@webex/webex-core 3.12.0-webex-services-ready.2 → 3.12.0-webex-services-ready.4

package/src/lib/domains.ts

@@ -0,0 +1,94 @@
+import Url from 'url';
+
+import {uniq} from 'lodash';
+
+// Canonicalise a hostname for comparison: lowercase, drop the brackets around
+// an IPv6 literal, and drop leading/trailing dots. DNS treats `Example.com`,
+// `example.com.` and `example.com` as the same name.
+//
+// Node's `url.domainToASCII` looks like the standard way to do this, but the
+// `url` polyfill this package bundles for the browser does not implement it,
+// so it cannot be used here. It also leaves trailing dots in place.
+const normalizeHostname = (value: string): string =>
+  typeof value === 'string'
+    ? value
+        .toLowerCase()
+        .replace(/^\[|\]$/g, '')
+        .replace(/^\.+/, '')
+        .replace(/\.+$/, '')
+    : '';
+
+/**
+ * Canonicalise a list of configured allowed domains, discarding any entry that
+ * is not a usable hostname. Callers normalise on the way in so the stored list
+ * is already canonical, rather than re-deriving it on every request.
+ *
+ * @param {Array<string>} allowedDomains - The configured allowed domains.
+ * @returns {Array<string>} - Normalized, de-duplicated, non-empty entries.
+ */
+export const normalizeAllowedDomains = (allowedDomains: Array<string>): Array<string> =>
+  uniq(
+    (Array.isArray(allowedDomains) ? allowedDomains : []).map(normalizeHostname).filter(Boolean)
+  );
+
+/**
+ * Determine if a hostname is covered by an allowed domain, matching only on DNS
+ * label boundaries, so that a hostname is allowed only when it is the domain
+ * itself or a subdomain of it. Matching on a substring instead would treat
+ * unrelated hostnames that merely contain the domain as allowed.
+ *
+ * @param {string} hostname - Hostname to test. Must not include a port.
+ * @param {string} allowedDomain - The configured allowed domain.
+ * @returns {boolean} - True when the hostname is the domain or a subdomain of it.
+ */
+const hostnameMatchesDomain = (hostname: string, allowedDomain: string): boolean => {
+  // The stored list is normalized on write, but `allowedDomains` is a public
+  // property, so normalize again here rather than trust it.
+  const host = normalizeHostname(hostname);
+  const domain = normalizeHostname(allowedDomain);
+
+  return !!host && !!domain && (host === domain || host.endsWith(`.${domain}`));
+};
+
+/**
+ * Find the allowed domain covering a url, or `undefined` if there is none.
+ *
+ * Parsing lives here rather than in the callers, and deliberately uses both url
+ * parsers, because this check gates an `Authorization` header. The two
+ * transports behind `@webex/http-core` do not use the same url parser: the
+ * browser transport parses per WHATWG, the node transport uses Node's legacy
+ * `Url.parse`, and for some inputs the two resolve different hosts.
+ *
+ * Rather than picking one, require both to agree and fail closed when they do
+ * not, so this check can never authorize a host that differs from the one a
+ * transport would actually connect to. Do not narrow this to a single parser.
+ *
+ * @param {string} url - The url to match the allowed domains against.
+ * @param {Array<string>} allowedDomains - The configured allowed domains.
+ * @returns {string} - The matching allowed domain, or undefined if there is none.
+ */
+export const matchAllowedDomain = (
+  url: string,
+  allowedDomains: Array<string>
+): string | undefined => {
+  let hostname: string;
+  let legacyHostname: string;
+
+  try {
+    ({hostname} = new URL(url));
+    ({hostname: legacyHostname} = Url.parse(url));
+  } catch {
+    // Not a parsable absolute url, so it cannot belong to an allowed domain.
+    return undefined;
+  }
+
+  if (normalizeHostname(hostname) !== normalizeHostname(legacyHostname)) {
+    return undefined;
+  }
+
+  return (allowedDomains || []).find((allowedDomain) =>
+    hostnameMatchesDomain(hostname, allowedDomain)
+  );
+};
+
+export default matchAllowedDomain;

package/src/lib/services/service-catalog.js

@@ -4,6 +4,7 @@ import AmpState from 'ampersand-state';
 
 import {union} from 'lodash';
 import ServiceUrl from './service-url';
+import {matchAllowedDomain, normalizeAllowedDomains} from '../domains';
 
