@webex/webex-core 3.12.0-next.5 → 3.12.0-next.50

package/src/lib/services-v2/service-catalog.ts

@@ -3,6 +3,8 @@ import AmpState from 'ampersand-state';
 import {union} from 'lodash';
 import ServiceDetail from './service-detail';
 import {IServiceDetail, ServiceGroup} from './types';
+import {matchAllowedDomain, normalizeAllowedDomains} from '../domains';
+import {matchesParsedCatalogUrl, parseCatalogUrl} from '../services/service-catalog';
 
 /**
  * @class
@@ -198,9 +200,17 @@ const ServiceCatalog = AmpState.extend({
   findServiceDetailFromUrl(url: string): IServiceDetail | undefined {
     const serviceDetails = this._getAllServiceDetails();
 
+    let candidateUrl: URL;
+
+    try {
+      candidateUrl = new URL(url);
+    } catch {
+      return undefined;
+    }
+
     return serviceDetails.find(({serviceUrls}) => {
       for (const serviceUrl of serviceUrls) {
-        if (url.startsWith(serviceUrl.baseUrl)) {
+        if (matchesParsedCatalogUrl(candidateUrl, parseCatalogUrl(serviceUrl.baseUrl))) {
           return true;
         }
       }
@@ -210,20 +220,14 @@ const ServiceCatalog = AmpState.extend({
   },
 
   /**
-   * Finds an allowed domain that matches a specific url.
+   * Finds an allowed domain that matches a specific url. The url's hostname
+   * must be the allowed domain itself or a subdomain of it.
    *
    * @param {string} url - The url to match the allowed domains against.
    * @returns {string} - The matching allowed domain.
    */
   findAllowedDomain(url: string): string {
-    try {
-      const urlObj = new URL(url);
-
-      return this.allowedDomains.find((allowedDomain) => urlObj.host.includes(allowedDomain));
-    } catch {
-      // If the URL is invalid or can't be found, return undefined
-      return undefined;
-    }
+    return matchAllowedDomain(url, this.allowedDomains);
   },
 
   /**
@@ -282,7 +286,7 @@ const ServiceCatalog = AmpState.extend({
    * @returns {void}
    */
   setAllowedDomains(allowedDomains: Array<string>): void {
-    this.allowedDomains = [...allowedDomains];
+    this.allowedDomains = normalizeAllowedDomains(allowedDomains);
   },
 
   /**
@@ -291,7 +295,7 @@ const ServiceCatalog = AmpState.extend({
    * @returns {void}
    */
   addAllowedDomains(newAllowedDomains: Array<string>): void {
-    this.allowedDomains = union(this.allowedDomains, newAllowedDomains);
+    this.allowedDomains = union(this.allowedDomains, normalizeAllowedDomains(newAllowedDomains));
   },
 
   /**

package/src/lib/services-v2/services-v2.ts

@@ -7,6 +7,7 @@ import METRICS from '../metrics';
 import ServiceCatalog from './service-catalog';
 import fedRampServices from './service-fed-ramp';
 import {COMMERCIAL_ALLOWED_DOMAINS} from '../constants';
+import {matchesCatalogUrl} from '../services/service-catalog';
 import {
   ActiveServices,
   IServiceCatalog,
@@ -15,6 +16,7 @@ import {
   ServiceHostmap,
   ServiceGroup,
   ServiceHost,
+  ServiceUrl,
   SelectionMeta,
 } from './types';
 
@@ -44,6 +46,22 @@ const Services = WebexPlugin.extend({
     initFailed: ['boolean', false, false],
   },
 
+  session: {
+    /**
+     * Becomes `true` once the initial catalog collection has completed
+     * (successfully or otherwise) and any in-flight credentials refresh has
+     * settled. Blocks `webex.ready` so consumers can rely on `webex.ready`
+     * implying "catalogs populated AND credential state stable".
+     * @instance
+     * @memberof Services
+     * @type {boolean}
+     */
+    ready: {
+      default: false,
+      type: 'boolean',
+    },
+  },
+
   _catalogs: new WeakMap(),
 
