msteams-mcp 0.28.0 → 0.29.0

package/README.md

@@ -117,7 +117,7 @@ See [CLI Usage](#cli-usage) for commands.
 | `teams_search_email` | Search emails in your mailbox (same auth as Teams - no extra login)                                                                                   |
 | `teams_list_chats`   | List recent conversations (1:1, group, meeting, channel) with a last-message preview                                                                  |
 | `teams_get_message`  | Get a single message by ID with full content (any age); includes reactions                                                                            |
-| `teams_get_thread`   | Get messages from a conversation/thread; includes reactions; `threadRootId` scopes to one channel thread; `fromUrl` accepts a Teams message deep link |
+| `teams_get_thread`   | Get messages from a conversation/thread; includes reactions; `threadRootId` scopes to one channel thread; `fromUrl` accepts a Teams message deep link; `cursor` pages back through older history |
 | `teams_find_channel` | Find channels by name (your teams + org-wide discovery)                                                                                               |
 | `teams_get_tags`     | List a team's channel tags for tag @mentions                                                                                                          |
 | `teams_get_activity` | Get activity feed (mentions, reactions, replies, notifications)                                                                                       |

package/dist/api/csa-api.js

@@ -20,8 +20,8 @@ export async function getFavorites() {
         return authResult;
     }
     const { auth, csaToken } = authResult.value;
-    const { csaRegion, baseUrl } = getApiConfig();
-    const url = CSA_API.conversationFolders(csaRegion, baseUrl);
+    const { region, baseUrl } = getApiConfig();
+    const url = CSA_API.conversationFolders(region, baseUrl);
     const response = await httpRequest(url, {
         method: 'GET',
         headers: getCsaHeaders(auth.skypeToken, csaToken, baseUrl),
@@ -94,7 +94,7 @@ async function modifyFavorite(conversationId, action) {
         return authResult;
     }
     const { auth, csaToken } = authResult.value;
-    const { csaRegion, baseUrl } = getApiConfig();
+    const { region, baseUrl } = getApiConfig();
     // Get current folder state
     const currentState = await getFavorites();
     if (!currentState.ok) {
@@ -103,7 +103,7 @@ async function modifyFavorite(conversationId, action) {
     if (!currentState.value.folderId) {
         return err(createError(ErrorCode.NOT_FOUND, 'Could not find Favorites folder'));
     }
-    const url = CSA_API.conversationFolders(csaRegion, baseUrl);
+    const url = CSA_API.conversationFolders(region, baseUrl);
     const response = await httpRequest(url, {
         method: 'POST',
         headers: getCsaHeaders(auth.skypeToken, csaToken, baseUrl),
@@ -135,8 +135,8 @@ export async function getMyTeamsAndChannels() {
         return authResult;
     }
     const { auth, csaToken } = authResult.value;
-    const { csaRegion, baseUrl } = getApiConfig();
-    const url = CSA_API.teamsList(csaRegion, baseUrl);
+    const { region, baseUrl } = getApiConfig();
+    const url = CSA_API.teamsList(region, baseUrl);
     const response = await httpRequest(url, {
         method: 'GET',
         headers: getCsaHeaders(auth.skypeToken, csaToken, baseUrl),
@@ -156,8 +156,8 @@ export async function getCustomEmojis() {
         return authResult;
     }
     const { auth, csaToken } = authResult.value;
-    const { csaRegion, baseUrl } = getApiConfig();
-    const url = CSA_API.customEmojis(csaRegion, baseUrl);
+    const { region, baseUrl } = getApiConfig();
+    const url = CSA_API.customEmojis(region, baseUrl);
     const response = await httpRequest(url, {
         method: 'GET',
         headers: getCsaHeaders(auth.skypeToken, csaToken, baseUrl),

package/dist/auth/crypto.d.ts

@@ -26,3 +26,7 @@ export declare function encrypt(plaintext: string): EncryptedData;
  * @throws Error if decryption fails (wrong machine, corrupted data, etc.)
  */
 export declare function decrypt(data: EncryptedData): string;
+/**
+ * Checks if data looks like encrypted format.
+ */
+export declare function isEncrypted(data: unknown): data is EncryptedData;

