@webex/plugin-authorization-browser-first-party 3.0.0-beta.13 → 3.0.0-beta.15

package/dist/authorization.js

@@ -379,7 +379,7 @@ var Authorization = _webexCore.WebexPlugin.extend((_dec = (0, _common.whileInFli
       throw new Error("CSRF token ".concat(token, " does not match stored token ").concat(sessionToken));
     }
   },
-  version: "3.0.0-beta.13"
+  version: "3.0.0-beta.15"
 }, ((0, _applyDecoratedDescriptor2.default)(_obj, "initiateAuthorizationCodeGrant", [_dec], (0, _getOwnPropertyDescriptor.default)(_obj, "initiateAuthorizationCodeGrant"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "requestAuthorizationCodeGrant", [_dec2, _common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "requestAuthorizationCodeGrant"), _obj)), _obj)));
 
 var _default = Authorization;

package/dist/authorization.js.map

@@ -1 +1 @@
-{"version":3,"names":["lodash","require","OAUTH2_CSRF_TOKEN","OAUTH2_CODE_VERIFIER","Authorization","WebexPlugin","extend","whileInFlight","derived","isAuthenticating","deps","fn","isAuthorizing","session","default","type","ready","namespace","initialize","attrs","ret","prototype","location","url","parse","webex","getWindow","href","_checkForErrors","code","query","state","JSON","base64","decode","codeVerifier","sessionStorage","getItem","removeItem","emailhash","_verifySecurityToken","_cleanUrl","process","nextTick","internal","services","collectPreauthCatalog","catch","resolve","then","requestAuthorizationCodeGrant","initiateLogin","options","email","emailHash","CryptoJS","SHA256","toString","csrf_token","_generateSecurityToken","code_challenge","_generateCodeChallenge","code_challenge_method","initiateAuthorizationCodeGrant","logger","info","credentials","buildLoginUrl","response_type","logout","noRedirect","buildLogoutUrl","reject","Error","form","grant_type","redirect_uri","config","self_contained_token","code_verifier","request","method","uri","tokenUrl","auth","user","client_id","pass","client_secret","sendImmediately","shouldRefreshAccessToken","res","set","supertoken","body","statusCode","ErrorConstructor","grantErrors","select","error","_res","history","replaceState","encode","search","querystring","stringify","format","safeCharacterMap","base64url","_safe_map","times","random","length","join","codeChallenge","setItem","token","uuid","v4","sessionToken","oneFlight"],"sources":["authorization.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n/* eslint camelcase: [0] */\n\nimport querystring from 'querystring';\nimport url from 'url';\n\nimport {base64, oneFlight, whileInFlight} from '@webex/common';\nimport {grantErrors, WebexPlugin} from '@webex/webex-core';\nimport {cloneDeep, isEmpty, omit} from 'lodash';\nimport uuid from 'uuid';\nimport base64url from 'crypto-js/enc-base64url';\nimport CryptoJS from 'crypto-js';\n\n// Necessary to require lodash this way in order to stub\n// methods in the unit test\nconst lodash = require('lodash');\n\nconst OAUTH2_CSRF_TOKEN = 'oauth2-csrf-token';\nconst OAUTH2_CODE_VERIFIER = 'oauth2-code-verifier';\n\n/**\n * Browser support for OAuth2. Automatically parses the URL query for an\n * authorization code\n *\n * Use of this plugin for anything other than the Webex Web Client is strongly\n * discouraged and may be broken at any time\n * @class\n * @name AuthorizationBrowserFirstParty\n * @private\n */\nconst Authorization = WebexPlugin.extend({\n  derived: {\n    /**\n     * Alias of {@link AuthorizationBrowserFirstParty#isAuthorizing}\n     * @instance\n     * @memberof AuthorizationBrowserFirstParty\n     * @type {boolean}\n     */\n    isAuthenticating: {\n      deps: ['isAuthorizing'],\n      fn() {\n        return this.isAuthorizing;\n      }\n    }\n  },\n\n  session: {\n    /**\n     * Indicates if an Authorization Code exchange is inflight\n     * @instance\n     * @memberof AuthorizationBrowserFirstParty\n     * @type {boolean}\n     */\n    isAuthorizing: {\n      default: false,\n      type: 'boolean'\n    },\n    ready: {\n      default: false,\n      type: 'boolean'\n    }\n  },\n\n  namespace: 'Credentials',\n\n  /**\n   * Initializer\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {Authorization}\n   */\n  // eslint-disable-next-line complexity\n  initialize(...attrs) {\n    const ret = Reflect.apply(WebexPlugin.prototype.initialize, this, attrs);\n    const location = url.parse(this.webex.getWindow().location.href, true);\n\n    this._checkForErrors(location);\n\n    const {code} = location.query;\n\n    if (!code) {\n      this.ready = true;\n\n      return ret;\n    }\n\n    if (location.query.state) {\n      location.query.state = JSON.parse(base64.decode(location.query.state));\n    }\n    else {\n      location.query.state = {};\n    }\n\n    const codeVerifier = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CODE_VERIFIER);\n\n    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CODE_VERIFIER);\n\n\n    const {emailhash} = location.query.state;\n\n    this._verifySecurityToken(location.query);\n    this._cleanUrl(location);\n\n    // Wait until nextTick in case `credentials` hasn't initialized yet\n    process.nextTick(() => {\n      this.webex.internal.services.collectPreauthCatalog({emailhash})\n        .catch(() => Promise.resolve())\n        .then(() => this.requestAuthorizationCodeGrant({code, codeVerifier}))\n        .then(() => {\n          this.ready = true;\n        });\n    });\n\n\n    return ret;\n  },\n\n  /**\n   * Kicks off an oauth flow\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateLogin(options = {}) {\n    options = cloneDeep(options);\n    if (options.email) {\n      options.emailHash = CryptoJS.SHA256(options.email).toString();\n    }\n    delete options.email;\n    options.state = options.state || {};\n    options.state.csrf_token = this._generateSecurityToken();\n    // catalog uses emailhash and redirectCI uses emailHash\n    options.state.emailhash = options.emailHash;\n\n    options.code_challenge = this._generateCodeChallenge();\n    options.code_challenge_method = 'S256';\n\n\n    return this.initiateAuthorizationCodeGrant(options);\n  },\n\n  @whileInFlight('isAuthorizing')\n  /**\n   * Kicks off the Implicit Code grant flow. Typically called via\n   * {@link AuthorizationBrowserFirstParty#initiateLogin}\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateAuthorizationCodeGrant(options) {\n    this.logger.info('authorization: initiating authorization code grant flow');\n    this.webex.getWindow().location = this.webex.credentials.buildLoginUrl(Object.assign({response_type: 'code'}, options));\n\n    return Promise.resolve();\n  },\n\n  /**\n   * Called by {@link WebexCore#logout()}. Redirects to the logout page\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @param {boolean} options.noRedirect if true, does not redirect\n   * @returns {Promise}\n   */\n  logout(options = {}) {\n    if (!options.noRedirect) {\n      this.webex.getWindow().location = this.webex.credentials.buildLogoutUrl(options);\n    }\n  },\n\n\n  @whileInFlight('isAuthorizing')\n  @oneFlight\n  /**\n   * Exchanges an authorization code for an access token\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @param {Object} options.code\n   * @returns {Promise}\n   */\n  requestAuthorizationCodeGrant(options = {}) {\n    this.logger.info('credentials: requesting authorization code grant');\n\n    if (!options.code) {\n      return Promise.reject(new Error('`options.code` is required'));\n    }\n\n    const form = {\n      grant_type: 'authorization_code',\n      redirect_uri: this.config.redirect_uri,\n      code: options.code,\n      self_contained_token: true\n    };\n\n    if (options.codeVerifier) {\n      form.code_verifier = options.codeVerifier;\n    }\n\n    return this.webex.request({\n      method: 'POST',\n      uri: this.config.tokenUrl,\n      form,\n      auth: {\n        user: this.config.client_id,\n        pass: this.config.client_secret,\n        sendImmediately: true\n      },\n      shouldRefreshAccessToken: false\n    })\n      .then((res) => {\n        this.webex.credentials.set({supertoken: res.body});\n      })\n      .catch((res) => {\n        if (res.statusCode !