@webex/webex-core 3.12.0-auth-prejoin-fetch.1 → 3.12.0-llmrefactor.10

package/test/unit/spec/services/service-catalog.js

@@ -5,6 +5,178 @@
 import {assert} from '@webex/test-helper-chai';
 import MockWebex from '@webex/test-helper-mock-webex';
 import {Services} from '@webex/webex-core';
+import {
+  matchesCatalogUrl,
+  matchesParsedCatalogUrl,
+  parseCatalogUrl,
+} from '../../../../src/lib/services/service-catalog';
+
+describe('matchesCatalogUrl()', () => {
+  describe('origin validation', () => {
+    it('returns true when origins match exactly', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when hosts differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://other.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when catalog host is prefix of candidate host (SECURITY)', () => {
+      // Attack: trusted.example.attacker.com should NOT match trusted.example
+      assert.isFalse(
+        matchesCatalogUrl(
+          'https://trusted.example.attacker.com/activities/id',
+          'https://trusted.example'
+        )
+      );
+    });
+
+    it('returns false when schemes differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('http://example.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when ports differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com:8443/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+  });
+
+  describe('path validation', () => {
+    it('returns true for root path catalog entry', () => {
+      assert.isTrue(matchesCatalogUrl('https://example.com/any/path/here', 'https://example.com/'));
+    });
+
+    it('returns true when paths match exactly', () => {
+      assert.isTrue(matchesCatalogUrl('https://example.com/api/v1', 'https://example.com/api/v1'));
+    });
+
+    it('returns true when candidate path extends catalog path at boundary', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users/123', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns true when catalog path has trailing slash', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users', 'https://example.com/api/v1/')
+      );
+    });
+
+    it('returns false when catalog path is prefix but not at path boundary (SECURITY)', () => {
+      // /api/v1 should NOT match /api/v1extra
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com/api/v1extra/something', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when candidate path does not start with catalog path', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com/other/path', 'https://example.com/api/v1')
+      );
+    });
+  });
+
+  describe('error handling', () => {
+    it('returns false for invalid candidate URL', () => {
+      assert.isFalse(matchesCatalogUrl('not-a-url', 'https://example.com/api'));
+    });
+
+    it('returns false for invalid catalog URL', () => {
+      assert.isFalse(matchesCatalogUrl('https://example.com/api', 'not-a-url'));
+    });
+
+    it('returns false when both URLs are invalid', () => {
+      assert.isFalse(matchesCatalogUrl('not-a-url', 'also-not-a-url'));
+    });
+  });
+});
+
+describe('parseCatalogUrl()', () => {
+  it('returns the origin and pathname for a valid url', () => {
+    assert.deepEqual(parseCatalogUrl('https://example.com/api/v1'), {
+      origin: 'https://example.com',
+      path: '/api/v1',
+    });
+  });
+
+  it('strips a trailing slash from the path', () => {
+    assert.deepEqual(parseCatalogUrl('https://example.com/api/v1/'), {
+      origin: 'https://example.com',
+      path: '/api/v1',
+    });
+  });
+
+  it('normalizes a root url to the "/" path', () => {
+    assert.deepEqual(parseCatalogUrl('https://example.com'), {
+      origin: 'https://example.com',
+      path: '/',
+    });
+  });
+
+  it('returns null for an unparsable url', () => {
+    assert.isNull(parseCatalogUrl('not-a-url'));
+  });
+
+  it('memoizes results, returning the same reference for repeated calls', () => {
+    const first = parseCatalogUrl('https://memoized.example.com/api/v1');
+    const second = parseCatalogUrl('https://memoized.example.com/api/v1');
+
+    assert.strictEqual(first, second);
+  });
+});
+
+describe('matchesParsedCatalogUrl()', () => {
+  it('returns true when the candidate is under the catalog origin and path', () => {
+    assert.isTrue(
+      matchesParsedCatalogUrl(
+        new URL('https://example.com/api/v1/users'),
+        parseCatalogUrl('https://example.com/api/v1')
+      )
+    );
+  });
+
+  it('returns false when origins differ (SECURITY)', () => {
+    assert.isFalse(
+      matchesParsedCatalogUrl(
+        new URL('https://trusted.example.attacker.com/activities/id'),
+        parseCatalogUrl('https://trusted.example')
+      )
+    );
+  });
+
+  it('returns false when the catalog path is not matched at a boundary (SECURITY)', () => {
+    assert.isFalse(
+      matchesParsedCatalogUrl(
+        new URL('https://example.com/api/v1extra/something'),
+        parseCatalogUrl('https://example.com/api/v1')
+      )
+    );
+  });
+
+  it('returns true for a root catalog path', () => {
+    assert.isTrue(
+      matchesParsedCatalogUrl(
+        new URL('https://example.com/any/path'),
+        parseCatalogUrl('https://example.com/')
+      )
+    );
+  });
+
+  it('returns false when the candidate url is missing', () => {
+    assert.isFalse(matchesParsedCatalogUrl(undefined, parseCatalogUrl('https://example.com/api')));
+  });
+
+  it('returns false when the parsed catalog url is null', () => {
+    assert.isFalse(matchesParsedCatalogUrl(new URL('https://example.com/api'), null));
+  });
+});
 
