@webex/plugin-authorization-browser-first-party 1.144.2 → 1.145.0

package/dist/authorization.js

@@ -40,9 +40,18 @@ var _webexCore = require("@webex/webex-core");
 
 var _uuid = _interopRequireDefault(require("uuid"));
 
+var _encBase64url = _interopRequireDefault(require("crypto-js/enc-base64url"));
+
+var _cryptoJs = _interopRequireDefault(require("crypto-js"));
+
 var _dec, _dec2, _obj;
 
+// Necessary to require lodash this way in order to stub
+// methods in the unit test
+var lodash = require('lodash');
+
 var OAUTH2_CSRF_TOKEN = 'oauth2-csrf-token';
+var OAUTH2_CODE_VERIFIER = 'oauth2-code-verifier';
 /**
  * Browser support for OAuth2. Automatically parses the URL query for an
  * authorization code
@@ -121,6 +130,8 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
       location.query.state = {};
     }
 
+    var codeVerifier = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CODE_VERIFIER);
+    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CODE_VERIFIER);
     var email = location.query.state.email;
 
     this._verifySecurityToken(location.query);
@@ -135,7 +146,8 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
         return _promise.default.resolve();
       }).then(function () {
         return _this.requestAuthorizationCodeGrant({
-          code: code
+          code: code,
+          codeVerifier: codeVerifier
         });
       }).then(function () {
         _this.ready = true;
@@ -156,6 +168,8 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
     options.state = options.state || {};
     options.state.csrf_token = this._generateSecurityToken();
     options.state.email = options.email;
+    options.code_challenge = this._generateCodeChallenge();
+    options.code_challenge_method = 'S256';
     return this.initiateAuthorizationCodeGrant(options);
   },
 
@@ -209,15 +223,21 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
       return _promise.default.reject(new Error('`options.code` is required'));
     }
 
+    var form = {
+      grant_type: 'authorization_code',
+      redirect_uri: this.config.redirect_uri,
+      code: options.code,
+      self_contained_token: true
+    };
+
+    if (options.codeVerifier) {
+      form.code_verifier = options.codeVerifier;
+    }
+
     return this.webex.request({
       method: 'POST',
       uri: this.config.tokenUrl,
-      form: {
-        grant_type: 'authorization_code',
-        redirect_uri: this.config.redirect_uri,
-        code: options.code,
-        self_contained_token: true
-      },
+      form: form,
       auth: {
         user: this.config.client_id,
         pass: this.config.client_secret,
@@ -283,6 +303,27 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
     }
   },
 
+  /**
+   * Generates PKCE code verifier and code challenge and sets the the code verifier in sessionStorage
+   * @instance
+   * @memberof AuthorizationBrowserFirstParty
+   * @private
+   * @returns {string}
+   */
+  _generateCodeChallenge: function _generateCodeChallenge() {
+    this.logger.info('authorization: generating PKCE code challenge'); // eslint-disable-next-line no-underscore-dangle
+
+    var safeCharacterMap = _encBase64url.default._safe_map;
+    var codeVerifier = lodash.times(128, function () {
+      return safeCharacterMap[lodash.random(0, safeCharacterMap.length - 1)];
+    }).join('');
+
+    var codeChallenge = _cryptoJs.default.SHA256(codeVerifier).toString(_encBase64url.default);
+
+    this.webex.getWindow().sessionStorage.setItem(OAUTH2_CODE_VERIFIER, codeVerifier);
+    return codeChallenge;
+  },
+
   /**
    * Generates a CSRF token and sticks in in sessionStorage
    * @instance
@@ -330,7 +371,7 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
       throw new Error("CSRF token ".concat(token, " does not match stored token ").concat(sessionToken));
     }
   },
-  version: "1.144.2"
+  version: "1.145.0"
 }, ((0, _applyDecoratedDescriptor2.default)(_obj, "initiateAuthorizationCodeGrant", [_dec], (0, _getOwnPropertyDescriptor.default)(_obj, "initiateAuthorizationCodeGrant"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "requestAuthorizationCodeGrant", [_dec2, _common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "requestAuthorizationCodeGrant"), _obj)), _obj)));
 
 var _default = Authorization;