== 400) {\n          return Promise.reject(res);\n        }\n\n        const ErrorConstructor = grantErrors.select(res.body.error);\n\n        return Promise.reject(new ErrorConstructor(res._res || res));\n      });\n  },\n\n  /**\n   * Checks if the result of the login redirect contains an error string\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _checkForErrors(location) {\n    const {query} = location;\n\n    if (query && query.error) {\n      const ErrorConstructor = grantErrors.select(query.error);\n\n      throw new ErrorConstructor(query);\n    }\n  },\n\n  /**\n   * Removes no-longer needed values from the url (access token, csrf token, etc)\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _cleanUrl(location) {\n    location = cloneDeep(location);\n    if (this.webex.getWindow().history && this.webex.getWindow().history.replaceState) {\n      Reflect.deleteProperty(location.query, 'code');\n      if (isEmpty(omit(location.query.state, 'csrf_token'))) {\n        Reflect.deleteProperty(location.query, 'state');\n      }\n      else {\n        location.query.state = base64.encode(JSON.stringify(omit(location.query.state, 'csrf_token')));\n      }\n      location.search = querystring.stringify(location.query);\n      Reflect.deleteProperty(location, 'query');\n      this.webex.getWindow().history.replaceState({}, null, url.format(location));\n    }\n  },\n\n  /**\n   * Generates PKCE code verifier and code challenge and sets the the code verifier in sessionStorage\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {string}\n   */\n  _generateCodeChallenge() {\n    this.logger.info('authorization: generating PKCE code challenge');\n\n    // eslint-disable-next-line no-underscore-dangle\n    const safeCharacterMap = base64url._safe_map;\n\n    const codeVerifier = lodash.times(\n      128,\n      () => safeCharacterMap[lodash.random(0, safeCharacterMap.length - 1)]\n    ).join('');\n\n    const codeChallenge = CryptoJS.SHA256(codeVerifier).toString(base64url);\n\n    this.webex.getWindow().sessionStorage.setItem(\n      OAUTH2_CODE_VERIFIER, codeVerifier\n    );\n\n    return codeChallenge;\n  },\n\n  /**\n   * Generates a CSRF token and sticks in in sessionStorage\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {Promise}\n   */\n  _generateSecurityToken() {\n    this.logger.info('authorization: generating csrf token');\n\n    const token = uuid.v4();\n\n    this.webex.getWindow().sessionStorage.setItem('oauth2-csrf-token', token);\n\n    return token;\n  },\n\n  /**\n   * Checks if the CSRF token in sessionStorage is the same as the one returned\n   * in the url.\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} query\n   * @private\n   * @returns {Promise}\n   */\n  _verifySecurityToken(query) {\n    const sessionToken = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CSRF_TOKEN);\n\n    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CSRF_TOKEN);\n    if (!sessionToken) {\n      return;\n    }\n\n    if (!query.state) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect query`);\n    }\n\n    if (!query.state.csrf_token) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect query`);\n    }\n\n    const token = query.state.csrf_token;\n\n    if (token !== sessionToken) {\n      throw new Error(`CSRF token ${token} does not match stored token ${sessionToken}`);\n    }\n  }\n});\n\nexport default Authorization;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA;;AACA;;AAEA;;AACA;;AAEA;;AACA;;AACA;;;;AAEA;AACA;AACA,IAAMA,MAAM,GAAGC,OAAO,CAAC,QAAD,CAAtB;;AAEA,IAAMC,iBAAiB,GAAG,mBAA1B;AACA,IAAMC,oBAAoB,GAAG,sBAA7B;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACA,IAAMC,aAAa,GAAGC,sBAAA,CAAYC,MAAZ,SAiHnB,IAAAC,qBAAA,EAAc,eAAd,CAjHmB,UAgJnB,IAAAA,qBAAA,EAAc,eAAd,CAhJmB,UAAmB;EACvCC,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;IACIC,gBAAgB,EAAE;MAChBC,IAAI,EAAE,CAAC,eAAD,CADU;MAEhBC,EAFgB,gBAEX;QACH,OAAO,KAAKC,aAAZ;MACD;IAJe;EAPX,CAD8B;EAgBvCC,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;IACID,aAAa,EAAE;MACbE,OAAO,EAAE,KADI;MAEbC,IAAI,EAAE;IAFO,CAPR;IAWPC,KAAK,EAAE;MACLF,OAAO,EAAE,KADJ;MAELC,IAAI,EAAE;IAFD;EAXA,CAhB8B;EAiCvCE,SAAS,EAAE,aAjC4B;;EAmCvC;AACF;AACA;AACA;AACA;AACA;AACA;EACE;EACAC,UA3CuC,wBA2ClB;IAAA;;IAAA,kCAAPC,KAAO;MAAPA,KAAO;IAAA;;IACnB,IAAMC,GAAG,GAAG,oBAAcf,sBAAA,CAAYgB,SAAZ,CAAsBH,UAApC,EAAgD,IAAhD,EAAsDC,KAAtD,CAAZ;;IACA,IAAMG,QAAQ,GAAGC,YAAA,CAAIC,KAAJ,CAAU,KAAKC,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,CAAgCK,IAA1C,EAAgD,IAAhD,CAAjB;;IAEA,KAAKC,eAAL,CAAqBN,QAArB;;IAEA,IAAOO,IAAP,GAAeP,QAAQ,CAACQ,KAAxB,CAAOD,IAAP;;IAEA,IAAI,CAACA,IAAL,EAAW;MACT,KAAKb,KAAL,GAAa,IAAb;MAEA,OAAOI,GAAP;IACD;;IAED,IAAIE,QAAQ,CAACQ,KAAT,CAAeC,KAAnB,EAA0B;MACxBT,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuBC,IAAI,CAACR,KAAL,CAAWS,cAAA,CAAOC,MAAP,CAAcZ,QAAQ,CAACQ,KAAT,CAAeC,KAA7B,CAAX,CAAvB;IACD,CAFD,MAGK;MACHT,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuB,EAAvB;IACD;;IAED,IAAMI,YAAY,GAAG,KAAKV,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCC,OAAtC,CAA8ClC,oBAA9C,CAArB;IAEA,KAAKsB,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCE,UAAtC,CAAiDnC,oBAAjD;IAGA,IAAOoC,SAAP,GAAoBjB,QAAQ,CAACQ,KAAT,CAAeC,KAAnC,CAAOQ,SAAP;;IAEA,KAAKC,oBAAL,CAA0BlB,QAAQ,CAACQ,KAAnC;;IACA,KAAKW,SAAL,CAAenB,QAAf,EA7BmB,CA+BnB;;;IACAoB,OAAO,CAACC,QAAR,CAAiB,YAAM;MACrB,KAAI,CAAClB,KAAL,CAAWmB,QAAX,CAAoBC,QAApB,CAA6BC,qBAA7B,CAAmD;QAACP,SAAS,EAATA;MAAD,CAAnD,EACGQ,KADH,CACS;QAAA,OAAM,iBAAQC,OAAR,EAAN;MAAA,CADT,EAEGC,IAFH,CAEQ;QAAA,OAAM,KAAI,CAACC,6BAAL,CAAmC;UAACrB,IAAI,EAAJA,IAAD;UAAOM,YAAY,EAAZA;QAAP,CAAnC,CAAN;MAAA,CAFR,EAGGc,IAHH,CAGQ,YAAM;QACV,KAAI,CAACjC,KAAL,GAAa,IAAb;MACD,CALH;IAMD,CAPD;IAUA,OAAOI,GAAP;EACD,CAtFsC;;EAwFvC;AACF;AACA;AACA;AACA;AACA;AACA;EACE+B,aA/FuC,2BA+FX;IAAA,IAAdC,OAAc,uEAAJ,EAAI;IAC1BA,OAAO,GAAG,yBAAUA,OAAV,CAAV;;IACA,IAAIA,OAAO,CAACC,KAAZ,EAAmB;MACjBD,OAAO,CAACE,SAAR,GAAoBC,iBAAA,CAASC,MAAT,CAAgBJ,OAAO,CAACC,KAAxB,EAA+BI,QAA/B,EAApB;IACD;;IACD,OAAOL,OAAO,CAACC,KAAf;IACAD,OAAO,CAACrB,KAAR,GAAgBqB,OAAO,CAACrB,KAAR,IAAiB,EAAjC;IACAqB,OAAO,CAACrB,KAAR,CAAc2B,UAAd,GAA2B,KAAKC,sBAAL,EAA3B,CAP0B,CAQ1B;;IACAP,OAAO,CAACrB,KAAR,CAAcQ,SAAd,GAA0Ba,OAAO,CAACE,SAAlC;IAEAF,OAAO,CAACQ,cAAR,GAAyB,KAAKC,sBAAL,EAAzB;IACAT,OAAO,CAACU,qBAAR,GAAgC,MAAhC;IAGA,OAAO,KAAKC,8BAAL,CAAoCX,OAApC,CAAP;EACD,CA/GsC;;EAkHvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEW,8BA1HuC,0CA0HRX,OA1HQ,EA0HC;IACtC,KAAKY,MAAL,CAAYC,IAAZ,CAAiB,yDAAjB;IACA,KAAKxC,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,GAAkC,KAAKG,KAAL,CAAWyC,WAAX,CAAuBC,aAAvB,CAAqC,qBAAc;MAACC,aAAa,EAAE;IAAhB,CAAd,EAAuChB,OAAvC,CAArC,CAAlC;IAEA,OAAO,iBAAQJ,OAAR,EAAP;EACD,CA/HsC;;EAiIvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEqB,MAzIuC,oBAyIlB;IAAA,IAAdjB,OAAc,uEAAJ,EAAI;;IACnB,IAAI,CAACA,OAAO,CAACkB,UAAb,EAAyB;MACvB,KAAK7C,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,GAAkC,KAAKG,KAAL,CAAWyC,WAAX,CAAuBK,cAAvB,CAAsCnB,OAAtC,CAAlC;IACD;EACF,CA7IsC;;EAkJvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEF,6BA1JuC,2CA0JK;IAAA;;IAAA,IAAdE,OAAc,uEAAJ,EAAI;IAC1C,KAAKY,MAAL,CAAYC,IAAZ,CAAiB,kDAAjB;;IAEA,IAAI,CAACb,OAAO,CAACvB,IAAb,EAAmB;MACjB,OAAO,iBAAQ2C,MAAR,CAAe,IAAIC,KAAJ,CAAU,4BAAV,CAAf,CAAP;IACD;;IAED,IAAMC,IAAI,GAAG;MACXC,UAAU,EAAE,oBADD;MAEXC,YAAY,EAAE,KAAKC,MAAL,CAAYD,YAFf;MAGX/C,IAAI,EAAEuB,OAAO,CAACvB,IAHH;MAIXiD,oBAAoB,EAAE;IAJX,CAAb;;IAOA,IAAI1B,OAAO,CAACjB,YAAZ,EAA0B;MACxBuC,IAAI,CAACK,aAAL,GAAqB3B,OAAO,CAACjB,YAA7B;IACD;;IAED,OAAO,KAAKV,KAAL,CAAWuD,OAAX,CAAmB;MACxBC,MAAM,EAAE,MADgB;MAExBC,GAAG,EAAE,KAAKL,MAAL,CAAYM,QAFO;MAGxBT,IAAI,EAAJA,IAHwB;MAIxBU,IAAI,EAAE;QACJC,IAAI,EAAE,KAAKR,MAAL,CAAYS,SADd;QAEJC,IAAI,EAAE,KAAKV,MAAL,CAAYW,aAFd;QAGJC,eAAe,EAAE;MAHb,CAJkB;MASxBC,wBAAwB,EAAE;IATF,CAAnB,EAWJzC,IAXI,CAWC,UAAC0C,GAAD,EAAS;MACb,MAAI,CAAClE,KAAL,CAAWyC,WAAX,CAAuB0B,GAAvB,CAA2B;QAACC,UAAU,EAAEF,GAAG,CAACG;MAAjB,CAA3B;IACD,CAbI,EAcJ/C,KAdI,CAcE,UAAC4C,GAAD,EAAS;MACd,IAAIA,GAAG,CAACI,UAAJ,KAAmB,GAAvB,EAA4B;QAC1B,OAAO,iBAAQvB,MAAR,CAAemB,GAAf,CAAP;MACD;;MAED,IAAMK,gBAAgB,GAAGC,sBAAA,CAAYC,MAAZ,CAAmBP,GAAG,CAACG,IAAJ,CAASK,KAA5B,CAAzB;;MAEA,OAAO,iBAAQ3B,MAAR,CAAe,IAAIwB,gBAAJ,CAAqBL,GAAG,CAACS,IAAJ,IAAYT,GAAjC,CAAf,CAAP;IACD,CAtBI,CAAP;EAuBD,CAnMsC;;EAqMvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE/D,eA7MuC,2BA6MvBN,QA7MuB,EA6Mb;IACxB,IAAOQ,KAAP,GAAgBR,QAAhB,CAAOQ,KAAP;;IAEA,IAAIA,KAAK,IAAIA,KAAK,CAACqE,KAAnB,EAA0B;MACxB,IAAMH,gBAAgB,GAAGC,sBAAA,CAAYC,MAAZ,CAAmBpE,KAAK,CAACqE,KAAzB,CAAzB;;MAEA,MAAM,IAAIH,gBAAJ,CAAqBlE,KAArB,CAAN;IACD;EACF,CArNsC;;EAuNvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEW,SA/NuC,qBA+N7BnB,QA/N6B,EA+NnB;IAClBA,QAAQ,GAAG,yBAAUA,QAAV,CAAX;;IACA,IAAI,KAAKG,KAAL,CAAWC,SAAX,GAAuB2E,OAAvB,IAAkC,KAAK5E,KAAL,CAAWC,SAAX,GAAuB2E,OAAvB,CAA+BC,YAArE,EAAmF;MACjF,6BAAuBhF,QAAQ,CAACQ,KAAhC,EAAuC,MAAvC;;MACA,IAAI,uBAAQ,oBAAKR,QAAQ,CAACQ,KAAT,CAAeC,KAApB,EAA2B,YAA3B,CAAR,CAAJ,EAAuD;QACrD,6BAAuBT,QAAQ,CAACQ,KAAhC,EAAuC,OAAvC;MACD,CAFD,MAGK;QACHR,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuBE,cAAA,CAAOsE,MAAP,CAAc,wBAAe,oBAAKjF,QAAQ,CAACQ,KAAT,CAAeC,KAApB,EAA2B,YAA3B,CAAf,CAAd,CAAvB;MACD;;MACDT,QAAQ,CAACkF,MAAT,GAAkBC,oBAAA,CAAYC,SAAZ,CAAsBpF,QAAQ,CAACQ,KAA/B,CAAlB;MACA,6BAAuBR,QAAvB,EAAiC,OAAjC;MACA,KAAKG,KAAL,CAAWC,SAAX,GAAuB2E,OAAvB,CAA+BC,YAA/B,CAA4C,EAA5C,EAAgD,IAAhD,EAAsD/E,YAAA,CAAIoF,MAAJ,CAAWrF,QAAX,CAAtD;IACD;EACF,CA7OsC;;EA+OvC;AACF;AACA;AACA;AACA;AACA;AACA;EACEuC,sBAtPuC,oCAsPd;IACvB,KAAKG,MAAL,CAAYC,IAAZ,CAAiB,+CAAjB,EADuB,CAGvB;;IACA,IAAM2C,gBAAgB,GAAGC,qBAAA,CAAUC,SAAnC;IAEA,IAAM3E,YAAY,GAAGnC,MAAM,CAAC+G,KAAP,CACnB,GADmB,EAEnB;MAAA,OAAMH,gBAAgB,CAAC5G,MAAM,CAACgH,MAAP,CAAc,CAAd,EAAiBJ,gBAAgB,CAACK,MAAjB,GAA0B,CAA3C,CAAD,CAAtB;IAAA,CAFmB,EAGnBC,IAHmB,CAGd,EAHc,CAArB;;IAKA,IAAMC,aAAa,GAAG5D,iBAAA,CAASC,MAAT,CAAgBrB,YAAhB,EAA8BsB,QAA9B,CAAuCoD,qBAAvC,CAAtB;;IAEA,KAAKpF,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCgF,OAAtC,CACEjH,oBADF,EACwBgC,YADxB;IAIA,OAAOgF,aAAP;EACD,CAxQsC;;EA0QvC;AACF;AACA;AACA;AACA;AACA;AACA;EACExD,sBAjRuC,oCAiRd;IACvB,KAAKK,MAAL,CAAYC,IAAZ,CAAiB,sCAAjB;;IAEA,IAAMoD,KAAK,GAAGC,aAAA,CAAKC,EAAL,EAAd;;IAEA,KAAK9F,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCgF,OAAtC,CAA8C,mBAA9C,EAAmEC,KAAnE;IAEA,OAAOA,KAAP;EACD,CAzRsC;;EA2RvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE7E,oBApSuC,gCAoSlBV,KApSkB,EAoSX;IAC1B,IAAM0F,YAAY,GAAG,KAAK/F,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCC,OAAtC,CAA8CnC,iBAA9C,CAArB;IAEA,KAAKuB,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCE,UAAtC,CAAiDpC,iBAAjD;;IACA,IAAI,CAACsH,YAAL,EAAmB;MACjB;IACD;;IAED,IAAI,CAAC1F,KAAK,CAACC,KAAX,EAAkB;MAChB,MAAM,IAAI0C,KAAJ,+BAAiC+C,YAAjC,uCAAN;IACD;;IAED,IAAI,CAAC1F,KAAK,CAACC,KAAN,CAAY2B,UAAjB,EAA6B;MAC3B,MAAM,IAAIe,KAAJ,+BAAiC+C,YAAjC,uCAAN;IACD;;IAED,IAAMH,KAAK,GAAGvF,KAAK,CAACC,KAAN,CAAY2B,UAA1B;;IAEA,IAAI2D,KAAK,KAAKG,YAAd,EAA4B;MAC1B,MAAM,IAAI/C,KAAJ,sBAAwB4C,KAAxB,0CAA6DG,YAA7D,EAAN;IACD;EACF,CAzTsC;EAAA;AAAA,CAAnB,yQAiJnBC,iBAjJmB,iGAAtB;;eA4TerH,a"}
