@openclaw/msteams 2026.5.2 → 2026.5.3-beta.1

package/src/token-response.ts

@@ -1,11 +0,0 @@
-export function readAccessToken(value: unknown): string | null {
-  if (typeof value === "string") {
-    return value;
-  }
-  if (value && typeof value === "object") {
-    const token =
-      (value as { accessToken?: unknown }).accessToken ?? (value as { token?: unknown }).token;
-    return typeof token === "string" ? token : null;
-  }
-  return null;
-}

package/src/token.test.ts

@@ -1,259 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { readAccessToken } from "./token-response.js";
-import { hasConfiguredMSTeamsCredentials, resolveMSTeamsCredentials } from "./token.js";
-
-vi.mock("./secret-input.js", () => ({
-  normalizeSecretInputString: (v: unknown) =>
-    typeof v === "string" && v.trim() ? v.trim() : undefined,
-  normalizeResolvedSecretInputString: (opts: { value: unknown; path: string }) =>
-    typeof opts.value === "string" && opts.value.trim() ? opts.value.trim() : undefined,
-  hasConfiguredSecretInput: (v: unknown) => typeof v === "string" && v.trim().length > 0,
-}));
-
-const ENV_KEYS = [
-  "MSTEAMS_APP_ID",
-  "MSTEAMS_APP_PASSWORD",
-  "MSTEAMS_TENANT_ID",
-  "MSTEAMS_AUTH_TYPE",
-  "MSTEAMS_CERTIFICATE_PATH",
-  "MSTEAMS_CERTIFICATE_THUMBPRINT",
-  "MSTEAMS_USE_MANAGED_IDENTITY",
-  "MSTEAMS_MANAGED_IDENTITY_CLIENT_ID",
-] as const;
-
-let savedEnv: Record<string, string | undefined> = {};
-
-function saveAndClearEnv() {
-  savedEnv = {};
-  for (const key of ENV_KEYS) {
-    savedEnv[key] = process.env[key];
-    delete process.env[key];
-  }
-}
-
-function restoreEnv() {
-  for (const key of ENV_KEYS) {
-    if (savedEnv[key] !== undefined) {
-      process.env[key] = savedEnv[key];
-    } else {
-      delete process.env[key];
-    }
-  }
-}
-
-describe("token – secret credentials", () => {
-  beforeEach(saveAndClearEnv);
-  afterEach(restoreEnv);
-
-  it("returns true when appId + appPassword + tenantId are provided in config", () => {
-    const cfg = { appId: "app-id", appPassword: "app-pw", tenantId: "tenant-id" } as any;
-    expect(hasConfiguredMSTeamsCredentials(cfg)).toBe(true);
-  });
-
-  it("returns false when appPassword is missing", () => {
-    const cfg = { appId: "app-id", tenantId: "tenant-id" } as any;
-    expect(hasConfiguredMSTeamsCredentials(cfg)).toBe(false);
-  });
-
-  it("returns false when no config is given and no env vars set", () => {
-    expect(hasConfiguredMSTeamsCredentials(undefined)).toBe(false);
-  });
-
-  it("resolves secret credentials from config", () => {
-    const cfg = { appId: "app-id", appPassword: "app-pw", tenantId: "tenant-id" } as any;
-    const result = resolveMSTeamsCredentials(cfg);
-    expect(result).toEqual({
-      type: "secret",
-      appId: "app-id",
-      appPassword: "app-pw",
-      tenantId: "tenant-id",
-    });
-  });
-
-  it("resolves secret credentials from env vars", () => {
-    process.env.MSTEAMS_APP_ID = "env-app-id";
-    process.env.MSTEAMS_APP_PASSWORD = "env-app-pw";
-    process.env.MSTEAMS_TENANT_ID = "env-tenant-id";
-    const result = resolveMSTeamsCredentials(undefined);
-    expect(result).toEqual({
-      type: "secret",
-      appId: "env-app-id",
-      appPassword: "env-app-pw",
-      tenantId: "env-tenant-id",
-    });
-  });
-
-  it("returns undefined when appPassword is missing", () => {
-    const cfg = { appId: "app-id", tenantId: "tenant-id" } as any;
-    expect(resolveMSTeamsCredentials(cfg)).toBeUndefined();
-  });
-});
-
-describe("token – federated credentials (certificate)", () => {
-  beforeEach(saveAndClearEnv);
-  afterEach(restoreEnv);
-
-  it("hasConfigured returns true when certificate path is provided", () => {
-    const cfg = {
-      appId: "app-id",
-      tenantId: "tenant-id",
-      authType: "federated",
-      certificatePath: "/cert.pem",
-    } as any;
-    expect(hasConfiguredMSTeamsCredentials(cfg)).toBe(true);
-  });
-
-  it("hasConfigured returns false when neither cert nor MI is provided", () => {
-    const cfg = { appId: "app-id", tenantId: "tenant-id", authType: "federated" } as any;
-    expect(hasConfiguredMSTeamsCredentials(cfg)).toBe(false);
-  });
-
-  it("resolves federated credentials with certificate from config", () => {
-    const cfg = {
-      appId: "app-id",
-      tenantId: "tenant-id",
-      authType: "federated",
-      certificatePath: "/cert.pem",
-      certificateThumbprint: "AABBCCDD",
-    } as any;
-    const result = resolveMSTeamsCredentials(cfg);
-    expect(result).toEqual({
-      type: "federated",
-      appId: "app-id",