package/dist/authorization.js.map

@@ -1 +1 @@
-{"version":3,"sources":["authorization.js"],"names":["OAUTH2_CSRF_TOKEN","Authorization","WebexPlugin","extend","derived","isAuthenticating","deps","fn","isAuthorizing","session","default","type","ready","namespace","initialize","attrs","ret","prototype","location","url","parse","webex","getWindow","href","_checkForErrors","code","query","state","JSON","base64","decode","email","_verifySecurityToken","_cleanUrl","process","nextTick","internal","services","collectPreauthCatalog","catch","resolve","then","requestAuthorizationCodeGrant","initiateLogin","options","csrf_token","_generateSecurityToken","initiateAuthorizationCodeGrant","logger","info","credentials","buildLoginUrl","response_type","logout","noRedirect","buildLogoutUrl","reject","Error","request","method","uri","config","tokenUrl","form","grant_type","redirect_uri","self_contained_token","auth","user","client_id","pass","client_secret","sendImmediately","shouldRefreshAccessToken","res","set","supertoken","body","statusCode","ErrorConstructor","grantErrors","select","error","_res","history","replaceState","encode","search","querystring","stringify","format","token","uuid","v4","sessionStorage","setItem","sessionToken","getItem","removeItem","oneFlight"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA;;AACA;;AAEA;;AACA;;AAEA;;;;AAEA,IAAMA,iBAAiB,GAAG,mBAA1B;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACA,IAAMC,aAAa,GAAGC,uBAAYC,MAAZ,SAmGnB,2BAAc,eAAd,CAnGmB,UAkInB,2BAAc,eAAd,CAlImB,UAAmB;AACvCC,EAAAA,OAAO,EAAE;AACP;AACJ;AACA;AACA;AACA;AACA;AACIC,IAAAA,gBAAgB,EAAE;AAChBC,MAAAA,IAAI,EAAE,CAAC,eAAD,CADU;AAEhBC,MAAAA,EAFgB,gBAEX;AACH,eAAO,KAAKC,aAAZ;AACD;AAJe;AAPX,GAD8B;AAgBvCC,EAAAA,OAAO,EAAE;AACP;AACJ;AACA;AACA;AACA;AACA;AACID,IAAAA,aAAa,EAAE;AACbE,MAAAA,OAAO,EAAE,KADI;AAEbC,MAAAA,IAAI,EAAE;AAFO,KAPR;AAWPC,IAAAA,KAAK,EAAE;AACLF,MAAAA,OAAO,EAAE,KADJ;AAELC,MAAAA,IAAI,EAAE;AAFD;AAXA,GAhB8B;AAiCvCE,EAAAA,SAAS,EAAE,aAjC4B;;AAmCvC;AACF;AACA;AACA;AACA;AACA;AACA;AACE;AACAC,EAAAA,UA3CuC,wBA2ClB;AAAA;;AAAA,sCAAPC,KAAO;AAAPA,MAAAA,KAAO;AAAA;;AACnB,QAAMC,GAAG,GAAG,oBAAcd,uBAAYe,SAAZ,CAAsBH,UAApC,EAAgD,IAAhD,EAAsDC,KAAtD,CAAZ;;AACA,QAAMG,QAAQ,GAAGC,aAAIC,KAAJ,CAAU,KAAKC,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,CAAgCK,IAA1C,EAAgD,IAAhD,CAAjB;;AAEA,SAAKC,eAAL,CAAqBN,QAArB;;AAEA,QAAOO,IAAP,GAAeP,QAAQ,CAACQ,KAAxB,CAAOD,IAAP;;AAEA,QAAI,CAACA,IAAL,EAAW;AACT,WAAKb,KAAL,GAAa,IAAb;AAEA,aAAOI,GAAP;AACD;;AAED,QAAIE,QAAQ,CAACQ,KAAT,CAAeC,KAAnB,EAA0B;AACxBT,MAAAA,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuBC,IAAI,CAACR,KAAL,CAAWS,eAAOC,MAAP,CAAcZ,QAAQ,CAACQ,KAAT,CAAeC,KAA7B,CAAX,CAAvB;AACD,KAFD,MAGK;AACHT,MAAAA,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuB,EAAvB;AACD;;AAED,QAAOI,KAAP,GAAgBb,QAAQ,CAACQ,KAAT,CAAeC,KAA/B,CAAOI,KAAP;;AAEA,SAAKC,oBAAL,CAA0Bd,QAAQ,CAACQ,KAAnC;;AACA,SAAKO,SAAL,CAAef,QAAf,EAxBmB,CA0BnB;;;AACAgB,IAAAA,OAAO,CAACC,QAAR,CAAiB,YAAM;AACrB,MAAA,KAAI,CAACd,KAAL,CAAWe,QAAX,CAAoBC,QAApB,CAA6BC,qBAA7B,CAAmD;AAACP,QAAAA,KAAK,EAALA;AAAD,OAAnD,EACGQ,KADH,CACS;AAAA,eAAM,iBAAQC,OAAR,EAAN;AAAA,OADT,EAEGC,IAFH,CAEQ;AAAA,eAAM,KAAI,CAACC,6BAAL,CAAmC;AAACjB,UAAAA,IAAI,EAAJA;AAAD,SAAnC,CAAN;AAAA,OAFR,EAGGgB,IAHH,CAGQ,YAAM;AACV,QAAA,KAAI,CAAC7B,KAAL,GAAa,IAAb;AACD,OALH;AAMD,KAPD;AAUA,WAAOI,GAAP;AACD,GAjFsC;;AAmFvC;AACF;AACA;AACA;AACA;AACA;AACA;AACE2B,EAAAA,aA1FuC,2BA0FX;AAAA,QAAdC,OAAc,uEAAJ,EAAI;AAC1BA,IAAAA,OAAO,CAACjB,KAAR,GAAgBiB,OAAO,CAACjB,KAAR,IAAiB,EAAjC;AACAiB,IAAAA,OAAO,CAACjB,KAAR,CAAckB,UAAd,GAA2B,KAAKC,sBAAL,EAA3B;AACAF,IAAAA,OAAO,CAACjB,KAAR,CAAcI,KAAd,GAAsBa,OAAO,CAACb,KAA9B;AAGA,WAAO,KAAKgB,8BAAL,CAAoCH,OAApC,CAAP;AACD,GAjGsC;;AAoGvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACEG,EAAAA,8BA5GuC,0CA4GRH,OA5GQ,EA4GC;AACtC,SAAKI,MAAL,CAAYC,IAAZ,CAAiB,yDAAjB;AACA,SAAK5B,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,GAAkC,KAAKG,KAAL,CAAW6B,WAAX,CAAuBC,aAAvB,CAAqC,qBAAc;AAACC,MAAAA,aAAa,EAAE;AAAhB,KAAd,EAAuCR,OAAvC,CAArC,CAAlC;AAEA,WAAO,iBAAQJ,OAAR,EAAP;AACD,GAjHsC;;AAmHvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACEa,EAAAA,MA3HuC,oBA2HlB;AAAA,QAAdT,OAAc,uEAAJ,EAAI;;AACnB,QAAI,CAACA,OAAO,CAACU,UAAb,EAAyB;AACvB,WAAKjC,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,GAAkC,KAAKG,KAAL,CAAW6B,WAAX,CAAuBK,cAAvB,CAAsCX,OAAtC,CAAlC;AACD;AACF,GA/HsC;;AAoIvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACEF,EAAAA,6BA5IuC,2CA4IK;AAAA;;AAAA,QAAdE,OAAc,uEAAJ,EAAI;AAC1C,SAAKI,MAAL,CAAYC,IAAZ,CAAiB,kDAAjB;;AAEA,QAAI,CAACL,OAAO,CAACnB,IAAb,EAAmB;AACjB,aAAO,iBAAQ+B,MAAR,CAAe,IAAIC,KAAJ,CAAU,4BAAV,CAAf,CAAP;AACD;;AAED,WAAO,KAAKpC,KAAL,CAAWqC,OAAX,CAAmB;AACxBC,MAAAA,MAAM,EAAE,MADgB;AAExBC,MAAAA,GAAG,EAAE,KAAKC,MAAL,CAAYC,QAFO;AAGxBC,MAAAA,IAAI,EAAE;AACJC,QAAAA,UAAU,EAAE,oBADR;AAEJC,QAAAA,YAAY,EAAE,KAAKJ,MAAL,CAAYI,YAFtB;AAGJxC,QAAAA,IAAI,EAAEmB,OAAO,CAACnB,IAHV;AAIJyC,QAAAA,oBAAoB,EAAE;AAJlB,OAHkB;AASxBC,MAAAA,IAAI,EAAE;AACJC,QAAAA,IAAI,EAAE,KAAKP,MAAL,CAAYQ,SADd;AAEJC,QAAAA,IAAI,EAAE,KAAKT,MAAL,CAAYU,aAFd;AAGJC,QAAAA,eAAe,EAAE;AAHb,OATkB;AAcxBC,MAAAA,wBAAwB,EAAE;AAdF,KAAnB,EAgBJhC,IAhBI,CAgBC,UAACiC,GAAD,EAAS;AACb,MAAA,MAAI,CAACrD,KAAL,CAAW6B,WAAX,CAAuByB,GAAvB,CAA2B;AAACC,QAAAA,UAAU,EAAEF,GAAG,CAACG;AAAjB,OAA3B;AACD,KAlBI,EAmBJtC,KAnBI,CAmBE,UAACmC,GAAD,EAAS;AACd,UAAIA,GAAG,CAACI,UAAJ,KAAmB,GAAvB,EAA4B;AAC1B,eAAO,iBAAQtB,MAAR,CAAekB,GAAf,CAAP;AACD;;AAED,UAAMK,gBAAgB,GAAGC,uBAAYC,MAAZ,CAAmBP,GAAG,CAACG,IAAJ,CAASK,KAA5B,CAAzB;;AAEA,aAAO,iBAAQ1B,MAAR,CAAe,IAAIuB,gBAAJ,CAAqBL,GAAG,CAACS,IAAJ,IAAYT,GAAjC,CAAf,CAAP;AACD,KA3BI,CAAP;AA4BD,GA/KsC;;AAiLvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACElD,EAAAA,eAzLuC,2BAyLvBN,QAzLuB,EAyLb;AACxB,QAAOQ,KAAP,GAAgBR,QAAhB,CAAOQ,KAAP;;AAEA,QAAIA,KAAK,IAAIA,KAAK,CAACwD,KAAnB,EAA0B;AACxB,UAAMH,gBAAgB,GAAGC,uBAAYC,MAAZ,CAAmBvD,KAAK,CAACwD,KAAzB,CAAzB;;AAEA,YAAM,IAAIH,gBAAJ,CAAqBrD,KAArB,CAAN;AACD;AACF,GAjMsC;;AAmMvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACEO,EAAAA,SA3MuC,qBA2M7Bf,QA3M6B,EA2MnB;AAClBA,IAAAA,QAAQ,GAAG,yBAAUA,QAAV,CAAX;;AACA,QAAI,KAAKG,KAAL,CAAWC,SAAX,GAAuB8D,OAAvB,IAAkC,KAAK/D,KAAL,CAAWC,SAAX,GAAuB8D,OAAvB,CAA+BC,YAArE,EAAmF;AACjF,mCAAuBnE,QAAQ,CAACQ,KAAhC,EAAuC,MAAvC;;AACA,UAAI,uBAAQ,oBAAKR,QAAQ,CAACQ,KAAT,CAAeC,KAApB,EAA2B,YAA3B,CAAR,CAAJ,EAAuD;AACrD,qCAAuBT,QAAQ,CAACQ,KAAhC,EAAuC,OAAvC;AACD,OAFD,MAGK;AACHR,QAAAA,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuBE,eAAOyD,MAAP,CAAc,wBAAe,oBAAKpE,QAAQ,CAACQ,KAAT,CAAeC,KAApB,EAA2B,YAA3B,CAAf,CAAd,CAAvB;AACD;;AACDT,MAAAA,QAAQ,CAACqE,MAAT,GAAkBC,qBAAYC,SAAZ,CAAsBvE,QAAQ,CAACQ,KAA/B,CAAlB;AACA,mCAAuBR,QAAvB,EAAiC,OAAjC;AACA,WAAKG,KAAL,CAAWC,SAAX,GAAuB8D,OAAvB,CAA+BC,YAA/B,CAA4C,EAA5C,EAAgD,IAAhD,EAAsDlE,aAAIuE,MAAJ,CAAWxE,QAAX,CAAtD;AACD;AACF,GAzNsC;;AA2NvC;AACF;AACA;AACA;AACA;AACA;AACA;AACE4B,EAAAA,sBAlOuC,oCAkOd;AACvB,SAAKE,MAAL,CAAYC,IAAZ,CAAiB,sCAAjB;;AAEA,QAAM0C,KAAK,GAAGC,cAAKC,EAAL,EAAd;;AAEA,SAAKxE,KAAL,CAAWC,SAAX,GAAuBwE,cAAvB,CAAsCC,OAAtC,CAA8C,mBAA9C,EAAmEJ,KAAnE;AAEA,WAAOA,KAAP;AACD,GA1OsC;;AA4OvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACE3D,EAAAA,oBArPuC,gCAqPlBN,KArPkB,EAqPX;AAC1B,QAAMsE,YAAY,GAAG,KAAK3E,KAAL,CAAWC,SAAX,GAAuBwE,cAAvB,CAAsCG,OAAtC,CAA8CjG,iBAA9C,CAArB;AAEA,SAAKqB,KAAL,CAAWC,SAAX,GAAuBwE,cAAvB,CAAsCI,UAAtC,CAAiDlG,iBAAjD;;AACA,QAAI,CAACgG,YAAL,EAAmB;AACjB;AACD;;AAED,QAAI,CAACtE,KAAK,CAACC,KAAX,EAAkB;AAChB,YAAM,IAAI8B,KAAJ,+BAAiCuC,YAAjC,uCAAN;AACD;;AAED,QAAI,CAACtE,KAAK,CAACC,KAAN,CAAYkB,UAAjB,EAA6B;AAC3B,YAAM,IAAIY,KAAJ,+BAAiCuC,YAAjC,uCAAN;AACD;;AAED,QAAML,KAAK,GAAGjE,KAAK,CAACC,KAAN,CAAYkB,UAA1B;;AAEA,QAAI8C,KAAK,KAAKK,YAAd,EAA4B;AAC1B,YAAM,IAAIvC,KAAJ,sBAAwBkC,KAAxB,0CAA6DK,YAA7D,EAAN;AACD;AACF,GA1QsC;AAAA;AAAA,CAAnB,yQAmInBG,iBAnImB,iGAAtB;;eA6QelG,a","sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n/* eslint