fix(authorization): set supertoken after authorization success

[xinhyao]

COMPLETES #SPARK-591039

This pull request addresses

https://jira-eng-gpk2.cisco.com/jira/browse/SPARK-591039

by making the following changes

After the user is authorized successfully, a super token needs to be set so that the user can complete the QR code joining process

Change Type

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Tooling change
• Internal code refactor

The following scenarios were tested

< ENUMERATE TESTS PERFORMED, WHETHER MANUAL OR AUTOMATED >

I certified that

• I have read and followed contributing guidelines

• I discussed changes with code owners prior to submitting this pull request

• I have not skipped any automated checks

• All existing and new tests passed

• I have updated the documentation accordingly

---

Make sure to have followed the contributing guidelines before submitting.

Summary by CodeRabbit

• New Features

  • Enhanced QR code login process with improved token management and error handling.
  • Added checks to ensure valid authorization codes are provided before proceeding with token requests.

• Bug Fixes

  • Improved handling of simultaneous polling requests for QR code login.

• Tests

  • Expanded test coverage for authorization processes, including error handling and state management.
  • Introduced new assertions and spies to monitor credential management during authorization.

[coderabbitai]

Warning

There were issues while running some tools. Please review the errors and either fix the tool’s configuration or disable the tool if it’s a critical failure.

🔧 eslint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

warning [email protected]: This version is no longer supported. Please see https://eslint.org/version-support for other options.
warning eslint > @humanwhocodes/[email protected]: Use @eslint/config-array instead
warning eslint > @humanwhocodes/config-array > @humanwhocodes/[email protected]: Use @eslint/object-schema instead
warning eslint > file-entry-cache > flat-cache > [email protected]: Rimraf versions prior to v4 are no longer supported
warning eslint > file-entry-cache > flat-cache > rimraf > [email protected]: Glob versions prior to v9 are no longer supported
warning eslint > file-entry-cache > flat-cache > rimraf > glob > [email protected]: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
warning eslint-import-resolver-typescript > [email protected]: Glob versions prior to v9 are no longer supported
warning [email protected]: Glob versions prior to v9 are no longer supported
warning intern > [email protected]: Glob versions prior to v9 are no longer supported
warning intern > glob > [email protected]: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
warning jasmine > [email protected]: Glob versions prior to v9 are no longer supported
warning jest > @jest/core > jest-config > [email protected]: Glob versions prior to v9 are no longer supported
warning jest > @jest/core > jest-runtime > [email protected]: Glob versions prior to v9 are no longer supported
warning jest > @jest/core > @jest/reporters > [email protected]: Glob versions prior to v9 are no longer supported
warning jest > @jest/core > @jest/transform > babel-plugin-istanbul > test-exclude > [email protected]: Glob versions prior to v9 are no longer supported
warning mocha > [email protected]: Glob versions prior to v9 are no longer supported
warning mocha > glob > [email protected]: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
warning [email protected]: 16.1.1
warning wd > [email protected]: request has been deprecated, see request/request#3142
warning wd > [email protected]: You or someone you depend on is using Q, the JavaScript Promise library that gave JavaScript developers strong feelings about promises. They can almost certainly migrate to the native JavaScript promise now. Thank you literally everyone for joining me in this bet against the odds. Be excellent to each other.

(For a CapTP with native promises, see @endo/eventual-send and @endo/captp)
warning wd > archiver > [email protected]: Glob versions prior to v9 are no longer supported
warning wd > request > [email protected]: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
warning wd > request > [email protected]: this library is no longer supported
warning wd > archiver > archiver-utils > [email protected]: Glob versions prior to v9 are no longer supported
warning @babel/cli > [email protected]: Glob versions prior to v9 are no longer supported
warning @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-async-generator-functions instead.
warning @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
warning @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-export-namespace-from instead.
warning @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-nullish-coalescing-operator instead.
warning @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-object-rest-spread instead.
warning @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-optional-chaining instead.
warning @babel/[email protected]: 🚨 This package has been deprecated in favor of separate inclusion of a polyfill and regenerator-runtime (when needed). See the @babel/polyfill docs (https://babeljs.io/docs/en/babel-polyfill) for more information.
warning @babel/polyfill > [email protected]: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
warning @babel/runtime-corejs2 > [email protected]: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
warning babel-plugin-lodash > [email protected]: Glob versions prior to v9 are no longer supported
warning workspace-aggregator-b842e7dc-b4c4-437b-b773-58cd84ce4c0d > [email protected]: This version is no longer supported. Please see https://eslint.org/version-support for other options.
warning workspace-aggregator-b842e7dc-b4c4-437b-b773-58cd84ce4c0d > [email protected]: Glob versions prior to v9 are no longer supported
warning workspace-aggregator-b842e7dc-b4c4-437b-b773-58cd84ce4c0d > [email protected]: 16.1.1
warning workspace-aggregator-b842e7dc-b4c4-437b-b773-58cd84ce4c0d > @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-async-generator-functions instead.
warning workspace-aggregator-b842e7dc-b4c4-437b-b773-58cd84ce4c0d > @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
warning workspace-aggregator-b842e7dc-b4c4-437b-b773-58cd84ce4c0d > @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-export-namespace-from instead.
warning workspace-aggregator-b842e7dc-b4c4-437b-b773-58cd84ce4c0d > @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-nullish-coalescing-operator instead.
warning workspace-aggregator-b842e7dc-b4c4-437b-b773-58cd84ce4c0d > @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-object-rest-spread instead.
warning workspace-aggregator-b842e7dc-b4c4-437b-b773-58cd84ce4c0d > @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-optional-chaining instead.
warning workspace-aggregator-b842e7dc-b4c4-437b-b773-58cd84ce4c0d > @babel/[email protected]: 🚨 This package has been deprecated in favor of separate inclusion of a polyfill and regenerator-runtime (when needed). See the @babel/polyfill docs (https://babeljs.io/docs/en/babel-polyfill) for more information.
error [email protected]: The engine "node" is incompatible with this module. Expected version "^14 || ^16 || ^17 || ^18 || ^19". Got "22.9.0"
error Found incompatible module.

