@webex/webex-core 3.11.0-webex-services-ready.1 → 3.12.0-auth-prejoin-fetch.1

package/test/integration/spec/services-v2/services-v2.js

@@ -5,7 +5,7 @@
 import '@webex/internal-plugin-device';
 
 import {assert} from '@webex/test-helper-chai';
-import {flaky} from '@webex/test-helper-mocha';
+import {flaky, retryOn429} from '@webex/test-helper-mocha';
 import WebexCore, {
   ServiceCatalogV2,
   ServiceDetail,
@@ -25,6 +25,7 @@ import {
   formattedServiceHostmapEntryTest,
   serviceHostmapV2,
 } from '../../../fixtures/host-catalog-v2';
+import {createActivationEmail} from '../../../fixtures/activation-email';
 
 // /* eslint-disable no-underscore-dangle */
 describe('webex-core', () => {
@@ -316,28 +317,19 @@ describe('webex-core', () => {
         assert.isTrue(catalog.isReady);
       });
 
-      it('should call services#initServiceCatalogs() on webex loaded', async () => {
+      it('should call services#initServiceCatalogs() on webex ready', async () => {
+        services._loadCatalogFromCache = sinon.stub().resolves(false);
         services.initServiceCatalogs = sinon.stub().resolves();
         services.initialize();
-        webex.trigger('loaded');
-        // Wait for the async callback to execute
-        await new Promise((resolve) => setTimeout(resolve, 10));
+        // The mode-specific ('ready'/'loaded') listener is registered inside the
+        // change:config handler, so fire change:config first, then 'ready'.
+        webex.trigger('change:config');
+        webex.trigger('ready');
+        // Wait for the async 'ready' handler to complete
+        await new Promise((resolve) => setTimeout(resolve, 50));
         assert.called(services.initServiceCatalogs);
       });
 
-      it('should set services.ready to true after initialization completes', async () => {
-        // services.ready starts as false
-        const newWebex = new WebexCore({credentials: {supertoken: webexUser.token}});
-        const newServices = newWebex.internal.services;
-
-        // Wait for initialization to complete
-        await new Promise((resolve) => {
-          newServices.on('services:initialized', resolve);
-        });
-
-        assert.isTrue(newServices.ready);
-      });
-
       it('should collect different catalogs based on OrgId region', () =>
         assert.notDeepEqual(catalog._getAllServiceDetails(), catalogEU._getAllServiceDetails()));
 
@@ -352,6 +344,45 @@ describe('webex-core', () => {
           done();
         }, 2000);
       });
+
+      it('blocks webex.ready until services.ready flips when waitForCatalogInit is enabled', async () => {
+        const gatedWebex = new WebexCore({
+          credentials: {supertoken: webexUser.token},
+          config: {services: {waitForCatalogInit: true}},
+        });
+
+        // Before init settles, webex.ready must be false because services.ready
+        // is a dependency and starts false in the gated path.
+        assert.isFalse(gatedWebex.internal.services.ready, 'services.ready should start false');
+        assert.isFalse(
+          gatedWebex.ready,
+          'webex.ready should not fire while services.ready is false'
+        );
+
+        // Wait up to 30s for services init to complete and flip ready.
+        await new Promise((resolve, reject) => {
+          if (gatedWebex.internal.services.ready) {
+            resolve();
+
+            return;
+          }
+          const timer = setTimeout(
+            () => reject(new Error('timed out waiting for services.ready')),
+            30_000
+          );
+
+          gatedWebex.internal.services.once('change:ready', () => {
+            clearTimeout(timer);
+            resolve();
+          });
+        });
+
+        assert.isTrue(
+          gatedWebex.internal.services.ready,
+          'services.ready should flip true after init settles'
+        );
+        assert.isTrue(gatedWebex.ready, 'webex.ready should fire once services.ready flips');
+      });
     });
 
     describe('#initServiceCatalogs()', () => {
@@ -801,18 +832,22 @@ describe('webex-core', () => {
           }));
 
       it('validates an authorized user and webex instance', () =>
-        services.validateUser({email: webexUser.email}).then((r) => {
-          assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-          assert.equal(r.activated, true);
-          assert.equal(r.exists, true);
-        }));
+        retryOn429(() =>
+          services.validateUser({email: webexUser.email}).then((r) => {
+            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+            assert.equal(r.activated, true);
+            assert.equal(r.exists, true);
+          })
+        ));
 
