@microsoft/agents-hosting 1.7.2 → 1.8.0-beta.36.gb033f0abc1

package/src/app/attachmentDownloader.ts

@@ -11,6 +11,8 @@ import { Attachment } from '@microsoft/agents-activity'
 import { AuthProvider } from '../auth/authProvider'
 import { debug } from '@microsoft/agents-telemetry'
 import { loadAuthConfigFromEnv, MsalTokenProvider } from '../auth'
+import { createOutboundHostValidator, OutboundUrlPolicy } from '../outboundHostValidator'
+import { Connections } from '../auth/connections'
 
 const logger = debug('agents:attachmentDownloader')
 
@@ -27,16 +29,19 @@ const logger = debug('agents:attachmentDownloader')
 export class AttachmentDownloader<TState extends TurnState = TurnState> implements InputFileDownloader<TState> {
   private _httpClient: HttpClient
   private _stateKey: string
+  private readonly _hostValidator: OutboundUrlPolicy
 
   /**
    * Creates an instance of AttachmentDownloader.
    * This class is responsible for downloading input files from attachments.
    *
    * @param stateKey The key to store files in state. Defaults to 'inputFiles'.
+   * @param outboundHostValidator Optional shared policy used to validate outbound attachment URLs.
    */
-  public constructor (stateKey: string = 'inputFiles') {
+  public constructor (stateKey: string = 'inputFiles', outboundHostValidator?: OutboundUrlPolicy) {
     this._httpClient = new HttpClient()
     this._stateKey = stateKey
+    this._hostValidator = outboundHostValidator ?? createOutboundHostValidator()
   }
 
   /**
@@ -52,10 +57,18 @@ export class AttachmentDownloader<TState extends TurnState = TurnState> implemen
       return Promise.resolve([])
     }
 
-    // TODO: from adapter
-    const authProvider: AuthProvider = new MsalTokenProvider()
-
-    const accessToken = await authProvider.getAccessToken(loadAuthConfigFromEnv(), 'https://api.botframework.com')
+    let accessToken = ''
+    const connectionManager = (context.adapter as { connectionManager?: Connections })?.connectionManager
+    const identity = context.identity
+    if (connectionManager && identity) {
+      const scope = identity.azp ?? identity.appid ?? 'https://api.botframework.com'
+      logger.debug(`Using adapter connection manager token provider for attachment downloads with scope ${scope}`)
+      accessToken = await connectionManager.getTokenProviderFromActivity(identity, context.activity).getAccessToken(scope)
+    } else {
+      logger.debug('Using MsalTokenProvider fallback for attachment downloads')
+      const authProvider: AuthProvider = new MsalTokenProvider()
+      accessToken = await authProvider.getAccessToken(loadAuthConfigFromEnv(), 'https://api.botframework.com')
+    }
 
     const files: InputFile[] = []
     for (const attachment of attachments) {
@@ -90,6 +103,13 @@ export class AttachmentDownloader<TState extends TurnState = TurnState> implemen
       if (accessToken.length > 0) {
         headers.Authorization = `Bearer ${accessToken}`
       }
+      if (!this._hostValidator.isAllowed(attachment.contentUrl)) {
+        let host = '[invalid-url]'
+        try { host = new URL(attachment.contentUrl).hostname } catch { /* invalid */ }
+        logger.warn(`Attachment contentUrl host is not in the configured allowed hosts. Host='${host}'`)
+        return undefined
+      }
+
       const response = await this._httpClient.get(attachment.contentUrl, {
         headers,
         responseType: 'arraybuffer'

package/src/app/auth/handlers/agenticAuthorization.ts

@@ -22,7 +22,7 @@ const logger = debug('agents:authorization:agentic')
  * where `{handlerId}` is the handler's unique identifier and `{propertyName}` matches the property name.
  *
  * @example
- * ```env
+ * ```
  * # For a handler with id "myAuth":
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__type=AgenticUserAuthorization
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__scopes=api://scope1 api://scope2

package/src/app/auth/handlers/azureBotAuthorization.ts

@@ -48,7 +48,7 @@ interface AzureBotActiveHandler extends ActiveAuthorizationHandler {
  * where `{handlerId}` is the handler's unique identifier and `{propertyName}` matches the property name.
  *
  * @example
- * ```env
+ * ```
  * # For a handler with id "myAuth":
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__azureBotOAuthConnectionName=MyConnection
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__oboScopes=api://scope1 api://scope2