Walkthrough

The changes involve updates to the AuthorizationBrowserFirstParty class in the authorization.js file, enhancing the handling of QR code login and authorization code grants. Key modifications include setting a supertoken upon successful polling, improved error handling for missing authorization codes, and preventing multiple polling requests. The corresponding test suite has been updated with new assertions and spies to ensure robust testing of these features, particularly in error scenarios and state management.

Changes

File	Change Summary
packages/@webex/plugin-authorization-browser-first-party/src/authorization.js	- Updated _startQRCodePolling to set supertoken after successful polling. - Enhanced error handling in requestAuthorizationCodeGrant for missing authorization codes. - Modified initQRCodeLogin to prevent multiple polling requests.
packages/@webex/plugin-authorization-browser-first-party/test/unit/spec/authorization.js	- Added assertions and spies to improve monitoring of function calls. - Refined error handling tests for authorization code exchanges. - Expanded tests for organization ID extraction and state parameter management.

Possibly related PRs

• feat(automotive): qr code login flow for automotive app  #3974: This PR introduces enhancements to the QR code login flow, including modifications to the _startQRCodePolling method, which is directly related to the changes made in the main PR regarding QR code polling and authorization.
• fix: too fast polling #4007: This PR refactors the polling logic in the _startQRCodePolling method to handle server responses better, which aligns with the main PR's updates to error handling and polling management.
• fix(automotive): qr code for launching webex app #4012: This PR adds a new method _generateQRCodeVerificationUrl and modifies the initQRCodeLogin method, which is relevant to the changes in the main PR that also involve updates to the initQRCodeLogin method and QR code handling.

Suggested labels

validated

Suggested reviewers

• maxinteger
• sreenara

🐇 In the realm of code, we hop and play,
With tokens and logins, we brighten the day.
A QR dance, so swift and neat,
Error handling now can’t be beat!
Let’s celebrate with joy and cheer,
For a smoother flow, we hold dear! 🌟

---

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL

📥 Commits

Reviewing files that changed from the base of the PR and between d545259 and a0ed18b.

📒 Files selected for processing (2)

• packages/@webex/plugin-authorization-browser-first-party/src/authorization.js (1 hunks)
• packages/@webex/plugin-authorization-browser-first-party/test/unit/spec/authorization.js (4 hunks)

🔇 Additional comments (3)

packages/@webex/plugin-authorization-browser-first-party/src/authorization.js (1)

437-437: LGTM: Properly setting supertoken after QR code authorization success.

The change ensures that credentials are properly set in the Webex instance after successful QR code-based device authorization. This aligns with the standard authorization flow where credentials need to be persisted after successful authentication.

Let's verify that the supertoken is being set consistently across all authorization flows:

packages/@webex/plugin-authorization-browser-first-party/test/unit/spec/authorization.js (2)

602-602: LGTM: Added test coverage for supertoken setting.

The test properly verifies that credentials are set exactly once after successful QR code authorization.

Also applies to: 621-621

---

713-714: LGTM: Added test coverage for slow_down scenario.

The test ensures that credentials are still properly set even when the server requests a slow down in polling frequency.

Also applies to: 726-726

---

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR. (Experiment)
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[aws-amplify-us-east-2]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-4026.d3m3l2kee0btzx.amplifyapp.com