-      tenantId: "tenant-id",
-      certificatePath: "/cert.pem",
-      certificateThumbprint: "AABBCCDD",
-      useManagedIdentity: undefined,
-      managedIdentityClientId: undefined,
-    });
-  });
-
-  it("resolves federated credentials from env vars", () => {
-    process.env.MSTEAMS_AUTH_TYPE = "federated";
-    process.env.MSTEAMS_APP_ID = "env-app-id";
-    process.env.MSTEAMS_TENANT_ID = "env-tenant-id";
-    process.env.MSTEAMS_CERTIFICATE_PATH = "/env/cert.pem";
-    process.env.MSTEAMS_CERTIFICATE_THUMBPRINT = "EEFF0011";
-    const result = resolveMSTeamsCredentials(undefined);
-    expect(result).toEqual({
-      type: "federated",
-      appId: "env-app-id",
-      tenantId: "env-tenant-id",
-      certificatePath: "/env/cert.pem",
-      certificateThumbprint: "EEFF0011",
-      useManagedIdentity: undefined,
-      managedIdentityClientId: undefined,
-    });
-  });
-});
-
-describe("token – federated credentials (managed identity)", () => {
-  beforeEach(saveAndClearEnv);
-  afterEach(restoreEnv);
-
-  it("resolves managed identity from config", () => {
-    const cfg = {
-      appId: "app-id",
-      tenantId: "tenant-id",
-      authType: "federated",
-      useManagedIdentity: true,
-      managedIdentityClientId: "mi-client-id",
-    } as any;
-    const result = resolveMSTeamsCredentials(cfg);
-    expect(result).toEqual({
-      type: "federated",
-      appId: "app-id",
-      tenantId: "tenant-id",
-      certificatePath: undefined,
-      certificateThumbprint: undefined,
-      useManagedIdentity: true,
-      managedIdentityClientId: "mi-client-id",
-    });
-  });
-
-  it("resolves system-assigned managed identity (no clientId)", () => {
-    const cfg = {
-      appId: "app-id",
-      tenantId: "tenant-id",
-      authType: "federated",
-      useManagedIdentity: true,
-    } as any;
-    const result = resolveMSTeamsCredentials(cfg);
-    expect(result).toEqual({
-      type: "federated",
-      appId: "app-id",
-      tenantId: "tenant-id",
-      certificatePath: undefined,
-      certificateThumbprint: undefined,
-      useManagedIdentity: true,
-      managedIdentityClientId: undefined,
-    });
-  });
-
-  it("hasConfigured returns true for managed identity via env", () => {
-    process.env.MSTEAMS_AUTH_TYPE = "federated";
-    process.env.MSTEAMS_APP_ID = "env-app-id";
-    process.env.MSTEAMS_TENANT_ID = "env-tenant-id";
-    process.env.MSTEAMS_USE_MANAGED_IDENTITY = "true";
-    expect(hasConfiguredMSTeamsCredentials(undefined)).toBe(true);
-  });
-
-  it("config useManagedIdentity=false overrides env MSTEAMS_USE_MANAGED_IDENTITY=true", () => {
-    process.env.MSTEAMS_USE_MANAGED_IDENTITY = "true";
-    const cfg = {
-      appId: "app-id",
-      tenantId: "tenant-id",
-      authType: "federated",
-      certificatePath: "/cert.pem",
-      useManagedIdentity: false,
-    } as any;
-    const result = resolveMSTeamsCredentials(cfg);
-    expect(result).toBeDefined();
-    expect(result!.type).toBe("federated");
-    expect((result as any).useManagedIdentity).toBeUndefined();
-    expect((result as any).certificatePath).toBe("/cert.pem");
-  });
-});
-
-describe("token – backward compatibility", () => {
-  beforeEach(saveAndClearEnv);
-  afterEach(restoreEnv);
-
-  it("defaults to secret when authType is absent", () => {
-    const cfg = { appId: "app-id", appPassword: "pw", tenantId: "tenant-id" } as any;
-    const result = resolveMSTeamsCredentials(cfg);
-    expect(result).toBeDefined();
-    expect(result!.type).toBe("secret");
-  });
-
-  it("explicit authType=secret behaves same as absent", () => {
-    const cfg = {
-      appId: "app-id",
-      appPassword: "pw",
-      tenantId: "tenant-id",
-      authType: "secret",
-    } as any;
-    const result = resolveMSTeamsCredentials(cfg);
-    expect(result).toEqual({
-      type: "secret",
-      appId: "app-id",
-      appPassword: "pw",
-      tenantId: "tenant-id",
-    });
-  });
-});
-
-describe("readAccessToken", () => {
-  it("reads string and object token forms", () => {
-    expect(readAccessToken("abc")).toBe("abc");
-    expect(readAccessToken({ accessToken: "access-token" })).toBe("access-token");
-    expect(readAccessToken({ token: "fallback-token" })).toBe("fallback-token");
-  });
-
-  it("returns null for unsupported token payloads", () => {
-    expect(readAccessToken({ accessToken: 123 })).toBeNull();
-    expect(readAccessToken({ token: false })).toBeNull();
-    expect(readAccessToken(null)).toBeNull();
-    expect(readAccessToken(undefined)).toBeNull();
-  });
-});

