agent-messenger 2.28.0 → 2.29.1

package/src/platforms/teams/device-login.ts

@@ -0,0 +1,206 @@
+import { getTeamsAppClientId } from './app-config'
+import { TeamsClient } from './client'
+import { TeamsCredentialManager } from './credential-manager'
+import {
+  type AadToken,
+  type DeviceCodeInfo,
+  decodeJwtTid,
+  exchangeDeviceCode,
+  exchangeForSkypeScope,
+  isConsumerTenant,
+  mintSkypeToken,
+  pollDeviceToken,
+  requestDeviceCode,
+  resolveWorkTenantId,
+} from './device-code'
+import { type TeamsAccountType, TeamsError } from './types'
+
+const PERSONAL_ACCOUNT_HINT =
+  'This looks like a personal Microsoft account. Run `agent-teams auth login --account-type personal` to sign in.'
+
+export interface DeviceCodePrompt {
+  verificationUri: string
+  verificationUriComplete: string
+  userCode: string
+  expiresAt: number
+}
+
+export interface DeviceLoginResult {
+  accountType: TeamsAccountType
+  userName: string
+  teams: Array<{ id: string; name: string }>
+  current: string | null
+}
+
+interface LoginCallbacks {
+  onCode: (prompt: DeviceCodePrompt) => void | Promise<void>
+  onPending?: () => void
+  debug?: (message: string) => void
+  clientId?: string
+  accountType?: TeamsAccountType
+}
+
+export async function startDeviceCode(
+  clientIdOverride?: string,
+  accountType: TeamsAccountType = 'personal',
+): Promise<{ info: DeviceCodeInfo; clientId: string }> {
+  const clientId = clientIdOverride ?? getTeamsAppClientId(accountType).clientId
+  const info = await requestDeviceCode(clientId, accountType)
+  return { info, clientId }
+}
+
+export async function completeDeviceCode(
+  deviceCode: string,
+  clientId: string,
+  credManager: TeamsCredentialManager = new TeamsCredentialManager(),
+  accountType: TeamsAccountType = 'personal',
+): Promise<DeviceLoginResult> {
+  const first = await exchangeDeviceCode(deviceCode, clientId, accountType)
+  if (first.status === 'pending' || first.status === 'slow_down') {
+    throw new PendingApprovalError()
+  }
+  if (first.status !== 'success') {
+    throw new Error(
+      first.status === 'expired'
+        ? 'Device code expired.'
+        : first.status === 'declined'
+          ? 'Authorization declined.'
+          : `Login failed: ${first.message}`,
+    )
+  }
+  return finalize(first.token, clientId, accountType, credManager)
+}
+
+export async function loginWithDeviceCode(
+  callbacks: LoginCallbacks,
+  credManager: TeamsCredentialManager = new TeamsCredentialManager(),
+): Promise<DeviceLoginResult> {
+  const accountType = callbacks.accountType ?? 'personal'
+  const { info, clientId } = await startDeviceCode(callbacks.clientId, accountType)
+  await callbacks.onCode({
+    verificationUri: info.verificationUri,
+    verificationUriComplete: info.verificationUriComplete,
+    userCode: info.userCode,
+    expiresAt: Date.now() + info.expiresIn * 1000,
+  })
+
+  const aad = await pollDeviceToken(info.deviceCode, info.interval, info.expiresIn, clientId, accountType)
+
+  // A work login can resolve to a personal (MSA) account, whose token carries a
+  // consumer tenant. Such accounts have no org tenant and can't be finished on
+  // the work flow, so stop with an actionable hint rather than fail obscurely.
+  if (accountType === 'work' && isPersonalAccount(aad)) {
+    throw new TeamsError(PERSONAL_ACCOUNT_HINT, 'teams_personal_account_on_work_login')
+  }
+
+  callbacks.onPending?.()
+  return finalize(aad, clientId, accountType, credManager, callbacks.debug)
+}
+
+function isPersonalAccount(aad: AadToken): boolean {
+  const tid = decodeJwtTid(aad.accessToken)
