lex-microsoft_teams 0.6.45 → 0.6.47

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-microsoft_teams
 version: !ruby/object:Gem::Version
-  version: 0.6.45
+  version: 0.6.47
 platform: ruby
 authors:
 - Esity
@@ -135,6 +135,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.3.9
+- !ruby/object:Gem::Dependency
+  name: lex-identity-entra
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.3.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.3.0
 - !ruby/object:Gem::Dependency
   name: snappy
   requirement: !ruby/object:Gem::Requirement
@@ -182,7 +196,6 @@ files:
 - lib/legion/extensions/microsoft_teams/actors/absorb_chat.rb
 - lib/legion/extensions/microsoft_teams/actors/absorb_meeting.rb
 - lib/legion/extensions/microsoft_teams/actors/api_ingest.rb
-- lib/legion/extensions/microsoft_teams/actors/auth_validator.rb
 - lib/legion/extensions/microsoft_teams/actors/cache_bulk_ingest.rb
 - lib/legion/extensions/microsoft_teams/actors/cache_sync.rb
 - lib/legion/extensions/microsoft_teams/actors/channel_poller.rb
@@ -193,11 +206,7 @@ files:
 - lib/legion/extensions/microsoft_teams/actors/observed_chat_poller.rb
 - lib/legion/extensions/microsoft_teams/actors/presence_poller.rb
 - lib/legion/extensions/microsoft_teams/actors/profile_ingest.rb
-- lib/legion/extensions/microsoft_teams/actors/token_refresher.rb
-- lib/legion/extensions/microsoft_teams/cli/auth.rb
 - lib/legion/extensions/microsoft_teams/client.rb
-- lib/legion/extensions/microsoft_teams/helpers/browser_auth.rb
-- lib/legion/extensions/microsoft_teams/helpers/callback_server.rb
 - lib/legion/extensions/microsoft_teams/helpers/client.rb
 - lib/legion/extensions/microsoft_teams/helpers/graph_client.rb
 - lib/legion/extensions/microsoft_teams/helpers/high_water_mark.rb
@@ -205,24 +214,27 @@ files:
 - lib/legion/extensions/microsoft_teams/helpers/prompt_resolver.rb
 - lib/legion/extensions/microsoft_teams/helpers/session_manager.rb
 - lib/legion/extensions/microsoft_teams/helpers/subscription_registry.rb
-- lib/legion/extensions/microsoft_teams/helpers/token_cache.rb
 - lib/legion/extensions/microsoft_teams/helpers/trace_retriever.rb
 - lib/legion/extensions/microsoft_teams/helpers/transform_definitions.rb
-- lib/legion/extensions/microsoft_teams/hooks/auth.rb
 - lib/legion/extensions/microsoft_teams/local_cache/extractor.rb
 - lib/legion/extensions/microsoft_teams/local_cache/record_parser.rb
 - lib/legion/extensions/microsoft_teams/local_cache/sstable_reader.rb
+- lib/legion/extensions/microsoft_teams/runners/activities.rb
 - lib/legion/extensions/microsoft_teams/runners/adaptive_cards.rb
 - lib/legion/extensions/microsoft_teams/runners/ai_insights.rb
 - lib/legion/extensions/microsoft_teams/runners/api_ingest.rb
+- lib/legion/extensions/microsoft_teams/runners/app_installations.rb
 - lib/legion/extensions/microsoft_teams/runners/auth.rb
 - lib/legion/extensions/microsoft_teams/runners/bot.rb
 - lib/legion/extensions/microsoft_teams/runners/cache_ingest.rb
+- lib/legion/extensions/microsoft_teams/runners/call_events.rb
 - lib/legion/extensions/microsoft_teams/runners/channel_messages.rb
 - lib/legion/extensions/microsoft_teams/runners/channels.rb
 - lib/legion/extensions/microsoft_teams/runners/chats.rb
+- lib/legion/extensions/microsoft_teams/runners/files.rb
 - lib/legion/extensions/microsoft_teams/runners/local_cache.rb
 - lib/legion/extensions/microsoft_teams/runners/loop.rb
+- lib/legion/extensions/microsoft_teams/runners/meeting_artifacts.rb
 - lib/legion/extensions/microsoft_teams/runners/meetings.rb
 - lib/legion/extensions/microsoft_teams/runners/messages.rb
 - lib/legion/extensions/microsoft_teams/runners/ownership.rb

data/lib/legion/extensions/microsoft_teams/actors/auth_validator.rb

@@ -1,123 +0,0 @@
-# frozen_string_literal: true
-
-module Legion
-  module Extensions
-    module MicrosoftTeams
-      module Actor
-        class AuthValidator < Legion::Extensions::Actors::Once # rubocop:disable Legion/Extension/SelfContainedActorRunnerClass
-          def use_runner?     = false
-          def check_subtask?  = false
-          def generate_task?  = false
-
-          def delay
-            90.0
-          end
-
-          def enabled?
