@webex/webex-core 3.0.0-beta.4 → 3.0.0-beta.400

package/dist/lib/credentials/token.js

@@ -1,55 +1,38 @@
 "use strict";
 
 var _typeof = require("@babel/runtime-corejs2/helpers/typeof");
-
-var _WeakMap = require("@babel/runtime-corejs2/core-js/weak-map");
-
-var _Object$defineProperty = require("@babel/runtime-corejs2/core-js/object/define-property");
-
+var _Object$keys = require("@babel/runtime-corejs2/core-js/object/keys");
+var _Object$getOwnPropertySymbols = require("@babel/runtime-corejs2/core-js/object/get-own-property-symbols");
 var _Object$getOwnPropertyDescriptor2 = require("@babel/runtime-corejs2/core-js/object/get-own-property-descriptor");
-
+var _Object$getOwnPropertyDescriptors = require("@babel/runtime-corejs2/core-js/object/get-own-property-descriptors");
+var _Object$defineProperties = require("@babel/runtime-corejs2/core-js/object/define-properties");
+var _Object$defineProperty = require("@babel/runtime-corejs2/core-js/object/define-property");
+var _WeakMap = require("@babel/runtime-corejs2/core-js/weak-map");
 var _interopRequireDefault = require("@babel/runtime-corejs2/helpers/interopRequireDefault");
-
 _Object$defineProperty(exports, "__esModule", {
   value: true
 });
-
 exports.default = void 0;
-
+var _defineProperty2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/defineProperty"));
 var _slicedToArray2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/slicedToArray"));
-
 var _applyDecoratedDescriptor2 = _interopRequireDefault(require("@babel/runtime-corejs2/helpers/applyDecoratedDescriptor"));
-
 var _promise = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/promise"));
-
 var _assign = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/object/assign"));
-
 var _apply = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/reflect/apply"));
-
 var _now = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/date/now"));
-
 var _getOwnPropertyDescriptor = _interopRequireDefault(require("@babel/runtime-corejs2/core-js/object/get-own-property-descriptor"));
-
 var _pick2 = _interopRequireDefault(require("lodash/pick"));
-
 var _common = require("@webex/common");
-
 var _commonTimers = require("@webex/common-timers");
-
 var _webexHttpError = _interopRequireDefault(require("../webex-http-error"));
-
 var _webexPlugin = _interopRequireDefault(require("../webex-plugin"));
-
 var _scope = require("./scope");
-
 var _grantErrors = _interopRequireWildcard(require("./grant-errors"));
-
 var _dec, _obj;
-
 function _getRequireWildcardCache(nodeInterop) { if (typeof _WeakMap !== "function") return null; var cacheBabelInterop = new _WeakMap(); var cacheNodeInterop = new _WeakMap(); return (_getRequireWildcardCache = function _getRequireWildcardCache(nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
-
 function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || _typeof(obj) !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = _Object$defineProperty && _Object$getOwnPropertyDescriptor2; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? _Object$getOwnPropertyDescriptor2(obj, key) : null; if (desc && (desc.get || desc.set)) { _Object$defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
-
+function ownKeys(object, enumerableOnly) { var keys = _Object$keys(object); if (_Object$getOwnPropertySymbols) { var symbols = _Object$getOwnPropertySymbols(object); enumerableOnly && (symbols = symbols.filter(function (sym) { return _Object$getOwnPropertyDescriptor2(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
+function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? ownKeys(Object(source), !0).forEach(function (key) { (0, _defineProperty2.default)(target, key, source[key]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(target, _Object$getOwnPropertyDescriptors(source)) : ownKeys(Object(source)).forEach(function (key) { _Object$defineProperty(target, key, _Object$getOwnPropertyDescriptor2(source, key)); }); } return target; }
 /* eslint-disable camelcase */
 
 /**
@@ -62,24 +45,19 @@ function processGrantError(res) {
   if (res.statusCode !== 400) {
     return _promise.default.reject(res);
   }
-
   var ErrorConstructor = _grantErrors.default.select(res.body.error);
-
   if (ErrorConstructor === _grantErrors.OAuthError && res instanceof _webexHttpError.default) {
     return _promise.default.reject(res);
   }
-
   if (!ErrorConstructor) {
     return _promise.default.reject(res);
   }
-
   return _promise.default.reject(new ErrorConstructor(res._res || res));
 }
+
 /**
  * @class
  */
-
-
 var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
   keyFactory: function keyFactory(scope) {
     return scope;
@@ -101,7 +79,6 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
         return !!this.access_token && !this.isExpired;
       }
     },
-
     /**
      * Indicates that this token can be downscoped. `true` iff
      * {@link config.credentials.client_id} is defined and if
@@ -122,7 +99,6 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
         return this.canAuthorize && !!this.config.client_id;
       }
     },
-
     /**
      * Indicates if this token can be refreshed. `true` iff
      * {@link Token@refresh_token} is defined and
@@ -143,11 +119,9 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
         if (_common.inBrowser) {
           return !!this.refresh_token && !!this.config.refreshCallback;
         }
-
         return !!this.refresh_token && !!this.config.client_secret;
       }
     },
-
     /**
      * Indicates if this `Token` is expired. `true` iff {@link Token#expires} is
      * defined and is less than {@link Date.now()}.
@@ -164,7 +138,6 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
         return !!this.expires && this._isExpired;
       }
     },
-
     /**
      * Cache for toString()
      * @instance
@@ -179,7 +152,6 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
         if (!this.access_token || !this.token_type) {
           return '';
         }
-
         return "".concat(this.token_type, " ").concat(this.access_token);
       }
     }
@@ -194,49 +166,42 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
      * @type {string}
      */
     scope: 'string',
-
     /**
      * @instance
      * @memberof Token
      * @type {string}
      */
     access_token: 'string',
-
     /**
      * @instance
      * @memberof Token
      * @type {number}
      */
     expires: 'number',
-
     /**
      * @instance
      * @memberof Token
      * @type {number}
      */
     expires_in: 'number',
-
     /**
      * @instance
      * @memberof Token
      * @type {string}
      */
     refresh_token: 'string',
-
     /**
      * @instance
      * @memberof Token
      * @type {number}
      */
     refresh_token_expires: 'number',
-
     /**
      * @instance
      * @memberof Token
      * @type {number}
      */
     refresh_token_expires_in: 'number',
-
     /**
      * @default "Bearer"
      * @instance
@@ -260,7 +225,6 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       default: false,
       type: 'boolean'
     },
-
     /**
      * Handle to the previous token that we'll revoke when we refresh this
      * token. The idea is to keep allow two valid tokens when a refresh occurs;
@@ -276,7 +240,6 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       type: 'state'
     }
   },
-
   /**
    * Uses this token to request a new Token with a subset of this Token's scopes
    * @instance
@@ -286,37 +249,35 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
    */
   downscope: function downscope(scope) {
     var _this = this;
-
     this.logger.info("token: downscoping token to ".concat(scope));
-
     if (this.isExpired) {
       this.logger.info('token: request received to downscope expired access_token');
       return _promise.default.reject(new Error('cannot downscope expired access token'));
     }
-
     if (!this.canDownscope) {
       if (this.config.client_id) {
         this.logger.info('token: request received to downscope invalid access_token');
       } else {
         this.logger.trace('token: cannot downscope without client_id');
       }
-
       return _promise.default.reject(new Error('cannot downscope access token'));
-    } // Since we're going to use scope as the index in our token collection, it's
-    // important scopes are always deterministically specified.
-
+    }
+    if ((0, _scope.diffScopes)(scope, this.config.scope) !== '') {
+      return _promise.default.reject(new Error("new scope (".concat(scope, ") is not subset of the available scopes (").concat(this.config.scope, ")")));
+    }
 
+    // Since we're going to use scope as the index in our token collection, it's
+    // important scopes are always deterministically specified.
     if (scope) {
       scope = (0, _scope.sortScope)(scope);
-    } // Ideally, we could depend on the service to communicate this error, but
+    }
+
+    // Ideally, we could depend on the service to communicate this error, but
     // all we get is "invalid scope", which, to the lay person, implies
     // something wrong with *one* of the scopes, not the whole thing.
-
-
     if (scope === (0, _scope.sortScope)(this.config.scope)) {
       return _promise.default.reject(new Error('token: scope reduction requires a reduced scope'));
     }
-
     return this.webex.request({
       method: 'POST',
       uri: this.config.tokenUrl,
@@ -330,7 +291,6 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       }
     }).then(function (res) {
       _this.logger.info("token: downscoped token to ".concat(scope));
-
       return new Token((0, _assign.default)(res.body, {
         scope: scope
       }), {
@@ -338,7 +298,6 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       });
     });
   },
-
   /**
    * Initializer
    * @instance
@@ -350,21 +309,18 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
    */
   initialize: function initialize() {
     var _this2 = this;
-
     var attrs = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
     var options = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
     (0, _apply.default)(_webexPlugin.default.prototype.initialize, this, [attrs, options]);
-
     if (typeof attrs === 'string') {
       this.access_token = attrs;
     }
-
     if (!this.access_token) {
       throw new Error('`access_token` is required');
-    } // We don't want the derived property `isExpired` to need {cache:false}, so
-    // we'll set up a timer the runs when this token should expire.
-
+    }
 
+    // We don't want the derived property `isExpired` to need {cache:false}, so
+    // we'll set up a timer the runs when this token should expire.
     if (this.expires) {
       if (this.expires < (0, _now.default)()) {
         this._isExpired = true;
@@ -375,7 +331,6 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       }
     }
   },
-
   /**
    * Refreshes this Token. Relies on
    * {@link config.credentials.refreshCallback()}
@@ -385,21 +340,16 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
    */
   refresh: function refresh() {
     var _this3 = this;
-
     if (!this.canRefresh) {
       throw new Error('Not enough information available to refresh this access token');
     }
-
     var promise;
-
     if (_common.inBrowser) {
       if (!this.config.refreshCallback) {
         throw new Error('Cannot refresh access token without refreshCallback');
       }
-
       promise = _promise.default.resolve(this.config.refreshCallback(this.webex, this));
     }
-
     return (promise || this.webex.request({
       method: 'POST',
       uri: this.config.tokenUrl,
@@ -419,36 +369,29 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
     })).then(function (obj) {
       if (!obj) {
         throw new Error('token: refreshCallback() did not produce an object');
-      } // If the authentication server did not send back a refresh token, copy
+      }
+      // If the authentication server did not send back a refresh token, copy
       // the current refresh token and related values to the response (note:
       // at time of implementation, CI never sends a new refresh token)
-
-
       if (!obj.refresh_token) {
         (0, _assign.default)(obj, (0, _pick2.default)(_this3, 'refresh_token', 'refresh_token_expires', 'refresh_token_expires_in'));
-      } // If the new token is the same as the previous token, then we may have
-      // found a bug in CI; log the details and reject the Promise
-
+      }
 
+      // If the new token is the same as the previous token, then we may have
+      // found a bug in CI; log the details and reject the Promise
       if (_this3.access_token === obj.access_token) {
-        _this3.logger.error('token: new token matches current token'); // log the tokens if it is not production
-
-
+        _this3.logger.error('token: new token matches current token');
+        // log the tokens if it is not production
         if (process.env.NODE_ENV !== 'production') {
           _this3.logger.error('token: current token:', _this3.access_token);
-
           _this3.logger.error('token: new token:', obj.access_token);
         }
-
         return _promise.default.reject(new Error('new token matches current token'));
       }
-
       if (_this3.previousToken) {
         _this3.previousToken.revoke();
-
         _this3.unset('previousToken');
       }
-
       obj.previousToken = _this3;
       obj.scope = _this3.scope;
       return new Token(obj, {
@@ -456,7 +399,6 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       });
     }).catch(processGrantError);
   },
-
   /**
    * Revokes this token and unsets its local properties
    * @instance
@@ -465,28 +407,25 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
    */
   revoke: function revoke() {
     var _this4 = this;
-
     if (this.isExpired) {
       this.logger.info('token: already expired, not making making revocation request');
       return _promise.default.resolve();
     }
-
     if (!this.canAuthorize) {
       this.logger.info('token: no longer valid, not making revocation request');
       return _promise.default.resolve();
-    } // FIXME we need to use the user token revocation endpoint to revoke a token
+    }
+
+    // FIXME we need to use the user token revocation endpoint to revoke a token
     // without a client_secret, but it doesn't current support using a token to
     // revoke itself
     // Note: I'm not making a canRevoke property because there should be changes
     // coming to the user token revocation endpoint that allow us to do this
     // correctly.
