@openclaw/msteams 2026.5.2 → 2026.5.3-beta.1

package/src/oauth.test.ts

@@ -1,305 +0,0 @@
-import { createHash } from "node:crypto";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-vi.mock("openclaw/plugin-sdk/ssrf-runtime", () => ({
-  fetchWithSsrFGuard: async (params: {
-    url: string;
-    init?: RequestInit;
-    fetchImpl?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
-  }) => {
-    const fetchImpl = params.fetchImpl ?? globalThis.fetch;
-    const response = await fetchImpl(params.url, params.init);
-    return {
-      response,
-      finalUrl: params.url,
-      release: async () => {},
-    };
-  },
-}));
-
-import {
-  generatePkce,
-  generateOAuthState,
-  buildMSTeamsAuthUrl,
-  parseCallbackInput,
-} from "./oauth.flow.js";
-import {
-  MSTEAMS_DEFAULT_DELEGATED_SCOPES,
-  MSTEAMS_OAUTH_REDIRECT_URI,
-  buildMSTeamsAuthEndpoint,
-  buildMSTeamsTokenEndpoint,
-} from "./oauth.shared.js";
-import { exchangeMSTeamsCodeForTokens, refreshMSTeamsDelegatedTokens } from "./oauth.token.js";
-
-function responseJson(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-describe("generatePkce", () => {
-  it("produces a 64-char hex verifier and a base64url SHA-256 challenge", () => {
-    const { verifier, challenge } = generatePkce();
-    expect(verifier).toMatch(/^[0-9a-f]{64}$/);
-    const expected = createHash("sha256").update(verifier).digest("base64url");
-    expect(challenge).toBe(expected);
-  });
-});
-
-describe("generateOAuthState", () => {
-  it("produces a 64-char hex string separate from the PKCE verifier", () => {
-    const state = generateOAuthState();
-    expect(state).toMatch(/^[0-9a-f]{64}$/);
-    const { verifier } = generatePkce();
-    expect(state).not.toBe(verifier);
-  });
-});
-
-describe("buildMSTeamsAuthUrl", () => {
-  it("includes correct tenant, client_id, scopes, PKCE params, and redirect_uri", () => {
-    const { challenge } = generatePkce();
-    const state = generateOAuthState();
-    const url = buildMSTeamsAuthUrl({
-      tenantId: "my-tenant-id",
-      clientId: "my-client-id",
-      challenge,
-      state,
-    });
-
-    const parsed = new URL(url);
-    expect(parsed.origin + parsed.pathname).toBe(buildMSTeamsAuthEndpoint("my-tenant-id"));
-    expect(parsed.searchParams.get("client_id")).toBe("my-client-id");
-    expect(parsed.searchParams.get("response_type")).toBe("code");
-    expect(parsed.searchParams.get("redirect_uri")).toBe(MSTEAMS_OAUTH_REDIRECT_URI);
-    expect(parsed.searchParams.get("scope")).toBe(MSTEAMS_DEFAULT_DELEGATED_SCOPES.join(" "));
-    expect(parsed.searchParams.get("code_challenge")).toBe(challenge);
-    expect(parsed.searchParams.get("code_challenge_method")).toBe("S256");
-    expect(parsed.searchParams.get("state")).toBe(state);
-    expect(parsed.searchParams.get("prompt")).toBe("consent");
-  });
-
-  it("does not expose the PKCE verifier in the URL", () => {
-    const { verifier, challenge } = generatePkce();
-    const state = generateOAuthState();
-    const url = buildMSTeamsAuthUrl({
-      tenantId: "t",
-      clientId: "c",
-      challenge,
-      state,
-    });
-    expect(url).not.toContain(verifier);
-    expect(url).toContain(`state=${state}`);
-  });
-
-  it("uses custom scopes when provided", () => {
-    const url = buildMSTeamsAuthUrl({
-      tenantId: "t",
-      clientId: "c",
-      challenge: "ch",
-      state: "s",
-      scopes: ["User.Read", "offline_access"],
-    });
-    const parsed = new URL(url);
-    expect(parsed.searchParams.get("scope")).toBe("User.Read offline_access");
-  });
-});
-
-describe("parseCallbackInput", () => {
-  const expectedState = "expected-state-value";
-
-  it("extracts code and state from a valid callback URL", () => {
-    const input = `${MSTEAMS_OAUTH_REDIRECT_URI}?code=abc123&state=${expectedState}`;
