@oneuptime/common 14.0.0 → 14.0.2

package/build/dist/Server/API/MicrosoftTeamsAPI.js

@@ -8,7 +8,6 @@ import URL from "../../Types/API/URL";
 import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
 import API from "../../Utils/API";
 import WorkspaceProjectAuthTokenService from "../Services/WorkspaceProjectAuthTokenService";
-import ObjectID from "../../Types/ObjectID";
 import WorkspaceUserAuthTokenService from "../Services/WorkspaceUserAuthTokenService";
 import WorkspaceType from "../../Types/Workspace/WorkspaceType";
 import MicrosoftTeamsUtil from "../Utils/Workspace/MicrosoftTeams/MicrosoftTeams";
@@ -17,6 +16,15 @@ import LocalFile from "../Utils/LocalFile";
 import path from "path";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import CommonAPI from "./CommonAPI";
+import WorkspaceNotificationRuleService from "../Services/WorkspaceNotificationRuleService";
+import WorkspaceNotificationRule from "../../Models/DatabaseModels/WorkspaceNotificationRule";
+import WorkspaceOAuthState, { WorkspaceOAuthFlow, } from "../Utils/Workspace/WorkspaceOAuthState";
+// Delegated scopes for "sign in with Microsoft Teams" — authorize and token requests must agree.
+const MICROSOFT_TEAMS_USER_SIGN_IN_SCOPES = "https://graph.microsoft.com/User.Read https://graph.microsoft.com/Team.ReadBasic.All https://graph.microsoft.com/Channel.ReadBasic.All https://graph.microsoft.com/ChannelMessage.Send";
+// The admin-consent sign-in only needs an ID token, to learn the tenant.
+const ADMIN_CONSENT_SIGN_IN_SCOPES = "openid profile";
+// Microsoft Entra tenant ids are GUIDs.
+const ENTRA_TENANT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 export default class MicrosoftTeamsAPI {
     static getTeamsAppManifest() {
         if (!MicrosoftTeamsAppClientId) {
@@ -154,6 +162,250 @@ export default class MicrosoftTeamsAPI {
         };
         return manifest;
     }
+    static getUserSignInRedirectUri() {
+        return `${AppApiClientUrl.toString()}/microsoft-teams/auth`;
+    }
+    static getAdminConsentRedirectUri() {
+        return `${AppApiClientUrl.toString()}/microsoft-teams/admin-consent/callback`;
+    }
+    static getIntegrationPageUrl(projectId) {
+        return URL.fromString(DashboardClientUrl.toString() +
+            `/${projectId.toString()}/settings/microsoft-teams-integration`);
+    }
+    /*
+     * Reads the tenant out of the ID token returned by the admin-consent
+     * sign-in, and refuses it unless every claim that ties it to this flow
+     * checks out.
+     *
+     * The token is not signature-checked, and does not need to be: it came
+     * straight back from Microsoft's token endpoint over TLS, in exchange for a
+     * code and this app's client secret, which OpenID Connect Core 3.1.3.7 lets
+     * stand in for the signature. The claims are still checked — audience,
+     * issuer, nonce and expiry — so a token minted for another app, another
+     * tenant or another sign-in is never accepted.
+     */
+    static getVerifiedTenantIdFromIdToken(data) {
+        if (typeof data.idToken !== "string") {
+            throw new BadDataException("Microsoft did not return an ID token for the admin consent sign-in.");
+        }
+        const parts = data.idToken.split(".");
+        if (parts.length !== 3 || !parts[1]) {
+            throw new BadDataException("Microsoft returned a malformed ID token for the admin consent sign-in.");
+        }
+        let claims;
+        try {
+            claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        }
+        catch (_a) {
+            throw new BadDataException("Microsoft returned a malformed ID token for the admin consent sign-in.");
+        }
+        if (!claims || typeof claims !== "object" || Array.isArray(claims)) {
+            throw new BadDataException("Microsoft returned a malformed ID token for the admin consent sign-in.");
+        }
+        const tenantClaim = claims["tid"];
+        if (typeof tenantClaim !== "string" ||
+            !ENTRA_TENANT_ID_PATTERN.test(tenantClaim)) {
+            throw new BadDataException("The admin consent sign-in did not identify a Microsoft 365 tenant.");
+        }
+        const tenantId = tenantClaim.toLowerCase();
+        if (typeof claims["aud"] !== "string" ||
+            claims["aud"].toLowerCase() !==
+                (MicrosoftTeamsAppClientId || "").toLowerCase()) {
+            throw new BadDataException("The admin consent sign-in was issued for a different application.");
+        }
+        if (typeof claims["iss"] !== "string" ||
+            claims["iss"].toLowerCase() !==
+                `https://login.microsoftonline.com/${tenantId}/v2.0`) {
+            throw new BadDataException("The admin consent sign-in was issued by an unexpected authority.");
+        }
+        if (claims["nonce"] !== data.expectedNonce) {
+            throw new BadDataException("The admin consent sign-in does not belong to this connection attempt.");
+        }
+        const expiresAtSeconds = claims["exp"];
+        if (typeof expiresAtSeconds !== "number" ||
+            expiresAtSeconds * 1000 <= Date.now()) {
+            throw new BadDataException("The admin consent sign-in has expired.");
+        }
+        if (tenantId !== data.expectedTenantId.toLowerCase()) {
+            throw new BadDataException("You signed in to a different Microsoft 365 tenant from the one that granted admin consent. Please sign in with an account from the tenant you granted consent for.");
+        }
+        return tenantId;
+    }
+    /*
+     * Admin consent, leg 1: the consent screen has redirected back with the
+     * tenant it says consented. That claim is only a query parameter, so it is
+     * used for nothing but choosing where to send the admin to sign in. A new
+     * single-use state pins the flow to that tenant, and the sign-in's ID token
+     * must then prove it.