 /* eslint-disable no-underscore-dangle */
 describe('webex-core', () => {
@@ -332,6 +504,109 @@ describe('webex-core', () => {
 
         assert.equal(service, exampleService);
       });
+
+      describe('security: origin validation', () => {
+        it('rejects URLs where the catalog host is a prefix of the candidate host (SECURITY)', () => {
+          // Attack: https://trusted.example.attacker.com should NOT match https://trusted.example
+          const exampleService = {
+            defaultUrl: 'https://trusted.example',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          // Attacker registers trusted.example.attacker.com
+          const attackerUrl = 'https://trusted.example.attacker.com/activities/id';
+          const service = catalog.findServiceUrlFromUrl(attackerUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs with different ports even if host matches', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const differentPortUrl = 'https://example.com:8443/resource/id';
+          const service = catalog.findServiceUrlFromUrl(differentPortUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs with different schemes', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const httpUrl = 'http://example.com/resource/id';
+          const service = catalog.findServiceUrlFromUrl(httpUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs where catalog path is a prefix but not at path boundary', () => {
+          // /api/v1 should NOT match /api/v1extra
+          const exampleService = {
+            defaultUrl: 'https://example.com/api/v1',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const nonBoundaryUrl = 'https://example.com/api/v1extra/something';
+          const service = catalog.findServiceUrlFromUrl(nonBoundaryUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('accepts URLs at exact path boundary', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/api/v1',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const boundaryUrl = 'https://example.com/api/v1/users/123';
+          const service = catalog.findServiceUrlFromUrl(boundaryUrl);
+
+          assert.equal(service, exampleService);
+        });
+
+        it('returns undefined for invalid URLs', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const invalidUrl = 'not-a-valid-url';
+          const service = catalog.findServiceUrlFromUrl(invalidUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('matches root path catalog entries correctly', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const subpathUrl = 'https://example.com/any/path/here';
+          const service = catalog.findServiceUrlFromUrl(subpathUrl);
+
+          assert.equal(service, exampleService);
+        });
+      });
     });
   });
 });

package/test/unit/spec/services-v2/service-catalog.ts

@@ -365,6 +365,47 @@ describe('webex-core', () => {
           assert.equal(service, exampleService);
         }
       );
+
+      it('rejects URLs with similar-looking hostnames (SECURITY)', () => {
+        // Attacker URL that looks like a catalog URL but has a different origin
+        const maliciousUrl = 'https://example.com.attacker.com/resource/id';
+
+        const exampleService = {
+          serviceUrls: [{baseUrl: 'https://example.com/resource'}],
+        };
+
+        catalog.serviceGroups.postauth.push(exampleService);
+
+        const service = catalog.findServiceDetailFromUrl(maliciousUrl);
+
+        // Should NOT match - origins are different
+        assert.isUndefined(service);
+      });
+
+      it('rejects URLs where catalog URL is a prefix but not at path boundary', () => {
+        // e.g., /api/v1 should not match /api/v1extra
+        const url = 'https://example.com/resourceextra/id';
+
+        const exampleService = {
+          serviceUrls: [{baseUrl: 'https://example.com/resource'}],
+        };
+
+        catalog.serviceGroups.postauth.push(exampleService);
+
+        const service = catalog.findServiceDetailFromUrl(url);
+
+        assert.isUndefined(service);
+      });
+
+      it('returns undefined for an unparsable url', () => {
+        const exampleService = {
+          serviceUrls: [{baseUrl: 'https://example.com/resource'}],
+        };
+
+        catalog.serviceGroups.postauth.push(exampleService);
+
+        assert.isUndefined(catalog.findServiceDetailFromUrl('not-a-url'));
+      });
     });
   });
 });

package/test/unit/spec/services-v2/services-v2.ts

@@ -896,6 +896,26 @@ describe('webex-core', () => {
       });
     });
 
