@webex/webex-core 3.0.0-beta.4 → 3.0.0-beta.400

package/test/unit/spec/credentials/credentials.js

@@ -11,6 +11,7 @@ import {inBrowser} from '@webex/common';
 import FakeTimers from '@sinonjs/fake-timers';
 import {skipInBrowser} from '@webex/test-helper-mocha';
 import Logger from '@webex/plugin-logger';
+import Metrics, {config} from '@webex/internal-plugin-metrics';
 
 /* eslint camelcase: [0] */
 
@@ -28,7 +29,8 @@ function promiseTick(count) {
   return promise;
 }
 
-const AUTHORIZATION_STRING = 'https://api.ciscospark.com/v1/authorize?client_id=MOCK_CLIENT_ID&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A8000&scope=spark%3Arooms_read%20spark%3Ateams_read&state=set_state_here';
+const AUTHORIZATION_STRING =
+  'https://api.ciscospark.com/v1/authorize?client_id=MOCK_CLIENT_ID&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A8000&scope=spark%3Arooms_read%20spark%3Ateams_read&state=set_state_here';
 
 describe('webex-core', () => {
   describe('Credentials', () => {
@@ -58,6 +60,34 @@ describe('webex-core', () => {
       });
     });
 
+    describe('#isUnverifiedGuest', () => {
+      let credentials;
+      let webex;
+      beforeEach('generate the webex instance', () => {
+        webex = new MockWebex();
+        credentials = new Credentials(undefined, {parent: webex});
+      });
+
+      it('should have #isUnverifiedGuest', () => {
+        assert.exists(credentials.isUnverifiedGuest);
+      });
+
+      it('should get the user status and return as a boolean', () => {
+        credentials.set('supertoken', 'AT');
+        assert.isFalse(credentials.isUnverifiedGuest);
+      });
+
+      it('should get guest user ', () => {
+        credentials.set('supertoken', 'eyJhbGciOiJSUzI1NiJ9.eyJ1c2VyX3R5cGUiOiJndWVzdCJ9');
+        assert.isTrue(credentials.isUnverifiedGuest);
+      });
+
+      it('should get login user ', () => {
+        credentials.set('supertoken', 'dGhpc2lzbm90YXJlYWx1c2VydG9rZW4=');
+        assert.isFalse(credentials.isUnverifiedGuest);
+      });
+    });
+
     describe('#canAuthorize', () => {
       it('indicates if the current state has enough information to populate an auth header, even if a token refresh or token downscope is required', () => {
         const webex = new MockWebex();
@@ -69,7 +99,7 @@ describe('webex-core', () => {
         assert.isFalse(credentials.canAuthorize);
 
         credentials.supertoken = makeToken(webex, {
-          access_token: 'AT'
+          access_token: 'AT',
         });
         assert.isTrue(credentials.canAuthorize);
 
@@ -77,13 +107,13 @@ describe('webex-core', () => {
         assert.isFalse(credentials.canAuthorize);
 
         credentials.supertoken = makeToken(webex, {
-          access_token: 'AT'
+          access_token: 'AT',
         });
         assert.isTrue(credentials.canAuthorize);
 
         credentials.supertoken = makeToken(webex, {
           access_token: 'AT',
-          expires: Date.now() - 10000
+          expires: Date.now() - 10000,
         });
         assert.isFalse(credentials.supertoken.canAuthorize);
         assert.isFalse(credentials.canRefresh);
@@ -95,7 +125,7 @@ describe('webex-core', () => {
         assert.isFalse(credentials.canAuthorize);
         credentials.supertoken = makeToken(webex, {
           access_token: 'AT',
-          refresh_token: 'RT'
+          refresh_token: 'RT',
         });
         credentials.supertoken.unset('access_token');
         assert.isTrue(credentials.canAuthorize);
@@ -109,9 +139,13 @@ describe('webex-core', () => {
 
         webex.trigger('change:config');
         assert.isFalse(credentials.canRefresh);
-        credentials.supertoken = makeToken(webex, {
-          access_token: 'AT'
-        }, {parent: true});
+        credentials.supertoken = makeToken(
+          webex,
+          {
+            access_token: 'AT',
+          },
+          {parent: true}
+        );
         assert.isFalse(credentials.canRefresh);
 
