@webex/webex-core 3.11.0-webex-services-ready.1 → 3.12.0-llmrefactor.1

package/src/lib/services/services.js

@@ -1,4 +1,3 @@
-/* eslint-disable no-console */
 import sha256 from 'crypto-js/sha256';
 
 import {union, forEach} from 'lodash';
@@ -60,8 +59,10 @@ const Services = WebexPlugin.extend({
 
   session: {
     /**
-     * Becomes `true` once service catalog initialization has completed.
-     * Blocks `webex.ready` until services are initialized.
+     * Becomes `true` once the initial catalog collection has completed
+     * (successfully or otherwise) and any in-flight credentials refresh has
+     * settled. Blocks `webex.ready` so consumers can rely on `webex.ready`
+     * implying "catalogs populated AND credential state stable".
      * @instance
      * @memberof Services
      * @type {boolean}
@@ -258,6 +259,28 @@ const Services = WebexPlugin.extend({
 
     return !!hostCatalog[host]?.length;
   },
+
+  /**
+   * Checks if the current environment is an integration (INT) environment
+   * by examining the u2c discovery URL from webex config.
+   * INT environments use discovery URLs containing 'intb' (e.g., u2c-intb.ciscospark.com).
+   * @returns {boolean} True if INT environment, false otherwise
+   */
+  isIntegrationEnvironment() {
+    try {
+      const u2cUrl = this.webex?.config?.services?.discovery?.u2c || '';
+      const isInt = u2cUrl.includes('intb');
+
+      this.logger.info(`services: isIntegrationEnvironment: ${isInt}`);
+
+      return isInt;
+    } catch (error) {
+      this.logger.error('services: failed to determine integration environment', error);
+
+      return false;
+    }
+  },
+
   /**
    * Merge provided active cluster mappings into current state.
    * @param {Record<string,string>} activeServices
@@ -1339,6 +1362,7 @@ const Services = WebexPlugin.extend({
 
     // Destructure the credentials plugin.
     const {credentials} = this.webex;
+    const catalog = this._getCatalog();
 
     // Init a promise chain. Must be done as a Promise.resolve() to allow
     // credentials#getOrgId() to properly throw.
@@ -1351,12 +1375,18 @@ const Services = WebexPlugin.extend({
         .then(() => {
           // Validate if the token is authorized.
           if (credentials.canAuthorize) {
-            // Attempt to collect the postauth catalog.
-
-            return this.updateServices().catch(() => {
-              this.initFailed = true;
-              this.logger.warn('services: cannot retrieve postauth catalog');
-            });
+            // Attempt to collect the postauth catalog, then mark the catalog
+            // ready. Setting `isReady` here - rather than only in the init
+            // callers - means a slow postauth fetch that loses the gated-init
+            // timeout race still marks the catalog ready once it completes.
+            return this.updateServices()
+              .then(() => {
+                catalog.isReady = true;
+              })
+              .catch(() => {
+                this.initFailed = true;
+                this.logger.warn('services: cannot retrieve postauth catalog');
+              });
           }
 
           // Return a resolved promise for consistent return value.
@@ -1365,6 +1395,29 @@ const Services = WebexPlugin.extend({
     );
   },
 
+  /**
+   * Await any in-flight credentials refresh, then flip `services.ready` so
+   * `webex.ready` can fire. Closes the parallel-refresh window: if a credential
+   * refresh is in flight when initial catalog collection settles, we must not
+   * signal ready until the refresh has resolved - otherwise downstream
+   * consumers may observe `canAuthorize`/token state that is about to change
+   * under them.
+   *
+   * @private
+   * @returns {Promise<void>}
+   */
+  async _finalizeReady() {
+    const {credentials} = this.webex;
+
+    if (credentials && credentials.isRefreshing) {
+      await new Promise((resolve) => {
+        credentials.once('change:isRefreshing', resolve);
+      });
+    }
+
+    this.ready = true;
+  },
+
   /**
    * Initializer
    *
@@ -1381,65 +1434,149 @@ const Services = WebexPlugin.extend({
     this.registries.set(this.webex, registry);
     this.states.set(this.webex, state);
 