+  return tid !== undefined && isConsumerTenant(tid)
+}
+
+async function finalize(
+  initialAad: AadToken,
+  clientId: string,
+  accountType: TeamsAccountType,
+  credManager: TeamsCredentialManager,
+  debug?: (message: string) => void,
+): Promise<DeviceLoginResult> {
+  if (!initialAad.refreshToken) {
+    throw new Error(
+      'Sign-in did not return a refresh token (needed to mint the Teams token). Retry `auth login`, or use `auth extract` if this persists.',
+    )
+  }
+
+  let tenantId: string | undefined
+  if (accountType === 'work') {
+    debug?.('Resolving Teams tenant...')
+    tenantId = await resolveWorkTenantId(initialAad.accessToken)
+  }
+
+  debug?.('Exchanging token for skype audience...')
+  const skypeScoped = await exchangeForSkypeScope(initialAad.refreshToken, clientId, accountType, tenantId)
+
+  debug?.('Minting skype token...')
+  const minted = await mintSkypeToken(skypeScoped.accessToken, accountType)
+
+  const client = await new TeamsClient().login({ token: minted.skypeToken, accountType })
+  const authInfo = await client.testAuth()
+  const teams = await client.listTeams()
+
+  const teamMap: Record<string, { team_id: string; team_name: string }> = {}
+  for (const team of teams) {
+    teamMap[team.id] = { team_id: team.id, team_name: team.name }
+  }
+  const currentTeam = teams[0]?.id ?? null
+
+  await credManager.setDeviceCodeAccount({
+    accountType,
+    token: minted.skypeToken,
+    tokenExpiresAt: minted.skypeTokenExpiresAt,
+    aadRefreshToken: skypeScoped.refreshToken,
+    aadClientId: clientId,
+    aadTenantId: tenantId,
+    region: minted.region ?? (accountType === 'work' ? client.getRegion() : undefined),
+    userName: authInfo.displayName,
+    teams: teamMap,
+    currentTeam,
+    authMethod: 'device-code',
+  })
+
+  return {
+    accountType,
+    userName: authInfo.displayName,
+    teams: teams.map((t) => ({ id: t.id, name: t.name })),
+    current: currentTeam,
+  }
+}
+
+export async function refreshDeviceCodeAccount(
+  accountType: TeamsAccountType,
+  credManager: TeamsCredentialManager = new TeamsCredentialManager(),
+  debug?: (message: string) => void,
+): Promise<boolean> {
+  const config = await credManager.loadConfig()
+  const account = config?.accounts[accountType]
+  if (!account || account.auth_method !== 'device-code' || !account.aad_refresh_token) {
+    return false
+  }
+  const clientId = account.aad_client_id ?? getTeamsAppClientId(accountType).clientId
+
+  try {
+    debug?.('Silently refreshing skype token...')
+    const tenantId = accountType === 'work' ? account.aad_tenant_id : undefined
+    const skypeScoped = await exchangeForSkypeScope(account.aad_refresh_token, clientId, accountType, tenantId)
+    const minted = await mintSkypeToken(skypeScoped.accessToken, accountType)
+
+    await credManager.setDeviceCodeAccount({
+      accountType,
+      token: minted.skypeToken,
+      tokenExpiresAt: minted.skypeTokenExpiresAt,
+      aadRefreshToken: skypeScoped.refreshToken,
+      aadClientId: clientId,
+      aadTenantId: tenantId,
+      region: minted.region ?? account.region,
+      userName: account.user_name,
+      teams: account.teams,
+      currentTeam: account.current_team,
+      authMethod: 'device-code',
+      makeCurrent: false,
+    })
+    return true
+  } catch (error) {
+    debug?.(`Silent refresh failed: ${(error as Error).message}`)
+    return false
+  }
+}
+
+export class PendingApprovalError extends Error {
+  constructor() {
+    super('Authorization pending. Approve in the browser, then retry.')
+    this.name = 'PendingApprovalError'
+  }
+}