package/src/token.ts

@@ -1,195 +0,0 @@
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { dirname } from "node:path";
-import type { MSTeamsConfig } from "../runtime-api.js";
-import type { MSTeamsDelegatedTokens } from "./oauth.shared.js";
-import { refreshMSTeamsDelegatedTokens } from "./oauth.token.js";
-import {
-  hasConfiguredSecretInput,
-  normalizeResolvedSecretInputString,
-  normalizeSecretInputString,
-} from "./secret-input.js";
-import { resolveMSTeamsStorePath } from "./storage.js";
-
-// ── Credential types ───────────────────────────────────────────────────────
-
-export type MSTeamsSecretCredentials = {
-  type: "secret";
-  appId: string;
-  appPassword: string;
-  tenantId: string;
-};
-
-export type MSTeamsFederatedCredentials = {
-  type: "federated";
-  appId: string;
-  tenantId: string;
-  certificatePath?: string;
-  certificateThumbprint?: string;
-  useManagedIdentity?: boolean;
-  managedIdentityClientId?: string;
-};
-
-export type MSTeamsCredentials = MSTeamsSecretCredentials | MSTeamsFederatedCredentials;
-
-// ── Helpers ────────────────────────────────────────────────────────────────
-
-function resolveAuthType(cfg?: MSTeamsConfig): "secret" | "federated" {
-  const fromCfg = cfg?.authType;
-  if (fromCfg === "secret" || fromCfg === "federated") {
-    return fromCfg;
-  }
-
-  const fromEnv = process.env.MSTEAMS_AUTH_TYPE;
-  if (fromEnv === "federated") {
-    return "federated";
-  }
-
-  return "secret";
-}
-
-// ── hasConfiguredMSTeamsCredentials ────────────────────────────────────────
-
-export function hasConfiguredMSTeamsCredentials(cfg?: MSTeamsConfig): boolean {
-  const authType = resolveAuthType(cfg);
-
-  const hasAppId = Boolean(
-    normalizeSecretInputString(cfg?.appId) ||
-    normalizeSecretInputString(process.env.MSTEAMS_APP_ID),
-  );
-  const hasTenantId = Boolean(
-    normalizeSecretInputString(cfg?.tenantId) ||
-    normalizeSecretInputString(process.env.MSTEAMS_TENANT_ID),
-  );
-
-  if (authType === "federated") {
-    const hasCert = Boolean(cfg?.certificatePath || process.env.MSTEAMS_CERTIFICATE_PATH);
-    const hasManagedIdentity =
-      cfg?.useManagedIdentity ?? process.env.MSTEAMS_USE_MANAGED_IDENTITY === "true";
-
-    return hasAppId && hasTenantId && (hasCert || hasManagedIdentity);
-  }
-
-  // "secret" (default) — original logic
-  return Boolean(
-    normalizeSecretInputString(cfg?.appId) &&
-    hasConfiguredSecretInput(cfg?.appPassword) &&
-    normalizeSecretInputString(cfg?.tenantId),
-  );
-}
-
-// ── resolveMSTeamsCredentials ─────────────────────────────────────────────
-
-export function resolveMSTeamsCredentials(cfg?: MSTeamsConfig): MSTeamsCredentials | undefined {
-  const authType = resolveAuthType(cfg);
-
-  const appId =
-    normalizeSecretInputString(cfg?.appId) ||
-    normalizeSecretInputString(process.env.MSTEAMS_APP_ID);
-
-  const tenantId =
-    normalizeSecretInputString(cfg?.tenantId) ||
-    normalizeSecretInputString(process.env.MSTEAMS_TENANT_ID);
-
-  if (!appId || !tenantId) {