-    // Listen for configuration changes once.
+    // Listen for configuration changes once. The config is not populated on the
+    // webex instance until the `change:config` event fires, so any decision that
+    // depends on config values (such as the gated-vs-ungated init below) must be
+    // made from within this handler rather than synchronously in `initialize()`.
     this.listenToOnce(this.webex, 'change:config', () => {
       this.initConfig();
+
+      // Feature flag: when enabled, `webex.ready` is blocked until the initial
+      // catalog collection has settled AND any in-flight credentials refresh has
+      // completed. When disabled (the default), preserves the pre-existing
+      // behavior where `webex.ready` fires as soon as `webex.loaded` does and
+      // the catalog is collected out-of-band.
+      const waitForCatalogInit = this.webex.config?.services?.waitForCatalogInit === true;
+
+      if (waitForCatalogInit) {
+        this._initializeCatalogsGated(catalog);
+      } else {
+        // Not gating - immediately mark ready so we do not block webex.ready.
+        this.ready = true;
+        this._initializeCatalogsUngated(catalog);
+      }
     });
+  },
 
-    // Wait for storage to be loaded before attempting to update the service catalogs.
-    // We listen for 'loaded' instead of 'ready' because services.ready is a dependency
-    // of webex.ready - listening to 'ready' would cause a deadlock.
+  /**
+   * Original (pre-verified-ready) initialization path. Runs on `webex.ready`
+   * and collects catalogs opportunistically without blocking anything.
+   *
+   * @private
+   * @param {ServiceCatalog} catalog
+   * @returns {void}
+   */
+  _initializeCatalogsUngated(catalog) {
+    // wait for webex instance to be ready before attempting
+    // to update the service catalogs
+    // this can cause a race condition because credentials may
+    // not be valid when services is initialized
+    this.listenToOnce(this.webex, 'ready', async () => {
+      const cachedCatalog = await this._loadCatalogFromCache();
+      if (cachedCatalog) {
+        catalog.isReady = true;
+
+        return; // skip initServiceCatalogs() on reload when cache exists
+      }
+      const {supertoken} = this.webex.credentials;
+      // Validate if the supertoken exists.
+      if (supertoken && supertoken.access_token) {
+        // `initServiceCatalogs` marks the catalog ready internally once the
+        // postauth catalog is collected.
+        this.initServiceCatalogs().catch((error) => {
+          this.initFailed = true;
+          this.logger.error(
+            `services: failed to init initial services when credentials available, ${error?.message}`
+          );
+        });
+      } else {
+        const {email} = this.webex.config;
+
+        this.collectPreauthCatalog(email ? {email} : undefined).catch((error) => {
+          this.initFailed = true;
+          this.logger.error(
+            `services: failed to init initial services when no credentials available, ${error?.message}`
+          );
+        });
+      }
+    });
+  },
+
+  /**
+   * Verified-ready initialization path. Blocks `webex.ready` until the initial
+   * catalog fetch has settled (or timed out) AND any in-flight credentials
+   * refresh has completed. Also handles the fresh-login case where OAuth
+   * completes after `loaded` fires.
+   *
+   * @private
+   * @param {ServiceCatalog} catalog
+   * @returns {void}
+   */
+  _initializeCatalogsGated(catalog) {
+    // Wait for storage to be loaded before attempting to update the service
+    // catalogs. We listen for 'loaded' instead of 'ready' because `services.ready`
+    // now blocks `webex.ready` - listening to 'ready' would deadlock.
     this.listenToOnce(this.webex, 'loaded', async () => {
       const cachedCatalog = await this._loadCatalogFromCache();
       if (cachedCatalog) {
         catalog.isReady = true;
+        await this._finalizeReady();
 