   _activeServices: {},
@@ -972,7 +990,9 @@ const Services = WebexPlugin.extend({
 
     const priorityUrl = service.get();
     const defaultUrl = new URL(
-      service.serviceUrls.find((serviceUrl) => url.startsWith(serviceUrl.baseUrl)).baseUrl
+      service.serviceUrls.find((serviceUrl: ServiceUrl) =>
+        matchesCatalogUrl(url, serviceUrl.baseUrl)
+      ).baseUrl
     ).href;
 
     return {
@@ -1219,7 +1239,11 @@ const Services = WebexPlugin.extend({
   ): Promise<object> {
     const service = 'u2c';
     const resource = from ? `/${from}/catalog` : '/catalog';
-    const qs = {...(query || {}), format: 'U2CV2'};
+    const qs = {
+      ...(query || {}),
+      format: 'U2CV2',
+      ...(this.webex.config?.services?.useCatalogOverride && {useCatalogOverride: true}),
+    };
 
     if (forceRefresh) {
       qs.timestamp = new Date().getTime();
@@ -1237,9 +1261,16 @@ const Services = WebexPlugin.extend({
       requestObject.headers = {authorization: token};
     }
 
-    return this.webex.internal.newMetrics.callDiagnosticLatencies
-      .measureLatency(() => this.request(requestObject), 'internal.get.u2c.time')
-      .then(({body}) => this._formatReceivedHostmap(body || {}));
+    const sendRequest = () => this.request(requestObject);
+
+    const responsePromise = this.webex.internal.newMetrics
+      ? this.webex.internal.newMetrics.callDiagnosticLatencies.measureLatency(
+          sendRequest,
+          'internal.get.u2c.time'
+        )
+      : sendRequest();
+
+    return responsePromise.then(({body}) => this._formatReceivedHostmap(body || {}));
   },
 
   /**
@@ -1312,6 +1343,7 @@ const Services = WebexPlugin.extend({
 
     // Destructure the credentials plugin.
     const {credentials} = this.webex;
+    const catalog = this._getCatalog();
 
     // Init a promise chain. Must be done as a Promise.resolve() to allow
     // credentials#getOrgId() to properly throw.
@@ -1324,11 +1356,18 @@ const Services = WebexPlugin.extend({
         .then(() => {
           // Validate if the token is authorized.
           if (credentials.canAuthorize) {
-            // Attempt to collect the postauth catalog.
-            return this.updateServices({forceRefresh: refresh}).catch(() => {
-              this.initFailed = true;
-              this.logger.warn('services: cannot retrieve postauth catalog');
-            });
+            // Attempt to collect the postauth catalog, then mark the catalog
+            // ready. Setting `isReady` here - rather than only in the init
+            // callers - means a slow postauth fetch that loses the gated-init
+            // timeout race still marks the catalog ready once it completes.
+            return this.updateServices({forceRefresh: refresh})
+              .then(() => {
+                catalog.isReady = true;
+              })
+              .catch(() => {
+                this.initFailed = true;
+                this.logger.warn('services: cannot retrieve postauth catalog');
+              });
           }
 
           // Return a resolved promise for consistent return value.
@@ -1337,6 +1376,51 @@ const Services = WebexPlugin.extend({
     );
   },
 
+  /**
+   * Await any in-flight credentials refresh, then flip `services.ready` so
+   * `webex.ready` can fire. Closes the parallel-refresh window: if a credential
+   * refresh is in flight when initial catalog collection settles, we must not
+   * signal ready until the refresh has resolved - otherwise downstream
+   * consumers may observe `canAuthorize`/token state that is about to change
+   * under them.
+   *
+   * @private
+   * @returns {Promise<void>}
+   */
+  async _finalizeReady(): Promise<void> {
+    const {credentials} = this.webex;
+
+    if (credentials && credentials.isRefreshing) {
+      await new Promise<void>((resolve) => {
+        credentials.once('change:isRefreshing', resolve);
+      });
+    }
+
+    this.ready = true;
+  },
+
+  /**
+   * Build a promise that rejects once the catalog init timeout elapses. Race
+   * this against catalog collection so a hung request never leaves
+   * `services.ready` false forever - that would stall `webex.ready` and leave
+   * consumers waiting on it indefinitely. Timeout is configurable via
+   * `config.services.catalogInitTimeout` (defaults to 15s in config). Created
+   * lazily so paths that skip catalog collection never schedule a stray timer.
+   *
+   * @private
+   * @returns {Promise<never>}
+   */
+  _makeInitTimeout(): Promise<never> {
+    const initTimeoutMs = this.webex.config?.services?.catalogInitTimeout;
+
+    return new Promise<never>((_, reject) => {
+      setTimeout(
+        () => reject(new Error(`services: init timed out after ${initTimeoutMs}ms`)),
+        initTimeoutMs
+      );
+    });
+  },
+
   /**
    * Initializer
    *
@@ -1348,11 +1432,39 @@ const Services = WebexPlugin.extend({
     const catalog = new ServiceCatalog();
     this._catalogs.set(this.webex, catalog);
 