package/src/app/auth/types.ts

@@ -126,7 +126,7 @@ export interface AuthorizationHandlerTokenOptions {
  * where `{handlerId}` is the handler's unique identifier and `{propertyName}` matches the property name.
  *
  * @example
- * ```env
+ * ```
  * # For a handler with id "myAuth":
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__azureBotOAuthConnectionName=MyConnection
  * AgentApplication__UserAuthorization__handlers__myAuth__settings__oboScopes=api://scope1 api://scope2
@@ -170,7 +170,7 @@ export interface AzureBotAuthorizationOptionsLegacy {
  * @deprecated
  * Messages configuration for the AzureBotAuthorization handler.
  */
-interface AzureBotAuthorizationOptionsMessages {
+export interface AzureBotAuthorizationOptionsMessages {
   /**
    * @deprecated Use `invalidSignInRetryMessage` instead.
    * Message displayed when an invalid code is entered.
@@ -198,7 +198,7 @@ interface AzureBotAuthorizationOptionsMessages {
  * @deprecated
  * Settings for on-behalf-of token acquisition.
  */
-interface AzureBotAuthorizationOptionsOBO {
+export interface AzureBotAuthorizationOptionsOBO {
   /**
    * @deprecated Use `oboConnectionName` instead.
    * Connection name to use for on-behalf-of token acquisition.

package/src/app/index.ts

@@ -3,6 +3,14 @@ export * from './agentApplicationBuilder'
 export * from './agentApplicationOptions'
 export * from './appRoute'
 export { Authorization } from './auth/authorization'
+export type { AgenticAuthorizationOptions, AzureBotAuthorizationOptions } from './auth/handlers'
+export type {
+  AuthorizationOptions,
+  AuthorizationHandlerTokenOptions,
+  AzureBotAuthorizationOptionsLegacy,
+  AzureBotAuthorizationOptionsMessages,
+  AzureBotAuthorizationOptionsOBO
+} from './auth/types'
 export * from './routeHandler'
 export * from './routeList'
 export * from './routeRank'

package/src/app/streaming/streamingResponse.ts

@@ -11,6 +11,10 @@ import { debug } from '@microsoft/agents-telemetry'
 import { Errors } from '../../errorHelper'
 
 const logger = debug('agents:streamingResponse')
+const teamsStreamTimedOut = 'Content stream finished due to exceeded streaming time.'
+const defaultStreamingTakingTooLongMessage = 'The response is taking longer than expected. Please wait while we continue to generate the response.'
+const m365StreamingTimeoutMs = 105000
+const m365WorkingNoticeIntervalMs = 35000
 
 /**
  * Results for streaming response operations.
@@ -57,6 +61,13 @@ export class StreamingResponse {
   private _finalMessage?: Activity
   private _canceled = false
   private _userCanceled = false
+  private _streamTimedOut = false
+  private _streamTimeoutNotificationSent = false
+  private _lastInformationalMessageSent = ''
+  private _streamStartedAt?: number
+  private _keepAliveTimer?: ReturnType<typeof setTimeout>
+  private _streamTimeoutTimer?: ReturnType<typeof setTimeout>
+  private _streamingTakingTooLongMessage = defaultStreamingTakingTooLongMessage
 
   // Queue for outgoing activities
   private _queue: Array<() => Activity> = []
@@ -127,12 +138,30 @@ export class StreamingResponse {
     return this._isStreamingChannel
   }
 
+  /**
+   * Gets the message sent when streaming takes longer than the channel allows.
+   */
+  public get streamingTakingTooLongMessage (): string {
+    return this._streamingTakingTooLongMessage
+  }
+
+  /**
+   * Sets the message sent when streaming takes longer than the channel allows.
+   */
+  public set streamingTakingTooLongMessage (message: string) {
+    this._streamingTakingTooLongMessage = message
+  }
+
   /**
    * Queues an informative update to be sent to the client.
    *
    * @param {string} text Text of the update to send.
    */
   public queueInformativeUpdate (text: string): void {
+    if (this.isM365Copilot()) {
+      this._lastInformationalMessageSent = text
+    }
+
     if (!this.isStreamingChannel || !text.trim() || this._canceled) {
       return
     }
@@ -203,9 +232,23 @@ export class StreamingResponse {
 