+{"version":3,"names":["lodash","require","OAUTH2_CSRF_TOKEN","OAUTH2_CODE_VERIFIER","Authorization","WebexPlugin","extend","whileInFlight","derived","isAuthenticating","deps","fn","isAuthorizing","session","default","type","ready","namespace","initialize","attrs","ret","prototype","location","url","parse","webex","getWindow","href","_checkForErrors","code","query","state","JSON","base64","decode","codeVerifier","sessionStorage","getItem","removeItem","emailhash","_verifySecurityToken","_cleanUrl","process","nextTick","internal","services","collectPreauthCatalog","catch","resolve","then","requestAuthorizationCodeGrant","initiateLogin","options","email","emailHash","CryptoJS","SHA256","toString","csrf_token","_generateSecurityToken","code_challenge","_generateCodeChallenge","code_challenge_method","initiateAuthorizationCodeGrant","logger","info","credentials","buildLoginUrl","response_type","logout","noRedirect","buildLogoutUrl","reject","Error","form","grant_type","redirect_uri","config","self_contained_token","code_verifier","request","method","uri","tokenUrl","auth","user","client_id","pass","client_secret","sendImmediately","shouldRefreshAccessToken","res","set","supertoken","body","statusCode","ErrorConstructor","grantErrors","select","error","_res","history","replaceState","encode","search","querystring","stringify","format","safeCharacterMap","base64url","_safe_map","times","random","length","join","codeChallenge","setItem","token","uuid","v4","sessionToken","oneFlight"],"sources":["authorization.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\n/* eslint camelcase: [0] */\n\nimport querystring from 'querystring';\nimport url from 'url';\n\nimport {base64, oneFlight, whileInFlight} from '@webex/common';\nimport {grantErrors, WebexPlugin} from '@webex/webex-core';\nimport {cloneDeep, isEmpty, omit} from 'lodash';\nimport uuid from 'uuid';\nimport base64url from 'crypto-js/enc-base64url';\nimport CryptoJS from 'crypto-js';\n\n// Necessary to require lodash this way in order to stub\n// methods in the unit test\nconst lodash = require('lodash');\n\nconst OAUTH2_CSRF_TOKEN = 'oauth2-csrf-token';\nconst OAUTH2_CODE_VERIFIER = 'oauth2-code-verifier';\n\n/**\n * Browser support for OAuth2. Automatically parses the URL query for an\n * authorization code\n *\n * Use of this plugin for anything other than the Webex Web Client is strongly\n * discouraged and may be broken at any time\n * @class\n * @name AuthorizationBrowserFirstParty\n * @private\n */\nconst Authorization = WebexPlugin.extend({\n  derived: {\n    /**\n     * Alias of {@link AuthorizationBrowserFirstParty#isAuthorizing}\n     * @instance\n     * @memberof AuthorizationBrowserFirstParty\n     * @type {boolean}\n     */\n    isAuthenticating: {\n      deps: ['isAuthorizing'],\n      fn() {\n        return this.isAuthorizing;\n      },\n    },\n  },\n\n  session: {\n    /**\n     * Indicates if an Authorization Code exchange is inflight\n     * @instance\n     * @memberof AuthorizationBrowserFirstParty\n     * @type {boolean}\n     */\n    isAuthorizing: {\n      default: false,\n      type: 'boolean',\n    },\n    ready: {\n      default: false,\n      type: 'boolean',\n    },\n  },\n\n  namespace: 'Credentials',\n\n  /**\n   * Initializer\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {Authorization}\n   */\n  // eslint-disable-next-line complexity\n  initialize(...attrs) {\n    const ret = Reflect.apply(WebexPlugin.prototype.initialize, this, attrs);\n    const location = url.parse(this.webex.getWindow().location.href, true);\n\n    this._checkForErrors(location);\n\n    const {code} = location.query;\n\n    if (!code) {\n      this.ready = true;\n\n      return ret;\n    }\n\n    if (location.query.state) {\n      location.query.state = JSON.parse(base64.decode(location.query.state));\n    } else {\n      location.query.state = {};\n    }\n\n    const codeVerifier = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CODE_VERIFIER);\n\n    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CODE_VERIFIER);\n\n    const {emailhash} = location.query.state;\n\n    this._verifySecurityToken(location.query);\n    this._cleanUrl(location);\n\n    // Wait until nextTick in case `credentials` hasn't initialized yet\n    process.nextTick(() => {\n      this.webex.internal.services\n        .collectPreauthCatalog({emailhash})\n        .catch(() => Promise.resolve())\n        .then(() => this.requestAuthorizationCodeGrant({code, codeVerifier}))\n        .then(() => {\n          this.ready = true;\n        });\n    });\n\n    return ret;\n  },\n\n  /**\n   * Kicks off an oauth flow\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateLogin(options = {}) {\n    options = cloneDeep(options);\n    if (options.email) {\n      options.emailHash = CryptoJS.SHA256(options.email).toString();\n    }\n    delete options.email;\n    options.state = options.state || {};\n    options.state.csrf_token = this._generateSecurityToken();\n    // catalog uses emailhash and redirectCI uses emailHash\n    options.state.emailhash = options.emailHash;\n\n    options.code_challenge = this._generateCodeChallenge();\n    options.code_challenge_method = 'S256';\n\n    return this.initiateAuthorizationCodeGrant(options);\n  },\n\n  @whileInFlight('isAuthorizing')\n  /**\n   * Kicks off the Implicit Code grant flow. Typically called via\n   * {@link AuthorizationBrowserFirstParty#initiateLogin}\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @returns {Promise}\n   */\n  initiateAuthorizationCodeGrant(options) {\n    this.logger.info('authorization: initiating authorization code grant flow');\n    this.webex.getWindow().location = this.webex.credentials.buildLoginUrl(\n      Object.assign({response_type: 'code'}, options)\n    );\n\n    return Promise.resolve();\n  },\n\n  /**\n   * Called by {@link WebexCore#logout()}. Redirects to the logout page\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @param {boolean} options.noRedirect if true, does not redirect\n   * @returns {Promise}\n   */\n  logout(options = {}) {\n    if (!options.noRedirect) {\n      this.webex.getWindow().location = this.webex.credentials.buildLogoutUrl(options);\n    }\n  },\n\n  @whileInFlight('isAuthorizing')\n  @oneFlight\n  /**\n   * Exchanges an authorization code for an access token\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} options\n   * @param {Object} options.code\n   * @returns {Promise}\n   */\n  requestAuthorizationCodeGrant(options = {}) {\n    this.logger.info('credentials: requesting authorization code grant');\n\n    if (!options.code) {\n      return Promise.reject(new Error('`options.code` is required'));\n    }\n\n    const form = {\n      grant_type: 'authorization_code',\n      redirect_uri: this.config.redirect_uri,\n      code: options.code,\n      self_contained_token: true,\n    };\n\n    if (options.codeVerifier) {\n      form.code_verifier = options.codeVerifier;\n    }\n\n    return this.webex\n      .request({\n        method: 'POST',\n        uri: this.config.tokenUrl,\n        form,\n        auth: {\n          user: this.config.client_id,\n          pass: this.config.client_secret,\n          sendImmediately: true,\n        },\n        shouldRefreshAccessToken: false,\n      })\n      .then((res) => {\n        this.webex.credentials.set({supertoken: res.body});\n      })\n      .catch((res) => {\n        if (res.statusCode !== 400) {\n          return Promise.reject(res);\n        }\n\n        const ErrorConstructor = grantErrors.select(res.body.error);\n\n        return Promise.reject(new ErrorConstructor(res._res || res));\n      });\n  },\n\n  /**\n   * Checks if the result of the login redirect contains an error string\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _checkForErrors(location) {\n    const {query} = location;\n\n    if (query && query.error) {\n      const ErrorConstructor = grantErrors.select(query.error);\n\n      throw new ErrorConstructor(query);\n    }\n  },\n\n  /**\n   * Removes no-longer needed values from the url (access token, csrf token, etc)\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} location\n   * @private\n   * @returns {Promise}\n   */\n  _cleanUrl(location) {\n    location = cloneDeep(location);\n    if (this.webex.getWindow().history && this.webex.getWindow().history.replaceState) {\n      Reflect.deleteProperty(location.query, 'code');\n      if (isEmpty(omit(location.query.state, 'csrf_token'))) {\n        Reflect.deleteProperty(location.query, 'state');\n      } else {\n        location.query.state = base64.encode(\n          JSON.stringify(omit(location.query.state, 'csrf_token'))\n        );\n      }\n      location.search = querystring.stringify(location.query);\n      Reflect.deleteProperty(location, 'query');\n      this.webex.getWindow().history.replaceState({}, null, url.format(location));\n    }\n  },\n\n  /**\n   * Generates PKCE code verifier and code challenge and sets the the code verifier in sessionStorage\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {string}\n   */\n  _generateCodeChallenge() {\n    this.logger.info('authorization: generating PKCE code challenge');\n\n    // eslint-disable-next-line no-underscore-dangle\n    const safeCharacterMap = base64url._safe_map;\n\n    const codeVerifier = lodash\n      .times(128, () => safeCharacterMap[lodash.random(0, safeCharacterMap.length - 1)])\n      .join('');\n\n    const codeChallenge = CryptoJS.SHA256(codeVerifier).toString(base64url);\n\n    this.webex.getWindow().sessionStorage.setItem(OAUTH2_CODE_VERIFIER, codeVerifier);\n\n    return codeChallenge;\n  },\n\n  /**\n   * Generates a CSRF token and sticks in in sessionStorage\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @private\n   * @returns {Promise}\n   */\n  _generateSecurityToken() {\n    this.logger.info('authorization: generating csrf token');\n\n    const token = uuid.v4();\n\n    this.webex.getWindow().sessionStorage.setItem('oauth2-csrf-token', token);\n\n    return token;\n  },\n\n  /**\n   * Checks if the CSRF token in sessionStorage is the same as the one returned\n   * in the url.