microsoft-agents-hosting-core 1.4.0.dev13__tar.gz → 1.5.0.dev8__tar.gz

{microsoft_agents_hosting_core-1.4.0.dev13/microsoft_agents_hosting_core.egg-info → microsoft_agents_hosting_core-1.5.0.dev8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agents-hosting-core
-Version: 1.4.0.dev13
+Version: 1.5.0.dev8
 Summary: Core library for Microsoft Agents
 Author: Microsoft Corporation
 License-Expression: MIT
@@ -15,12 +15,14 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: microsoft-agents-activity==1.4.0.dev13
+Requires-Dist: microsoft-agents-activity==1.5.0.dev8
 Requires-Dist: pyjwt>=2.10.1
 Requires-Dist: isodate>=0.6.1
 Requires-Dist: python-dotenv>=1.1.1
 Requires-Dist: opentelemetry-api>=1.27.0
 Requires-Dist: opentelemetry-sdk>=1.27.0
+Requires-Dist: aiohttp>=3.11.11
+Requires-Dist: yarl<2.0,>=1.17.0
 Dynamic: license-file
 Dynamic: requires-dist
 
@@ -42,6 +44,15 @@ This library is part of the **Microsoft 365 Agents SDK for Python** - a comprehe
     <th style="width:20%">Date</th>
     <th style="width:60%">Release Notes</th>
   </tr>
+  <tr>
+   <td>1.4.0</td>
+   <td>2026-08-18</td>
+   <td>
+     <a href="https://github.com/microsoft/Agents-for-python/blob/main/changelog.md#microsoft-365-agents-sdk-for-python---release-notes-v140">
+       1.4.0 Release Notes
+     </a>
+   </td>
+  </tr>
   <tr>
     <td>1.3.0</td>
     <td>2026-07-30</td>

microsoft_agents_hosting_core-1.5.0.dev8/VERSION.txt

@@ -0,0 +1 @@
+1.5.0.dev8

{microsoft_agents_hosting_core-1.4.0.dev13 → microsoft_agents_hosting_core-1.5.0.dev8}/microsoft_agents/hosting/core/__init__.py

@@ -9,6 +9,7 @@ from .message_factory import MessageFactory
 from .middleware_set import Middleware, MiddlewareSet
 from .rest_channel_service_client_factory import RestChannelServiceClientFactory
 from .turn_context import TurnContext
+from .outbound_host_validator import OutboundHostValidator
 
 # HTTP abstractions
 from .http import (
@@ -122,6 +123,7 @@ __all__ = [
     "Middleware",
     "RestChannelServiceClientFactory",
     "TurnContext",
+    "OutboundHostValidator",
     "HttpRequestProtocol",
     "HttpResponse",
     "HttpResponseFactory",

{microsoft_agents_hosting_core-1.4.0.dev13 → microsoft_agents_hosting_core-1.5.0.dev8}/microsoft_agents/hosting/core/_http_adapter_base.py

@@ -7,6 +7,8 @@ from abc import ABC
 from http import HTTPStatus
 from traceback import format_exc
 
+import logging
+
 from microsoft_agents.activity import Activity, DeliveryModes
 from microsoft_agents.hosting.core.telemetry.adapter import spans
 
@@ -20,6 +22,9 @@ from .http._http_response import HttpResponse, HttpResponseFactory
 from .message_factory import MessageFactory
 from .rest_channel_service_client_factory import RestChannelServiceClientFactory
 from .turn_context import TurnContext
+from .outbound_host_validator import OutboundHostValidator, _try_create_url
+
+logger = logging.getLogger(__name__)
 
 
 class HttpAdapterBase(ChannelServiceAdapter, ABC):
@@ -35,6 +40,7 @@ class HttpAdapterBase(ChannelServiceAdapter, ABC):
         connection_manager: Connections | None = None,
         channel_service_client_factory: ChannelServiceClientFactoryBase | None = None,
         channel_service_client_factory_options: dict | None = None,
+        host_validator: OutboundHostValidator | None = None,
     ):
         """Initialize the HTTP adapter.
 