     // Queue final message
     this._ended = true
+    this.clearStreamTimers()
 
     if (!this.isStreamingChannel) {
-      await this.sendActivity(this.createFinalMessage())
+      // A failed streaming send may still be updating the timed-out activity.
+      // Preserve ordering so that the completed response is always the last update.
+      await this.waitForQueue()
+
+      if (this._streamTimeoutNotificationSent && !this._message && !this._finalMessage && !this._attachments?.length) {
+        return StreamingResponseResult.Success
+      }
+
+      const finalMessage = this.createFinalMessage()
+      if (this._streamTimedOut) {
+        await this.updateActivity(finalMessage)
+      } else {
+        await this.sendActivity(finalMessage)
+      }
       return StreamingResponseResult.Success
     }
 
@@ -214,6 +257,13 @@ export class StreamingResponse {
 
     // Wait for the queue to drain
     await this.waitForQueue()
+
+    // The final streaming send itself can report that the channel timed out. In
+    // that case the queued final activity is discarded and must be applied as
+    // an update after the timeout recovery has completed.
+    if (this._streamTimedOut) {
+      await this.updateActivity(this.createFinalMessage())
+    }
     return StreamingResponseResult.Success
   }
 
@@ -223,6 +273,7 @@ export class StreamingResponse {
    */
   public async reset () : Promise<void> {
     await this.waitForQueue()
+    this.clearStreamTimers()
 
     this._queueSync = undefined
     this._queue = []
@@ -230,6 +281,10 @@ export class StreamingResponse {
     this._ended = false
     this._canceled = false
     this._userCanceled = false
+    this._streamTimedOut = false
+    this._streamTimeoutNotificationSent = false
+    this._lastInformationalMessageSent = ''
+    this._streamStartedAt = undefined
     this._message = ''
     this._nextSequence = 1
     this._streamId = undefined
@@ -358,6 +413,29 @@ export class StreamingResponse {
     return this._message
   }
 
+  /**
+   * Ends the streaming portion of a response while allowing the underlying operation to continue.
+   *
+   * @param message Message sent to notify the user that streaming has stopped.
+   * @returns Whether the streaming response was stopped.
+   */
+  public async sendStreamTimedOutNotification (message: string): Promise<boolean> {
+    if (this._ended || this._canceled || !this.isStreamingChannel) {
+      return false
+    }
+
+    // Ensure any in-flight queued sends complete before we send the timeout notification.
+    await this.waitForQueue()
+
+    await this.sendActivity(this.createStreamStoppedMessage(message))
+    this._streamTimeoutNotificationSent = true
+    this._isStreamingChannel = false
+    this._queue = []
+    this._chunkQueued = false
+    this.clearStreamTimers()
+    return true
+  }
+
   /**
    * Waits for the outgoing activity queue to be empty.
    *
@@ -446,6 +524,10 @@ export class StreamingResponse {
     activity.attachments = this._attachments
     this._nextSequence++ // Increment sequence for final message, even if not streaming.
 
+    if (this._streamTimedOut && this._streamId) {
+      activity.id = this._streamId
+    }
+
     if (this.isStreamingChannel) {
       activity.entities.push({
         type: 'streaminfo',
@@ -457,6 +539,72 @@ export class StreamingResponse {
     return activity
   }
 