+     */
+    static async continueAdminConsentWithSignIn(data) {
+        var _a, _b;
+        const { req, res, stateRecord, teamsIntegrationPageUrl } = data;
+        const tenantId = (((_a = req.query["tenant"]) === null || _a === void 0 ? void 0 : _a.toString()) || "")
+            .trim()
+            .toLowerCase();
+        if (!ENTRA_TENANT_ID_PATTERN.test(tenantId)) {
+            return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Missing tenant information from admin consent callback"));
+        }
+        if (((_b = req.query["admin_consent"]) === null || _b === void 0 ? void 0 : _b.toString().toLowerCase()) !== "true") {
+            return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Admin consent was not granted for the OneUptime Microsoft Teams app"));
+        }
+        if (stateRecord.tenantId &&
+            stateRecord.tenantId.toLowerCase() !== tenantId) {
+            logger.warn(`Refusing Microsoft Teams admin consent for project ${stateRecord.projectId.toString()}: consent came back for tenant ${tenantId}, but the project is connected to tenant ${stateRecord.tenantId}.`, getLogAttributesFromRequest(req));
+            return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Admin consent was granted for a different Microsoft 365 tenant from the one this project is connected to. Disconnect Microsoft Teams in Project Settings before connecting a different tenant."));
+        }
+        const { state, oidcNonce } = await WorkspaceOAuthState.create({
+            req,
+            res,
+            flow: WorkspaceOAuthFlow.MicrosoftTeamsAdminConsentSignIn,
+            projectId: stateRecord.projectId,
+            userId: stateRecord.userId,
+            tenantId: tenantId,
+            includeOidcNonce: true,
+        });
+        const signInUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize?client_id=${encodeURIComponent(MicrosoftTeamsAppClientId || "")}&response_type=code&redirect_uri=${encodeURIComponent(MicrosoftTeamsAPI.getAdminConsentRedirectUri())}&response_mode=query&scope=${encodeURIComponent(ADMIN_CONSENT_SIGN_IN_SCOPES)}&state=${encodeURIComponent(state)}&nonce=${encodeURIComponent(oidcNonce || "")}`;
+        return Response.redirect(req, res, URL.fromString(signInUrl));
+    }
+    /*
+     * Admin consent, leg 2: trade the sign-in code for an ID token, take the
+     * tenant from it, and only then fetch that tenant's Graph app token and
+     * bind it to the project recorded in the state.
+     */
+    static async completeAdminConsent(data) {
+        var _a;
+        const { req, res, stateRecord, teamsIntegrationPageUrl } = data;
+        const projectId = stateRecord.projectId;
+        const userId = stateRecord.userId;
+        const code = (_a = req.query["code"]) === null || _a === void 0 ? void 0 : _a.toString();
+        if (!code || !stateRecord.tenantId || !stateRecord.oidcNonce) {
+            return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Microsoft did not return a sign-in for the admin consent. Please try again."));
+        }
+        // The request holds the client secret and the code; neither is logged.
