@aifabrix/builder 2.53.1 → 2.55.0

package/lib/channels/microsoft-provisioning/index.js

@@ -0,0 +1,55 @@
+/**
+ * Microsoft channel provisioning adapter (auth-config + Agent 365 checkpoint).
+ *
+ * @fileoverview Single entry for Copilot Entra SSO capture and Teams Bot errors
+ */
+
+'use strict';
+
+const { captureCopilotAuthConfigId } = require('./auth-config');
+const {
+  startPortalMicrosoftLogin,
+  isLoopbackAuthorizeUrl,
+  peekPortalMicrosoftLogin,
+  awaitPortalMicrosoftLogin
+} = require('./login-portal');
+const { readProvisioningState, isReusableAuthConfig } = require('./persist');
+const { wrongTenantError, wrapToolkitError, wrapTeamsCliError } = require('./errors');
+const {
+  evaluateAgent365Checkpoint,
+  agent365AppliesToDeclarativeAgents,
+  registerExternalMcpServer
+} = require('./a365');
+const { extractTenantId, assertExpectedTenant } = require('./auth');
+const { provisionTeamsBot, TEAMS_CLI_MISSING_REMAINING } = require('./teams-bot-provision');
+const { buildAppCreateArgs } = require('./teams-bot-args');
+const { isReusableTeamsBot, readTeamsBotState } = require('./teams-bot-persist');
+const {
+  loadTeamsBotControllerContext,
+  extractAzureFromEnvironment
+} = require('./teams-bot-controller');
+
+module.exports = {
+  captureCopilotAuthConfigId,
+  startPortalMicrosoftLogin,
+  isLoopbackAuthorizeUrl,
+  peekPortalMicrosoftLogin,
+  awaitPortalMicrosoftLogin,
+  readProvisioningState,
+  isReusableAuthConfig,
+  extractTenantId,
+  assertExpectedTenant,
+  wrongTenantError,
+  wrapToolkitError,
+  wrapTeamsCliError,
+  evaluateAgent365Checkpoint,
+  agent365AppliesToDeclarativeAgents,
+  registerExternalMcpServer,
+  provisionTeamsBot,
+  buildAppCreateArgs,
+  isReusableTeamsBot,
+  readTeamsBotState,
+  TEAMS_CLI_MISSING_REMAINING,
+  loadTeamsBotControllerContext,
+  extractAzureFromEnvironment
+};