 /* eslint-disable no-underscore-dangle */
 /**
@@ -268,19 +269,14 @@ const ServiceCatalog = AmpState.extend({
   },
 
   /**
-   * Finds an allowed domain that matches a specific url.
+   * Finds an allowed domain that matches a specific url. The url's hostname
+   * must be the allowed domain itself or a subdomain of it.
    *
    * @param {string} url - The url to match the allowed domains against.
    * @returns {string} - The matching allowed domain.
    */
   findAllowedDomain(url) {
-    const urlObj = Url.parse(url);
-
-    if (!urlObj.host) {
-      return undefined;
-    }
-
-    return this.allowedDomains.find((allowedDomain) => urlObj.host.includes(allowedDomain));
+    return matchAllowedDomain(url, this.allowedDomains);
   },
 
   /**
@@ -367,7 +363,7 @@ const ServiceCatalog = AmpState.extend({
    * @returns {void}
    */
   setAllowedDomains(allowedDomains) {
-    this.allowedDomains = [...allowedDomains];
+    this.allowedDomains = normalizeAllowedDomains(allowedDomains);
   },
 
   /**
@@ -376,7 +372,7 @@ const ServiceCatalog = AmpState.extend({
    * @returns {void}
    */
   addAllowedDomains(newAllowedDomains) {
-    this.allowedDomains = union(this.allowedDomains, newAllowedDomains);
+    this.allowedDomains = union(this.allowedDomains, normalizeAllowedDomains(newAllowedDomains));
   },
 
   /**

package/src/lib/services/services.js

@@ -23,12 +23,6 @@ const DEFAULT_CLUSTER_IDENTIFIER =
 const CATALOG_CACHE_KEY_V1 = 'services.v1.u2cHostMap';
 const CATALOG_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
-// Maximum time we will wait for the initial catalog collection before letting
-// `services.ready` (and therefore `webex.ready`) fire anyway. A hung request
-// must never leave the app on a permanent spinner - past this point downstream
-// consumers must fall through to their normal error/login paths.
-const SERVICES_INIT_TIMEOUT_MS = 15_000;
-
 /* eslint-disable no-underscore-dangle */
 /**
  * @class
@@ -1368,6 +1362,7 @@ const Services = WebexPlugin.extend({
 
     // Destructure the credentials plugin.
     const {credentials} = this.webex;
+    const catalog = this._getCatalog();
 
     // Init a promise chain. Must be done as a Promise.resolve() to allow
     // credentials#getOrgId() to properly throw.
@@ -1380,12 +1375,18 @@ const Services = WebexPlugin.extend({
         .then(() => {
           // Validate if the token is authorized.
           if (credentials.canAuthorize) {
-            // Attempt to collect the postauth catalog.
-
-            return this.updateServices().catch(() => {
-              this.initFailed = true;
-              this.logger.warn('services: cannot retrieve postauth catalog');
-            });
+            // Attempt to collect the postauth catalog, then mark the catalog
+            // ready. Setting `isReady` here - rather than only in the init
+            // callers - means a slow postauth fetch that loses the gated-init
+            // timeout race still marks the catalog ready once it completes.
+            return this.updateServices()
+              .then(() => {
+                catalog.isReady = true;
+              })
+              .catch(() => {
+                this.initFailed = true;
+                this.logger.warn('services: cannot retrieve postauth catalog');
+              });
           }
 
           // Return a resolved promise for consistent return value.
@@ -1480,16 +1481,14 @@ const Services = WebexPlugin.extend({
       const {supertoken} = this.webex.credentials;
       // Validate if the supertoken exists.
       if (supertoken && supertoken.access_token) {
-        this.initServiceCatalogs()
-          .then(() => {
-            catalog.isReady = true;
-          })
-          .catch((error) => {
-            this.initFailed = true;
-            this.logger.error(
-              `services: failed to init initial services when credentials available, ${error?.message}`
-            );
-          });
+        // `initServiceCatalogs` marks the catalog ready internally once the
+        // postauth catalog is collected.
+        this.initServiceCatalogs().catch((error) => {
+          this.initFailed = true;
+          this.logger.error(
+            `services: failed to init initial services when credentials available, ${error?.message}`
+          );
+        });
       } else {
         const {email} = this.webex.config;
 