         webex.config.credentials.refreshCallback = inBrowser && noop;
@@ -120,7 +154,7 @@ describe('webex-core', () => {
         assert.isFalse(credentials.canRefresh);
         credentials.supertoken = makeToken(webex, {
           access_token: 'AT',
-          refresh_token: 'RT'
+          refresh_token: 'RT',
         });
         assert.isTrue(credentials.supertoken.canRefresh);
         assert.isTrue(credentials.canRefresh);
@@ -131,8 +165,8 @@ describe('webex-core', () => {
       it('requires `state` to be an object', () => {
         const webex = new MockWebex({
           children: {
-            credentials: Credentials
-          }
+            credentials: Credentials,
+          },
         });
 
         webex.trigger('change:config)');
@@ -161,7 +195,7 @@ describe('webex-core', () => {
 
         assert.match(credentials.buildLoginUrl({state: {}}), /idbroker/);
         webex.config.credentials = {
-          authorizationString: AUTHORIZATION_STRING
+          authorizationString: AUTHORIZATION_STRING,
         };
         credentials = new Credentials({}, {parent: webex});
         webex.trigger('change:config');
@@ -174,7 +208,12 @@ describe('webex-core', () => {
 
         webex.trigger('change:config');
 
-        assert.equal(credentials.buildLoginUrl({state: {page: 'front'}}), `${process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'}/idb/oauth2/v1/authorize?state=eyJwYWdlIjoiZnJvbnQifQ&client_id=fake&redirect_uri=http%3A%2F%2Fexample.com&scope=scope%3Aone&response_type=code`);
+        assert.equal(
+          credentials.buildLoginUrl({state: {page: 'front'}}),
+          `${
+            process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+          }/idb/oauth2/v1/authorize?state=eyJwYWdlIjoiZnJvbnQifQ&client_id=fake&redirect_uri=http%3A%2F%2Fexample.com&scope=scope%3Aone&response_type=code`
+        );
       });
 
       skipInBrowser(it)('generates the login url with empty state param', () => {
@@ -183,11 +222,15 @@ describe('webex-core', () => {
 
         webex.trigger('change:config');
 
-        assert.equal(credentials.buildLoginUrl({state: {}}), `${process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'}/idb/oauth2/v1/authorize?client_id=fake&redirect_uri=http%3A%2F%2Fexample.com&scope=scope%3Aone&response_type=code`);
+        assert.equal(
+          credentials.buildLoginUrl({state: {}}),
+          `${
+            process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+          }/idb/oauth2/v1/authorize?client_id=fake&redirect_uri=http%3A%2F%2Fexample.com&scope=scope%3Aone&response_type=code`
+        );
       });
     });
 
-
     describe('#buildLogoutUrl()', () => {
       skipInBrowser(it)('generates the logout url', () => {
         const webex = new MockWebex();
@@ -196,7 +239,12 @@ describe('webex-core', () => {
         const credentials = new Credentials(undefined, {parent: webex});
 
         webex.trigger('change:config');
-        assert.equal(credentials.buildLogoutUrl(), `${process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'}/idb/oauth2/v1/logout?cisService=webex&goto=ru`);
+        assert.equal(
+          credentials.buildLogoutUrl(),
+          `${
+            process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+          }/idb/oauth2/v1/logout?cisService=webex&goto=ru`
+        );
       });
 
       skipInBrowser(it)('includes a token param if passed', () => {
@@ -206,7 +254,12 @@ describe('webex-core', () => {
         const credentials = new Credentials(undefined, {parent: webex});
 
         webex.trigger('change:config');
-        assert.equal(credentials.buildLogoutUrl({token: 't'}), `${process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'}/idb/oauth2/v1/logout?cisService=webex&goto=ru&token=t`);
+        assert.equal(
+          credentials.buildLogoutUrl({token: 't'}),
+          `${
+            process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+          }/idb/oauth2/v1/logout?cisService=webex&goto=ru&token=t`
+        );
       });
 
       it('always fallsback to idbroker', () => {
@@ -224,7 +277,10 @@ describe('webex-core', () => {
         const credentials = new Credentials(undefined, {parent: webex});
 
         webex.trigger('change:config');
-        assert.match(credentials.buildLogoutUrl({goto: 'http://example.com/'}), /goto=http%3A%2F%2Fexample.com%2F/);
+        assert.match(
+          credentials.buildLogoutUrl({goto: 'http://example.com/'}),
+          /goto=http%3A%2F%2Fexample.com%2F/
+        );
       });
     });
 