\n   * @instance\n   * @memberof AuthorizationBrowserFirstParty\n   * @param {Object} query\n   * @private\n   * @returns {Promise}\n   */\n  _verifySecurityToken(query) {\n    const sessionToken = this.webex.getWindow().sessionStorage.getItem(OAUTH2_CSRF_TOKEN);\n\n    this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CSRF_TOKEN);\n    if (!sessionToken) {\n      return;\n    }\n\n    if (!query.state) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect query`);\n    }\n\n    if (!query.state.csrf_token) {\n      throw new Error(`Expected CSRF token ${sessionToken}, but not found in redirect query`);\n    }\n\n    const token = query.state.csrf_token;\n\n    if (token !== sessionToken) {\n      throw new Error(`CSRF token ${token} does not match stored token ${sessionToken}`);\n    }\n  },\n});\n\nexport default Authorization;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA;;AACA;;AAEA;;AACA;;AAEA;;AACA;;AACA;;;;AAEA;AACA;AACA,IAAMA,MAAM,GAAGC,OAAO,CAAC,QAAD,CAAtB;;AAEA,IAAMC,iBAAiB,GAAG,mBAA1B;AACA,IAAMC,oBAAoB,GAAG,sBAA7B;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACA,IAAMC,aAAa,GAAGC,sBAAA,CAAYC,MAAZ,SA8GnB,IAAAC,qBAAA,EAAc,eAAd,CA9GmB,UA8InB,IAAAA,qBAAA,EAAc,eAAd,CA9ImB,UAAmB;EACvCC,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;IACIC,gBAAgB,EAAE;MAChBC,IAAI,EAAE,CAAC,eAAD,CADU;MAEhBC,EAFgB,gBAEX;QACH,OAAO,KAAKC,aAAZ;MACD;IAJe;EAPX,CAD8B;EAgBvCC,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;IACID,aAAa,EAAE;MACbE,OAAO,EAAE,KADI;MAEbC,IAAI,EAAE;IAFO,CAPR;IAWPC,KAAK,EAAE;MACLF,OAAO,EAAE,KADJ;MAELC,IAAI,EAAE;IAFD;EAXA,CAhB8B;EAiCvCE,SAAS,EAAE,aAjC4B;;EAmCvC;AACF;AACA;AACA;AACA;AACA;AACA;EACE;EACAC,UA3CuC,wBA2ClB;IAAA;;IAAA,kCAAPC,KAAO;MAAPA,KAAO;IAAA;;IACnB,IAAMC,GAAG,GAAG,oBAAcf,sBAAA,CAAYgB,SAAZ,CAAsBH,UAApC,EAAgD,IAAhD,EAAsDC,KAAtD,CAAZ;;IACA,IAAMG,QAAQ,GAAGC,YAAA,CAAIC,KAAJ,CAAU,KAAKC,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,CAAgCK,IAA1C,EAAgD,IAAhD,CAAjB;;IAEA,KAAKC,eAAL,CAAqBN,QAArB;;IAEA,IAAOO,IAAP,GAAeP,QAAQ,CAACQ,KAAxB,CAAOD,IAAP;;IAEA,IAAI,CAACA,IAAL,EAAW;MACT,KAAKb,KAAL,GAAa,IAAb;MAEA,OAAOI,GAAP;IACD;;IAED,IAAIE,QAAQ,CAACQ,KAAT,CAAeC,KAAnB,EAA0B;MACxBT,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuBC,IAAI,CAACR,KAAL,CAAWS,cAAA,CAAOC,MAAP,CAAcZ,QAAQ,CAACQ,KAAT,CAAeC,KAA7B,CAAX,CAAvB;IACD,CAFD,MAEO;MACLT,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuB,EAAvB;IACD;;IAED,IAAMI,YAAY,GAAG,KAAKV,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCC,OAAtC,CAA8ClC,oBAA9C,CAArB;IAEA,KAAKsB,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCE,UAAtC,CAAiDnC,oBAAjD;IAEA,IAAOoC,SAAP,GAAoBjB,QAAQ,CAACQ,KAAT,CAAeC,KAAnC,CAAOQ,SAAP;;IAEA,KAAKC,oBAAL,CAA0BlB,QAAQ,CAACQ,KAAnC;;IACA,KAAKW,SAAL,CAAenB,QAAf,EA3BmB,CA6BnB;;;IACAoB,OAAO,CAACC,QAAR,CAAiB,YAAM;MACrB,KAAI,CAAClB,KAAL,CAAWmB,QAAX,CAAoBC,QAApB,CACGC,qBADH,CACyB;QAACP,SAAS,EAATA;MAAD,CADzB,EAEGQ,KAFH,CAES;QAAA,OAAM,iBAAQC,OAAR,EAAN;MAAA,CAFT,EAGGC,IAHH,CAGQ;QAAA,OAAM,KAAI,CAACC,6BAAL,CAAmC;UAACrB,IAAI,EAAJA,IAAD;UAAOM,YAAY,EAAZA;QAAP,CAAnC,CAAN;MAAA,CAHR,EAIGc,IAJH,CAIQ,YAAM;QACV,KAAI,CAACjC,KAAL,GAAa,IAAb;MACD,CANH;IAOD,CARD;IAUA,OAAOI,GAAP;EACD,CApFsC;;EAsFvC;AACF;AACA;AACA;AACA;AACA;AACA;EACE+B,aA7FuC,2BA6FX;IAAA,IAAdC,OAAc,uEAAJ,EAAI;IAC1BA,OAAO,GAAG,yBAAUA,OAAV,CAAV;;IACA,IAAIA,OAAO,CAACC,KAAZ,EAAmB;MACjBD,OAAO,CAACE,SAAR,GAAoBC,iBAAA,CAASC,MAAT,CAAgBJ,OAAO,CAACC,KAAxB,EAA+BI,QAA/B,EAApB;IACD;;IACD,OAAOL,OAAO,CAACC,KAAf;IACAD,OAAO,CAACrB,KAAR,GAAgBqB,OAAO,CAACrB,KAAR,IAAiB,EAAjC;IACAqB,OAAO,CAACrB,KAAR,CAAc2B,UAAd,GAA2B,KAAKC,sBAAL,EAA3B,CAP0B,CAQ1B;;IACAP,OAAO,CAACrB,KAAR,CAAcQ,SAAd,GAA0Ba,OAAO,CAACE,SAAlC;IAEAF,OAAO,CAACQ,cAAR,GAAyB,KAAKC,sBAAL,EAAzB;IACAT,OAAO,CAACU,qBAAR,GAAgC,MAAhC;IAEA,OAAO,KAAKC,8BAAL,CAAoCX,OAApC,CAAP;EACD,CA5GsC;;EA+GvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEW,8BAvHuC,0CAuHRX,OAvHQ,EAuHC;IACtC,KAAKY,MAAL,CAAYC,IAAZ,CAAiB,yDAAjB;IACA,KAAKxC,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,GAAkC,KAAKG,KAAL,CAAWyC,WAAX,CAAuBC,aAAvB,CAChC,qBAAc;MAACC,aAAa,EAAE;IAAhB,CAAd,EAAuChB,OAAvC,CADgC,CAAlC;IAIA,OAAO,iBAAQJ,OAAR,EAAP;EACD,CA9HsC;;EAgIvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEqB,MAxIuC,oBAwIlB;IAAA,IAAdjB,OAAc,uEAAJ,EAAI;;IACnB,IAAI,CAACA,OAAO,CAACkB,UAAb,EAAyB;MACvB,KAAK7C,KAAL,CAAWC,SAAX,GAAuBJ,QAAvB,GAAkC,KAAKG,KAAL,CAAWyC,WAAX,CAAuBK,cAAvB,CAAsCnB,OAAtC,CAAlC;IACD;EACF,CA5IsC;;EAgJvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEF,6BAxJuC,2CAwJK;IAAA;;IAAA,IAAdE,OAAc,uEAAJ,EAAI;IAC1C,KAAKY,MAAL,CAAYC,IAAZ,CAAiB,kDAAjB;;IAEA,IAAI,CAACb,OAAO,CAACvB,IAAb,EAAmB;MACjB,OAAO,iBAAQ2C,MAAR,CAAe,IAAIC,KAAJ,CAAU,4BAAV,CAAf,CAAP;IACD;;IAED,IAAMC,IAAI,GAAG;MACXC,UAAU,EAAE,oBADD;MAEXC,YAAY,EAAE,KAAKC,MAAL,CAAYD,YAFf;MAGX/C,IAAI,EAAEuB,OAAO,CAACvB,IAHH;MAIXiD,oBAAoB,EAAE;IAJX,CAAb;;IAOA,IAAI1B,OAAO,CAACjB,YAAZ,EAA0B;MACxBuC,IAAI,CAACK,aAAL,GAAqB3B,OAAO,CAACjB,YAA7B;IACD;;IAED,OAAO,KAAKV,KAAL,CACJuD,OADI,CACI;MACPC,MAAM,EAAE,MADD;MAEPC,GAAG,EAAE,KAAKL,MAAL,CAAYM,QAFV;MAGPT,IAAI,EAAJA,IAHO;MAIPU,IAAI,EAAE;QACJC,IAAI,EAAE,KAAKR,MAAL,CAAYS,SADd;QAEJC,IAAI,EAAE,KAAKV,MAAL,CAAYW,aAFd;QAGJC,eAAe,EAAE;MAHb,CAJC;MASPC,wBAAwB,EAAE;IATnB,CADJ,EAYJzC,IAZI,CAYC,UAAC0C,GAAD,EAAS;MACb,MAAI,CAAClE,KAAL,CAAWyC,WAAX,CAAuB0B,GAAvB,CAA2B;QAACC,UAAU,EAAEF,GAAG,CAACG;MAAjB,CAA3B;IACD,CAdI,EAeJ/C,KAfI,CAeE,UAAC4C,GAAD,EAAS;MACd,IAAIA,GAAG,CAACI,UAAJ,KAAmB,GAAvB,EAA4B;QAC1B,OAAO,iBAAQvB,MAAR,CAAemB,GAAf,CAAP;MACD;;MAED,IAAMK,gBAAgB,GAAGC,sBAAA,CAAYC,MAAZ,CAAmBP,GAAG,CAACG,IAAJ,CAASK,KAA5B,CAAzB;;MAEA,OAAO,iBAAQ3B,MAAR,CAAe,IAAIwB,gBAAJ,CAAqBL,GAAG,CAACS,IAAJ,IAAYT,GAAjC,CAAf,CAAP;IACD,CAvBI,CAAP;EAwBD,CAlMsC;;EAoMvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE/D,eA5MuC,2BA4MvBN,QA5MuB,EA4Mb;IACxB,IAAOQ,KAAP,GAAgBR,QAAhB,CAAOQ,KAAP;;IAEA,IAAIA,KAAK,IAAIA,KAAK,CAACqE,KAAnB,EAA0B;MACxB,IAAMH,gBAAgB,GAAGC,sBAAA,CAAYC,MAAZ,CAAmBpE,KAAK,CAACqE,KAAzB,CAAzB;;MAEA,MAAM,IAAIH,gBAAJ,CAAqBlE,KAArB,CAAN;IACD;EACF,CApNsC;;EAsNvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEW,SA9NuC,qBA8N7BnB,QA9N6B,EA8NnB;IAClBA,QAAQ,GAAG,yBAAUA,QAAV,CAAX;;IACA,IAAI,KAAKG,KAAL,CAAWC,SAAX,GAAuB2E,OAAvB,IAAkC,KAAK5E,KAAL,CAAWC,SAAX,GAAuB2E,OAAvB,CAA+BC,YAArE,EAAmF;MACjF,6BAAuBhF,QAAQ,CAACQ,KAAhC,EAAuC,MAAvC;;MACA,IAAI,uBAAQ,oBAAKR,QAAQ,CAACQ,KAAT,CAAeC,KAApB,EAA2B,YAA3B,CAAR,CAAJ,EAAuD;QACrD,6BAAuBT,QAAQ,CAACQ,KAAhC,EAAuC,OAAvC;MACD,CAFD,MAEO;QACLR,QAAQ,CAACQ,KAAT,CAAeC,KAAf,GAAuBE,cAAA,CAAOsE,MAAP,CACrB,wBAAe,oBAAKjF,QAAQ,CAACQ,KAAT,CAAeC,KAApB,EAA2B,YAA3B,CAAf,CADqB,CAAvB;MAGD;;MACDT,QAAQ,CAACkF,MAAT,GAAkBC,oBAAA,CAAYC,SAAZ,CAAsBpF,QAAQ,CAACQ,KAA/B,CAAlB;MACA,6BAAuBR,QAAvB,EAAiC,OAAjC;MACA,KAAKG,KAAL,CAAWC,SAAX,GAAuB2E,OAAvB,CAA+BC,YAA/B,CAA4C,EAA5C,EAAgD,IAAhD,EAAsD/E,YAAA,CAAIoF,MAAJ,CAAWrF,QAAX,CAAtD;IACD;EACF,CA7OsC;;EA+OvC;AACF;AACA;AACA;AACA;AACA;AACA;EACEuC,sBAtPuC,oCAsPd;IACvB,KAAKG,MAAL,CAAYC,IAAZ,CAAiB,+CAAjB,EADuB,CAGvB;;IACA,IAAM2C,gBAAgB,GAAGC,qBAAA,CAAUC,SAAnC;IAEA,IAAM3E,YAAY,GAAGnC,MAAM,CACxB+G,KADkB,CACZ,GADY,EACP;MAAA,OAAMH,gBAAgB,CAAC5G,MAAM,CAACgH,MAAP,CAAc,CAAd,EAAiBJ,gBAAgB,CAACK,MAAjB,GAA0B,CAA3C,CAAD,CAAtB;IAAA,CADO,EAElBC,IAFkB,CAEb,EAFa,CAArB;;IAIA,IAAMC,aAAa,GAAG5D,iBAAA,CAASC,MAAT,CAAgBrB,YAAhB,EAA8BsB,QAA9B,CAAuCoD,qBAAvC,CAAtB;;IAEA,KAAKpF,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCgF,OAAtC,CAA8CjH,oBAA9C,EAAoEgC,YAApE;IAEA,OAAOgF,aAAP;EACD,CArQsC;;EAuQvC;AACF;AACA;AACA;AACA;AACA;AACA;EACExD,sBA9QuC,oCA8Qd;IACvB,KAAKK,MAAL,CAAYC,IAAZ,CAAiB,sCAAjB;;IAEA,IAAMoD,KAAK,GAAGC,aAAA,CAAKC,EAAL,EAAd;;IAEA,KAAK9F,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCgF,OAAtC,CAA8C,mBAA9C,EAAmEC,KAAnE;IAEA,OAAOA,KAAP;EACD,CAtRsC;;EAwRvC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE7E,oBAjSuC,gCAiSlBV,KAjSkB,EAiSX;IAC1B,IAAM0F,YAAY,GAAG,KAAK/F,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCC,OAAtC,CAA8CnC,iBAA9C,CAArB;IAEA,KAAKuB,KAAL,CAAWC,SAAX,GAAuBU,cAAvB,CAAsCE,UAAtC,CAAiDpC,iBAAjD;;IACA,IAAI,CAACsH,YAAL,EAAmB;MACjB;IACD;;IAED,IAAI,CAAC1F,KAAK,CAACC,KAAX,EAAkB;MAChB,MAAM,IAAI0C,KAAJ,+BAAiC+C,YAAjC,uCAAN;IACD;;IAED,IAAI,CAAC1F,KAAK,CAACC,KAAN,CAAY2B,UAAjB,EAA6B;MAC3B,MAAM,IAAIe,KAAJ,+BAAiC+C,YAAjC,uCAAN;IACD;;IAED,IAAMH,KAAK,GAAGvF,KAAK,CAACC,KAAN,CAAY2B,UAA1B;;IAEA,IAAI2D,KAAK,KAAKG,YAAd,EAA4B;MAC1B,MAAM,IAAI/C,KAAJ,sBAAwB4C,KAAxB,0CAA6DG,YAA7D,EAAN;IACD;EACF,CAtTsC;EAAA;AAAA,CAAnB,yQA+InBC,iBA/ImB,iGAAtB;;eAyTerH,a"}