+        const signInTokenResponse = await API.post({
+            url: URL.fromString(`https://login.microsoftonline.com/${stateRecord.tenantId}/oauth2/v2.0/token`),
+            data: {
+                grant_type: "authorization_code",
+                code: code,
+                client_id: MicrosoftTeamsAppClientId || "",
+                client_secret: MicrosoftTeamsAppClientSecret || "",
+                redirect_uri: MicrosoftTeamsAPI.getAdminConsentRedirectUri(),
+                scope: ADMIN_CONSENT_SIGN_IN_SCOPES,
+            },
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        });
+        if (signInTokenResponse instanceof HTTPErrorResponse) {
+            logger.error("Error exchanging the Microsoft Teams admin consent sign-in code:", getLogAttributesFromRequest(req));
+            logger.error(signInTokenResponse, getLogAttributesFromRequest(req));
+            return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Could not verify the Microsoft 365 sign-in after admin consent"));
+        }
+        let tenantId;
+        try {
+            tenantId = MicrosoftTeamsAPI.getVerifiedTenantIdFromIdToken({
+                idToken: signInTokenResponse.data["id_token"],
+                expectedTenantId: stateRecord.tenantId,
+                expectedNonce: stateRecord.oidcNonce,
+            });
+        }
+        catch (verificationError) {
+            logger.warn(`Refusing Microsoft Teams admin consent for project ${projectId.toString()}: ${verificationError.message}`, getLogAttributesFromRequest(req));
+            return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", verificationError.message));
+        }
+        // Fetch any existing project auth to merge
+        const existingAuth = await WorkspaceProjectAuthTokenService.getProjectAuth({
+            projectId: projectId,
+            workspaceType: WorkspaceType.MicrosoftTeams,
+        });
+        // Acquire an application token for the verified tenant using client credentials
+        const tokenResp = await API.post({
+            url: URL.fromString(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`),
+            data: {
+                client_id: MicrosoftTeamsAppClientId || "",
+                client_secret: MicrosoftTeamsAppClientSecret || "",
+                grant_type: "client_credentials",
+                scope: "https://graph.microsoft.com/.default",
+            },
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        });
+        if (tokenResp instanceof HTTPErrorResponse) {
+            logger.error("Error getting app token after admin consent:", getLogAttributesFromRequest(req));
+            logger.error(tokenResp, getLogAttributesFromRequest(req));
+            return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Failed to get Graph app token after admin consent"));
+        }
+        const tokenData = tokenResp.data;
+        const appAccessToken = tokenData["access_token"] || "";
+        const expiresInSec = Number(tokenData["expires_in"] || 0);
+        const expiresAt = new Date(Date.now() + Math.max(0, (expiresInSec - 60) * 1000));
+        // tokenData carries the app access token; only its expiry is logged.
+        logger.debug("Microsoft Graph app token acquired via admin consent. expiresAt: " +
+            expiresAt.toISOString(), getLogAttributesFromRequest(req));
+        // Get available teams from user auth token
+        const userAuth = await WorkspaceUserAuthTokenService.getUserAuth({
+            projectId: projectId,
+            userId: userId,
+            workspaceType: WorkspaceType.MicrosoftTeams,
+        });
+        let availableTeams = {};
+        if (userAuth === null || userAuth === void 0 ? void 0 : userAuth.miscData) {
+            availableTeams = userAuth.miscData.availableTeams || {};
+        }
+        // If no teams from user auth, try to get them using app token
+        if (Object.keys(availableTeams).length === 0) {
+            try {
+                const teamsResponse = await API.get({
+                    url: URL.fromString("https://graph.microsoft.com/v1.0/teams?$select=id,displayName"),
+                    headers: {
+                        Authorization: `Bearer ${appAccessToken}`,
+                    },
+                });
+                if (teamsResponse instanceof HTTPErrorResponse) {
+                    logger.error("Failed to get teams:", getLogAttributesFromRequest(req));
+                    logger.error(teamsResponse, getLogAttributesFromRequest(req));
+                    return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Failed to retrieve teams from Microsoft Graph API after admin consent"));
+                }
+                const teamsData = teamsResponse.data;
+                const teams = teamsData["value"] || [];
+                if (teams.length === 0) {
+                    return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "No teams available in your Microsoft 365 tenant. Please create a team first."));
+                }
+                availableTeams = teams.reduce((acc, t) => {
+                    const team = {
+                        id: t["id"],
+                        name: t["displayName"] || "Unnamed Team",
+                    };
+                    /*
+                     * Keyed by id, not display name — Teams allows duplicate
+                     * team names, and keying by name silently collapsed them so
+                     * only the last one of each name was selectable.
+                     */
+                    acc[team.id] = team;
+                    return acc;
+                }, {});
+            }
+            catch (error) {
+                logger.error("Error getting teams:", getLogAttributesFromRequest(req));
+                logger.error(error, getLogAttributesFromRequest(req));
+                return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Failed to retrieve teams from Microsoft Graph API"));
+            }
+        }
+        /*
+         * Merge and persist project auth with tenantId and available teams. The
+         * app token goes in authToken / authTokenExpiresAt only: miscData is
+         * readable by every project Viewer.
+         */
+        const mergedMiscData = Object.assign(Object.assign({}, existingAuth === null || existingAuth === void 0 ? void 0 : existingAuth.miscData), { tenantId: tenantId, adminConsentGranted: true, adminConsentGrantedAt: new Date().toISOString(), adminConsentGrantedBy: userId.toString(), availableTeams: availableTeams, botId: MicrosoftTeamsAppClientId || "" });
+        await WorkspaceProjectAuthTokenService.refreshAuthToken({
+            projectId: projectId,
+            workspaceType: WorkspaceType.MicrosoftTeams,
+            authToken: appAccessToken,
+            authTokenExpiresAt: expiresAt,
+            workspaceProjectId: tenantId, // Use tenant ID as the workspace project identifier
+            miscData: mergedMiscData,
+        });
+        return Response.redirect(req, res, teamsIntegrationPageUrl
+            .addQueryParam("adminConsent", "success")
+            .addQueryParam("tenantId", tenantId));
+    }
     getRouter() {
         const router = Express.getRouter();
         // Teams app manifest ZIP endpoint
@@ -215,10 +467,37 @@ export default class MicrosoftTeamsAPI {
             }
         });
         /*
-         * Microsoft Teams OAuth callback endpoint for project integration
-         * New (preferred) static redirect URI that uses state param to carry projectId and userId
-         * State format: <projectId>:<userId>
+         * Start "sign in with Microsoft Teams" for the calling user.