@@ -240,7 +296,8 @@ describe('webex-core', () => {
 
       it('should return the OrgId of JWT-authenticated user', () => {
         credentials.supertoken = {
-          access_token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJyZWFsbSI6Im15LXJlYWxtIn0.U16gzUsaRW1VVikJA2VeXRHPX716tG1_B42oxzy1UMk'
+          access_token:
+            'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJyZWFsbSI6Im15LXJlYWxtIn0.U16gzUsaRW1VVikJA2VeXRHPX716tG1_B42oxzy1UMk',
         };
 
         orgId = 'my-realm';
@@ -252,17 +309,14 @@ describe('webex-core', () => {
         orgId = 'this-is-an-org-id';
 
         credentials.supertoken = {
-          access_token: `000_000_${orgId}`
+          access_token: `000_000_${orgId}`,
         };
 
         assert.equal(credentials.getOrgId(), orgId);
       });
 
       it('should throw if the OrgId was not determined', () =>
-        assert.throws(
-          () => credentials.getOrgId(),
-          'the provided token is not a valid format'
-        ));
+        assert.throws(() => credentials.getOrgId(), 'the provided token is not a valid format'));
     });
 
     describe('#extractOrgIdFromJWT()', () => {
@@ -275,7 +329,8 @@ describe('webex-core', () => {
       });
 
       it('should return the OrgId of a provided JWT', () => {
-        const jwt = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJyZWFsbSI6Im15LXJlYWxtIn0.U16gzUsaRW1VVikJA2VeXRHPX716tG1_B42oxzy1UMk';
+        const jwt =
+          'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJyZWFsbSI6Im15LXJlYWxtIn0.U16gzUsaRW1VVikJA2VeXRHPX716tG1_B42oxzy1UMk';
         const realm = 'my-realm';
 
         assert.equal(credentials.extractOrgIdFromJWT(jwt), realm);
@@ -285,7 +340,8 @@ describe('webex-core', () => {
         assert.throws(() => credentials.extractOrgIdFromJWT('not-valid')));
 
       it('should throw if the provided JWT does not contain an OrgId', () => {
-        const jwtNoOrg = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
+        const jwtNoOrg =
+          'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
 
         assert.throws(() => credentials.extractOrgIdFromJWT(jwtNoOrg));
       });
@@ -324,7 +380,7 @@ describe('webex-core', () => {
         webex.config.credentials = {
           client_id: 'ci',
           redirect_uri: 'ru',
-          scope: 's'
+          scope: 's',
         };
 
         let credentials = new Credentials(undefined, {parent: webex});
@@ -358,16 +414,26 @@ describe('webex-core', () => {
         'data.supertoken.access_token',
         'data.authorization',
         'data.authorization.supertoken',
-        'data.authorization.supertoken.access_token'
-      ].reduce((acc, path) => acc.concat(['ST', 'Bearer ST'].map((str) => {
-        const obj = {
-          msg: `accepts token string "${str}" at path "${path.split('.').slice(1).join('.')}"`
-        };
-
-        set(obj, path, str);
-
-        return obj;
-      })), [])
+        'data.authorization.supertoken.access_token',
+      ]
+        .reduce(
+          (acc, path) =>
+            acc.concat(
+              ['ST', 'Bearer ST'].map((str) => {
+                const obj = {
+                  msg: `accepts token string "${str}" at path "${path
+                    .split('.')
+                    .slice(1)
+                    .join('.')}"`,
+                };
+
+                set(obj, path, str);
+
+                return obj;
+              })
+            ),
+          []
+        )
         .forEach(({msg, data}) => {
           it(msg, () => {
             const webex = new MockWebex();
@@ -380,19 +446,24 @@ describe('webex-core', () => {
         });
 
       it('schedules a refreshTimer', () => {
-        const webex = new MockWebex();
+        const webex = new MockWebex({
+          children: {
+            metrics: Metrics,
+          },
+        });
         const supertoken = makeToken(webex, {
           access_token: 'ST',
           refresh_token: 'RT',
-          expires: Date.now() + 10000
+          expires: Date.now() + 10000,
         });
         const supertoken2 = makeToken(webex, {
           access_token: 'ST2',
           refresh_token: 'RT2',
-          expires: Date.now() + 20000
+          expires: Date.now() + 20000,
         });
 
         sinon.stub(supertoken, 'refresh').returns(Promise.resolve(supertoken2));
+        sinon.stub(webex.internal.metrics, 'submitClientMetrics').callsFake(() => {});
         const credentials = new Credentials(supertoken, {parent: webex});
 
         webex.trigger('change:config');
@@ -414,7 +485,7 @@ describe('webex-core', () => {
         const supertoken = makeToken(webex, {
           access_token: 'ST',
           refresh_token: 'RT',
-          expires: Date.now() - 10000
+          expires: Date.now() - 10000,
         });
 
         sinon.stub(supertoken, 'refresh').returns(Promise.reject());
@@ -427,7 +498,19 @@ describe('webex-core', () => {
     });
 