-
-
     if (!this.config.client_secret) {
       this.logger.info('token: no client secret available, not making revocation request');
       return _promise.default.resolve();
     }
-
     this.logger.info('token: revoking access token');
     return this.webex.request({
       method: 'POST',
@@ -503,46 +442,37 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       shouldRefreshAccessToken: false
     }).then(function () {
       _this4.unset(['access_token', 'expires', 'expires_in', 'token_type']);
-
       _this4.logger.info('token: access token revoked');
     }).catch(processGrantError);
   },
   set: function set() {
     // eslint-disable-next-line prefer-const
     var _this$_filterSetParam = this._filterSetParameters.apply(this, arguments),
-        _this$_filterSetParam2 = (0, _slicedToArray2.default)(_this$_filterSetParam, 2),
-        attrs = _this$_filterSetParam2[0],
-        options = _this$_filterSetParam2[1];
-
+      _this$_filterSetParam2 = (0, _slicedToArray2.default)(_this$_filterSetParam, 2),
+      attrs = _this$_filterSetParam2[0],
+      options = _this$_filterSetParam2[1];
     if (!attrs.token_type && attrs.access_token && attrs.access_token.includes(' ')) {
       var _attrs$access_token$s = attrs.access_token.split(' '),
-          _attrs$access_token$s2 = (0, _slicedToArray2.default)(_attrs$access_token$s, 2),
-          token_type = _attrs$access_token$s2[0],
-          access_token = _attrs$access_token$s2[1];
-
-      attrs = (0, _assign.default)({}, attrs, {
+        _attrs$access_token$s2 = (0, _slicedToArray2.default)(_attrs$access_token$s, 2),
+        token_type = _attrs$access_token$s2[0],
+        access_token = _attrs$access_token$s2[1];
+      attrs = _objectSpread(_objectSpread({}, attrs), {}, {
         access_token: access_token,
         token_type: token_type
       });
     }
-
     var now = (0, _now.default)();
-
     if (!attrs.expires && attrs.expires_in) {
       attrs.expires = now + attrs.expires_in * 1000;
     }
-
     if (!attrs.refresh_token_expires && attrs.refresh_token_expires_in) {
       attrs.refresh_token_expires = now + attrs.refresh_token_expires_in * 1000;
     }
-
     if (attrs.scope) {
       attrs.scope = (0, _scope.sortScope)(attrs.scope);
     }
-
     return (0, _apply.default)(_webexPlugin.default.prototype.set, this, [attrs, options]);
   },
-
   /**
    * Renders the token object as an HTTP Header Value
    * @instance
@@ -554,10 +484,8 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
     if (!this._string) {
       throw new Error('cannot stringify Token');
     }
-
     return this._string;
   },
-
   /**
    * Uses a non-producation api to return information about this token. This
    * method is primarily for tests and will throw if NODE_ENV === production
@@ -568,11 +496,9 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
    */
   validate: function validate() {
     var _this5 = this;
-
     if (process.env.NODE_ENV === 'production') {
       throw new Error('Token#validate() must not be used in production');
     }
-
     return this.webex.request({
       method: 'POST',
       service: 'conversation',
@@ -584,12 +510,11 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       if ('statusCode' in reason) {
         return _promise.default.reject(reason);
       }
+      _this5.logger.info("REMINDER: If you're investigating a network error here, it's normal");
 
-      _this5.logger.info('REMINDER: If you\'re investigating a network error here, it\'s normal'); // If we got an error that isn't a WebexHttpError, assume the problem is
+      // If we got an error that isn't a WebexHttpError, assume the problem is
       // that we don't have the wdm plugin loaded and service/resource isn't
       // a valid means of identifying a request.
-
-
       var convApi = process.env.CONVERSATION_SERVICE || process.env.CONVERSATION_SERVICE_URL || 'https://conv-a.wbx2.com/conversation/api/v1';
       return _this5.webex.request({
         method: 'POST',
@@ -605,9 +530,8 @@ var Token = _webexPlugin.default.extend((_dec = (0, _common.oneFlight)({
       return res.body;
     });
   },
-  version: "3.0.0-beta.4"
+  version: "3.0.0-beta.400"
 }, ((0, _applyDecoratedDescriptor2.default)(_obj, "downscope", [_dec], (0, _getOwnPropertyDescriptor.default)(_obj, "downscope"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "refresh", [_common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "refresh"), _obj), (0, _applyDecoratedDescriptor2.default)(_obj, "revoke", [_common.oneFlight], (0, _getOwnPropertyDescriptor.default)(_obj, "revoke"), _obj)), _obj)));
-
 var _default = Token;
 exports.default = _default;
 //# sourceMappingURL=token.js.map

package/dist/lib/credentials/token.js.map

@@ -1 +1 @@
-{"version":3,"names":["processGrantError","res","statusCode","reject","ErrorConstructor","grantErrors","select","body","error","OAuthError","WebexHttpError","_res","Token","WebexPlugin","extend","oneFlight","keyFactory","scope","derived","canAuthorize","deps","fn","access_token","isExpired","canDownscope","config","client_id","canRefresh","inBrowser","refresh_token","refreshCallback","client_secret","expires","_isExpired","_string","token_type","namespace","props","expires_in","refresh_token_expires","refresh_token_expires_in","default","type","session","previousToken","downscope","logger","info","Error","trace","sortScope","webex","request","method","uri","tokenUrl","addAuthHeader","form","grant_type","token","self_contained_token","then","parent","initialize","attrs","options","prototype","safeSetTimeout","refresh","promise","resolve","redirect_uri","auth","user","pass","sendImmediately","shouldRefreshAccessToken","obj","process","env","NODE_ENV","revoke","unset","catch","revokeUrl","token_type_hint","set","_filterSetParameters","includes","split","now","toString","validate","service","resource","reason","convApi","CONVERSATION_SERVICE","CONVERSATION_SERVICE_URL","headers","authorization"],"sources":["token.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport {pick} from 'lodash';\nimport {inBrowser, oneFlight} from '@webex/common';\nimport {safeSetTimeout} from '@webex/common-timers';\n\nimport WebexHttpError from '../webex-http-error';\nimport WebexPlugin from '../webex-plugin';\n\nimport {sortScope} from './scope';\nimport grantErrors, {OAuthError} from './grant-errors';\n\n/* eslint-disable camelcase */\n\n/**\n * Parse response from CI and converts to structured error when appropriate\n * @param {WebexHttpError} res\n * @private\n * @returns {GrantError}\n */\nfunction processGrantError(res) {\n  if (res.statusCode !== 400) {\n    return Promise.reject(res);\n  }\n\n  const ErrorConstructor = grantErrors.select(res.body.error);\n\n  if (ErrorConstructor === OAuthError && res instanceof WebexHttpError) {\n    return Promise.reject(res);\n  }\n  if (!ErrorConstructor) {\n    return Promise.reject(res);\n  }\n\n  return Promise.reject(new ErrorConstructor(res._res || res));\n}\n\n/**\n * @class\n */\nconst Token = WebexPlugin.extend({\n  derived: {\n    /**\n     * Indicates if this token can be used in an auth header. `true` iff\n     * {@link Token#access_token} is defined and {@link Token#isExpired} is\n     * false.\n     * @instance\n     * @memberof Token\n     * @readonly\n     * @type {boolean}\n     */\n    canAuthorize: {\n      deps: ['access_token', 'isExpired'],\n      fn() {\n        return !!this.access_token && !this.isExpired;\n      }\n    },\n\n    /**\n     * Indicates that this token can be downscoped. `true` iff\n     * {@link config.credentials.client_id} is defined and if\n     * {@link Token#canAuthorize} is true\n     *\n     * Note: since {@link config} is not evented, we can't listen for changes to\n     * {@link config.credentials.client_id}. As such,\n     * {@link config.credentials.client_id} must always be set before\n     * instantiating a {@link Token}\n     * @instance\n     * @memberof Token\n     * @readonly\n     * @type {boolean}\n     */\n    canDownscope: {\n      deps: ['canAuthorize'],\n      fn() {\n        return this.canAuthorize && !!this.config.client_id;\n      }\n    },\n\n    /**\n     * Indicates if this token can be refreshed. `true` iff\n     * {@link Token@refresh_token} is defined and\n     * {@link config.credentials.refreshCallback()} is defined\n     *\n     * Note: since {@link config} is not evented, we can't listen for changes to\n     * {@link config.credentials.refreshCallback()}. As such,\n     * {@link config.credentials.refreshCallback()} must always be set before\n     * instantiating a {@link Token}\n     * @instance\n     * @memberof Token\n     * @readonly\n     * @type {boolean}\n     */\n    canRefresh: {\n      deps: ['refresh_token'],\n      fn() {\n        if (inBrowser) {\n          return !!this.refresh_token && !!this.config.refreshCallback;\n        }\n\n        return !!this.refresh_token && !!this.config.client_secret;\n      }\n    },\n\n    /**\n     * Indicates if this `Token` is expired. `true` iff {@link Token#expires} is\n     * defined and is less than {@link Date.now()}.