camelcase: [0] */\n\nimport querystring from 'querystring';\nimport url from 'url';\n\nimport {base64, oneFlight, whileInFlight} from '@webex/common';\nimport {grantErrors, WebexPlugin} from '@webex/webex-core';\nimport {cloneDeep, isEmpty, omit} from 'lodash';\nimport uuid from 'uuid';\n\nconst OAUTH2_CSRF_TOKEN = 'oauth2-csrf-token';\n\n/**\n * Browser support for OAuth2. Automatically parses the URL query for an\n * authorization code\n *\n * Use of this plugin for anything other than the Webex Web Client is strongly\n * discouraged and may be broken at any time\n * @class\n * @name AuthorizationBrowserFirstParty\n * @private\n */\nconst Authorization = WebexPlugin.extend({\n  derived: {\n    /**\n     * Alias of {@link AuthorizationBrowserFirstParty#isAuthorizing}\n     * @instance\n     * @memberof AuthorizationBrowserFirstParty\n     * @type {boolean}\n     */\n    isAuthenticating: {\n      deps: ['isAuthorizing'],\n      fn() {\n        return this.isAuthorizing;\n      }\n    }\n  },\n\n  session: {\n    /**\n     * Indicates if an Authorization Code exchange is inflight\n     * @instance\n     * @memberof AuthorizationBrowserFirstParty\n     * @type {boolean}\n     */\n    isAuthorizing: {\n      default: false,\n      type: 'boolean'\n    },\n    ready: {\n      default: false,\n      type: 'boolean'\n    }\n  },\n\n  namespace: 'Credentials',\n\n  /**\n   * Initializer\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {Authorization}\n   */\n  // eslint-disable-next-line complexity\n  initialize(...attrs) {\n    const ret = Reflect.apply(WebexPlugin.prototype.initialize, this, attrs);\n    const location = url.parse(this.webex.getWindow().location.href, true);\n\n    this._checkForErrors(location);\n\n    const {code} = location.query;\n\n    if (!code) {\n      this.ready = true;\n\n      return ret;\n    }\n\n    if (location.query.state) {\n      location.query.state = JSON.parse(base64.decode(location.query.state));\n    }\n    else {\n      location.query.state = {};\n    }\n\n    const {email} = location.query.state;\n\n    this._verifySecurityToken(location.query);\n    this._cleanUrl(location);\n\n    // Wait until nextTick in case `credentials` hasn't initialized yet\n    process.nextTick(() => {\n      this.webex.internal.services.collectPreauthCatalog({email})\n        .catch(() => Promise.resolve())\n        .then(() => this.requestAuthorizationCodeGrant({code}))\n        .then(() => {\n          this.ready = true;\n        });\n    });\n\n\n    return ret;\n  },\n\n  /**\n   * Kicks off an oauth flow\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateLogin(options = {}) {\n    options.state = options.state || {};\n    options.state.csrf_token = this._generateSecurityToken();\n    options.state.email = options.email;\n\n\n    return this.initiateAuthorizationCodeGrant(options);\n  },\n\n  @whileInFlight('isAuthorizing')\n  /**\n   * Kicks off the Implicit Code grant flow. Typically called via\n   * {@link AuthorizationBrowserFirstParty#initiateLogin}\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateAuthorizationCodeGrant(options) {\n    this.logger.info('authorization: initiating authorization code grant flow');\n    this.webex.getWindow().location = this.webex.credentials.buildLoginUrl(Object.assign({response_type: 'code'}, options));\n\n    return Promise.resolve();\n  },\n\n  /**\n   * Called by {@link WebexCore#logout()}. Redirects to the logout page\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @param {boolean} options.noRedirect if true, does not redirect\n   * @returns {Promise}\n   */\n  logout(options = {}) {\n    if (!options.noRedirect) {\n      this.webex.getWindow().location = this.webex.credentials.buildLogoutUrl(options);\n    }\n  },\n\n\n  @whileInFlight('isAuthorizing')\n  @oneFlight\n  /**\n   * Exchanges an authorization code for an access token\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @param {Object} options.code\n   * @returns {Promise}\n   */\n  requestAuthorizationCodeGrant(options = {}) {\n    this.logger.info('credentials: requesting authorization code grant');\n\n    if (!options.code) {\n      return Promise.reject(new Error('`options.code` is required'));\n    }\n\n    return this.webex.request({\n      method: 'POST',\n      uri: this.config.tokenUrl,\n      form: {\n        grant_type: 'authorization_code',\n        redirect_uri: this.config.redirect_uri,\n        code: options.code,\n        self_contained_token: true\n      },\n      auth: {\n        user: this.config.client_id,\n        pass: this.config.client_secret,\n        sendImmediately: true\n      },\n      shouldRefreshAccessToken: false\n    })\n      .then((res) => {\n        this.webex.credentials.set({supertoken: res.body});\n      })\n      .catch((res) => {\n        if (res.statusCode !== 400) {\n          return Promise.reject(res);\n        }\n\n        const ErrorConstructor = grantErrors.select(res.body.error);\n\n        return Promise.reject(new ErrorConstructor(res._res || res));\n      });\n  },\n\n  /**\n   * Checks if the result of the login redirect contains an error string\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _checkForErrors(location) {\n    const {query} = location;\n\n    if (query && query.error) {\n      const ErrorConstructor = grantErrors.select(query.error);\n\n      throw new ErrorConstructor(query);\n    }\n  },\n\n  /**\n   * Removes no-longer needed values from the url (access token, csrf token, etc)\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _cleanUrl(location) {\n    location = cloneDeep(location);\n    if (this.webex.getWindow().history && this.webex.getWindow().history.replaceState) {\n      Reflect.deleteProperty(location.query, 'code');\n      if (isEmpty(omit(location.query.state, 'csrf_token'))) {\n        Reflect.deleteProperty(location.query, 'state');\n      }\n      else {\n        location.query.state = base64.encode(JSON.stringify(omit(location.query.state, 'csrf_token')));\n      }\n      location.search = querystring.stringify(location.query);\n      Reflect.deleteProperty(location, 'query');\n      this.webex.getWindow().history.replaceState({}, null, url.format(location));\n    }\n  },\n\n  /**\n   * Generates a CSRF token and sticks in in sessionStorage\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {Promise}\n   */\n  _generateSecurityToken() {\n    this.logger.info('authorization: generating csrf token');\n\n    const token = uuid.v4();\n\n    this.webex.getWindow().sessionStorage.setItem('oauth2-csrf-token', token);\n\n    return token;\n  },\n\n  /**\n   * Checks if the CSRF token in sessionStorage is the same as the one returned\n   * in the url.