@webex/webex-core 3.12.0-llmrefactor.1 → 3.12.0-llmrefactor.10

package/test/unit/spec/services/service-catalog.js

@@ -5,6 +5,178 @@
 import {assert} from '@webex/test-helper-chai';
 import MockWebex from '@webex/test-helper-mock-webex';
 import {Services} from '@webex/webex-core';
+import {
+  matchesCatalogUrl,
+  matchesParsedCatalogUrl,
+  parseCatalogUrl,
+} from '../../../../src/lib/services/service-catalog';
+
+describe('matchesCatalogUrl()', () => {
+  describe('origin validation', () => {
+    it('returns true when origins match exactly', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when hosts differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://other.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when catalog host is prefix of candidate host (SECURITY)', () => {
+      // Attack: trusted.example.attacker.com should NOT match trusted.example
+      assert.isFalse(
+        matchesCatalogUrl(
+          'https://trusted.example.attacker.com/activities/id',
+          'https://trusted.example'
+        )
+      );
+    });
+
+    it('returns false when schemes differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('http://example.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when ports differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com:8443/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+  });
+
+  describe('path validation', () => {
+    it('returns true for root path catalog entry', () => {
+      assert.isTrue(matchesCatalogUrl('https://example.com/any/path/here', 'https://example.com/'));
+    });
+
+    it('returns true when paths match exactly', () => {
+      assert.isTrue(matchesCatalogUrl('https://example.com/api/v1', 'https://example.com/api/v1'));
+    });
+
+    it('returns true when candidate path extends catalog path at boundary', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users/123', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns true when catalog path has trailing slash', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users', 'https://example.com/api/v1/')
+      );
+    });
+
+    it('returns false when catalog path is prefix but not at path boundary (SECURITY)', () => {
+      // /api/v1 should NOT match /api/v1extra
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com/api/v1extra/something', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when candidate path does not start with catalog path', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com/other/path', 'https://example.com/api/v1')
+      );
+    });
+  });
+
+  describe('error handling', () => {
+    it('returns false for invalid candidate URL', () => {
+      assert.isFalse(matchesCatalogUrl('not-a-url', 'https://example.com/api'));
+    });
+
+    it('returns false for invalid catalog URL', () => {
+      assert.isFalse(matchesCatalogUrl('https://example.com/api', 'not-a-url'));
+    });
+
+    it('returns false when both URLs are invalid', () => {
+      assert.isFalse(matchesCatalogUrl('not-a-url', 'also-not-a-url'));
+    });
+  });
+});
+
+describe('parseCatalogUrl()', () => {
+  it('returns the origin and pathname for a valid url', () => {
+    assert.deepEqual(parseCatalogUrl('https://example.com/api/v1'), {
+      origin: 'https://example.com',
+      path: '/api/v1',
+    });
+  });
+
+  it('strips a trailing slash from the path', () => {
+    assert.deepEqual(parseCatalogUrl('https://example.com/api/v1/'), {
+      origin: 'https://example.com',
+      path: '/api/v1',
+    });
+  });
+
+  it('normalizes a root url to the "/" path', () => {
+    assert.deepEqual(parseCatalogUrl('https://example.com'), {
+      origin: 'https://example.com',
+      path: '/',
+    });
+  });
+
+  it('returns null for an unparsable url', () => {
+    assert.isNull(parseCatalogUrl('not-a-url'));
+  });
+
+  it('memoizes results, returning the same reference for repeated calls', () => {
+    const first = parseCatalogUrl('https://memoized.example.com/api/v1');
+    const second = parseCatalogUrl('https://memoized.example.com/api/v1');
+
+    assert.strictEqual(first, second);
+  });
+});
+
+describe('matchesParsedCatalogUrl()', () => {
+  it('returns true when the candidate is under the catalog origin and path', () => {
+    assert.isTrue(
+      matchesParsedCatalogUrl(
+        new URL('https://example.com/api/v1/users'),
+        parseCatalogUrl('https://example.com/api/v1')
+      )
+    );
+  });
+
+  it('returns false when origins differ (SECURITY)', () => {
+    assert.isFalse(
+      matchesParsedCatalogUrl(
+        new URL('https://trusted.example.attacker.com/activities/id'),
+        parseCatalogUrl('https://trusted.example')
+      )
+    );
+  });
+
+  it('returns false when the catalog path is not matched at a boundary (SECURITY)', () => {
+    assert.isFalse(
+      matchesParsedCatalogUrl(
+        new URL('https://example.com/api/v1extra/something'),
+        parseCatalogUrl('https://example.com/api/v1')
+      )
+    );
+  });
+
+  it('returns true for a root catalog path', () => {
+    assert.isTrue(
+      matchesParsedCatalogUrl(
+        new URL('https://example.com/any/path'),
+        parseCatalogUrl('https://example.com/')
+      )
+    );
+  });
+
+  it('returns false when the candidate url is missing', () => {
+    assert.isFalse(matchesParsedCatalogUrl(undefined, parseCatalogUrl('https://example.com/api')));
+  });
+
+  it('returns false when the parsed catalog url is null', () => {
+    assert.isFalse(matchesParsedCatalogUrl(new URL('https://example.com/api'), null));
+  });
+});
 
