@webex/webex-core 3.12.0-next.5 → 3.12.0-next.51

package/test/integration/spec/services-v2/services-v2.js

@@ -5,7 +5,7 @@
 import '@webex/internal-plugin-device';
 
 import {assert} from '@webex/test-helper-chai';
-import {flaky} from '@webex/test-helper-mocha';
+import {flaky, retryOn429} from '@webex/test-helper-mocha';
 import WebexCore, {
   ServiceCatalogV2,
   ServiceDetail,
@@ -25,6 +25,7 @@ import {
   formattedServiceHostmapEntryTest,
   serviceHostmapV2,
 } from '../../../fixtures/host-catalog-v2';
+import {createActivationEmail} from '../../../fixtures/activation-email';
 
 // /* eslint-disable no-underscore-dangle */
 describe('webex-core', () => {
@@ -320,11 +321,13 @@ describe('webex-core', () => {
         services._loadCatalogFromCache = sinon.stub().resolves(false);
         services.initServiceCatalogs = sinon.stub().resolves();
         services.initialize();
+        // The mode-specific ('ready'/'loaded') listener is registered inside the
+        // change:config handler, so fire change:config first, then 'ready'.
+        webex.trigger('change:config');
         webex.trigger('ready');
         // Wait for the async 'ready' handler to complete
         await new Promise((resolve) => setTimeout(resolve, 50));
         assert.called(services.initServiceCatalogs);
-        assert.isTrue(catalog.isReady);
       });
 
       it('should collect different catalogs based on OrgId region', () =>
@@ -341,6 +344,45 @@ describe('webex-core', () => {
           done();
         }, 2000);
       });
+
+      it('blocks webex.ready until services.ready flips when waitForCatalogInit is enabled', async () => {
+        const gatedWebex = new WebexCore({
+          credentials: {supertoken: webexUser.token},
+          config: {services: {waitForCatalogInit: true}},
+        });
+
+        // Before init settles, webex.ready must be false because services.ready
+        // is a dependency and starts false in the gated path.
+        assert.isFalse(gatedWebex.internal.services.ready, 'services.ready should start false');
+        assert.isFalse(
+          gatedWebex.ready,
+          'webex.ready should not fire while services.ready is false'
+        );
+
+        // Wait up to 30s for services init to complete and flip ready.
+        await new Promise((resolve, reject) => {
+          if (gatedWebex.internal.services.ready) {
+            resolve();
+
+            return;
+          }
+          const timer = setTimeout(
+            () => reject(new Error('timed out waiting for services.ready')),
+            30_000
+          );
+
+          gatedWebex.internal.services.once('change:ready', () => {
+            clearTimeout(timer);
+            resolve();
+          });
+        });
+
+        assert.isTrue(
+          gatedWebex.internal.services.ready,
+          'services.ready should flip true after init settles'
+        );
+        assert.isTrue(gatedWebex.ready, 'webex.ready should fire once services.ready flips');
+      });
     });
 
     describe('#initServiceCatalogs()', () => {
@@ -790,18 +832,22 @@ describe('webex-core', () => {
           }));
 
       it('validates an authorized user and webex instance', () =>
-        services.validateUser({email: webexUser.email}).then((r) => {
-          assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-          assert.equal(r.activated, true);
-          assert.equal(r.exists, true);
-        }));
+        retryOn429(() =>
+          services.validateUser({email: webexUser.email}).then((r) => {
+            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+            assert.equal(r.activated, true);
+            assert.equal(r.exists, true);
+          })
+        ));
 
       it('validates an authorized EU user and webex instance', () =>
-        servicesEU.validateUser({email: webexUserEU.email}).then((r) => {
-          assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-          assert.equal(r.activated, true);
-          assert.equal(r.exists, true);
-        }));
+        retryOn429(() =>
+          servicesEU.validateUser({email: webexUserEU.email}).then((r) => {
+            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+            assert.equal(r.activated, true);
+            assert.equal(r.exists, true);
+          })
+        ));
 
