lex-microsoft_teams 0.5.4 → 0.5.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 050cf6a6703c4b6ee4d636980ee7843a3bc34b27c533d0d1cab0325c9903ca02
-  data.tar.gz: ffb0ca49267fc2f64b1a27c10f25e45099e2d2450839b3ddf8984efe21572d6b
+  metadata.gz: 5dd2ecc48c7eda33072b23d32d9a08947b43d51aaeba49b6b4eb46fb410e8065
+  data.tar.gz: ec8b561ede2e96afe790aad56ecc02c3491117ea26e3bbd2e78a480d214a58d2
 SHA512:
-  metadata.gz: 9f93cdb1ff43c5ff3829f71de8aedca04086cf1a8efed385441a8d0920d39c7a429718e3de6035f734021921d3583ed2004648dc97bd47982cb75d6258baebc7
-  data.tar.gz: 50327854fc1dad382f923be114d6b2c413666070f2e8cffb14c35cd467d73519654bdc7bb372fb370ed743e834d438ea4ce25663b7826c0f56a0f6bdd1b6953f
+  metadata.gz: 786b4d6f2b4e3cce9fee5d61d96cb2c89f31080628d19c5e146976e9eaf3ecb6e4e8eaf76854493cfa37e6dba89721c0e6dca42e8dd657bbaac67ad84b195cf6
+  data.tar.gz: 82fc1cf2c2f31b81e7f640b5edc00be53cc976733bb7c33f3d3a68648991ad0a6979cfb2eb43f57584c48aeb7dd90542ac787e056fc44938216b7b7b9bbed41a

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.5.5] - 2026-03-19
+
+### Added
+- `Hooks::Auth` hook class with `mount '/callback'` for OAuth redirect via expanded hooks system
+- `Runners::Auth#auth_callback` method handling OAuth callback with HTML response and event emission
+- OAuth callback now routes through `Ingress.run` for RBAC and audit support
+
+### Changed
+- OAuth callback URL moves from hardcoded `/api/oauth/microsoft_teams/callback` to `/api/hooks/lex/microsoft_teams/auth/callback`
+
 ## [0.5.4] - 2026-03-19
 
 ### Added

data/CLAUDE.md

@@ -10,7 +10,7 @@ Legion Extension that connects LegionIO to Microsoft Teams via Graph API and Bot
 
 **GitHub**: https://github.com/LegionIO/lex-microsoft_teams
 **License**: MIT
-**Version**: 0.5.2
+**Version**: 0.5.4
 
 ## Architecture
 
@@ -36,7 +36,9 @@ Legion::Extensions::MicrosoftTeams
 │   ├── CacheSync             # Every 5min: incremental ingest of new messages
 │   ├── DirectChatPoller      # Every 5s: polls bot DM chats via Graph API
 │   ├── ObservedChatPoller    # Every 30s: polls subscribed human conversations (compliance-gated)
-│   └── MessageProcessor      # Subscription: consumes AMQP queue, routes by mode
+│   ├── MessageProcessor      # Subscription: consumes AMQP queue, routes by mode
+│   ├── AuthValidator         # Once: validates/restores delegated tokens on boot (2s delay)
+│   └── TokenRefresher        # Every 15min (configurable): keeps delegated tokens fresh
 ├── Transport/
 │   ├── Exchanges/Messages    # teams.messages topic exchange
 │   ├── Queues/MessagesProcess # teams.messages.process durable queue
@@ -50,7 +52,7 @@ Legion::Extensions::MicrosoftTeams
 │   ├── HighWaterMark     # Per-chat message dedup via legion-cache (with in-memory fallback)
 │   ├── PromptResolver    # Layered system prompt resolution (settings -> mode -> per-conversation)
 │   ├── SessionManager    # Multi-turn LLM session lifecycle with lex-memory persistence
-│   ├── TokenCache        # In-memory OAuth token cache with pre-expiry refresh (app + delegated slots)
+│   ├── TokenCache        # In-memory OAuth token cache with pre-expiry refresh (app + delegated slots, authenticated?/previously_authenticated? predicates)
 │   ├── SubscriptionRegistry # Conversation observation subscriptions (in-memory + lex-memory)
 │   ├── BrowserAuth       # Delegated OAuth orchestrator (PKCE, headless detection, browser launch)
 │   └── CallbackServer    # Ephemeral TCP server for OAuth redirect callback
@@ -68,6 +70,18 @@ Tokens stored in Vault (`legionio/microsoft_teams/delegated_token`) with configu
 
 Key files: `Helpers::BrowserAuth` (orchestrator), `Helpers::CallbackServer` (ephemeral TCP), `Runners::Auth` (authorize_url, exchange_code, refresh_delegated_token), `Helpers::TokenCache` (delegated slot).
 