@@ -73,6 +79,7 @@ class HttpAdapterBase(ChannelServiceAdapter, ABC):
                 connection_manager,
                 **(channel_service_client_factory_options or {}),
             )
+        self._host_validator = host_validator or OutboundHostValidator()
 
         super().__init__(factory)
 
@@ -112,10 +119,8 @@ class HttpAdapterBase(ChannelServiceAdapter, ABC):
             span.share(activity=activity)
 
             # Get claims identity (default to anonymous if not set by middleware)
-            claims_identity: (
-                ClaimsIdentity
-            ) = request.get_claims_identity() or ClaimsIdentity(
-                {}, False, authentication_type="Anonymous"
+            claims_identity: ClaimsIdentity = (
+                request.get_claims_identity() or ClaimsIdentity()
             )
 
             # Validate required activity fields
@@ -128,6 +133,11 @@ class HttpAdapterBase(ChannelServiceAdapter, ABC):
                     "Activity must have type and conversation.id"
                 )
 
+            if not self._validate_service_url(claims_identity, activity):
+                return HttpResponseFactory.unauthorized(
+                    "Service URL is not allowed by the host validator."
+                )
+
             try:
                 # Process the inbound activity with the agent
                 invoke_response = await self.process_activity(
@@ -153,3 +163,57 @@ class HttpAdapterBase(ChannelServiceAdapter, ABC):
 
             except PermissionError:
                 return HttpResponseFactory.unauthorized()
+
+    def _validate_service_url(
+        self, claims_identity: ClaimsIdentity, activity: Activity
+    ) -> bool:
+        """Validate the service URL against the claims identity.
+
+        Args:
+            claims_identity: The claims identity to validate against.
+            activity: The activity containing the service URL to validate.
+
+        Returns:
+            True if the service URL is valid, False otherwise.
+        """
+
+        if (
+            self._host_validator.enabled
+            and activity.service_url
+            and not self._host_validator.is_allowed(activity.service_url)
+        ):
+            logger.warning(
+                "Service URL %s is not allowed by the host validator.",
+                activity.service_url,
+            )
+            return False
+
+        if not claims_identity:
+            return True
+
+        claims_service_url = claims_identity.get_claim_value("serviceurl")
+        if activity.service_url and claims_service_url:
+            claim_url = _try_create_url(claims_service_url)
+            activity_url = _try_create_url(activity.service_url)
+            claim_url_host = (claim_url.host or "") if claim_url else ""
+            activity_url_host = (activity_url.host or "") if activity_url else ""
+            if (
+                not claim_url
+                or not activity_url
+                or claim_url_host.casefold() != activity_url_host.casefold()
+            ):
+                if self._host_validator and self._host_validator.enabled:
+                    logger.warning(
+                        "Service URL host mismatch: %s vs %s",
+                        claim_url_host,
+                        activity_url_host,
+                    )
+                    return False
+                else:
+                    logger.warning(
+                        "Service URL host mismatch (host validator disabled): %s vs %s",
+                        claim_url_host,
+                        activity_url_host,
+                    )
+
+        return True

{microsoft_agents_hosting_core-1.4.0.dev13 → microsoft_agents_hosting_core-1.5.0.dev8}/microsoft_agents/hosting/core/_oauth/_flow_storage_client.py

@@ -1,8 +1,6 @@
 # Copyright (c) Microsoft Corporation. All rights reserved.
 # Licensed under the MIT License.
 
-from typing import Optional
-
 from ..storage import Storage
 from ._flow_state import _FlowState
 
@@ -34,7 +32,7 @@ class _FlowStorageClient:
         channel_id: str,
         user_id: str,
         storage: Storage,
-        cache_class: Optional[type[Storage]] = None,
+        cache_class: type[Storage] | None = None,
     ):
         """
         Args:
@@ -65,7 +63,7 @@ class _FlowStorageClient:
         """Creates a storage key for a specific sign-in handler."""
         return f"{self._base_key}{auth_handler_id}"
 