-    // Listen for configuration changes once.
+    // Listen for configuration changes once. The config is not populated on the
+    // webex instance until the `change:config` event fires, so any decision that
+    // depends on config values (such as the gated-vs-ungated init below) must be
+    // made from within this handler rather than synchronously in `initialize()`.
     this.listenToOnce(this.webex, 'change:config', () => {
       this.initConfig();
+
+      // Feature flag: when enabled, `webex.ready` is blocked until the initial
+      // catalog collection has settled AND any in-flight credentials refresh has
+      // completed. When disabled (the default), preserves the pre-existing
+      // behavior where `webex.ready` fires as soon as `webex.loaded` does and
+      // the catalog is collected out-of-band.
+      const waitForCatalogInit = this.webex.config?.services?.waitForCatalogInit === true;
+
+      if (waitForCatalogInit) {
+        this._initializeCatalogsGated(catalog);
+      } else {
+        // Not gating - immediately mark ready so we do not block webex.ready.
+        this.ready = true;
+        this._initializeCatalogsUngated(catalog);
+      }
     });
+  },
 
+  /**
+   * Original (pre-verified-ready) initialization path. Runs on `webex.ready`
+   * and collects catalogs opportunistically without blocking anything.
+   *
+   * @private
+   * @param {ServiceCatalog} catalog
+   * @returns {void}
+   */
+  _initializeCatalogsUngated(catalog: ServiceCatalog): void {
     // wait for webex instance to be ready before attempting
     // to update the service catalogs
     this.listenToOnce(this.webex, 'ready', async () => {
@@ -1365,19 +1477,25 @@ const Services = WebexPlugin.extend({
       const {supertoken} = this.webex.credentials;
       // Validate if the supertoken exists.
       if (supertoken && supertoken.access_token) {
-        this.initServiceCatalogs()
-          .then(() => {
-            catalog.isReady = true;
-          })
-          .catch((error) => {
-            this.initFailed = true;
-            this.logger.error(
-              `services: failed to init initial services when credentials available, ${error?.message}`
-            );
-          });
+        // `initServiceCatalogs` marks the catalog ready internally once the
+        // postauth catalog is collected.
+        this.initServiceCatalogs().catch((error) => {
+          this.initFailed = true;
+          this.logger.error(
+            `services: failed to init initial services when credentials available, ${error?.message}`
+          );
+        });
       } else {
         const {email} = this.webex.config;
 