     describe('#getUserToken()', () => {
-      it('resolves with the supertoken if the supertoken matches the requested scopes');
+      it('resolves with the supertoken if the supertoken matches the requested scopes', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+        const st = makeToken(webex, {access_token: 'ST', scope: 'scope1'});
+
+        credentials.set({
+          supertoken: st,
+        });
+
+        return credentials.getUserToken('scope1').then((result) => assert.deepEqual(result, st));
+      });
 
       it('resolves with the token identified by the specified scopes', () => {
         const webex = new MockWebex();
@@ -437,28 +520,43 @@ describe('webex-core', () => {
         const st = makeToken(webex, {access_token: 'ST'});
         const t1 = makeToken(webex, {
           access_token: 'AT1',
-          scope: 'scope1'
+          scope: 'scope1',
         });
         const t2 = makeToken(webex, {
           access_token: 'AT2',
-          scope: 'scope2'
+          scope: 'scope2',
         });
 
         credentials.set({
           supertoken: st,
-          userTokens: [
-            t1, t2
-          ]
+          userTokens: [t1, t2],
         });
 
         return Promise.all([
-          credentials.getUserToken('scope1')
-            .then((result) => assert.deepEqual(result, t1)),
-          credentials.getUserToken('scope2')
-            .then((result) => assert.deepEqual(result, t2))
+          credentials.getUserToken('scope1').then((result) => assert.deepEqual(result, t1)),
+          credentials.getUserToken('scope2').then((result) => assert.deepEqual(result, t2)),
         ]);
       });
 
+      it('uses the supertoken.scope instead of the config.scope for downscope', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+        const st = makeToken(webex, {access_token: 'ST', scope: 'scope1 spark:kms'});
+
+        credentials.set({
+          supertoken: st,
+          scope: 'invalidScope scope1',
+        });
+
+        sinon.stub(credentials, 'downscope').returns(Promise.resolve());
+
+        return credentials.getUserToken().then(() => {
+          assert.calledWith(credentials.downscope, 'scope1');
+        });
+      });
+
       describe('when no matching token is found', () => {
         it('downscopes the supertoken', () => {
           const webex = new MockWebex();
@@ -467,42 +565,42 @@ describe('webex-core', () => {
           webex.trigger('change:config');
 
           credentials.supertoken = makeToken(webex, {
-            access_token: 'ST'
+            access_token: 'ST',
           });
 
           const t2 = makeToken(webex, {
-            access_token: 'AT2'
+            access_token: 'AT2',
           });
 
           sinon.stub(credentials.supertoken, 'downscope').returns(Promise.resolve(t2));
 
           const t1 = makeToken(webex, {
             access_token: 'AT1',
-            scope: 'scope1'
+            scope: 'scope1',
           });
 
           credentials.set({
-            userTokens: [t1]
+            userTokens: [t1],
           });
 
-          return credentials.getUserToken('scope2')
+          return credentials
+            .getUserToken('scope2')
             .then((result) => assert.deepEqual(result, t2))
             .then(() => assert.calledWith(credentials.supertoken.downscope, 'scope2'));
         });
       });
 
-
       describe('when no scope is specified', () => {
         it('resolves with a token containing all but the kms scopes', () => {
           const webex = new MockWebex();
 
-          webex.config.credentials.scope = 'scope1 spark:kms';
           const credentials = new Credentials(undefined, {parent: webex});
 
           webex.trigger('change:config');
 
           credentials.supertoken = makeToken(webex, {
-            access_token: 'ST'
+            access_token: 'ST',
+            scope: 'scope1 spark:kms',
           });
 
           // const t2 = makeToken(webex, {
@@ -513,15 +611,14 @@ describe('webex-core', () => {
 
           const t1 = makeToken(webex, {
             access_token: 'AT1',
-            scope: 'scope1'
+            scope: 'scope1',
           });
 
           credentials.set({
-            userTokens: [t1]
+            userTokens: [t1],
           });
 
-          return credentials.getUserToken()
-            .then((result) => assert.deepEqual(result, t1));
+          return credentials.getUserToken().then((result) => assert.deepEqual(result, t1));
         });
       });
 
@@ -529,37 +626,57 @@ describe('webex-core', () => {
         it('falls back to the supertoken', () => {
           const webex = new MockWebex({
             children: {
-              logger: Logger
-            }
+              logger: Logger,
+              metrics: Metrics,
+            },
           });
 
