agent-messenger 2.27.2 → 2.29.0

package/src/platforms/teams/device-code.ts

@@ -0,0 +1,277 @@
+import {
+  authzUrl,
+  CONSUMER_TENANT_ID,
+  deviceCodeSkypeScope,
+  deviceCodeTeamsScope,
+  deviceCodeTokenUrl,
+  deviceCodeUrl,
+  MICROSOFT_SERVICES_TENANT_ID,
+  TEAMS_TENANTS_URL,
+  WORK_TENANT_ID,
+} from './app-config'
+import type { TeamsAccountType, TeamsRegion } from './types'
+import { TeamsError } from './types'
+
+const DEFAULT_SKYPE_TOKEN_TTL_SEC = 21600
+
+export interface TeamsTenant {
+  tenantId: string
+  tenantName?: string
+  isInvitationRedeemed?: boolean
+}
+
+export interface DeviceCodeInfo {
+  deviceCode: string
+  userCode: string
+  verificationUri: string
+  verificationUriComplete: string
+  expiresIn: number
+  interval: number
+}
+
+export interface AadToken {
+  accessToken: string
+  refreshToken?: string
+}
+
+export interface MintedSkypeToken {
+  skypeToken: string
+  skypeTokenExpiresAt: string
+  region?: TeamsRegion
+}
+
+export type DeviceTokenResult =
+  | { status: 'success'; token: AadToken }
+  | { status: 'pending' }
+  | { status: 'slow_down' }
+  | { status: 'expired' }
+  | { status: 'declined' }
+  | { status: 'error'; message: string }
+
+async function postForm(
+  url: string,
+  params: Record<string, string>,
+): Promise<{ status: number; body: Record<string, unknown> }> {
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams(params),
+  })
+  const body = (await res.json().catch(() => ({}))) as Record<string, unknown>
+  return { status: res.status, body }
+}
+
+export async function requestDeviceCode(
+  clientId: string,
+  accountType: TeamsAccountType = 'personal',
+): Promise<DeviceCodeInfo> {
+  const { status, body } = await postForm(deviceCodeUrl(accountType), {
+    client_id: clientId,
+    scope: deviceCodeTeamsScope(accountType),
+  })
+  if (status !== 200) {
+    throw new TeamsError(`Device code request failed: ${describeAadError(body, status)}`, 'device_code_failed')
+  }
+  const userCode = String(body.user_code ?? '')
+  const verificationUri = String(body.verification_uri ?? 'https://microsoft.com/devicelogin')
+  return {
+    deviceCode: String(body.device_code ?? ''),
+    userCode,
+    verificationUri,
+    verificationUriComplete: `${verificationUri}?otc=${encodeURIComponent(userCode)}`,
+    expiresIn: Number(body.expires_in ?? 900),
+    interval: Number(body.interval ?? 5),
+  }
+}
+
+export async function exchangeDeviceCode(
+  deviceCode: string,
+  clientId: string,
+  accountType: TeamsAccountType = 'personal',
+): Promise<DeviceTokenResult> {
+  const { status, body } = await postForm(deviceCodeTokenUrl(accountType), {
+    client_id: clientId,
+    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+    device_code: deviceCode,
+  })
+  if (status === 200) {
+    return {
+      status: 'success',
+      token: { accessToken: String(body.access_token), refreshToken: body.refresh_token as string | undefined },
+    }
+  }
+  const error = String(body.error ?? '')
+  if (error === 'authorization_pending') return { status: 'pending' }
+  if (error === 'slow_down') return { status: 'slow_down' }
+  if (error === 'expired_token') return { status: 'expired' }
+  if (error === 'authorization_declined') return { status: 'declined' }
+  return { status: 'error', message: describeAadError(body, status) }
+}
+
+export async function pollDeviceToken(
+  deviceCode: string,
+  interval: number,
+  expiresIn: number,
+  clientId: string,
+  accountType: TeamsAccountType = 'personal',
+): Promise<AadToken> {
+  const deadline = Date.now() + expiresIn * 1000
+  let waitMs = Math.max(interval, 1) * 1000
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, waitMs))
+    const result = await exchangeDeviceCode(deviceCode, clientId, accountType)
+    if (result.status === 'success') return result.token
+    if (result.status === 'slow_down') {
+      waitMs += 5000
+      continue
+    }
+    if (result.status === 'pending') continue