       it("returns a rejected promise if the provided email isn't valid", () =>
         unauthServices
@@ -814,113 +860,134 @@ describe('webex-core', () => {
           }));
 
       it('validates a non-existing user', () =>
-        unauthServices
-          .validateUser({email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`})
-          .then((r) => {
+        retryOn429(() =>
+          unauthServices.validateUser({email: createActivationEmail()}).then((r) => {
             assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
             assert.equal(r.activated, false);
             assert.equal(r.exists, false);
-          }));
+          })
+        ));
 
       it('validates new user with activationOptions suppressEmail false', () =>
-        unauthServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: false},
-          })
-          .then((r) => {
-            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-            assert.equal(r.activated, false);
-            assert.equal(r.exists, false);
-            assert.equal(r.user.verificationEmailTriggered, true);
-          }));
+        retryOn429(() =>
+          unauthServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: false},
+            })
+            .then((r) => {
+              assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+              assert.equal(r.activated, false);
+              assert.equal(r.exists, false);
+              assert.equal(r.user.verificationEmailTriggered, true);
+            })
+        ));
 
       it('validates new user with activationOptions suppressEmail true', () =>
-        unauthServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: true},
-          })
-          .then((r) => {
-            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-            assert.equal(r.activated, false);
-            assert.equal(r.exists, false);
-            assert.equal(r.user.verificationEmailTriggered, false);
-          }));
+        retryOn429(() =>
+          unauthServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: true},
+            })
+            .then((r) => {
+              assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+              assert.equal(r.activated, false);
+              assert.equal(r.exists, false);
+              assert.equal(r.user.verificationEmailTriggered, false);
+            })
+        ));
 
       it('validates an inactive user', () => {
         const inactive = 'webex.web.client+nonactivated@gmail.com';
 
-        return unauthServices
-          .validateUser({email: inactive, activationOptions: {suppressEmail: true}})
-          .then((r) => {
-            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-            assert.equal(r.activated, false, 'activated');
-            assert.equal(r.exists, true, 'exists');
-          })
-          .catch(() => {
-            assert(true);
-          });
+        return retryOn429(() =>
+          unauthServices
+            .validateUser({email: inactive, activationOptions: {suppressEmail: true}})
+            .then((r) => {
+              assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+              assert.equal(r.activated, false, 'activated');
+              assert.equal(r.exists, true, 'exists');
+            })
+        ).catch(() => {
+          assert(true);
+        });
       });
 
       it('validates an existing user', () =>
-        unauthServices.validateUser({email: webexUser.email}).then((r) => {
-          assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-          assert.equal(r.activated, true);
-          assert.equal(r.exists, true);
-        }));
+        retryOn429(() =>
+          unauthServices.validateUser({email: webexUser.email}).then((r) => {
+            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+            assert.equal(r.activated, true);
+            assert.equal(r.exists, true);
+          })
+        ));
 
       it('validates an existing EU user', () =>
-        unauthServices.validateUser({email: webexUserEU.email}).then((r) => {
-          assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
-          assert.equal(r.activated, true);
-          assert.equal(r.exists, true);
-        }));
+        retryOn429(() =>
+          unauthServices.validateUser({email: webexUserEU.email}).then((r) => {
+            assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
+            assert.equal(r.activated, true);
+            assert.equal(r.exists, true);
+          })
+        ));
 
       it('sends the prelogin user id as undefined when not specified', () => {
         const requestStub = sandbox.spy(unauthServices, 'request');
 
-        return unauthServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: true},
-          })
-          .then(() => {
-            assert.isUndefined(getActivationRequest(requestStub).headers['x-prelogin-userid']);
-          });
+        return retryOn429(() => {
+          requestStub.resetHistory();
+
+          return unauthServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: true},
+            })
+            .then(() => {
+              assert.isUndefined(getActivationRequest(requestStub).headers['x-prelogin-userid']);
+            });
+        });
       });
 
       it('sends the prelogin user id as provided when specified', () => {
         const requestStub = sandbox.spy(unauthServices, 'request');
         const preloginUserId = uuid.v4();
 