-    const result = parseCallbackInput(input, expectedState);
-    expect(result).toEqual({ code: "abc123", state: expectedState });
-  });
-
-  it("returns error when code is missing from URL", () => {
-    const input = `${MSTEAMS_OAUTH_REDIRECT_URI}?state=${expectedState}`;
-    const result = parseCallbackInput(input, expectedState);
-    expect(result).toEqual({ error: "Missing 'code' parameter in URL" });
-  });
-
-  it("rejects bare authorization codes to prevent CSRF bypass", () => {
-    const result = parseCallbackInput("bare-code-value", expectedState);
-    expect(result).toEqual({
-      error:
-        "Paste the full redirect URL (including code and state parameters), not just the authorization code.",
-    });
-  });
-
-  it("returns error on empty input", () => {
-    const result = parseCallbackInput("", expectedState);
-    expect(result).toEqual({ error: "No input provided" });
-  });
-
-  it("returns error when state is missing from a valid URL (CSRF protection)", () => {
-    const input = `${MSTEAMS_OAUTH_REDIRECT_URI}?code=abc123`;
-    const result = parseCallbackInput(input, expectedState);
-    expect(result).toEqual({
-      error: "Missing 'state' parameter in URL. Paste the full redirect URL.",
-    });
-  });
-
-  it("rejects bare codes even when expectedState is empty", () => {
-    const result = parseCallbackInput("bare-code", "");
-    expect(result).toEqual({
-      error:
-        "Paste the full redirect URL (including code and state parameters), not just the authorization code.",
-    });
-  });
-});
-
-describe("exchangeMSTeamsCodeForTokens", () => {
-  let fetchSpy: ReturnType<typeof vi.fn>;
-
-  beforeEach(() => {
-    fetchSpy = vi.fn();
-    vi.stubGlobal("fetch", fetchSpy);
-  });
-
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  it("exchanges an authorization code for delegated tokens", async () => {
-    const now = Date.now();
-    fetchSpy.mockResolvedValueOnce(
-      responseJson({
-        access_token: "at-123",
-        refresh_token: "rt-456",
-        expires_in: 3600,
-        scope: "ChatMessage.Send offline_access",
-      }),
-    );
-
-    const tokens = await exchangeMSTeamsCodeForTokens({
-      tenantId: "tenant-1",
-      clientId: "client-1",
-      clientSecret: "secret-1", // pragma: allowlist secret
-      code: "auth-code",
-      verifier: "pkce-verifier",
-    });
-    const afterExchange = Date.now();
-
-    expect(tokens.accessToken).toBe("at-123");
-    expect(tokens.refreshToken).toBe("rt-456");
-    expect(tokens.scopes).toEqual(["ChatMessage.Send", "offline_access"]);
-    // expiresAt should be roughly now + 3600s - 300s
-    expect(tokens.expiresAt).toBeGreaterThanOrEqual(now + 3300 * 1000 - 1000);
-    expect(tokens.expiresAt).toBeLessThanOrEqual(afterExchange + 3300 * 1000 + 2000);
-
-    // Verify the request was well-formed
-    expect(fetchSpy).toHaveBeenCalledOnce();
-    const [url, init] = fetchSpy.mock.calls[0] as [string, RequestInit];
-    expect(url).toBe(buildMSTeamsTokenEndpoint("tenant-1"));
-    const body = new URLSearchParams(init.body as string);
-    expect(body.get("client_id")).toBe("client-1");
-    expect(body.get("client_secret")).toBe("secret-1");
-    expect(body.get("grant_type")).toBe("authorization_code");
-    expect(body.get("code")).toBe("auth-code");
-    expect(body.get("code_verifier")).toBe("pkce-verifier");
-    expect(body.get("redirect_uri")).toBe(MSTEAMS_OAUTH_REDIRECT_URI);
-  });
-
-  it("throws on a 400 error response", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      new Response(JSON.stringify({ error: "invalid_grant" }), {
-        status: 400,
-        headers: { "Content-Type": "application/json" },
-      }),
-    );
-
-    await expect(
-      exchangeMSTeamsCodeForTokens({
-        tenantId: "t",
-        clientId: "c",
-        clientSecret: "s", // pragma: allowlist secret