package/lib/channels/microsoft-provisioning/install-atk.js

@@ -0,0 +1,158 @@
+/**
+ * Install Microsoft 365 Agents Toolkit CLI when `atk` / `teamsapp` is missing.
+ *
+ * @fileoverview Documented npm package only; skipped under Jest unless deps allow it
+ */
+
+'use strict';
+
+const os = require('os');
+const path = require('path');
+const { promisify } = require('util');
+const execFileDefault = promisify(require('child_process').execFile);
+const { ATK_BINARIES, ATK_NPM_PACKAGE } = require('./constants');
+
+/**
+ * @param {Object} [env]
+ * @returns {string}
+ */
+function atkWritableHome(env = process.env) {
+  const home = typeof env.HOME === 'string' && env.HOME.trim() && env.HOME.trim() !== '/'
+    ? env.HOME.trim()
+    : os.tmpdir();
+  return home;
+}
+
+/**
+ * @param {Object} [env]
+ * @returns {string}
+ */
+function atkInstallPrefix(env = process.env) {
+  return path.join(atkWritableHome(env), '.local');
+}
+
+/**
+ * npm must not use HOME=/ (container appuser) — that writes /.npm and EACCES.
+ * @param {Object} [env]
+ * @returns {Object}
+ */
+function atkInstallEnv(env = process.env) {
+  const home = atkWritableHome(env);
+  const cache = path.join(home, '.npm');
+  const prefixBin = path.join(atkInstallPrefix(env), 'bin');
+  const pathValue = typeof env.PATH === 'string' ? env.PATH : '';
+  return {
+    ...env,
+    HOME: home,
+    NPM_CONFIG_CACHE: cache,
+    npm_config_cache: cache,
+    npm_config_update_notifier: 'false',
+    PATH: pathValue.includes(prefixBin) ? pathValue : `${prefixBin}${path.delimiter}${pathValue}`
+  };
+}
+
+/**
+ * @param {string} prefix
+ * @returns {string[]}
+ */
+function atkInstallCandidates(prefix) {
+  return ATK_BINARIES.map((name) => path.join(prefix, 'bin', name));
+}
+
+/**
+ * @param {Object|null} resultOrError
+ * @returns {string}
+ */
+function execText(resultOrError) {
+  const stdout = resultOrError && resultOrError.stdout ? String(resultOrError.stdout) : '';
+  const stderr = resultOrError && resultOrError.stderr ? String(resultOrError.stderr) : '';
+  return `${stdout}\n${stderr}`;
+}
+
+/**
+ * atk --version can print a version then exit 1 (HOME=/ mkdir /.fx).
+ * @param {string} text
+ * @returns {boolean}
+ */
+function looksLikeAtkVersion(text) {
+  return /\d+\.\d+/.test(String(text || ''));
+}
+
+/**
+ * @param {Function} execFileImpl
+ * @param {string} bin
+ * @param {Object} [env]
+ * @returns {Promise<boolean>}
+ */
+async function binaryResponds(execFileImpl, bin, env) {
+  const opts = { timeout: 20000, env: atkInstallEnv(env) };
+  try {
+    const result = await execFileImpl(bin, ['--version'], opts);
+    return looksLikeAtkVersion(execText(result));
+  } catch (error) {
+    return looksLikeAtkVersion(execText(error));
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string|null>}
+ */
+async function findAtkBinary(deps = {}) {
+  const execFileImpl = deps.execFile || execFileDefault;
+  const prefix = atkInstallPrefix(deps.env || process.env);
+  const bins = [...ATK_BINARIES, ...atkInstallCandidates(prefix)];
+  for (const bin of bins) {
+    if (await binaryResponds(execFileImpl, bin, deps.env || process.env)) {
+      return bin;
+    }
+  }
+  return null;
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function installAtkCli(deps = {}) {
+  if (typeof deps.installAtkImpl === 'function') {
+    await deps.installAtkImpl();
+    return;
+  }
+  const execFileImpl = deps.execFile || execFileDefault;
+  const prefix = atkInstallPrefix(deps.env || process.env);
+  await execFileImpl(
+    'npm',
+    ['install', '-g', ATK_NPM_PACKAGE, '--prefix', prefix],
+    { timeout: 180000, env: atkInstallEnv(deps.env || process.env) }
+  );
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string|null>}
+ */
+async function findOrInstallAtkBinary(deps = {}) {
+  const existing = await findAtkBinary(deps);
+  if (existing) {
+    return existing;
+  }
+  if (deps.skipInstall === true) {
+    return null;
+  }
+  try {
+    await installAtkCli(deps);
+  } catch {
+    return null;
+  }
+  return findAtkBinary(deps);
+}
+
+module.exports = {
+  atkWritableHome,
+  atkInstallPrefix,
+  atkInstallEnv,
+  findAtkBinary,
+  installAtkCli,
+  findOrInstallAtkBinary
+};

