toga-ai 1.0.70 → 1.0.71

package/knowledge/2.0/apps/worker2/features/teams-transcript-export.md

@@ -42,10 +42,16 @@ Per run, after acquiring a Graph client-credentials token:
    - **Fallback:** the comma-separated `[teams] organizer_user_ids` list (used only when no group
      is configured or the group resolves no members; group-lookup failures are caught so they
      can't abort the run).
-2. Per organizer: `getAllTranscripts(meetingOrganizerUserId='{guid}', startDateTime, endDateTime)`
+2. **Per organizer**, `resolveUserId()` ensures a GUID: a value already shaped like a GUID
+   (the group path) passes through; a UPN is looked up via `/users/{upn}?$select=id` and
+   returns the object-id, or **`null`** if that lookup fails. The loop **fails fast** on null —
+   it throws a clear per-organizer error (caught and recorded in `summary['errors']`, the run
+   continues for other organizers) rather than sending a UPN to Graph. `listAllTranscripts()`
+   also re-asserts the GUID shape before embedding it in the OData literal.
+3. `getAllTranscripts(meetingOrganizerUserId='{guid}', startDateTime, endDateTime)`
    over an incremental window (`MAX(dtCreated)` watermark from the ledger, else `now − lookbackDays`),
    following `@odata.nextLink`.
-3. Per new transcript (dedup by `transcriptIdentifier`): fetch meeting `subject`+`startDateTime`
+4. Per new transcript (dedup by `transcriptIdentifier`): fetch meeting `subject`+`startDateTime`
    (cached per meeting), classify, download VTT (`?$format=text/vtt`), `putObject` to S3, insert
    ledger row.
 
@@ -91,8 +97,13 @@ process is identical for all.
   producing the same 400. Lesson: a "fix" that depends on an ungranted permission and silently
   falls back will look correct in code review but never work in prod. The group-members approach
   avoids the `/users` endpoint entirely.
-- `resolveUserId()` still exists for the `organizer_user_ids` fallback path and returns a GUID
-  unchanged (regex match); it is bypassed entirely when the group is configured.
+- `resolveUserId()` returns `?string`: a GUID passes through, a UPN is resolved via `/users`,
+  and it returns **`null`** when a non-GUID can't be resolved — it never echoes the UPN back.
+  The Export loop rejects null and skips that organizer with a clear error, so a UPN can never
+  reach Graph. `listAllTranscripts()` re-asserts the GUID shape (`preg_match`) before embedding
+  the id in the OData string literal — defense-in-depth so the no-injection invariant can't
+  silently regress. Note: the `organizer_user_ids` UPN fallback only actually works in a tenant
+  that grants `User.Read.All`; in this tenant it does not, so the group is the only working source.
 - Graph meeting/transcript ids are base64 and contain `+ / =` — they must be `rawurlencode()`'d
   at every Graph call site (`getMeeting`, `downloadTranscriptVtt` fallback URL).
 - `resolveWatermark()` guards against an unparseable stored `dtCreated`: without the guard,
@@ -102,17 +113,25 @@ process is identical for all.
 
 ## Diagnosing a 400
 
-A standalone bash diagnostic (`worker2/diagnose-transcripts.sh`) reproduces the Graph call
-chain step-by-step (token → group members → `getAllTranscripts`) and prints the **full** Graph
-error body that the worker discards (it keeps only `error.message`). It reads creds from the ini
-at runtime and prints none. Useful first stop for any future Graph failure here.
+When a 400 recurs, reproduce the Graph call chain **outside** the worker, step-by-step
+(OAuth token → `GET /groups/{id}/members/microsoft.graph.user?$select=id` → `getAllTranscripts`
+with one member's object-id) with curl, reading creds from `Config/production.ini` `[teams]`.
+This surfaces the **full** Graph error body (`error.code` + `innerError`) that the worker
+discards — `curlRequest()` keeps only `error.message`, which is why prod logs showed an opaque
+`UnknownError`. A `400 UnknownError` on a *valid GUID* points to a Teams Application Access
+Policy gap; a `400` only on a UPN means the id was never resolved to a GUID. (A throwaway
+`diagnose-transcripts.sh` was used this way during the fix but is not committed.)
 
 ## Change history
 
+- 2026-06-12 — **Merged (PR #78) and verified in production**: a real `Team/Transcripts/Export`
+  run returned 6/6 organizers, 33 found, 33 exported, 0 errors (classified 30 general / 3 Elite).
+  Added fail-fast on unresolvable organizers (`resolveUserId` → null, loop throws clear error
+  instead of sending a UPN to Graph) and a GUID assertion in `listAllTranscripts`. (ajean)
 - 2026-06-12 — Resolve organizers from the `organizer_group_id` Entra group (object-ids via
   GroupMember.Read.All) instead of per-UPN lookup; fixes the recurring HTTP 400 that PR #77's
   `/users` approach couldn't (no User.Read.All). Hardened watermark parsing, URL-encoding, and
-  silent catches. Verified live: 6/6 organizers, 32 transcripts. (ajean)
+  silent catches. (ajean)
 
 ## Related docs
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.70",
+  "version": "1.0.71",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",