         return; // skip initServiceCatalogs() on reload when cache exists
       }
       const {supertoken} = this.webex.credentials;
+
+      // Race init against a hard timeout so a hung request never leaves
+      // `services.ready` false forever - that would stall `webex.ready` and
+      // leave consumers waiting on it indefinitely. Timeout is configurable via
+      // `config.services.catalogInitTimeout` (defaults to 15s in config).
+      const initTimeoutMs = this.webex.config?.services?.catalogInitTimeout;
+
+      const initServiceCatalogsTimeout = new Promise((_, reject) => {
+        setTimeout(
+          () => reject(new Error(`services: init timed out after ${initTimeoutMs}ms`)),
+          initTimeoutMs
+        );
+      });
+
       // Validate if the supertoken exists.
       if (supertoken && supertoken.access_token) {
-        this.initServiceCatalogs()
-          .then(() => {
-            catalog.isReady = true;
-          })
+        // `initServiceCatalogs` marks the catalog ready internally once the
+        // postauth catalog is collected - even if it loses the timeout race
+        // above, so a slow fetch still eventually flips `catalog.isReady`.
+        Promise.race([this.initServiceCatalogs(), initServiceCatalogsTimeout])
           .catch((error) => {
             this.initFailed = true;
             this.logger.error(
               `services: failed to init initial services when credentials available, ${error?.message}`
             );
           })
-          .finally(() => {
-            this.ready = true;
-            this.trigger('services:initialized');
-          });
+          .finally(() => this._finalizeReady());
       } else {
         const {email} = this.webex.config;
 
-        this.collectPreauthCatalog(email ? {email} : undefined)
+        Promise.race([
+          this.collectPreauthCatalog(email ? {email} : undefined),
+          initServiceCatalogsTimeout,
+        ])
           .catch((error) => {
             this.initFailed = true;
             this.logger.error(
               `services: failed to init initial services when no credentials available, ${error?.message}`
             );
           })
-          .finally(() => {
-            this.ready = true;
-            this.trigger('services:initialized');
-          });
-        // Listen for when credentials become available to fetch the full catalog.
-        // This handles fresh login where 'loaded' fires before OAuth completes.
+          .finally(() => this._finalizeReady());
+
+        // Handle fresh login: 'loaded' fires before OAuth completes, so listen
+        // for `canAuthorize` flipping true and then collect the postauth catalog.
         this.listenToOnce(this.webex, 'change:canAuthorize', () => {
           if (this.webex.canAuthorize && !catalog.status.postauth.ready) {
-            this.initServiceCatalogs()
-              .then(() => {
-                catalog.isReady = true;
-              })
-              .catch((error) => {
-                this.logger.error(
-                  `services: failed to init service catalogs after auth, ${error?.message}`
-                );
-              });
+            // `initServiceCatalogs` marks the catalog ready internally.
+            this.initServiceCatalogs().catch((error) => {
+              this.logger.error(
+                `services: failed to init service catalogs after auth, ${error?.message}`
+              );
+            });
           }
         });
       }

package/src/lib/services-v2/service-catalog.ts

@@ -3,6 +3,7 @@ import AmpState from 'ampersand-state';
 import {union} from 'lodash';
 import ServiceDetail from './service-detail';
 import {IServiceDetail, ServiceGroup} from './types';
+import {matchAllowedDomain, normalizeAllowedDomains} from '../domains';
 
 /**
  * @class
@@ -210,20 +211,14 @@ const ServiceCatalog = AmpState.extend({
   },
 
   /**
-   * Finds an allowed domain that matches a specific url.
+   * Finds an allowed domain that matches a specific url. The url's hostname
+   * must be the allowed domain itself or a subdomain of it.
    *
    * @param {string} url - The url to match the allowed domains against.
    * @returns {string} - The matching allowed domain.
    */
   findAllowedDomain(url: string): string {
-    try {
-      const urlObj = new URL(url);
-
-      return this.allowedDomains.find((allowedDomain) => urlObj.host.includes(allowedDomain));
-    } catch {
-      // If the URL is invalid or can't be found, return undefined
-      return undefined;
-    }
+    return matchAllowedDomain(url, this.allowedDomains);
   },
 
   /**
@@ -282,7 +277,7 @@ const ServiceCatalog = AmpState.extend({
    * @returns {void}
    */
   setAllowedDomains(allowedDomains: Array<string>): void {
-    this.allowedDomains = [...allowedDomains];
+    this.allowedDomains = normalizeAllowedDomains(allowedDomains);
   },
 
   /**
@@ -291,7 +286,7 @@ const ServiceCatalog = AmpState.extend({
    * @returns {void}
    */
   addAllowedDomains(newAllowedDomains: Array<string>): void {
-    this.allowedDomains = union(this.allowedDomains, newAllowedDomains);
+    this.allowedDomains = union(this.allowedDomains, normalizeAllowedDomains(newAllowedDomains));
   },
 