@@ -1529,20 +1528,23 @@ const Services = WebexPlugin.extend({
 
       // Race init against a hard timeout so a hung request never leaves
       // `services.ready` false forever - that would stall `webex.ready` and
-      // leave the app on a permanent spinner.
-      const timeout = new Promise((_, reject) => {
+      // leave consumers waiting on it indefinitely. Timeout is configurable via
+      // `config.services.catalogInitTimeout` (defaults to 15s in config).
+      const initTimeoutMs = this.webex.config?.services?.catalogInitTimeout;
+
+      const initServiceCatalogsTimeout = new Promise((_, reject) => {
         setTimeout(
-          () => reject(new Error(`services: init timed out after ${SERVICES_INIT_TIMEOUT_MS}ms`)),
-          SERVICES_INIT_TIMEOUT_MS
+          () => reject(new Error(`services: init timed out after ${initTimeoutMs}ms`)),
+          initTimeoutMs
         );
       });
 
       // Validate if the supertoken exists.
       if (supertoken && supertoken.access_token) {
-        Promise.race([this.initServiceCatalogs(), timeout])
-          .then(() => {
-            catalog.isReady = true;
-          })
+        // `initServiceCatalogs` marks the catalog ready internally once the
+        // postauth catalog is collected - even if it loses the timeout race
+        // above, so a slow fetch still eventually flips `catalog.isReady`.
+        Promise.race([this.initServiceCatalogs(), initServiceCatalogsTimeout])
           .catch((error) => {
             this.initFailed = true;
             this.logger.error(
@@ -1553,7 +1555,10 @@ const Services = WebexPlugin.extend({
       } else {
         const {email} = this.webex.config;
 
-        Promise.race([this.collectPreauthCatalog(email ? {email} : undefined), timeout])
+        Promise.race([
+          this.collectPreauthCatalog(email ? {email} : undefined),
+          initServiceCatalogsTimeout,
+        ])
           .catch((error) => {
             this.initFailed = true;
             this.logger.error(
@@ -1566,6 +1571,7 @@ const Services = WebexPlugin.extend({
         // for `canAuthorize` flipping true and then collect the postauth catalog.
         this.listenToOnce(this.webex, 'change:canAuthorize', () => {
           if (this.webex.canAuthorize && !catalog.status.postauth.ready) {
+            // `initServiceCatalogs` marks the catalog ready internally.
             this.initServiceCatalogs().catch((error) => {
               this.logger.error(
                 `services: failed to init service catalogs after auth, ${error?.message}`

package/src/lib/services-v2/service-catalog.ts

@@ -3,6 +3,7 @@ import AmpState from 'ampersand-state';
 import {union} from 'lodash';
 import ServiceDetail from './service-detail';
 import {IServiceDetail, ServiceGroup} from './types';
+import {matchAllowedDomain, normalizeAllowedDomains} from '../domains';
 
 /**
  * @class
@@ -210,20 +211,14 @@ const ServiceCatalog = AmpState.extend({
   },
 
   /**
-   * Finds an allowed domain that matches a specific url.
+   * Finds an allowed domain that matches a specific url. The url's hostname
+   * must be the allowed domain itself or a subdomain of it.
    *
    * @param {string} url - The url to match the allowed domains against.
    * @returns {string} - The matching allowed domain.
    */
   findAllowedDomain(url: string): string {
-    try {
-      const urlObj = new URL(url);
-
-      return this.allowedDomains.find((allowedDomain) => urlObj.host.includes(allowedDomain));
-    } catch {
-      // If the URL is invalid or can't be found, return undefined
-      return undefined;
-    }
+    return matchAllowedDomain(url, this.allowedDomains);
   },
 
   /**
@@ -282,7 +277,7 @@ const ServiceCatalog = AmpState.extend({
    * @returns {void}
    */
   setAllowedDomains(allowedDomains: Array<string>): void {
-    this.allowedDomains = [...allowedDomains];
+    this.allowedDomains = normalizeAllowedDomains(allowedDomains);
   },
 