package/lib/channels/microsoft-provisioning/install-teams.js

@@ -0,0 +1,115 @@
+/**
+ * Install Teams Developer CLI when `teams` is missing.
+ *
+ * @fileoverview Documented npm package only; skipped under Jest unless deps allow it
+ */
+
+'use strict';
+
+const path = require('path');
+const { promisify } = require('util');
+const execFileDefault = promisify(require('child_process').execFile);
+const { TEAMS_BINARIES, TEAMS_CLI_PACKAGE } = require('./constants');
+const { atkInstallPrefix, atkInstallEnv } = require('./install-atk');
+
+/**
+ * @param {Object|null} resultOrError
+ * @returns {string}
+ */
+function execText(resultOrError) {
+  const stdout = resultOrError && resultOrError.stdout ? String(resultOrError.stdout) : '';
+  const stderr = resultOrError && resultOrError.stderr ? String(resultOrError.stderr) : '';
+  return `${stdout}\n${stderr}`;
+}
+
+/**
+ * @param {string} text
+ * @returns {boolean}
+ */
+function looksLikeTeamsVersion(text) {
+  return /\d+\.\d+/.test(String(text || ''));
+}
+
+/**
+ * @param {Function} execFileImpl
+ * @param {string} bin
+ * @param {Object} [env]
+ * @returns {Promise<boolean>}
+ */
+async function binaryResponds(execFileImpl, bin, env) {
+  const opts = { timeout: 20000, env: atkInstallEnv(env) };
+  try {
+    const result = await execFileImpl(bin, ['--version'], opts);
+    return looksLikeTeamsVersion(execText(result));
+  } catch (error) {
+    return looksLikeTeamsVersion(execText(error));
+  }
+}
+
+/**
+ * @param {string} prefix
+ * @returns {string[]}
+ */
+function teamsInstallCandidates(prefix) {
+  return TEAMS_BINARIES.map((name) => path.join(prefix, 'bin', name));
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string|null>}
+ */
+async function findTeamsBinary(deps = {}) {
+  const execFileImpl = deps.execFile || execFileDefault;
+  const prefix = atkInstallPrefix(deps.env || process.env);
+  const bins = [...TEAMS_BINARIES, ...teamsInstallCandidates(prefix)];
+  for (const bin of bins) {
+    if (await binaryResponds(execFileImpl, bin, deps.env || process.env)) {
+      return bin;
+    }
+  }
+  return null;
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function installTeamsCli(deps = {}) {
+  if (typeof deps.installTeamsImpl === 'function') {
+    await deps.installTeamsImpl();
+    return;
+  }
+  const execFileImpl = deps.execFile || execFileDefault;
+  const prefix = atkInstallPrefix(deps.env || process.env);
+  await execFileImpl(
+    'npm',
+    ['install', '-g', TEAMS_CLI_PACKAGE, '--prefix', prefix],
+    { timeout: 180000, env: atkInstallEnv(deps.env || process.env) }
+  );
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string|null>}
+ */
+async function findOrInstallTeamsBinary(deps = {}) {
+  const existing = await findTeamsBinary(deps);
+  if (existing) {
+    return existing;
+  }
+  if (deps.skipInstall === true) {
+    return null;
+  }
+  try {
+    await installTeamsCli(deps);
+  } catch {
+    return null;
+  }
+  return findTeamsBinary(deps);
+}
+
+module.exports = {
+  findTeamsBinary,
+  installTeamsCli,
+  findOrInstallTeamsBinary
+};