-        return unauthServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: true},
-            preloginUserId,
-          })
-          .then(() => {
-            assert.strictEqual(
-              getActivationRequest(requestStub).headers['x-prelogin-userid'],
-              preloginUserId
-            );
-          });
+        return retryOn429(() => {
+          requestStub.resetHistory();
+
+          return unauthServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: true},
+              preloginUserId,
+            })
+            .then(() => {
+              assert.strictEqual(
+                getActivationRequest(requestStub).headers['x-prelogin-userid'],
+                preloginUserId
+              );
+            });
+        });
       });
 
       it('uses the license service by default', () => {
         const requestStub = sandbox.spy(unauthServices, 'request');
 
-        return unauthServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: true},
-          })
-          .then(() => {
-            const request = getActivationRequest(requestStub, false);
-            assert.strictEqual(request.service, 'license');
-            assert.strictEqual(request.resource, 'users/activations');
-          });
+        return retryOn429(() => {
+          requestStub.resetHistory();
+
+          return unauthServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: true},
+            })
+            .then(() => {
+              const request = getActivationRequest(requestStub, false);
+              assert.strictEqual(request.service, 'license');
+              assert.strictEqual(request.resource, 'users/activations');
+            });
+        });
       });
 
       it('uses the user-onboarding service when useUserOnboardingServiceForActivations config is true', () => {
@@ -934,16 +1001,20 @@ describe('webex-core', () => {
         const userOnboardingServices = userOnboardingWebex.internal.services;
         const requestStub = sandbox.spy(userOnboardingServices, 'request');
 
-        return userOnboardingServices
-          .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
-            activationOptions: {suppressEmail: true},
-          })
-          .then(() => {
-            const request = getActivationRequest(requestStub, true);
-            assert.strictEqual(request.service, 'user-onboarding');
-            assert.strictEqual(request.resource, 'api/v1/users/activations');
-          });
+        return retryOn429(() => {
+          requestStub.resetHistory();
+
+          return userOnboardingServices
+            .validateUser({
+              email: createActivationEmail(),
+              activationOptions: {suppressEmail: true},
+            })
+            .then(() => {
+              const request = getActivationRequest(requestStub, true);
+              assert.strictEqual(request.service, 'user-onboarding');
+              assert.strictEqual(request.resource, 'api/v1/users/activations');
+            });
+        });
       });
     });
 

package/test/unit/spec/credentials/credentials.js

@@ -7,7 +7,7 @@ import {assert} from '@webex/test-helper-chai';
 import sinon from 'sinon';
 import MockWebex from '@webex/test-helper-mock-webex';
 import {Credentials, Token, grantErrors} from '@webex/webex-core';
-import {inBrowser} from '@webex/common';
+import {inBrowser, base64} from '@webex/common';
 import FakeTimers from '@sinonjs/fake-timers';
 import {skipInBrowser} from '@webex/test-helper-mocha';
 import Logger from '@webex/plugin-logger';
@@ -183,6 +183,10 @@ describe('webex-core', () => {
           webex.credentials.buildLoginUrl({state: 'state'});
         }, /if specified, `options.state` must be an object/);
 
+        assert.throws(() => {
+          webex.credentials.buildLoginUrl({state: null});
+        }, /if specified, `options.state` must be an object/);
+
         assert.doesNotThrow(() => {
           webex.credentials.buildLoginUrl({state: {}});
         }, /if specified, `options.state` must be an object/);
@@ -232,6 +236,132 @@ describe('webex-core', () => {
       });
     });
 