-    return undefined;
-  }
-
-  if (authType === "federated") {
-    const certificatePath =
-      cfg?.certificatePath || process.env.MSTEAMS_CERTIFICATE_PATH || undefined;
-
-    const certificateThumbprint =
-      cfg?.certificateThumbprint || process.env.MSTEAMS_CERTIFICATE_THUMBPRINT || undefined;
-
-    const useManagedIdentity =
-      cfg?.useManagedIdentity ?? process.env.MSTEAMS_USE_MANAGED_IDENTITY === "true";
-
-    const managedIdentityClientId =
-      cfg?.managedIdentityClientId || process.env.MSTEAMS_MANAGED_IDENTITY_CLIENT_ID || undefined;
-
-    // At least one federated mechanism must be configured.
-    if (!certificatePath && !useManagedIdentity) {
-      return undefined;
-    }
-
-    return {
-      type: "federated",
-      appId,
-      tenantId,
-      certificatePath,
-      certificateThumbprint,
-      useManagedIdentity: useManagedIdentity || undefined,
-      managedIdentityClientId,
-    };
-  }
-
-  // "secret" (default) — original logic
-  const appPassword =
-    normalizeResolvedSecretInputString({
-      value: cfg?.appPassword,
-      path: "channels.msteams.appPassword",
-    }) || normalizeSecretInputString(process.env.MSTEAMS_APP_PASSWORD);
-
-  if (!appPassword) {
-    return undefined;
-  }
-
-  return { type: "secret", appId, appPassword, tenantId };
-}
-
-// ---------------------------------------------------------------------------
-// Delegated token storage / resolution
-// ---------------------------------------------------------------------------
-
-const DELEGATED_TOKEN_FILENAME = "msteams-delegated.json";
-
-function resolveDelegatedTokenPath(): string {
-  return resolveMSTeamsStorePath({ filename: DELEGATED_TOKEN_FILENAME });
-}
-
-export function loadDelegatedTokens(): MSTeamsDelegatedTokens | undefined {
-  try {
-    const content = readFileSync(resolveDelegatedTokenPath(), "utf8");
-    return JSON.parse(content) as MSTeamsDelegatedTokens;
-  } catch {
-    return undefined;
-  }
-}
-
-export function saveDelegatedTokens(tokens: MSTeamsDelegatedTokens): void {
-  const tokenPath = resolveDelegatedTokenPath();
-  const dir = dirname(tokenPath);
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(tokenPath, JSON.stringify(tokens, null, 2), "utf8");
-}
-
-export async function resolveDelegatedAccessToken(params: {
-  tenantId: string;
-  clientId: string;
-  clientSecret: string;
-}): Promise<string | undefined> {
-  const tokens = loadDelegatedTokens();
-  if (!tokens) {
-    return undefined;
-  }
-
-  // Token still valid (5-min buffer already baked into expiresAt)
-  if (tokens.expiresAt > Date.now()) {
-    return tokens.accessToken;
-  }
-
-  // Attempt refresh
-  try {
-    const refreshed = await refreshMSTeamsDelegatedTokens({
-      tenantId: params.tenantId,
-      clientId: params.clientId,
-      clientSecret: params.clientSecret,
-      refreshToken: tokens.refreshToken,
-      scopes: tokens.scopes,
-    });
-    saveDelegatedTokens(refreshed);
-    return refreshed.accessToken;
-  } catch {
-    return undefined;
-  }
-}