-        code: "bad-code",
-        verifier: "v",
-      }),
-    ).rejects.toThrow(/MSTeams token exchange failed \(400\)/);
-  });
-});
-
-describe("refreshMSTeamsDelegatedTokens", () => {
-  let fetchSpy: ReturnType<typeof vi.fn>;
-
-  beforeEach(() => {
-    fetchSpy = vi.fn();
-    vi.stubGlobal("fetch", fetchSpy);
-  });
-
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  it("refreshes tokens using refresh_token grant and keeps old refresh token when Azure omits it", async () => {
-    const now = Date.now();
-    fetchSpy.mockResolvedValueOnce(
-      responseJson({
-        access_token: "new-at",
-        // Azure sometimes does not return a new refresh_token
-        expires_in: 3600,
-        scope: "ChatMessage.Send offline_access",
-      }),
-    );
-
-    const tokens = await refreshMSTeamsDelegatedTokens({
-      tenantId: "tenant-1",
-      clientId: "client-1",
-      clientSecret: "secret-1", // pragma: allowlist secret
-      refreshToken: "original-rt",
-    });
-
-    expect(tokens.accessToken).toBe("new-at");
-    // Old refresh token should be preserved
-    expect(tokens.refreshToken).toBe("original-rt");
-    expect(tokens.scopes).toEqual(["ChatMessage.Send", "offline_access"]);
-    expect(tokens.expiresAt).toBeGreaterThanOrEqual(now + 3300 * 1000 - 1000);
-
-    // Verify the request body includes refresh_token grant type
-    const [, init] = fetchSpy.mock.calls[0] as [string, RequestInit];
-    const body = new URLSearchParams(init.body as string);
-    expect(body.get("grant_type")).toBe("refresh_token");
-    expect(body.get("refresh_token")).toBe("original-rt");
-    expect(body.get("client_secret")).toBe("secret-1");
-  });
-
-  it("uses new refresh token when Azure returns one", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      responseJson({
-        access_token: "new-at",
-        refresh_token: "new-rt",
-        expires_in: 3600,
-      }),
-    );
-
-    const tokens = await refreshMSTeamsDelegatedTokens({
-      tenantId: "t",
-      clientId: "c",
-      clientSecret: "s", // pragma: allowlist secret
-      refreshToken: "old-rt",
-    });
-
-    expect(tokens.refreshToken).toBe("new-rt");
-  });
-
-  it("throws on a 401 error response", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      new Response(JSON.stringify({ error: "invalid_grant" }), {
-        status: 401,
-        headers: { "Content-Type": "application/json" },
-      }),
-    );
-
-    await expect(
-      refreshMSTeamsDelegatedTokens({
-        tenantId: "t",
-        clientId: "c",
-        clientSecret: "s", // pragma: allowlist secret
-        refreshToken: "expired-rt",
-      }),
-    ).rejects.toThrow(/MSTeams token refresh failed \(401\)/);
-  });
-});

package/src/oauth.token.ts

@@ -1,158 +0,0 @@
-import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
-import {
-  MSTEAMS_DEFAULT_DELEGATED_SCOPES,
-  MSTEAMS_DEFAULT_TOKEN_FETCH_TIMEOUT_MS,
-  MSTEAMS_OAUTH_REDIRECT_URI,
-  buildMSTeamsTokenEndpoint,
-  type MSTeamsDelegatedTokens,
-} from "./oauth.shared.js";
-
-/** Five-minute buffer subtracted from token expiry to avoid edge-case clock drift. */
-const EXPIRY_BUFFER_MS = 5 * 60 * 1000;
-
-type MSTeamsTokenResponse = {
-  access_token: string;
-  refresh_token?: string;
-  expires_in: number;
-  scope?: string;
-};
-
-function createMSTeamsTokenBody(params: {
-  clientId: string;
-  clientSecret: string;
-  grantType: string;
-  scopes: readonly string[];
-  values?: Record<string, string>;
-}): URLSearchParams {
-  const body = new URLSearchParams({
-    client_id: params.clientId,
-    client_secret: params.clientSecret,
-    grant_type: params.grantType,
-    scope: [...params.scopes].join(" "),
-  });
-
-  for (const [key, value] of Object.entries(params.values ?? {})) {
-    body.set(key, value);
-  }
-
-  return body;