+  /**
+   * Creates the final streaming notification used when streaming stops but processing continues.
+   */
+  private createStreamStoppedMessage (message: string): Activity {
+    return Activity.fromObject({
+      type: 'message',
+      text: message || 'No text was streamed',
+      entities: [{
+        type: 'streaminfo',
+        streamType: 'final',
+        streamResult: this._message ? 'success' : 'error',
+        streamSequence: this._nextSequence++
+      }]
+    })
+  }
+
+  /**
+   * Creates a checkpoint or final notification for a channel streaming timeout.
+   */
+  private createStreamTimedOutMessage (addStreamFinal = false): Activity {
+    const text = this._message
+      ? `${this._message}\n\n${this.streamingTakingTooLongMessage}\n`
+      : this.streamingTakingTooLongMessage
+    const activity = Activity.fromObject({
+      type: 'message',
+      text,
+      entities: []
+    })
+
+    if (this._streamId) {
+      activity.id = this._streamId
+    }
+
+    if (addStreamFinal) {
+      activity.entities!.push({
+        type: 'streaminfo',
+        streamType: 'final',
+        streamId: this._streamId,
+        streamResult: this._message ? 'success' : 'error',
+        streamSequence: this._nextSequence++
+      })
+    }
+
+    return activity
+  }
+
+  /**
+   * Creates the last streaming update sent before proactively finalizing an
+   * M365 Copilot stream.
+   */
+  private createStreamTimedOutStreamingUpdate (): Activity {
+    const text = this._message
+      ? `${this._message}\n\n${this.streamingTakingTooLongMessage}\n`
+      : this.streamingTakingTooLongMessage
+
+    return Activity.fromObject({
+      type: 'typing',
+      text,
+      entities: [{
+        type: 'streaminfo',
+        streamType: 'streaming',
+        streamSequence: this._nextSequence++
+      }]
+    })
+  }
+
   /**
    * Sends an activity to the client and saves the stream ID returned.
    *
@@ -465,16 +613,15 @@ export class StreamingResponse {
    * @private
    */
   private async sendActivity (activity: Activity): Promise<void> {
-    // Set activity ID to the assigned stream ID
-    if (this._streamId) {
+    this.startStreamTimers()
+
+    // Only streaming activities should carry stream metadata. Once streaming
+    // has stopped, the completed response must be sent as an independent
+    // message without an orphaned streamId entity.
+    const streamInfo = activity.entities?.find(entity => entity.type?.toLowerCase() === 'streaminfo')
+    if (this._streamId && streamInfo) {
       activity.id = this._streamId
-      if (!activity.entities) {
-        activity.entities = []
-      }
-      if (!activity.entities[0]) {
-        activity.entities[0] = {} as Entity
-      }
-      activity.entities[0].streamId = this._streamId
+      streamInfo.streamId = this._streamId
     }
 
     if (this._citations && this._citations.length > 0 && !this._ended) {
@@ -507,25 +654,138 @@ export class StreamingResponse {
       if (!this._streamId) {
         this._streamId = response?.id
       }
+      if (this.isM365Copilot() && this.isStreamingChannel && !this._ended) {
+        this.scheduleKeepAlive()
+      }
       await new Promise((resolve) => setTimeout(resolve, this.delayInMs))
     } catch (error) {
-      const { message } = error as Error
+      const message = error instanceof Error ? error.message : String(error)
       this._canceled = true
-      this._queueSync = undefined
       this._queue = []
+      this._chunkQueued = false
+      this.clearStreamTimers()
 
       // MS Teams code list: https://learn.microsoft.com/en-us/microsoftteams/platform/bots/streaming-ux?tabs=jsts#error-codes
-      if (message.includes('ContentStreamNotAllowed')) {
+      const normalizedMessage = message.toLowerCase()
+      if (normalizedMessage.includes('contentstreamnotallowed') && normalizedMessage.includes(teamsStreamTimedOut.toLowerCase())) {
+        logger.warn('Client canceled due to exceeded allowed streaming time.', { originalError: message })
+        this._streamTimedOut = true
+        this._canceled = false
+        this._isStreamingChannel = false
+        await this.updateActivity(this.createStreamTimedOutMessage())
+      } else if (normalizedMessage.includes('contentstreamnotallowed')) {
         logger.warn('Streaming content is not allowed by the client side.', { originalError: message })
         this._userCanceled = true
-      } else if (message.includes('BadArgument') && message.toLowerCase().includes('streaming api is not enabled')) {
+      } else if (normalizedMessage.includes('badargument') && normalizedMessage.includes('streaming api is not enabled')) {
         logger.warn('Interaction does not support streaming. Defaulting to non-streaming response.', { originalError: message })
         this._canceled = false
         this._isStreamingChannel = false
+      } else {
+        logger.error('Exception during StreamingResponse sendActivity.', { originalError: message })
       }
     }
   }
 