package/lib/channels/microsoft-provisioning/login-portal-device.js

@@ -0,0 +1,236 @@
+/**
+ * Portal M365 device-code login via MSAL bundled with Agents Toolkit.
+ *
+ * @fileoverview Writes Toolkit ~/.fx account cache; never uses localhost redirect
+ */
+
+'use strict';
+
+const path = require('path');
+const { createRequire } = require('module');
+const fs = require('../../internal/fs-real-sync');
+const {
+  ATK_M365_CLIENT_ID,
+  ATK_APP_STUDIO_SCOPE,
+  ATK_DEVICE_LOGIN_URL,
+  ATK_ACCOUNT_NAME
+} = require('./constants');
+const { microsoftProvisioningError } = require('./errors');
+const { atkInstallEnv, atkWritableHome } = require('./install-atk');
+
+const localRequire = createRequire(__filename);
+
+/**
+ * @param {string|null} atkBin
+ * @returns {string[]}
+ */
+function msalCandidatePaths(atkBin) {
+  if (!atkBin) {
+    return [];
+  }
+  const prefix = path.resolve(path.dirname(atkBin), '..');
+  const pkg = '@microsoft/m365agentstoolkit-cli/node_modules/@azure/msal-node';
+  return [
+    path.join(prefix, 'lib/node_modules', pkg),
+    path.join(prefix, 'lib/node_modules/@azure/msal-node')
+  ];
+}
+
+/**
+ * @param {string|null} atkBin
+ * @param {Object} [deps]
+ * @returns {Object|null}
+ */
+function loadMsalNode(atkBin, deps = {}) {
+  if (typeof deps.loadMsalNode === 'function') {
+    return deps.loadMsalNode(atkBin);
+  }
+  for (const candidate of msalCandidatePaths(atkBin)) {
+    try {
+      return localRequire(candidate);
+    } catch {
+      // next candidate
+    }
+  }
+  return null;
+}
+
+/**
+ * @param {string} home
+ * @returns {string}
+ */
+function accountDir(home) {
+  return path.join(home, '.fx', 'account');
+}
+
+/**
+ * @param {string} home
+ * @returns {{ beforeCacheAccess: Function, afterCacheAccess: Function }}
+ */
+function createFxCachePlugin(home) {
+  const filePath = path.join(accountDir(home), `token.cache.${ATK_ACCOUNT_NAME}.json`);
+  return {
+    async beforeCacheAccess(cacheContext) {
+      if (!fs.existsSync(filePath)) {
+        return;
+      }
+      const text = fs.readFileSync(filePath, 'utf8');
+      if (text) {
+        cacheContext.tokenCache.deserialize(text);
+      }
+    },
+    async afterCacheAccess(cacheContext) {
+      if (!cacheContext.cacheHasChanged) {
+        return;
+      }
+      fs.mkdirSync(accountDir(home), { recursive: true });
+      fs.writeFileSync(filePath, cacheContext.tokenCache.serialize());
+    }
+  };
+}
+
+/**
+ * @param {string} home
+ * @param {Object|null} result
+ * @returns {void}
+ */
+function writeAccountSidecars(home, result) {
+  const account = result && result.account;
+  if (!account) {
+    return;
+  }
+  const dir = accountDir(home);
+  fs.mkdirSync(dir, { recursive: true });
+  if (account.homeAccountId) {
+    fs.writeFileSync(path.join(dir, `homeId.cache.${ATK_ACCOUNT_NAME}`), account.homeAccountId);
+  }
+  if (account.tenantId) {
+    fs.writeFileSync(path.join(dir, `tenantId.cache.${ATK_ACCOUNT_NAME}`), account.tenantId);
+  }
+}
+
+/**
+ * @param {string|null} tenantId
+ * @returns {string}
+ */
+function authorityForTenant(tenantId) {
+  if (tenantId) {
+    return `https://login.microsoftonline.com/${tenantId}`;
+  }
+  return 'https://login.microsoftonline.com/organizations';
+}
+
+/**
+ * @param {Object} info
+ * @returns {{ loginUrl: string, userCode: string|null }}
+ */
+function deviceInfoToLogin(info) {
+  const loginUrl =
+    typeof info.verificationUri === 'string' && info.verificationUri.trim()
+      ? info.verificationUri.trim()
+      : ATK_DEVICE_LOGIN_URL;
+  const userCode = typeof info.userCode === 'string' ? info.userCode.trim() : null;
+  return { loginUrl, userCode };
+}
+
+/**
+ * @param {Object} msal
+ * @param {string} home
+ * @param {string|null} tenantId
+ * @returns {Object}
+ */
+function createPublicClient(msal, home, tenantId) {
+  return new msal.PublicClientApplication({
+    auth: {
+      clientId: ATK_M365_CLIENT_ID,
+      authority: authorityForTenant(tenantId)
+    },
+    cache: { cachePlugin: createFxCachePlugin(home) }
+  });
+}
+
+/**
+ * @param {Promise<{ loginUrl: string, userCode: string|null }>} ready
+ * @returns {Promise<{ loginUrl: string, userCode: string|null }|null>}
+ */
+function waitForDeviceInfo(ready) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => resolve(null), 20000);
+    ready
+      .then((parsed) => {
+        clearTimeout(timer);
+        resolve(parsed);
+      })
+      .catch(() => {
+        clearTimeout(timer);
+        resolve(null);
+      });
+  });
+}
+
+/**
+ * Start device-code login and return the browser URL as soon as MSAL prints it.
+ * @param {Object} params
+ * @param {string} key
+ * @param {Map} inflight
+ * @returns {Promise<{ waiting: boolean, loginUrl?: string, userCode?: string|null }>}
+ */
+function deviceCodeStartError(message) {
+  const error = microsoftProvisioningError(message, 'TOOLKIT');
+  error.statusCode = 409;
+  return error;
+}
+
+async function startMsalDeviceCode(params, key, inflight) {
+  const deps = params.deps || {};
+  const msal = loadMsalNode(params.atkBinary || null, deps);
+  if (!msal || typeof msal.PublicClientApplication !== 'function') {
+    throw deviceCodeStartError(
+      'Microsoft sign-in could not start (Agents Toolkit MSAL is not available).'
+    );
+  }
+  const home = atkWritableHome(atkInstallEnv(deps.env || process.env));
+  const pca = createPublicClient(msal, home, params.expectedTenantId || null);
+  let resolveReady;
+  const ready = new Promise((resolve) => {
+    resolveReady = resolve;
+  });
+  const request = {
+    scopes: [ATK_APP_STUDIO_SCOPE, 'openid', 'profile', 'offline_access'],
+    cancel: false,
+    deviceCodeCallback: (info) => resolveReady(deviceInfoToLogin(info))
+  };
+  const tokenPromise = pca.acquireTokenByDeviceCode(request).then((result) => {
+    writeAccountSidecars(home, result);
+    const job = inflight.get(key);
+    if (job) {
+      job.authenticated = true;
+    }
+    return result;
+  });
+  tokenPromise.catch(() => undefined);
+  const parsed = await waitForDeviceInfo(ready);
+  if (!parsed) {
+    request.cancel = true;
+    throw deviceCodeStartError(
+      'Microsoft sign-in timed out before a device code was issued. Use Get a new code.'
+    );
+  }
+  if (key) {
+    inflight.set(key, {
+      request,
+      tokenPromise,
+      cli: 'atk',
+      loginUrl: parsed.loginUrl,
+      userCode: parsed.userCode
+    });
+  }
+  return { waiting: true, loginUrl: parsed.loginUrl, userCode: parsed.userCode };
+}
+
+module.exports = {
+  loadMsalNode,
+  startMsalDeviceCode,
+  writeAccountSidecars,
+  createFxCachePlugin
+};