+         *
+         * Returns the Microsoft authorize URL for the dashboard to navigate to. The
+         * `state` in it is an opaque single-use nonce (see WorkspaceOAuthState):
+         * the callback below learns the project and user from the server-side
+         * record behind it, never from the redirect.
          */
+        router.get("/microsoft-teams/sign-in-url", UserMiddleware.getUserMiddleware, async (req, res) => {
+            try {
+                const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+                if (!MicrosoftTeamsAppClientId) {
+                    throw new BadDataException("Microsoft Teams App Client ID is not set");
+                }
+                const { state } = await WorkspaceOAuthState.create({
+                    req,
+                    res,
+                    flow: WorkspaceOAuthFlow.MicrosoftTeamsUserSignIn,
+                    projectId: projectId,
+                    userId: databaseProps.userId,
+                });
+                const authorizationUrl = `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=${encodeURIComponent(MicrosoftTeamsAppClientId)}&response_type=code&redirect_uri=${encodeURIComponent(MicrosoftTeamsAPI.getUserSignInRedirectUri())}&response_mode=query&scope=${encodeURIComponent(MICROSOFT_TEAMS_USER_SIGN_IN_SCOPES)}&state=${encodeURIComponent(state)}`;
+                return Response.sendJsonObjectResponse(req, res, {
+                    authorizationUrl: authorizationUrl,
+                });
+            }
+            catch (err) {
+                return Response.sendErrorResponse(req, res, err);
+            }
+        });
+        // Microsoft Teams OAuth callback for "sign in with Microsoft Teams".
         router.get("/microsoft-teams/auth", async (req, res) => {
             var _a, _b, _c, _d;
             if (!MicrosoftTeamsAppClientId) {
@@ -227,20 +506,24 @@ export default class MicrosoftTeamsAPI {
             if (!MicrosoftTeamsAppClientSecret) {
                 return Response.sendErrorResponse(req, res, new BadDataException("Microsoft Teams App Client Secret is not set"));
             }
-            const error = (_a = req.query["error"]) === null || _a === void 0 ? void 0 : _a.toString();
-            const stateParam = (_b = req.query["state"]) === null || _b === void 0 ? void 0 : _b.toString();
-            if (!stateParam) {
-                return Response.sendErrorResponse(req, res, new BadRequestException("Invalid request - state param not present"));
+            let stateRecord = null;
+            try {
+                stateRecord = await WorkspaceOAuthState.consume({
+                    req,
+                    state: (_a = req.query["state"]) === null || _a === void 0 ? void 0 : _a.toString(),
+                    flows: [WorkspaceOAuthFlow.MicrosoftTeamsUserSignIn],
+                });
+            }
+            catch (err) {
+                logger.error(err, getLogAttributesFromRequest(req));
             }
-            // Expect state in format projectId:userId
-            const stateParts = stateParam.split(":");
-            if (stateParts.length !== 2 || !stateParts[0] || !stateParts[1]) {
-                return Response.sendErrorResponse(req, res, new BadRequestException("Invalid state param"));
+            if (!stateRecord) {
+                return Response.sendErrorResponse(req, res, new BadRequestException(WorkspaceOAuthState.INVALID_STATE_MESSAGE));
             }
-            const projectId = stateParts[0];
-            const userId = stateParts[1];
-            const teamsIntegrationPageUrl = URL.fromString(DashboardClientUrl.toString() +
-                `/${projectId.toString()}/settings/microsoft-teams-integration`);
+            const projectId = stateRecord.projectId;
+            const userId = stateRecord.userId;
+            const teamsIntegrationPageUrl = MicrosoftTeamsAPI.getIntegrationPageUrl(projectId);
+            const error = (_b = req.query["error"]) === null || _b === void 0 ? void 0 : _b.toString();
             if (error) {
                 return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", error));
             }
@@ -249,15 +532,13 @@ export default class MicrosoftTeamsAPI {
                 return Response.sendErrorResponse(req, res, new BadRequestException("Invalid request - no authorization code"));
             }
             try {
-                // Exchange code for access token
-                const redirectUri = URL.fromString(`${AppApiClientUrl.toString()}/microsoft-teams/auth`);
                 const tokenRequestBody = {
                     grant_type: "authorization_code",
                     code: code,
                     client_id: MicrosoftTeamsAppClientId,
                     client_secret: MicrosoftTeamsAppClientSecret,
-                    redirect_uri: redirectUri.toString(),
-                    scope: "https://graph.microsoft.com/User.Read https://graph.microsoft.com/Team.ReadBasic.All https://graph.microsoft.com/Channel.ReadBasic.All https://graph.microsoft.com/ChannelMessage.Send",
+                    redirect_uri: MicrosoftTeamsAPI.getUserSignInRedirectUri(),
+                    scope: MICROSOFT_TEAMS_USER_SIGN_IN_SCOPES,
                 };
                 /*
                  * The token request body holds the app client secret and the
@@ -299,8 +580,8 @@ export default class MicrosoftTeamsAPI {