package/src/platforms/teams/ensure-auth.ts

@@ -2,6 +2,7 @@ import { warn } from '@/shared/utils/stderr'
 
 import { TeamsClient } from './client'
 import { TeamsCredentialManager } from './credential-manager'
+import { refreshDeviceCodeAccount } from './device-login'
 import { TeamsTokenExtractor } from './token-extractor'
 import type { TeamsAccount, TeamsAccountType, TeamsConfig } from './types'
 
@@ -12,6 +13,8 @@ export async function ensureTeamsAuth(): Promise<void> {
 
     if (config && hasValidToken(config)) return
 
+    if (config && (await trySilentRefresh(config, credManager))) return
+
     const extractor = new TeamsTokenExtractor()
     const extracted = await extractor.extract()
     if (extracted.length === 0) return
@@ -92,6 +95,14 @@ async function resolveAccountType(
   throw lastError ?? new Error('Token validation failed')
 }
 
+async function trySilentRefresh(config: TeamsConfig, credManager: TeamsCredentialManager): Promise<boolean> {
+  const key = TeamsCredentialManager.accountOverride ?? config.current_account
+  if (!key) return false
+  const account = config.accounts[key]
+  if (account?.auth_method !== 'device-code' || !account.aad_refresh_token) return false
+  return refreshDeviceCodeAccount(key as TeamsAccountType, credManager)
+}
+
 function hasValidToken(config: TeamsConfig): boolean {
   const key = TeamsCredentialManager.accountOverride ?? config.current_account
   if (!key) return false

package/src/platforms/teams/index.test.ts

@@ -13,7 +13,9 @@ import {
   TeamsFileSchema,
   TeamsMessageSchema,
   TeamsReactionSchema,
+  TeamsSearchResultSchema,
   TeamsTeamSchema,
+  TeamsTokenProvider,
   TeamsUserSchema,
 } from '@/platforms/teams/index'
 
@@ -29,6 +31,10 @@ it('TeamsCredentialManager is exported from barrel', () => {
   expect(typeof TeamsCredentialManager).toBe('function')
 })
 
+it('TeamsTokenProvider is exported from barrel', () => {
+  expect(typeof TeamsTokenProvider).toBe('function')
+})
+
 it('TeamsTeamSchema is exported from barrel', () => {
   expect(typeof TeamsTeamSchema.parse).toBe('function')
 })
@@ -41,6 +47,10 @@ it('TeamsMessageSchema is exported from barrel', () => {
   expect(typeof TeamsMessageSchema.parse).toBe('function')
 })
 
+it('TeamsSearchResultSchema is exported from barrel', () => {
+  expect(typeof TeamsSearchResultSchema.parse).toBe('function')
+})
+
 it('TeamsUserSchema is exported from barrel', () => {
   expect(typeof TeamsUserSchema.parse).toBe('function')
 })

package/src/platforms/teams/index.ts

@@ -1,6 +1,16 @@
 export { TeamsClient } from './client'
 export { TeamsCredentialManager } from './credential-manager'
-export { TeamsError } from './types'
+export { TeamsTokenProvider } from './token-provider'
+export {
+  completeDeviceCode,
+  loginWithDeviceCode,
+  PendingApprovalError,
+  refreshDeviceCodeAccount,
+  startDeviceCode,
+} from './device-login'
+export type { DeviceCodePrompt, DeviceLoginResult } from './device-login'
+export { TeamsListener } from './listener'
+export { TeamsAuthCapabilityError, TeamsError } from './types'
 export type {
   TeamsAccount,
   TeamsAccountType,
@@ -9,9 +19,14 @@ export type {
   TeamsConfigLegacy,
   TeamsCredentials,
   TeamsFile,
+  TeamsListenerEventMap,
+  TeamsMention,
   TeamsMessage,
+  TeamsRealtimeMessage,
   TeamsReaction,
+  TeamsSearchResult,
   TeamsTeam,
+  TeamsTrouterGenericEvent,
   TeamsUser,
 } from './types'
 export {
@@ -24,6 +39,7 @@ export {
   TeamsFileSchema,
   TeamsMessageSchema,
   TeamsReactionSchema,
+  TeamsSearchResultSchema,
   TeamsTeamSchema,
   TeamsUserSchema,
 } from './types'