+    describe('#buildThirdPartyLoginUrl()', () => {
+      it('throws if both `oauth2provider` and `returnURL` are missing', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.throws(() => {
+          credentials.buildThirdPartyLoginUrl({});
+        }, /`options.oauth2provider` is required/);
+      });
+
+      it('throws if `oauth2provider` is missing', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.throws(() => {
+          credentials.buildThirdPartyLoginUrl({returnURL: 'https://web.webex.com'});
+        }, /`options.oauth2provider` is required/);
+      });
+
+      it('throws if `returnURL` is missing', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.throws(() => {
+          credentials.buildThirdPartyLoginUrl({oauth2provider: 'google'});
+        }, /`options.returnURL` is required/);
+      });
+
+      skipInBrowser(it)('generates the third-party login url', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.equal(
+          credentials.buildThirdPartyLoginUrl({
+            oauth2provider: 'google',
+            returnURL: 'https://web.webex.com',
+          }),
+          `${
+            process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+          }/idb/ThirdPartyLogin?oauth2provider=google&returnURL=https%3A%2F%2Fweb.webex.com`
+        );
+      });
+
+      skipInBrowser(it)('generates the url with different parameter values', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.equal(
+          credentials.buildThirdPartyLoginUrl({
+            oauth2provider: 'apple',
+            returnURL: 'https://example.com/callback',
+          }),
+          `${
+            process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+          }/idb/ThirdPartyLogin?oauth2provider=apple&returnURL=https%3A%2F%2Fexample.com%2Fcallback`
+        );
+      });
+
+      it('throws if `state` is not an object', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        assert.throws(() => {
+          credentials.buildThirdPartyLoginUrl({
+            oauth2provider: 'google',
+            returnURL: 'https://web.webex.com',
+            state: 'not-an-object',
+          });
+        }, /`options.state` must be an object/);
+      });
+
+      skipInBrowser(it)('omits `state` when an empty object is provided', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        const result = credentials.buildThirdPartyLoginUrl({
+          oauth2provider: 'google',
+          returnURL: 'https://web.webex.com',
+          state: {},
+        });
+
+        const parsed = new URL(result);
+
+        assert.isFalse(parsed.searchParams.has('state'));
+      });
+
+      skipInBrowser(it)('base64url-encodes a non-empty `state` and emits it as a top-level query param', () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+
+        webex.trigger('change:config');
+
+        const result = credentials.buildThirdPartyLoginUrl({
+          oauth2provider: 'google',
+          returnURL: 'https://web.webex.com',
+          state: {csrf_token: 'abc', popUpSignIn: true},
+        });
+
+        // Literal base64url of '{"csrf_token":"abc","popUpSignIn":true}'
+        const expectedState = 'eyJjc3JmX3Rva2VuIjoiYWJjIiwicG9wVXBTaWduSW4iOnRydWV9';
+
+        assert.equal(
+          result,
+          `${
+            process.env.IDBROKER_BASE_URL || 'https://idbroker.webex.com'
+          }/idb/ThirdPartyLogin?oauth2provider=google&returnURL=${encodeURIComponent(
+            'https://web.webex.com'
+          )}&state=${expectedState}`
+        );
+      });
+    });
+
     describe('#buildLogoutUrl()', () => {
       skipInBrowser(it)('generates the logout url', () => {
         const webex = new MockWebex();
@@ -368,12 +498,96 @@ describe('webex-core', () => {
       });
 
       it('should throw when provided an invalid token', () =>
-        expect(() => credentials.extractOrgIdFromUserToken()).toThrow('the provided token is not a valid format, token has 1 sections'));
+        expect(() => credentials.extractOrgIdFromUserToken()).toThrow(
+          'the provided token is not a valid format, token has 1 sections'
+        ));
 
       it('should throw when no token is provided', () =>
         expect(() => credentials.extractOrgIdFromUserToken()).toThrow());
     });
 