                 logger.debug("User Profile: ", getLogAttributesFromRequest(req));
                 logger.debug(userProfile, getLogAttributesFromRequest(req));
                 await WorkspaceUserAuthTokenService.refreshAuthToken({
-                    projectId: new ObjectID(projectId),
-                    userId: new ObjectID(userId),
+                    projectId: projectId,
+                    userId: userId,
                     workspaceType: WorkspaceType.MicrosoftTeams,
                     authToken: accessToken,
                     workspaceUserId: userProfile["id"],
@@ -313,14 +594,14 @@ export default class MicrosoftTeamsAPI {
                 });
                 // Check if admin consent is already granted
                 const existingProjectAuth = await WorkspaceProjectAuthTokenService.getProjectAuth({
-                    projectId: new ObjectID(projectId),
+                    projectId: projectId,
                     workspaceType: WorkspaceType.MicrosoftTeams,
                 });
                 if (existingProjectAuth &&
                     ((_d = existingProjectAuth.miscData) === null || _d === void 0 ? void 0 : _d.adminConsentGranted)) {
                     // Admin consent already granted, refresh teams
                     await MicrosoftTeamsUtil.refreshTeams({
-                        projectId: new ObjectID(projectId),
+                        projectId: projectId,
                     });
                     return Response.redirect(req, res, teamsIntegrationPageUrl);
                 }
@@ -334,185 +615,113 @@ export default class MicrosoftTeamsAPI {
             }
         });
         /*
-         * Admin consent - start flow (tenant-wide admin consent)
-         * Uses state in the same format as OAuth: <projectId>:<userId>
+         * Admin consent - start flow (tenant-wide admin consent).
+         *
+         * Only a signed-in member who may manage the project's workspace
+         * connections can start it, and it returns the Microsoft admin-consent URL
+         * for the dashboard to navigate to. Its `state` is a single-use nonce
+         * recorded against this user and project — see WorkspaceOAuthState.
          */
-        router.get("/microsoft-teams/admin-consent", async (req, res) => {
-            var _a;
+        router.get("/microsoft-teams/admin-consent", UserMiddleware.getUserMiddleware, async (req, res) => {
             try {
+                const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+                CommonAPI.assertPermittedInProject({
+                    databaseProps: databaseProps,
+                    allowedPermissions: WorkspaceOAuthState.MANAGE_CONNECTION_PERMISSIONS,
+                    errorMessage: "You do not have permission to connect this project to Microsoft Teams.",
+                });
                 if (!MicrosoftTeamsAppClientId) {
-                    return Response.sendErrorResponse(req, res, new BadDataException("Microsoft Teams App Client ID is not set"));
-                }
-                const stateParam = (_a = req.query["state"]) === null || _a === void 0 ? void 0 : _a.toString();
-                if (!stateParam) {
-                    return Response.sendErrorResponse(req, res, new BadRequestException("Invalid request - state param not present"));
-                }
-                const stateParts = stateParam.split(":");
-                if (stateParts.length !== 2 || !stateParts[0] || !stateParts[1]) {
-                    return Response.sendErrorResponse(req, res, new BadRequestException("Invalid state param"));
-                }
-                const projectId = stateParts[0];
-                // Try to use tenant from existing project auth, otherwise default to "organizations"
-                let tenantForConsent = "organizations";
-                try {
-                    const existingAuth = await WorkspaceProjectAuthTokenService.getProjectAuth({
-                        projectId: new ObjectID(projectId),
-                        workspaceType: WorkspaceType.MicrosoftTeams,
-                    });
-                    const existingTenant = existingAuth === null || existingAuth === void 0 ? void 0 : existingAuth.workspaceProjectId;
-                    if (existingTenant) {
-                        tenantForConsent = existingTenant;
-                    }
-                }
-                catch (_b) {
-                    // ignore and fall back to default
+                    throw new BadDataException("Microsoft Teams App Client ID is not set");
                 }
-                const redirectUri = URL.fromString(`${AppApiClientUrl.toString()}/microsoft-teams/admin-consent/callback`);
-                const adminConsentUrl = `https://login.microsoftonline.com/${encodeURIComponent(tenantForConsent)}/v2.0/adminconsent?client_id=${encodeURIComponent(MicrosoftTeamsAppClientId)}&scope=${encodeURIComponent("https://graph.microsoft.com/.default")}&redirect_uri=${encodeURIComponent(redirectUri.toString())}&state=${encodeURIComponent(stateParam)}`;
-                return Response.redirect(req, res, URL.fromString(adminConsentUrl));
+                /*
+                 * A project already bound to a tenant re-consents for THAT tenant
+                 * only: the consent URL targets it, and the callback refuses any
+                 * other. Moving a project to a different tenant means disconnecting
+                 * it first.