package/dist/auth/crypto.js

@@ -52,3 +52,15 @@ export function decrypt(data) {
     decrypted += decipher.final('utf8');
     return decrypted;
 }
+/**
+ * Checks if data looks like encrypted format.
+ */
+export function isEncrypted(data) {
+    if (!data || typeof data !== 'object')
+        return false;
+    const obj = data;
+    return (typeof obj.iv === 'string' &&
+        typeof obj.content === 'string' &&
+        typeof obj.tag === 'string' &&
+        typeof obj.version === 'number');
+}

package/dist/auth/crypto.test.js

@@ -2,7 +2,7 @@
  * Unit tests for encryption utilities.
  */
 import { describe, it, expect } from 'vitest';
-import { encrypt, decrypt } from './crypto.js';
+import { encrypt, decrypt, isEncrypted } from './crypto.js';
 describe('encrypt/decrypt round-trip', () => {
     it('encrypts and decrypts a simple string', () => {
         const plaintext = 'hello world';
@@ -36,6 +36,23 @@ describe('encrypt/decrypt round-trip', () => {
         expect(encrypted1.content).not.toBe(encrypted2.content);
     });
 });
+describe('isEncrypted', () => {
+    it('returns true for encrypted data structure', () => {
+        const encrypted = encrypt('test');
+        expect(isEncrypted(encrypted)).toBe(true);
+    });
+    it('returns false for plain objects', () => {
+        expect(isEncrypted({})).toBe(false);
+        expect(isEncrypted({ content: 'abc' })).toBe(false);
+        expect(isEncrypted({ iv: 'abc' })).toBe(false);
+        expect(isEncrypted(null)).toBe(false);
+        expect(isEncrypted(undefined)).toBe(false);
+        expect(isEncrypted('string')).toBe(false);
+    });
+    it('returns true for object with all required fields', () => {
+        expect(isEncrypted({ content: 'x', iv: 'y', tag: 'z', version: 1 })).toBe(true);
+    });
+});
 describe('decrypt error handling', () => {
     it('throws on tampered ciphertext', () => {
         const encrypted = encrypt('secret');

package/dist/auth/session-store.d.ts

@@ -9,18 +9,11 @@
  * Session files are stored in a user-specific config directory (~/.teams-mcp-server/)
  * to ensure consistency regardless of how the server is invoked (npx, global install, etc.).
  */
-/**
- * User-specific config directory for teams-mcp-server.
- * - Windows: %APPDATA%\teams-mcp-server\
- * - macOS/Linux: ~/.teams-mcp-server/
- */
+export declare const PROJECT_ROOT: string;
 export declare const CONFIG_DIR: string;
+export declare const USER_DATA_DIR: string;
 export declare const SESSION_STATE_PATH: string;
 export declare const TOKEN_CACHE_PATH: string;
-/**
- * Ensures the config directory exists with secure permissions.
- */
-export declare function ensureConfigDir(): void;
 /** Session state as stored by Playwright. */
 export interface SessionState {
     cookies: Array<{
@@ -47,6 +40,10 @@ export interface TokenCache {
     substrateTokenExpiry: number;
     extractedAt: number;
 }
+/**
+ * Ensures the user data directory exists.
+ */
+export declare function ensureUserDataDir(): void;
 /**
  * Checks if session state file exists.
  */