-    async def read(self, auth_handler_id: str) -> Optional[_FlowState]:
+    async def read(self, auth_handler_id: str) -> _FlowState | None:
         """Reads the flow state for a specific authentication handler."""
         key: str = self.key(auth_handler_id)
         data = await self._cache.read([key], target_cls=_FlowState)
@@ -74,13 +72,13 @@ class _FlowStorageClient:
             if key not in data:
                 return None
             await self._cache.write({key: data[key]})
-        return _FlowState.model_validate(data.get(key))
+        return data.get(key)
 
     async def write(self, value: _FlowState) -> None:
         """Saves the flow state for a specific authentication handler."""
         key: str = self.key(value.auth_handler_id)
         cached_state = await self._cache.read([key], target_cls=_FlowState)
-        if not cached_state or cached_state != value:
+        if not cached_state or cached_state.get(key, None) != value:
             await self._cache.write({key: value})
             await self._storage.write({key: value})
 

{microsoft_agents_hosting_core-1.4.0.dev13 → microsoft_agents_hosting_core-1.5.0.dev8}/microsoft_agents/hosting/core/_oauth/_oauth_flow.py

@@ -126,7 +126,7 @@ class _OAuthFlow:
             magic_code=magic_code,
         )
         if token_response:
-            logger.info("User token obtained successfully: %s", token_response)
+            logger.info("User token obtained successfully")
             self._flow_state.expiration = (
                 datetime.now(timezone.utc).timestamp() + self._default_flow_duration
             )
@@ -315,10 +315,7 @@ class _OAuthFlow:
             self._flow_state.expiration = (
                 datetime.now(timezone.utc).timestamp() + self._default_flow_duration
             )
-            logger.debug(
-                "OAuth flow completed successfully, got TokenResponse: %s",
-                token_response,
-            )
+            logger.debug("OAuth flow completed successfully, got a token response.")
 
         return _FlowResponse(
             flow_state=self._flow_state.model_copy(),

microsoft_agents_hosting_core-1.5.0.dev8/microsoft_agents/hosting/core/app/adaptive_card/__init__.py

@@ -0,0 +1,6 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from .adaptive_card import AdaptiveCard
+
+__all__ = ["AdaptiveCard"]

microsoft_agents_hosting_core-1.5.0.dev8/microsoft_agents/hosting/core/app/adaptive_card/_type_defs.py

@@ -0,0 +1,46 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from typing import Awaitable, Protocol
+
+from microsoft_agents.activity import (
+    AdaptiveCardInvokeResponse,
+    AdaptiveCardInvokeValue,
+)
+
+from microsoft_agents.hosting.core.turn_context import TurnContext
+from microsoft_agents.hosting.core.app.state import TurnState
+
+from .models import (
+    AdaptiveCardSearchParams,
+    AdaptiveCardSearchResult,
+    Query,
+)
+
+
+class ActionExecuteHandler(Protocol):
+    def __call__(
+        self, context: TurnContext, state: TurnState, data: object, /
+    ) -> Awaitable[AdaptiveCardInvokeResponse]: ...
+
+
+class ActionExecuteValueHandler(Protocol):
+    def __call__(
+        self, context: TurnContext, state: TurnState, value: AdaptiveCardInvokeValue, /
+    ) -> Awaitable[AdaptiveCardInvokeResponse]: ...
+
+
+class ActionSubmitHandler(Protocol):
+    def __call__(
+        self, context: TurnContext, state: TurnState, data: object, /
+    ) -> Awaitable[None]: ...
+
+
+class SearchHandler(Protocol):
+    def __call__(
+        self,
+        context: TurnContext,
+        state: TurnState,
+        query: Query[AdaptiveCardSearchParams],
+        /,
+    ) -> Awaitable[list[AdaptiveCardSearchResult]]: ...

microsoft_agents_hosting_core-1.5.0.dev8/microsoft_agents/hosting/core/app/adaptive_card/adaptive_card.py