 /* eslint-disable no-underscore-dangle */
 describe('webex-core', () => {
@@ -332,6 +504,109 @@ describe('webex-core', () => {
 
         assert.equal(service, exampleService);
       });
+
+      describe('security: origin validation', () => {
+        it('rejects URLs where the catalog host is a prefix of the candidate host (SECURITY)', () => {
+          // Attack: https://trusted.example.attacker.com should NOT match https://trusted.example
+          const exampleService = {
+            defaultUrl: 'https://trusted.example',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          // Attacker registers trusted.example.attacker.com
+          const attackerUrl = 'https://trusted.example.attacker.com/activities/id';
+          const service = catalog.findServiceUrlFromUrl(attackerUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs with different ports even if host matches', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const differentPortUrl = 'https://example.com:8443/resource/id';
+          const service = catalog.findServiceUrlFromUrl(differentPortUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs with different schemes', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const httpUrl = 'http://example.com/resource/id';
+          const service = catalog.findServiceUrlFromUrl(httpUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs where catalog path is a prefix but not at path boundary', () => {
+          // /api/v1 should NOT match /api/v1extra
+          const exampleService = {
+            defaultUrl: 'https://example.com/api/v1',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const nonBoundaryUrl = 'https://example.com/api/v1extra/something';
+          const service = catalog.findServiceUrlFromUrl(nonBoundaryUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('accepts URLs at exact path boundary', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/api/v1',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const boundaryUrl = 'https://example.com/api/v1/users/123';
+          const service = catalog.findServiceUrlFromUrl(boundaryUrl);
+
+          assert.equal(service, exampleService);
+        });
+
+        it('returns undefined for invalid URLs', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const invalidUrl = 'not-a-valid-url';
+          const service = catalog.findServiceUrlFromUrl(invalidUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('matches root path catalog entries correctly', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const subpathUrl = 'https://example.com/any/path/here';
+          const service = catalog.findServiceUrlFromUrl(subpathUrl);
+
+          assert.equal(service, exampleService);
+        });
+      });
     });
   });
 });

