fix(eu-data-act): actionable login error messages + don't restart-loop on bad creds

The login flow used to throw a single generic 'Login failed - check email
and password' for every IdP refusal. The Identity Portal actually exposes
a specific error code in the landing-URL query string (?error=...) and
the templateModel.error in the body — we now parse both and map known
codes to user-actionable messages:

  password_invalid       -> 'password incorrect'
  email_invalid          -> 'email not recognised'
  throttled              -> 'too many failed attempts, wait ~30 min'
  account_disabled       -> 'account locked, reset password'
  tenants.notAuthorized  -> 'not entitled to EU Data Act portal,
                            complete browser-side first-time setup'

Plus, the runEuDataAct catch in main.js no longer schedules a 30-min
restart loop for credential failures (pointless — won't self-heal). It
logs once, marks info.connection=false, and stays put until the user
fixes the config and restarts manually. Network/transient failures still
get the 30-min retry as before.

Verified live: wrong password now reports
'Login failed: password incorrect (login.errors.password_invalid).'

Author: TA2k

lib/euDataAct.js

@@ -140,6 +140,59 @@ function loginErrorText(html) {
   return String(err);
 }
 
+/**
+ * Map a failed-login landing page (URL + HTML) to a user-actionable message.
+ *
+ * Identity portal surfaces the failure reason in three places:
+ *   1. ?error=<code> on the landing URL (e.g. login.errors.password_invalid)
+ *   2. window._IDK.templateModel.error in the body
+ *   3. nothing at all — bare "back to signin-service" redirect
+ *
+ * Known error codes (observed in the wild):
+ *   login.errors.password_invalid     - wrong password
+ *   login.errors.email_invalid        - email not registered / typo
+ *   login.error.throttled             - too many failed attempts, locked out
+ *   login.errors.tenants.notAuthorized - account ineligible for this client
+ *   login.errors.account_disabled     - account locked by VW
+ */
+function diagnoseLoginFailure(landing) {
+  const errCode = (() => {
+    try {
+      return new URL(landing.url).searchParams.get("error");
+    } catch {
+      return null;
+    }
+  })();
+  const modelText = loginErrorText(landing.body);
+  const code = errCode || modelText || "";
+
+  if (/password_invalid/i.test(code)) {
+    return "Login failed: password incorrect (login.errors.password_invalid).";
+  }
+  if (/email_invalid|user_id|identifier/i.test(code)) {
+    return "Login failed: email not recognised by VW Identity (login.errors.email_invalid).";
+  }
+  if (/throttle|rate_limit|too_many/i.test(code)) {
+    return "Login failed: too many failed attempts, account temporarily throttled by VW. " +
+      "Wait ~30 min before retrying.";
+  }
+  if (/account_disabled|locked|blocked/i.test(code)) {
+    return "Login failed: VW account is locked or disabled. Reset the password at " +
+      "https://identity.vwgroup.io/ before retrying.";
+  }
+  if (/tenants?\.?notAuthorized|client_not_allowed|consent/i.test(code)) {
+    return "Login failed: this VW account is not entitled to use the EU Data Act portal. " +
+      "Open https://eu-data-act.drivesomethinggreater.com/ in a browser and complete " +
+      "first-time setup (terms, vehicle linking).";
+  }
+  if (code) {
+    return `Login failed: ${code}`;
+  }
+  // Last resort: include the URL so the user can paste it into a browser
+  // and see what the portal is complaining about.
+  return `Login failed (no error code reported by IdP). Landing URL: ${landing.url}`;
+}
+
 // --- value parsing (mirrors data.py.parse_value) ---------------------------
 
 const _DURATION_RE = /^(-?\d+(?:\.\d+)?)\s*s$/i;
@@ -450,7 +503,7 @@ class EuDataActClient {
       throw new Error(err || `Login rejected (HTTP ${landing.status})`);
     }
     if (landing.url.includes("signin-service") || landing.url.includes("/error")) {
-      throw new Error("Login failed - check email and password");
+      throw new Error(diagnoseLoginFailure(landing));
     }
     if (new URL(landing.url).host !== new URL(BASE_URL).host) {
       throw new Error("Login did not complete (ended at " + landing.url + ")");

main.js

@@ -312,7 +312,19 @@ class VwWeconnect extends utils.Adapter {
     // portal-based pipeline.
     if (this.config.type === "id") {
       this.runEuDataAct().catch((err) => {
-        this.log.error("EU Data Act flow failed: " + (err && err.message ? err.message : err));
+        const msg = (err && err.message) || String(err);
+        this.log.error("EU Data Act flow failed: " + msg);
+        // Credential / account problems don't self-heal on a restart — just
+        // log once and stay down until the user fixes the config.
+        if (/login failed|password_invalid|email_invalid|account.*(locked|disabled)|not entitled/i.test(msg)) {
+          this.log.error(
+            "Adapter staying down until credentials are corrected. " +
+              "Update user/password in the adapter settings, then restart manually.",
+          );
+          this.setState("info.connection", false, true);
+          return;
+        }
+        // Anything else (network, portal 5xx, IdP transient): retry in 30 min.
         this.log.error("Restart Adapter in 30min");
         this.restartTimeout && clearTimeout(this.restartTimeout);
         this.restartTimeout = setTimeout(() => {