+          webex.config.metrics = config.metrics;
           webex.config.credentials.scope = 'scope1 spark:kms';
           const credentials = new Credentials(undefined, {parent: webex});
 
           webex.trigger('change:config');
 
           credentials.supertoken = makeToken(webex, {
-            access_token: 'ST'
+            access_token: 'ST',
           });
 
-          sinon.stub(credentials.supertoken, 'downscope').returns(Promise.reject(new Error('downscope failed')));
+          const failReason = 'downscope failed';
+          sinon.stub(credentials.supertoken, 'downscope').returns(Promise.reject(failReason));
+
+          sinon.stub(credentials.logger, 'warn').callsFake(() => {});
+          sinon.stub(webex.internal.metrics, 'submitClientMetrics').callsFake(() => {});
 
           const t1 = makeToken(webex, {
             access_token: 'AT1',
-            scope: 'scope1'
+            scope: 'scope1',
           });
 
           credentials.set({
-            userTokens: [t1]
+            userTokens: [t1],
           });
 
-          return credentials.getUserToken('scope2')
-            .then((t) => assert.equal(t.access_token, credentials.supertoken.access_token));
+          return credentials.getUserToken('scope2').then((t) => {
+            assert.equal(t.access_token, credentials.supertoken.access_token);
+            assert.calledWith(
+              credentials.logger.warn,
+              'credentials: failed to downscope supertoken to "scope2"'
+            );
+            assert.calledWith(
+              webex.internal.metrics.submitClientMetrics,
+              'JS_SDK_CREDENTIALS_DOWNSCOPE_FAILED',
+              {fields: {failReason, requestedScope: 'scope2'}}
+            );
+          });
         });
       });
 
       it('is blocked while a token refresh is inflight', () => {
-        const webex = new MockWebex();
+        const webex = new MockWebex({
+          children: {
+            metrics: Metrics,
+          },
+        });
 
         webex.config.credentials.scope = 'scope1 spark:kms';
         const credentials = new Credentials(undefined, {parent: webex});
@@ -568,14 +685,16 @@ describe('webex-core', () => {
 
         const supertoken1 = makeToken(webex, {
           access_token: 'ST1',
-          refresh_token: 'RT1'
+          refresh_token: 'RT1',
         });
 
         credentials.set({supertoken: supertoken1});
 
-        sinon.stub(supertoken1, 'downscope').returns(Promise.resolve(new Token({access_token: 'ST1ATD'})));
+        sinon
+          .stub(supertoken1, 'downscope')
+          .returns(Promise.resolve(new Token({access_token: 'ST1ATD'})));
         const supertoken2 = makeToken(webex, {
-          access_token: 'ST2'
+          access_token: 'ST2',
         });
 
         sinon.stub(supertoken1, 'refresh').returns(Promise.resolve(supertoken2));
@@ -583,11 +702,11 @@ describe('webex-core', () => {
         const at2 = makeToken(webex, {access_token: 'ST2ATD'});
 
         sinon.stub(supertoken2, 'downscope').returns(Promise.resolve(at2));
+        sinon.stub(webex.internal.metrics, 'submitClientMetrics').callsFake(() => {});
 
         return Promise.all([
           credentials.refresh(),
-          credentials.getUserToken('scope2')
-            .then((result) => assert.deepEqual(result, at2))
+          credentials.getUserToken('scope2').then((result) => assert.deepEqual(result, at2)),
         ]);
       });
     });
@@ -600,16 +719,16 @@ describe('webex-core', () => {
         webex.trigger('change:config');
         const st = makeToken(webex, {
           access_token: 'ST',
-          refresh_token: 'RT'
+          refresh_token: 'RT',
         });
 
         const st2 = makeToken(webex, {
           access_token: 'ST2',
-          refresh_token: 'RT2'
+          refresh_token: 'RT2',
         });
 
         credentials.set({
-          supertoken: st
+          supertoken: st,
         });
 
         sinon.stub(credentials, 'refresh').returns(Promise.resolve(st2));
@@ -618,12 +737,11 @@ describe('webex-core', () => {
         assert.isDefined(credentials.refreshTimer);
         assert.notCalled(credentials.refresh);
 