package/test/unit/spec/services/services.js

@@ -149,9 +149,55 @@ describe('webex-core', () => {
         const [, event] = services.listenToOnce.getCall(1).args;
         assert.equal(event, 'ready', 'default path listens on webex ready');
       });
+
+      it('skips preauth catalog collection when skipPreauthCatalogOnUnauthenticated is true and no credentials', async () => {
+        services.webex.config = {
+          ...(services.webex.config || {}),
+          services: {skipPreauthCatalogOnUnauthenticated: true},
+        };
+        services.listenToOnce = sinon.stub();
+        services.collectPreauthCatalog = sinon.stub().returns(Promise.resolve());
+        services.logger.info = sinon.stub();
+
+        services.initialize();
+        services.listenToOnce.getCall(0).args[2]();
+        services.listenToOnce.getCall(1).args[2]();
+        await waitForAsync();
+
+        assert.isFalse(
+          services.collectPreauthCatalog.called,
+          'must not collect preauth catalog while unauthenticated when option is enabled'
+        );
+        assert.isFalse(services.initFailed);
+        sinon.assert.calledWith(
+          services.logger.info,
+          'services: skipping preauth catalog collection while unauthenticated as per the config'
+        );
+      });
+
+      it('still collects preauth catalog when skipPreauthCatalogOnUnauthenticated is false (default)', async () => {
+        services.webex.config = {
+          ...(services.webex.config || {}),
+          services: {skipPreauthCatalogOnUnauthenticated: false},
+        };
+        services.listenToOnce = sinon.stub();
+        services.collectPreauthCatalog = sinon.stub().returns(Promise.resolve());
+
+        services.initialize();
+        services.listenToOnce.getCall(0).args[2]();
+        services.listenToOnce.getCall(1).args[2]();
+        await waitForAsync();
+
+        assert.isTrue(
+          services.collectPreauthCatalog.called,
+          'must collect preauth catalog when option is disabled'
+        );
+      });
     });
 
     describe('#initialize (waitForCatalogInit=true)', () => {
+      let clock;
+
       beforeEach(() => {
         services.webex.config = {
           ...(services.webex.config || {}),
@@ -162,6 +208,15 @@ describe('webex-core', () => {
         // true). We reset here so tests that call initialize() a second time
         // with the flag enabled observe the gated behavior from a clean state.
         services.ready = false;
+        // The gated path schedules a real 15s setTimeout via _makeInitTimeout()
+        // that is not cleared when the init race resolves. Fake only setTimeout/
+        // clearTimeout (leaving setImmediate real so waitForAsync still works)
+        // so restoring in afterEach clears the pending timer and Jest can exit.
+        clock = sinon.useFakeTimers({toFake: ['setTimeout', 'clearTimeout']});
+      });
+
+      afterEach(() => {
+        clock.restore();
       });
 
       it('leaves services.ready=false after initialize (does not flip until finalize)', () => {
@@ -242,7 +297,6 @@ describe('webex-core', () => {
       });
 
       it('flips services.ready=true when init times out', async () => {
-        const clock = sinon.useFakeTimers();
         services.listenToOnce = sinon.stub();
         // Never resolves - the timeout must win the race.
         services.initServiceCatalogs = sinon.stub().returns(new Promise(() => {}));
@@ -259,7 +313,6 @@ describe('webex-core', () => {
         // rejected timeout can propagate through .catch and .finally into
         // _finalizeReady().
         await clock.tickAsync(15_001);
-        clock.restore();
 
         assert.isTrue(services.initFailed);
         assert.isTrue(services.ready);
@@ -382,6 +435,86 @@ describe('webex-core', () => {
       });
     });
 