   /**

package/src/lib/services-v2/services-v2.ts

@@ -46,8 +46,10 @@ const Services = WebexPlugin.extend({
 
   session: {
     /**
-     * Becomes `true` once services initialization has completed.
-     * This blocks `webex.ready` until services are initialized.
+     * Becomes `true` once the initial catalog collection has completed
+     * (successfully or otherwise) and any in-flight credentials refresh has
+     * settled. Blocks `webex.ready` so consumers can rely on `webex.ready`
+     * implying "catalogs populated AND credential state stable".
      * @instance
      * @memberof Services
      * @type {boolean}
@@ -212,6 +214,27 @@ const Services = WebexPlugin.extend({
       });
     });
   },
+
+  /**
+   * Checks if the current environment is an integration (INT) environment
+   * by examining the u2c discovery URL from webex config.
+   * INT environments use discovery URLs containing 'intb' (e.g., u2c-intb.ciscospark.com).
+   * @returns {boolean} True if INT environment, false otherwise
+   */
+  isIntegrationEnvironment(): boolean {
+    try {
+      const u2cUrl = this.webex?.config?.services?.discovery?.u2c || '';
+      const isInt = u2cUrl.includes('intb');
+
+      this.logger.info(`services: isIntegrationEnvironment: ${isInt}`);
+
+      return isInt;
+    } catch (error) {
+      this.logger.error('services: failed to determine integration environment', error);
+
+      return false;
+    }
+  },
   /**
    * saves all the services from the pre and post catalog service
    * @param {ActiveServices} activeServices
@@ -1212,7 +1235,11 @@ const Services = WebexPlugin.extend({
   ): Promise<object> {
     const service = 'u2c';
     const resource = from ? `/${from}/catalog` : '/catalog';
-    const qs = {...(query || {}), format: 'U2CV2'};
+    const qs = {
+      ...(query || {}),
+      format: 'U2CV2',
+      ...(this.webex.config?.services?.useCatalogOverride && {useCatalogOverride: true}),
+    };
 
     if (forceRefresh) {
       qs.timestamp = new Date().getTime();
@@ -1305,6 +1332,7 @@ const Services = WebexPlugin.extend({
 
     // Destructure the credentials plugin.
     const {credentials} = this.webex;
+    const catalog = this._getCatalog();
 
     // Init a promise chain. Must be done as a Promise.resolve() to allow
     // credentials#getOrgId() to properly throw.
@@ -1317,11 +1345,18 @@ const Services = WebexPlugin.extend({
         .then(() => {
           // Validate if the token is authorized.
           if (credentials.canAuthorize) {
-            // Attempt to collect the postauth catalog.
-            return this.updateServices({forceRefresh: refresh}).catch(() => {
-              this.initFailed = true;
-              this.logger.warn('services: cannot retrieve postauth catalog');
-            });
+            // Attempt to collect the postauth catalog, then mark the catalog
+            // ready. Setting `isReady` here - rather than only in the init
+            // callers - means a slow postauth fetch that loses the gated-init
+            // timeout race still marks the catalog ready once it completes.
+            return this.updateServices({forceRefresh: refresh})
+              .then(() => {
+                catalog.isReady = true;
+              })
+              .catch(() => {
+                this.initFailed = true;
+                this.logger.warn('services: cannot retrieve postauth catalog');
+              });
           }
 
           // Return a resolved promise for consistent return value.
@@ -1330,6 +1365,29 @@ const Services = WebexPlugin.extend({
     );
   },
 
+  /**
+   * Await any in-flight credentials refresh, then flip `services.ready` so
+   * `webex.ready` can fire. Closes the parallel-refresh window: if a credential
+   * refresh is in flight when initial catalog collection settles, we must not
+   * signal ready until the refresh has resolved - otherwise downstream
+   * consumers may observe `canAuthorize`/token state that is about to change
+   * under them.
+   *
+   * @private
+   * @returns {Promise<void>}
+   */
+  async _finalizeReady(): Promise<void> {
+    const {credentials} = this.webex;
+
+    if (credentials && credentials.isRefreshing) {
+      await new Promise<void>((resolve) => {
+        credentials.once('change:isRefreshing', resolve);
+      });
+    }
+
+    this.ready = true;
+  },
+
   /**
    * Initializer
    *
@@ -1341,64 +1399,146 @@ const Services = WebexPlugin.extend({
     const catalog = new ServiceCatalog();
     this._catalogs.set(this.webex, catalog);
 