package/src/user-agent.test.ts

@@ -1,86 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mock the runtime before importing buildUserAgent
-const mockRuntime = {
-  version: "2026.3.19",
-};
-
-vi.mock("./runtime.js", () => ({
-  getMSTeamsRuntime: vi.fn(() => mockRuntime),
-}));
-
-import { fetchGraphJson } from "./graph.js";
-import { getMSTeamsRuntime } from "./runtime.js";
-import { buildUserAgent, ensureUserAgentHeader, resetUserAgentCache } from "./user-agent.js";
-
-describe("buildUserAgent", () => {
-  beforeEach(() => {
-    resetUserAgentCache();
-    vi.mocked(getMSTeamsRuntime).mockReturnValue(mockRuntime as never);
-  });
-
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it("returns teams.ts[apps]/<sdk> OpenClaw/<version> format", () => {
-    const ua = buildUserAgent();
-    expect(ua).toMatch(/^teams\.ts\[apps\]\/.+ OpenClaw\/2026\.3\.19$/);
-  });
-
-  it("reflects the runtime version", () => {
-    vi.mocked(getMSTeamsRuntime).mockReturnValue({ version: "1.2.3" } as never);
-    const ua = buildUserAgent();
-    expect(ua).toMatch(/OpenClaw\/1\.2\.3$/);
-  });
-
-  it("returns OpenClaw/unknown when runtime is not initialized", () => {
-    vi.mocked(getMSTeamsRuntime).mockImplementation(() => {
-      throw new Error("MSTeams runtime not initialized");
-    });
-    const ua = buildUserAgent();
-    expect(ua).toMatch(/OpenClaw\/unknown$/);
-    // SDK version should still be present
-    expect(ua).toMatch(/^teams\.ts\[apps\]\//);
-  });
-
-  it("sends the generated User-Agent in Graph requests by default", async () => {
-    const mockFetch = vi.fn().mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({ value: [] }),
-    });
-    vi.stubGlobal("fetch", mockFetch);
-
-    await fetchGraphJson({ token: "test-token", path: "/groups" });
-
-    expect(mockFetch).toHaveBeenCalledOnce();
-    const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toMatch(/^teams\.ts\[apps\]\/.+ OpenClaw\/2026\.3\.19$/);
-    expect(init.headers).toHaveProperty("Authorization", "Bearer test-token");
-  });
-
-  it("lets caller headers override the default Graph User-Agent", async () => {
-    const mockFetch = vi.fn().mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({ value: [] }),
-    });
-    vi.stubGlobal("fetch", mockFetch);
-
-    await fetchGraphJson({
-      token: "test-token",
-      path: "/groups",
-      headers: { "User-Agent": "custom-agent/1.0" },
-    });
-
-    const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("custom-agent/1.0");
-  });
-
-  it("adds the generated User-Agent to Headers instances without overwriting callers", () => {
-    const generated = ensureUserAgentHeader();
-    expect(generated.get("User-Agent")).toMatch(/^teams\.ts\[apps\]\/.+ OpenClaw\/2026\.3\.19$/);
-
-    const custom = ensureUserAgentHeader({ "User-Agent": "custom-agent/2.0" });
-    expect(custom.get("User-Agent")).toBe("custom-agent/2.0");
-  });
-});