\n     * @instance\n     * @memberof Token\n     * @readonly\n     * @type {boolean}\n     */\n    isExpired: {\n      deps: ['expires', '_isExpired'],\n      fn() {\n        // in order to avoid setting `cache:false`, we'll use a private property\n        // and a timer rather than comparing to `Date.now()`;\n        return !!this.expires && this._isExpired;\n      }\n    },\n\n    /**\n     * Cache for toString()\n     * @instance\n     * @memberof Token\n     * @private\n     * @readonly\n     * @type {string}\n     */\n    _string: {\n      deps: ['access_token', 'token_type'],\n      fn() {\n        if (!this.access_token || !this.token_type) {\n          return '';\n        }\n\n        return `${this.token_type} ${this.access_token}`;\n      }\n    }\n  },\n\n  namespace: 'Credentials',\n\n  props: {\n    /**\n     * Used for indexing in the credentials userTokens collection\n     * @instance\n     * @memberof Token\n     * @private\n     * @type {string}\n     */\n    scope: 'string',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {string}\n     */\n    access_token: 'string',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {number}\n     */\n    expires: 'number',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {number}\n     */\n    expires_in: 'number',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {string}\n     */\n    refresh_token: 'string',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {number}\n     */\n    refresh_token_expires: 'number',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {number}\n     */\n    refresh_token_expires_in: 'number',\n    /**\n     * @default \"Bearer\"\n     * @instance\n     * @memberof Token\n     * @type {string}\n     */\n    token_type: {\n      default: 'Bearer',\n      type: 'string'\n    }\n  },\n\n  session: {\n    /**\n     * Used by {@link Token#isExpired} to avoid doing a Date comparison.\n     * @instance\n     * @memberof Token\n     * @private\n     * @type {boolean}\n     */\n    _isExpired: {\n      default: false,\n      type: 'boolean'\n    },\n    /**\n     * Handle to the previous token that we'll revoke when we refresh this\n     * token. The idea is to keep allow two valid tokens when a refresh occurs;\n     * we don't want revoke a token that's in the middle of being used, so when\n     * we do a token refresh, we won't revoke the token being refreshed, but\n     * we'll revoke the previous one.\n     * @instance\n     * @memberof Token\n     * @private\n     * @type {Object}\n     */\n    previousToken: {\n      type: 'state'\n    }\n  },\n\n  @oneFlight({\n    keyFactory(scope) {\n      return scope;\n    }\n  })\n  /**\n   * Uses this token to request a new Token with a subset of this Token's scopes\n   * @instance\n   * @memberof Token\n   * @param {string} scope\n   * @returns {Promise<Token>}\n   */\n  downscope(scope) {\n    this.logger.info(`token: downscoping token to ${scope}`);\n\n    if (this.isExpired) {\n      this.logger.info('token: request received to downscope expired access_token');\n\n      return Promise.reject(new Error('cannot downscope expired access token'));\n    }\n\n    if (!this.canDownscope) {\n      if (this.config.client_id) {\n        this.logger.info('token: request received to downscope invalid access_token');\n      }\n      else {\n        this.logger.trace('token: cannot downscope without client_id');\n      }\n\n      return Promise.reject(new Error('cannot downscope access token'));\n    }\n\n    // Since we're going to use scope as the index in our token collection, it's\n    // important scopes are always deterministically specified.\n    if (scope) {\n      scope = sortScope(scope);\n    }\n\n    // Ideally, we could depend on the service to communicate this error, but\n    // all we get is \"invalid scope\", which, to the lay person, implies\n    // something wrong with *one* of the scopes, not the whole thing.\n    if (scope === sortScope(this.config.scope)) {\n      return Promise.reject(new Error('token: scope reduction requires a reduced scope'));\n    }\n\n    return this.webex.request({\n      method: 'POST',\n      uri: this.config.tokenUrl,\n      addAuthHeader: false,\n      form: {\n        grant_type: 'urn:cisco:oauth:grant-type:scope-reduction',\n        token: this.access_token,\n        scope,\n        client_id: this.config.client_id,\n        self_contained_token: true\n      }\n    })\n      .then((res) => {\n        this.logger.info(`token: downscoped token to ${scope}`);\n\n        return new Token(Object.assign(res.body, {scope}), {parent: this.parent});\n      });\n  },\n\n  /**\n   * Initializer\n   * @instance\n   * @memberof Token\n   * @param {Object} [attrs={}]\n   * @param {Object} [options={}]\n   * @see {@link WebexPlugin#initialize()}\n   * @returns {Token}\n   */\n  initialize(attrs = {}, options = {}) {\n    Reflect.apply(WebexPlugin.prototype.initialize, this, [attrs, options]);\n\n    if (typeof attrs === 'string') {\n      this.access_token = attrs;\n    }\n\n    if (!this.access_token) {\n      throw new Error('`access_token` is required');\n    }\n\n    // We don't want the derived property `isExpired` to need {cache:false}, so\n    // we'll set up a timer the runs when this token should expire.\n    if (this.expires) {\n      if (this.expires < Date.now()) {\n        this._isExpired = true;\n      }\n      else {\n        safeSetTimeout(() => {\n          this._isExpired = true;\n        }, this.expires - Date.now());\n      }\n    }\n  },\n\n  @oneFlight\n  /**\n   * Refreshes this Token. Relies on\n   * {@link config.credentials.refreshCallback()}\n   * @instance\n   * @memberof Token\n   * @returns {Promise<Token>}\n   */\n  refresh() {\n    if (!this.canRefresh) {\n      throw new Error('Not enough information available to refresh this access token');\n    }\n\n    let promise;\n\n    if (inBrowser) {\n      if (!this.config.refreshCallback) {\n        throw new Error('Cannot refresh access token without refreshCallback');\n      }\n\n      promise = Promise.resolve(this.config.refreshCallback(this.webex, this));\n    }\n\n    return (promise || this.webex.request({\n      method: 'POST',\n      uri: this.config.tokenUrl,\n      form: {\n        grant_type: 'refresh_token',\n        redirect_uri: this.config.redirect_uri,\n        refresh_token: this.refresh_token\n      },\n      auth: {\n        user: this.config.client_id,\n        pass: this.config.client_secret,\n        sendImmediately: true\n      },\n      shouldRefreshAccessToken: false\n    })\n      .then((res) => res.body))\n      .then((obj) => {\n        if (!obj) {\n          throw new Error('token: refreshCallback() did not produce an object');\n        }\n        // If the authentication server did not send back a refresh token, copy\n        // the current refresh token and related values to the response (note:\n        // at time of implementation, CI never sends a new refresh token)\n        if (!obj.refresh_token) {\n          Object.assign(obj, pick(this, 'refresh_token', 'refresh_token_expires', 'refresh_token_expires_in'));\n        }\n\n        // If the new token is the same as the previous token, then we may have\n        // found a bug in CI; log the details and reject the Promise\n        if (this.access_token === obj.access_token) {\n          this.logger.error('token: new token matches current token');\n          // log the tokens if it is not production\n          if (process.env.NODE_ENV !