+    describe('#getServiceFromUrl()', () => {
+      it('matches an exact service URL when the catalog URL has a trailing slash', () => {
+        const baseUrl = 'https://example.com/api/v1/';
+
+        catalog.updateServiceGroups('preauth', [
+          {
+            id: 'example',
+            serviceName: 'example',
+            serviceUrls: [{host: 'example.com', baseUrl, priority: 1}],
+          },
+        ]);
+
+        assert.deepEqual(services.getServiceFromUrl('https://example.com/api/v1'), {
+          name: 'example',
+          priorityUrl: baseUrl,
+          defaultUrl: baseUrl,
+        });
+      });
+    });
+
     describe('#_formatReceivedHostmap()', () => {
       let serviceHostmap;
       let formattedHM;

package/test/unit/spec/webex-core.js

@@ -91,6 +91,30 @@ describe('Webex', () => {
       assert.isFalse(webex.canAuthorize);
     });
 
+    it('initializes network telemetry after applying the configured metrics options', async () => {
+      const configuredWebex = new WebexCore({
+        config: {
+          metrics: {
+            networkTelemetry: {
+              enabled: true,
+              intervalMs: 60 * 1_000,
+            },
+          },
+        },
+      });
+      const submitClientMetrics = sinon
+        .stub(configuredWebex.internal.metrics, 'submitClientMetrics')
+        .resolves();
+
+      assert.exists(configuredWebex.internal.metrics.networkTelemetry);
+      configuredWebex.trigger('request:start', {service: 'hydra', resource: 'rooms'});
+      await configuredWebex.internal.metrics.flushNetworkTelemetry();
+
+      assert.calledOnce(submitClientMetrics);
+
+      await configuredWebex.internal.metrics.stopNetworkTelemetry();
+    });
+
     [
       'data',
       'data.access_token',
@@ -179,7 +203,7 @@ describe('Webex', () => {
 
   describe('initializes with interceptors', () => {
     [
-      // 4 pre, 4 post, 10 remaining default = 18
+      // 4 pre (CatalogUrlInterceptor is opt-in), 4 post, 10 remaining default = 18
       [
         'defaults to existing interceptors if undefined',
         undefined,
@@ -205,6 +229,58 @@ describe('Webex', () => {
           'RateLimitInterceptor',
         ],
       ],
+      [
+        'does not include CatalogUrlInterceptor for a truthy non-boolean value',
+        {services: {validateCatalogUrls: 'true'}},
+        18,
+        [
+          'RequestTimingInterceptor',
+          'RequestEventInterceptor',
+          'WebexTrackingIdInterceptor',
+          'RateLimitInterceptor',
+          'ServiceInterceptor',
+          'UserAgentInterceptor',
+          'ProxyInterceptor',
+          'WebexUserAgentInterceptor',
+          'AuthInterceptor',
+          'PayloadTransformerInterceptor',
+          'RedirectInterceptor',
+          'DefaultOptionsInterceptor',
+          'HostMapInterceptor',
+          'ServerErrorInterceptor',
+          'HttpStatusInterceptor',
+          'NetworkTimingInterceptor',
+          'EmbargoInterceptor',
+          'RateLimitInterceptor',
+        ],
+      ],
+      // CatalogUrlInterceptor is opt-in via services.validateCatalogUrls
+      [
+        'includes CatalogUrlInterceptor when validateCatalogUrls is enabled',
+        {services: {validateCatalogUrls: true}},
+        19,
+        [
+          'RequestTimingInterceptor',
+          'RequestEventInterceptor',
+          'WebexTrackingIdInterceptor',
+          'RateLimitInterceptor',
+          'CatalogUrlInterceptor',
+          'ServiceInterceptor',
+          'UserAgentInterceptor',
+          'ProxyInterceptor',
+          'WebexUserAgentInterceptor',
+          'AuthInterceptor',
+          'PayloadTransformerInterceptor',
+          'RedirectInterceptor',
+          'DefaultOptionsInterceptor',
+          'HostMapInterceptor',
+          'ServerErrorInterceptor',
+          'HttpStatusInterceptor',
+          'NetworkTimingInterceptor',
+          'EmbargoInterceptor',
+          'RateLimitInterceptor',
+        ],
+      ],
       [
         'only adds PayloadTransformerInterceptor',
         {interceptors: {PayloadTransformerInterceptor: PayloadTransformerInterceptor.create}},