\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} query\n   * @private\n   * @returns {Promise}\n   */\n  _verifySecurityToken(query) {\n    const sessionToken = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CSRF_TOKEN);\n\n    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CSRF_TOKEN);\n    if (!sessionToken) {\n      return;\n    }\n\n    if (!query.state) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect query`);\n    }\n\n    if (!query.state.csrf_token) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect query`);\n    }\n\n    const token = query.state.csrf_token;\n\n    if (token !== sessionToken) {\n      throw new Error(`CSRF token ${token} does not match stored token ${sessionToken}`);\n    }\n  }\n});\n\nexport default Authorization;\n"]}
+{"version":3,"sources":["authorization.js"],"names":["lodash","require","OAUTH2_CSRF_TOKEN","OAUTH2_CODE_VERIFIER","Authorization","WebexPlugin","extend","derived","isAuthenticating","deps","fn","isAuthorizing","session","default","type","ready","namespace","initialize","attrs","ret","prototype","location","url","parse","webex","getWindow","href","_checkForErrors","code","query","state","JSON","base64","decode","codeVerifier","sessionStorage","getItem","removeItem","email","_verifySecurityToken","_cleanUrl","process","nextTick","internal","services","collectPreauthCatalog","catch","resolve","then","requestAuthorizationCodeGrant","initiateLogin","options","csrf_token","_generateSecurityToken","code_challenge","_generateCodeChallenge","code_challenge_method","initiateAuthorizationCodeGrant","logger","info","credentials","buildLoginUrl","response_type","logout","noRedirect","buildLogoutUrl","reject","Error","form","grant_type","redirect_uri","config","self_contained_token","code_verifier","request","method","uri","tokenUrl","auth","user","client_id","pass","client_secret","sendImmediately","shouldRefreshAccessToken","res","set","supertoken","body","statusCode","ErrorConstructor","grantErrors","select","error","_res","history","replaceState","encode","search","querystring","stringify","format","safeCharacterMap","base64url","_safe_map","times","random","length","join","codeChallenge","CryptoJS","SHA256","toString","setItem","token","uuid","v4","sessionToken","oneFlight"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA;;AACA;;AAEA;;AACA;;AAEA;;AACA;;AACA;;;;AAEA;AACA;AACA,IAAMA,MAAM,GAAGC,OAAO,CAAC,QAAD,CAAtB;;AAEA,IAAMC,iBAAiB,GAAG,mBAA1B;AACA,IAAMC,oBAAoB,GAAG,sBAA7B;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACA,IAAMC,aAAa,GAAGC,uBAAYC,MAAZ,SA2GnB,2BAAc,eAAd,CA3GmB,UA0InB,2BAAc,eAAd,CA1ImB,UAAmB;AACvCC,EAAAA,OAAO,EAAE;AACP;AACJ;AACA;AACA;AACA;AACA;AACIC,IAAAA,gBAAgB,EAAE;AAChBC,MAAAA,IAAI,EAAE,CAAC,eAAD,CADU;AAEhBC,MAAAA,EAFgB,gBAEX;AACH,eAAO,KAAKC,aAAZ;AACD;AAJe;AAPX,GAD8B;AAgBvCC,EAAAA,OAAO,EAAE;AACP;AACJ;AACA;AACA;AACA;AACA;AACID,IAAAA,aAAa,EAAE;AACbE,MAAAA,OAAO,EAAE,KADI;AAEbC,MAAAA,IAAI,EAAE;AAFO,KAPR;AAWPC,IAAAA,KAAK,EAAE;AACLF,MAAAA,OAAO,EAAE,KADJ;AAELC,MAAAA,IAAI,EAAE;AAFD;AAXA,GAhB8B;AAiCvCE,EAAAA,SAAS,EAAE,aAjC4B;;AAmCvC;AACF;AACA;AACA;AACA;AACA;AACA;AACE;AACAC,EAAAA,UA3CuC,wBA2ClB;AAAA;;AAAA,sCAAPC,KAAO;AAAPA,MAAAA,KAAO;AAAA;;AACnB,QAAMC,GAAG,GAAG,oBAAcd,uBAAYe,SAAZ,CAAsBH,UAApC,EAAgD,IAAhD,EAAsDC,KAAtD,CAAZ;;AACA,QAAMG,QAAQ,GAAGC,aAAIC,KAAJ,CAAU,KAAKC,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,CAAgCK,IAA1C,EAAgD,IAAhD,CAAjB;;AAEA,SAAKC,eAAL,CAAqBN,QAArB;;AAEA,QAAOO,IAAP,GAAeP,QAAQ,CAACQ,KAAxB,CAAOD,IAAP;;AAEA,QAAI,CAACA,IAAL,EAAW;AACT,WAAKb,KAAL,GAAa,IAAb;AAEA,aAAOI,GAAP;AACD;;AAED,QAAIE,QAAQ,CAACQ,KAAT,CAAeC,KAAnB,EAA0B;AACxBT,MAAAA,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuBC,IAAI,CAACR,KAAL,CAAWS,eAAOC,MAAP,CAAcZ,QAAQ,CAACQ,KAAT,CAAeC,KAA7B,CAAX,CAAvB;AACD,KAFD,MAGK;AACHT,MAAAA,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuB,EAAvB;AACD;;AAED,QAAMI,YAAY,GAAG,KAAKV,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCC,OAAtC,CAA8CjC,oBAA9C,CAArB;AAEA,SAAKqB,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCE,UAAtC,CAAiDlC,oBAAjD;AAGA,QAAOmC,KAAP,GAAgBjB,QAAQ,CAACQ,KAAT,CAAeC,KAA/B,CAAOQ,KAAP;;AAEA,SAAKC,oBAAL,CAA0BlB,QAAQ,CAACQ,KAAnC;;AACA,SAAKW,SAAL,CAAenB,QAAf,EA7BmB,CA+BnB;;;AACAoB,IAAAA,OAAO,CAACC,QAAR,CAAiB,YAAM;AACrB,MAAA,KAAI,CAAClB,KAAL,CAAWmB,QAAX,CAAoBC,QAApB,CAA6BC,qBAA7B,CAAmD;AAACP,QAAAA,KAAK,EAALA;AAAD,OAAnD,EACGQ,KADH,CACS;AAAA,eAAM,iBAAQC,OAAR,EAAN;AAAA,OADT,EAEGC,IAFH,CAEQ;AAAA,eAAM,KAAI,CAACC,6BAAL,CAAmC;AAACrB,UAAAA,IAAI,EAAJA,IAAD;AAAOM,UAAAA,YAAY,EAAZA;AAAP,SAAnC,CAAN;AAAA,OAFR,EAGGc,IAHH,CAGQ,YAAM;AACV,QAAA,KAAI,CAACjC,KAAL,GAAa,IAAb;AACD,OALH;AAMD,KAPD;AAUA,WAAOI,GAAP;AACD,GAtFsC;;AAwFvC;AACF;AACA;AACA;AACA;AACA;AACA;AACE+B,EAAAA,aA/FuC,2BA+FX;AAAA,QAAdC,OAAc,uEAAJ,EAAI;AAC1BA,IAAAA,OAAO,CAACrB,KAAR,GAAgBqB,OAAO,CAACrB,KAAR,IAAiB,EAAjC;AACAqB,IAAAA,OAAO,CAACrB,KAAR,CAAcsB,UAAd,GAA2B,KAAKC,sBAAL,EAA3B;AACAF,IAAAA,OAAO,CAACrB,KAAR,CAAcQ,KAAd,GAAsBa,OAAO,CAACb,KAA9B;AAEAa,IAAAA,OAAO,CAACG,cAAR,GAAyB,KAAKC,sBAAL,EAAzB;AACAJ,IAAAA,OAAO,CAACK,qBAAR,GAAgC,MAAhC;AAGA,WAAO,KAAKC,8BAAL,CAAoCN,OAApC,CAAP;AACD,GAzGsC;;AA4GvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACEM,EAAAA,8BApHuC,0CAoHRN,OApHQ,EAoHC;AACtC,SAAKO,MAAL,CAAYC,IAAZ,CAAiB,yDAAjB;AACA,SAAKnC,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,GAAkC,KAAKG,KAAL,CAAWoC,WAAX,CAAuBC,aAAvB,CAAqC,qBAAc;AAACC,MAAAA,aAAa,EAAE;AAAhB,KAAd,EAAuCX,OAAvC,CAArC,CAAlC;AAEA,WAAO,iBAAQJ,OAAR,EAAP;AACD,GAzHsC;;AA2HvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACEgB,EAAAA,MAnIuC,oBAmIlB;AAAA,QAAdZ,OAAc,uEAAJ,EAAI;;AACnB,QAAI,CAACA,OAAO,CAACa,UAAb,EAAyB;AACvB,WAAKxC,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,GAAkC,KAAKG,KAAL,CAAWoC,WAAX,CAAuBK,cAAvB,CAAsCd,OAAtC,CAAlC;AACD;AACF,GAvIsC;;AA4IvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACEF,EAAAA,6BApJuC,2CAoJK;AAAA;;AAAA,QAAdE,OAAc,uEAAJ,EAAI;AAC1C,SAAKO,MAAL,CAAYC,IAAZ,CAAiB,kDAAjB;;AAEA,QAAI,CAACR,OAAO,CAACvB,IAAb,EAAmB;AACjB,aAAO,iBAAQsC,MAAR,CAAe,IAAIC,KAAJ,CAAU,4BAAV,CAAf,CAAP;AACD;;AAED,QAAMC,IAAI,GAAG;AACXC,MAAAA,UAAU,EAAE,oBADD;AAEXC,MAAAA,YAAY,EAAE,KAAKC,MAAL,CAAYD,YAFf;AAGX1C,MAAAA,IAAI,EAAEuB,OAAO,CAACvB,IAHH;AAIX4C,MAAAA,oBAAoB,EAAE;AAJX,KAAb;;AAOA,QAAIrB,OAAO,CAACjB,YAAZ,EAA0B;AACxBkC,MAAAA,IAAI,CAACK,aAAL,GAAqBtB,OAAO,CAACjB,YAA7B;AACD;;AAED,WAAO,KAAKV,KAAL,CAAWkD,OAAX,CAAmB;AACxBC,MAAAA,MAAM,EAAE,MADgB;AAExBC,MAAAA,GAAG,EAAE,KAAKL,MAAL,CAAYM,QAFO;AAGxBT,MAAAA,IAAI,EAAJA,IAHwB;AAIxBU,MAAAA,IAAI,EAAE;AACJC,QAAAA,IAAI,EAAE,KAAKR,MAAL,CAAYS,SADd;AAEJC,QAAAA,IAAI,EAAE,KAAKV,MAAL,CAAYW,aAFd;AAGJC,QAAAA,eAAe,EAAE;AAHb,OAJkB;AASxBC,MAAAA,wBAAwB,EAAE;AATF,KAAnB,EAWJpC,IAXI,CAWC,UAACqC,GAAD,EAAS;AACb,MAAA,MAAI,CAAC7D,KAAL,CAAWoC,WAAX,CAAuB0B,GAAvB,CAA2B;AAACC,QAAAA,UAAU,EAAEF,GAAG,CAACG;AAAjB,OAA3B;AACD,KAbI,EAcJ1C,KAdI,CAcE,UAACuC,GAAD,EAAS;AACd,UAAIA,GAAG,CAACI,UAAJ,KAAmB,GAAvB,EAA4B;AAC1B,eAAO,iBAAQvB,MAAR,CAAemB,GAAf,CAAP;AACD;;AAED,UAAMK,gBAAgB,GAAGC,uBAAYC,MAAZ,CAAmBP,GAAG,CAACG,IAAJ,CAASK,KAA5B,CAAzB;;AAEA,aAAO,iBAAQ3B,MAAR,CAAe,IAAIwB,gBAAJ,CAAqBL,GAAG,CAACS,IAAJ,IAAYT,GAAjC,CAAf,CAAP;AACD,KAtBI,CAAP;AAuBD,GA7LsC;;AA+LvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACE1D,EAAAA,eAvMuC,2BAuMvBN,QAvMuB,EAuMb;AACxB,QAAOQ,KAAP,GAAgBR,QAAhB,CAAOQ,KAAP;;AAEA,QAAIA,KAAK,IAAIA,KAAK,CAACgE,KAAnB,EAA0B;AACxB,UAAMH,gBAAgB,GAAGC,uBAAYC,MAAZ,CAAmB/D,KAAK,CAACgE,KAAzB,CAAzB;;AAEA,YAAM,IAAIH,gBAAJ,CAAqB7D,KAArB,CAAN;AACD;AACF,GA/MsC;;AAiNvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACEW,EAAAA,SAzNuC,qBAyN7BnB,QAzN6B,EAyNnB;AAClBA,IAAAA,QAAQ,GAAG,yBAAUA,QAAV,CAAX;;AACA,QAAI,KAAKG,KAAL,CAAWC,SAAX,GAAuBsE,OAAvB,IAAkC,KAAKvE,KAAL,CAAWC,SAAX,GAAuBsE,OAAvB,CAA+BC,YAArE,EAAmF;AACjF,mCAAuB3E,QAAQ,CAACQ,KAAhC,EAAuC,MAAvC;;AACA,UAAI,uBAAQ,oBAAKR,QAAQ,CAACQ,KAAT,CAAeC,KAApB,EAA2B,YAA3B,CAAR,CAAJ,EAAuD;AACrD,qCAAuBT,QAAQ,CAACQ,KAAhC,EAAuC,OAAvC;AACD,OAFD,MAGK;AACHR,QAAAA,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuBE,eAAOiE,MAAP,CAAc,wBAAe,oBAAK5E,QAAQ,CAACQ,KAAT,CAAeC,KAApB,EAA2B,YAA3B,CAAf,CAAd,CAAvB;AACD;;AACDT,MAAAA,QAAQ,CAAC6E,MAAT,GAAkBC,qBAAYC,SAAZ,CAAsB/E,QAAQ,CAACQ,KAA/B,CAAlB;AACA,mCAAuBR,QAAvB,EAAiC,OAAjC;AACA,WAAKG,KAAL,CAAWC,SAAX,GAAuBsE,OAAvB,CAA+BC,YAA/B,CAA4C,EAA5C,EAAgD,IAAhD,EAAsD1E,aAAI+E,MAAJ,CAAWhF,QAAX,CAAtD;AACD;AACF,GAvOsC;;AAyOvC;AACF;AACA;AACA;AACA;AACA;AACA;AACEkC,EAAAA,sBAhPuC,oCAgPd;AACvB,SAAKG,MAAL,CAAYC,IAAZ,CAAiB,+CAAjB,EADuB,CAGvB;;AACA,QAAM2C,gBAAgB,GAAGC,sBAAUC,SAAnC;AAEA,QAAMtE,YAAY,GAAGlC,MAAM,CAACyG,KAAP,CACnB,GADmB,EAEnB;AAAA,aAAMH,gBAAgB,CAACtG,MAAM,CAAC0G,MAAP,CAAc,CAAd,EAAiBJ,gBAAgB,CAACK,MAAjB,GAA0B,CAA3C,CAAD,CAAtB;AAAA,KAFmB,EAGnBC,IAHmB,CAGd,EAHc,CAArB;;AAKA,QAAMC,aAAa,GAAGC,kBAASC,MAAT,CAAgB7E,YAAhB,EAA8B8E,QAA9B,CAAuCT,qBAAvC,CAAtB;;AAEA,SAAK/E,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsC8E,OAAtC,CACE9G,oBADF,EACwB+B,YADxB;AAIA,WAAO2E,aAAP;AACD,GAlQsC;;AAoQvC;AACF;AACA;AACA;AACA;AACA;AACA;AACExD,EAAAA,sBA3QuC,oCA2Qd;AACvB,SAAKK,MAAL,CAAYC,IAAZ,CAAiB,sCAAjB;;AAEA,QAAMuD,KAAK,GAAGC,cAAKC,EAAL,EAAd;;AAEA,SAAK5F,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsC8E,OAAtC,CAA8C,mBAA9C,EAAmEC,KAAnE;AAEA,WAAOA,KAAP;AACD,GAnRsC;;AAqRvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACE3E,EAAAA,oBA9RuC,gCA8RlBV,KA9RkB,EA8RX;AAC1B,QAAMwF,YAAY,GAAG,KAAK7F,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCC,OAAtC,CAA8ClC,iBAA9C,CAArB;AAEA,SAAKsB,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCE,UAAtC,CAAiDnC,iBAAjD;;AACA,QAAI,CAACmH,YAAL,EAAmB;AACjB;AACD;;AAED,QAAI,CAACxF,KAAK,CAACC,KAAX,EAAkB;AAChB,YAAM,IAAIqC,KAAJ,+BAAiCkD,YAAjC,uCAAN;AACD;;AAED,QAAI,CAACxF,KAAK,CAACC,KAAN,CAAYsB,UAAjB,EAA6B;AAC3B,YAAM,IAAIe,KAAJ,+BAAiCkD,YAAjC,uCAAN;AACD;;AAED,QAAMH,KAAK,GAAGrF,KAAK,CAACC,KAAN,CAAYsB,UAA1B;;AAEA,QAAI8D,KAAK,KAAKG,YAAd,EAA4B;AAC1B,YAAM,IAAIlD,KAAJ,sBAAwB+C,KAAxB,0CAA6DG,YAA7D,EAAN;AACD;AACF,GAnTsC;AAAA;AAAA,CAAnB,yQA2InBC,iBA3ImB,iGAAtB;;eAsTelH,a","sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n/* eslint camelcase: [0] */\n\nimport querystring from 'querystring';\nimport url from 'url';\n\nimport {base64, oneFlight, whileInFlight} from '@webex/common';\nimport {grantErrors, WebexPlugin} from '@webex/webex-core';\nimport {cloneDeep, isEmpty, omit} from 'lodash';\nimport uuid from 'uuid';\nimport base64url from 'crypto-js/enc-base64url';\nimport CryptoJS from 'crypto-js';\n\n// Necessary to require lodash this way in order to stub\n// methods in the unit test\nconst lodash = require('lodash');\n\nconst OAUTH2_CSRF_TOKEN = 'oauth2-csrf-token';\nconst OAUTH2_CODE_VERIFIER = 'oauth2-code-verifier';\n\n/**\n * Browser support for OAuth2. Automatically parses the URL query for an\n * authorization code\n *\n * Use of this plugin for anything other than the Webex Web Client is strongly\n * discouraged and may be broken at any time\n * @class\n * @name AuthorizationBrowserFirstParty\n * @private\n */\nconst Authorization = WebexPlugin.extend({\n  derived: {\n    /**\n     * Alias of {@link AuthorizationBrowserFirstParty#isAuthorizing}\n     * @instance\n     * @memberof AuthorizationBrowserFirstParty\n     * @type {boolean}\n     */\n    isAuthenticating: {\n      deps: ['isAuthorizing'],\n      fn() {\n        return this.isAuthorizing;\n      }\n    }\n  },\n\n  session: {\n    /**\n     * Indicates if an Authorization Code exchange is inflight\n     * @instance\n     * @memberof AuthorizationBrowserFirstParty\n     * @type {boolean}\n     */\n    isAuthorizing: {\n      default: false,\n      type: 'boolean'\n    },\n    ready: {\n      default: false,\n      type: 'boolean'\n    }\n  },\n\n  namespace: 'Credentials',\n\n  /**\n   * Initializer\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {Authorization}\n   */\n  // eslint-disable-next-line complexity\n  initialize(...attrs) {\n    const ret = Reflect.apply(WebexPlugin.prototype.initialize, this, attrs);\n    const location = url.parse(this.webex.getWindow().location.href, true);\n\n    this._checkForErrors(location);\n\n    const {code} = location.query;\n\n    if (!code) {\n      this.ready = true;\n\n      return ret;\n    }\n\n    if (location.query.state) {\n      location.query.state = JSON.parse(base64.decode(location.query.state));\n    }\n    else {\n      location.query.state = {};\n    }\n\n    const codeVerifier = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CODE_VERIFIER);\n\n    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CODE_VERIFIER);\n\n\n    const {email} = location.query.state;\n\n    this._verifySecurityToken(location.query);\n    this._cleanUrl(location);\n\n    // Wait until nextTick in case `credentials` hasn't initialized yet\n    process.nextTick(() => {\n      this.webex.internal.services.collectPreauthCatalog({email})\n        .catch(() => Promise.resolve())\n        .then(() => this.requestAuthorizationCodeGrant({code, codeVerifier}))\n        .then(() => {\n          this.ready = true;\n        });\n    });\n\n\n    return ret;\n  },\n\n  /**\n   * Kicks off an oauth flow\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateLogin(options = {}) {\n    options.state = options.state || {};\n    options.state.csrf_token = this._generateSecurityToken();\n    options.state.email = options.email;\n\n    options.code_challenge = this._generateCodeChallenge();\n    options.code_challenge_method = 'S256';\n\n\n    return this.initiateAuthorizationCodeGrant(options);\n  },\n\n  @whileInFlight('isAuthorizing')\n  /**\n   * Kicks off the Implicit Code grant flow. Typically called via\n   * {@link AuthorizationBrowserFirstParty#initiateLogin}\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateAuthorizationCodeGrant(options) {\n    this.logger.info('authorization: initiating authorization code grant flow');\n    this.webex.getWindow().location = this.webex.credentials.buildLoginUrl(Object.assign({response_type: 'code'}, options));\n\n    return Promise.resolve();\n  },\n\n  /**\n   * Called by {@link WebexCore#logout()}. Redirects to the logout page\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @param {boolean} options.noRedirect if true, does not redirect\n   * @returns {Promise}\n   */\n  logout(options = {}) {\n    if (!options.noRedirect) {\n      this.webex.getWindow().location = this.webex.credentials.buildLogoutUrl(options);\n    }\n  },\n\n\n  @whileInFlight('isAuthorizing')\n  @oneFlight\n  /**\n   * Exchanges an authorization code for an access token\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @param {Object} options.code\n   * @returns {Promise}\n   */\n  requestAuthorizationCodeGrant(options = {}) {\n    this.logger.info('credentials: requesting authorization code grant');\n\n    if (!options.code) {\n      return Promise.reject(new Error('`options.code` is required'));\n    }\n\n    const form = {\n      grant_type: 'authorization_code',\n      redirect_uri: this.config.redirect_uri,\n      code: options.code,\n      self_contained_token: true\n    };\n\n    if (options.codeVerifier) {\n      form.code_verifier = options.codeVerifier;\n    }\n\n    return this.webex.request({\n      method: 'POST',\n      uri: this.config.tokenUrl,\n      form,\n      auth: {\n        user: this.config.client_id,\n        pass: this.config.client_secret,\n        sendImmediately: true\n      },\n      shouldRefreshAccessToken: false\n    })\n      .then((res) => {\n        this.webex.credentials.set({supertoken: res.body});\n      })\n      .catch((res) => {\n        if (res.statusCode !== 400) {\n          return Promise.reject(res);\n        }\n\n        const ErrorConstructor = grantErrors.select(res.body.error);\n\n        return Promise.reject(new ErrorConstructor(res._res || res));\n      });\n  },\n\n  /**\n   * Checks if the result of the login redirect contains an error string\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _checkForErrors(location) {\n    const {query} = location;\n\n    if (query && query.error) {\n      const ErrorConstructor = grantErrors.select(query.error);\n\n      throw new ErrorConstructor(query);\n    }\n  },\n\n  /**\n   * Removes no-longer needed values from the url (access token, csrf token, etc)\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _cleanUrl(location) {\n    location = cloneDeep(location);\n    if (this.webex.getWindow().history && this.webex.getWindow().history.replaceState) {\n      Reflect.deleteProperty(location.query, 'code');\n      if (isEmpty(omit(location.query.state, 'csrf_token'))) {\n        Reflect.deleteProperty(location.query, 'state');\n      }\n      else {\n        location.query.state = base64.encode(JSON.stringify(omit(location.query.state, 'csrf_token')));\n      }\n      location.search = querystring.stringify(location.query);\n      Reflect.deleteProperty(location, 'query');\n      this.webex.getWindow().history.replaceState({}, null, url.format(location));\n    }\n  },\n\n  /**\n   * Generates PKCE code verifier and code challenge and sets the the code verifier in sessionStorage\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {string}\n   */\n  _generateCodeChallenge() {\n    this.logger.info('authorization: generating PKCE code challenge');\n\n    // eslint-disable-next-line no-underscore-dangle\n    const safeCharacterMap = base64url._safe_map;\n\n    const codeVerifier = lodash.times(\n      128,\n      () => safeCharacterMap[lodash.random(0, safeCharacterMap.length - 1)]\n    ).join('');\n\n    const codeChallenge = CryptoJS.SHA256(codeVerifier).toString(base64url);\n\n    this.webex.getWindow().sessionStorage.setItem(\n      OAUTH2_CODE_VERIFIER, codeVerifier\n    );\n\n    return codeChallenge;\n  },\n\n  /**\n   * Generates a CSRF token and sticks in in sessionStorage\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {Promise}\n   */\n  _generateSecurityToken() {\n    this.logger.info('authorization: generating csrf token');\n\n    const token = uuid.v4();\n\n    this.webex.getWindow().sessionStorage.setItem('oauth2-csrf-token', token);\n\n    return token;\n  },\n\n  /**\n   * Checks if the CSRF token in sessionStorage is the same as the one returned\n   * in the url.\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} query\n   * @private\n   * @returns {Promise}\n   */\n  _verifySecurityToken(query) {\n    const sessionToken = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CSRF_TOKEN);\n\n    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CSRF_TOKEN);\n    if (!sessionToken) {\n      return;\n    }\n\n    if (!query.state) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect query`);\n    }\n\n    if (!query.state.csrf_token) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect query`);\n    }\n\n    const token = query.state.csrf_token;\n\n    if (token !== sessionToken) {\n      throw new Error(`CSRF token ${token} does not match stored token ${sessionToken}`);\n    }\n  }\n});\n\nexport default Authorization;\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webex/plugin-authorization-browser-first-party",
-  "version": "1.144.2",
+  "version": "1.145.0",
   "description": "",
   "license": "MIT",
   "author": "Ian W. Remmel <iremmel@cisco.com>",
@@ -17,10 +17,11 @@
   },
   "dependencies": {
     "@babel/runtime-corejs2": "^7.14.8",
-    "@webex/webex-core": "1.144.2",
+    "@webex/webex-core": "1.145.0",
     "lodash": "^4.17.21",
-    "@webex/common": "1.144.2",
+    "@webex/common": "1.145.0",
     "uuid": "^3.3.2",
+    "crypto-js": "^4.1.1",
     "envify": "^4.1.0"
   }
 }