       it('validates an authorized EU user and webex instance', () =>
-        servicesEU.validateUser({email: webexUserEU.email}).then((r) => {
-          assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-          assert.equal(r.activated, true);
-          assert.equal(r.exists, true);
-        }));
+        retryOn429(() =>
+          servicesEU.validateUser({email: webexUserEU.email}).then((r) => {
+            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+            assert.equal(r.activated, true);
+            assert.equal(r.exists, true);
+          })
+        ));
 
       it("returns a rejected promise if the provided email isn't valid", () =>
         unauthServices
@@ -825,113 +860,134 @@ describe('webex-core', () => {
           }));
 
       it('validates a non-existing user', () =>
-        unauthServices
-          .validateUser({email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`})
-          .then((r) => {
+        retryOn429(() =>
+          unauthServices.validateUser({email: createActivationEmail()}).then((r) => {
             assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
             assert.equal(r.activated, false);
             assert.equal(r.exists, false);
-          }));
+          })
+        ));
 
       it('validates new user with activationOptions suppressEmail false', () =>
-        unauthServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: false},
-          })
-          .then((r) => {
-            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-            assert.equal(r.activated, false);
-            assert.equal(r.exists, false);
-            assert.equal(r.user.verificationEmailTriggered, true);
-          }));
+        retryOn429(() =>
+          unauthServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: false},
+            })
+            .then((r) => {
+              assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+              assert.equal(r.activated, false);
+              assert.equal(r.exists, false);
+              assert.equal(r.user.verificationEmailTriggered, true);
+            })
+        ));
 
       it('validates new user with activationOptions suppressEmail true', () =>
-        unauthServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: true},
-          })
-          .then((r) => {
-            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-            assert.equal(r.activated, false);
-            assert.equal(r.exists, false);
-            assert.equal(r.user.verificationEmailTriggered, false);
-          }));
+        retryOn429(() =>
+          unauthServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: true},
+            })
+            .then((r) => {
+              assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+              assert.equal(r.activated, false);
+              assert.equal(r.exists, false);
+              assert.equal(r.user.verificationEmailTriggered, false);
+            })
+        ));
 
       it('validates an inactive user', () => {
         const inactive = 'webex.web.client+nonactivated@gmail.com';
 
-        return unauthServices
-          .validateUser({email: inactive, activationOptions: {suppressEmail: true}})
-          .then((r) => {
-            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-            assert.equal(r.activated, false, 'activated');
-            assert.equal(r.exists, true, 'exists');
-          })
-          .catch(() => {
-            assert(true);
-          });
+        return retryOn429(() =>
+          unauthServices
+            .validateUser({email: inactive, activationOptions: {suppressEmail: true}})
+            .then((r) => {
+              assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+              assert.equal(r.activated, false, 'activated');
+              assert.equal(r.exists, true, 'exists');
+            })
+        ).catch(() => {
+          assert(true);
+        });
       });
 
       it('validates an existing user', () =>
-        unauthServices.validateUser({email: webexUser.email}).then((r) => {
-          assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-          assert.equal(r.activated, true);
-          assert.equal(r.exists, true);
-        }));
+        retryOn429(() =>
+          unauthServices.validateUser({email: webexUser.email}).then((r) => {
+            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+            assert.equal(r.activated, true);
+            assert.equal(r.exists, true);
+          })
+        ));
 
       it('validates an existing EU user', () =>
-        unauthServices.validateUser({email: webexUserEU.email}).then((r) => {
-          assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-          assert.equal(r.activated, true);
-          assert.equal(r.exists, true);
-        }));
+        retryOn429(() =>
+          unauthServices.validateUser({email: webexUserEU.email}).then((r) => {
+            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+            assert.equal(r.activated, true);
+            assert.equal(r.exists, true);
+          })
+        ));
 
       it('sends the prelogin user id as undefined when not specified', () => {
         const requestStub = sandbox.spy(unauthServices, 'request');
 
-        return unauthServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: true},
-          })
-          .then(() => {
-            assert.isUndefined(getActivationRequest(requestStub).headers['x-prelogin-userid']);
-          });
+        return retryOn429(() => {
+          requestStub.resetHistory();
+
+          return unauthServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: true},
+            })
+            .then(() => {
+              assert.isUndefined(getActivationRequest(requestStub).headers['x-prelogin-userid']);
+            });
+        });
       });
 
       it('sends the prelogin user id as provided when specified', () => {
         const requestStub = sandbox.spy(unauthServices, 'request');
         const preloginUserId = uuid.v4();
 