-    // Listen for configuration changes once.
+    // Listen for configuration changes once. The config is not populated on the
+    // webex instance until the `change:config` event fires, so any decision that
+    // depends on config values (such as the gated-vs-ungated init below) must be
+    // made from within this handler rather than synchronously in `initialize()`.
     this.listenToOnce(this.webex, 'change:config', () => {
       this.initConfig();
+
+      // Feature flag: when enabled, `webex.ready` is blocked until the initial
+      // catalog collection has settled AND any in-flight credentials refresh has
+      // completed. When disabled (the default), preserves the pre-existing
+      // behavior where `webex.ready` fires as soon as `webex.loaded` does and
+      // the catalog is collected out-of-band.
+      const waitForCatalogInit = this.webex.config?.services?.waitForCatalogInit === true;
+
+      if (waitForCatalogInit) {
+        this._initializeCatalogsGated(catalog);
+      } else {
+        // Not gating - immediately mark ready so we do not block webex.ready.
+        this.ready = true;
+        this._initializeCatalogsUngated(catalog);
+      }
     });
+  },
 
+  /**
+   * Original (pre-verified-ready) initialization path. Runs on `webex.ready`
+   * and collects catalogs opportunistically without blocking anything.
+   *
+   * @private
+   * @param {ServiceCatalog} catalog
+   * @returns {void}
+   */
+  _initializeCatalogsUngated(catalog: ServiceCatalog): void {
     // wait for webex instance to be ready before attempting
     // to update the service catalogs
+    this.listenToOnce(this.webex, 'ready', async () => {
+      const warmed = await this._loadCatalogFromCache();
+      if (warmed) {
+        catalog.isReady = true;
+
+        return;
+      }
+      const {supertoken} = this.webex.credentials;
+      // Validate if the supertoken exists.
+      if (supertoken && supertoken.access_token) {
+        // `initServiceCatalogs` marks the catalog ready internally once the
+        // postauth catalog is collected.
+        this.initServiceCatalogs().catch((error) => {
+          this.initFailed = true;
+          this.logger.error(
+            `services: failed to init initial services when credentials available, ${error?.message}`
+          );
+        });
+      } else {
+        const {email} = this.webex.config;
+
+        this.collectPreauthCatalog(email ? {email} : undefined).catch((error) => {
+          this.initFailed = true;
+          this.logger.error(
+            `services: failed to init initial services when no credentials available, ${error?.message}`
+          );
+        });
+      }
+    });
+  },
+
+  /**
+   * Verified-ready initialization path. Blocks `webex.ready` until the initial
+   * catalog fetch has settled (or timed out) AND any in-flight credentials
+   * refresh has completed. Also handles the fresh-login case where OAuth
+   * completes after `loaded` fires.
+   *
+   * @private
+   * @param {ServiceCatalog} catalog
+   * @returns {void}
+   */
+  _initializeCatalogsGated(catalog: ServiceCatalog): void {
+    // Wait for storage to be loaded before attempting to update the service
+    // catalogs. We listen for 'loaded' instead of 'ready' because `services.ready`
+    // now blocks `webex.ready` - listening to 'ready' would deadlock.
     this.listenToOnce(this.webex, 'loaded', async () => {
       const warmed = await this._loadCatalogFromCache();
       if (warmed) {
         catalog.isReady = true;
+        await this._finalizeReady();
 