   /**
@@ -291,7 +286,7 @@ const ServiceCatalog = AmpState.extend({
    * @returns {void}
    */
   addAllowedDomains(newAllowedDomains: Array<string>): void {
-    this.allowedDomains = union(this.allowedDomains, newAllowedDomains);
+    this.allowedDomains = union(this.allowedDomains, normalizeAllowedDomains(newAllowedDomains));
   },
 
   /**

package/src/lib/services-v2/services-v2.ts

@@ -32,12 +32,6 @@ const DEFAULT_CLUSTER_IDENTIFIER =
 const CATALOG_CACHE_KEY_V2 = 'services.v2.u2cHostMap';
 const CATALOG_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
-// Maximum time we will wait for the initial catalog collection before letting
-// `services.ready` (and therefore `webex.ready`) fire anyway. A hung request
-// must never leave the app on a permanent spinner - past this point downstream
-// consumers must fall through to their normal error/login paths.
-const SERVICES_INIT_TIMEOUT_MS = 15_000;
-
 /* eslint-disable no-underscore-dangle */
 /**
  * @class
@@ -1241,7 +1235,11 @@ const Services = WebexPlugin.extend({
   ): Promise<object> {
     const service = 'u2c';
     const resource = from ? `/${from}/catalog` : '/catalog';
-    const qs = {...(query || {}), format: 'U2CV2'};
+    const qs = {
+      ...(query || {}),
+      format: 'U2CV2',
+      ...(this.webex.config?.services?.useCatalogOverride && {useCatalogOverride: true}),
+    };
 
     if (forceRefresh) {
       qs.timestamp = new Date().getTime();
@@ -1334,6 +1332,7 @@ const Services = WebexPlugin.extend({
 
     // Destructure the credentials plugin.
     const {credentials} = this.webex;
+    const catalog = this._getCatalog();
 
     // Init a promise chain. Must be done as a Promise.resolve() to allow
     // credentials#getOrgId() to properly throw.
@@ -1346,11 +1345,18 @@ const Services = WebexPlugin.extend({
         .then(() => {
           // Validate if the token is authorized.
           if (credentials.canAuthorize) {
-            // Attempt to collect the postauth catalog.
-            return this.updateServices({forceRefresh: refresh}).catch(() => {
-              this.initFailed = true;
-              this.logger.warn('services: cannot retrieve postauth catalog');
-            });
+            // Attempt to collect the postauth catalog, then mark the catalog
+            // ready. Setting `isReady` here - rather than only in the init
+            // callers - means a slow postauth fetch that loses the gated-init
+            // timeout race still marks the catalog ready once it completes.
+            return this.updateServices({forceRefresh: refresh})
+              .then(() => {
+                catalog.isReady = true;
+              })
+              .catch(() => {
+                this.initFailed = true;
+                this.logger.warn('services: cannot retrieve postauth catalog');
+              });
           }
 
           // Return a resolved promise for consistent return value.
@@ -1438,16 +1444,14 @@ const Services = WebexPlugin.extend({
       const {supertoken} = this.webex.credentials;
       // Validate if the supertoken exists.
       if (supertoken && supertoken.access_token) {
-        this.initServiceCatalogs()
-          .then(() => {
-            catalog.isReady = true;
-          })
-          .catch((error) => {
-            this.initFailed = true;
-            this.logger.error(
-              `services: failed to init initial services when credentials available, ${error?.message}`
-            );
-          });
+        // `initServiceCatalogs` marks the catalog ready internally once the
+        // postauth catalog is collected.
+        this.initServiceCatalogs().catch((error) => {
+          this.initFailed = true;
+          this.logger.error(
+            `services: failed to init initial services when credentials available, ${error?.message}`
+          );
+        });
       } else {
         const {email} = this.webex.config;
 
@@ -1487,20 +1491,22 @@ const Services = WebexPlugin.extend({
 
       // Race init against a hard timeout so a hung request never leaves
       // `services.ready` false forever - that would stall `webex.ready` and
-      // leave the app on a permanent spinner.
-      const timeout = new Promise<never>((_, reject) => {
+      // leave consumers waiting on it indefinitely. Timeout is configurable via
+      // `config.services.catalogInitTimeout` (defaults to 15s in config).
+      const initTimeoutMs = this.webex.config?.services?.catalogInitTimeout;
+      const initServiceCatalogsTimeout = new Promise<never>((_, reject) => {
         setTimeout(
-          () => reject(new Error(`services: init timed out after ${SERVICES_INIT_TIMEOUT_MS}ms`)),
-          SERVICES_INIT_TIMEOUT_MS
+          () => reject(new Error(`services: init timed out after ${initTimeoutMs}ms`)),
+          initTimeoutMs
         );
       });
 
