@webex/contact-center 3.12.0-next.16 → 3.12.0-next.161

package/src/services/core/aqm-reqs.ts

@@ -117,16 +117,15 @@ export default class AqmReqs {
             clear();
             const notifFail = c.notifFail!;
             if ('errId' in notifFail) {
-              LoggerProxy.log(`Routing request failed: ${JSON.stringify(msg)}`, {
-                module: AQM_REQS_FILE,
-                method: METHODS.CREATE_PROMISE,
-              });
-              const eerr = new Err.Details(notifFail.errId, msg as any);
-              LoggerProxy.log(`Routing request failed: ${eerr}`, {
+              const error = new Err.Details(notifFail.errId, msg as any);
+
+              // The raw routing-failure payload/error is never logged verbatim; only a
+              // redacted, non-sensitive diagnostic is emitted regardless of redactSensitiveLogs.
+              LoggerProxy.log('Routing request failed (sensitive details redacted)', {
                 module: AQM_REQS_FILE,
                 method: METHODS.CREATE_PROMISE,
               });
-              reject(eerr);
+              reject(error);
             } else {
               reject(notifFail.err(msg as any));
             }
@@ -176,13 +175,20 @@ export default class AqmReqs {
             if (response?.headers) {
               response.headers.Authorization = '*';
             }
-            LoggerProxy.error(
-              `Routing request timeout${keySuccess}${JSON.stringify(response)}${c.url}`,
-              {
+            if (c.redactSensitiveLogs) {
+              LoggerProxy.error('Routing request timeout (sensitive details redacted)', {
                 module: AQM_REQS_FILE,
                 method: METHODS.CREATE_PROMISE,
-              }
-            );
+              });
+            } else {
+              LoggerProxy.error(
+                `Routing request timeout${keySuccess}${JSON.stringify(response)}${c.url}`,
+                {
+                  module: AQM_REQS_FILE,
+                  method: METHODS.CREATE_PROMISE,
+                }
+              );
+            }
             reject(
               new Err.Details('Service.aqm.reqs.Timeout', {
                 key: keySuccess,

package/src/services/core/constants.ts

@@ -80,6 +80,14 @@ export const PARTICIPANT_TYPES = {
 /** Interaction state for consultation */
 export const STATE_CONSULT = 'consult';
 
+/**
+ * Trusted domains for the RoutingNotifs WebSocket connection. A `webSocketUrl` returned by the
+ * subscribe/register API is only opened when its hostname matches one of these domains exactly
+ * or is a subdomain of one of them.
+ * @ignore
+ */
+export const ALLOWED_ROUTING_NOTIFS_DOMAINS = ['cisco.com', 'ciscoccservice.com'];
+
 // Method names for core services
 export const METHODS = {
   // WebexRequest methods

package/src/services/core/types.ts

@@ -1,4 +1,10 @@
-import {HTTP_METHODS, RequestBody, WebexRequestPayload} from '../../types';
+import {
+  AIAssistantEventName,
+  AIAssistantEventType,
+  HTTP_METHODS,
+  RequestBody,
+  WebexRequestPayload,
+} from '../../types';
 import * as Err from './Err';
 import {Msg} from './GlobalTypes';
 