         return;
       }
       const {supertoken} = this.webex.credentials;
+
+      // Race init against a hard timeout so a hung request never leaves
+      // `services.ready` false forever - that would stall `webex.ready` and
+      // leave consumers waiting on it indefinitely. Timeout is configurable via
+      // `config.services.catalogInitTimeout` (defaults to 15s in config).
+      const initTimeoutMs = this.webex.config?.services?.catalogInitTimeout;
+      const initServiceCatalogsTimeout = new Promise<never>((_, reject) => {
+        setTimeout(
+          () => reject(new Error(`services: init timed out after ${initTimeoutMs}ms`)),
+          initTimeoutMs
+        );
+      });
+
       // Validate if the supertoken exists.
       if (supertoken && supertoken.access_token) {
-        this.initServiceCatalogs()
-          .then(() => {
-            catalog.isReady = true;
-          })
+        // `initServiceCatalogs` marks the catalog ready internally once the
+        // postauth catalog is collected - even if it loses the timeout race
+        // above, so a slow fetch still eventually flips `catalog.isReady`.
+        Promise.race([this.initServiceCatalogs(), initServiceCatalogsTimeout])
           .catch((error) => {
             this.initFailed = true;
             this.logger.error(
               `services: failed to init initial services when credentials available, ${error?.message}`
             );
           })
-          .finally(() => {
-            this.ready = true;
-            this.trigger('services:initialized');
-          });
+          .finally(() => this._finalizeReady());
       } else {
         const {email} = this.webex.config;
 
-        this.collectPreauthCatalog(email ? {email} : undefined)
+        Promise.race([
+          this.collectPreauthCatalog(email ? {email} : undefined),
+          initServiceCatalogsTimeout,
+        ])
           .catch((error) => {
             this.initFailed = true;
             this.logger.error(
               `services: failed to init initial services when no credentials available, ${error?.message}`
             );
           })
-          .finally(() => {
-            this.ready = true;
-            this.trigger('services:initialized');
-          });
-        // Listen for when credentials become available to fetch the full catalog.
-        // This handles fresh login where 'loaded' fires before OAuth completes.
+          .finally(() => this._finalizeReady());
+
+        // Handle fresh login: 'loaded' fires before OAuth completes, so listen
+        // for `canAuthorize` flipping true and then collect the postauth catalog.
         this.listenToOnce(this.webex, 'change:canAuthorize', () => {
           if (this.webex.canAuthorize && !catalog.status.postauth.ready) {
-            this.initServiceCatalogs()
-              .then(() => {
-                catalog.isReady = true;
-              })
-              .catch((error) => {
-                this.logger.error(
-                  `services: failed to init service catalogs after auth, ${error?.message}`
-                );
-              });
+            // `initServiceCatalogs` marks the catalog ready internally.
+            this.initServiceCatalogs().catch((error) => {
+              this.logger.error(
+                `services: failed to init service catalogs after auth, ${error?.message}`
+              );
+            });
           }
         });
       }

package/test/fixtures/activation-email.ts

@@ -0,0 +1,22 @@
+/*!
+ * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.
+ */
+
+import uuid from 'uuid';
+
+/**
+ * Generates a unique test email for user-activation/validation specs.
+ *
+ * The local part is kept short on purpose: for a brand-new self-signup user the
+ * backend derives the "given name" from the email local part, and self-signup
+ * orgs cap the given name at 50 characters. A full UUID would push the local
+ * part to 59 chars and fail with errorCode 100018, so we use 20 hex characters
+ * of entropy (local part = 43 chars).
+ *
+ * @returns {string} e.g. `Collabctg+webex-js-sdk-1a2b3c4d5e6f7a8b9c0d@gmail.com`
+ */
+export function createActivationEmail(): string {
+  return `Collabctg+webex-js-sdk-${uuid.v4().replace(/-/g, '').slice(0, 20)}@gmail.com`;
+}
+
+export default createActivationEmail;

package/test/integration/spec/services/service-catalog.js

@@ -23,12 +23,13 @@ describe('webex-core', () => {
         .then(
           ([user]) =>
             new Promise((resolve) => {
-              webexUser = user;
-              webex = new WebexCore({credentials: user.token});
-              services = webex.internal.services;
-              catalog = services._getCatalog();
-              // Wait for webex ready event before registering device to ensure newMetrics.callDiagnosticMetrics is initialized
-              webex.once('ready', resolve);
+              setTimeout(() => {
+                webexUser = user;
+                webex = new WebexCore({credentials: user.token});
+                services = webex.internal.services;
+                catalog = services._getCatalog();
+                resolve();
+              }, 1000);
             })
         )
         .then(() => webex.internal.device.register())