== 'production') {\n            this.logger.error('token: current token:', this.access_token);\n            this.logger.error('token: new token:', obj.access_token);\n          }\n\n          return Promise.reject(new Error('new token matches current token'));\n        }\n\n        if (this.previousToken) {\n          this.previousToken.revoke();\n          this.unset('previousToken');\n        }\n\n        obj.previousToken = this;\n        obj.scope = this.scope;\n\n        return new Token(obj, {parent: this.parent});\n      })\n      .catch(processGrantError);\n  },\n\n  @oneFlight\n  /**\n   * Revokes this token and unsets its local properties\n   * @instance\n   * @memberof Token\n   * @returns {Promise}\n   */\n  revoke() {\n    if (this.isExpired) {\n      this.logger.info('token: already expired, not making making revocation request');\n\n      return Promise.resolve();\n    }\n\n    if (!this.canAuthorize) {\n      this.logger.info('token: no longer valid, not making revocation request');\n\n      return Promise.resolve();\n    }\n\n    // FIXME we need to use the user token revocation endpoint to revoke a token\n    // without a client_secret, but it doesn't current support using a token to\n    // revoke itself\n    // Note: I'm not making a canRevoke property because there should be changes\n    // coming to the user token revocation endpoint that allow us to do this\n    // correctly.\n    if (!this.config.client_secret) {\n      this.logger.info('token: no client secret available, not making revocation request');\n\n      return Promise.resolve();\n    }\n\n    this.logger.info('token: revoking access token');\n\n    return this.webex.request({\n      method: 'POST',\n      uri: this.config.revokeUrl,\n      form: {\n        token: this.access_token,\n        token_type_hint: 'access_token'\n      },\n      auth: {\n        user: this.config.client_id,\n        pass: this.config.client_secret,\n        sendImmediately: true\n      },\n      shouldRefreshAccessToken: false\n    })\n      .then(() => {\n        this.unset([\n          'access_token',\n          'expires',\n          'expires_in',\n          'token_type'\n        ]);\n        this.logger.info('token: access token revoked');\n      })\n      .catch(processGrantError);\n  },\n\n  set(...args) {\n    // eslint-disable-next-line prefer-const\n    let [attrs, options] = this._filterSetParameters(...args);\n\n    if (!attrs.token_type && attrs.access_token && attrs.access_token.includes(' ')) {\n      const [token_type, access_token] = attrs.access_token.split(' ');\n\n      attrs = Object.assign({}, attrs, {access_token, token_type});\n    }\n    const now = Date.now();\n\n    if (!attrs.expires && attrs.expires_in) {\n      attrs.expires = now + attrs.expires_in * 1000;\n    }\n\n    if (!attrs.refresh_token_expires && attrs.refresh_token_expires_in) {\n      attrs.refresh_token_expires = now + attrs.refresh_token_expires_in * 1000;\n    }\n\n    if (attrs.scope) {\n      attrs.scope = sortScope(attrs.scope);\n    }\n\n    return Reflect.apply(WebexPlugin.prototype.set, this, [attrs, options]);\n  },\n\n  /**\n   * Renders the token object as an HTTP Header Value\n   * @instance\n   * @memberof Token\n   * @returns {string}\n   * @see {@link Object#toString()}\n   */\n  toString() {\n    if (!this._string) {\n      throw new Error('cannot stringify Token');\n    }\n\n    return this._string;\n  },\n\n  /**\n   * Uses a non-producation api to return information about this token. This\n   * method is primarily for tests and will throw if NODE_ENV === production\n   * @instance\n   * @memberof Token\n   * @private\n   * @returns {Promise}\n   */\n  validate() {\n    if (process.env.NODE_ENV === 'production') {\n      throw new Error('Token#validate() must not be used in production');\n    }\n\n    return this.webex.request({\n      method: 'POST',\n      service: 'conversation',\n      resource: 'users/validateAuthToken',\n      body: {\n        token: this.access_token\n      }\n    })\n      .catch((reason) => {\n        if ('statusCode' in reason) {\n          return Promise.reject(reason);\n        }\n        this.logger.info('REMINDER: If you\\'re investigating a network error here, it\\'s normal');\n\n        // If we got an error that isn't a WebexHttpError, assume the problem is\n        // that we don't have the wdm plugin loaded and service/resource isn't\n        // a valid means of identifying a request.\n        const convApi = process.env.CONVERSATION_SERVICE || process.env.CONVERSATION_SERVICE_URL || 'https://conv-a.wbx2.com/conversation/api/v1';\n\n        return this.webex.request({\n          method: 'POST',\n          uri: `${convApi}/users/validateAuthToken`,\n          body: {\n            token: this.access_token\n          },\n          headers: {\n            authorization: `Bearer ${this.access_token}`\n          }\n        });\n      })\n      .then((res) => res.body);\n  }\n});\n\nexport default Token;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA;;AACA;;AAEA;;AACA;;AAEA;;AACA;;;;;;;;AAEA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,iBAAT,CAA2BC,GAA3B,EAAgC;EAC9B,IAAIA,GAAG,CAACC,UAAJ,KAAmB,GAAvB,EAA4B;IAC1B,OAAO,iBAAQC,MAAR,CAAeF,GAAf,CAAP;EACD;;EAED,IAAMG,gBAAgB,GAAGC,oBAAA,CAAYC,MAAZ,CAAmBL,GAAG,CAACM,IAAJ,CAASC,KAA5B,CAAzB;;EAEA,IAAIJ,gBAAgB,KAAKK,uBAArB,IAAmCR,GAAG,YAAYS,uBAAtD,EAAsE;IACpE,OAAO,iBAAQP,MAAR,CAAeF,GAAf,CAAP;EACD;;EACD,IAAI,CAACG,gBAAL,EAAuB;IACrB,OAAO,iBAAQD,MAAR,CAAeF,GAAf,CAAP;EACD;;EAED,OAAO,iBAAQE,MAAR,CAAe,IAAIC,gBAAJ,CAAqBH,GAAG,CAACU,IAAJ,IAAYV,GAAjC,CAAf,CAAP;AACD;AAED;AACA;AACA;;;AACA,IAAMW,KAAK,GAAGC,oBAAA,CAAYC,MAAZ,SA4LX,IAAAC,iBAAA,EAAU;EACTC,UADS,sBACEC,KADF,EACS;IAChB,OAAOA,KAAP;EACD;AAHQ,CAAV,CA5LW,UAAmB;EAC/BC,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,YAAY,EAAE;MACZC,IAAI,EAAE,CAAC,cAAD,EAAiB,WAAjB,CADM;MAEZC,EAFY,gBAEP;QACH,OAAO,CAAC,CAAC,KAAKC,YAAP,IAAuB,CAAC,KAAKC,SAApC;MACD;IAJW,CAVP;;IAiBP;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,YAAY,EAAE;MACZJ,IAAI,EAAE,CAAC,cAAD,CADM;MAEZC,EAFY,gBAEP;QACH,OAAO,KAAKF,YAAL,IAAqB,CAAC,CAAC,KAAKM,MAAL,CAAYC,SAA1C;MACD;IAJW,CA/BP;;IAsCP;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,UAAU,EAAE;MACVP,IAAI,EAAE,CAAC,eAAD,CADI;MAEVC,EAFU,gBAEL;QACH,IAAIO,iBAAJ,EAAe;UACb,OAAO,CAAC,CAAC,KAAKC,aAAP,IAAwB,CAAC,CAAC,KAAKJ,MAAL,CAAYK,eAA7C;QACD;;QAED,OAAO,CAAC,CAAC,KAAKD,aAAP,IAAwB,CAAC,CAAC,KAAKJ,MAAL,CAAYM,aAA7C;MACD;IARS,CApDL;;IA+DP;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;IACIR,SAAS,EAAE;MACTH,IAAI,EAAE,CAAC,SAAD,EAAY,YAAZ,CADG;MAETC,EAFS,gBAEJ;QACH;QACA;QACA,OAAO,CAAC,CAAC,KAAKW,OAAP,IAAkB,KAAKC,UAA9B;MACD;IANQ,CAvEJ;;IAgFP;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,OAAO,EAAE;MACPd,IAAI,EAAE,CAAC,cAAD,EAAiB,YAAjB,CADC;MAEPC,EAFO,gBAEF;QACH,IAAI,CAAC,KAAKC,YAAN,IAAsB,CAAC,KAAKa,UAAhC,EAA4C;UAC1C,OAAO,EAAP;QACD;;QAED,iBAAU,KAAKA,UAAf,cAA6B,KAAKb,YAAlC;MACD;IARM;EAxFF,CADsB;EAqG/Bc,SAAS,EAAE,aArGoB;EAuG/BC,KAAK,EAAE;IACL;AACJ;AACA;AACA;AACA;AACA;AACA;IACIpB,KAAK,EAAE,QARF;;IASL;AACJ;AACA;AACA;AACA;IACIK,YAAY,EAAE,QAdT;;IAeL;AACJ;AACA;AACA;AACA;IACIU,OAAO,EAAE,QApBJ;;IAqBL;AACJ;AACA;AACA;AACA;IACIM,UAAU,EAAE,QA1BP;;IA2BL;AACJ;AACA;AACA;AACA;IACIT,aAAa,EAAE,QAhCV;;IAiCL;AACJ;AACA;AACA;AACA;IACIU,qBAAqB,EAAE,QAtClB;;IAuCL;AACJ;AACA;AACA;AACA;IACIC,wBAAwB,EAAE,QA5CrB;;IA6CL;AACJ;AACA;AACA;AACA;AACA;IACIL,UAAU,EAAE;MACVM,OAAO,EAAE,QADC;MAEVC,IAAI,EAAE;IAFI;EAnDP,CAvGwB;EAgK/BC,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;AACA;IACIV,UAAU,EAAE;MACVQ,OAAO,EAAE,KADC;MAEVC,IAAI,EAAE;IAFI,CARL;;IAYP;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;IACIE,aAAa,EAAE;MACbF,IAAI,EAAE;IADO;EAvBR,CAhKsB;;EAiM/B;AACF;AACA;AACA;AACA;AACA;AACA;EACEG,SAxM+B,qBAwMrB5B,KAxMqB,EAwMd;IAAA;;IACf,KAAK6B,MAAL,CAAYC,IAAZ,uCAAgD9B,KAAhD;;IAEA,IAAI,KAAKM,SAAT,EAAoB;MAClB,KAAKuB,MAAL,CAAYC,IAAZ,CAAiB,2DAAjB;MAEA,OAAO,iBAAQ5C,MAAR,CAAe,IAAI6C,KAAJ,CAAU,uCAAV,CAAf,CAAP;IACD;;IAED,IAAI,CAAC,KAAKxB,YAAV,EAAwB;MACtB,IAAI,KAAKC,MAAL,CAAYC,SAAhB,EAA2B;QACzB,KAAKoB,MAAL,CAAYC,IAAZ,CAAiB,2DAAjB;MACD,CAFD,MAGK;QACH,KAAKD,MAAL,CAAYG,KAAZ,CAAkB,2CAAlB;MACD;;MAED,OAAO,iBAAQ9C,MAAR,CAAe,IAAI6C,KAAJ,CAAU,+BAAV,CAAf,CAAP;IACD,CAlBc,CAoBf;IACA;;;IACA,IAAI/B,KAAJ,EAAW;MACTA,KAAK,GAAG,IAAAiC,gBAAA,EAAUjC,KAAV,CAAR;IACD,CAxBc,CA0Bf;IACA;IACA;;;IACA,IAAIA,KAAK,KAAK,IAAAiC,gBAAA,EAAU,KAAKzB,MAAL,CAAYR,KAAtB,CAAd,EAA4C;MAC1C,OAAO,iBAAQd,MAAR,CAAe,IAAI6C,KAAJ,CAAU,iDAAV,CAAf,CAAP;IACD;;IAED,OAAO,KAAKG,KAAL,CAAWC,OAAX,CAAmB;MACxBC,MAAM,EAAE,MADgB;MAExBC,GAAG,EAAE,KAAK7B,MAAL,CAAY8B,QAFO;MAGxBC,aAAa,