-            defined?(Legion::Extensions::MicrosoftTeams::Helpers::TokenCache)
-          rescue StandardError => e
-            log.debug("AuthValidator#enabled?: #{e.message}")
-            false
-          end
-
-          def token_cache
-            Legion::Extensions::MicrosoftTeams::Helpers::TokenCache.instance
-          end
-
-          def manual
-            log.info('AuthValidator starting')
-            cache = token_cache
-            log.debug("Token loaded: authenticated?=#{cache.authenticated?}")
-
-            if cache.authenticated?
-              token = cache.cached_delegated_token
-              if token
-                log.info('Teams delegated auth restored (token valid)')
-              elsif cache.previously_authenticated? || auto_authenticate?
-                log.info('Token loaded but expired, attempting browser re-auth')
-                attempt_browser_reauth(cache)
-              else
-                log.debug('Token loaded but expired, no re-auth configured')
-              end
-            elsif cache.previously_authenticated?
-              log.warn('Token file found but could not load, attempting re-authentication')
-              attempt_browser_reauth(cache)
-            elsif auto_authenticate?
-              log.info('auto_authenticate enabled, opening browser for initial authentication...')
-              attempt_browser_reauth(cache)
-            else
-              log.debug('No Teams delegated auth configured, skipping')
-            end
-            log.info('AuthValidator complete')
-          rescue StandardError => e
-            log.error("AuthValidator: #{e.message}")
-          end
-
-          private
-
-          def attempt_browser_reauth(cache)
-            settings = teams_auth_settings
-            unless settings[:tenant_id] && settings[:client_id]
-              log.warn("Cannot re-auth: tenant_id=#{settings[:tenant_id] ? 'present' : 'nil'}, client_id=#{settings[:client_id] ? 'present' : 'nil'}")
-              return false
-            end
-
-            log.warn('Delegated token expired, opening browser for re-authentication...')
-
-            scopes = settings.dig(:delegated, :scopes) ||
-                     Legion::Extensions::MicrosoftTeams::Helpers::BrowserAuth::DEFAULT_SCOPES
-            log.debug("Using scopes: #{scopes}")
-            browser_auth = Legion::Extensions::MicrosoftTeams::Helpers::BrowserAuth.new(
-              tenant_id: settings[:tenant_id],
-              client_id: settings[:client_id],
-              scopes:    scopes
-            )
-
-            result = browser_auth.authenticate
-            if result[:error]
-              log.error("Browser auth returned error: #{result[:error]} - #{result[:description]}")
-              return false
-            end
-
-            body = result[:result]
-            log.info("Browser auth succeeded, storing token (expires_in=#{body['expires_in']})")
-            cache.store_delegated_token(
-              access_token:  body['access_token'],
-              refresh_token: body['refresh_token'],
-              expires_in:    body['expires_in'],
-              scopes:        scopes
-            )
-            cache.save_to_vault
-            log.info('Teams delegated auth restored via browser')
-            true
-          rescue StandardError => e
-            log.error("Browser re-auth failed: #{e.message}")
-            false
-          end
-
-          def auto_authenticate?