+                 */
+                const existingAuth = await WorkspaceProjectAuthTokenService.getProjectAuth({
+                    projectId: projectId,
+                    workspaceType: WorkspaceType.MicrosoftTeams,
+                });
+                const existingTenantId = (existingAuth === null || existingAuth === void 0 ? void 0 : existingAuth.workspaceProjectId) || undefined;
+                const { state } = await WorkspaceOAuthState.create({
+                    req,
+                    res,
+                    flow: WorkspaceOAuthFlow.MicrosoftTeamsAdminConsent,
+                    projectId: projectId,
+                    userId: databaseProps.userId,
+                    tenantId: existingTenantId,
+                });
+                const authorizationUrl = `https://login.microsoftonline.com/${encodeURIComponent(existingTenantId || "organizations")}/v2.0/adminconsent?client_id=${encodeURIComponent(MicrosoftTeamsAppClientId)}&scope=${encodeURIComponent("https://graph.microsoft.com/.default")}&redirect_uri=${encodeURIComponent(MicrosoftTeamsAPI.getAdminConsentRedirectUri())}&state=${encodeURIComponent(state)}`;
+                return Response.sendJsonObjectResponse(req, res, {
+                    authorizationUrl: authorizationUrl,
+                });
             }
             catch (error) {
                 logger.error("Error starting Teams admin consent: ", getLogAttributesFromRequest(req));
                 logger.error(error, getLogAttributesFromRequest(req));
-                return Response.sendErrorResponse(req, res, new BadDataException("Failed to start Microsoft Teams admin consent"));
+                return Response.sendErrorResponse(req, res, error);
             }
         });
         /*
-         * Admin consent - callback handler
-         * Receives: state=<projectId>:<userId>, tenant=<tenantId>, admin_consent=True | error params
+         * Admin consent - callback handler. Microsoft redirects here twice:
+         *
+         *  1. After the admin-consent screen, with tenant=<tenantId> and
+         *     admin_consent=True. Both are plain query parameters anyone can type,
+         *     so nothing is stored on them. The flow continues to a sign-in against
+         *     that tenant instead.
+         *  2. After that sign-in, with an authorization code. Its ID token says
+         *     which tenant the person completing the flow actually signed in to,
+         *     and only a tenant proven that way is bound to the project.
+         *
+         * Which leg a request is comes from the server-side state record, not from
+         * the shape of the query string.
          */
         router.get("/microsoft-teams/admin-consent/callback", async (req, res) => {
-            var _a, _b, _c, _d, _e;
+            var _a, _b, _c;
+            let teamsIntegrationPageUrl = null;
             try {
-                const error = (_a = req.query["error"]) === null || _a === void 0 ? void 0 : _a.toString();
-                const errorDescription = (_b = req.query["error_description"]) === null || _b === void 0 ? void 0 : _b.toString();
-                const stateParam = (_c = req.query["state"]) === null || _c === void 0 ? void 0 : _c.toString();
-                const tenantId = (_d = req.query["tenant"]) === null || _d === void 0 ? void 0 : _d.toString();
-                if (!stateParam) {
-                    return Response.sendErrorResponse(req, res, new BadRequestException("Invalid request - state param not present"));
-                }
-                const stateParts = stateParam.split(":");
-                if (stateParts.length !== 2 || !stateParts[0] || !stateParts[1]) {
-                    return Response.sendErrorResponse(req, res, new BadRequestException("Invalid state param"));
+                const stateRecord = await WorkspaceOAuthState.consume({
+                    req,
+                    state: (_a = req.query["state"]) === null || _a === void 0 ? void 0 : _a.toString(),
+                    flows: [
+                        WorkspaceOAuthFlow.MicrosoftTeamsAdminConsent,
+                        WorkspaceOAuthFlow.MicrosoftTeamsAdminConsentSignIn,
+                    ],
+                });
+                if (!stateRecord) {
+                    return Response.sendErrorResponse(req, res, new BadRequestException(WorkspaceOAuthState.INVALID_STATE_MESSAGE));
                 }
-                const projectId = stateParts[0];
-                const teamsIntegrationPageUrl = URL.fromString(DashboardClientUrl.toString() +
-                    `/${projectId.toString()}/settings/microsoft-teams-integration`);
+                teamsIntegrationPageUrl = MicrosoftTeamsAPI.getIntegrationPageUrl(stateRecord.projectId);
+                const error = (_b = req.query["error"]) === null || _b === void 0 ? void 0 : _b.toString();
+                const errorDescription = (_c = req.query["error_description"]) === null || _c === void 0 ? void 0 : _c.toString();
                 if (error) {
                     return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", `${error}${errorDescription ? ": " + errorDescription : ""}`));
                 }
-                if (!tenantId) {
-                    return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Missing tenant information from admin consent callback"));
-                }
                 if (!MicrosoftTeamsAppClientId || !MicrosoftTeamsAppClientSecret) {
                     return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Microsoft Teams App credentials are not configured"));
                 }
-                // Fetch any existing project auth to merge
-                const existingAuth = await WorkspaceProjectAuthTokenService.getProjectAuth({
-                    projectId: new ObjectID(projectId),
-                    workspaceType: WorkspaceType.MicrosoftTeams,
-                });
-                // Acquire an application token for the specific tenant using client credentials
-                const tokenResp = await API.post({
-                    url: URL.fromString(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`),
-                    data: {
-                        client_id: MicrosoftTeamsAppClientId,
-                        client_secret: MicrosoftTeamsAppClientSecret,
-                        grant_type: "client_credentials",
-                        scope: "https://graph.microsoft.com/.default",
-                    },
-                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                });
-                if (tokenResp instanceof HTTPErrorResponse) {
-                    logger.error("Error getting app token after admin consent:", getLogAttributesFromRequest(req));
-                    logger.error(tokenResp, getLogAttributesFromRequest(req));
-                    return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Failed to get Graph app token after admin consent"));
-                }
-                const tokenData = tokenResp.data;
-                const appAccessToken = tokenData["access_token"] || "";
-                const expiresInSec = Number(tokenData["expires_in"] || 0);
-                const expiresAtIso = new Date(Date.now() + Math.max(0, (expiresInSec - 60) * 1000)).toISOString();
-                // tokenData carries the app access token; only its expiry is logged.