package/lib/channels/microsoft-provisioning/login-portal-parse.js

@@ -0,0 +1,71 @@
+/**
+ * Portal Microsoft login URL parsing. Device-code only — never loopback authorize.
+ *
+ * @fileoverview Remote browsers cannot complete MSAL localhost redirects
+ */
+
+'use strict';
+
+const { ATK_DEVICE_LOGIN_URL } = require('./constants');
+
+const DEVICE_LOGIN_RE =
+  /https:\/\/(?:www\.)?(?:microsoft\.com\/devicelogin|aka\.ms\/devicelogin)/i;
+const DEVICEAUTH_RE =
+  /https:\/\/login\.microsoftonline\.com\/[^\s"'<>]*oauth2\/(?:v2\.0\/)?deviceauth/i;
+const USER_CODE_RE = /enter the code\s+([A-Z0-9-]+)/i;
+const LOOPBACK_HOST = /(?:localhost|127\.0\.0\.1)/i;
+
+/**
+ * @param {string} url
+ * @returns {boolean}
+ */
+function isLoopbackAuthorizeUrl(url) {
+  const text = String(url || '');
+  if (!/login\.microsoftonline\.com/i.test(text)) {
+    return false;
+  }
+  if (!/oauth2\/v2\.0\/authorize/i.test(text)) {
+    return false;
+  }
+  return /redirect_uri=/i.test(text) && LOOPBACK_HOST.test(text);
+}
+
+/**
+ * @param {string} url
+ * @returns {boolean}
+ */
+function isDeviceLoginUrl(url) {
+  const text = String(url || '');
+  return DEVICE_LOGIN_RE.test(text) || DEVICEAUTH_RE.test(text);
+}
+
+/**
+ * Portal-safe Microsoft login URL (device-code hosts only).
+ * @param {string} url
+ * @returns {boolean}
+ */
+function isMicrosoftLoginUrl(url) {
+  return isDeviceLoginUrl(url) && !isLoopbackAuthorizeUrl(url);
+}
+
+/**
+ * @param {string} text
+ * @returns {{ loginUrl: string|null, userCode: string|null }}
+ */
+function parseMicrosoftLoginOutput(text) {
+  const blob = String(text || '');
+  const urls = blob.match(/https:\/\/[^\s"'<>]+/gi) || [];
+  const loginUrl = urls.find((item) => isMicrosoftLoginUrl(item)) || null;
+  const labelled = blob.match(USER_CODE_RE);
+  return {
+    loginUrl: loginUrl || (labelled ? ATK_DEVICE_LOGIN_URL : null),
+    userCode: labelled ? labelled[1] : null
+  };
+}
+
+module.exports = {
+  isLoopbackAuthorizeUrl,
+  isDeviceLoginUrl,
+  isMicrosoftLoginUrl,
+  parseMicrosoftLoginOutput
+};