-        return unauthServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: true},
-            preloginUserId,
-          })
-          .then(() => {
-            assert.strictEqual(
-              getActivationRequest(requestStub).headers['x-prelogin-userid'],
-              preloginUserId
-            );
-          });
+        return retryOn429(() => {
+          requestStub.resetHistory();
+
+          return unauthServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: true},
+              preloginUserId,
+            })
+            .then(() => {
+              assert.strictEqual(
+                getActivationRequest(requestStub).headers['x-prelogin-userid'],
+                preloginUserId
+              );
+            });
+        });
       });
 
       it('uses the license service by default', () => {
         const requestStub = sandbox.spy(unauthServices, 'request');
 
-        return unauthServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: true},
-          })
-          .then(() => {
-            const request = getActivationRequest(requestStub, false);
-            assert.strictEqual(request.service, 'license');
-            assert.strictEqual(request.resource, 'users/activations');
-          });
+        return retryOn429(() => {
+          requestStub.resetHistory();
+
+          return unauthServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: true},
+            })
+            .then(() => {
+              const request = getActivationRequest(requestStub, false);
+              assert.strictEqual(request.service, 'license');
+              assert.strictEqual(request.resource, 'users/activations');
+            });
+        });
       });
 
       it('uses the user-onboarding service when useUserOnboardingServiceForActivations config is true', () => {
@@ -945,16 +1001,20 @@ describe('webex-core', () => {
         const userOnboardingServices = userOnboardingWebex.internal.services;
         const requestStub = sandbox.spy(userOnboardingServices, 'request');
 
-        return userOnboardingServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: true},
-          })
-          .then(() => {
-            const request = getActivationRequest(requestStub, true);
-            assert.strictEqual(request.service, 'user-onboarding');
-            assert.strictEqual(request.resource, 'api/v1/users/activations');
-          });
+        return retryOn429(() => {
+          requestStub.resetHistory();
+
+          return userOnboardingServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: true},
+            })
+            .then(() => {
+              const request = getActivationRequest(requestStub, true);
+              assert.strictEqual(request.service, 'user-onboarding');
+              assert.strictEqual(request.resource, 'api/v1/users/activations');
+            });
+        });
       });
     });
 

package/test/unit/spec/credentials/credentials.js

@@ -183,6 +183,10 @@ describe('webex-core', () => {
           webex.credentials.buildLoginUrl({state: 'state'});
         }, /if specified, `options.state` must be an object/);
 
+        assert.throws(() => {
+          webex.credentials.buildLoginUrl({state: null});
+        }, /if specified, `options.state` must be an object/);
+
         assert.doesNotThrow(() => {
           webex.credentials.buildLoginUrl({state: {}});
         }, /if specified, `options.state` must be an object/);
@@ -232,6 +236,132 @@ describe('webex-core', () => {
       });
     });
 
+    describe('#buildThirdPartyLoginUrl()', () => {
+      it('throws if both `oauth2provider` and `returnURL` are missing', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.throws(() => {
+          credentials.buildThirdPartyLoginUrl({});
+        }, /`options.oauth2provider` is required/);
+      });
+
+      it('throws if `oauth2provider` is missing', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.throws(() => {
+          credentials.buildThirdPartyLoginUrl({returnURL: 'https://web.webex.com'});
+        }, /`options.oauth2provider` is required/);
+      });
+
+      it('throws if `returnURL` is missing', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.throws(() => {
+          credentials.buildThirdPartyLoginUrl({oauth2provider: 'google'});
+        }, /`options.returnURL` is required/);
+      });
+
+      skipInBrowser(it)('generates the third-party login url', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.equal(
+          credentials.buildThirdPartyLoginUrl({
+            oauth2provider: 'google',
+            returnURL: 'https://web.webex.com',
+          }),
+          `${
+            process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+          }/idb/ThirdPartyLogin?oauth2provider=google&returnURL=https%3A%2F%2Fweb.webex.com`
+        );
+      });
+
+      skipInBrowser(it)('generates the url with different parameter values', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.equal(
+          credentials.buildThirdPartyLoginUrl({
+            oauth2provider: 'apple',
+            returnURL: 'https://example.com/callback',
+          }),
+          `${
+            process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+          }/idb/ThirdPartyLogin?oauth2provider=apple&returnURL=https%3A%2F%2Fexample.com%2Fcallback`
+        );
+      });
+
+      it('throws if `state` is not an object', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.throws(() => {
+          credentials.buildThirdPartyLoginUrl({
+            oauth2provider: 'google',
+            returnURL: 'https://web.webex.com',
+            state: 'not-an-object',
+          });
+        }, /`options.state` must be an object/);
+      });
+
+      skipInBrowser(it)('omits `state` when an empty object is provided', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        const result = credentials.buildThirdPartyLoginUrl({
+          oauth2provider: 'google',
+          returnURL: 'https://web.webex.com',
+          state: {},
+        });
+
+        const parsed = new URL(result);
+
+        assert.isFalse(parsed.searchParams.has('state'));
+      });
+
+      skipInBrowser(it)('base64url-encodes a non-empty `state` and emits it as a top-level query param', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        const result = credentials.buildThirdPartyLoginUrl({
+          oauth2provider: 'google',
+          returnURL: 'https://web.webex.com',
+          state: {csrf_token: 'abc', popUpSignIn: true},
+        });
+
+        // Literal base64url of '{"csrf_token":"abc","popUpSignIn":true}'
+        const expectedState = 'eyJjc3JmX3Rva2VuIjoiYWJjIiwicG9wVXBTaWduSW4iOnRydWV9';
+
+        assert.equal(
+          result,
+          `${
+            process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+          }/idb/ThirdPartyLogin?oauth2provider=google&returnURL=${encodeURIComponent(
+            'https://web.webex.com'
+          )}&state=${expectedState}`
+        );
+      });
+    });
+
     describe('#buildLogoutUrl()', () => {
       skipInBrowser(it)('generates the logout url', () => {
         const webex = new MockWebex();
@@ -368,7 +498,9 @@ describe('webex-core', () => {
       });
 