-            settings = teams_auth_settings
-            result = settings.dig(:delegated, :auto_authenticate) == true
-            log.debug("auto_authenticate? => #{result}")
-            result
-          end
-
-          def teams_auth_settings
-            settings = if defined?(Legion::Settings)
-                         ms = Legion::Settings[:microsoft_teams]
-                         auth = ms && ms[:auth].is_a?(Hash) ? ms[:auth].dup : {}
-                         auth[:tenant_id] ||= ms[:tenant_id] if ms
-                         auth[:client_id] ||= ms[:client_id] if ms
-                         auth
-                       else
-                         {}
-                       end
-            settings[:tenant_id] ||= ENV.fetch('AZURE_TENANT_ID', nil)
-            settings[:client_id] ||= ENV.fetch('AZURE_CLIENT_ID', nil)
-            settings
-          end
-        end
-      end
-    end
-  end
-end

data/lib/legion/extensions/microsoft_teams/actors/token_refresher.rb

@@ -1,122 +0,0 @@
-# frozen_string_literal: true
-
-module Legion
-  module Extensions
-    module MicrosoftTeams
-      module Actor
-        class TokenRefresher < Legion::Extensions::Actors::Every
-          DEFAULT_REFRESH_INTERVAL = 900
-
-          def runner_class    = Legion::Extensions::MicrosoftTeams::Helpers::TokenCache
-          def runner_function = 'cached_delegated_token'
-          def run_now?        = false
-          def use_runner?     = false
-          def check_subtask?  = false
-          def generate_task?  = false
-
-          def time
-            settings = teams_auth_settings
-            delegated = settings[:delegated]
-            return DEFAULT_REFRESH_INTERVAL unless delegated.is_a?(Hash)
-
-            delegated[:refresh_interval] || DEFAULT_REFRESH_INTERVAL
-          end
-
-          def enabled?
-            defined?(Legion::Extensions::MicrosoftTeams::Helpers::TokenCache)
-          rescue StandardError => e
-            log.debug("TokenRefresher#enabled?: #{e.message}")
-            false
-          end
-
-          def token_cache
-            Legion::Extensions::MicrosoftTeams::Helpers::TokenCache.instance
-          end
-
-          def manual
-            log.debug('TokenRefresher tick')
-            unless token_cache.authenticated?
-              log.debug('No active delegated token, skipping refresh')
-              return
-            end
-
-            log.info('Checking delegated token freshness')
-            token = token_cache.cached_delegated_token
-            if token
-              log.info('Delegated token still valid, persisting')
-              token_cache.save_to_vault
-            elsif token_cache.previously_authenticated?
-              log.warn('Delegated token expired, attempting browser re-auth')
-              attempt_browser_reauth(token_cache)
-            else
-              log.warn('Delegated token expired, no previous auth to restore')
-            end
-          rescue StandardError => e
-            log.error("TokenRefresher: #{e.message}")
-          end
-
-          private
-
-          def attempt_browser_reauth(cache)
-            settings = teams_auth_settings
-            unless settings[:tenant_id] && settings[:client_id]
-              log.warn("Cannot re-auth: tenant_id=#{settings[:tenant_id] ? 'present' : 'nil'}, client_id=#{settings[:client_id] ? 'present' : 'nil'}")
-              return false
-            end
-
-            log.warn('Delegated token expired, opening browser for re-authentication...')
-
-            scopes = settings.dig(:delegated, :scopes) ||
-                     Legion::Extensions::MicrosoftTeams::Helpers::BrowserAuth::DEFAULT_SCOPES
-            log.debug("Using scopes: #{scopes}")
-            browser_auth = Legion::Extensions::MicrosoftTeams::Helpers::BrowserAuth.new(
-              tenant_id: settings[:tenant_id],
-              client_id: settings[:client_id],
-              scopes:    scopes
-            )
-
-            result = browser_auth.authenticate
-            if result[:error]
-              log.error("Browser auth returned error: #{result[:error]} - #{result[:description]}")
-              return false
-            end
-
-            body = result[:result]
-            log.info("Browser auth succeeded, storing token (expires_in=#{body['expires_in']})")
-            cache.store_delegated_token(
-              access_token:  body['access_token'],
-              refresh_token: body['refresh_token'],
-              expires_in:    body['expires_in'],
-              scopes:        scopes
-            )
-            cache.save_to_vault
-            log.info('Teams delegated auth restored via browser')
-            true
-          rescue StandardError => e
-            log.error("Browser re-auth failed: #{e.message}")
-            false
-          end
-
-          def teams_auth_settings
-            settings = if defined?(Legion::Settings)
-                         ms = Legion::Settings[:microsoft_teams]
-                         auth = if ms && ms[:auth].is_a?(Hash)
-                                  ms[:auth].dup
-                                else
-                                  {}
-                                end
-                         auth[:tenant_id] ||= ms[:tenant_id] if ms
-                         auth[:client_id] ||= ms[:client_id] if ms
-                         auth
-                       else
-                         {}
-                       end
-            settings[:tenant_id] ||= ENV.fetch('AZURE_TENANT_ID', nil)
-            settings[:client_id] ||= ENV.fetch('AZURE_CLIENT_ID', nil)
-            settings
-          end