+        if (this.webex.config?.services?.skipPreauthCatalogOnUnauthenticated === true) {
+          this.logger.info(
+            'services: skipping preauth catalog collection while unauthenticated as per the config'
+          );
+
+          return;
+        }
+
         this.collectPreauthCatalog(email ? {email} : undefined).catch((error) => {
           this.initFailed = true;
           this.logger.error(
@@ -1387,6 +1505,85 @@ const Services = WebexPlugin.extend({
       }
     });
   },
+
+  /**
+   * Verified-ready initialization path. Blocks `webex.ready` until the initial
+   * catalog fetch has settled (or timed out) AND any in-flight credentials
+   * refresh has completed. Also handles the fresh-login case where OAuth
+   * completes after `loaded` fires.
+   *
+   * @private
+   * @param {ServiceCatalog} catalog
+   * @returns {void}
+   */
+  _initializeCatalogsGated(catalog: ServiceCatalog): void {
+    // Wait for storage to be loaded before attempting to update the service
+    // catalogs. We listen for 'loaded' instead of 'ready' because `services.ready`
+    // now blocks `webex.ready` - listening to 'ready' would deadlock.
+    this.listenToOnce(this.webex, 'loaded', async () => {
+      const warmed = await this._loadCatalogFromCache();
+      if (warmed) {
+        catalog.isReady = true;
+        await this._finalizeReady();
+
+        return;
+      }
+      const {supertoken} = this.webex.credentials;
+
+      // Validate if the supertoken exists.
+      if (supertoken && supertoken.access_token) {
+        // `initServiceCatalogs` marks the catalog ready internally once the
+        // postauth catalog is collected - even if it loses the timeout race
+        // below, so a slow fetch still eventually flips `catalog.isReady`.
+        Promise.race([this.initServiceCatalogs(), this._makeInitTimeout()])
+          .catch((error) => {
+            this.initFailed = true;
+            this.logger.error(
+              `services: failed to init initial services when credentials available, ${error?.message}`
+            );
+          })
+          .finally(() => this._finalizeReady());
+      } else {
+        const {email} = this.webex.config;
+
+        // Handle fresh login: 'loaded' fires before OAuth completes, so listen
+        // for `canAuthorize` flipping true and then collect the postauth catalog.
+        this.listenToOnce(this.webex, 'change:canAuthorize', () => {
+          if (this.webex.canAuthorize && !catalog.status.postauth.ready) {
+            // `initServiceCatalogs` marks the catalog ready internally.
+            this.initServiceCatalogs().catch((error) => {
+              this.logger.error(
+                `services: failed to init service catalogs after auth, ${error?.message}`
+              );
+            });
+          }
+        });
+
+        if (this.webex.config?.services?.skipPreauthCatalogOnUnauthenticated === true) {
+          // Skip the preauth catalog fetch (it will be collected manually
+          // later), but still finalize `services.ready` so `webex.ready` is not
+          // stalled while unauthenticated. No timeout is created here so there
+          // is no stray timer or unhandled rejection.
+          this.logger.info(
+            'services: skipping preauth catalog collection while unauthenticated as per the config'
+          );
+          this._finalizeReady();
+        } else {
+          Promise.race([
+            this.collectPreauthCatalog(email ? {email} : undefined),
+            this._makeInitTimeout(),
+          ])
+            .catch((error) => {
+              this.initFailed = true;
+              this.logger.error(
+                `services: failed to init initial services when no credentials available, ${error?.message}`
+              );
+            })
+            .finally(() => this._finalizeReady());
+        }
+      }
+    });
+  },
 });
 /* eslint-enable no-underscore-dangle */
 

package/src/webex-core.js

@@ -17,6 +17,7 @@ import AmpState from 'ampersand-state';
 import uuid from 'uuid';
 
 import AuthInterceptor from './interceptors/auth';
+import CatalogUrlInterceptor from './interceptors/catalog-url';
 import NetworkTimingInterceptor from './interceptors/network-timing';
 import PayloadTransformerInterceptor from './interceptors/payload-transformer';
 import RedirectInterceptor from './interceptors/redirect';
@@ -58,6 +59,7 @@ const interceptors = {
   /* eslint-enable no-extra-parens */
   RequestTimingInterceptor: RequestTimingInterceptor.create,
   ServiceInterceptor: undefined,
+  CatalogUrlInterceptor: CatalogUrlInterceptor.create,
   UserAgentInterceptor: UserAgentInterceptor.create,
   ProxyInterceptor: ProxyInterceptor.create,
   WebexUserAgentInterceptor: WebexUserAgentInterceptor.create,
@@ -83,6 +85,7 @@ const preInterceptors = [
   'RequestEventInterceptor',
   'WebexTrackingIdInterceptor',
   'RateLimitInterceptor',
+  'CatalogUrlInterceptor',
 ];
 
 const postInterceptors = [
@@ -393,6 +396,11 @@ const WebexCore = AmpState.extend({
         return ints;
       }
 
+      // CatalogUrlInterceptor is opt-in via config.services.validateCatalogUrls
+      if (key === 'CatalogUrlInterceptor' && this.config.services?.validateCatalogUrls !== true) {
+        return ints;
+      }
+
       ints.push(Reflect.apply(interceptor, this, []));
 
       return ints;

package/test/fixtures/activation-email.ts

@@ -0,0 +1,22 @@
+/*!
+ * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.
+ */
+
+import uuid from 'uuid';
+
+/**
+ * Generates a unique test email for user-activation/validation specs.
+ *
+ * The local part is kept short on purpose: for a brand-new self-signup user the
+ * backend derives the "given name" from the email local part, and self-signup
+ * orgs cap the given name at 50 characters. A full UUID would push the local
+ * part to 59 chars and fail with errorCode 100018, so we use 20 hex characters
+ * of entropy (local part = 43 chars).
+ *
+ * @returns {string} e.g. `Collabctg+webex-js-sdk-1a2b3c4d5e6f7a8b9c0d@gmail.com`
+ */
+export function createActivationEmail(): string {
+  return `Collabctg+webex-js-sdk-${uuid.v4().replace(/-/g, '').slice(0, 20)}@gmail.com`;
+}
+
+export default createActivationEmail;