EAAE,KAHS;MAIxBC,IAAI,EAAE;QACJC,UAAU,EAAE,4CADR;QAEJC,KAAK,EAAE,KAAKrC,YAFR;QAGJL,KAAK,EAALA,KAHI;QAIJS,SAAS,EAAE,KAAKD,MAAL,CAAYC,SAJnB;QAKJkC,oBAAoB,EAAE;MALlB;IAJkB,CAAnB,EAYJC,IAZI,CAYC,UAAC5D,GAAD,EAAS;MACb,KAAI,CAAC6C,MAAL,CAAYC,IAAZ,sCAA+C9B,KAA/C;;MAEA,OAAO,IAAIL,KAAJ,CAAU,qBAAcX,GAAG,CAACM,IAAlB,EAAwB;QAACU,KAAK,EAALA;MAAD,CAAxB,CAAV,EAA4C;QAAC6C,MAAM,EAAE,KAAI,CAACA;MAAd,CAA5C,CAAP;IACD,CAhBI,CAAP;EAiBD,CA1P8B;;EA4P/B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,UArQ+B,wBAqQM;IAAA;;IAAA,IAA1BC,KAA0B,uEAAlB,EAAkB;IAAA,IAAdC,OAAc,uEAAJ,EAAI;IACnC,oBAAcpD,oBAAA,CAAYqD,SAAZ,CAAsBH,UAApC,EAAgD,IAAhD,EAAsD,CAACC,KAAD,EAAQC,OAAR,CAAtD;;IAEA,IAAI,OAAOD,KAAP,KAAiB,QAArB,EAA+B;MAC7B,KAAK1C,YAAL,GAAoB0C,KAApB;IACD;;IAED,IAAI,CAAC,KAAK1C,YAAV,EAAwB;MACtB,MAAM,IAAI0B,KAAJ,CAAU,4BAAV,CAAN;IACD,CATkC,CAWnC;IACA;;;IACA,IAAI,KAAKhB,OAAT,EAAkB;MAChB,IAAI,KAAKA,OAAL,GAAe,mBAAnB,EAA+B;QAC7B,KAAKC,UAAL,GAAkB,IAAlB;MACD,CAFD,MAGK;QACH,IAAAkC,4BAAA,EAAe,YAAM;UACnB,MAAI,CAAClC,UAAL,GAAkB,IAAlB;QACD,CAFD,EAEG,KAAKD,OAAL,GAAe,mBAFlB;MAGD;IACF;EACF,CA5R8B;;EA+R/B;AACF;AACA;AACA;AACA;AACA;AACA;EACEoC,OAtS+B,qBAsSrB;IAAA;;IACR,IAAI,CAAC,KAAKzC,UAAV,EAAsB;MACpB,MAAM,IAAIqB,KAAJ,CAAU,+DAAV,CAAN;IACD;;IAED,IAAIqB,OAAJ;;IAEA,IAAIzC,iBAAJ,EAAe;MACb,IAAI,CAAC,KAAKH,MAAL,CAAYK,eAAjB,EAAkC;QAChC,MAAM,IAAIkB,KAAJ,CAAU,qDAAV,CAAN;MACD;;MAEDqB,OAAO,GAAG,iBAAQC,OAAR,CAAgB,KAAK7C,MAAL,CAAYK,eAAZ,CAA4B,KAAKqB,KAAjC,EAAwC,IAAxC,CAAhB,CAAV;IACD;;IAED,OAAO,CAACkB,OAAO,IAAI,KAAKlB,KAAL,CAAWC,OAAX,CAAmB;MACpCC,MAAM,EAAE,MAD4B;MAEpCC,GAAG,EAAE,KAAK7B,MAAL,CAAY8B,QAFmB;MAGpCE,IAAI,EAAE;QACJC,UAAU,EAAE,eADR;QAEJa,YAAY,EAAE,KAAK9C,MAAL,CAAY8C,YAFtB;QAGJ1C,aAAa,EAAE,KAAKA;MAHhB,CAH8B;MAQpC2C,IAAI,EAAE;QACJC,IAAI,EAAE,KAAKhD,MAAL,CAAYC,SADd;QAEJgD,IAAI,EAAE,KAAKjD,MAAL,CAAYM,aAFd;QAGJ4C,eAAe,EAAE;MAHb,CAR8B;MAapCC,wBAAwB,EAAE;IAbU,CAAnB,EAehBf,IAfgB,CAeX,UAAC5D,GAAD;MAAA,OAASA,GAAG,CAACM,IAAb;IAAA,CAfW,CAAZ,EAgBJsD,IAhBI,CAgBC,UAACgB,GAAD,EAAS;MACb,IAAI,CAACA,GAAL,EAAU;QACR,MAAM,IAAI7B,KAAJ,CAAU,oDAAV,CAAN;MACD,CAHY,CAIb;MACA;MACA;;;MACA,IAAI,CAAC6B,GAAG,CAAChD,aAAT,EAAwB;QACtB,qBAAcgD,GAAd,EAAmB,oBAAK,MAAL,EAAW,eAAX,EAA4B,uBAA5B,EAAqD,0BAArD,CAAnB;MACD,CATY,CAWb;MACA;;;MACA,IAAI,MAAI,CAACvD,YAAL,KAAsBuD,GAAG,CAACvD,YAA9B,EAA4C;QAC1C,MAAI,CAACwB,MAAL,CAAYtC,KAAZ,CAAkB,wCAAlB,EAD0C,CAE1C;;;QACA,IAAIsE,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;UACzC,MAAI,CAAClC,MAAL,CAAYtC,KAAZ,CAAkB,uBAAlB,EAA2C,MAAI,CAACc,YAAhD;;UACA,MAAI,CAACwB,MAAL,CAAYtC,KAAZ,CAAkB,mBAAlB,EAAuCqE,GAAG,CAACvD,YAA3C;QACD;;QAED,OAAO,iBAAQnB,MAAR,CAAe,IAAI6C,KAAJ,CAAU,iCAAV,CAAf,CAAP;MACD;;MAED,IAAI,MAAI,CAACJ,aAAT,EAAwB;QACtB,MAAI,CAACA,aAAL,CAAmBqC,MAAnB;;QACA,MAAI,CAACC,KAAL,CAAW,eAAX;MACD;;MAEDL,GAAG,CAACjC,aAAJ,GAAoB,MAApB;MACAiC,GAAG,CAAC5D,KAAJ,GAAY,MAAI,CAACA,KAAjB;MAEA,OAAO,IAAIL,KAAJ,CAAUiE,GAAV,EAAe;QAACf,MAAM,EAAE,MAAI,CAACA;MAAd,CAAf,CAAP;IACD,CAjDI,EAkDJqB,KAlDI,CAkDEnF,iBAlDF,CAAP;EAmDD,CAxW8B;;EA2W/B;AACF;AACA;AACA;AACA;AACA;EACEiF,MAjX+B,oBAiXtB;IAAA;;IACP,IAAI,KAAK1D,SAAT,EAAoB;MAClB,KAAKuB,MAAL,CAAYC,IAAZ,CAAiB,8DAAjB;MAEA,OAAO,iBAAQuB,OAAR,EAAP;IACD;;IAED,IAAI,CAAC,KAAKnD,YAAV,EAAwB;MACtB,KAAK2B,MAAL,CAAYC,IAAZ,CAAiB,uDAAjB;MAEA,OAAO,iBAAQuB,OAAR,EAAP;IACD,CAXM,CAaP;IACA;IACA;IACA;IACA;IACA;;;IACA,IAAI,CAAC,KAAK7C,MAAL,CAAYM,aAAjB,EAAgC;MAC9B,KAAKe,MAAL,CAAYC,IAAZ,CAAiB,kEAAjB;MAEA,OAAO,iBAAQuB,OAAR,EAAP;IACD;;IAED,KAAKxB,MAAL,CAAYC,IAAZ,CAAiB,8BAAjB;IAEA,OAAO,KAAKI,KAAL,CAAWC,OAAX,CAAmB;MACxBC,MAAM,EAAE,MADgB;MAExBC,GAAG,EAAE,KAAK7B,MAAL,CAAY2D,SAFO;MAGxB3B,IAAI,EAAE;QACJE,KAAK,EAAE,KAAKrC,YADR;QAEJ+D,eAAe,EAAE;MAFb,CAHkB;MAOxBb,IAAI,EAAE;QACJC,IAAI,EAAE,KAAKhD,MAAL,CAAYC,SADd;QAEJgD,IAAI,EAAE,KAAKjD,MAAL,CAAYM,aAFd;QAGJ4C,eAAe,EAAE;MAHb,CAPkB;MAYxBC,wBAAwB,EAAE;IAZF,CAAnB,EAcJf,IAdI,CAcC,YAAM;MACV,MAAI,CAACqB,KAAL,CAAW,CACT,cADS,EAET,SAFS,EAGT,YAHS,EAIT,YAJS,CAAX;;MAMA,MAAI,CAACpC,MAAL,CAAYC,IAAZ,CAAiB,6BAAjB;IACD,CAtBI,EAuBJoC,KAvBI,CAuBEnF,iBAvBF,CAAP;EAwBD,CApa8B;EAsa/BsF,GAta+B,iBAsalB;IACX;IACA,4BAAuB,KAAKC,oBAAL,uBAAvB;IAAA;IAAA,IAAKvB,KAAL;IAAA,IAAYC,OAAZ;;IAEA,IAAI,CAACD,KAAK,CAAC7B,UAAP,IAAqB6B,KAAK,CAAC1C,YAA3B,IAA2C0C,KAAK,CAAC1C,YAAN,CAAmBkE,QAAnB,CAA4B,GAA5B,CAA/C,EAAiF;MAC/E,4BAAmCxB,KAAK,CAAC1C,YAAN,CAAmBmE,KAAnB,CAAyB,GAAzB,CAAnC;MAAA;MAAA,IAAOtD,UAAP;MAAA,IAAmBb,YAAnB;;MAEA0C,KAAK,GAAG,qBAAc,EAAd,EAAkBA,KAAlB,EAAyB;QAAC1C,YAAY,EAAZA,YAAD;QAAea,UAAU,EAAVA;MAAf,CAAzB,CAAR;IACD;;IACD,IAAMuD,GAAG,GAAG,mBAAZ;;IAEA,IAAI,CAAC1B,KAAK,CAAChC,OAAP,IAAkBgC,KAAK,CAAC1B,UAA5B,EAAwC;MACtC0B,KAAK,CAAChC,OAAN,GAAgB0D,GAAG,GAAG1B,KAAK,CAAC1B,UAAN,GAAmB,IAAzC;IACD;;IAED,IAAI,CAAC0B,KAAK,CAACzB,qBAAP,IAAgCyB,KAAK,CAACxB,wBAA1C,EAAoE;MAClEwB,KAAK,CAACzB,qBAAN,GAA8BmD,GAAG,GAAG1B,KAAK,CAACxB,wBAAN,GAAiC,IAArE;IACD;;IAED,IAAIwB,KAAK,CAAC/C,KAAV,EAAiB;MACf+C,KAAK,CAAC/C,KAAN,GAAc,IAAAiC,gBAAA,EAAUc,KAAK,CAAC/C,KAAhB,CAAd;IACD;;IAED,OAAO,oBAAcJ,oBAAA,CAAYqD,SAAZ,CAAsBoB,GAApC,EAAyC,IAAzC,EAA+C,CAACtB,KAAD,EAAQC,OAAR,CAA/C,CAAP;EACD,CA9b8B;;EAgc/B;AACF;AACA;AACA;AACA;AACA;AACA;EACE0B,QAvc+B,sBAucpB;IACT,IAAI,CAAC,KAAKzD,OAAV,EAAmB;MACjB,MAAM,IAAIc,KAAJ,CAAU,wBAAV,CAAN;IACD;;IAED,OAAO,KAAKd,OAAZ;EACD,CA7c8B;;EA+c/B;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE0D,QAvd+B,sBAudpB;IAAA;;IACT,IAAId,OAAO,CAACC,GAAR,CAAYC,QAAZ,KAAyB,YAA7B,EAA2C;MACzC,MAAM,IAAIhC,KAAJ,CAAU,iDAAV,CAAN;IACD;;IAED,OAAO,KAAKG,KAAL,CAAWC,OAAX,CAAmB;MACxBC,MAAM,EAAE,MADgB;MAExBwC,OAAO,EAAE,cAFe;MAGxBC,QAAQ,EAAE,yBAHc;MAIxBvF,IAAI,EAAE;QACJoD,KAAK,EAAE,KAAKrC;MADR;IAJkB,CAAnB,EAQJ6D,KARI,CAQE,UAACY,MAAD,EAAY;MACjB,IAAI,gBAAgBA,MAApB,EAA4B;QAC1B,OAAO,iBAAQ5F,MAAR,CAAe4F,MAAf,CAAP;MACD;;MACD,MAAI,CAACjD,MAAL,CAAYC,IAAZ,CAAiB,uEAAjB,EAJiB,CAMjB;MACA;MACA;;;MACA,IAAMiD,OAAO,GAAGlB,OAAO,CAACC,GAAR,CAAYkB,oBAAZ,IAAoCnB,OAAO,CAACC,GAAR,CAAYmB,wBAAhD,IAA4E,6CAA5F;MAEA,OAAO,MAAI,CAAC/C,KAAL,CAAWC,OAAX,CAAmB;QACxBC,MAAM,EAAE,MADgB;QAExBC,GAAG,YAAK0C,OAAL,6BAFqB;QAGxBzF,IAAI,EAAE;UACJoD,KAAK,EAAE,MAAI,CAACrC;QADR,CAHkB;QAMxB6E,OAAO,EAAE;UACPC,aAAa,mBAAY,MAAI,CAAC9E,YAAjB;QADN;MANe,CAAnB,CAAP;IAUD,CA7BI,EA8BJuC,IA9BI,CA8BC,UAAC5D,GAAD;MAAA,OAASA,GAAG,CAACM,IAAb;IAAA,CA9BD,CAAP;EA+BD,CA3f8B;EAAA;AAAA,CAAnB,kMA8RXQ,iBA9RW,4HA0WXA,iBA1WW,0EAAd;;eA8feH,K"}
+{"version":3,"names":["processGrantError","res","statusCode","reject","ErrorConstructor","grantErrors","select","body","error","OAuthError","WebexHttpError","_res","Token","WebexPlugin","extend","oneFlight","keyFactory","scope","derived","canAuthorize","deps","fn","access_token","isExpired","canDownscope","config","client_id","canRefresh","inBrowser","refresh_token","refreshCallback","client_secret","expires","_isExpired","_string","token_type","namespace","props","expires_in","refresh_token_expires","refresh_token_expires_in","default","type","session","previousToken","downscope","logger","info","Error","trace","diffScopes","sortScope","webex","request","method","uri","tokenUrl","addAuthHeader","form","grant_type","token","self_contained_token","then","parent","initialize","attrs","options","prototype","safeSetTimeout","refresh","promise","resolve","redirect_uri","auth","user","pass","sendImmediately","shouldRefreshAccessToken","obj","process","env","NODE_ENV","revoke","unset","catch","revokeUrl","token_type_hint","set","_filterSetParameters","includes","split","now","toString","validate","service","resource","reason","convApi","CONVERSATION_SERVICE","CONVERSATION_SERVICE_URL","headers","authorization"],"sources":["token.js"],"sourcesContent":["/*!\n * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.\n */\n\nimport {pick} from 'lodash';\nimport {inBrowser, oneFlight} from '@webex/common';\nimport {safeSetTimeout} from '@webex/common-timers';\n\nimport WebexHttpError from '../webex-http-error';\nimport WebexPlugin from '../webex-plugin';\n\nimport {sortScope, diffScopes} from './scope';\nimport grantErrors, {OAuthError} from './grant-errors';\n\n/* eslint-disable camelcase */\n\n/**\n * Parse response from CI and converts to structured error when appropriate\n * @param {WebexHttpError} res\n * @private\n * @returns {GrantError}\n */\nfunction processGrantError(res) {\n  if (res.statusCode !== 400) {\n    return Promise.reject(res);\n  }\n\n  const ErrorConstructor = grantErrors.select(res.body.error);\n\n  if (ErrorConstructor === OAuthError && res instanceof WebexHttpError) {\n    return Promise.reject(res);\n  }\n  if (!ErrorConstructor) {\n    return Promise.reject(res);\n  }\n\n  return Promise.reject(new ErrorConstructor(res._res || res));\n}\n\n/**\n * @class\n */\nconst Token = WebexPlugin.extend({\n  derived: {\n    /**\n     * Indicates if this token can be used in an auth header. `true` iff\n     * {@link Token#access_token} is defined and {@link Token#isExpired} is\n     * false.