+    if (result.status === 'expired') throw new TeamsError('Device code expired before approval.', 'device_code_expired')
+    if (result.status === 'declined') throw new TeamsError('Authorization was declined.', 'device_code_declined')
+    throw new TeamsError(`Device authorization failed: ${result.message}`, 'device_code_failed')
+  }
+  throw new TeamsError('Device code expired before approval.', 'device_code_expired')
+}
+
+export async function exchangeForSkypeScope(
+  refreshToken: string,
+  clientId: string,
+  accountType: TeamsAccountType = 'personal',
+  tenantId?: string,
+): Promise<AadToken> {
+  const { status, body } = await postForm(deviceCodeTokenUrl(accountType, tenantId), {
+    client_id: clientId,
+    grant_type: 'refresh_token',
+    refresh_token: refreshToken,
+    scope: deviceCodeSkypeScope(accountType),
+  })
+  if (status !== 200) {
+    throw new TeamsError(`Token exchange failed: ${describeAadError(body, status)}`, 'token_exchange_failed')
+  }
+  return {
+    accessToken: String(body.access_token),
+    refreshToken: (body.refresh_token as string | undefined) ?? refreshToken,
+  }
+}
+
+// Work logins go through the `organizations` authority, so the token's `tid` is
+// a placeholder, not a real tenant GUID. The skype authz endpoint then rejects
+// it with `GuestUserNotRedeemed`. Resolving the concrete tenant lets the
+// skype-scope exchange target the tenant-specific authority and succeed.
+export async function resolveWorkTenantId(accessToken: string): Promise<string> {
+  const claimTid = decodeJwtTid(accessToken)
+  if (claimTid && !isPlaceholderTenant(claimTid)) return claimTid
+
+  const tenants = await fetchTenants(accessToken)
+  const redeemed = tenants.find((tenant) => tenant.isInvitationRedeemed !== false) ?? tenants[0]
+  if (!redeemed) {
+    throw new TeamsError(
+      'No Microsoft Teams tenant is associated with this account. If this is a personal Microsoft account, run `agent-teams auth login --account-type personal`.',
+      'teams_tenant_missing',
+    )
+  }
+  if (redeemed.isInvitationRedeemed === false) {
+    throw new TeamsError(
+      'This Microsoft Teams guest invitation has not been accepted yet. Accept the invite in Teams, then run `agent-teams auth login` again.',
+      'teams_invitation_not_redeemed',
+    )
+  }
+  return redeemed.tenantId
+}
+
+async function fetchTenants(accessToken: string): Promise<TeamsTenant[]> {
+  const res = await fetch(TEAMS_TENANTS_URL, { headers: { Authorization: `Bearer ${accessToken}` } })
+  if (!res.ok) {
+    throw new TeamsError(`Tenant discovery failed: HTTP ${res.status}`, 'tenant_discovery_failed')
+  }
+  const body = (await res.json().catch(() => [])) as unknown
+  const rows = Array.isArray(body) ? body : []
+  return rows
+    .map((row): TeamsTenant | null => {
+      if (typeof row !== 'object' || row === null) return null
+      const record = row as Record<string, unknown>
+      const tenantId = record.tenantId
+      if (typeof tenantId !== 'string' || !tenantId) return null
+      return {
+        tenantId,
+        tenantName: typeof record.tenantName === 'string' ? record.tenantName : undefined,
+        isInvitationRedeemed:
+          typeof record.isInvitationRedeemed === 'boolean' ? record.isInvitationRedeemed : undefined,
+      }
+    })
+    .filter((tenant): tenant is TeamsTenant => tenant !== null)
+}
+
+export function decodeJwtTid(token: string): string | undefined {
+  const payload = token.split('.')[1]
+  if (!payload) return undefined
+  try {
+    const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as { tid?: unknown }
+    return typeof claims.tid === 'string' ? claims.tid : undefined
+  } catch {
+    return undefined
+  }
+}
+
+// The consumer tenant unambiguously marks a personal account: it has no org
+// tenant, so a work login carrying it can never resolve a Teams tenant. The
+// Microsoft Services placeholder is intentionally excluded — it also appears on
+// legitimate work tokens, which resolveWorkTenantId() resolves via discovery.
