lex-microsoft_teams 0.5.4 → 0.5.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 050cf6a6703c4b6ee4d636980ee7843a3bc34b27c533d0d1cab0325c9903ca02
-  data.tar.gz: ffb0ca49267fc2f64b1a27c10f25e45099e2d2450839b3ddf8984efe21572d6b
+  metadata.gz: d414b08d6eaabf909ab4de6fe900cc879bdeda369ea386925c2c3258ed9d4a24
+  data.tar.gz: 8bdf0da6fb7f666eb9a4489180370e5f4e3124104e9c8736d85e9d0dbe1afbb5
 SHA512:
-  metadata.gz: 9f93cdb1ff43c5ff3829f71de8aedca04086cf1a8efed385441a8d0920d39c7a429718e3de6035f734021921d3583ed2004648dc97bd47982cb75d6258baebc7
-  data.tar.gz: 50327854fc1dad382f923be114d6b2c413666070f2e8cffb14c35cd467d73519654bdc7bb372fb370ed743e834d438ea4ce25663b7826c0f56a0f6bdd1b6953f
+  metadata.gz: 02b042dea9cc6292403cc504c6bdcfde101e63c24c7120300985a0825ea3dcf11aa988705f64ad9ff5bace61513b4b621f263740f7ce9e40e858b45123017acb
+  data.tar.gz: 9d09c3aa2518ccc19655d864c393f01ff2a578c7085c47ff4dfa130b1fb8dcec6a6cb465b2c3ae57787617201f06f9528006f60d6c0373860e2191c5b9a3216d

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.5.6] - 2026-03-19
+
+### Added
+- BrowserAuth API hook detection: uses hook URL when Legion::API is running instead of ephemeral CallbackServer
+- `api_hook_available?` and `hook_redirect_uri` methods on BrowserAuth
+- `authenticate_via_hook` path using `Legion::Events` for callback notification
+- `authenticate_via_server` extracted from original `authenticate_browser` as fallback path
+
+### Changed
+- `authenticate_browser` now delegates to hook path (API running) or server path (standalone)
+
+## [0.5.5] - 2026-03-19
+
+### Added
+- `Hooks::Auth` hook class with `mount '/callback'` for OAuth redirect via expanded hooks system
+- `Runners::Auth#auth_callback` method handling OAuth callback with HTML response and event emission
+- OAuth callback now routes through `Ingress.run` for RBAC and audit support
+
+### Changed
+- OAuth callback URL moves from hardcoded `/api/oauth/microsoft_teams/callback` to `/api/hooks/lex/microsoft_teams/auth/callback`
+
 ## [0.5.4] - 2026-03-19
 
 ### Added

data/CLAUDE.md

@@ -10,14 +10,14 @@ Legion Extension that connects LegionIO to Microsoft Teams via Graph API and Bot
 
 **GitHub**: https://github.com/LegionIO/lex-microsoft_teams
 **License**: MIT
-**Version**: 0.5.2
+**Version**: 0.5.5
 
 ## Architecture
 
 ```
 Legion::Extensions::MicrosoftTeams
 ├── Runners/
-│   ├── Auth              # OAuth2 client credentials (Graph + Bot Framework)
+│   ├── Auth              # OAuth2 client credentials (Graph + Bot Framework) + auth_callback for hook
 │   ├── Teams             # List/get teams, members
 │   ├── Chats             # 1:1 and group chat CRUD
 │   ├── Messages          # Chat message send/read/reply
@@ -36,7 +36,9 @@ Legion::Extensions::MicrosoftTeams
 │   ├── CacheSync             # Every 5min: incremental ingest of new messages
 │   ├── DirectChatPoller      # Every 5s: polls bot DM chats via Graph API
 │   ├── ObservedChatPoller    # Every 30s: polls subscribed human conversations (compliance-gated)
-│   └── MessageProcessor      # Subscription: consumes AMQP queue, routes by mode
+│   ├── MessageProcessor      # Subscription: consumes AMQP queue, routes by mode
+│   ├── AuthValidator         # Once: validates/restores delegated tokens on boot (2s delay)
+│   └── TokenRefresher        # Every 15min (configurable): keeps delegated tokens fresh
 ├── Transport/
 │   ├── Exchanges/Messages    # teams.messages topic exchange
 │   ├── Queues/MessagesProcess # teams.messages.process durable queue
@@ -50,10 +52,12 @@ Legion::Extensions::MicrosoftTeams
 │   ├── HighWaterMark     # Per-chat message dedup via legion-cache (with in-memory fallback)
 │   ├── PromptResolver    # Layered system prompt resolution (settings -> mode -> per-conversation)
 │   ├── SessionManager    # Multi-turn LLM session lifecycle with lex-memory persistence
-│   ├── TokenCache        # In-memory OAuth token cache with pre-expiry refresh (app + delegated slots)
+│   ├── TokenCache        # In-memory OAuth token cache with pre-expiry refresh (app + delegated slots, authenticated?/previously_authenticated? predicates)
 │   ├── SubscriptionRegistry # Conversation observation subscriptions (in-memory + lex-memory)
 │   ├── BrowserAuth       # Delegated OAuth orchestrator (PKCE, headless detection, browser launch)
 │   └── CallbackServer    # Ephemeral TCP server for OAuth redirect callback
+├── Hooks/
+│   └── Auth              # OAuth callback hook (mount '/callback') → /api/hooks/lex/microsoft_teams/auth/callback
 └── Client                # Standalone client (includes all runners)
 ```
 