-        return credentials.invalidate()
-          .then(() => {
-            clock.tick(10000);
-            assert.isUndefined(credentials.refreshTimer);
-            assert.notCalled(credentials.refresh);
-          });
+        return credentials.invalidate().then(() => {
+          clock.tick(10000);
+          assert.isUndefined(credentials.refreshTimer);
+          assert.notCalled(credentials.refresh);
+        });
       });
 
       it('clears the tokens from boundedStorage', () => {
@@ -632,25 +750,22 @@ describe('webex-core', () => {
 
         webex.trigger('change:config');
         const st = makeToken(webex, {
-          access_token: 'ST'
+          access_token: 'ST',
         });
 
         const t1 = makeToken(webex, {
           access_token: 'AT1',
-          scope: 'scope1'
+          scope: 'scope1',
         });
 
         const t2 = makeToken(webex, {
           access_token: 'AT2',
-          scope: 'scope2'
+          scope: 'scope2',
         });
 
         credentials.set({
           supertoken: st,
-          userTokens: [
-            t1,
-            t2
-          ]
+          userTokens: [t1, t2],
         });
 
         return new Promise((resolve) => {
@@ -665,19 +780,24 @@ describe('webex-core', () => {
             return credentials.invalidate();
           })
           .then(() => promiseTick(500))
-          .then(() => new Promise((resolve) => {
-            setTimeout(resolve, 1);
-            clock.tick(1000);
-          }))
+          .then(
+            () =>
+              new Promise((resolve) => {
+                setTimeout(resolve, 1);
+                clock.tick(1000);
+              })
+          )
           .then(() => promiseTick(500))
-          .then(() => new Promise((resolve) => {
-            setTimeout(resolve, 1);
-            clock.tick(1000);
-          }))
+          .then(
+            () =>
+              new Promise((resolve) => {
+                setTimeout(resolve, 1);
+                clock.tick(1000);
+              })
+          )
           .then(() => assert.isRejected(webex.boundedStorage.get('Credentials', '@'), /NotFound/));
       });
 
-
       it('does not induce any token refreshes');
 
       it('prevents #getUserToken() from being invoked', () => {
@@ -687,67 +807,77 @@ describe('webex-core', () => {
         webex.trigger('change:config');
         const st = makeToken(webex, {
           access_token: 'ST',
-          refresh_token: 'RT'
+          refresh_token: 'RT',
         });
 
         const t1 = makeToken(webex, {
           access_token: 'AT1',
-          scope: 'scope1'
+          scope: 'scope1',
         });
 
         credentials.set({
           supertoken: st,
-          userTokens: [
-            t1
-          ]
+          userTokens: [t1],
         });
 
-        return credentials.invalidate()
-          .then(() => assert.isRejected(credentials.getUserToken(), /Current state cannot produce an access token/));
+        return credentials
+          .invalidate()
+          .then(() =>
+            assert.isRejected(
+              credentials.getUserToken(),
+              /Current state cannot produce an access token/
+            )
+          );
       });
     });
 
     describe('#refresh()', () => {
       it('refreshes and downscopes the supertoken, and revokes previous tokens', () => {
-        const webex = new MockWebex();
+        const webex = new MockWebex({
+          children: {
+            metrics: Metrics,
+          },
+        });
         const credentials = new Credentials(undefined, {parent: webex});
 
         webex.trigger('change:config');
         const st = makeToken(webex, {
           access_token: 'ST',
-          refresh_token: 'RT'
+          refresh_token: 'RT',
+          scope: 'scope1 scope2',
         });
 
         const st2 = makeToken(webex, {
           access_token: 'ST2',
-          refresh_token: 'RT2'
+          refresh_token: 'RT2',
+          scope: 'scope1 scope2',
         });
 
         const t1 = makeToken(webex, {
           access_token: 'AT1',
-          scope: 'scope1'
+          scope: 'scope1',
         });
 
         const t2 = makeToken(webex, {
           access_token: 'AT2',
-          scope: 'scope2'
+          scope: 'scope2',
         });
 
         sinon.stub(st2, 'downscope').returns(Promise.resolve(t2));
         sinon.stub(st, 'refresh').returns(Promise.resolve(st2));
         sinon.stub(t1, 'revoke').returns(Promise.resolve());
         sinon.spy(credentials, 'scheduleRefresh');
+        sinon.stub(webex.internal.metrics, 'submitClientMetrics').callsFake(() => {});
 
         credentials.set({
           supertoken: st,
-          userTokens: [
-            t1
-          ]
+          userTokens: [t1],
         });
 
         assert.equal(credentials.userTokens.get(t1.scope), t1);
 