package/src/platforms/teams/listener.test.ts

@@ -0,0 +1,243 @@
+import { afterEach, describe, expect, mock, it } from 'bun:test'
+
+import { TeamsListener } from '@/platforms/teams/listener'
+import type { TeamsRealtimeMessage } from '@/platforms/teams/types'
+
+type WsHandler = (...args: any[]) => void
+
+let mockWsInstance: MockWs
+
+class MockWs {
+  static OPEN = 1
+  static CLOSED = 3
+  readyState = MockWs.OPEN
+
+  private handlers = new Map<string, WsHandler[]>()
+  sent: string[] = []
+
+  constructor(_url: string, _options?: any) {
+    // oxlint-disable-next-line typescript-eslint/no-this-alias
+    mockWsInstance = this
+  }
+
+  on(event: string, handler: WsHandler) {
+    const list = this.handlers.get(event) ?? []
+    list.push(handler)
+    this.handlers.set(event, list)
+  }
+
+  send(data: string) {
+    this.sent.push(data)
+  }
+
+  close() {
+    this.readyState = MockWs.CLOSED
+  }
+
+  emit(event: string, ...args: any[]) {
+    for (const handler of this.handlers.get(event) ?? []) {
+      handler(...args)
+    }
+  }
+
+  simulateFrame(frame: string) {
+    this.emit('message', Buffer.from(frame))
+  }
+}
+
+mock.module('ws', () => ({ default: MockWs, __esModule: true }))
+
+const actualTrouter = await import('@/platforms/teams/trouter')
+mock.module('@/platforms/teams/trouter', () => ({
+  ...actualTrouter,
+  fetchTrouterInfo: mock(() => Promise.resolve({ socketio: 'wss://fake/', surl: 'https://fake/', connectparams: {} })),
+  fetchTrouterSessionId: mock(() => Promise.resolve('SESSION')),
+  registerEndpoint: mock(() => Promise.resolve()),
+}))
+
+function messageFrame(resource: Record<string, unknown>): string {
+  const body = JSON.stringify({ resourceType: 'NewMessage', resource })
+  return `3:::${JSON.stringify({ id: 1, url: '/v4/f/HASH/messaging', body })}`
+}
+
+function conversationLink(conversationId: string): string {
+  return `https://notifications.skype.net/v1/users/ME/conversations/${conversationId}`
+}
+
+function createMockClient(channelTeamMap: Map<string, string> = new Map()) {
+  return {
+    getToken: mock(() => 'skype-token'),
+    getIdToken: mock(() => Promise.resolve('id-token')),
+    getAccountType: mock(() => 'work'),
+    buildChannelTeamMap: mock(() => Promise.resolve(channelTeamMap)),
+  } as any
+}
+
+async function startAndCapture(
+  client: ReturnType<typeof createMockClient>,
+): Promise<{ listener: TeamsListener; messages: TeamsRealtimeMessage[] }> {
+  const listener = new TeamsListener(client)
+  const messages: TeamsRealtimeMessage[] = []
+  listener.on('message', (message) => messages.push(message))
+  await listener.start()
+  return { listener, messages }
+}
+
+async function flushMicrotasks(): Promise<void> {
+  for (let i = 0; i < 5; i++) await Promise.resolve()
+}
+
+describe('TeamsListener.emitMessage', () => {
+  let listener: TeamsListener
+
+  afterEach(() => {
+    listener?.stop()
+  })
+
+  it('classifies a 1:1 chat and carries no team/channel context', async () => {
+    const client = createMockClient()
+    const started = await startAndCapture(client)
+    listener = started.listener
+
+    mockWsInstance.simulateFrame(
+      messageFrame({
+        id: 'm1',
+        messagetype: 'RichText/Html',
+        content: 'hello there',
+        from: 'https://x/contacts/8:orgid:alice',
+        imdisplayname: 'Alice',
+        conversationLink: conversationLink('19:uni01_abc@unq.gbl.spaces'),
+      }),
+    )
+    await flushMicrotasks()
+
+    expect(started.messages).toHaveLength(1)
+    const message = started.messages[0]
+    expect(message.chatId).toBe('19:uni01_abc@unq.gbl.spaces')
+    expect(message.conversationType).toBe('chat')
+    expect(message.teamId).toBeUndefined()
+    expect(message.channelId).toBeUndefined()
+    expect(message.content).toBe('hello there')
+    expect(message.mentions).toEqual([])
+    expect(message.author).toEqual({ id: '8:orgid:alice', displayName: 'Alice' })
+  })
+
+  it('classifies a group chat thread with no groupId as a chat', async () => {
+    const client = createMockClient()