@@ -64,9 +68,21 @@ Opt-in browser-based OAuth for delegated Microsoft Graph permissions. Two flows:
 - **Authorization Code + PKCE** (primary): Opens browser for Entra ID login, captures callback on ephemeral local port, exchanges code with PKCE verification
 - **Device Code** (fallback): Auto-selected in headless/SSH environments (no `DISPLAY`/`WAYLAND_DISPLAY`)
 
-Tokens stored in Vault (`legionio/microsoft_teams/delegated_token`) with configurable pre-expiry silent refresh. CLI command: `legion auth teams`. Sinatra route: `GET /api/oauth/microsoft_teams/callback` for daemon re-auth.
+Tokens stored in Vault (`legionio/microsoft_teams/delegated_token`) with configurable pre-expiry silent refresh. CLI command: `legion auth teams`. Hook route: `GET|POST /api/hooks/lex/microsoft_teams/auth/callback` for daemon re-auth (routed through Ingress for RBAC/audit).
 
-Key files: `Helpers::BrowserAuth` (orchestrator), `Helpers::CallbackServer` (ephemeral TCP), `Runners::Auth` (authorize_url, exchange_code, refresh_delegated_token), `Helpers::TokenCache` (delegated slot).
+Key files: `Helpers::BrowserAuth` (orchestrator), `Helpers::CallbackServer` (ephemeral TCP), `Runners::Auth` (authorize_url, exchange_code, refresh_delegated_token, auth_callback), `Helpers::TokenCache` (delegated slot), `Hooks::Auth` (hook class with mount path).
+
+## Token Lifecycle (v0.5.4)
+
+Automatic delegated token management: validate on boot, refresh on a timer, re-authenticate via browser when a previously authenticated user's token expires.
+
+- **AuthValidator** (Once actor, 2s delay): Loads token from Vault/local file on boot, attempts refresh. If refresh fails and user previously authenticated (`previously_authenticated?` — local file exists), fires BrowserAuth. Silent for users who never opted in.
+- **TokenRefresher** (Every actor, 15min default): Guards with `authenticated?` (live token in memory). Refreshes and persists on each tick. On failure, same re-auth logic as AuthValidator.
+- **TokenCache predicates**: `authenticated?` = live token in `@delegated_cache`. `previously_authenticated?` = local token file exists on disk. This distinction controls auto re-auth (returning users only) vs silence (never-authenticated users).
+
+Configuration: `settings[:microsoft_teams][:auth][:delegated][:refresh_interval]` (default 900 seconds).
+
+Design doc: `docs/plans/2026-03-19-teams-token-lifecycle-design.md`
 
 ## AI Bot (v0.2.0)
 
@@ -104,6 +120,8 @@ microsoft_teams:
     tenant_id: "..."
     client_id: "..."
     client_secret: "vault://secret/teams/client_secret"
+    delegated:
+      refresh_interval: 900    # seconds (TokenRefresher interval)
   bot:
     bot_id: "28:your-bot-id"
     direct_poll_interval: 5      # seconds
@@ -197,7 +215,7 @@ Optional framework dependencies (guarded with `defined?`, not in gemspec):
 
 ```bash
 bundle install
-bundle exec rspec     # 185 specs (as of v0.5.2)
+bundle exec rspec     # 219 specs (as of v0.5.5)
 bundle exec rubocop   # Clean
 ```
 

data/lib/legion/extensions/microsoft_teams/helpers/browser_auth.rb

@@ -32,6 +32,19 @@ module Legion
             end
           end
 
+          def api_hook_available?
+            !!(defined?(Legion::API) && defined?(Legion::Events))
+          end
+
+          def hook_redirect_uri
+            port = if defined?(Legion::Settings)
+                     Legion::Settings.dig(:api, :port) || 4567
+                   else
+                     4567
+                   end
+            "http://127.0.0.1:#{port}/api/hooks/lex/microsoft_teams/auth/callback"
+          end
+
           def generate_pkce
             verifier  = SecureRandom.urlsafe_base64(32)
             challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
@@ -66,17 +79,62 @@ module Legion
             verifier, challenge = generate_pkce
             state = SecureRandom.hex(32)
 