+    describe('#extractUserIdFromToken()', () => {
+      let credentials;
+      let webex;
+
+      beforeEach(() => {
+        webex = new MockWebex();
+        credentials = new Credentials(undefined, {parent: webex});
+      });
+
+      const buildToken = (payload) =>
+        `header.${base64.toBase64Url(JSON.stringify(payload))}.signature`;
+
+      it('should return the cis_uuid from the provided token', () => {
+        const token = buildToken({cis_uuid: 'my-user-id'});
+
+        assert.equal(credentials.extractUserIdFromToken(token), 'my-user-id');
+      });
+
+      it('should throw if the token does not contain a cis_uuid', () => {
+        const token = buildToken({foo: 'bar'});
+
+        expect(() => credentials.extractUserIdFromToken(token)).toThrow(
+          'the provided token does not contain a user ID'
+        );
+      });
+
+      it('should throw when provided an unparseable token', () =>
+        expect(() => credentials.extractUserIdFromToken('not-a-valid-token')).toThrow());
+
+      it('should throw when no token is provided', () =>
+        expect(() => credentials.extractUserIdFromToken()).toThrow());
+    });
+
+    describe('#getUserId()', () => {
+      let credentials;
+      let webex;
+
+      const buildToken = (userId) =>
+        `header.${base64.toBase64Url(JSON.stringify({cis_uuid: userId}))}.signature`;
+
+      beforeEach(() => {
+        webex = new MockWebex();
+        credentials = new Credentials(undefined, {parent: webex});
+      });
+
+      it('should return the userId from the supertoken', () => {
+        credentials.supertoken = makeToken(webex, {
+          access_token: buildToken('supertoken-user-id'),
+        });
+
+        assert.equal(credentials.getUserId(), 'supertoken-user-id');
+      });
+
+      it('should fall back to a user token when the supertoken has no userId', () => {
+        credentials.supertoken = makeToken(webex, {access_token: 'AT'});
+        credentials.userTokens.add(
+          makeToken(webex, {access_token: buildToken('user-token-user-id'), scope: 'scope1'})
+        );
+
+        assert.equal(credentials.getUserId(), 'user-token-user-id');
+      });
+
+      it('should prefer the supertoken over the user tokens', () => {
+        credentials.supertoken = makeToken(webex, {
+          access_token: buildToken('supertoken-user-id'),
+        });
+        credentials.userTokens.add(
+          makeToken(webex, {access_token: buildToken('user-token-user-id'), scope: 'scope1'})
+        );
+
+        assert.equal(credentials.getUserId(), 'supertoken-user-id');
+      });
+
+      it('should throw if no available token contains a userId', () => {
+        credentials.supertoken = makeToken(webex, {access_token: 'AT'});
+
+        expect(() => credentials.getUserId()).toThrow(
+          'could not extract the user ID from any available token'
+        );
+      });
+    });
+
     describe('#initialize()', () => {
       it('turns a portal auth string into a configuration object', () => {
         const webex = new MockWebex();
@@ -498,6 +712,37 @@ describe('webex-core', () => {
       });
     });
 
+    describe('#getClientToken()', () => {
+      it('requests a client token without bypassing catalog URL validation', async () => {
+        const webex = new MockWebex();
+        const credentials = new Credentials(undefined, {parent: webex});
+        const uri = 'https://idbroker.webex.com/idb/oauth2/v1/access_token';
+        const scope = 'spark:all';
+
+        webex.request.resolves({body: {access_token: 'AT', token_type: 'Bearer'}});
+
+        const token = await credentials.getClientToken({uri, scope});
+
+        assert.calledOnceWithExactly(webex.request, {
+          method: 'POST',
+          uri,
+          form: {
+            grant_type: 'client_credentials',
+            scope,
+            self_contained_token: true,
+          },
+          auth: {
+            user: 'fake',
+            pass: 'fake',
+            sendImmediately: true,
+          },
+          shouldRefreshAccessToken: false,
+        });
+        assert.instanceOf(token, Token);
+        assert.equal(token.access_token, 'AT');
+      });
+    });
+
     describe('#getUserToken()', () => {
       it('resolves with the supertoken if the supertoken matches the requested scopes', () => {
         const webex = new MockWebex();
@@ -799,7 +1044,6 @@ describe('webex-core', () => {
           .then(() => assert.isRejected(webex.boundedStorage.get('Credentials', '@'), /NotFound/));
       });
 
-
       // it('does not induce any token refreshes');
 
       it('prevents #getUserToken() from being invoked', () => {