+  /**
+   * Updates the existing streaming activity without allowing failures to escape the queue.
+   */
+  private async updateActivity (activity: Activity): Promise<void> {
+    try {
+      await this._context.updateActivity(activity)
+    } catch (error) {
+      logger.warn('Exception during StreamingResponse updateActivity.', { originalError: (error as Error).message })
+    }
+  }
+
+  /**
+   * Starts M365 Copilot keep-alive and maximum-duration timers.
+   */
+  private startStreamTimers (): void {
+    if (!this.isM365Copilot() || !this.isStreamingChannel || this._streamStartedAt !== undefined) {
+      return
+    }
+
+    this._streamStartedAt = Date.now()
+    this.scheduleKeepAlive()
+    this._streamTimeoutTimer = setTimeout(() => {
+      this.handleM365StreamTimeout().catch(error => {
+        logger.error('Error handling the M365 Copilot streaming timeout.', { originalError: (error as Error).message })
+      })
+    }, m365StreamingTimeoutMs)
+  }
+
+  /**
+   * Schedules an informative update before M365 Copilot's idle timeout.
+   */
+  private scheduleKeepAlive (): void {
+    if (!this.isM365Copilot() || !this.isStreamingChannel || this._ended) {
+      return
+    }
+
+    if (this._keepAliveTimer) {
+      clearTimeout(this._keepAliveTimer)
+    }
+
+    this._keepAliveTimer = setTimeout(() => {
+      this._keepAliveTimer = undefined
+      if (!this._ended && this.isStreamingChannel && this._queue.length === 0) {
+        this.queueInformativeUpdate(this._lastInformationalMessageSent.trim()
+          ? this._lastInformationalMessageSent
+          : this.streamingTakingTooLongMessage)
+      }
+    }, m365WorkingNoticeIntervalMs)
+  }
+
+  /**
+   * Finalizes an M365 Copilot stream that reached the channel duration limit.
+   */
+  private async handleM365StreamTimeout (): Promise<void> {
+    if (this._ended || this._canceled || !this.isStreamingChannel || !this.isM365Copilot()) {
+      return
+    }
+
+    logger.warn('M365 Copilot streaming response reached the maximum duration. Finalizing the stream and continuing in non-streaming mode.', {
+      streamId: this._streamId,
+      elapsedMs: this._streamStartedAt === undefined ? undefined : Date.now() - this._streamStartedAt
+    })
+
+    const timedOutActivities = this._message
+      ? [this.createStreamTimedOutStreamingUpdate(), this.createStreamTimedOutMessage(true)]
+      : [this.createStreamTimedOutMessage(true)]
+
+    this._streamTimeoutNotificationSent = true
+    this._isStreamingChannel = false
+    this._queue = []
+    this._chunkQueued = false
+    this.clearStreamTimers()
+
+    // Queue these behind any in-flight send. Clearing pending activities and
+    // using the same drain prevents out-of-order stream sequences.
+    for (const activity of timedOutActivities) {
+      this.queueActivity(() => activity)
+    }
+
+    await this.waitForQueue()
+  }
+
+  /**
+   * Stops active channel timeout timers.
+   */
+  private clearStreamTimers (): void {
+    if (this._keepAliveTimer) {
+      clearTimeout(this._keepAliveTimer)
+      this._keepAliveTimer = undefined
+    }
+    if (this._streamTimeoutTimer) {
+      clearTimeout(this._streamTimeoutTimer)
+      this._streamTimeoutTimer = undefined
+    }
+  }
+
+  private isM365Copilot (): boolean {
+    return this._context.activity.channelId?.toLocaleLowerCase() === Channels.M365Copilot.toLocaleLowerCase()
+  }
+
   /**
    * Loads default values for the streaming response.
    */
@@ -537,14 +797,8 @@ export class StreamingResponse {
     if (activity.deliveryMode === DeliveryModes.ExpectReplies) {
       this._isStreamingChannel = false
     } else if (Channels.Msteams === activity.channelIdChannel) {
-      if (activity.isAgenticRequest()) {
-        // Agentic requests do not support streaming responses at this time.
-        // TODO: Enable streaming for agentic requests when supported.
-        this._isStreamingChannel = false
-      } else {
-        this._isStreamingChannel = true
-        this._delayInMs = 1000
-      }
+      this._isStreamingChannel = true
+      this._delayInMs = 1000
     } else if (Channels.Webchat === activity.channelId || Channels.Directline === activity.channelId || Channels.Emulator === activity.channelId) {
       this._isStreamingChannel = true
       this._delayInMs = 500