-        end
-      end
-    end
-  end
-end

data/lib/legion/extensions/microsoft_teams/cli/auth.rb

@@ -1,94 +0,0 @@
-# frozen_string_literal: true
-
-require 'legion/extensions/microsoft_teams/helpers/browser_auth'
-require 'legion/extensions/microsoft_teams/helpers/token_cache'
-
-module Legion
-  module Extensions
-    module MicrosoftTeams
-      module CLI
-        class Auth
-          include Legion::Extensions::Helpers::Lex if Legion::Extensions.const_defined?(:Helpers, false) &&
-                                                      Legion::Extensions::Helpers.const_defined?(:Lex, false)
-
-          def self.cli_alias
-            'teams'
-          end
-
-          def self.descriptions
-            {
-              login:  'Authenticate with Microsoft Teams via browser OAuth',
-              status: 'Show current Teams authentication state'
-            }
-          end
-
-          def login(tenant_id: nil, client_id: nil)
-            settings = resolve_settings
-            tid = tenant_id || settings[:tenant_id] || ENV.fetch('AZURE_TENANT_ID', nil)
-            cid = client_id || settings[:client_id] || ENV.fetch('AZURE_CLIENT_ID', nil)
-
-            log.debug("Resolved tenant_id=#{tid ? 'present' : 'nil'}, client_id=#{cid ? 'present' : 'nil'}")
-
-            unless tid && cid
-              puts 'Error: tenant_id and client_id required (set in settings, env vars, or pass as args)'
-              return
-            end
-
-            log.info('Starting Teams delegated auth login')
-            browser_auth = Helpers::BrowserAuth.new(tenant_id: tid, client_id: cid, force_local_server: true)
-            result = browser_auth.authenticate
-
-            body = result&.dig(:result)
-            if body&.dig('access_token')
-              log.info('Authentication successful, storing token')
-              store_token(body)
-              puts 'Teams authenticated successfully.'
-            else
-              log.warn("Authentication result: #{result&.keys&.join(', ') || 'nil'}")
-              puts 'Teams authentication failed or was cancelled.'
-            end
-          rescue StandardError => e
-            log.error("Login failed: #{e.message}")
-            puts "Error: #{e.message}"
-          end
-
-          def status
-            token_file = File.expand_path('~/.legionio/tokens/microsoft_teams.json')
-            if File.exist?(token_file)
-              log.info("Token file found: #{token_file}")
-              puts 'Teams: authenticated (token file present)'
-            else
-              log.info('No token file found')
-              puts 'Teams: not authenticated'
-            end
-          end
-
-          private
-
-          def resolve_settings
-            return {} unless defined?(Legion::Settings)
-
-            Legion::Settings[:microsoft_teams]&.dig(:auth) || {}
-          rescue StandardError => e
-            log.debug("Auth: resolve_settings failed: #{e.message}")
-            {}
-          end
-
-          def store_token(body)
-            cache = Helpers::TokenCache.instance
-            cache.store_delegated_token(
-              access_token:  body['access_token'],
-              refresh_token: body['refresh_token'],
-              expires_in:    body['expires_in'],
-              scopes:        body['scope']
-            )
-            cache.save_to_vault
-            log.info('Token stored successfully')
-          rescue StandardError => e
-            log.error("Failed to store token: #{e.message}")
-          end
-        end
-      end
-    end
-  end
-end

data/lib/legion/extensions/microsoft_teams/helpers/browser_auth.rb

@@ -1,270 +0,0 @@
-# frozen_string_literal: true
-
-require 'securerandom'
-require 'digest'
-require 'base64'
-require 'rbconfig'
-
-require 'legion/extensions/microsoft_teams/runners/auth'
-require 'legion/extensions/microsoft_teams/helpers/callback_server'
-
-module Legion
-  module Extensions
-    module MicrosoftTeams
-      module Helpers
-        class BrowserAuth
-          include Legion::Extensions::Helpers::Lex if Legion::Extensions.const_defined?(:Helpers, false) &&
-                                                      Legion::Extensions::Helpers.const_defined?(:Lex, false)
-
-          DEFAULT_SCOPES = [
-            'offline_access', 'openid', 'profile', 'email',
-            'User.Read', 'People.Read', 'Presence.Read', 'Presence.Read.All',
-            'Chat.Read', 'Chat.ReadBasic', 'ChatMember.Read', 'ChatMessage.Read',
-            'Channel.ReadBasic.All', 'ChannelMember.Read.All', 'ChannelMessage.Read.All',
-            'Team.ReadBasic.All', 'Group-Conversation.Read.All',
-            'OnlineMeetings.Read', 'OnlineMeetingTranscript.Read.All',
-            'OnlineMeetingRecording.Read.All', 'OnlineMeetingArtifact.Read.All',
-            'OnlineMeetingAiInsight.Read.All', 'CallAiInsights.Read.All',
-            'CallEvents.Read', 'CallRecordings.Read.All', 'CallTranscripts.Read.All',
-            'TeamsActivity.Read', 'TeamsActivity.Send'
-          ].join(' ').freeze
-
-          attr_reader :tenant_id, :client_id, :scopes
-
-          def initialize(tenant_id:, client_id:, scopes: DEFAULT_SCOPES, auth: nil, force_local_server: false, **)
-            @tenant_id = tenant_id
-            @client_id = client_id
-            @scopes    = scopes
-            @auth      = auth || Object.new.extend(Runners::Auth)
-            @force_local_server = force_local_server
-            log.debug("BrowserAuth initialized (tenant=#{tenant_id}, client=#{client_id}, force_local=#{force_local_server})")
-          end
-
-          def authenticate
-            if gui_available?