package/src/user-agent.ts

@@ -1,53 +0,0 @@
-import { createRequire } from "node:module";
-import { getMSTeamsRuntime } from "./runtime.js";
-
-let cachedUserAgent: string | undefined;
-
-function resolveTeamsSdkVersion(): string {
-  try {
-    const require = createRequire(import.meta.url);
-    const pkg = require("@microsoft/teams.apps/package.json") as { version?: string };
-    return pkg.version ?? "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-
-function resolveOpenClawVersion(): string {
-  try {
-    return getMSTeamsRuntime().version;
-  } catch {
-    return "unknown";
-  }
-}
-
-/**
- * Build a combined User-Agent string that preserves the Teams SDK identity
- * and appends the OpenClaw version.
- *
- * Format: "teams.ts[apps]/<sdk-version> OpenClaw/<openclaw-version>"
- * Example: "teams.ts[apps]/2.0.5 OpenClaw/2026.3.22"
- *
- * This lets the Teams backend track SDK usage while also identifying the
- * host application.
- */
-/** Reset the cached User-Agent (for testing). */
-export function resetUserAgentCache(): void {
-  cachedUserAgent = undefined;
-}
-
-export function buildUserAgent(): string {
-  if (cachedUserAgent) {
-    return cachedUserAgent;
-  }
-  cachedUserAgent = `teams.ts[apps]/${resolveTeamsSdkVersion()} OpenClaw/${resolveOpenClawVersion()}`;
-  return cachedUserAgent;
-}
-
-export function ensureUserAgentHeader(headers?: HeadersInit): Headers {
-  const nextHeaders = new Headers(headers);
-  if (!nextHeaders.has("User-Agent")) {
-    nextHeaders.set("User-Agent", buildUserAgent());
-  }
-  return nextHeaders;
-}

package/src/webhook-timeouts.ts

@@ -1,27 +0,0 @@
-import type { Server } from "node:http";
-
-const MSTEAMS_WEBHOOK_INACTIVITY_TIMEOUT_MS = 30_000;
-const MSTEAMS_WEBHOOK_REQUEST_TIMEOUT_MS = 30_000;
-const MSTEAMS_WEBHOOK_HEADERS_TIMEOUT_MS = 15_000;
-
-type ApplyMSTeamsWebhookTimeoutsOpts = {
-  inactivityTimeoutMs?: number;
-  requestTimeoutMs?: number;
-  headersTimeoutMs?: number;
-};
-
-export function applyMSTeamsWebhookTimeouts(
-  httpServer: Server,
-  opts?: ApplyMSTeamsWebhookTimeoutsOpts,
-): void {
-  const inactivityTimeoutMs = opts?.inactivityTimeoutMs ?? MSTEAMS_WEBHOOK_INACTIVITY_TIMEOUT_MS;
-  const requestTimeoutMs = opts?.requestTimeoutMs ?? MSTEAMS_WEBHOOK_REQUEST_TIMEOUT_MS;
-  const headersTimeoutMs = Math.min(
-    opts?.headersTimeoutMs ?? MSTEAMS_WEBHOOK_HEADERS_TIMEOUT_MS,
-    requestTimeoutMs,
-  );
-
-  httpServer.setTimeout(inactivityTimeoutMs);
-  httpServer.requestTimeout = requestTimeoutMs;
-  httpServer.headersTimeout = headersTimeoutMs;
-}