@@ -0,0 +1,275 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from __future__ import annotations
+
+from dataclasses import asdict
+from http import HTTPStatus
+from typing import TYPE_CHECKING, Callable, Pattern
+
+import pydantic
+
+from microsoft_agents.activity import (
+    Activity,
+    ActivityTypes,
+    AdaptiveCardInvokeResponse,
+    AdaptiveCardInvokeValue,
+    AdaptiveCardSearchInvokeValue,
+    Channels,
+    ChannelId,
+    InvokeResponse,
+)
+from microsoft_agents.hosting.core.turn_context import TurnContext
+
+from ..state import TurnState
+from . import factory
+from ._type_defs import (
+    ActionExecuteHandler,
+    ActionSubmitHandler,
+    SearchHandler,
+)
+from .models import AdaptiveCardSearchParams, Query
+
+if TYPE_CHECKING:
+    from ..agent_application import AgentApplication
+
+_ACTION_EXECUTE_TYPE = "Action.Execute"
+_ACTION_INVOKE_NAME = "adaptiveCard/action"
+_SEARCH_INVOKE_NAME = "application/search"
+
+
+class AdaptiveCard:
+    """Register handlers for Adaptive Card activities."""
+
+    def __init__(self, app: AgentApplication):
+        """Initialize an Adaptive Card route registrar for an application."""
+        self._app = app
+
+    def action_execute(
+        self,
+        verb: str | Pattern[str],
+        *,
+        auth_handlers: list[str] | None = None,
+        **kwargs,
+    ) -> Callable[[ActionExecuteHandler], ActionExecuteHandler]:
+        """Register an ``Action.Execute`` handler that receives the action data."""
+
+        def selector(context: TurnContext) -> bool:
+            activity = context.activity
+            if (
+                activity.type != ActivityTypes.invoke
+                or activity.name != _ACTION_INVOKE_NAME
+            ):
+                return False
+
+            try:
+                invoke_value = AdaptiveCardInvokeValue.model_validate(activity.value)
+            except pydantic.ValidationError:
+                return False
+
+            verb_value = (
+                invoke_value.action.verb if invoke_value.action is not None else None
+            )
+            return self._matches(verb, verb_value)
+
+        def register(func: Callable) -> Callable:
+            async def handler(context: TurnContext, state: TurnState) -> None:
+                invoke_value, response = self._validate_action_execute_value(context)
+
+                if invoke_value is not None:
+                    response = await func(context, state, invoke_value.action.data)
+
+                response = response or AdaptiveCardInvokeResponse(
+                    status_code=HTTPStatus.OK
+                )
+
+                await self._send_invoke_response(
+                    context, response, status_code=HTTPStatus.OK
+                )
+
+            kwargs.pop("is_invoke", None)
+            self._app.add_route(
+                selector,
+                handler,
+                is_invoke=True,
+                auth_handlers=auth_handlers,
+                **kwargs,
+            )
+            return func
+
+        return register
+
+    def action_submit(
+        self,
+        verb: str | Pattern[str],
+        *,
+        auth_handlers: list[str] | None = None,
+        submit_filter: str = "verb",
+        **kwargs,
+    ) -> Callable[[ActionSubmitHandler], ActionSubmitHandler]:
+        """Register an Adaptive Card ``Action.Submit`` handler."""
+
+        def selector(context: TurnContext) -> bool:
+            activity = context.activity
+            if (
+                activity.type != ActivityTypes.message
+                or activity.text
+                or activity.value is None
+            ):
+                return False
+
+            verb_value = None
+            if isinstance(activity.value, dict):
+                verb_value = activity.value.get(submit_filter)
+            return self._matches(verb, verb_value)
+
+        def register(func: ActionSubmitHandler) -> ActionSubmitHandler:
+            async def handler(context: TurnContext, state: TurnState) -> None:
+                await func(context, state, context.activity.value)
+
+            self._app.add_route(
+                selector,
+                handler,
+                is_invoke=False,
+                auth_handlers=auth_handlers,
+                **kwargs,
+            )
+            return func
+
+        return register
+
+    def search(
+        self,
+        dataset: str | Pattern[str],
+        *,
+        auth_handlers: list[str] | None = None,
+        **kwargs,
+    ) -> Callable[[SearchHandler], SearchHandler]:
+        """Register an Adaptive Card dynamic-search handler."""
+
+        def selector(context: TurnContext) -> bool:
+            activity = context.activity
+            if (
+                activity.type != ActivityTypes.invoke
+                or activity.name != _SEARCH_INVOKE_NAME
+            ):
+                return False
+
+            try:
+                invoke_value = AdaptiveCardSearchInvokeValue.model_validate(