-              log.info('GUI available, using browser auth')
-              authenticate_browser
-            else
-              log.info('No GUI detected, using device code flow')
-              authenticate_device_code
-            end
-          end
-
-          def api_hook_available?
-            if @force_local_server
-              log.debug('api_hook_available? => false (force_local_server)')
-              return false
-            end
-
-            api_defined = defined?(Legion::API)
-            events_defined = defined?(Legion::Events)
-            hooks_defined = defined?(Legion::Extensions::Hooks::Base)
-            route_ok = api_defined && events_defined && hooks_defined && hook_route_registered?
-
-            log.debug("api_hook_available? => #{!route_ok.nil?} " \
-                      "(API=#{!api_defined.nil?}, Events=#{!events_defined.nil?}, Hooks=#{!hooks_defined.nil?}, route=#{route_ok})")
-            !!route_ok
-          end
-
-          def hook_redirect_uri
-            port = if defined?(Legion::Settings)
-                     Legion::Settings.dig(:api, :port) || 4567
-                   else
-                     4567
-                   end
-            "http://127.0.0.1:#{port}/api/extensions/microsoft_teams/hooks/auth/handle"
-          end
-
-          def generate_pkce
-            verifier  = SecureRandom.urlsafe_base64(32)
-            challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
-            log.debug('PKCE challenge generated')
-            [verifier, challenge]
-          end
-
-          def gui_available?
-            os = host_os
-            return true if /darwin|mswin|mingw/.match?(os)
-
-            !ENV['DISPLAY'].nil? || !ENV['WAYLAND_DISPLAY'].nil?
-          end
-
-          def open_browser(url)
-            cmd = case host_os
-                  when /darwin/       then 'open'
-                  when /linux/        then 'xdg-open'
-                  when /mswin|mingw/  then 'start'
-                  end
-            unless cmd
-              log.warn('No browser command found for this OS')
-              return false
-            end
-
-            log.debug("Opening browser with: #{cmd}")
-            system(cmd, url)
-          end
-
-          private
-
-          def host_os
-            RbConfig::CONFIG['host_os']
-          end
-
-          def hook_route_registered?
-            return false unless defined?(Legion::API)
-
-            log.debug("Probing hook route at http://127.0.0.1:#{api_port}/api/extensions/microsoft_teams/hooks/auth/handle")
-            conn = Faraday.new(url: "http://127.0.0.1:#{api_port}")
-            resp = conn.head('/api/extensions/microsoft_teams/hooks/auth/handle')
-            registered = resp.status != 404
-            log.debug("Hook route probe returned #{resp.status} (registered=#{registered})")
-            registered
-          rescue StandardError => e
-            log.debug("Hook route probe failed: #{e.message}")
-            false
-          end
-
-          def api_port
-            if defined?(Legion::Settings)
-              Legion::Settings.dig(:api, :port) || 4567
-            else
-              4567
-            end
-          end
-
-          def authenticate_browser
-            verifier, challenge = generate_pkce
-            state = SecureRandom.hex(32)
-
-            if api_hook_available?