+## Token Lifecycle (v0.5.4)
+
+Automatic delegated token management: validate on boot, refresh on a timer, re-authenticate via browser when a previously authenticated user's token expires.
+
+- **AuthValidator** (Once actor, 2s delay): Loads token from Vault/local file on boot, attempts refresh. If refresh fails and user previously authenticated (`previously_authenticated?` — local file exists), fires BrowserAuth. Silent for users who never opted in.
+- **TokenRefresher** (Every actor, 15min default): Guards with `authenticated?` (live token in memory). Refreshes and persists on each tick. On failure, same re-auth logic as AuthValidator.
+- **TokenCache predicates**: `authenticated?` = live token in `@delegated_cache`. `previously_authenticated?` = local token file exists on disk. This distinction controls auto re-auth (returning users only) vs silence (never-authenticated users).
+
+Configuration: `settings[:microsoft_teams][:auth][:delegated][:refresh_interval]` (default 900 seconds).
+
+Design doc: `docs/plans/2026-03-19-teams-token-lifecycle-design.md`
+
 ## AI Bot (v0.2.0)
 
 Two operating modes, both using polling (Graph API) with AMQP-based message routing:
@@ -104,6 +118,8 @@ microsoft_teams:
     tenant_id: "..."
     client_id: "..."
     client_secret: "vault://secret/teams/client_secret"
+    delegated:
+      refresh_interval: 900    # seconds (TokenRefresher interval)
   bot:
     bot_id: "28:your-bot-id"
     direct_poll_interval: 5      # seconds
@@ -197,7 +213,7 @@ Optional framework dependencies (guarded with `defined?`, not in gemspec):
 
 ```bash
 bundle install
-bundle exec rspec     # 185 specs (as of v0.5.2)
+bundle exec rspec     # 209 specs (as of v0.5.4)
 bundle exec rubocop   # Clean
 ```
 

data/lib/legion/extensions/microsoft_teams/hooks/auth.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module MicrosoftTeams
+      module Hooks
+        class Auth < Legion::Extensions::Hooks::Base
+          mount '/callback'
+
+          def route(_headers, _payload)
+            :auth_callback
+          end
+
+          def runner_class
+            'Legion::Extensions::MicrosoftTeams::Runners::Auth'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/microsoft_teams/runners/auth.rb

@@ -107,6 +107,35 @@ module Legion
             { result: response.body }
           end
 
+          def auth_callback(code: nil, state: nil, **)
+            unless code && state
+              return {
+                result:   { error: 'missing_params' },
+                response: { status: 400, content_type: 'text/html',
+                            body: '<html><body><h2>Missing code or state parameter</h2></body></html>' }
+              }
+            end
+
+            Legion::Events.emit('microsoft_teams.oauth.callback', code: code, state: state) if defined?(Legion::Events)
+
+            {
+              result:   { authenticated: true, code: code, state: state },
+              response: { status: 200, content_type: 'text/html',
+                          body: callback_success_html }
+            }
+          end
+
+          private
+
+          def callback_success_html
+            <<~HTML
+              <html><body style="font-family:sans-serif;text-align:center;padding:40px;">
+              <h2>Authentication complete</h2>
+              <p>You can close this window.</p>
+              </body></html>
+            HTML
+          end
+
           include Legion::Extensions::Helpers::Lex if Legion::Extensions.const_defined?(:Helpers) &&
                                                       Legion::Extensions::Helpers.const_defined?(:Lex)
         end

data/lib/legion/extensions/microsoft_teams/version.rb

@@ -3,7 +3,7 @@
 module Legion
   module Extensions
     module MicrosoftTeams
-      VERSION = '0.5.4'
+      VERSION = '0.5.5'
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-microsoft_teams
 version: !ruby/object:Gem::Version
-  version: 0.5.4
+  version: 0.5.5
 platform: ruby
 authors:
 - Esity
@@ -91,6 +91,7 @@ files:
 - lib/legion/extensions/microsoft_teams/helpers/session_manager.rb
 - lib/legion/extensions/microsoft_teams/helpers/subscription_registry.rb
 - lib/legion/extensions/microsoft_teams/helpers/token_cache.rb
+- lib/legion/extensions/microsoft_teams/hooks/auth.rb
 - lib/legion/extensions/microsoft_teams/local_cache/extractor.rb
 - lib/legion/extensions/microsoft_teams/local_cache/record_parser.rb
 - lib/legion/extensions/microsoft_teams/local_cache/sstable_reader.rb