       // Validate if the supertoken exists.
       if (supertoken && supertoken.access_token) {
-        Promise.race([this.initServiceCatalogs(), timeout])
-          .then(() => {
-            catalog.isReady = true;
-          })
+        // `initServiceCatalogs` marks the catalog ready internally once the
+        // postauth catalog is collected - even if it loses the timeout race
+        // above, so a slow fetch still eventually flips `catalog.isReady`.
+        Promise.race([this.initServiceCatalogs(), initServiceCatalogsTimeout])
           .catch((error) => {
             this.initFailed = true;
             this.logger.error(
@@ -1511,7 +1517,10 @@ const Services = WebexPlugin.extend({
       } else {
         const {email} = this.webex.config;
 
-        Promise.race([this.collectPreauthCatalog(email ? {email} : undefined), timeout])
+        Promise.race([
+          this.collectPreauthCatalog(email ? {email} : undefined),
+          initServiceCatalogsTimeout,
+        ])
           .catch((error) => {
             this.initFailed = true;
             this.logger.error(
@@ -1524,6 +1533,7 @@ const Services = WebexPlugin.extend({
         // for `canAuthorize` flipping true and then collect the postauth catalog.
         this.listenToOnce(this.webex, 'change:canAuthorize', () => {
           if (this.webex.canAuthorize && !catalog.status.postauth.ready) {
+            // `initServiceCatalogs` marks the catalog ready internally.
             this.initServiceCatalogs().catch((error) => {
               this.logger.error(
                 `services: failed to init service catalogs after auth, ${error?.message}`

package/test/fixtures/activation-email.ts

@@ -0,0 +1,22 @@
+/*!
+ * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.
+ */
+
+import uuid from 'uuid';
+
+/**
+ * Generates a unique test email for user-activation/validation specs.
+ *
+ * The local part is kept short on purpose: for a brand-new self-signup user the
+ * backend derives the "given name" from the email local part, and self-signup
+ * orgs cap the given name at 50 characters. A full UUID would push the local
+ * part to 59 chars and fail with errorCode 100018, so we use 20 hex characters
+ * of entropy (local part = 43 chars).
+ *
+ * @returns {string} e.g. `Collabctg+webex-js-sdk-1a2b3c4d5e6f7a8b9c0d@gmail.com`
+ */
+export function createActivationEmail(): string {
+  return `Collabctg+webex-js-sdk-${uuid.v4().replace(/-/g, '').slice(0, 20)}@gmail.com`;
+}
+
+export default createActivationEmail;

package/test/integration/spec/services/service-catalog.js

@@ -23,12 +23,13 @@ describe('webex-core', () => {
         .then(
           ([user]) =>
             new Promise((resolve) => {
-              webexUser = user;
-              webex = new WebexCore({credentials: user.token});
-              services = webex.internal.services;
-              catalog = services._getCatalog();
-              // Wait for webex ready event before registering device to ensure newMetrics.callDiagnosticMetrics is initialized
-              webex.once('ready', resolve);
+              setTimeout(() => {
+                webexUser = user;
+                webex = new WebexCore({credentials: user.token});
+                services = webex.internal.services;
+                catalog = services._getCatalog();
+                resolve();
+              }, 1000);
             })
         )
         .then(() => webex.internal.device.register())

package/test/integration/spec/services/services.js

@@ -20,6 +20,7 @@ import WebexCore, {
 import testUsers from '@webex/test-helper-test-users';
 import uuid from 'uuid';
 import sinon from 'sinon';
+import {createActivationEmail} from '../../../fixtures/activation-email';
 