-              log.info('Using API hook for OAuth callback')
-              authenticate_via_hook(verifier: verifier, challenge: challenge, state: state)
-            else
-              log.info('Using local callback server for OAuth callback')
-              authenticate_via_server(verifier: verifier, challenge: challenge, state: state)
-            end
-          end
-
-          def authenticate_via_hook(verifier:, challenge:, state:)
-            callback_uri = hook_redirect_uri
-            log.debug("Hook callback URI: #{callback_uri}")
-            result_holder = { result: nil }
-            mutex = Mutex.new
-            cv = ConditionVariable.new
-
-            listener = Legion::Events.once('microsoft_teams.oauth.callback') do |event|
-              log.debug('OAuth callback event received via Legion::Events')
-              mutex.synchronize do
-                result_holder[:result] = event
-                cv.broadcast
-              end
-            end
-
-            url = @auth.authorize_url(
-              tenant_id: tenant_id, client_id: client_id,
-              redirect_uri: callback_uri, scope: scopes,
-              state: state, code_challenge: challenge
-            )
-
-            log.info('Opening browser for authentication (using API hook)...')
-            unless open_browser(url)
-              Legion::Events.off('microsoft_teams.oauth.callback', listener)
-              log.warn('Could not open browser. Falling back to device code flow.')
-              return authenticate_device_code
-            end
-
-            log.debug('Waiting for OAuth callback (timeout=120s)...')
-            mutex.synchronize { cv.wait(mutex, 120) unless result_holder[:result] }
-            result = result_holder[:result]
-
-            unless result && result[:code]
-              log.error('OAuth callback timed out or missing code')
-              return { error: 'timeout', description: 'No callback received within timeout' }
-            end
-
-            unless result[:state] == state
-              log.error('OAuth state mismatch (possible CSRF)')
-              return { error: 'state_mismatch', description: 'CSRF state parameter mismatch' }
-            end
-
-            log.info('Exchanging authorization code for tokens (via hook)')
-            @auth.exchange_code(
-              tenant_id: tenant_id, client_id: client_id,
-              code: result[:code], redirect_uri: callback_uri,
-              code_verifier: verifier, scope: scopes
-            )
-          end
-
-          def authenticate_via_server(verifier:, challenge:, state:)
-            server = CallbackServer.new
-            server.start
-            callback_uri = server.redirect_uri
-            log.info("Local callback server started on #{callback_uri}")
-
-            url = @auth.authorize_url(
-              tenant_id: tenant_id, client_id: client_id,
-              redirect_uri: callback_uri, scope: scopes,
-              state: state, code_challenge: challenge
-            )
-
-            log.info("Opening browser for authentication (callback: #{callback_uri})...")
-            unless open_browser(url)
-              log.warn('Could not open browser. Falling back to device code flow.')
-              return authenticate_device_code
-            end
-
-            log.debug('Waiting for OAuth callback on local server (timeout=120s)...')
-            result = server.wait_for_callback(timeout: 120)
-
-            unless result && result[:code]
-              log.error('OAuth callback timed out or missing code')
-              return { error: 'timeout', description: 'No callback received within timeout' }
-            end
-
-            unless result[:state] == state
-              log.error('OAuth state mismatch (possible CSRF)')
-              return { error: 'state_mismatch', description: 'CSRF state parameter mismatch' }
-            end
-
-            log.info('Exchanging authorization code for tokens (via local server)')
-            @auth.exchange_code(
-              tenant_id: tenant_id, client_id: client_id,
-              code: result[:code], redirect_uri: callback_uri,
-              code_verifier: verifier, scope: scopes
-            )
-          ensure
-            server&.shutdown
-            log.debug('Local callback server shut down')
-          end
-
-          def authenticate_device_code
-            log.info('Starting device code flow')
-            dc = @auth.request_device_code(
-              tenant_id: tenant_id,
-              client_id: client_id,
-              scope:     scopes
-            )
-            if dc[:error]
-              log.error("Device code request failed: #{dc[:error]} - #{dc[:description]}")
-              return { error: dc[:error], description: dc[:description] }
-            end
-
-            body = dc[:result]
-
-            log.info("Go to:  #{body['verification_uri']}")
-            log.info("Code:   #{body['user_code']}")
-
-            open_browser(body['verification_uri']) if gui_available?
-
-            log.debug('Polling for device code authorization...')
-            @auth.poll_device_code(
-              tenant_id:   tenant_id,
-              client_id:   client_id,
-              device_code: body['device_code']
-            )
-          end
-        end
-      end
-    end
-  end
-end