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"names":["credentials","clientType","refreshCallback","webex","token","request","method","uri","config","tokenUrl","form","grant_type","redirect_uri","refresh_token","auth","user","client_id","pass","client_secret","sendImmediately","shouldRefreshAccessToken","then","res","body"],"sources":["config.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nexport default {\n  credentials: {\n    /**\n     * Controls whether {@link Authorization#initiateLogin()} requests a token\n     * or an auth code. Anything other than 'confidential' will be treated as\n     * 'public'\n     * @private\n     * @type {string}\n     */\n    clientType: 'public',\n\n    refreshCallback(webex, token) {\n      /* eslint-disable camelcase */\n      return webex.request({\n        method: 'POST',\n        uri: token.config.tokenUrl,\n        form: {\n          grant_type: 'refresh_token',\n          redirect_uri: token.config.redirect_uri,\n          refresh_token: token.refresh_token\n        },\n        auth: {\n          user: token.config.client_id,\n          pass: token.config.client_secret,\n          sendImmediately: true\n        },\n        shouldRefreshAccessToken: false\n      })\n        .then((res) => res.body);\n      /* eslint-enable camelcase */\n    }\n  }\n};\n"],"mappings":";;;;;;;;;;AAAA;AACA;AACA;eAEe;EACbA,WAAW,EAAE;IACX;AACJ;AACA;AACA;AACA;AACA;AACA;IACIC,UAAU,EAAE,QARD;IAUXC,eAVW,2BAUKC,KAVL,EAUYC,KAVZ,EAUmB;MAC5B;MACA,OAAOD,KAAK,CAACE,OAAN,CAAc;QACnBC,MAAM,EAAE,MADW;QAEnBC,GAAG,EAAEH,KAAK,CAACI,MAAN,CAAaC,QAFC;QAGnBC,IAAI,EAAE;UACJC,UAAU,EAAE,eADR;UAEJC,YAAY,EAAER,KAAK,CAACI,MAAN,CAAaI,YAFvB;UAGJC,aAAa,EAAET,KAAK,CAACS;QAHjB,CAHa;QAQnBC,IAAI,EAAE;UACJC,IAAI,EAAEX,KAAK,CAACI,MAAN,CAAaQ,SADf;UAEJC,IAAI,EAAEb,KAAK,CAACI,MAAN,CAAaU,aAFf;UAGJC,eAAe,EAAE;QAHb,CARa;QAanBC,wBAAwB,EAAE;MAbP,CAAd,EAeJC,IAfI,CAeC,UAACC,GAAD;QAAA,OAASA,GAAG,CAACC,IAAb;MAAA,CAfD,CAAP;MAgBA;IACD;EA7BU;AADA,C"}
+{"version":3,"names":["credentials","clientType","refreshCallback","webex","token","request","method","uri","config","tokenUrl","form","grant_type","redirect_uri","refresh_token","auth","user","client_id","pass","client_secret","sendImmediately","shouldRefreshAccessToken","then","res","body"],"sources":["config.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nexport default {\n  credentials: {\n    /**\n     * Controls whether {@link Authorization#initiateLogin()} requests a token\n     * or an auth code. Anything other than 'confidential' will be treated as\n     * 'public'\n     * @private\n     * @type {string}\n     */\n    clientType: 'public',\n\n    refreshCallback(webex, token) {\n      /* eslint-disable camelcase */\n      return webex\n        .request({\n          method: 'POST',\n          uri: token.config.tokenUrl,\n          form: {\n            grant_type: 'refresh_token',\n            redirect_uri: token.config.redirect_uri,\n            refresh_token: token.refresh_token,\n          },\n          auth: {\n            user: token.config.client_id,\n            pass: token.config.client_secret,\n            sendImmediately: true,\n          },\n          shouldRefreshAccessToken: false,\n        })\n        .then((res) => res.body);\n      /* eslint-enable camelcase */\n    },\n  },\n};\n"],"mappings":";;;;;;;;;;AAAA;AACA;AACA;eAEe;EACbA,WAAW,EAAE;IACX;AACJ;AACA;AACA;AACA;AACA;AACA;IACIC,UAAU,EAAE,QARD;IAUXC,eAVW,2BAUKC,KAVL,EAUYC,KAVZ,EAUmB;MAC5B;MACA,OAAOD,KAAK,CACTE,OADI,CACI;QACPC,MAAM,EAAE,MADD;QAEPC,GAAG,EAAEH,KAAK,CAACI,MAAN,CAAaC,QAFX;QAGPC,IAAI,EAAE;UACJC,UAAU,EAAE,eADR;UAEJC,YAAY,EAAER,KAAK,CAACI,MAAN,CAAaI,YAFvB;UAGJC,aAAa,EAAET,KAAK,CAACS;QAHjB,CAHC;QAQPC,IAAI,EAAE;UACJC,IAAI,EAAEX,KAAK,CAACI,MAAN,CAAaQ,SADf;UAEJC,IAAI,EAAEb,KAAK,CAACI,MAAN,CAAaU,aAFf;UAGJC,eAAe,EAAE;QAHb,CARC;QAaPC,wBAAwB,EAAE;MAbnB,CADJ,EAgBJC,IAhBI,CAgBC,UAACC,GAAD;QAAA,OAASA,GAAG,CAACC,IAAb;MAAA,CAhBD,CAAP;MAiBA;IACD;EA9BU;AADA,C"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["proxies","registerPlugin","Authorization","config"],"sources":["index.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport {registerPlugin} from '@webex/webex-core';\n\nimport Authorization from './authorization';\nimport config from './config';\n\nconst proxies = [\n  'isAuthorizing',\n  'isAuthenticating'\n];\n\nregisterPlugin('authorization', Authorization, {\n  config,\n  proxies\n});\n\nexport {default} from './authorization';\nexport {default as config} from './config';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIA;;AAEA;;AACA;;AAPA;AACA;AACA;AAOA,IAAMA,OAAO,GAAG,CACd,eADc,EAEd,kBAFc,CAAhB;AAKA,IAAAC,yBAAA,EAAe,eAAf,EAAgCC,sBAAhC,EAA+C;EAC7CC,MAAM,EAANA,eAD6C;EAE7CH,OAAO,EAAPA;AAF6C,CAA/C"}
+{"version":3,"names":["proxies","registerPlugin","Authorization","config"],"sources":["index.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport {registerPlugin} from '@webex/webex-core';\n\nimport Authorization from './authorization';\nimport config from './config';\n\nconst proxies = ['isAuthorizing', 'isAuthenticating'];\n\nregisterPlugin('authorization', Authorization, {\n  config,\n  proxies,\n});\n\nexport {default} from './authorization';\nexport {default as config} from './config';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIA;;AAEA;;AACA;;AAPA;AACA;AACA;AAOA,IAAMA,OAAO,GAAG,CAAC,eAAD,EAAkB,kBAAlB,CAAhB;AAEA,IAAAC,yBAAA,EAAe,eAAf,EAAgCC,sBAAhC,EAA+C;EAC7CC,MAAM,EAANA,eAD6C;EAE7CH,OAAO,EAAPA;AAF6C,CAA/C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webex/plugin-authorization-browser-first-party",
-  "version": "3.0.0-beta.13",
+  "version": "3.0.0-beta.15",
   "description": "",
   "license": "MIT",
   "author": "Ian W. Remmel <iremmel@cisco.com>",
@@ -25,15 +25,15 @@
     "sinon": "^9.2.4"
   },
   "dependencies": {
-    "@webex/common": "3.0.0-beta.13",
-    "@webex/plugin-authorization-browser-first-party": "3.0.0-beta.13",
-    "@webex/storage-adapter-local-storage": "3.0.0-beta.13",
-    "@webex/test-helper-automation": "3.0.0-beta.13",
-    "@webex/test-helper-chai": "3.0.0-beta.13",
-    "@webex/test-helper-mocha": "3.0.0-beta.13",
-    "@webex/test-helper-mock-webex": "3.0.0-beta.13",
-    "@webex/test-helper-test-users": "3.0.0-beta.13",
-    "@webex/webex-core": "3.0.0-beta.13",
+    "@webex/common": "3.0.0-beta.15",
+    "@webex/plugin-authorization-browser-first-party": "3.0.0-beta.15",
+    "@webex/storage-adapter-local-storage": "3.0.0-beta.15",
+    "@webex/test-helper-automation": "3.0.0-beta.15",
+    "@webex/test-helper-chai": "3.0.0-beta.15",
+    "@webex/test-helper-mocha": "3.0.0-beta.15",
+    "@webex/test-helper-mock-webex": "3.0.0-beta.15",
+    "@webex/test-helper-test-users": "3.0.0-beta.15",
+    "@webex/webex-core": "3.0.0-beta.15",
     "crypto-js": "^4.1.1",
     "lodash": "^4.17.21",
     "uuid": "^3.3.2"