-        return credentials.refresh()
+        return credentials
+          .refresh()
           .then(() => assert.called(st.refresh))
           .then(() => assert.calledWith(st2.downscope, 'scope1'))
           .then(() => assert.called(t1.revoke))
@@ -757,45 +887,50 @@ describe('webex-core', () => {
       });
 
       it('refreshes and downscopes the supertoken even if revocation of previous token fails', () => {
-        const webex = new MockWebex();
+        const webex = new MockWebex({
+          children: {
+            metrics: Metrics,
+          },
+        });
         const credentials = new Credentials(undefined, {parent: webex});
 
         webex.trigger('change:config');
         const st = makeToken(webex, {
           access_token: 'ST',
-          refresh_token: 'RT'
+          refresh_token: 'RT',
         });
 
         const st2 = makeToken(webex, {
           access_token: 'ST2',
-          refresh_token: 'RT2'
+          refresh_token: 'RT2',
+          scope: 'scope1 scope2',
         });
 
         const t1 = makeToken(webex, {
           access_token: 'AT1',
-          scope: 'scope1'
+          scope: 'scope1',
         });
 
         const t2 = makeToken(webex, {
           access_token: 'AT2',
-          scope: 'scope2'
+          scope: 'scope2',
         });
 
         sinon.stub(st2, 'downscope').returns(Promise.resolve(t2));
         sinon.stub(st, 'refresh').returns(Promise.resolve(st2));
         sinon.stub(t1, 'revoke').returns(Promise.reject());
         sinon.spy(credentials, 'scheduleRefresh');
+        sinon.stub(webex.internal.metrics, 'submitClientMetrics').callsFake(() => {});
 
         credentials.set({
           supertoken: st,
-          userTokens: [
-            t1
-          ]
+          userTokens: [t1],
         });
 
         assert.equal(credentials.userTokens.get(t1.scope), t1);
 
-        return credentials.refresh()
+        return credentials
+          .refresh()
           .then(() => assert.called(st.refresh))
           .then(() => assert.calledWith(st2.downscope, 'scope1'))
           .then(() => assert.called(t1.revoke))
@@ -807,74 +942,72 @@ describe('webex-core', () => {
       it('removes and revokes all child tokens', () => {
         const webex = new MockWebex({
           children: {
-            logger: Logger
-          }
+            logger: Logger,
+            metrics: Metrics,
+          },
         });
         const credentials = new Credentials(undefined, {parent: webex});
 
         webex.trigger('change:config');
         const st = makeToken(webex, {
           access_token: 'ST',
-          refresh_token: 'RT'
+          refresh_token: 'RT',
+          scope: '',
         });
 
         sinon.stub(st, 'refresh').returns(Promise.resolve(makeToken(webex, {access_token: 'ST2'})));
+        sinon.stub(webex.internal.metrics, 'submitClientMetrics').callsFake(() => {});
 
         const t1 = makeToken(webex, {
           access_token: 'AT1',
-          scope: 'scope1'
+          scope: 'scope1',
         });
 
         credentials.set({
           supertoken: st,
-          userTokens: [
-            t1
-          ]
+          userTokens: [t1],
         });
 
-        return credentials.refresh()
-          .then(() => assert.called(st.refresh));
+        return credentials.refresh().then(() => assert.called(st.refresh));
       });
 
       it('allows #getUserToken() to be revoked, but #getUserToken() promises will not resolve until the suport token has been refreshed', () => {
-        const webex = new MockWebex();
+        const webex = new MockWebex({children: {metrics: Metrics}});
         const credentials = new Credentials(undefined, {parent: webex});
 
         webex.trigger('change:config');
         const st1 = makeToken(webex, {
           access_token: 'ST1',
-          refresh_token: 'RT1'
+          refresh_token: 'RT1',
         });
 
         const st2 = makeToken(webex, {
           access_token: 'ST2',
-          refresh_token: 'RT1'
+          refresh_token: 'RT1',
         });
 
         const t1 = makeToken(webex, {
           access_token: 'AT1',
-          scope: 'scope1'
+          scope: 'scope1',
         });
 
         const t2 = makeToken(webex, {
           access_token: 'AT2',
-          scope: 'scope1'
+          scope: 'scope1',
         });
 
         sinon.stub(st1, 'refresh').returns(Promise.resolve(st2));
         sinon.stub(st2, 'downscope').returns(Promise.resolve(t2));
+        sinon.stub(webex.internal.metrics, 'submitClientMetrics').callsFake(() => {});
 
         credentials.set({
           supertoken: st1,
-          userTokens: [
-            t1
-          ]
+          userTokens: [t1],
         });
 
         credentials.refresh();
 