+export function isConsumerTenant(tenantId: string): boolean {
+  return tenantId === CONSUMER_TENANT_ID
+}
+
+function isPlaceholderTenant(tenantId: string): boolean {
+  return tenantId === WORK_TENANT_ID || tenantId === CONSUMER_TENANT_ID || tenantId === MICROSOFT_SERVICES_TENANT_ID
+}
+
+export async function mintSkypeToken(
+  spacesAccessToken: string,
+  accountType: TeamsAccountType = 'personal',
+): Promise<MintedSkypeToken> {
+  const res = await fetch(authzUrl(accountType), {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${spacesAccessToken}`, Accept: 'application/json; ver=1.0' },
+  })
+  const body = (await res.json().catch(() => ({}))) as Record<string, unknown>
+  if (!res.ok) {
+    throw new TeamsError(`Failed to mint skype token: ${describeAuthzError(body, res.status)}`, 'skype_token_failed')
+  }
+  const nested = body.skypeToken as { skypetoken?: string; skypeTokenExpiresIn?: number } | undefined
+  const flat = body.tokens as { skypeToken?: string; expiresIn?: number } | undefined
+  const skypeToken = nested?.skypetoken ?? flat?.skypeToken
+  if (!skypeToken) {
+    throw new TeamsError('Consumer authz response did not contain a skype token.', 'skype_token_missing')
+  }
+  const ttlSec = nested?.skypeTokenExpiresIn ?? flat?.expiresIn ?? DEFAULT_SKYPE_TOKEN_TTL_SEC
+  return {
+    skypeToken,
+    skypeTokenExpiresAt: new Date(Date.now() + ttlSec * 1000).toISOString(),
+    region: parseRegion(body),
+  }
+}
+
+export async function mintConsumerSkypeToken(spacesAccessToken: string): Promise<MintedSkypeToken> {
+  return mintSkypeToken(spacesAccessToken, 'personal')
+}
+
+function describeAadError(body: Record<string, unknown>, status: number): string {
+  const desc = body.error_description ?? body.error
+  return typeof desc === 'string' ? desc.split('\n')[0] : `HTTP ${status}`
+}
+
+function describeAuthzError(body: Record<string, unknown>, status: number): string {
+  const statusObj = body.status as { text?: string } | undefined
+  const code = String(body.errorCode ?? body.message ?? statusObj?.text ?? `HTTP ${status}`)
+  if (code === 'GuestUserNotRedeemed') {
+    return `${code} (the account has no redeemed Teams tenant — if this is a personal account, run \`agent-teams auth login --account-type personal\`; if you are a guest, accept the Teams invite first)`
+  }
+  return code
+}
+
+function parseRegion(body: Record<string, unknown>): TeamsRegion | undefined {
+  const regionGtms = body.regionGtms as { region?: string; middleTier?: string; mt?: string } | undefined
+  const raw = regionGtms?.region ?? regionGtms?.middleTier ?? regionGtms?.mt
+  if (raw === 'amer' || raw === 'emea' || raw === 'apac') return raw
+  return undefined
+}

package/src/platforms/teams/device-login.test.ts

@@ -0,0 +1,288 @@
+import { afterAll, afterEach, describe, expect, it, mock, spyOn } from 'bun:test'
+import { rmSync } from 'node:fs'
+import { join } from 'node:path'
+
+import { TeamsClient } from './client'
+import { TeamsCredentialManager } from './credential-manager'
+import * as deviceCode from './device-code'
+import type { DeviceCodeInfo } from './device-code'
+import { loginWithDeviceCode, refreshDeviceCodeAccount } from './device-login'
+
+const CONSUMER_TENANT_ID = '9188040d-6c67-4c5b-b112-36a304b66dad'
+const MICROSOFT_SERVICES_TENANT_ID = 'f8cdef31-a31e-4b4a-93e4-5f571e91255a'
+const REAL_TENANT_ID = 'c0ffee00-1111-2222-3333-444455556666'
+
+function fakeJwt(claims: Record<string, unknown>): string {