-                logger.debug("Microsoft Graph app token acquired via admin consent. expiresAt: " +
-                    expiresAtIso, getLogAttributesFromRequest(req));
-                // Get available teams from user auth token
-                const userId = stateParts[1];
-                const userAuth = await WorkspaceUserAuthTokenService.getUserAuth({
-                    projectId: new ObjectID(projectId),
-                    userId: new ObjectID(userId),
-                    workspaceType: WorkspaceType.MicrosoftTeams,
-                });
-                let availableTeams = {};
-                if (userAuth === null || userAuth === void 0 ? void 0 : userAuth.miscData) {
-                    availableTeams = userAuth.miscData.availableTeams || {};
-                }
-                // If no teams from user auth, try to get them using app token
-                if (Object.keys(availableTeams).length === 0) {
-                    try {
-                        const teamsResponse = await API.get({
-                            url: URL.fromString("https://graph.microsoft.com/v1.0/teams?$select=id,displayName"),
-                            headers: {
-                                Authorization: `Bearer ${appAccessToken}`,
-                            },
-                        });
-                        if (teamsResponse instanceof HTTPErrorResponse) {
-                            logger.error("Failed to get teams:", getLogAttributesFromRequest(req));
-                            logger.error(teamsResponse, getLogAttributesFromRequest(req));
-                            return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Failed to retrieve teams from Microsoft Graph API after admin consent"));
-                        }
-                        const teamsData = teamsResponse.data;
-                        const teams = teamsData["value"] || [];
-                        if (teams.length === 0) {
-                            return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "No teams available in your Microsoft 365 tenant. Please create a team first."));
-                        }
-                        availableTeams = teams.reduce((acc, t) => {
-                            const team = {
-                                id: t["id"],
-                                name: t["displayName"] || "Unnamed Team",
-                            };
-                            /*
-                             * Keyed by id, not display name — Teams allows duplicate
-                             * team names, and keying by name silently collapsed them so
-                             * only the last one of each name was selectable.
-                             */
-                            acc[team.id] = team;
-                            return acc;
-                        }, {});
-                    }
-                    catch (error) {
-                        logger.error("Error getting teams:", getLogAttributesFromRequest(req));
-                        logger.error(error, getLogAttributesFromRequest(req));
-                        return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Failed to retrieve teams from Microsoft Graph API"));
-                    }
+                if (stateRecord.flow === WorkspaceOAuthFlow.MicrosoftTeamsAdminConsent) {
+                    return await MicrosoftTeamsAPI.continueAdminConsentWithSignIn({
+                        req,
+                        res,
+                        stateRecord,
+                        teamsIntegrationPageUrl,
+                    });
                 }
-                // Merge and persist project auth with tenantId, app token, and available teams
-                const mergedMiscData = Object.assign(Object.assign({}, existingAuth === null || existingAuth === void 0 ? void 0 : existingAuth.miscData), { tenantId: tenantId, appAccessToken: appAccessToken, appAccessTokenExpiresAt: expiresAtIso, adminConsentGranted: true, adminConsentGrantedAt: new Date().toISOString(), availableTeams: availableTeams, botId: MicrosoftTeamsAppClientId || "" });
-                await WorkspaceProjectAuthTokenService.refreshAuthToken({
-                    projectId: new ObjectID(projectId),
-                    workspaceType: WorkspaceType.MicrosoftTeams,
-                    authToken: appAccessToken,
-                    workspaceProjectId: tenantId, // Use tenant ID as the workspace project identifier
-                    miscData: mergedMiscData,
+                return await MicrosoftTeamsAPI.completeAdminConsent({
+                    req,
+                    res,
+                    stateRecord,
+                    teamsIntegrationPageUrl,
                 });
-                return Response.redirect(req, res, teamsIntegrationPageUrl
-                    .addQueryParam("adminConsent", "success")
-                    .addQueryParam("tenantId", tenantId));
             }
             catch (err) {
                 logger.error("Error in Microsoft Teams admin consent callback: ", getLogAttributesFromRequest(req));
                 logger.error(err, getLogAttributesFromRequest(req));
-                // Best-effort redirect to integration page with error
-                try {
-                    const stateParam = (_e = req.query["state"]) === null || _e === void 0 ? void 0 : _e.toString();
-                    const projectId = stateParam === null || stateParam === void 0 ? void 0 : stateParam.split(":")[0];
-                    if (projectId) {
-                        const teamsIntegrationPageUrl = URL.fromString(DashboardClientUrl.toString() +
-                            `/${projectId.toString()}/settings/microsoft-teams-integration`);
-                        return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Failed to finalize Microsoft Teams admin consent"));
-                    }
-                }
-                catch (_f) {
-                    // ignore
+                if (teamsIntegrationPageUrl) {
+                    return Response.redirect(req, res, teamsIntegrationPageUrl.addQueryParam("error", "Failed to finalize Microsoft Teams admin consent"));
                 }
                 return Response.sendErrorResponse(req, res, new BadDataException("Failed to finalize Microsoft Teams admin consent"));
             }
@@ -764,6 +973,46 @@ export default class MicrosoftTeamsAPI {
                 return Response.sendErrorResponse(req, res, err);
             }
         });
+        // Send a test notification to one channel ("Send Test" in Project Settings).