package/src/app/teamsAttachmentDownloader.ts

@@ -11,6 +11,7 @@ import { TurnContext } from '../turnContext'
 import { TurnState } from './turnState'
 import { HttpClient } from '../httpClient'
 import { z } from 'zod'
+import { createOutboundHostValidator, OutboundUrlPolicy } from '../outboundHostValidator'
 
 const logger = debug('agents:M365AttachmentDownloader')
 
@@ -20,10 +21,12 @@ const logger = debug('agents:M365AttachmentDownloader')
 export class M365AttachmentDownloader<TState extends TurnState = TurnState> implements InputFileDownloader<TState> {
   private _httpClient: HttpClient
   private _stateKey: string
+  private readonly _hostValidator: OutboundUrlPolicy
 
-  public constructor (stateKey: string = 'inputFiles') {
+  public constructor (stateKey: string = 'inputFiles', outboundHostValidator?: OutboundUrlPolicy) {
     this._httpClient = new HttpClient()
     this._stateKey = stateKey
+    this._hostValidator = outboundHostValidator ?? createOutboundHostValidator()
   }
 
   /**
@@ -69,6 +72,13 @@ export class M365AttachmentDownloader<TState extends TurnState = TurnState> impl
         const contentSchema = z.object({ downloadUrl: z.string().url() })
         const parsed = contentSchema.safeParse(attachment.content)
         const downloadUrl = parsed.success ? parsed.data.downloadUrl : attachment.contentUrl
+        if (!this._hostValidator.isAllowed(downloadUrl)) {
+          let host = '[invalid-url]'
+          try { host = new URL(downloadUrl).hostname } catch { /* invalid */ }
+          logger.warn(`Attachment downloadUrl host is not in the configured allowed hosts. Host='${host}'`)
+          return undefined
+        }
+
         const response = await this._httpClient.get(downloadUrl, { responseType: 'arraybuffer' })
 
         const content = Buffer.from(response.data as ArrayBuffer)

package/src/auth/authConfiguration.ts

@@ -8,6 +8,7 @@ import { loadEnvSettings, AuthConfiguration, envParser, envParserUtils, LoadEnv,
 
 export { type AuthConfiguration, type ConnectionSettings, type ConnectionSettingsBase, type MsalConnectionSettings, type SidecarConnectionSettings, AuthType, resolveAuthority, type ConnectionMapItem, resolveAuthType } from './settings'
 import { prune } from '../utils'
+import { parseBooleanEnv } from '../utils/env'
 import { ExceptionHelper } from '@microsoft/agents-activity'
 import { Errors } from '../errorHelper'
 