+    const started = await startAndCapture(client)
+    listener = started.listener
+
+    mockWsInstance.simulateFrame(
+      messageFrame({
+        id: 'm2',
+        messagetype: 'RichText/Html',
+        content: 'group hi',
+        from: 'https://x/contacts/8:orgid:bob',
+        imdisplayname: 'Bob',
+        conversationLink: conversationLink('19:group_xyz@thread.tacv2'),
+      }),
+    )
+    await flushMicrotasks()
+
+    expect(started.messages).toHaveLength(1)
+    const message = started.messages[0]
+    expect(message.chatId).toBe('19:group_xyz@thread.tacv2')
+    expect(message.conversationType).toBe('chat')
+    expect(message.teamId).toBeUndefined()
+    expect(message.channelId).toBeUndefined()
+  })
+
+  it('does not refresh the channel map for every group-chat message', async () => {
+    const client = createMockClient()
+    const started = await startAndCapture(client)
+    listener = started.listener
+
+    for (const id of ['g1', 'g2', 'g3']) {
+      mockWsInstance.simulateFrame(
+        messageFrame({
+          id,
+          messagetype: 'RichText/Html',
+          content: 'group hi',
+          from: 'https://x/contacts/8:orgid:bob',
+          imdisplayname: 'Bob',
+          conversationLink: conversationLink('19:group_xyz@thread.tacv2'),
+        }),
+      )
+      await flushMicrotasks()
+    }
+
+    expect(started.messages).toHaveLength(3)
+    // One build at start() + one refresh on the first miss; the negative cache
+    // prevents a fetch on the 2nd and 3rd messages.
+    expect(client.buildChannelTeamMap).toHaveBeenCalledTimes(2)
+  })
+
+  it('classifies a team channel message and resolves teamId plus mentions', async () => {
+    const channelId = '19:channel_abc@thread.tacv2'
+    const client = createMockClient(new Map([[channelId, 'team-group-id']]))
+    const started = await startAndCapture(client)
+    listener = started.listener
+
+    mockWsInstance.simulateFrame(
+      messageFrame({
+        id: 'm3',
+        messagetype: 'RichText/Html',
+        content: '<span itemtype="http://schema.skype.com/Mention" itemscope itemid="0">Alice</span> please review',
+        from: 'https://x/contacts/8:orgid:bob',
+        imdisplayname: 'Bob',
+        conversationLink: conversationLink(channelId),
+        properties: {
+          mentions: [{ itemid: '0', mri: '8:orgid:alice', mentionType: 'person', displayName: 'Alice' }],
+        },
+      }),
+    )
+    await flushMicrotasks()
+
+    expect(started.messages).toHaveLength(1)
+    const message = started.messages[0]
+    expect(message.conversationType).toBe('channel')
+    expect(message.teamId).toBe('team-group-id')
+    expect(message.channelId).toBe(channelId)
+    expect(message.content).toBe('Alice please review')
+    expect(message.mentions).toEqual([{ id: '0', mri: '8:orgid:alice', displayName: 'Alice' }])
+  })
+
+  it('does not re-emit a message with a duplicate id', async () => {
+    const client = createMockClient()
+    const started = await startAndCapture(client)
+    listener = started.listener
+
+    const frame = messageFrame({
+      id: 'dup',
+      messagetype: 'Text',
+      content: 'once',
+      from: 'https://x/contacts/8:orgid:alice',
+      imdisplayname: 'Alice',
+      conversationLink: conversationLink('19:uni01_abc@unq.gbl.spaces'),
+    })
+    mockWsInstance.simulateFrame(frame)
+    await flushMicrotasks()
+    mockWsInstance.simulateFrame(frame)
+    await flushMicrotasks()
+
+    expect(started.messages).toHaveLength(1)
+  })
+
+  it('ignores non-text message types', async () => {
+    const client = createMockClient()
+    const started = await startAndCapture(client)
+    listener = started.listener
+
+    mockWsInstance.simulateFrame(
+      messageFrame({
+        id: 'sys',
+        messagetype: 'ThreadActivity/AddMember',
+        content: '',
+        conversationLink: conversationLink('19:uni01_abc@unq.gbl.spaces'),
+      }),
+    )
+    await flushMicrotasks()
+
+    expect(started.messages).toHaveLength(0)
+  })
+})