package/dist/auth/session-store.js

@@ -12,26 +12,89 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { encrypt, decrypt } from './crypto.js';
+import { fileURLToPath } from 'url';
+import { encrypt, decrypt, isEncrypted } from './crypto.js';
 import { SESSION_EXPIRY_HOURS } from '../constants.js';
 import * as log from '../utils/logger.js';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 /**
- * User-specific config directory for teams-mcp-server.
- * - Windows: %APPDATA%\teams-mcp-server\
+ * Gets the user's home directory with fallback.
+ * os.homedir() can throw in rare edge cases (missing env vars, broken passwd).
+ */
+function getHomeDirSafe() {
+    try {
+        return os.homedir();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Gets the user-specific config directory for teams-mcp-server.
+ * - Windows: %APPDATA%\teams-mcp-server\ (e.g., C:\Users\name\AppData\Roaming\teams-mcp-server\)
  * - macOS/Linux: ~/.teams-mcp-server/
+ * - Fallback: ./teams-mcp-server-data/ relative to package (legacy behaviour)
  */
-export const CONFIG_DIR = process.platform === 'win32'
-    ? path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'teams-mcp-server')
-    : path.join(os.homedir(), '.teams-mcp-server');
+function getConfigDir() {
+    const homeDir = getHomeDirSafe();
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA || (homeDir ? path.join(homeDir, 'AppData', 'Roaming') : null);
+        if (appData) {
+            return path.join(appData, 'teams-mcp-server');
+        }
+    }
+    else if (homeDir) {
+        return path.join(homeDir, '.teams-mcp-server');
+    }
+    // Fallback to package-relative directory if home directory unavailable
+    const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+    return path.join(projectRoot, 'teams-mcp-server-data');
+}
+export const PROJECT_ROOT = path.resolve(__dirname, '../..');
+export const CONFIG_DIR = getConfigDir();
+export const USER_DATA_DIR = path.join(CONFIG_DIR, '.user-data');
 export const SESSION_STATE_PATH = path.join(CONFIG_DIR, 'session-state.json');
 export const TOKEN_CACHE_PATH = path.join(CONFIG_DIR, 'token-cache.json');
+// Legacy paths for migration
+const LEGACY_SESSION_PATH = path.join(PROJECT_ROOT, 'session-state.json');
+const LEGACY_TOKEN_CACHE_PATH = path.join(PROJECT_ROOT, 'token-cache.json');
 /** File permission mode: owner read/write only. */
 const SECURE_FILE_MODE = 0o600;
 /**
  * Ensures the config directory exists with secure permissions.
  */
-export function ensureConfigDir() {
-    fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+function ensureConfigDir() {
+    if (!fs.existsSync(CONFIG_DIR)) {
+        fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+}
+/**
+ * Migrates a file from legacy location to new config directory.
+ * Only migrates if legacy exists and new location doesn't.
+ */
+function migrateIfNeeded(legacyPath, newPath) {
+    if (fs.existsSync(legacyPath) && !fs.existsSync(newPath)) {
+        ensureConfigDir();
+        try {
+            fs.copyFileSync(legacyPath, newPath);
+            fs.chmodSync(newPath, SECURE_FILE_MODE);
+            // Remove legacy file after successful copy
+            fs.unlinkSync(legacyPath);
+        }
+        catch (error) {
+            // Log migration errors for debugging, but continue - will just create new session
+            log.warn('session-store', `Failed to migrate ${path.basename(legacyPath)}: ${error instanceof Error ? error.message : error}`);
+        }
+    }
+}
+/**
+ * Ensures the user data directory exists.
+ */
+export function ensureUserDataDir() {
+    ensureConfigDir();
+    if (!fs.existsSync(USER_DATA_DIR)) {
+        fs.mkdirSync(USER_DATA_DIR, { recursive: true, mode: 0o700 });
+    }
 }
 /**
  * Writes data securely with encryption and file permissions.
@@ -45,16 +108,26 @@ function writeSecure(filePath, data) {
     });
 }
 /**
- * Reads and decrypts data. Returns null if missing or undecryptable
- * (different machine, corrupted).
+ * Reads data securely, handling both encrypted and legacy plaintext.
  */
 function readSecure(filePath) {
-    if (!fs.existsSync(filePath))
+    if (!fs.existsSync(filePath)) {
         return null;
+    }
     try {
-        return JSON.parse(decrypt(JSON.parse(fs.readFileSync(filePath, 'utf8'))));
+        const content = fs.readFileSync(filePath, 'utf8');
+        const parsed = JSON.parse(content);
+        // Check if this is encrypted data
+        if (isEncrypted(parsed)) {
+            const decrypted = decrypt(parsed);
+            return JSON.parse(decrypted);
+        }
+        // Legacy plaintext - migrate to encrypted
+        writeSecure(filePath, parsed);
+        return parsed;
     }
     catch (error) {
+        // If decryption fails (different machine, corrupted), return null
         log.error('session-store', `Failed to read ${filePath}: ${error instanceof Error ? error.message : error}`);
         return null;
     }
@@ -63,12 +136,14 @@ function readSecure(filePath) {
  * Checks if session state file exists.
  */
 export function hasSessionState() {
+    migrateIfNeeded(LEGACY_SESSION_PATH, SESSION_STATE_PATH);
     return fs.existsSync(SESSION_STATE_PATH);
 }
 /**
  * Reads the session state.
  */
 export function readSessionState() {
+    migrateIfNeeded(LEGACY_SESSION_PATH, SESSION_STATE_PATH);
     return readSecure(SESSION_STATE_PATH);
 }
 /**
@@ -110,6 +185,7 @@ export function isSessionLikelyExpired() {
  * Reads the token cache.
  */
 export function readTokenCache() {
+    migrateIfNeeded(LEGACY_TOKEN_CACHE_PATH, TOKEN_CACHE_PATH);
     return readSecure(TOKEN_CACHE_PATH);
 }
 /**