package/src/authorization.js

@@ -11,8 +11,15 @@ import {base64, oneFlight, whileInFlight} from '@webex/common';
 import {grantErrors, WebexPlugin} from '@webex/webex-core';
 import {cloneDeep, isEmpty, omit} from 'lodash';
 import uuid from 'uuid';
+import base64url from 'crypto-js/enc-base64url';
+import CryptoJS from 'crypto-js';
+
+// Necessary to require lodash this way in order to stub
+// methods in the unit test
+const lodash = require('lodash');
 
 const OAUTH2_CSRF_TOKEN = 'oauth2-csrf-token';
+const OAUTH2_CODE_VERIFIER = 'oauth2-code-verifier';
 
 /**
  * Browser support for OAuth2. Automatically parses the URL query for an
@@ -88,6 +95,11 @@ const Authorization = WebexPlugin.extend({
       location.query.state = {};
     }
 
+    const codeVerifier = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CODE_VERIFIER);
+
+    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CODE_VERIFIER);
+
+
     const {email} = location.query.state;
 
     this._verifySecurityToken(location.query);
@@ -97,7 +109,7 @@ const Authorization = WebexPlugin.extend({
     process.nextTick(() => {
       this.webex.internal.services.collectPreauthCatalog({email})
         .catch(() => Promise.resolve())
-        .then(() => this.requestAuthorizationCodeGrant({code}))
+        .then(() => this.requestAuthorizationCodeGrant({code, codeVerifier}))
         .then(() => {
           this.ready = true;
         });
@@ -119,6 +131,9 @@ const Authorization = WebexPlugin.extend({
     options.state.csrf_token = this._generateSecurityToken();
     options.state.email = options.email;
 
