メニュー
Template for a Hubitat App + child Driver pair that performs OAuth2 authorization code flow against a cloud API, discovers appliances, and exposes per-appliance children as ContactSensor (or other capability).
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Pattern for keeping a rolling temperature-trend sample buffer in Hubitat state, computing slope over a configurable window, and classifying rising/falling/steady/unknown.
Implement Tuya Local v3.3 Groovy drivers on Hubitat using rawSocket, AES-128-ECB, queued retries, and defensive frame parsing.
Use Hubitat async HTTP plus a request queue to authenticate with Cognito, cache tokens in state, refresh proactively, and replay a single 401-failed request.
When two agents produce overlapping skills in one session, consolidate by merging unique content into the highest-confidence existing skill.
Never let cached-state dedup bypass session validity in cloud-backed Hubitat drivers.
Standard guard pattern for async HTTP response callbacks in Hubitat drivers
| name | hubitat-cloud-oauth-app |
| description | Template for a Hubitat App + child Driver pair that performs OAuth2 authorization code flow against a cloud API, discovers appliances, and exposes per-appliance children as ContactSensor (or other capability). |
| domain | groovy |
| confidence | medium |
| source | earned — Bosch Home Connect architecture design (trinity-bosch-home-connect-architecture.md) |
Use this skill when a Hubitat integration needs OAuth2 authorization code flow (browser redirect, not ROPC/refresh-token-only). Unlike SunStat (ROPC flow handled entirely in a Driver), OAuth2 code flow requires a mappings {} block — which is only available in a Hubitat App, not a Driver.
Hubitat App (one app instance)
├── Holds: accessToken, refreshToken, tokenExpiresAt in state.*
├── mappings { path("/oauth/initialize") { action: [GET: "oauthInitialize"] }
│ path("/oauth/callback") { action: [GET: "oauthCallback"] } }
├── oauthInitialize(): createAccessToken() → redirect to cloud auth URL
├── oauthCallback(): exchange code → store tokens → discoverDevices()
├── discoverDevices(): GET /api/devices → addChildDevice() per appliance feature
├── poll(): GET /api/devices/{id}/status → child.parseDeviceState(data)
└── Token refresh: proactiveTokenRefresh() via runIn before expiry
Child Driver (one per physical device feature — e.g., one per door zone)
├── Capabilities: ContactSensor, Sensor (or other as needed)
├── DataValue: cloudApplianceId
├── DataValue: deviceZone (e.g. "refrigerator" | "freezer")
└── parseDeviceState(Map data) → sendEvent contact open/closed
// In App metadata:
oauthPage() // Hubitat built-in — enables OAuth for this app
mappings {
path("/oauth/initialize") { action: [GET: "oauthInitialize"] }
path("/oauth/callback") { action: [GET: "oauthCallback"] }
}
def oauthInitialize() {
def state = UUID.randomUUID().toString()
atomicState.oauthState = state
String callbackUri = URLEncoder.encode("${getApiServerUrl()}/apps/api/${app.id}/oauth/callback?access_token=${state.accessToken}", "UTF-8")
String authUrl = "${CLOUD_AUTH_URL}?client_id=${CLIENT_ID}&response_type=code&redirect_uri=${callbackUri}&scope=${SCOPE}&state=${state}"
redirect(location: authUrl)
}
def oauthCallback() {
String code = params.code
String st = params.state
if (st != atomicState.oauthState) { render contentType: "text/plain", data: "State mismatch — possible CSRF"; return }
exchangeCodeForTokens(code)
render contentType: "text/html", data: "<html><body><h1>Authorized! Return to Hubitat.</h1></body></html>"
}
private void exchangeCodeForTokens(String code) {
// Standard authorization_code exchange
httpPost([uri: TOKEN_URL, requestContentType: "application/x-www-form-urlencoded",
body: "grant_type=authorization_code&code=${code}&client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}&redirect_uri=${callbackUri}"]) { resp ->
state.accessToken = resp.data.access_token
state.refreshToken = resp.data.refresh_token
state.tokenExpiresAt = now() + (resp.data.expires_in as Long) * 1000
}
discoverDevices()
}
DEVICE_ZONES.each { zone ->
String dni = "${DRIVER_PREFIX}-${applianceId}-${zone}"
def existing = getChildDevice(dni)
if (!existing) {
def child = addChildDevice("mads", "My Cloud Child Sensor", dni,
[name: "${displayName} ${zone.capitalize()}", isComponent: false])
child.updateDataValue("cloudApplianceId", applianceId)
child.updateDataValue("deviceZone", zone)
}
}
mappings {}, Drivers do not. Any cloud OAuth2 code-flow driver MUST be implemented as a Hubitat App.oauthCallback() — atomicState survives the redirect round-trip; regular state may not.runIn(secondsUntilExpiry - TOKEN_REFRESH_LEEWAY, "proactiveTokenRefresh") — same pattern as SunStat, just triggered from exchangeCodeForTokens() and after every token refresh.Hubitat Cloud Endpoint callback URL format:
https://cloud.hubitat.com/api/{hub-id}/apps/{app-id}/oauth/callback
Hub ID changes per hub installation. For providers that require exact URI pre-registration (e.g. Bosch Home Connect), this is a blocker — research whether they support wildcard or if the community has a workaround (proxy, static relay URL).
.squad/decisions/inbox/trinity-bosch-home-connect-architecture.mddrivers/sunstat-thermostat/sunstat-thermostat-parent.groovy (ROPC variant — no redirect, but all other patterns identical)mappings {} in a Driver — not supported by Hubitat platform.state (not atomicState) for the OAuth CSRF state parameter — state may not survive the redirect.