       it('should throw when provided an invalid token', () =>
-        expect(() => credentials.extractOrgIdFromUserToken()).toThrow('the provided token is not a valid format, token has 1 sections'));
+        expect(() => credentials.extractOrgIdFromUserToken()).toThrow(
+          'the provided token is not a valid format, token has 1 sections'
+        ));
 
       it('should throw when no token is provided', () =>
         expect(() => credentials.extractOrgIdFromUserToken()).toThrow());
@@ -799,7 +931,6 @@ describe('webex-core', () => {
           .then(() => assert.isRejected(webex.boundedStorage.get('Credentials', '@'), /NotFound/));
       });
 
-
       // it('does not induce any token refreshes');
 
       it('prevents #getUserToken() from being invoked', () => {

package/test/unit/spec/interceptors/auth.js

@@ -14,6 +14,8 @@ import {
   AuthInterceptor,
   config,
   Credentials,
+  Services,
+  ServicesV2,
   WebexHttpError,
   Token,
   serviceConstants,
@@ -380,6 +382,60 @@ describe('webex-core', () => {
         });
       });
 
+      describe('#onRequest() against a real service catalog', () => {
+        // The cases above stub `isAllowedDomainUrl`, so they answer the
+        // allowed-domain question themselves and cannot show that the catalog
+        // matcher is reached by the code that attaches the token. These use a
+        // real catalog and real allowed-domain methods.
+        [
+          {name: 'Services', Constructor: Services},
+          {name: 'ServicesV2', Constructor: ServicesV2},
+        ].forEach(({name, Constructor}) => {
+          describe(name, () => {
+            let getUserToken;
+
+            beforeEach(() => {
+              const services = new Constructor(undefined, {parent: webex});
+
+              services._getCatalog().setAllowedDomains(['webex.com']);
+              // the catalog holds no services, so a url that is not covered by
+              // an allowed domain has nothing else to authorize it
+              services.waitForService = sinon.stub().rejects(new Error('no such service'));
+
+              webex.internal.services = services;
+              getUserToken = sinon.spy(webex.credentials, 'getUserToken');
+            });
+
+            afterEach(() => {
+              getUserToken.restore();
+              delete webex.internal.services;
+            });
+
+            it('adds the authorization header for a url under an allowed domain', () =>
+              interceptor
+                .onRequest({uri: 'https://api.webex.com/resource', headers: {}})
+                .then((options) => {
+                  assert.equal(
+                    options.headers.authorization,
+                    webex.credentials.supertoken.toString()
+                  );
+                  assert.calledOnce(getUserToken);
+                }));
+
+            [
+              'https://notwebex.com/resource',
+              'https://webex.com.unrelated.example/resource',
+            ].forEach((uri) => {
+              it(`does not add the authorization header for ${uri}`, () =>
+                interceptor.onRequest({uri, headers: {}}).then((options) => {
+                  assert.notProperty(options.headers, 'authorization');
+                  assert.notCalled(getUserToken);
+                }));
+            });
+          });
+        });
+      });
+
       describe('#onResponseError()', () => {
         describe('when the server responds with 401', () => {
           nodeOnly(it)('refreshes the access token and replays the request', () => {