-}
-
-async function fetchMSTeamsTokens(params: {
-  tokenUrl: string;
-  body: URLSearchParams;
-  auditContext: string;
-  failureLabel: string;
-}): Promise<MSTeamsTokenResponse> {
-  const currentFetch = globalThis.fetch;
-  const { response, release } = await fetchWithSsrFGuard({
-    url: params.tokenUrl,
-    fetchImpl: async (input, guardedInit) => await currentFetch(input, guardedInit),
-    init: {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8",
-        Accept: "application/json",
-      },
-      body: params.body,
-      signal: AbortSignal.timeout(MSTEAMS_DEFAULT_TOKEN_FETCH_TIMEOUT_MS),
-    },
-    auditContext: params.auditContext,
-  });
-
-  try {
-    if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`MSTeams ${params.failureLabel} failed (${response.status}): ${errorText}`);
-    }
-    return (await response.json()) as MSTeamsTokenResponse;
-  } finally {
-    await release();
-  }
-}
-
-async function requestMSTeamsDelegatedTokens(params: {
-  tenantId: string;
-  clientId: string;
-  clientSecret: string;
-  scopes?: readonly string[];
-  grantType: string;
-  values: Record<string, string>;
-  auditContext: string;
-  failureLabel: string;
-  resolveRefreshToken: (data: MSTeamsTokenResponse) => string;
-}): Promise<MSTeamsDelegatedTokens> {
-  const scopes = params.scopes ?? MSTEAMS_DEFAULT_DELEGATED_SCOPES;
-  const body = createMSTeamsTokenBody({
-    clientId: params.clientId,
-    clientSecret: params.clientSecret,
-    grantType: params.grantType,
-    scopes,
-    values: params.values,
-  });
-  const data = await fetchMSTeamsTokens({
-    tokenUrl: buildMSTeamsTokenEndpoint(params.tenantId),
-    body,
-    auditContext: params.auditContext,
-    failureLabel: params.failureLabel,
-  });
-
-  return {
-    accessToken: data.access_token,
-    refreshToken: params.resolveRefreshToken(data),
-    expiresAt: Date.now() + data.expires_in * 1000 - EXPIRY_BUFFER_MS,
-    scopes: data.scope ? data.scope.split(" ") : [...scopes],
-  };
-}
-
-export async function exchangeMSTeamsCodeForTokens(params: {
-  tenantId: string;
-  clientId: string;
-  clientSecret: string;
-  code: string;
-  verifier: string;
-  scopes?: readonly string[];
-}): Promise<MSTeamsDelegatedTokens> {
-  return await requestMSTeamsDelegatedTokens({
-    tenantId: params.tenantId,
-    clientId: params.clientId,
-    clientSecret: params.clientSecret,
-    grantType: "authorization_code",
-    scopes: params.scopes,
-    values: {
-      code: params.code,
-      redirect_uri: MSTEAMS_OAUTH_REDIRECT_URI,
-      code_verifier: params.verifier,
-    },
-    auditContext: "msteams-oauth-token-exchange",
-    failureLabel: "token exchange",
-    resolveRefreshToken: (data) => {
-      if (!data.refresh_token) {
-        throw new Error("No refresh token received from Azure AD. Please try again.");
-      }
-      return data.refresh_token;
-    },
-  });
-}
-
-export async function refreshMSTeamsDelegatedTokens(params: {
-  tenantId: string;
-  clientId: string;
-  clientSecret: string;
-  refreshToken: string;
-  scopes?: readonly string[];
-}): Promise<MSTeamsDelegatedTokens> {
-  return await requestMSTeamsDelegatedTokens({
-    tenantId: params.tenantId,
-    clientId: params.clientId,
-    clientSecret: params.clientSecret,
-    grantType: "refresh_token",
-    scopes: params.scopes,
-    values: {
-      refresh_token: params.refreshToken,
-    },
-    auditContext: "msteams-oauth-token-refresh",
-    failureLabel: "token refresh",
-    resolveRefreshToken: (data) => data.refresh_token ?? params.refreshToken,
-  });
-}

package/src/oauth.ts

@@ -1,130 +0,0 @@
-import {
-  buildMSTeamsAuthUrl,
-  generateOAuthState,
-  generatePkce,
-  parseCallbackInput,
-  shouldUseManualOAuthFlow,
-  waitForLocalCallback,
-} from "./oauth.flow.js";
-import {
-  MSTEAMS_DEFAULT_DELEGATED_SCOPES,