 /* eslint-disable no-underscore-dangle */
 describe('webex-core', () => {
@@ -408,11 +409,13 @@ describe('webex-core', () => {
         services._loadCatalogFromCache = sinon.stub().resolves(false);
         services.initServiceCatalogs = sinon.stub().resolves();
         services.initialize();
+        // The mode-specific ('ready'/'loaded') listener is registered inside the
+        // change:config handler, so fire change:config first, then 'ready'.
+        webex.trigger('change:config');
         webex.trigger('ready');
         // Wait for the async 'ready' handler to complete
         await new Promise((resolve) => setTimeout(resolve, 50));
         assert.called(services.initServiceCatalogs);
-        assert.isTrue(catalog.isReady);
       });
 
       it('should collect different catalogs based on OrgId region', () =>
@@ -925,7 +928,7 @@ describe('webex-core', () => {
 
       it('validates a non-existing user', () =>
         unauthServices
-          .validateUser({email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`})
+          .validateUser({email: createActivationEmail()})
           .then((r) => {
             assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
             assert.equal(r.activated, false);
@@ -938,7 +941,7 @@ describe('webex-core', () => {
       it('validates new user with activationOptions suppressEmail false', () =>
         unauthServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: false},
           })
           .then((r) => {
@@ -954,7 +957,7 @@ describe('webex-core', () => {
       it('validates new user with activationOptions suppressEmail true', () =>
         unauthServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: true},
           })
           .then((r) => {
@@ -1010,7 +1013,7 @@ describe('webex-core', () => {
 
         return unauthServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: true},
           })
           .then(() => {
@@ -1024,7 +1027,7 @@ describe('webex-core', () => {
 
         return unauthServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: true},
             preloginUserId,
           })
@@ -1041,7 +1044,7 @@ describe('webex-core', () => {
 
         return unauthServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: true},
           })
           .then(() => {
@@ -1064,7 +1067,7 @@ describe('webex-core', () => {
 
         return userOnboardingServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: true},
           })
           .then(() => {

package/test/integration/spec/services-v2/services-v2.js

@@ -25,6 +25,7 @@ import {
   formattedServiceHostmapEntryTest,
   serviceHostmapV2,
 } from '../../../fixtures/host-catalog-v2';
+import {createActivationEmail} from '../../../fixtures/activation-email';
 
 // /* eslint-disable no-underscore-dangle */
 describe('webex-core', () => {
@@ -320,11 +321,13 @@ describe('webex-core', () => {
         services._loadCatalogFromCache = sinon.stub().resolves(false);
         services.initServiceCatalogs = sinon.stub().resolves();
         services.initialize();
+        // The mode-specific ('ready'/'loaded') listener is registered inside the
+        // change:config handler, so fire change:config first, then 'ready'.
+        webex.trigger('change:config');
         webex.trigger('ready');
         // Wait for the async 'ready' handler to complete
         await new Promise((resolve) => setTimeout(resolve, 50));
         assert.called(services.initServiceCatalogs);
-        assert.isTrue(catalog.isReady);
       });
 
       it('should collect different catalogs based on OrgId region', () =>
@@ -848,7 +851,7 @@ describe('webex-core', () => {
 
       it('validates a non-existing user', () =>
         unauthServices
-          .validateUser({email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`})
+          .validateUser({email: createActivationEmail()})
           .then((r) => {
             assert.hasAllKeys(r, ['activated', 'exists', 'user', 'details']);
             assert.equal(r.activated, false);
@@ -858,7 +861,7 @@ describe('webex-core', () => {
       it('validates new user with activationOptions suppressEmail false', () =>
         unauthServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: false},
           })
           .then((r) => {
@@ -871,7 +874,7 @@ describe('webex-core', () => {
       it('validates new user with activationOptions suppressEmail true', () =>
         unauthServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: true},
           })
           .then((r) => {
@@ -915,7 +918,7 @@ describe('webex-core', () => {
 
         return unauthServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: true},
           })
           .then(() => {
@@ -929,7 +932,7 @@ describe('webex-core', () => {
 
         return unauthServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: true},
             preloginUserId,
           })
@@ -946,7 +949,7 @@ describe('webex-core', () => {
 
         return unauthServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: true},
           })
           .then(() => {
@@ -969,7 +972,7 @@ describe('webex-core', () => {
 
         return userOnboardingServices
           .validateUser({
-            email: `Collabctg+webex-js-sdk-${uuid.v4()}@gmail.com`,
+            email: createActivationEmail(),
             activationOptions: {suppressEmail: true},
           })
           .then(() => {