+  return `header.${Buffer.from(JSON.stringify(claims)).toString('base64url')}.signature`
+}
+
+function fakeDeviceCodeInfo(): DeviceCodeInfo {
+  return {
+    deviceCode: 'device-code',
+    userCode: 'USER-CODE',
+    verificationUri: 'https://microsoft.com/devicelogin',
+    verificationUriComplete: 'https://microsoft.com/devicelogin?otc=USER-CODE',
+    expiresIn: 900,
+    interval: 1,
+  }
+}
+
+const testDirs: string[] = []
+const originalFetch = globalThis.fetch
+
+function setup(): TeamsCredentialManager {
+  const dir = join(import.meta.dir, `.test-teams-refresh-${Date.now()}-${Math.random().toString(36).slice(2)}`)
+  testDirs.push(dir)
+  return new TeamsCredentialManager(dir)
+}
+
+function mockExchangeAndMint(skypeToken: string, rotatedRefresh: string): { tokenUrls: string[] } {
+  const tokenUrls: string[] = []
+  globalThis.fetch = mock((input: string | URL | Request) => {
+    const url = String(input)
+    if (url.includes('/oauth2/v2.0/token')) {
+      tokenUrls.push(url)
+      return Promise.resolve({
+        ok: true,
+        status: 200,
+        json: () => Promise.resolve({ access_token: 'spaces-at', refresh_token: rotatedRefresh }),
+      } as Response)
+    }
+    return Promise.resolve({
+      ok: true,
+      status: 200,
+      json: () => Promise.resolve({ skypeToken: { skypetoken: skypeToken, skypeTokenExpiresIn: 3600 } }),
+    } as Response)
+  }) as typeof fetch
+  return { tokenUrls }
+}
+
+afterEach(() => {
+  globalThis.fetch = originalFetch
+})
+
+afterAll(() => {
+  for (const dir of testDirs) rmSync(dir, { recursive: true, force: true })
+})
+
+describe('refreshDeviceCodeAccount', () => {
+  it('re-mints the skype token, rotates the refresh token, and keeps the account current', async () => {
+    const manager = setup()
+    await manager.setDeviceCodeAccount({
+      accountType: 'personal',
+      token: 'old-skype',
+      tokenExpiresAt: '2000-01-01T00:00:00Z',
+      aadRefreshToken: 'old-refresh',
+      aadClientId: 'client',
+      teams: {},
+      currentTeam: null,
+    })
+
+    mockExchangeAndMint('new-skype', 'new-refresh')
+    const ok = await refreshDeviceCodeAccount('personal', manager)
+
+    expect(ok).toBe(true)
+    const config = await manager.loadConfig()
+    expect(config?.accounts.personal?.token).toBe('new-skype')
+    expect(config?.accounts.personal?.aad_refresh_token).toBe('new-refresh')
+    expect(new Date(config!.accounts.personal!.token_expires_at!).getTime()).toBeGreaterThan(Date.now())
+    expect(config?.current_account).toBe('personal')
+  })
+
+  it('refreshes work device-code accounts and persists the rotated refresh token', async () => {
+    const manager = setup()
+    await manager.setDeviceCodeAccount({
+      accountType: 'work',
+      token: 'old-skype',
+      tokenExpiresAt: '2000-01-01T00:00:00Z',
+      aadRefreshToken: 'old-refresh',
+      aadClientId: 'client',
+      teams: {},
+      currentTeam: null,
+    })
+
+    mockExchangeAndMint('new-skype', 'new-work-refresh')
+    const ok = await refreshDeviceCodeAccount('work', manager)
+
+    expect(ok).toBe(true)
+    const config = await manager.loadConfig()
+    expect(config?.accounts.work?.token).toBe('new-skype')
+    expect(config?.accounts.work?.aad_refresh_token).toBe('new-work-refresh')
+    expect(config?.accounts.work?.auth_method).toBe('device-code')
+  })
+
+  it('refreshes a work account against its stored tenant authority', async () => {
+    const manager = setup()