-  MSTEAMS_OAUTH_CALLBACK_PORT,
-  type MSTeamsDelegatedOAuthContext,
-  type MSTeamsDelegatedTokens,
-} from "./oauth.shared.js";
-import { exchangeMSTeamsCodeForTokens } from "./oauth.token.js";
-
-export type { MSTeamsDelegatedOAuthContext, MSTeamsDelegatedTokens };
-
-export async function loginMSTeamsDelegated(
-  ctx: MSTeamsDelegatedOAuthContext,
-  params: {
-    tenantId: string;
-    clientId: string;
-    clientSecret: string;
-    scopes?: readonly string[];
-  },
-): Promise<MSTeamsDelegatedTokens> {
-  const scopes = params.scopes ?? MSTEAMS_DEFAULT_DELEGATED_SCOPES;
-  const needsManual = shouldUseManualOAuthFlow(ctx.isRemote);
-
-  await ctx.note(
-    needsManual
-      ? [
-          "You are running in a remote/VPS environment.",
-          "A URL will be shown for you to open in your LOCAL browser.",
-          "After signing in, copy the redirect URL and paste it back here.",
-        ].join("\n")
-      : [
-          "Browser will open for Microsoft authentication.",
-          `Sign in to grant delegated permissions for MSTeams.`,
-          `The callback will be captured automatically on localhost:${MSTEAMS_OAUTH_CALLBACK_PORT}.`,
-        ].join("\n"),
-    "MSTeams Delegated OAuth",
-  );
-
-  const { verifier, challenge } = generatePkce();
-  const state = generateOAuthState();
-  const authUrl = buildMSTeamsAuthUrl({
-    tenantId: params.tenantId,
-    clientId: params.clientId,
-    challenge,
-    state,
-    scopes,
-  });
-
-  if (needsManual) {
-    return manualFlow(ctx, authUrl, state, verifier, params);
-  }
-
-  ctx.progress.update("Complete sign-in in browser...");
-  try {
-    await ctx.openUrl(authUrl);
-  } catch {
-    ctx.log(`\nOpen this URL in your browser:\n\n${authUrl}\n`);
-  }
-
-  try {
-    const { code } = await waitForLocalCallback({
-      expectedState: state,
-      timeoutMs: 5 * 60 * 1000,
-      onProgress: (msg) => ctx.progress.update(msg),
-    });
-    ctx.progress.update("Exchanging authorization code for tokens...");
-    return await exchangeMSTeamsCodeForTokens({
-      tenantId: params.tenantId,
-      clientId: params.clientId,
-      clientSecret: params.clientSecret,
-      code,
-      verifier,
-      scopes,
-    });
-  } catch (err) {
-    // EADDRINUSE or other listen errors: fall back to manual flow
-    if (
-      err instanceof Error &&
-      (err.message.includes("EADDRINUSE") ||
-        err.message.includes("port") ||
-        err.message.includes("listen"))
-    ) {
-      ctx.progress.update("Local callback server failed. Switching to manual mode...");
-      return manualFlow(ctx, authUrl, state, verifier, params, err);
-    }
-    throw err;
-  }
-}
-
-async function manualFlow(
-  ctx: MSTeamsDelegatedOAuthContext,
-  authUrl: string,
-  state: string,
-  verifier: string,
-  params: {
-    tenantId: string;
-    clientId: string;
-    clientSecret: string;
-    scopes?: readonly string[];
-  },
-  cause?: Error,
-): Promise<MSTeamsDelegatedTokens> {
-  ctx.progress.update("OAuth URL ready");
-  ctx.log(`\nOpen this URL in your LOCAL browser:\n\n${authUrl}\n`);
-  ctx.progress.update("Waiting for you to paste the callback URL...");
-  const callbackInput = await ctx.prompt("Paste the redirect URL here: ");
-  const parsed = parseCallbackInput(callbackInput, state);
-  if ("error" in parsed) {
-    throw new Error(parsed.error, cause ? { cause } : undefined);
-  }
-  if (parsed.state !== state) {
-    throw new Error("OAuth state mismatch - please try again", cause ? { cause } : undefined);
-  }
-  ctx.progress.update("Exchanging authorization code for tokens...");
-  return exchangeMSTeamsCodeForTokens({
-    tenantId: params.tenantId,
-    clientId: params.clientId,
-    clientSecret: params.clientSecret,
-    code: parsed.code,
-    verifier,
-    scopes: params.scopes,
-  });
-}