package/dist/auth/token-extractor.d.ts

@@ -5,17 +5,19 @@
  * Teams stores MSAL tokens in localStorage; we parse these to get bearer tokens
  * for various APIs (Substrate search, chatsvc messaging, etc.).
  */
-import { type SessionState } from './session-store.js';
+import { clearTokenCache, type SessionState } from './session-store.js';
 import { type UserProfile } from '../utils/parsers.js';
-/**
- * Decodes a JWT token's payload without verifying the signature.
- */
-export declare function decodeJwtPayload(token: string): Record<string, unknown> | null;
-/** A JWT access token and its expiry. */
+/** Substrate search token (for search/people APIs). */
 export interface SubstrateTokenInfo {
     token: string;
     expiry: Date;
 }
+/** Teams chat API token (for chatsvc). */
+export interface TeamsTokenInfo {
+    token: string;
+    expiry: Date;
+    userMri: string;
+}
 /** Cookie-based auth for messaging APIs. */
 export interface MessageAuthInfo {
     skypeToken: string;
@@ -25,17 +27,16 @@ export interface MessageAuthInfo {
 /**
  * Extracts the Substrate search token from session state.
  * This token is used for search and people APIs.
- *
- * The target scope containing 'SubstrateSearch' matches all known formats:
- *   - substrate.office.com/search/SubstrateSearch (old)
- *   - substrate.office.com/SubstrateSearch-Internal.ReadWrite (new)
- *   - outlook.office.com/search/SubstrateSearch-Internal.ReadWrite (some Enterprise tenants)
  */
 export declare function extractSubstrateToken(state?: SessionState): SubstrateTokenInfo | null;
 /**
  * Gets a valid Substrate token, either from cache or by extracting from session.
  */
 export declare function getValidSubstrateToken(): string | null;
+/**
+ * Checks if we have a valid Substrate token.
+ */
+export declare function hasValidSubstrateToken(): boolean;
 /**
  * Gets Substrate token status for diagnostics.
  */
@@ -45,28 +46,13 @@ export declare function getSubstrateTokenStatus(): {
     minutesRemaining?: number;
 };
 /**
- * Extracts the EDU Assignments API token from session state.
+ * Extracts the Teams chat API token from session state.
  *
- * This token authenticates calls to `assignments.edu.cloud.microsoft`. It is
- * minted on demand by HTTP token refresh and stored in the MSAL cache.
- * Select AccessToken entries by the JWT audience, since Microsoft Graph uses
- * the same EduAssignments permission names for a different resource.
- */
-export declare function extractAssignmentsToken(state?: SessionState): SubstrateTokenInfo | null;
-/**
- * Extracts a Microsoft Graph token from session state. Teams web caches one for
- * its own client; the on-demand refresh (`refreshTokensViaHttp('graph')`) renews it.
- */
-export declare function extractGraphToken(state?: SessionState): SubstrateTokenInfo | null;
-/** Remove only the rejected credential; leave other API tokens untouched. */
-export declare function invalidateAccessToken(token: string): void;
-/**
- * Gets a valid EDU Assignments token from the session, or null. Refreshed on
- * demand by `refreshTokensViaHttp('assignments')`.
+ * Teams stores multiple tokens for different services. We prefer:
+ * 1. chatsvcagg.teams.microsoft.com (primary chat API)
+ * 2. api.spaces.skype.com (fallback)
  */
-export declare function getValidAssignmentsToken(): string | null;
-/** Gets a valid Microsoft Graph token from the session, or null. */
-export declare function getValidGraphToken(): string | null;
+export declare function extractTeamsToken(state?: SessionState): TeamsTokenInfo | null;
 /**
  * Extracts the Skype Spaces API token from session state.
  *
@@ -112,6 +98,35 @@ export interface RegionConfig {
  * base URLs (e.g., teams.microsoft.us).
  */
 export declare function extractRegionConfig(state?: SessionState): RegionConfig | null;
+/** User details from DISCOVER-USER-DETAILS. */
+export interface UserDetails {
+    /** User's MRI (e.g., "8:orgid:abc..."). */
+    mri: string;
+    /** User's region (e.g., "amer", "emea"). */
+    region: string;
+    /** User's partition (e.g., "amer01"). */
+    userPartition: string;
+    /** Tenant's partition (e.g., "amer02"). */
+    tenantPartition: string;
+    /** License details. */
+    licenses: {
+        isFreemium: boolean;
+        isTrial: boolean;
+        isTeamsEnabled: boolean;
+        isCopilot: boolean;
+        isTranscriptEnabled: boolean;
+        isFrontline: boolean;
+    };
+}
+/**
+ * Extracts user details from DISCOVER-USER-DETAILS in localStorage.
+ *
+ * This provides user-specific info including:
+ * - User's MRI
+ * - Region and partition info
+ * - License details (Copilot, transcription, etc.)
+ */
+export declare function extractUserDetails(state?: SessionState): UserDetails | null;
 /**
  * Extracts authentication info needed for messaging API.
  * Unlike other APIs, messaging uses cookies rather than localStorage tokens.
@@ -140,3 +155,31 @@ export declare function getUserProfile(state?: SessionState): UserProfile | null
  * Searches localStorage entries first, then falls back to JWT claims.
  */
 export declare function getUserDisplayName(state?: SessionState): string | null;
+/**
+ * Checks if tokens in session state are expired.
+ */
+export declare function areTokensExpired(state?: SessionState): boolean;
+export { clearTokenCache };
+/**
+ * Discovered configuration from localStorage.
+ * Used for debugging and understanding what config is available.
+ */
+export interface DiscoveredConfig {
+    /** All DISCOVER-* keys with their parsed values. */
+    discoveryConfigs: Record<string, unknown>;
+    /** All keys that look like configuration (not tokens). */
+    configKeys: string[];
+    /** Content of interesting config keys (settings, flags). */
+    configContents: Record<string, unknown>;
+    /** Teams base URL extracted from discovery config. */
+    teamsBaseUrl: string | null;
+    /** Substrate URL if found in any config. */
+    substrateUrl: string | null;
+    /** All unique hosts found in config URLs. */
+    uniqueHosts: string[];
+}
+/**
+ * Extracts all configuration data from localStorage for debugging.
+ * This helps discover what config is available from different tenants.
+ */
+export declare function discoverConfig(state?: SessionState): DiscoveredConfig | null;