+    options.code_challenge = this._generateCodeChallenge();
+    options.code_challenge_method = 'S256';
+
 
     return this.initiateAuthorizationCodeGrant(options);
   },
@@ -171,15 +186,21 @@ const Authorization = WebexPlugin.extend({
       return Promise.reject(new Error('`options.code` is required'));
     }
 
+    const form = {
+      grant_type: 'authorization_code',
+      redirect_uri: this.config.redirect_uri,
+      code: options.code,
+      self_contained_token: true
+    };
+
+    if (options.codeVerifier) {
+      form.code_verifier = options.codeVerifier;
+    }
+
     return this.webex.request({
       method: 'POST',
       uri: this.config.tokenUrl,
-      form: {
-        grant_type: 'authorization_code',
-        redirect_uri: this.config.redirect_uri,
-        code: options.code,
-        self_contained_token: true
-      },
+      form,
       auth: {
         user: this.config.client_id,
         pass: this.config.client_secret,
@@ -243,6 +264,33 @@ const Authorization = WebexPlugin.extend({
     }
   },
 
+  /**
+   * Generates PKCE code verifier and code challenge and sets the the code verifier in sessionStorage
+   * @instance
+   * @memberof AuthorizationBrowserFirstParty
+   * @private
+   * @returns {string}
+   */
+  _generateCodeChallenge() {
+    this.logger.info('authorization: generating PKCE code challenge');
+
+    // eslint-disable-next-line no-underscore-dangle
+    const safeCharacterMap = base64url._safe_map;
+
+    const codeVerifier = lodash.times(
+      128,
+      () => safeCharacterMap[lodash.random(0, safeCharacterMap.length - 1)]
+    ).join('');
+
+    const codeChallenge = CryptoJS.SHA256(codeVerifier).toString(base64url);
+
+    this.webex.getWindow().sessionStorage.setItem(
+      OAUTH2_CODE_VERIFIER, codeVerifier
+    );
+
+    return codeChallenge;
+  },
+
   /**
    * Generates a CSRF token and sticks in in sessionStorage
    * @instance

package/test/unit/spec/authorization.js

@@ -11,13 +11,18 @@ import {browserOnly} from '@webex/test-helper-mocha';
 import sinon from 'sinon';
 import MockWebex from '@webex/test-helper-mock-webex';
 import {Credentials, Services} from '@webex/webex-core';
-import Authorization from '@webex/plugin-authorization-browser-first-party';
 import {base64, patterns} from '@webex/common';
-import {merge} from 'lodash';
+import {merge, times} from 'lodash';
+import CryptoJS from 'crypto-js';
+import Authorization from '@webex/plugin-authorization-browser-first-party';
+
+// Necessary to require lodash this way in order to stub the method
+const lodash = require('lodash');
+
 
 browserOnly(describe)('plugin-authorization-browser-first-party', () => {
   describe('Authorization', () => {
-    function makeWebex(href = 'https://example.com', csrfToken = undefined, config = {}) {
+    function makeWebex(href = 'https://example.com', csrfToken = undefined, pkceVerifier = undefined, config = {}) {
       const mockWindow = {
         history: {
           replaceState(a, b, location) {
@@ -28,7 +33,11 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
           href
         },
         sessionStorage: {
-          getItem: sinon.stub().returns(csrfToken),
+          getItem: sinon.stub()
+            .onCall(0)
+            .returns(pkceVerifier)
+            .onCall(1)
+            .returns(csrfToken),
           removeItem: sinon.spy(),
           setItem: sinon.spy()
         }
@@ -86,7 +95,10 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
 
           return webex.authorization.when('change:ready')
             .then(() => {
-              assert.calledOnce(webex.request);
+              // Webex request gets called twice:
+              // once for the pre-auth catalog
+              // once for auth token exchange
+              assert.calledTwice(webex.request);
               assert.isTrue(webex.authorization.ready);
               assert.isTrue(webex.credentials.canAuthorize);
             });
@@ -149,6 +161,35 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
           assert.isFalse(webex.credentials.canAuthorize);
         });
       });
+
+      describe('when code verifier is present in session storage', () => {
+        it('passes codeVerifier to requestAuthorizationCodeGrant', () => {
+          const expectedVerifier = 'test verifier';
+
+          const webex = makeWebex(
+            'http://example.com?code=5',
+            undefined,
+            expectedVerifier
+          );
+
+          return webex.authorization.when('change:ready')
+            .then(() => {
+              assert.calledTwice(webex.request);
+              assert.calledWith(
+                webex.getWindow().sessionStorage.getItem,
+                'oauth2-code-verifier'
+              );
+              assert.calledWith(
+                webex.getWindow().sessionStorage.removeItem,
+                'oauth2-code-verifier'
+              );
+              assert.equal(
+                webex.request.getCall(1).args[0].form.code_verifier,
+                expectedVerifier
+              );
+            });
+        });
+      });
     });
 
     describe('#initiateLogin()', () => {
@@ -193,6 +234,31 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
           });
       });
 
+      it('adds a pkce code challenge', () => {
+        const webex = makeWebex(undefined, undefined, {
+          credentials: {
+            clientType: 'confidential'
+          }
+        });
+
+        const expectedCodeChallenge = 'test challenge';
+
+        sinon.spy(webex.authorization, 'initiateAuthorizationCodeGrant');
+        sinon.stub(webex.authorization, '_generateCodeChallenge')
+          .returns(expectedCodeChallenge);
+
+        return webex.authorization.initiateLogin()
+          .then(() => {
+            assert.called(webex.authorization.initiateAuthorizationCodeGrant);
+            const grantOptions = webex.authorization.initiateAuthorizationCodeGrant.getCall(0).args[0];
+
+            assert.equal(grantOptions.code_challenge, expectedCodeChallenge);
+            assert.equal(grantOptions.code_challenge_method, 'S256');
+            // eslint-disable-next-line no-underscore-dangle
+            assert.calledWith(webex.authorization._generateCodeChallenge);
+          });
+      });
+
       it('sets #isAuthorizing', () => {
         const webex = makeWebex(undefined, undefined, {
           credentials: {
@@ -242,6 +308,38 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
       });
     });
 
+    describe('#_generateCodeChallenge', () => {
+      const expectedCodeChallenge = 'code challenge';
+      // eslint-disable-next-line no-underscore-dangle
+      const safeCharacterMap = CryptoJS.enc.Base64url._safe_map;
+
+      const expectedVerifier = times(128, () => safeCharacterMap[0]).join('');
+
+      it('generates a challenge code and stores it in session storage', () => {
+        const webex = makeWebex('http://example.com');
+
+        const toStringStub = sinon.stub().returns(expectedCodeChallenge);
+        const randomStub = sinon.stub(lodash, 'random').returns(0);
+        const sha256Stub = sinon.stub(CryptoJS, 'SHA256').returns({
+          toString: toStringStub
+        });
+
+        // eslint-disable-next-line no-underscore-dangle
+        const codeChallenge = webex.authorization._generateCodeChallenge();
+
+        assert.equal(codeChallenge, expectedCodeChallenge);
+        assert.calledWith(sha256Stub, expectedVerifier);
+        assert.calledWith(toStringStub, CryptoJS.enc.Base64url);
+        assert.callCount(randomStub, 128);
+        assert.calledWith(randomStub, 0, safeCharacterMap.length - 1);
+        assert.calledWith(
+          webex.getWindow().sessionStorage.setItem,
+          'oauth2-code-verifier',
+          expectedVerifier
+        );
+      });
+    });
+
     describe('#_cleanUrl()', () => {
       it('removes the state parameter when it has no keys', () => {
         const webex = makeWebex(undefined, undefined, {