+        router.post("/microsoft-teams/channels/test", UserMiddleware.getUserMiddleware, async (req, res) => {
+            var _a, _b;
+            try {
+                const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                /*
+                 * Posting into a channel is a side effect, so membership alone is
+                 * not enough. Anyone who could create a workspace notification rule
+                 * - including its team block list, which the CRUD create enforces
+                 * too - can already make OneUptime post to this channel; a Viewer,
+                 * or a member whose team is blocked from creating rules, cannot.
+                 * getUserMiddleware admits unauthenticated requests as "public", so
+                 * the membership check is mandatory as well.
+                 */
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+                CommonAPI.assertCanCreateTable({
+                    modelType: WorkspaceNotificationRule,
+                    props: databaseProps,
+                    errorMessage: "You do not have permission to send test notifications in this project.",
+                });
+                const teamId = typeof ((_a = req.body) === null || _a === void 0 ? void 0 : _a["teamId"]) === "string"
+                    ? req.body["teamId"]
+                    : "";
+                const channelId = typeof ((_b = req.body) === null || _b === void 0 ? void 0 : _b["channelId"]) === "string"
+                    ? req.body["channelId"]
+                    : "";
+                // chatId is deliberately not forwarded: this route tests channels only.
+                await WorkspaceNotificationRuleService.sendTestNotificationToDestination({
+                    projectId: projectId,
+                    workspaceType: WorkspaceType.MicrosoftTeams,
+                    testByUserId: databaseProps.userId,
+                    teamId: teamId,
+                    channelId: channelId,
+                });
+                return Response.sendEmptySuccessResponse(req, res);
+            }
+            catch (err) {
+                return Response.sendErrorResponse(req, res, err);
+            }
+        });
         /*
          * Get chats (group / personal chats) the OneUptime app has been added to.
          * Chats cannot be listed via app-only Graph permissions, so this returns
@@ -795,6 +1044,46 @@ export default class MicrosoftTeamsAPI {
                 return Response.sendErrorResponse(req, res, err);
             }
         });
+        // Send a test notification to one chat ("Send Test" in Project Settings).
+        router.post("/microsoft-teams/chats/test", UserMiddleware.getUserMiddleware, async (req, res) => {
+            var _a;
+            try {
+                const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                /*
+                 * Posting into a chat is a side effect, so membership alone is not
+                 * enough. Anyone who could create a workspace notification rule -
+                 * including its team block list, which the CRUD create enforces
+                 * too - can already make OneUptime post to this chat; a Viewer, or
+                 * a member whose team is blocked from creating rules, cannot.
+                 * getUserMiddleware admits unauthenticated requests as "public", so
+                 * the membership check is mandatory as well.
+                 */
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+                CommonAPI.assertCanCreateTable({
+                    modelType: WorkspaceNotificationRule,
+                    props: databaseProps,
+                    errorMessage: "You do not have permission to send test notifications in this project.",
+                });
+                const chatId = typeof ((_a = req.body) === null || _a === void 0 ? void 0 : _a["chatId"]) === "string"
+                    ? req.body["chatId"]
+                    : "";
+                /*
+                 * Only the chat id is forwarded. The service checks it against the
+                 * chats this project captured, so a chat id from another tenant is
+                 * rejected before anything is sent.
+                 */
+                await WorkspaceNotificationRuleService.sendTestNotificationToDestination({
+                    projectId: projectId,
+                    workspaceType: WorkspaceType.MicrosoftTeams,
+                    testByUserId: databaseProps.userId,
+                    chatId: chatId,
+                });
+                return Response.sendEmptySuccessResponse(req, res);
+            }
+            catch (err) {
+                return Response.sendErrorResponse(req, res, err);
+            }
+        });
         return router;
     }
 }