@@ -28,6 +29,7 @@ function summarizeAuthConfiguration (authConfig: AuthConfiguration) {
       authorityEndpoint: config.authorityEndpoint ? redactUrl(config.authorityEndpoint) : undefined,
       scopes: (config.scopes ? redactScopes(config.scopes) : undefined) as any,
       issuers: config.issuers?.map(redactUrl).filter(e => e !== undefined),
+      validateIssuer: config.validateIssuer,
       federatedClientId: redactString(config.federatedClientId, true),
       certPemFile: redactString(config.certPemFile),
       certKeyFile: redactString(config.certKeyFile),
@@ -40,6 +42,7 @@ function summarizeAuthConfiguration (authConfig: AuthConfiguration) {
       alternateBlueprintConnectionName: undefined, // Alias of altBlueprintConnectionName, avoid logging duplicate info
       azureRegion: config.azureRegion,
       sendX5C: config.sendX5C,
+      msalRetryCount: config.msalRetryCount,
       sidecarBaseUrl: config.sidecarBaseUrl ? redactUrl(config.sidecarBaseUrl) : undefined,
       serviceName: config.serviceName,
       blueprintServiceName: config.blueprintServiceName,
@@ -96,6 +99,10 @@ const connectionsEnv = {
     idpmResource: envParserUtils.bypass,
     azureRegion: envParserUtils.bypass,
     sendX5C: (value) => ({ value: value === 'true' }),
+    msalRetryCount: (value) => {
+      const n = parseInt(value, 10)
+      return { value: Number.isFinite(n) && n >= 0 ? n : undefined }
+    },
     sidecarBaseUrl: envParserUtils.bypass,
     serviceName: envParserUtils.bypass,
     blueprintServiceName: envParserUtils.bypass,
@@ -114,6 +121,7 @@ const connectionsEnv = {
       }
       return { value: value.split(/\s+/).filter(Boolean) }
     },
+    validateIssuer: (value) => ({ value: parseBooleanEnv(value) }),
   }),
   default (connections?: AuthConfiguration['connections'], connectionsMap?: AuthConfiguration['connectionsMap']) {
     const conn = connections ?? this.connections
@@ -230,6 +238,7 @@ const legacyBotFrameworkEnv = {
     WIDAssertionFile: envParserUtils.redirect(connectionsEnv.parser, 'WIDAssertionFile'),
     azureRegion: envParserUtils.redirect(connectionsEnv.parser, 'azureRegion'),
     sendX5C: envParserUtils.redirect(connectionsEnv.parser, 'sendX5C'),
+    msalRetryCount: envParserUtils.redirect(connectionsEnv.parser, 'msalRetryCount'),
     authType: envParserUtils.redirect(connectionsEnv.parser, 'authType'),
     federatedTokenFile: envParserUtils.redirect(connectionsEnv.parser, 'federatedTokenFile'),
     idpmResource: envParserUtils.redirect(connectionsEnv.parser, 'idpmResource'),
@@ -239,6 +248,7 @@ const legacyBotFrameworkEnv = {
     bypassLocalNetworkRestriction: envParserUtils.redirect(connectionsEnv.parser, 'bypassLocalNetworkRestriction'),
     requestTimeout: envParserUtils.redirect(connectionsEnv.parser, 'requestTimeout'),
     retryCount: envParserUtils.redirect(connectionsEnv.parser, 'retryCount'),
+    validateIssuer: envParserUtils.redirect(connectionsEnv.parser, 'validateIssuer'),
   }),
   process (env: LoadEnv) {
     return legacyPrefixEnv.process.call(this, env)
@@ -265,6 +275,7 @@ const legacyPrefixEnv = {
     WIDAssertionFile: envParserUtils.redirect(connectionsEnv.parser, 'WIDAssertionFile'),
     azureRegion: envParserUtils.redirect(connectionsEnv.parser, 'azureRegion'),
     sendX5C: envParserUtils.redirect(connectionsEnv.parser, 'sendX5C'),
+    msalRetryCount: envParserUtils.redirect(connectionsEnv.parser, 'msalRetryCount'),
     authType: envParserUtils.redirect(connectionsEnv.parser, 'authType'),
     federatedTokenFile: envParserUtils.redirect(connectionsEnv.parser, 'federatedTokenFile'),
     idpmResource: envParserUtils.redirect(connectionsEnv.parser, 'idpmResource'),
@@ -274,6 +285,7 @@ const legacyPrefixEnv = {
     bypassLocalNetworkRestriction: envParserUtils.redirect(connectionsEnv.parser, 'bypassLocalNetworkRestriction'),
     requestTimeout: envParserUtils.redirect(connectionsEnv.parser, 'requestTimeout'),
     retryCount: envParserUtils.redirect(connectionsEnv.parser, 'retryCount'),
+    validateIssuer: envParserUtils.redirect(connectionsEnv.parser, 'validateIssuer'),
   }),
   process (env: LoadEnv, prefix?: string) {
     const settings: Partial<AuthConfiguration> = {}

package/src/auth/index.ts

@@ -1,8 +1,9 @@
 export * from './authConfiguration'
 export * from './authConstants'
 export * from './authProvider'
-export * from './msal/msalTokenProvider'
+export * from './connections'
 export * from './request'
+export * from './msal/msalTokenProvider'
 export * from './msal/msalTokenCredential'
 export * from './connectionManager'
 export * from './connections'