package/src/authorization.js

@@ -43,8 +43,8 @@ const Authorization = WebexPlugin.extend({
       deps: ['isAuthorizing'],
       fn() {
         return this.isAuthorizing;
-      }
-    }
+      },
+    },
   },
 
   session: {
@@ -56,12 +56,12 @@ const Authorization = WebexPlugin.extend({
      */
     isAuthorizing: {
       default: false,
-      type: 'boolean'
+      type: 'boolean',
     },
     ready: {
       default: false,
-      type: 'boolean'
-    }
+      type: 'boolean',
+    },
   },
 
   namespace: 'Credentials',
@@ -90,8 +90,7 @@ const Authorization = WebexPlugin.extend({
 
     if (location.query.state) {
       location.query.state = JSON.parse(base64.decode(location.query.state));
-    }
-    else {
+    } else {
       location.query.state = {};
     }
 
@@ -99,7 +98,6 @@ const Authorization = WebexPlugin.extend({
 
     this.webex.getWindow().sessionStorage.removeItem(OAUTH2_CODE_VERIFIER);
 
-
     const {emailhash} = location.query.state;
 
     this._verifySecurityToken(location.query);
@@ -107,7 +105,8 @@ const Authorization = WebexPlugin.extend({
 
     // Wait until nextTick in case `credentials` hasn't initialized yet
     process.nextTick(() => {
-      this.webex.internal.services.collectPreauthCatalog({emailhash})
+      this.webex.internal.services
+        .collectPreauthCatalog({emailhash})
         .catch(() => Promise.resolve())
         .then(() => this.requestAuthorizationCodeGrant({code, codeVerifier}))
         .then(() => {
@@ -115,7 +114,6 @@ const Authorization = WebexPlugin.extend({
         });
     });
 
-
     return ret;
   },
 
@@ -140,7 +138,6 @@ const Authorization = WebexPlugin.extend({
     options.code_challenge = this._generateCodeChallenge();
     options.code_challenge_method = 'S256';
 
-
     return this.initiateAuthorizationCodeGrant(options);
   },
 
@@ -155,7 +152,9 @@ const Authorization = WebexPlugin.extend({
    */
   initiateAuthorizationCodeGrant(options) {
     this.logger.info('authorization: initiating authorization code grant flow');
-    this.webex.getWindow().location = this.webex.credentials.buildLoginUrl(Object.assign({response_type: 'code'}, options));
+    this.webex.getWindow().location = this.webex.credentials.buildLoginUrl(
+      Object.assign({response_type: 'code'}, options)
+    );
 
     return Promise.resolve();
   },
@@ -174,7 +173,6 @@ const Authorization = WebexPlugin.extend({
     }
   },
 
-
   @whileInFlight('isAuthorizing')
   @oneFlight
   /**
@@ -196,24 +194,25 @@ const Authorization = WebexPlugin.extend({
       grant_type: 'authorization_code',
       redirect_uri: this.config.redirect_uri,
       code: options.code,
-      self_contained_token: true
+      self_contained_token: true,
     };
 
     if (options.codeVerifier) {
       form.code_verifier = options.codeVerifier;
     }
 
-    return this.webex.request({
-      method: 'POST',
-      uri: this.config.tokenUrl,
-      form,
-      auth: {
-        user: this.config.client_id,
-        pass: this.config.client_secret,
-        sendImmediately: true
-      },
-      shouldRefreshAccessToken: false
-    })
+    return this.webex
+      .request({
+        method: 'POST',
+        uri: this.config.tokenUrl,
+        form,
+        auth: {
+          user: this.config.client_id,
+          pass: this.config.client_secret,
+          sendImmediately: true,
+        },
+        shouldRefreshAccessToken: false,
+      })
       .then((res) => {
         this.webex.credentials.set({supertoken: res.body});
       })
@@ -260,9 +259,10 @@ const Authorization = WebexPlugin.extend({
       Reflect.deleteProperty(location.query, 'code');
       if (isEmpty(omit(location.query.state, 'csrf_token'))) {
         Reflect.deleteProperty(location.query, 'state');
-      }
-      else {
-        location.query.state = base64.encode(JSON.stringify(omit(location.query.state, 'csrf_token')));
+      } else {
+        location.query.state = base64.encode(
+          JSON.stringify(omit(location.query.state, 'csrf_token'))
+        );
       }
       location.search = querystring.stringify(location.query);
       Reflect.deleteProperty(location, 'query');
@@ -283,16 +283,13 @@ const Authorization = WebexPlugin.extend({
     // eslint-disable-next-line no-underscore-dangle
     const safeCharacterMap = base64url._safe_map;
 
-    const codeVerifier = lodash.times(
-      128,
-      () => safeCharacterMap[lodash.random(0, safeCharacterMap.length - 1)]
-    ).join('');
+    const codeVerifier = lodash
+      .times(128, () => safeCharacterMap[lodash.random(0, safeCharacterMap.length - 1)])
+      .join('');
 
     const codeChallenge = CryptoJS.SHA256(codeVerifier).toString(base64url);
 
-    this.webex.getWindow().sessionStorage.setItem(
-      OAUTH2_CODE_VERIFIER, codeVerifier
-    );
+    this.webex.getWindow().sessionStorage.setItem(OAUTH2_CODE_VERIFIER, codeVerifier);
 
     return codeChallenge;
   },
@@ -344,7 +341,7 @@ const Authorization = WebexPlugin.extend({
     if (token !== sessionToken) {
       throw new Error(`CSRF token ${token} does not match stored token ${sessionToken}`);
     }
-  }
+  },
 });
 
 export default Authorization;

package/src/config.js

@@ -15,23 +15,24 @@ export default {
 
     refreshCallback(webex, token) {
       /* eslint-disable camelcase */
-      return webex.request({
-        method: 'POST',
-        uri: token.config.tokenUrl,
-        form: {
-          grant_type: 'refresh_token',
-          redirect_uri: token.config.redirect_uri,
-          refresh_token: token.refresh_token
-        },
-        auth: {
-          user: token.config.client_id,
-          pass: token.config.client_secret,
-          sendImmediately: true
-        },
-        shouldRefreshAccessToken: false
-      })
+      return webex
+        .request({
+          method: 'POST',
+          uri: token.config.tokenUrl,
+          form: {
+            grant_type: 'refresh_token',
+            redirect_uri: token.config.redirect_uri,
+            refresh_token: token.refresh_token,
+          },
+          auth: {
+            user: token.config.client_id,
+            pass: token.config.client_secret,
+            sendImmediately: true,
+          },
+          shouldRefreshAccessToken: false,
+        })
         .then((res) => res.body);
       /* eslint-enable camelcase */
-    }
-  }
+    },
+  },
 };

package/src/index.js

@@ -7,14 +7,11 @@ import {registerPlugin} from '@webex/webex-core';
 import Authorization from './authorization';
 import config from './config';
 
-const proxies = [
-  'isAuthorizing',
-  'isAuthenticating'
-];
+const proxies = ['isAuthorizing', 'isAuthenticating'];
 
 registerPlugin('authorization', Authorization, {
   config,
-  proxies
+  proxies,
 });
 
 export {default} from './authorization';

package/test/automation/fixtures/app.js

@@ -11,22 +11,23 @@ import WebexCore from '@webex/webex-core';
 
 import pkg from '../../../package';
 
-const webex = window.webex = new WebexCore({
+const webex = (window.webex = new WebexCore({
   config: {
     storage: {
-      boundedAdapter: new StorageAdapterLocalStorage('webex')
-    }
-  }
-});
+      boundedAdapter: new StorageAdapterLocalStorage('webex'),
+    },
+  },
+}));
 
 webex.once('ready', () => {
   if (webex.canAuthorize) {
     document.getElementById('access-token').innerHTML = webex.credentials.supertoken.access_token;
     document.getElementById('refresh-token').innerHTML = webex.credentials.supertoken.refresh_token;
 
-    webex.request({
-      uri: 'https://locus-a.wbx2.com/locus/api/v1/ping'
-    })
+    webex
+      .request({
+        uri: 'https://locus-a.wbx2.com/locus/api/v1/ping',
+      })
       .then(() => {
         document.getElementById('ping-complete').innerHTML = 'success';
       });
@@ -41,18 +42,17 @@ document.getElementById('initiate-authorization-code-grant').addEventListener('c
   webex.authorization.initiateLogin({
     state: {
       exchange: false,
-      name: pkg.name
-    }
+      name: pkg.name,
+    },
   });
 });
 
 document.getElementById('token-refresh').addEventListener('click', () => {
   document.getElementById('access-token').innerHTML = '';
-  webex.refresh({force: true})
-    .then(() => {
-      document.getElementById('access-token').innerHTML = webex.credentials.supertoken.access_token;
-      document.getElementById('refresh-token').innerHTML = webex.credentials.supertoken.refresh_token;
-    });
+  webex.refresh({force: true}).then(() => {
+    document.getElementById('access-token').innerHTML = webex.credentials.supertoken.access_token;
+    document.getElementById('refresh-token').innerHTML = webex.credentials.supertoken.refresh_token;
+  });
 });
 
 document.getElementById('logout').addEventListener('click', () => {

package/test/automation/fixtures/index.html

@@ -1,21 +1,24 @@
 <!DOCTYPE html>
 <html>
-<head>
-  <title>Authorization Automation Test</title>
-</head>
-<body class="authorization-automation-test">
-  <button title="Login with Authorization Code Grant" id="initiate-authorization-code-grant">Login with Authorization Code Grant</button>
-  <button title="Refresh Access Token" id="token-refresh">Refresh Access Token</button>
+  <head>
+    <title>Authorization Automation Test</title>
+  </head>
+  <body class="authorization-automation-test">
+    <button title="Login with Authorization Code Grant" id="initiate-authorization-code-grant">
+      Login with Authorization Code Grant
+    </button>
+    <button title="Refresh Access Token" id="token-refresh">Refresh Access Token</button>
 
-  <h1>Access Token</h1>
-  <div id="access-token"></div>
-  <h1>Refresh Token</h1>
-  <div id="refresh-token"></div>
+    <h1>Access Token</h1>
+    <div id="access-token"></div>
+    <h1>Refresh Token</h1>
+    <div id="refresh-token"></div>
 
-  <h1>Pinging WDM</h1>
-  <div id="ping-complete"></div>
+    <h1>Pinging WDM</h1>
+    <div id="ping-complete"></div>
 
-  <button title="Logout" id="logout">Logout</button>
+    <button title="Logout" id="logout">Logout</button>
 
-  <script src="app.js"></script>
-</body>
+    <script src="app.js"></script>
+  </body>
+</html>

package/test/automation/spec/authorization-code-grant.js

@@ -16,9 +16,17 @@ const redirectUri = process.env.WEBEX_REDIRECT_URI || process.env.REDIRECT_URI;
 // for test users in EU (Federation) and US
 // Also try US user with Federation enabled
 const runs = [
-  {it: 'with EU user with Federation enabled', EUUser: true, attrs: {config: {credentials: {federation: true}}}},
+  {
+    it: 'with EU user with Federation enabled',
+    EUUser: true,
+    attrs: {config: {credentials: {federation: true}}},
+  },
   {it: 'with US user without Federation enabled', EUUser: false, attrs: {}},
-  {it: 'with US user with Federation enabled', EUUser: false, attrs: {config: {credentials: {federation: true}}}}
+  {
+    it: 'with US user with Federation enabled',
+    EUUser: false,
+    attrs: {config: {credentials: {federation: true}}},
+  },
 ];
 
 runs.forEach((run) => {
@@ -35,98 +43,108 @@ runs.forEach((run) => {
           testUserParm.config = {orgId: process.env.EU_PRIMARY_ORG_ID};
         }
 
