2()

~\AppData\Local\Continuum\anaconda3\envs\py3.6\lib\site-packages\fast_arrow\client.py in post(self, url, payload, retry)
70 try:
71 res = requests.post(url, headers=headers, data=payload, timeout=15, verify=self.certs)
---> 72 res.raise_for_status()
73 if res.headers['Content-Length'] == '0':
74 return None

~\AppData\Local\Continuum\anaconda3\envs\py3.6\lib\site-packages\requests\models.py in raise_for_status(self)
938
939 if http_error_msg:
--> 940 raise HTTPError(http_error_msg, response=self)
941
942 def close(self):

[westonplatter]

@wccramer I see you closed this issue. Did it work for you?

[viaConBodhi]

@westonplatter No...I messed up my prior post and started a new. Found the following thread somewhere else on this which means your code most likely is affected for others (like me). Looks like the recent RH update has affected others too but not all. Nice work on the code base though...been very helpful up till when login stopped working. Let me know if you find a solution as I'm keeping an eye out for those with more skills to help provide some options...no pun intended.

robinhood-unofficial/pyrh#176

[westonplatter]

@wccramer thanks for the context. Won't have time to look at it for a while. Happy to look at a PR.

[viaConBodhi]

@westonplatter If/when I get can get something together I'll send your way.

[halessi]

Also having this error as of a few hours ago, everything was working well last night. (~ 12 hours ago)

[Chenzoh12]

Same as @halessi.
Worked perfectly yesterday and last night and then as of this morning I can not access anything.

[halessi]

@wccramer Any chance you could reopen this? Or keeping consolidated to #86 ?

[viaConBodhi]

Checkout the link I posted above for the thread from Jamonek. There are some folks who have a solution but the code is mostly in C#/Java but there is some python. No fully updated code base but looks like you should be able to build out a solution with what has been provided via the discussions. RH has added SMS/email verification so login has changed. Looks like they are rolling it out in phases though.

[Chenzoh12]

Agh yes, I saw that thread as well. I could not figure out my next steps exactly once I received the the SMS verification code. If anybody has any idea how to clear that hurdle please do let me know. I will keep my eyes on that thread as well.

…

On Wed, May 1, 2019 at 12:42 PM wccramer ***@***.***> wrote: Checkout the link I posted above for the thread from robinhood-unofficial/pyrh#176 <robinhood-unofficial/pyrh#176>. There are some folks who have a solution but the code is mostly in C#/Java but there is some python. No fully updated code base but looks like you should be able to build out a solution with what has been provided via the discussions. RH has added SMS/email verification so login has changed. Looks like they are rolling it out in phases though. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#85 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AG3DHZIE6SOE57A6JR2XKT3PTHB6ZANCNFSM4HJE7IYQ> .

[viaConBodhi]

@Chenzoh12 Haven't tested but it looks like you can opt to have an email sent then, if using Google API, use some reg X and email filtering to capture the # and add to the variable. A few steps but seems like it should work.

[halessi]

@Chenzoh12

Utilizing what they did over at the Robinhood repo linked earlier, I replaced the first few lines of login_oauth2 with:

   `if self.device_token == None:
        self.device_token = self.GenerateDeviceToken()

    data = {
        "grant_type": "password",
        "scope": "internal",
        "client_id": CLIENT_ID,
        "expires_in": 86400,
        "password": password,
        "username": username,
        "challenge_type": 'sms',
        "device_token": self.device_token
    }`

with GenerateDeviceToken (also written in the other thread) being:

  `def GenerateDeviceToken():
    rands = []
    for i in range(0,16):
        r = random.random()
        rand = 4294967296.0 * r
        rands.append((int(rand) >> ((3 & i) << 3)) & 255)

    hexa = []
    for i in range(0,256):
        hexa.append(str(hex(i+256)).lstrip("0x").rstrip("L")[1:])

    id = ""
    for i in range(0,16):
        id += hexa[rands[i]]

        if (i == 3) or (i == 5) or (i == 7) or (i == 9):
            id += "-"

    return id`

And I get an SMS text. Going to swap to email and see if I can somehow do what @wccramer suggested.

[viaConBodhi]

@halessi thanks for that! Let me know if it works out...caught up on day job stuff so I can't play with it now.

[halessi]

Alright, I've managed to get it working off of what was said in the other thread. The initial post for authenticating returns a "challenge", of which it's necessary to save the challenge id. If you have that, you can use the verification code retrieved via the below function (note, user & pass are gmail login info) if you submitted the original post with {'challenge_type': 'email'}:

`def fetch_mfa_code(self):
    username, password = user, pass

    obj = imaplib.IMAP4_SSL('imap.gmail.com')
    obj.login(username, password)
    obj.select()

    cutoff = (datetime.today() - timedelta(minutes = 2)).strftime('%d-%b-%Y')
    typ, data = obj.search(None, 
                '(SINCE %s) (FROM "notifications@robinhood.com")' % (cutoff,))
    email_ids = data[0].decode().split(' ')
    email = obj.fetch(email_ids[-1], '(UID BODY[TEXT])')

    parsed = email[1][0][1].decode().split('r')[9]
    mfa_code = [int(s) for s in re.findall(pattern = r'\d+', string = parsed)]
    
    assert len(str(mfa_code[0])) == 6, print('ERROR: failed to parse mfa code.')
    return mfa_code[0]`

Use this verification code alongside the saved challenge id to submit another post:

  `if mfa_code is not None and id is not None:
        url = 'https://api.robinhood.com/challenge/{}/respond/'.format(id)
        payload = {'response' : mfa_code}
        res = self.post(url, payload = payload, retry = False)`

Res['status'] should be validated, and you're good! I can make a PR if @westonplatter wants, but I'm certain my solution isn't exactly the best approach.