+    describe('#initialize (waitForCatalogInit=true, skipPreauthCatalogOnUnauthenticated=true)', () => {
+      beforeEach(() => {
+        services.webex.config = {
+          ...(services.webex.config || {}),
+          services: {
+            waitForCatalogInit: true,
+            catalogInitTimeout: 15000,
+            skipPreauthCatalogOnUnauthenticated: true,
+          },
+        };
+        services.ready = false;
+      });
+
+      it('skips preauth catalog collection but still finalizes services.ready when unauthenticated', async () => {
+        services.listenToOnce = sinon.stub();
+        services.collectPreauthCatalog = sinon.stub().returns(Promise.resolve());
+        services.logger.info = sinon.stub();
+
+        services.initialize();
+        services.listenToOnce.getCall(0).args[2]();
+        services.listenToOnce.getCall(1).args[2]();
+        await waitForAsync();
+
+        assert.isFalse(
+          services.collectPreauthCatalog.called,
+          'must not collect preauth catalog while unauthenticated when option is enabled'
+        );
+        assert.isTrue(services.ready, 'must still finalize ready so webex.ready is not stalled');
+        sinon.assert.calledWith(
+          services.logger.info,
+          'services: skipping preauth catalog collection while unauthenticated as per the config'
+        );
+      });
+
+      it('still registers a change:canAuthorize listener when skipping preauth (fresh-login path)', async () => {
+        services.listenToOnce = sinon.stub();
+        services.collectPreauthCatalog = sinon.stub().returns(Promise.resolve());
+        services.initServiceCatalogs = sinon.stub().returns(Promise.resolve());
+
+        services.initialize();
+        const currentCatalog = services._getCatalog();
+        services.listenToOnce.getCall(0).args[2]();
+        services.listenToOnce.getCall(1).args[2]();
+        await waitForAsync();
+
+        const freshLoginCall = services.listenToOnce
+          .getCalls()
+          .find((call) => call.args[1] === 'change:canAuthorize');
+        assert.isDefined(freshLoginCall, 'expected change:canAuthorize listener to be registered');
+
+        services.webex.canAuthorize = true;
+        currentCatalog.status.postauth.ready = false;
+        freshLoginCall.args[2]();
+
+        assert.isTrue(
+          services.initServiceCatalogs.called,
+          'expected postauth catalog init after canAuthorize flips'
+        );
+        await waitForAsync();
+      });
+
+      it('does not schedule an init timeout when skipping preauth (no stray timer/rejection)', async () => {
+        const clock = sinon.useFakeTimers();
+        services.listenToOnce = sinon.stub();
+        services.collectPreauthCatalog = sinon.stub().returns(Promise.resolve());
+        services.logger.error = sinon.stub();
+
+        services.initialize();
+        services.listenToOnce.getCall(0).args[2]();
+        services.listenToOnce.getCall(1).args[2]();
+
+        // Advance well past the configured init timeout; since no timeout was
+        // scheduled in skip mode, no timeout error should ever be logged.
+        await clock.tickAsync(30_000);
+        clock.restore();
+
+        sinon.assert.neverCalledWithMatch(services.logger.error, /services: init timed out/);
+      });
+    });
+
     describe('#_finalizeReady', () => {
       beforeEach(() => {
         // Outer beforeEach construction already ran initialize() (ungated,

package/test/unit/spec/services-v2/service-catalog.ts

@@ -365,6 +365,47 @@ describe('webex-core', () => {
           assert.equal(service, exampleService);
         }
       );
+
+      it('rejects URLs with similar-looking hostnames (SECURITY)', () => {
+        // Attacker URL that looks like a catalog URL but has a different origin
+        const maliciousUrl = 'https://example.com.attacker.com/resource/id';
+
+        const exampleService = {
+          serviceUrls: [{baseUrl: 'https://example.com/resource'}],
+        };
+
+        catalog.serviceGroups.postauth.push(exampleService);
+
+        const service = catalog.findServiceDetailFromUrl(maliciousUrl);
+
+        // Should NOT match - origins are different
+        assert.isUndefined(service);
+      });
+
+      it('rejects URLs where catalog URL is a prefix but not at path boundary', () => {
+        // e.g., /api/v1 should not match /api/v1extra
+        const url = 'https://example.com/resourceextra/id';
+
+        const exampleService = {
+          serviceUrls: [{baseUrl: 'https://example.com/resource'}],
+        };
+
+        catalog.serviceGroups.postauth.push(exampleService);
+
+        const service = catalog.findServiceDetailFromUrl(url);
+
+        assert.isUndefined(service);
+      });
+
+      it('returns undefined for an unparsable url', () => {
+        const exampleService = {
+          serviceUrls: [{baseUrl: 'https://example.com/resource'}],
+        };
+
+        catalog.serviceGroups.postauth.push(exampleService);
+
+        assert.isUndefined(catalog.findServiceDetailFromUrl('not-a-url'));
+      });
     });
   });
 });