-        before(() => testUsers.create(testUserParm)
-          .then((users) => {
+        before(() =>
+          testUsers.create(testUserParm).then((users) => {
             user = users[0];
-          }));
+          })
+        );
 
-        before(() => createBrowser(pkg)
-          .then((b) => {
+        before(() =>
+          createBrowser(pkg).then((b) => {
             browser = b;
-          }));
+          })
+        );
 
         after(() => browser && browser.printLogs());
 
-        after(() => browser && browser.quit()
-          .catch((reason) => {
-            console.warn(reason);
-          }));
-
-        it('authorizes a user', () => browser
-          .get(`${redirectUri}/${pkg.name}`)
-          .waitForElementByClassName('ready')
-          .title()
+        after(
+          () =>
+            browser &&
+            browser.quit().catch((reason) => {
+              console.warn(reason);
+            })
+        );
+
+        it('authorizes a user', () =>
+          browser
+            .get(`${redirectUri}/${pkg.name}`)
+            .waitForElementByClassName('ready')
+            .title()
             .should.eventually.become('Authorization Automation Test')
-          .waitForElementByCssSelector('[title="Login with Authorization Code Grant"]')
+            .waitForElementByCssSelector('[title="Login with Authorization Code Grant"]')
             .click()
-          .login(user)
-          .waitForElementByClassName('authorization-automation-test')
-          .waitForElementById('refresh-token')
+            .login(user)
+            .waitForElementByClassName('authorization-automation-test')
+            .waitForElementById('refresh-token')
             .text()
-              .should.eventually.not.be.empty
-          .waitForElementByCssSelector('#ping-complete:not(:empty)')
+            .should.eventually.not.be.empty.waitForElementByCssSelector(
+              '#ping-complete:not(:empty)'
+            )
             .text()
-              .should.eventually.become('success'));
+            .should.eventually.become('success'));
 
-        it('is still logged in after reloading the page', () => browser
-          .waitForElementById('access-token')
-            .text()
-              .should.eventually.not.be.empty
-          .get(`${redirectUri}/${pkg.name}`)
-          .sleep(500)
-          .waitForElementById('access-token')
+        it('is still logged in after reloading the page', () =>
+          browser
+            .waitForElementById('access-token')
             .text()
-              .should.eventually.not.be.empty);
+            .should.eventually.not.be.empty.get(`${redirectUri}/${pkg.name}`)
+            .sleep(500)
+            .waitForElementById('access-token')
+            .text().should.eventually.not.be.empty);
 
-        it('refreshes the user\'s access token', () => {
+        it("refreshes the user's access token", () => {
           let accessToken = '';
 
-          return browser
-            .waitForElementByCssSelector('#access-token:not(:empty)')
+          return (
+            browser
+              .waitForElementByCssSelector('#access-token:not(:empty)')
               .text()
-                .then((text) => {
-                  accessToken = text;
-                  assert.isString(accessToken);
-                  assert.isAbove(accessToken.length, 0);
-
-                  return browser;
-                })
-            .waitForElementByCssSelector('[title="Refresh Access Token"]')
+              .then((text) => {
+                accessToken = text;
+                assert.isString(accessToken);
+                assert.isAbove(accessToken.length, 0);
+
+                return browser;
+              })
+              .waitForElementByCssSelector('[title="Refresh Access Token"]')
               .click()
-            // Not thrilled by a sleep, but we just need to give the button click
-            // enough time to clear the #access-token box
-            .sleep(500)
-            .waitForElementByCssSelector('#access-token:not(:empty)')
+              // Not thrilled by a sleep, but we just need to give the button click
+              // enough time to clear the #access-token box
+              .sleep(500)
+              .waitForElementByCssSelector('#access-token:not(:empty)')
               .text()
-                .then((text) => {
-                  assert.isString(text);
-                  assert.isAbove(text.length, 0);
-                  assert.notEqual(text, accessToken);
-
-                  return browser;
-                });
+              .then((text) => {
+                assert.isString(text);
+                assert.isAbove(text.length, 0);
+                assert.notEqual(text, accessToken);
+
+                return browser;
+              })
+          );
         });
 
-        it('logs out a user', () => browser
-          .title()
+        it('logs out a user', () =>
+          browser
+            .title()
             .should.eventually.become('Authorization Automation Test')
-          .waitForElementByCssSelector('[title="Logout"]')
+            .waitForElementByCssSelector('[title="Logout"]')
             .click()
-          // We need to revoke three tokens before the window.location assignment.
-          // So far, I haven't found any ques to wait for, so sleep seems to be
-          // the only option.
-          .sleep(3000)
-          .title()
+            // We need to revoke three tokens before the window.location assignment.
+            // So far, I haven't found any ques to wait for, so sleep seems to be
+            // the only option.
+            .sleep(3000)
+            .title()
             .should.eventually.become('Redirect Dispatcher')
-          .get(`${redirectUri}/${pkg.name}`)
-          .title()
+            .get(`${redirectUri}/${pkg.name}`)
+            .title()
             .should.eventually.become('Authorization Automation Test')
-          .waitForElementById('access-token')
+            .waitForElementById('access-token')
             .text()
-              .should.eventually.be.empty
-          .waitForElementByCssSelector('[title="Login with Authorization Code Grant"]')
+            .should.eventually.be.empty.waitForElementByCssSelector(
+              '[title="Login with Authorization Code Grant"]'
+            )
             .click()
-          .waitForElementById('IDToken1'));
+            .waitForElementById('IDToken1'));
       });
     });
   });

package/test/unit/spec/authorization.js

@@ -19,28 +19,28 @@ import Authorization from '@webex/plugin-authorization-browser-first-party';
 // Necessary to require lodash this way in order to stub the method
 const lodash = require('lodash');
 
-
 browserOnly(describe)('plugin-authorization-browser-first-party', () => {
   describe('Authorization', () => {
-    function makeWebex(href = 'https://example.com', csrfToken = undefined, pkceVerifier = undefined, config = {}) {
+    function makeWebex(
+      href = 'https://example.com',
+      csrfToken = undefined,
+      pkceVerifier = undefined,
+      config = {}
+    ) {
       const mockWindow = {
         history: {
           replaceState(a, b, location) {
             mockWindow.location.href = location;
-          }
+          },
         },
         location: {
-          href
+          href,
         },
         sessionStorage: {
-          getItem: sinon.stub()
-            .onCall(0)
-            .returns(pkceVerifier)
-            .onCall(1)
-            .returns(csrfToken),
+          getItem: sinon.stub().onCall(0).returns(pkceVerifier).onCall(1).returns(csrfToken),
           removeItem: sinon.spy(),
-          setItem: sinon.spy()
-        }
+          setItem: sinon.spy(),
+        },
       };
 
       sinon.spy(mockWindow.history, 'replaceState');
@@ -49,37 +49,52 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
         children: {
           authorization: Authorization,
           credentials: Credentials,
-          services: Services
+          services: Services,
         },
-        request: sinon.stub().returns(Promise.resolve({body: {access_token: 'AT', token_type: 'Fake', refresh_token: 'RT'}})),
-        config: merge({
-          credentials: {
-            idbroker: {
-              url: process.env.IDBROKER_BASE_URL,
-              defaultUrl: process.env.IDBROKER_BASE_URL
-            },
-            identity: {
-              url: process.env.IDENTITY_BASE_URL,
-              defaultUrl: process.env.IDENTITY_BASE_URL
+        request: sinon
+          .stub()
+          .returns(
+            Promise.resolve({body: {access_token: 'AT', token_type: 'Fake', refresh_token: 'RT'}})
+          ),
+        config: merge(
+          {
+            credentials: {
+              idbroker: {
+                url: process.env.IDBROKER_BASE_URL,
+                defaultUrl: process.env.IDBROKER_BASE_URL,
+              },
+              identity: {
+                url: process.env.IDENTITY_BASE_URL,
+                defaultUrl: process.env.IDENTITY_BASE_URL,
+              },
+              activationUrl: `${
+                process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+              }/idb/token/v1/actions/UserActivation/invoke`,
+              authorizeUrl: `${
+                process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+              }/idb/oauth2/v1/authorize`,
+              setPasswordUrl: `${
+                process.env.IDBROKER_BASE_URL || 'https://identity.webex.com'
+              }/identity/scim/v1/Users`,
+              logoutUrl: `${
+                process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+              }/idb/oauth2/v1/logout`,
+              // eslint-disable-next-line camelcase
+              client_id: 'fake',
+              // eslint-disable-next-line camelcase
+              client_secret: 'fake',
+              // eslint-disable-next-line camelcase
+              redirect_uri: 'http://example.com',
+              // eslint-disable-next-line camelcase
+              scope: 'scope:one',
+              refreshCallback: () => Promise.resolve(),
             },
-            activationUrl: `${process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'}/idb/token/v1/actions/UserActivation/invoke`,
-            authorizeUrl: `${process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'}/idb/oauth2/v1/authorize`,
-            setPasswordUrl: `${process.env.IDBROKER_BASE_URL || 'https://identity.webex.com'}/identity/scim/v1/Users`,
-            logoutUrl: `${process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'}/idb/oauth2/v1/logout`,
-            // eslint-disable-next-line camelcase
-            client_id: 'fake',
-            // eslint-disable-next-line camelcase
-            client_secret: 'fake',
-            // eslint-disable-next-line camelcase
-            redirect_uri: 'http://example.com',
-            // eslint-disable-next-line camelcase
-            scope: 'scope:one',
-            refreshCallback: () => Promise.resolve()
-          }
-        }, config),
+          },
+          config
+        ),
         getWindow() {
           return mockWindow;
-        }
+        },
       });
 
       return webex;
@@ -93,15 +108,14 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
           assert.isFalse(webex.authorization.ready);
           assert.isFalse(webex.credentials.canAuthorize);
 
-          return webex.authorization.when('change:ready')
-            .then(() => {
-              // Webex request gets called twice:
-              // once for the pre-auth catalog
-              // once for auth token exchange
-              assert.calledTwice(webex.request);
-              assert.isTrue(webex.authorization.ready);
-              assert.isTrue(webex.credentials.canAuthorize);
-            });
+          return webex.authorization.when('change:ready').then(() => {
+            // Webex request gets called twice:
+            // once for the pre-auth catalog
+            // once for auth token exchange
+            assert.calledTwice(webex.request);
+            assert.isTrue(webex.authorization.ready);
+            assert.isTrue(webex.credentials.canAuthorize);
+          });
         });
 
         it('validates the csrf token', () => {
@@ -109,12 +123,20 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
 
           assert.throws(() => {
             // eslint-disable-next-line no-unused-vars
-            const webex = makeWebex(`http://example.com/?code=5&state=${base64.encode(JSON.stringify({csrf_token: 'someothertoken'}))}`, csrfToken);
+            const webex = makeWebex(
+              `http://example.com/?code=5&state=${base64.encode(
+                JSON.stringify({csrf_token: 'someothertoken'})
+              )}`,
+              csrfToken
+            );
           }, /CSRF token someothertoken does not match stored token abcd/);
 
           assert.throws(() => {
             // eslint-disable-next-line no-unused-vars
-            const webex = makeWebex(`http://example.com/?code=5&state=${base64.encode(JSON.stringify({}))}`, csrfToken);
+            const webex = makeWebex(
+              `http://example.com/?code=5&state=${base64.encode(JSON.stringify({}))}`,
+              csrfToken
+            );
           }, /Expected CSRF token abcd, but not found in redirect query/);
 
           assert.throws(() => {
@@ -122,33 +144,46 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
             const webex = makeWebex('http://example.com/?code=5', csrfToken);
           }, /Expected CSRF token abcd, but not found in redirect query/);
 