\n     * @instance\n     * @memberof Token\n     * @readonly\n     * @type {boolean}\n     */\n    canAuthorize: {\n      deps: ['access_token', 'isExpired'],\n      fn() {\n        return !!this.access_token && !this.isExpired;\n      },\n    },\n\n    /**\n     * Indicates that this token can be downscoped. `true` iff\n     * {@link config.credentials.client_id} is defined and if\n     * {@link Token#canAuthorize} is true\n     *\n     * Note: since {@link config} is not evented, we can't listen for changes to\n     * {@link config.credentials.client_id}. As such,\n     * {@link config.credentials.client_id} must always be set before\n     * instantiating a {@link Token}\n     * @instance\n     * @memberof Token\n     * @readonly\n     * @type {boolean}\n     */\n    canDownscope: {\n      deps: ['canAuthorize'],\n      fn() {\n        return this.canAuthorize && !!this.config.client_id;\n      },\n    },\n\n    /**\n     * Indicates if this token can be refreshed. `true` iff\n     * {@link Token@refresh_token} is defined and\n     * {@link config.credentials.refreshCallback()} is defined\n     *\n     * Note: since {@link config} is not evented, we can't listen for changes to\n     * {@link config.credentials.refreshCallback()}. As such,\n     * {@link config.credentials.refreshCallback()} must always be set before\n     * instantiating a {@link Token}\n     * @instance\n     * @memberof Token\n     * @readonly\n     * @type {boolean}\n     */\n    canRefresh: {\n      deps: ['refresh_token'],\n      fn() {\n        if (inBrowser) {\n          return !!this.refresh_token && !!this.config.refreshCallback;\n        }\n\n        return !!this.refresh_token && !!this.config.client_secret;\n      },\n    },\n\n    /**\n     * Indicates if this `Token` is expired. `true` iff {@link Token#expires} is\n     * defined and is less than {@link Date.now()}.\n     * @instance\n     * @memberof Token\n     * @readonly\n     * @type {boolean}\n     */\n    isExpired: {\n      deps: ['expires', '_isExpired'],\n      fn() {\n        // in order to avoid setting `cache:false`, we'll use a private property\n        // and a timer rather than comparing to `Date.now()`;\n        return !!this.expires && this._isExpired;\n      },\n    },\n\n    /**\n     * Cache for toString()\n     * @instance\n     * @memberof Token\n     * @private\n     * @readonly\n     * @type {string}\n     */\n    _string: {\n      deps: ['access_token', 'token_type'],\n      fn() {\n        if (!this.access_token || !this.token_type) {\n          return '';\n        }\n\n        return `${this.token_type} ${this.access_token}`;\n      },\n    },\n  },\n\n  namespace: 'Credentials',\n\n  props: {\n    /**\n     * Used for indexing in the credentials userTokens collection\n     * @instance\n     * @memberof Token\n     * @private\n     * @type {string}\n     */\n    scope: 'string',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {string}\n     */\n    access_token: 'string',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {number}\n     */\n    expires: 'number',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {number}\n     */\n    expires_in: 'number',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {string}\n     */\n    refresh_token: 'string',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {number}\n     */\n    refresh_token_expires: 'number',\n    /**\n     * @instance\n     * @memberof Token\n     * @type {number}\n     */\n    refresh_token_expires_in: 'number',\n    /**\n     * @default \"Bearer\"\n     * @instance\n     * @memberof Token\n     * @type {string}\n     */\n    token_type: {\n      default: 'Bearer',\n      type: 'string',\n    },\n  },\n\n  session: {\n    /**\n     * Used by {@link Token#isExpired} to avoid doing a Date comparison.\n     * @instance\n     * @memberof Token\n     * @private\n     * @type {boolean}\n     */\n    _isExpired: {\n      default: false,\n      type: 'boolean',\n    },\n    /**\n     * Handle to the previous token that we'll revoke when we refresh this\n     * token. The idea is to keep allow two valid tokens when a refresh occurs;\n     * we don't want revoke a token that's in the middle of being used, so when\n     * we do a token refresh, we won't revoke the token being refreshed, but\n     * we'll revoke the previous one.\n     * @instance\n     * @memberof Token\n     * @private\n     * @type {Object}\n     */\n    previousToken: {\n      type: 'state',\n    },\n  },\n\n  @oneFlight({\n    keyFactory(scope) {\n      return scope;\n    },\n  })\n  /**\n   * Uses this token to request a new Token with a subset of this Token's scopes\n   * @instance\n   * @memberof Token\n   * @param {string} scope\n   * @returns {Promise<Token>}\n   */\n  downscope(scope) {\n    this.logger.info(`token: downscoping token to ${scope}`);\n\n    if (this.isExpired) {\n      this.logger.info('token: request received to downscope expired access_token');\n\n      return Promise.reject(new Error('cannot downscope expired access token'));\n    }\n\n    if (!this.canDownscope) {\n      if (this.config.client_id) {\n        this.logger.info('token: request received to downscope invalid access_token');\n      } else {\n        this.logger.trace('token: cannot downscope without client_id');\n      }\n\n      return Promise.reject(new Error('cannot downscope access token'));\n    }\n\n    if (diffScopes(scope, this.config.scope) !== '') {\n      return Promise.reject(\n        new Error(\n          `new scope (${scope}) is not subset of the available scopes (${this.config.scope})`\n        )\n      );\n    }\n\n    // Since we're going to use scope as the index in our token collection, it's\n    // important scopes are always deterministically specified.\n    if (scope) {\n      scope = sortScope(scope);\n    }\n\n    // Ideally, we could depend on the service to communicate this error, but\n    // all we get is \"invalid scope\", which, to the lay person, implies\n    // something wrong with *one* of the scopes, not the whole thing.\n    if (scope === sortScope(this.config.scope)) {\n      return Promise.reject(new Error('token: scope reduction requires a reduced scope'));\n    }\n\n    return this.webex\n      .request({\n        method: 'POST',\n        uri: this.config.tokenUrl,\n        addAuthHeader: false,\n        form: {\n          grant_type: 'urn:cisco:oauth:grant-type:scope-reduction',\n          token: this.access_token,\n          scope,\n          client_id: this.config.client_id,\n          self_contained_token: true,\n        },\n      })\n      .then((res) => {\n        this.logger.info(`token: downscoped token to ${scope}`);\n\n        return new Token(Object.assign(res.body, {scope}), {parent: this.parent});\n      });\n  },\n\n  /**\n   * Initializer\n   * @instance\n   * @memberof Token\n   * @param {Object} [attrs={}]\n   * @param {Object} [options={}]\n   * @see {@link WebexPlugin#initialize()}\n   * @returns {Token}\n   */\n  initialize(attrs = {}, options = {}) {\n    Reflect.apply(WebexPlugin.prototype.initialize, this, [attrs, options]);\n\n    if (typeof attrs === 'string') {\n      this.access_token = attrs;\n    }\n\n    if (!this.access_token) {\n      throw new Error('`access_token` is required');\n    }\n\n    // We don't want the derived property `isExpired` to need {cache:false}, so\n    // we'll set up a timer the runs when this token should expire.