@@ -20,6 +26,8 @@ export type Req<TRes, TErr> = {
   url: string;
   host?: string;
   method?: HTTP_METHODS;
+  /** Suppress request URLs and routing payloads from AQM logs for sensitive operations. */
+  redactSensitiveLogs?: boolean;
   err?:
     | ((errObj: WebexRequestPayload) => Err.Details<'Service.reqs.generic.failure'>)
     | Err.IdsMessage
@@ -46,3 +54,27 @@ export type ConfEmpty<TRes, TErr> = () => Req<TRes, TErr>;
 export type Res<TRes, TReq> = (p: TReq, cbRes?: CbRes<TRes>) => Promise<TRes>;
 export type ResEmpty<TRes> = (cbRes?: CbRes<TRes>) => Promise<TRes>;
 export type CbRes<TRes> = (res: any) => void | TRes;
+
+/** @internal Pending request completed by a correlated RTD response. */
+export type PendingRtdRequest<T> = {
+  correlationId: string;
+  rtdEventType: string;
+  timeoutId?: ReturnType<typeof setTimeout>;
+  resolve: (payload: T) => void;
+  reject: (error: Error) => void;
+};
+
+/** @internal Request configuration for an event completed by an RTD response. */
+export type RtdRequestOptions = Readonly<{
+  correlationId: string;
+  rtdEventType: string;
+  timeoutMs: number;
+  createTimeoutError: () => Error;
+  agentId: string;
+  interactionId: string;
+  eventType: AIAssistantEventType;
+  eventName: AIAssistantEventName;
+  eventMetaData?: Record<string, unknown>;
+  publishTimestamp?: number;
+  timeout?: number;
+}>;

package/src/services/core/websocket/WebSocketManager.ts

@@ -5,8 +5,14 @@ import {ConnectionLostDetails} from './types';
 import {CC_EVENTS, SubscribeResponse, WelcomeResponse} from '../../config/types';
 import LoggerProxy from '../../../logger-proxy';
 import workerScript from './keepalive.worker';
-import {KEEPALIVE_WORKER_INTERVAL, CLOSE_SOCKET_TIMEOUT, METHODS} from '../constants';
+import {
+  KEEPALIVE_WORKER_INTERVAL,
+  CLOSE_SOCKET_TIMEOUT,
+  METHODS,
+  ALLOWED_ROUTING_NOTIFS_DOMAINS,
+} from '../constants';
 import {WEB_SOCKET_MANAGER_FILE} from '../../../constants';
+import {isAllowedUrlHost} from '../Utils';
 
 /**
  * WebSocketManager handles the WebSocket connection for Contact Center operations.
@@ -107,7 +113,25 @@ export class WebSocketManager extends EventEmitter {
         body: connectionConfig,
         headers: isIntEnv && orgId ? {'X-ORGANIZATION-ID': orgId} : undefined,
       });
-      this.url = subscribeResponse.body.webSocketUrl;
+      const {webSocketUrl} = subscribeResponse.body;
+
+      // Only a `wss` URL whose hostname is, or is a subdomain of, one of the allow-listed
+      // RoutingNotifs domains is considered trusted.
+      let isWssUrl = false;
+
+      try {
+        isWssUrl = !!webSocketUrl && new URL(webSocketUrl).protocol === 'wss:';
+      } catch (error) {
+        isWssUrl = false;
+      }
+
+      if (!isWssUrl || !isAllowedUrlHost(webSocketUrl, ALLOWED_ROUTING_NOTIFS_DOMAINS)) {
+        throw new Error(
+          'Rejected webSocketUrl from RoutingNotifs registration: scheme or host not allow-listed'
+        );
+      }
+
+      this.url = webSocketUrl;
     } catch (e) {
       LoggerProxy.error(
         `Register API Failed, Request to RoutingNotifs websocket registration API failed ${e}`,
@@ -214,3 +238,5 @@ export class WebSocketManager extends EventEmitter {
     }
   }
 }
+
+export default WebSocketManager;

package/src/services/core/websocket/types.ts

@@ -1,5 +1,5 @@
 import {SubscribeRequest} from '../../../types';
-import {WebSocketManager} from './WebSocketManager';
+import type WebSocketManager from './WebSocketManager';
 
 /**
  * Options for initializing a connection service.

package/src/services/index.ts

@@ -25,7 +25,7 @@ export default class Services {
   public readonly dialer: ReturnType<typeof aqmDialer>;
   /** WebSocket manager for handling real-time communications */
   public readonly webSocketManager: WebSocketManager;
-  /** RTD WebSocket manager for handling realtime transcription */
+  /** RTD WebSocket manager for handling real-time transcription */
   public readonly rtdWebSocketManager: WebSocketManager;
   /** Connection service for managing websocket connections */
   public readonly connectionService: ConnectionService;