-          const webex = makeWebex(`http://example.com/?code=5&state=${base64.encode(JSON.stringify({csrf_token: csrfToken}))}`, csrfToken);
+          const webex = makeWebex(
+            `http://example.com/?code=5&state=${base64.encode(
+              JSON.stringify({csrf_token: csrfToken})
+            )}`,
+            csrfToken
+          );
 
-          return webex.authorization.when('change:ready')
-            .then(() => {
-              assert.isTrue(webex.credentials.canAuthorize);
-              assert.called(webex.getWindow().sessionStorage.removeItem);
-            });
+          return webex.authorization.when('change:ready').then(() => {
+            assert.isTrue(webex.credentials.canAuthorize);
+            assert.called(webex.getWindow().sessionStorage.removeItem);
+          });
         });
 
         it('removes the oauth parameters from the url', () => {
           const csrfToken = 'abcd';
 
-          const webex = makeWebex(`http://example.com/?code=5&state=${base64.encode(JSON.stringify({csrf_token: csrfToken, something: true}))}`, csrfToken);
+          const webex = makeWebex(
+            `http://example.com/?code=5&state=${base64.encode(
+              JSON.stringify({csrf_token: csrfToken, something: true})
+            )}`,
+            csrfToken
+          );
 
-          return webex.authorization.when('change:ready')
-            .then(() => {
-              assert.isTrue(webex.credentials.canAuthorize);
-              assert.called(webex.getWindow().sessionStorage.removeItem);
-              assert.called(webex.getWindow().history.replaceState);
-              assert.equal(webex.getWindow().location.href, `http://example.com/?state=${base64.encode(JSON.stringify({something: true}))}`);
-            });
+          return webex.authorization.when('change:ready').then(() => {
+            assert.isTrue(webex.credentials.canAuthorize);
+            assert.called(webex.getWindow().sessionStorage.removeItem);
+            assert.called(webex.getWindow().history.replaceState);
+            assert.equal(
+              webex.getWindow().location.href,
+              `http://example.com/?state=${base64.encode(JSON.stringify({something: true}))}`
+            );
+          });
         });
       });
       describe('when the url contains an error', () => {
         it('throws a grant error', () => {
           assert.throws(() => {
-            makeWebex('http://127.0.0.1:8000/?error=invalid_scope&error_description=The%20requested%20scope%20is%20invalid.');
+            makeWebex(
+              'http://127.0.0.1:8000/?error=invalid_scope&error_description=The%20requested%20scope%20is%20invalid.'
+            );
           }, /The requested scope is invalid./);
         });
       });
@@ -166,28 +201,14 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
         it('passes codeVerifier to requestAuthorizationCodeGrant', () => {
           const expectedVerifier = 'test verifier';
 
-          const webex = makeWebex(
-            'http://example.com?code=5',
-            undefined,
-            expectedVerifier
-          );
+          const webex = makeWebex('http://example.com?code=5', undefined, expectedVerifier);
 
-          return webex.authorization.when('change:ready')
-            .then(() => {
-              assert.calledTwice(webex.request);
-              assert.calledWith(
-                webex.getWindow().sessionStorage.getItem,
-                'oauth2-code-verifier'
-              );
-              assert.calledWith(
-                webex.getWindow().sessionStorage.removeItem,
-                'oauth2-code-verifier'
-              );
-              assert.equal(
-                webex.request.getCall(1).args[0].form.code_verifier,
-                expectedVerifier
-              );
-            });
+          return webex.authorization.when('change:ready').then(() => {
+            assert.calledTwice(webex.request);
+            assert.calledWith(webex.getWindow().sessionStorage.getItem, 'oauth2-code-verifier');
+            assert.calledWith(webex.getWindow().sessionStorage.removeItem, 'oauth2-code-verifier');
+            assert.equal(webex.request.getCall(1).args[0].form.code_verifier, expectedVerifier);
+          });
         });
       });
     });
@@ -196,95 +217,97 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
       it('calls #initiateAuthorizationCodeGrant()', () => {
         const webex = makeWebex(undefined, undefined, {
           credentials: {
-            clientType: 'confidential'
-          }
+            clientType: 'confidential',
+          },
         });
 
         sinon.spy(webex.authorization, 'initiateAuthorizationCodeGrant');
 
-        return webex.authorization.initiateLogin()
-          .then(() => {
-            assert.called(webex.authorization.initiateAuthorizationCodeGrant);
-            assert.include(webex.getWindow().location, 'response_type=code');
-          });
+        return webex.authorization.initiateLogin().then(() => {
+          assert.called(webex.authorization.initiateAuthorizationCodeGrant);
+          assert.include(webex.getWindow().location, 'response_type=code');
+        });
       });
 
       it('adds a csrf_token to the login url and sessionStorage', () => {
         const webex = makeWebex(undefined, undefined, {
           credentials: {
-            clientType: 'confidential'
-          }
+            clientType: 'confidential',
+          },
         });
 
         sinon.spy(webex.authorization, 'initiateAuthorizationCodeGrant');
 
-        return webex.authorization.initiateLogin()
-          .then(() => {
-            assert.called(webex.authorization.initiateAuthorizationCodeGrant);
-            assert.include(webex.getWindow().location, 'response_type=code');
-            const {query} = url.parse(webex.getWindow().location, true);
-            let {state} = query;
-
-            state = JSON.parse(base64.decode(state));
-            assert.property(state, 'csrf_token');
-            assert.isDefined(state.csrf_token);
-            assert.match(state.csrf_token, patterns.uuid);
-            assert.called(webex.getWindow().sessionStorage.setItem);
-            assert.calledWith(webex.getWindow().sessionStorage.setItem, 'oauth2-csrf-token', state.csrf_token);
-          });
+        return webex.authorization.initiateLogin().then(() => {
+          assert.called(webex.authorization.initiateAuthorizationCodeGrant);
+          assert.include(webex.getWindow().location, 'response_type=code');
+          const {query} = url.parse(webex.getWindow().location, true);
+          let {state} = query;
+
+          state = JSON.parse(base64.decode(state));
+          assert.property(state, 'csrf_token');
+          assert.isDefined(state.csrf_token);
+          assert.match(state.csrf_token, patterns.uuid);
+          assert.called(webex.getWindow().sessionStorage.setItem);
+          assert.calledWith(
+            webex.getWindow().sessionStorage.setItem,
+            'oauth2-csrf-token',
+            state.csrf_token
+          );
+        });
       });
 
       it('adds a pkce code challenge', () => {
         const webex = makeWebex(undefined, undefined, {
           credentials: {
-            clientType: 'confidential'
-          }
+            clientType: 'confidential',
+          },
         });
 
         const expectedCodeChallenge = 'test challenge';
 
         sinon.spy(webex.authorization, 'initiateAuthorizationCodeGrant');
-        sinon.stub(webex.authorization, '_generateCodeChallenge')
-          .returns(expectedCodeChallenge);
-
-        return webex.authorization.initiateLogin()
-          .then(() => {
-            assert.called(webex.authorization.initiateAuthorizationCodeGrant);
-            const grantOptions = webex.authorization.initiateAuthorizationCodeGrant.getCall(0).args[0];
-
-            assert.equal(grantOptions.code_challenge, expectedCodeChallenge);
-            assert.equal(grantOptions.code_challenge_method, 'S256');
-            // eslint-disable-next-line no-underscore-dangle
-            assert.calledWith(webex.authorization._generateCodeChallenge);
-          });
+        sinon.stub(webex.authorization, '_generateCodeChallenge').returns(expectedCodeChallenge);
+
+        return webex.authorization.initiateLogin().then(() => {
+          assert.called(webex.authorization.initiateAuthorizationCodeGrant);
+          const grantOptions =
+            webex.authorization.initiateAuthorizationCodeGrant.getCall(0).args[0];
+
+          assert.equal(grantOptions.code_challenge, expectedCodeChallenge);
+          assert.equal(grantOptions.code_challenge_method, 'S256');
+          // eslint-disable-next-line no-underscore-dangle
+          assert.calledWith(webex.authorization._generateCodeChallenge);
+        });
       });
 
       it('adds emailHash', () => {
         const webex = makeWebex(undefined, undefined, {
           credentials: {
-            clientType: 'confidential'
-          }
+            clientType: 'confidential',
+          },
         });
 
-        const expectedEmailHash = '73062d872926c2a556f17b36f50e328ddf9bff9d403939bd14b6c3b7f5a33fc2';
+        const expectedEmailHash =
+          '73062d872926c2a556f17b36f50e328ddf9bff9d403939bd14b6c3b7f5a33fc2';
 
         sinon.spy(webex.authorization, 'initiateAuthorizationCodeGrant');
 
-        return webex.authorization.initiateLogin({email: 'test@email.com'})
-          .then(() => {
-            assert.called(webex.authorization.initiateAuthorizationCodeGrant);
-            const grantOptions = webex.authorization.initiateAuthorizationCodeGrant.getCall(0).args[0];
+        return webex.authorization.initiateLogin({email: 'test@email.com'}).then(() => {
+          assert.called(webex.authorization.initiateAuthorizationCodeGrant);
+          const grantOptions =
+            webex.authorization.initiateAuthorizationCodeGrant.getCall(0).args[0];
 
-            assert.equal(grantOptions.emailHash, expectedEmailHash);
-            assert.isUndefined(grantOptions.email);
-          });
+          assert.equal(grantOptions.emailHash, expectedEmailHash);
+          assert.isUndefined(grantOptions.email);
+        });
       });
 
       it('sets #isAuthorizing', () => {
         const webex = makeWebex(undefined, undefined, {
           credentials: {
-            clientType: 'confidential'
-          }
+            clientType: 'confidential',
+          },
         });
 
         assert.isFalse(webex.authorization.isAuthorizing);
@@ -298,8 +321,8 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
       it('sets #isAuthenticating', () => {
         const webex = makeWebex(undefined, undefined, {
           credentials: {
-            clientType: 'confidential'
-          }
+            clientType: 'confidential',
+          },
         });
 
         assert.isFalse(webex.authorization.isAuthenticating);
@@ -315,17 +338,16 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
       it('redirects to the login page with response_type=code', () => {
         const webex = makeWebex(undefined, undefined, {
           credentials: {
-            clientType: 'confidential'
-          }
+            clientType: 'confidential',
+          },
         });
 
         sinon.spy(webex.authorization, 'initiateAuthorizationCodeGrant');
 
-        return webex.authorization.initiateLogin()
-          .then(() => {
-            assert.called(webex.authorization.initiateAuthorizationCodeGrant);
-            assert.include(webex.getWindow().location, 'response_type=code');
-          });
+        return webex.authorization.initiateLogin().then(() => {
+          assert.called(webex.authorization.initiateAuthorizationCodeGrant);
+          assert.include(webex.getWindow().location, 'response_type=code');
+        });
       });
     });
 
@@ -342,7 +364,7 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
         const toStringStub = sinon.stub().returns(expectedCodeChallenge);
         const randomStub = sinon.stub(lodash, 'random').returns(0);
         const sha256Stub = sinon.stub(CryptoJS, 'SHA256').returns({
-          toString: toStringStub
+          toString: toStringStub,
         });
 
         // eslint-disable-next-line no-underscore-dangle
@@ -365,16 +387,16 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
       it('removes the state parameter when it has no keys', () => {
         const webex = makeWebex(undefined, undefined, {
           credentials: {
-            clientType: 'confidential'
-          }
+            clientType: 'confidential',
+          },
         });
         const location = {
           query: {
             code: 'code',
             state: {
-              csrf_token: 'token'
-            }
-          }
+              csrf_token: 'token',
+            },
+          },
         };
 
         sinon.spy(webex.authorization, '_cleanUrl');
@@ -386,17 +408,17 @@ browserOnly(describe)('plugin-authorization-browser-first-party', () => {
       it('keeps the parameter when it has keys', () => {
         const webex = makeWebex(undefined, undefined, {
           credentials: {
-            clientType: 'confidential'
-          }
+            clientType: 'confidential',
+          },
         });
         const location = {
           query: {
             code: 'code',
             state: {
               csrf_token: 'token',
-              key: 'value'
-            }
-          }
+              key: 'value',
+            },
+          },
         };
 
         sinon.spy(webex.authorization, '_cleanUrl');