\n    if (this.expires) {\n      if (this.expires < Date.now()) {\n        this._isExpired = true;\n      } else {\n        safeSetTimeout(() => {\n          this._isExpired = true;\n        }, this.expires - Date.now());\n      }\n    }\n  },\n\n  @oneFlight\n  /**\n   * Refreshes this Token. Relies on\n   * {@link config.credentials.refreshCallback()}\n   * @instance\n   * @memberof Token\n   * @returns {Promise<Token>}\n   */\n  refresh() {\n    if (!this.canRefresh) {\n      throw new Error('Not enough information available to refresh this access token');\n    }\n\n    let promise;\n\n    if (inBrowser) {\n      if (!this.config.refreshCallback) {\n        throw new Error('Cannot refresh access token without refreshCallback');\n      }\n\n      promise = Promise.resolve(this.config.refreshCallback(this.webex, this));\n    }\n\n    return (\n      promise ||\n      this.webex\n        .request({\n          method: 'POST',\n          uri: this.config.tokenUrl,\n          form: {\n            grant_type: 'refresh_token',\n            redirect_uri: this.config.redirect_uri,\n            refresh_token: this.refresh_token,\n          },\n          auth: {\n            user: this.config.client_id,\n            pass: this.config.client_secret,\n            sendImmediately: true,\n          },\n          shouldRefreshAccessToken: false,\n        })\n        .then((res) => res.body)\n    )\n      .then((obj) => {\n        if (!obj) {\n          throw new Error('token: refreshCallback() did not produce an object');\n        }\n        // If the authentication server did not send back a refresh token, copy\n        // the current refresh token and related values to the response (note:\n        // at time of implementation, CI never sends a new refresh token)\n        if (!obj.refresh_token) {\n          Object.assign(\n            obj,\n            pick(this, 'refresh_token', 'refresh_token_expires', 'refresh_token_expires_in')\n          );\n        }\n\n        // If the new token is the same as the previous token, then we may have\n        // found a bug in CI; log the details and reject the Promise\n        if (this.access_token === obj.access_token) {\n          this.logger.error('token: new token matches current token');\n          // log the tokens if it is not production\n          if (process.env.NODE_ENV !== 'production') {\n            this.logger.error('token: current token:', this.access_token);\n            this.logger.error('token: new token:', obj.access_token);\n          }\n\n          return Promise.reject(new Error('new token matches current token'));\n        }\n\n        if (this.previousToken) {\n          this.previousToken.revoke();\n          this.unset('previousToken');\n        }\n\n        obj.previousToken = this;\n        obj.scope = this.scope;\n\n        return new Token(obj, {parent: this.parent});\n      })\n      .catch(processGrantError);\n  },\n\n  @oneFlight\n  /**\n   * Revokes this token and unsets its local properties\n   * @instance\n   * @memberof Token\n   * @returns {Promise}\n   */\n  revoke() {\n    if (this.isExpired) {\n      this.logger.info('token: already expired, not making making revocation request');\n\n      return Promise.resolve();\n    }\n\n    if (!this.canAuthorize) {\n      this.logger.info('token: no longer valid, not making revocation request');\n\n      return Promise.resolve();\n    }\n\n    // FIXME we need to use the user token revocation endpoint to revoke a token\n    // without a client_secret, but it doesn't current support using a token to\n    // revoke itself\n    // Note: I'm not making a canRevoke property because there should be changes\n    // coming to the user token revocation endpoint that allow us to do this\n    // correctly.\n    if (!this.config.client_secret) {\n      this.logger.info('token: no client secret available, not making revocation request');\n\n      return Promise.resolve();\n    }\n\n    this.logger.info('token: revoking access token');\n\n    return this.webex\n      .request({\n        method: 'POST',\n        uri: this.config.revokeUrl,\n        form: {\n          token: this.access_token,\n          token_type_hint: 'access_token',\n        },\n        auth: {\n          user: this.config.client_id,\n          pass: this.config.client_secret,\n          sendImmediately: true,\n        },\n        shouldRefreshAccessToken: false,\n      })\n      .then(() => {\n        this.unset(['access_token', 'expires', 'expires_in', 'token_type']);\n        this.logger.info('token: access token revoked');\n      })\n      .catch(processGrantError);\n  },\n\n  set(...args) {\n    // eslint-disable-next-line prefer-const\n    let [attrs, options] = this._filterSetParameters(...args);\n\n    if (!attrs.token_type && attrs.access_token && attrs.access_token.includes(' ')) {\n      const [token_type, access_token] = attrs.access_token.split(' ');\n\n      attrs = {...attrs, access_token, token_type};\n    }\n    const now = Date.now();\n\n    if (!attrs.expires && attrs.expires_in) {\n      attrs.expires = now + attrs.expires_in * 1000;\n    }\n\n    if (!attrs.refresh_token_expires && attrs.refresh_token_expires_in) {\n      attrs.refresh_token_expires = now + attrs.refresh_token_expires_in * 1000;\n    }\n\n    if (attrs.scope) {\n      attrs.scope = sortScope(attrs.scope);\n    }\n\n    return Reflect.apply(WebexPlugin.prototype.set, this, [attrs, options]);\n  },\n\n  /**\n   * Renders the token object as an HTTP Header Value\n   * @instance\n   * @memberof Token\n   * @returns {string}\n   * @see {@link Object#toString()}\n   */\n  toString() {\n    if (!this._string) {\n      throw new Error('cannot stringify Token');\n    }\n\n    return this._string;\n  },\n\n  /**\n   * Uses a non-producation api to return information about this token. This\n   * method is primarily for tests and will throw if NODE_ENV === production\n   * @instance\n   * @memberof Token\n   * @private\n   * @returns {Promise}\n   */\n  validate() {\n    if (process.env.NODE_ENV === 'production') {\n      throw new Error('Token#validate() must not be used in production');\n    }\n\n    return this.webex\n      .request({\n        method: 'POST',\n        service: 'conversation',\n        resource: 'users/validateAuthToken',\n        body: {\n          token: this.access_token,\n        },\n      })\n      .catch((reason) => {\n        if ('statusCode' in reason) {\n          return Promise.reject(reason);\n        }\n        this.logger.info(\"REMINDER: If you're investigating a network error here, it's normal\");\n\n        // If we got an error that isn't a WebexHttpError, assume the problem is\n        // that we don't have the wdm plugin loaded and service/resource isn't\n        // a valid means of identifying a request.\n        const convApi =\n          process.env.CONVERSATION_SERVICE ||\n          process.env.CONVERSATION_SERVICE_URL ||\n          'https://conv-a.wbx2.com/conversation/api/v1';\n\n        return this.webex.request({\n          method: 'POST',\n          uri: `${convApi}/users/validateAuthToken`,\n          body: {\n            token: this.access_token,\n          },\n          headers: {\n            authorization: `Bearer ${this.access_token}`,\n          },\n        });\n      })\n      .then((res) => res.body);\n  },\n});\n\nexport default Token;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAKA;AACA;AAEA;AACA;AAEA;AACA;AAAuD;AAAA;AAAA;AAAA;AAAA;AAEvD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,iBAAiB,CAACC,GAAG,EAAE;EAC9B,IAAIA,GAAG,CAACC,UAAU,KAAK,GAAG,EAAE;IAC1B,OAAO,iBAAQC,MAAM,CAACF,GAAG,CAAC;EAC5B;EAEA,IAAMG,gBAAgB,GAAGC,oBAAW,CAACC,MAAM,CAACL,GAAG,CAACM,IAAI,CAACC,KAAK,CAAC;EAE3D,IAAIJ,gBAAgB,KAAKK,uBAAU,IAAIR,GAAG,YAAYS,uBAAc,EAAE;IACpE,OAAO,iBAAQP,MAAM,CAACF,GAAG,CAAC;EAC5B;EACA,IAAI,CAACG,gBAAgB,EAAE;IACrB,OAAO,iBAAQD,MAAM,CAACF,GAAG,CAAC;EAC5B;EAEA,OAAO,iBAAQE,MAAM,CAAC,IAAIC,gBAAgB,CAACH,GAAG,CAACU,IAAI,IAAIV,GAAG,CAAC,CAAC;AAC9D;;AAEA;AACA;AACA;AACA,IAAMW,KAAK,GAAGC,oBAAW,CAACC,MAAM,SA4L7B,IAAAC,iBAAS,EAAC;EACTC,UAAU,sBAACC,KAAK,EAAE;IAChB,OAAOA,KAAK;EACd;AACF,CAAC,CAAC,UAhM6B;EAC/BC,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,YAAY,EAAE;MACZC,IAAI,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC;MACnCC,EAAE,gBAAG;QACH,OAAO,CAAC,CAAC,IAAI,CAACC,YAAY,IAAI,CAAC,IAAI,CAACC,SAAS;MAC/C;IACF,CAAC;IAED;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,YAAY,EAAE;MACZJ,IAAI,EAAE,CAAC,cAAc,CAAC;MACtBC,EAAE,gBAAG;QACH,OAAO,IAAI,CAACF,YAAY,IAAI,CAAC,CAAC,IAAI,CAACM,MAAM,CAACC,SAAS;MACrD;IACF,CAAC;IAED;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,UAAU,EAAE;MACVP,IAAI,EAAE,CAAC,eAAe,CAAC;MACvBC,EAAE,gBAAG;QACH,IAAIO,iBAAS,EAAE;UACb,OAAO,CAAC,CAAC,IAAI,CAACC,aAAa,IAAI,CAAC,CAAC,IAAI,CAACJ,MAAM,CAACK,eAAe;QAC9D;QAEA,OAAO,CAAC,CAAC,IAAI,CAACD,aAAa,IAAI,CAAC,CAAC,IAAI,CAACJ,MAAM,CAACM,aAAa;MAC5D;IACF,CAAC;IAED;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;IACIR,SAAS,EAAE;MACTH,IAAI,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC;MAC/BC,EAAE,gBAAG;QACH;QACA;QACA,OAAO,CAAC,CAAC,IAAI,CAACW,OAAO,IAAI,IAAI,CAACC,UAAU;MAC1C;IACF,CAAC;IAED;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;IACIC,OAAO,EAAE;MACPd,IAAI,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;MACpCC,EAAE,gBAAG;QACH,IAAI,CAAC,IAAI,CAACC,YAAY,IAAI,CAAC,IAAI,CAACa,UAAU,EAAE;UAC1C,OAAO,EAAE;QACX;QAEA,iBAAU,IAAI,CAACA,UAAU,cAAI,IAAI,CAACb,YAAY;MAChD;IACF;EACF,CAAC;EAEDc,SAAS,EAAE,aAAa;EAExBC,KAAK,EAAE;IACL;AACJ;AACA;AACA;AACA;AACA;AACA;IACIpB,KAAK,EAAE,QAAQ;IACf;AACJ;AACA;AACA;AACA;IACIK,YAAY,EAAE,QAAQ;IACtB;AACJ;AACA;AACA;AACA;IACIU,OAAO,EAAE,QAAQ;IACjB;AACJ;AACA;AACA;AACA;IACIM,UAAU,EAAE,QAAQ;IACpB;AACJ;AACA;AACA;AACA;IACIT,aAAa,EAAE,QAAQ;IACvB;AACJ;AACA;AACA;AACA;IACIU,qBAAqB,EAAE,QAAQ;IAC/B;AACJ;AACA;AACA;AACA;IACIC,wBAAwB,EAAE,QAAQ;IAClC;AACJ;AACA;AACA;AACA;AACA;IACIL,UAAU,EAAE;MACVM,OAAO,EAAE,QAAQ;MACjBC,IAAI,EAAE;IACR;EACF,CAAC;EAEDC,OAAO,EAAE;IACP;AACJ;AACA;AACA;AACA;AACA;AACA;IACIV,UAAU,EAAE;MACVQ,OAAO,EAAE,KAAK;MACdC,IAAI,EAAE;IACR,CAAC;IACD;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;IACIE,aAAa,EAAE;MACbF,IAAI,EAAE;IACR;EACF,CAAC;EAOD;AACF;AACA;AACA;AACA;AACA;AACA;EACEG,SAAS,qBAAC5B,KAAK,EAAE;IAAA;IACf,IAAI,CAAC6B,MAAM,CAACC,IAAI,uCAAgC9B,KAAK,EAAG;IAExD,IAAI,IAAI,CAACM,SAAS,EAAE;MAClB,IAAI,CAACuB,MAAM,CAACC,IAAI,CAAC,2DAA2D,CAAC;MAE7E,OAAO,iBAAQ5C,MAAM,CAAC,IAAI6C,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3E;IAEA,IAAI,CAAC,IAAI,CAACxB,YAAY,EAAE;MACtB,IAAI,IAAI,CAACC,MAAM,CAACC,SAAS,EAAE;QACzB,IAAI,CAACoB,MAAM,CAACC,IAAI,CAAC,2DAA2D,CAAC;MAC/E,CAAC,MAAM;QACL,IAAI,CAACD,MAAM,CAACG,KAAK,CAAC,2CAA2C,CAAC;MAChE;MAEA,OAAO,iBAAQ9C,MAAM,CAAC,IAAI6C,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE;IAEA,IAAI,IAAAE,iBAAU,EAACjC,KAAK,EAAE,IAAI,CAACQ,MAAM,CAACR,KAAK,CAAC,KAAK,EAAE,EAAE;MAC/C,OAAO,iBAAQd,MAAM,CACnB,IAAI6C,KAAK,sBACO/B,KAAK,sDAA4C,IAAI,CAACQ,MAAM,CAACR,KAAK,OACjF,CACF;IACH;;IAEA;IACA;IACA,IAAIA,KAAK,EAAE;MACTA,KAAK,GAAG,IAAAkC,gBAAS,EAAClC,KAAK,CAAC;IAC1B;;IAEA;IACA;IACA;IACA,IAAIA,KAAK,KAAK,IAAAkC,gBAAS,EAAC,IAAI,CAAC1B,MAAM,CAACR,KAAK,CAAC,EAAE;MAC1C,OAAO,iBAAQd,MAAM,CAAC,IAAI6C,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrF;IAEA,OAAO,IAAI,CAACI,KAAK,CACdC,OAAO,CAAC;MACPC,MAAM,EAAE,MAAM;MACdC,GAAG,EAAE,IAAI,CAAC9B,MAAM,CAAC+B,QAAQ;MACzBC,aAAa,EAAE,KAAK;MACpBC,IAAI,EAAE;QACJC,UAAU,EAAE,4CAA4C;QACxDC,KAAK,EAAE,IAAI,CAACtC,YAAY;QACxBL,KAAK,EAALA,KAAK;QACLS,SAAS,EAAE,IAAI,CAACD,MAAM,CAACC,SAAS;QAChCmC,oBAAoB,EAAE;MACxB;IACF,CAAC,CAAC,CACDC,IAAI,CAAC,UAAC7D,GAAG,EAAK;MACb,KAAI,CAAC6C,MAAM,CAACC,IAAI,sCAA+B9B,KAAK,EAAG;MAEvD,OAAO,IAAIL,KAAK,CAAC,qBAAcX,GAAG,CAACM,IAAI,EAAE;QAACU,KAAK,EAALA;MAAK,CAAC,CAAC,EAAE;QAAC8C,MAAM,EAAE,KAAI,CAACA;MAAM,CAAC,CAAC;IAC3E,CAAC,CAAC;EACN,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEC,UAAU,wBAA2B;IAAA;IAAA,IAA1BC,KAAK,uEAAG,CAAC,CAAC;IAAA,IAAEC,OAAO,uEAAG,CAAC,CAAC;IACjC,oBAAcrD,oBAAW,CAACsD,SAAS,CAACH,UAAU,EAAE,IAAI,EAAE,CAACC,KAAK,EAAEC,OAAO,CAAC,CAAC;IAEvE,IAAI,OAAOD,KAAK,KAAK,QAAQ,EAAE;MAC7B,IAAI,CAAC3C,YAAY,GAAG2C,KAAK;IAC3B;IAEA,IAAI,CAAC,IAAI,CAAC3C,YAAY,EAAE;MACtB,MAAM,IAAI0B,KAAK,CAAC,4BAA4B,CAAC;IAC/C;;IAEA;IACA;IACA,IAAI,IAAI,CAAChB,OAAO,EAAE;MAChB,IAAI,IAAI,CAACA,OAAO,GAAG,mBAAU,EAAE;QAC7B,IAAI,CAACC,UAAU,GAAG,IAAI;MACxB,CAAC,MAAM;QACL,IAAAmC,4BAAc,EAAC,YAAM;UACnB,MAAI,CAACnC,UAAU,GAAG,IAAI;QACxB,CAAC,EAAE,IAAI,CAACD,OAAO,GAAG,mBAAU,CAAC;MAC/B;IACF;EACF,CAAC;EAGD;AACF;AACA;AACA;AACA;AACA;AACA;EACEqC,OAAO,qBAAG;IAAA;IACR,IAAI,CAAC,IAAI,CAAC1C,UAAU,EAAE;MACpB,MAAM,IAAIqB,KAAK,CAAC,+DAA+D,CAAC;IAClF;IAEA,IAAIsB,OAAO;IAEX,IAAI1C,iBAAS,EAAE;MACb,IAAI,CAAC,IAAI,CAACH,MAAM,CAACK,eAAe,EAAE;QAChC,MAAM,IAAIkB,KAAK,CAAC,qDAAqD,CAAC;MACxE;MAEAsB,OAAO,GAAG,iBAAQC,OAAO,CAAC,IAAI,CAAC9C,MAAM,CAACK,eAAe,CAAC,IAAI,CAACsB,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1E;IAEA,OAAO,CACLkB,OAAO,IACP,IAAI,CAAClB,KAAK,CACPC,OAAO,CAAC;MACPC,MAAM,EAAE,MAAM;MACdC,GAAG,EAAE,IAAI,CAAC9B,MAAM,CAAC+B,QAAQ;MACzBE,IAAI,EAAE;QACJC,UAAU,EAAE,eAAe;QAC3Ba,YAAY,EAAE,IAAI,CAAC/C,MAAM,CAAC+C,YAAY;QACtC3C,aAAa,EAAE,IAAI,CAACA;MACtB,CAAC;MACD4C,IAAI,EAAE;QACJC,IAAI,EAAE,IAAI,CAACjD,MAAM,CAACC,SAAS;QAC3BiD,IAAI,EAAE,IAAI,CAAClD,MAAM,CAACM,aAAa;QAC/B6C,eAAe,EAAE;MACnB,CAAC;MACDC,wBAAwB,EAAE;IAC5B,CAAC,CAAC,CACDf,IAAI,CAAC,UAAC7D,GAAG;MAAA,OAAKA,GAAG,CAACM,IAAI;IAAA,EAAC,EAEzBuD,IAAI,CAAC,UAACgB,GAAG,EAAK;MACb,IAAI,CAACA,GAAG,EAAE;QACR,MAAM,IAAI9B,KAAK,CAAC,oDAAoD,CAAC;MACvE;MACA;MACA;MACA;MACA,IAAI,CAAC8B,GAAG,CAACjD,aAAa,EAAE;QACtB,qBACEiD,GAAG,EACH,oBAAK,MAAI,EAAE,eAAe,EAAE,uBAAuB,EAAE,0BAA0B,CAAC,CACjF;MACH;;MAEA;MACA;MACA,IAAI,MAAI,CAACxD,YAAY,KAAKwD,GAAG,CAACxD,YAAY,EAAE;QAC1C,MAAI,CAACwB,MAAM,CAACtC,KAAK,CAAC,wCAAwC,CAAC;QAC3D;QACA,IAAIuE,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;UACzC,MAAI,CAACnC,MAAM,CAACtC,KAAK,CAAC,uBAAuB,EAAE,MAAI,CAACc,YAAY,CAAC;UAC7D,MAAI,CAACwB,MAAM,CAACtC,KAAK,CAAC,mBAAmB,EAAEsE,GAAG,CAACxD,YAAY,CAAC;QAC1D;QAEA,OAAO,iBAAQnB,MAAM,CAAC,IAAI6C,KAAK,CAAC,iCAAiC,CAAC,CAAC;MACrE;MAEA,IAAI,MAAI,CAACJ,aAAa,EAAE;QACtB,MAAI,CAACA,aAAa,CAACsC,MAAM,EAAE;QAC3B,MAAI,CAACC,KAAK,CAAC,eAAe,CAAC;MAC7B;MAEAL,GAAG,CAAClC,aAAa,GAAG,MAAI;MACxBkC,GAAG,CAAC7D,KAAK,GAAG,MAAI,CAACA,KAAK;MAEtB,OAAO,IAAIL,KAAK,CAACkE,GAAG,EAAE;QAACf,MAAM,EAAE,MAAI,CAACA;MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACDqB,KAAK,CAACpF,iBAAiB,CAAC;EAC7B,CAAC;EAGD;AACF;AACA;AACA;AACA;AACA;EACEkF,MAAM,oBAAG;IAAA;IACP,IAAI,IAAI,CAAC3D,SAAS,EAAE;MAClB,IAAI,CAACuB,MAAM,CAACC,IAAI,CAAC,8DAA8D,CAAC;MAEhF,OAAO,iBAAQwB,OAAO,EAAE;IAC1B;IAEA,IAAI,CAAC,IAAI,CAACpD,YAAY,EAAE;MACtB,IAAI,CAAC2B,MAAM,CAACC,IAAI,CAAC,uDAAuD,CAAC;MAEzE,OAAO,iBAAQwB,OAAO,EAAE;IAC1B;;IAEA;IACA;IACA;IACA;IACA;IACA;IACA,IAAI,CAAC,IAAI,CAAC9C,MAAM,CAACM,aAAa,EAAE;MAC9B,IAAI,CAACe,MAAM,CAACC,IAAI,CAAC,kEAAkE,CAAC;MAEpF,OAAO,iBAAQwB,OAAO,EAAE;IAC1B;IAEA,IAAI,CAACzB,MAAM,CAACC,IAAI,CAAC,8BAA8B,CAAC;IAEhD,OAAO,IAAI,CAACK,KAAK,CACdC,OAAO,CAAC;MACPC,MAAM,EAAE,MAAM;MACdC,GAAG,EAAE,IAAI,CAAC9B,MAAM,CAAC4D,SAAS;MAC1B3B,IAAI,EAAE;QACJE,KAAK,EAAE,IAAI,CAACtC,YAAY;QACxBgE,eAAe,EAAE;MACnB,CAAC;MACDb,IAAI,EAAE;QACJC,IAAI,EAAE,IAAI,CAACjD,MAAM,CAACC,SAAS;QAC3BiD,IAAI,EAAE,IAAI,CAAClD,MAAM,CAACM,aAAa;QAC/B6C,eAAe,EAAE;MACnB,CAAC;MACDC,wBAAwB,EAAE;IAC5B,CAAC,CAAC,CACDf,IAAI,CAAC,YAAM;MACV,MAAI,CAACqB,KAAK,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;MACnE,MAAI,CAACrC,MAAM,CAACC,IAAI,CAAC,6BAA6B,CAAC;IACjD,CAAC,CAAC,CACDqC,KAAK,CAACpF,iBAAiB,CAAC;EAC7B,CAAC;EAEDuF,GAAG,iBAAU;IACX;IACA,4BAAuB,IAAI,CAACC,oBAAoB,OAAzB,IAAI,YAA8B;MAAA;MAApDvB,KAAK;MAAEC,OAAO;IAEnB,IAAI,CAACD,KAAK,CAAC9B,UAAU,IAAI8B,KAAK,CAAC3C,YAAY,IAAI2C,KAAK,CAAC3C,YAAY,CAACmE,QAAQ,CAAC,GAAG,CAAC,EAAE;MAC/E,4BAAmCxB,KAAK,CAAC3C,YAAY,CAACoE,KAAK,CAAC,GAAG,CAAC;QAAA;QAAzDvD,UAAU;QAAEb,YAAY;MAE/B2C,KAAK,mCAAOA,KAAK;QAAE3C,YAAY,EAAZA,YAAY;QAAEa,UAAU,EAAVA;MAAU,EAAC;IAC9C;IACA,IAAMwD,GAAG,GAAG,mBAAU;IAEtB,IAAI,CAAC1B,KAAK,CAACjC,OAAO,IAAIiC,KAAK,CAAC3B,UAAU,EAAE;MACtC2B,KAAK,CAACjC,OAAO,GAAG2D,GAAG,GAAG1B,KAAK,CAAC3B,UAAU,GAAG,IAAI;IAC/C;IAEA,IAAI,CAAC2B,KAAK,CAAC1B,qBAAqB,IAAI0B,KAAK,CAACzB,wBAAwB,EAAE;MAClEyB,KAAK,CAAC1B,qBAAqB,GAAGoD,GAAG,GAAG1B,KAAK,CAACzB,wBAAwB,GAAG,IAAI;IAC3E;IAEA,IAAIyB,KAAK,CAAChD,KAAK,EAAE;MACfgD,KAAK,CAAChD,KAAK,GAAG,IAAAkC,gBAAS,EAACc,KAAK,CAAChD,KAAK,CAAC;IACtC;IAEA,OAAO,oBAAcJ,oBAAW,CAACsD,SAAS,CAACoB,GAAG,EAAE,IAAI,EAAE,CAACtB,KAAK,EAAEC,OAAO,CAAC,CAAC;EACzE,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;EACE0B,QAAQ,sBAAG;IACT,IAAI,CAAC,IAAI,CAAC1D,OAAO,EAAE;MACjB,MAAM,IAAIc,KAAK,CAAC,wBAAwB,CAAC;IAC3C;IAEA,OAAO,IAAI,CAACd,OAAO;EACrB,CAAC;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE2D,QAAQ,sBAAG;IAAA;IACT,IAAId,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;MACzC,MAAM,IAAIjC,KAAK,CAAC,iDAAiD,CAAC;IACpE;IAEA,OAAO,IAAI,CAACI,KAAK,CACdC,OAAO,CAAC;MACPC,MAAM,EAAE,MAAM;MACdwC,OAAO,EAAE,cAAc;MACvBC,QAAQ,EAAE,yBAAyB;MACnCxF,IAAI,EAAE;QACJqD,KAAK,EAAE,IAAI,CAACtC;MACd;IACF,CAAC,CAAC,CACD8D,KAAK,CAAC,UAACY,MAAM,EAAK;MACjB,IAAI,YAAY,IAAIA,MAAM,EAAE;QAC1B,OAAO,iBAAQ7F,MAAM,CAAC6F,MAAM,CAAC;MAC/B;MACA,MAAI,CAAClD,MAAM,CAACC,IAAI,CAAC,qEAAqE,CAAC;;MAEvF;MACA;MACA;MACA,IAAMkD,OAAO,GACXlB,OAAO,CAACC,GAAG,CAACkB,oBAAoB,IAChCnB,OAAO,CAACC,GAAG,CAACmB,wBAAwB,IACpC,6CAA6C;MAE/C,OAAO,MAAI,CAAC/C,KAAK,CAACC,OAAO,CAAC;QACxBC,MAAM,EAAE,MAAM;QACdC,GAAG,YAAK0C,OAAO,6BAA0B;QACzC1F,IAAI,EAAE;UACJqD,KAAK,EAAE,MAAI,CAACtC;QACd,CAAC;QACD8E,OAAO,EAAE;UACPC,aAAa,mBAAY,MAAI,CAAC/E,YAAY;QAC5C;MACF,CAAC,CAAC;IACJ,CAAC,CAAC,CACDwC,IAAI,CAAC,UAAC7D,GAAG;MAAA,OAAKA,GAAG,CAACM,IAAI;IAAA,EAAC;EAC5B,CAAC;EAAA;AACH,CAAC,kMArOEQ,iBAAS,4HAmFTA,iBAAS,0EAkJV;AAAC,eAEYH,KAAK;AAAA"}