+            if api_hook_available?
+              authenticate_via_hook(verifier: verifier, challenge: challenge, state: state)
+            else
+              authenticate_via_server(verifier: verifier, challenge: challenge, state: state)
+            end
+          end
+
+          def authenticate_via_hook(verifier:, challenge:, state:)
+            callback_uri = hook_redirect_uri
+            result_holder = { result: nil }
+            mutex = Mutex.new
+            cv = ConditionVariable.new
+
+            listener = Legion::Events.once('microsoft_teams.oauth.callback') do |event|
+              mutex.synchronize do
+                result_holder[:result] = event
+                cv.broadcast
+              end
+            end
+
+            url = @auth.authorize_url(
+              tenant_id: tenant_id, client_id: client_id,
+              redirect_uri: callback_uri, scope: scopes,
+              state: state, code_challenge: challenge
+            )
+
+            log_info('Opening browser for authentication (using API hook)...')
+            unless open_browser(url)
+              Legion::Events.off('microsoft_teams.oauth.callback', listener)
+              log_info('Could not open browser. Falling back to device code flow.')
+              return authenticate_device_code
+            end
+
+            mutex.synchronize { cv.wait(mutex, 120) unless result_holder[:result] }
+            result = result_holder[:result]
+
+            return { error: 'timeout', description: 'No callback received within timeout' } unless result && result[:code]
+
+            return { error: 'state_mismatch', description: 'CSRF state parameter mismatch' } unless result[:state] == state
+
+            @auth.exchange_code(
+              tenant_id: tenant_id, client_id: client_id,
+              code: result[:code], redirect_uri: callback_uri,
+              code_verifier: verifier, scope: scopes
+            )
+          end
+
+          def authenticate_via_server(verifier:, challenge:, state:)
             server = CallbackServer.new
             server.start
             callback_uri = server.redirect_uri
 
             url = @auth.authorize_url(
-              tenant_id:      tenant_id,
-              client_id:      client_id,
-              redirect_uri:   callback_uri,
-              scope:          scopes,
-              state:          state,
-              code_challenge: challenge
+              tenant_id: tenant_id, client_id: client_id,
+              redirect_uri: callback_uri, scope: scopes,
+              state: state, code_challenge: challenge
             )
 
             log_info('Opening browser for authentication...')
@@ -92,12 +150,9 @@ module Legion
             return { error: 'state_mismatch', description: 'CSRF state parameter mismatch' } unless result[:state] == state
 
             @auth.exchange_code(
-              tenant_id:     tenant_id,
-              client_id:     client_id,
-              code:          result[:code],
-              redirect_uri:  callback_uri,
-              code_verifier: verifier,
-              scope:         scopes
+              tenant_id: tenant_id, client_id: client_id,
+              code: result[:code], redirect_uri: callback_uri,
+              code_verifier: verifier, scope: scopes
             )
           ensure
             server&.shutdown

data/lib/legion/extensions/microsoft_teams/hooks/auth.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module MicrosoftTeams
+      module Hooks
+        class Auth < Legion::Extensions::Hooks::Base
+          mount '/callback'
+
+          def route(_headers, _payload)
+            :auth_callback
+          end
+
+          def runner_class
+            'Legion::Extensions::MicrosoftTeams::Runners::Auth'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/microsoft_teams/runners/auth.rb

@@ -107,6 +107,35 @@ module Legion
             { result: response.body }
           end
 
+          def auth_callback(code: nil, state: nil, **)
+            unless code && state
+              return {
+                result:   { error: 'missing_params' },
+                response: { status: 400, content_type: 'text/html',
+                            body: '<html><body><h2>Missing code or state parameter</h2></body></html>' }
+              }
+            end
+
+            Legion::Events.emit('microsoft_teams.oauth.callback', code: code, state: state) if defined?(Legion::Events)
+
+            {
+              result:   { authenticated: true, code: code, state: state },
+              response: { status: 200, content_type: 'text/html',
+                          body: callback_success_html }
+            }
+          end
+
+          private
+
+          def callback_success_html
+            <<~HTML
+              <html><body style="font-family:sans-serif;text-align:center;padding:40px;">
+              <h2>Authentication complete</h2>
+              <p>You can close this window.</p>
+              </body></html>
+            HTML
+          end
+
           include Legion::Extensions::Helpers::Lex if Legion::Extensions.const_defined?(:Helpers) &&
                                                       Legion::Extensions::Helpers.const_defined?(:Lex)
         end

data/lib/legion/extensions/microsoft_teams/version.rb

@@ -3,7 +3,7 @@
 module Legion
   module Extensions
     module MicrosoftTeams
-      VERSION = '0.5.4'
+      VERSION = '0.5.6'
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-microsoft_teams
 version: !ruby/object:Gem::Version
-  version: 0.5.4
+  version: 0.5.6
 platform: ruby
 authors:
 - Esity
@@ -91,6 +91,7 @@ files:
 - lib/legion/extensions/microsoft_teams/helpers/session_manager.rb
 - lib/legion/extensions/microsoft_teams/helpers/subscription_registry.rb
 - lib/legion/extensions/microsoft_teams/helpers/token_cache.rb
+- lib/legion/extensions/microsoft_teams/hooks/auth.rb
 - lib/legion/extensions/microsoft_teams/local_cache/extractor.rb
 - lib/legion/extensions/microsoft_teams/local_cache/record_parser.rb
 - lib/legion/extensions/microsoft_teams/local_cache/sstable_reader.rb