+    const tenantId = 'c0ffee00-1111-2222-3333-444455556666'
+    await manager.setDeviceCodeAccount({
+      accountType: 'work',
+      token: 'old-skype',
+      tokenExpiresAt: '2000-01-01T00:00:00Z',
+      aadRefreshToken: 'old-refresh',
+      aadClientId: 'client',
+      aadTenantId: tenantId,
+      teams: {},
+      currentTeam: null,
+    })
+
+    const { tokenUrls } = mockExchangeAndMint('new-skype', 'new-work-refresh')
+    const ok = await refreshDeviceCodeAccount('work', manager)
+
+    expect(ok).toBe(true)
+    expect(tokenUrls.some((url) => url.includes(`/${tenantId}/oauth2/v2.0/token`))).toBe(true)
+    const config = await manager.loadConfig()
+    expect(config?.accounts.work?.aad_tenant_id).toBe(tenantId)
+  })
+
+  it('does not change current_account when refreshing a non-current account', async () => {
+    const manager = setup()
+    await manager.setDeviceCodeAccount({
+      accountType: 'personal',
+      token: 'p',
+      tokenExpiresAt: '2000-01-01T00:00:00Z',
+      aadRefreshToken: 'r',
+      aadClientId: 'c',
+      teams: {},
+      currentTeam: null,
+    })
+    await manager.setToken('work-token', 'work', '2100-01-01T00:00:00Z')
+    await manager.setCurrentAccount('work')
+
+    mockExchangeAndMint('new-skype', 'new-refresh')
+    await refreshDeviceCodeAccount('personal', manager)
+
+    const config = await manager.loadConfig()
+    expect(config?.current_account).toBe('work')
+    expect(config?.accounts.personal?.token).toBe('new-skype')
+  })
+
+  it('returns false for a non-device-code account', async () => {
+    const manager = setup()
+    await manager.setToken('extracted-token', 'personal', '2100-01-01T00:00:00Z')
+
+    const ok = await refreshDeviceCodeAccount('personal', manager)
+    expect(ok).toBe(false)
+  })
+
+  it('returns false and leaves the token intact when the exchange fails', async () => {
+    const manager = setup()
+    await manager.setDeviceCodeAccount({
+      accountType: 'personal',
+      token: 'old-skype',
+      tokenExpiresAt: '2000-01-01T00:00:00Z',
+      aadRefreshToken: 'old-refresh',
+      aadClientId: 'client',
+      teams: {},
+      currentTeam: null,
+    })
+
+    globalThis.fetch = mock(() =>
+      Promise.resolve({ ok: false, status: 400, json: () => Promise.resolve({ error: 'invalid_grant' }) } as Response),
+    ) as typeof fetch
+
+    const ok = await refreshDeviceCodeAccount('personal', manager)
+    expect(ok).toBe(false)
+    const config = await manager.loadConfig()
+    expect(config?.accounts.personal?.token).toBe('old-skype')
+  })
+})
+
+describe('loginWithDeviceCode personal-account detection', () => {
+  const spies: Array<ReturnType<typeof spyOn>> = []
+
+  function spy<T extends object, K extends keyof T>(obj: T, key: K): ReturnType<typeof spyOn> {
+    const s = spyOn(obj, key as never)
+    spies.push(s)
+    return s
+  }
+
+  afterEach(() => {
+    for (const s of spies.splice(0)) s.mockRestore()
+  })
+
+  function stubFinalizeChain(): void {
+    spy(deviceCode, 'exchangeForSkypeScope').mockResolvedValue({ accessToken: 'spaces-at', refreshToken: 'rt' })
+    spy(deviceCode, 'mintSkypeToken').mockResolvedValue({
+      skypeToken: 'skype',
+      skypeTokenExpiresAt: '2100-01-01T00:00:00Z',
+    })
+    spy(TeamsClient.prototype, 'login').mockResolvedValue(new TeamsClient())
+    spy(TeamsClient.prototype, 'testAuth').mockResolvedValue({
+      id: 'u',
+      displayName: 'Work User',
+      email: 'w@example.com',