-        return credentials.getUserToken('scope1')
-          .then((result) => assert.deepEqual(result, t2));
+        return credentials.getUserToken('scope1').then((result) => assert.deepEqual(result, t2));
       });
 
       it('emits InvalidRequestError when the refresh token and access token expire', () => {
@@ -884,42 +1017,99 @@ describe('webex-core', () => {
         webex.trigger('change:config');
         const st = makeToken(webex, {
           access_token: 'ST',
-          refresh_token: 'RT'
+          refresh_token: 'RT',
         });
 
         const t1 = makeToken(webex, {
           access_token: 'AT1',
-          scope: 'scope1'
+          scope: 'scope1',
         });
 
         const res = {
           body: {
             error: 'invalid_request',
-            error_description: 'The refresh token provided is expired, revoked, malformed, or invalid.',
-            trackingID: 'test123'
-          }
+            error_description:
+              'The refresh token provided is expired, revoked, malformed, or invalid.',
+            trackingID: 'test123',
+          },
         };
 
         const ErrorConstructor = grantErrors.select(res.body.error);
 
-        sinon.stub(st, 'refresh').returns(Promise.reject(new ErrorConstructor('InvalidRequestError')));
+        sinon
+          .stub(st, 'refresh')
+          .returns(Promise.reject(new ErrorConstructor('InvalidRequestError')));
         sinon.stub(credentials, 'unset').returns(Promise.resolve());
         const triggerSpy = sinon.spy(webex, 'trigger');
 
         credentials.set({
           supertoken: st,
-          userTokens: [
-            t1
-          ]
+          userTokens: [t1],
         });
 
-        return credentials.refresh()
+        return credentials
+          .refresh()
           .then(() => assert.called(st.refresh))
           .catch(() => {
             assert.called(credentials.unset);
             assert.calledWith(triggerSpy, sinon.match('client:InvalidRequestError'));
           });
       });
+
+      it('exclude invalid scopes from user token, log and call metrics when fetched supertoken scope mismatch with the configured scope', () => {
+        const webex = new MockWebex({
+          children: {
+            logger: Logger,
+            metrics: Metrics,
+          },
+        });
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+        const st = makeToken(webex, {
+          access_token: 'ST',
+          refresh_token: 'RT',
+        });
+
+        const st2 = makeToken(webex, {
+          access_token: 'ST2',
+          refresh_token: 'RT2',
+          scope: 'scope1',
+        });
+
+        const userToken = makeToken(webex, {
+          access_token: 'AT1',
+          scope: 'scope1 invalidScope1',
+        });
+
+        credentials.set({
+          supertoken: st,
+          userTokens: [userToken],
+        });
+        const invalidScopes = 'invalidScope1 invalidScope2';
+        credentials.config.scope = `scope1 ${invalidScopes}`;
+
+        sinon.stub(st2, 'downscope').returns(Promise.resolve());
+        sinon.stub(st, 'refresh').returns(Promise.resolve(st2));
+        sinon.spy(credentials, 'downscope');
+        sinon.spy(credentials, 'scheduleRefresh');
+
+        sinon.stub(credentials.logger, 'warn').callsFake(() => {});
+        sinon.stub(webex.internal.metrics, 'submitClientMetrics').callsFake(() => {});
+
+        return credentials.refresh().then(() => {
+          assert.calledWith(
+            credentials.logger.warn,
+            `credentials: "${invalidScopes}" scope(s) are invalid because not listed in the supertoken, they will be excluded from user token requests.`
+          );
+          assert.calledWith(
+            webex.internal.metrics.submitClientMetrics,
+            'JS_SDK_CREDENTIALS_TOKEN_REFRESH_SCOPE_MISMATCH',
+            {fields: {invalidScopes}}
+          );
+          assert.calledWith(credentials.downscope, 'scope1');
+        });
+      });
     });
 
     describe('#scheduleRefresh()', () => {
@@ -930,16 +1120,16 @@ describe('webex-core', () => {
         webex.trigger('change:config');
         const st = makeToken(webex, {
           access_token: 'ST',
-          refresh_token: 'RT'
+          refresh_token: 'RT',
         });
 
         const st2 = makeToken(webex, {
           access_token: 'ST2',
-          refresh_token: 'RT2'
+          refresh_token: 'RT2',
         });
 
         credentials.set({
-          supertoken: st
+          supertoken: st,
         });
 
         sinon.stub(credentials, 'refresh').returns(Promise.resolve(st2));
@@ -956,16 +1146,16 @@ describe('webex-core', () => {
         webex.trigger('change:config');
         const st = makeToken(webex, {
           access_token: 'ST',
-          refresh_token: 'RT'
+          refresh_token: 'RT',
         });
 
         const st2 = makeToken(webex, {
           access_token: 'ST2',
-          refresh_token: 'RT2'
+          refresh_token: 'RT2',
         });
 
         credentials.set({
-          supertoken: st
+          supertoken: st,
         });
 
         sinon.stub(credentials, 'refresh').returns(Promise.resolve(st2));