+    })
+    spy(TeamsClient.prototype, 'listTeams').mockResolvedValue([])
+    spy(TeamsClient.prototype, 'getRegion').mockReturnValue('emea')
+    spy(TeamsCredentialManager.prototype, 'setDeviceCodeAccount').mockResolvedValue(undefined)
+  }
+
+  it('stops with an actionable hint when a work login resolves to a consumer account', async () => {
+    const requestSpy = spy(deviceCode, 'requestDeviceCode').mockResolvedValue(fakeDeviceCodeInfo())
+    spy(deviceCode, 'pollDeviceToken').mockResolvedValue({
+      accessToken: fakeJwt({ tid: CONSUMER_TENANT_ID }),
+      refreshToken: 'work-rt',
+    })
+    const tenantSpy = spy(deviceCode, 'resolveWorkTenantId')
+    const exchangeSpy = spy(deviceCode, 'exchangeForSkypeScope')
+
+    // given: a work login whose token carries a consumer tenant
+    // then: it throws --account-type personal guidance without minting a token
+    await expect(loginWithDeviceCode({ accountType: 'work', onCode: () => {} })).rejects.toThrow(
+      /--account-type personal/,
+    )
+    expect(requestSpy).toHaveBeenCalledTimes(1)
+    expect(tenantSpy).not.toHaveBeenCalled()
+    expect(exchangeSpy).not.toHaveBeenCalled()
+  })
+
+  it('finishes a work login normally when it resolves to a real organizational tenant', async () => {
+    const requestSpy = spy(deviceCode, 'requestDeviceCode').mockResolvedValue(fakeDeviceCodeInfo())
+    spy(deviceCode, 'pollDeviceToken').mockResolvedValue({
+      accessToken: fakeJwt({ tid: REAL_TENANT_ID }),
+      refreshToken: 'work-rt',
+    })
+    const tenantSpy = spy(deviceCode, 'resolveWorkTenantId').mockResolvedValue(REAL_TENANT_ID)
+    stubFinalizeChain()
+
+    const result = await loginWithDeviceCode({ accountType: 'work', onCode: () => {} })
+
+    expect(requestSpy).toHaveBeenCalledTimes(1)
+    expect(tenantSpy).toHaveBeenCalledTimes(1)
+    expect(result.accountType).toBe('work')
+  })
+
+  it('runs tenant discovery for a work login carrying the Microsoft Services placeholder', async () => {
+    // given: a work token whose tid is the MSA-passthrough placeholder, which
+    // legitimate work accounts also carry and which discovery can still resolve
+    spy(deviceCode, 'requestDeviceCode').mockResolvedValue(fakeDeviceCodeInfo())
+    spy(deviceCode, 'pollDeviceToken').mockResolvedValue({
+      accessToken: fakeJwt({ tid: MICROSOFT_SERVICES_TENANT_ID }),
+      refreshToken: 'work-rt',
+    })
+    const tenantSpy = spy(deviceCode, 'resolveWorkTenantId').mockResolvedValue(REAL_TENANT_ID)
+    stubFinalizeChain()
+
+    // then: it is not rejected early — discovery runs and the login completes
+    const result = await loginWithDeviceCode({ accountType: 'work', onCode: () => {} })
+
+    expect(tenantSpy).toHaveBeenCalledTimes(1)
+    expect(result.accountType).toBe('work')
+  })
+
+  it('finishes a personal login without tenant discovery', async () => {
+    const requestSpy = spy(deviceCode, 'requestDeviceCode').mockResolvedValue(fakeDeviceCodeInfo())
+    spy(deviceCode, 'pollDeviceToken').mockResolvedValue({
+      accessToken: fakeJwt({ tid: CONSUMER_TENANT_ID }),
+      refreshToken: 'personal-rt',
+    })
+    const tenantSpy = spy(deviceCode, 'resolveWorkTenantId')
+    stubFinalizeChain()
+
+    const result = await loginWithDeviceCode({ accountType: 'personal', onCode: () => {} })
+
+    expect(requestSpy.mock.calls[0][1]).toBe('personal')
+    expect(tenantSpy).not.toHaveBeenCalled()
+    expect(result.accountType).toBe('personal')
+  })
+})