+                    activity.value
+                )
+            except pydantic.ValidationError:
+                return False
+
+            return self._matches(dataset, invoke_value.dataset)
+
+        def register(func: SearchHandler) -> SearchHandler:
+            async def handler(context: TurnContext, state: TurnState) -> None:
+                value, response = self._validate_search_value(context)
+                if value is not None:
+                    options = value.query_options
+                    query = Query(
+                        count=options.top,
+                        skip=options.skip,
+                        parameters=AdaptiveCardSearchParams(
+                            query_text=value.query_text,
+                            dataset=value.dataset or "",
+                        ),
+                    )
+                    results = await func(context, state, query)
+                    response = factory.search_response(
+                        {"results": [asdict(result) for result in results]}
+                    )
+
+                await self._send_invoke_response(
+                    context, response, response.status_code or HTTPStatus.OK
+                )
+
+            kwargs.pop("is_invoke", None)
+            self._app.add_route(
+                selector,
+                handler,
+                is_invoke=True,
+                auth_handlers=auth_handlers,
+                **kwargs,
+            )
+            return func
+
+        return register
+
+    def _validate_action_execute_value(
+        self, context: TurnContext
+    ) -> tuple[AdaptiveCardInvokeValue | None, AdaptiveCardInvokeResponse]:
+        if context.activity.value is None:
+            return None, factory.bad_request("Missing value property for Invoke Action")
+
+        try:
+            value = AdaptiveCardInvokeValue.model_validate(context.activity.value)
+        except pydantic.ValidationError:
+            return None, factory.bad_request(
+                "Value property is not a properly formed Invoke Action"
+            )
+
+        if value.action is None:
+            return None, factory.bad_request("Missing action property")
+        if value.action.type != _ACTION_EXECUTE_TYPE:
+            return None, factory.not_supported(
+                f"The Invoke Action '{value.action.type}' was not expected."
+            )
+
+        return value, AdaptiveCardInvokeResponse()
+
+    def _validate_search_value(
+        self, context: TurnContext
+    ) -> tuple[AdaptiveCardSearchInvokeValue | None, AdaptiveCardInvokeResponse]:
+        value = context.activity.value
+        if value is None:
+            return None, factory.bad_request("Missing value property for search")
+
+        try:
+            search_invoke_value = AdaptiveCardSearchInvokeValue.model_validate(value)
+        except pydantic.ValidationError:
+            return None, factory.bad_request(
+                "Value property is not a properly formed search invoke value"
+            )
+
+        missing = []
+        if not search_invoke_value.kind:
+            if ChannelId.get_channel(context.activity.channel_id) == Channels.ms_teams:
+                search_invoke_value.kind = "search"
+            else:
+                missing.append("kind")
+
+        if not search_invoke_value.query_text:
+            missing.append("queryText")
+
+        if missing:
+            return None, factory.bad_request(
+                f"Missing '{', '.join(missing)}' property for search"
+            )
+        return search_invoke_value, AdaptiveCardInvokeResponse()
+
+    @staticmethod
+    def _matches(selector: str | Pattern[str], value: object) -> bool:
+        if not isinstance(value, str):
+            return False
+        if isinstance(selector, str):
+            return selector == value
+        return selector.search(value) is not None
+
+    @staticmethod
+    async def _send_invoke_response(
+        context: TurnContext,
+        body: AdaptiveCardInvokeResponse,
+        status_code: int | HTTPStatus = HTTPStatus.OK,
+    ) -> None:
+        await context.send_activity(
+            Activity(
+                type=ActivityTypes.invoke_response,
+                value=InvokeResponse(
+                    status=int(status_code),
+                    body=body.model_dump(mode="json", by_alias=True, exclude_none=True),
+                ),
+            )
+        )

microsoft_agents_hosting_core-1.5.0.dev8/microsoft_agents/hosting/core/app/adaptive_card/factory.py

@@ -0,0 +1,99 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from http import HTTPStatus
+
+from microsoft_agents.activity import (
+    AdaptiveCardInvokeResponse,
+    ContentTypes,
+    OAuthCard,
+)
+
+
+def adaptive_card(adaptive_card_json: str) -> AdaptiveCardInvokeResponse:
+    return AdaptiveCardInvokeResponse(
+        status_code=HTTPStatus.OK,
+        type=ContentTypes.adaptive_card,
+        value=adaptive_card_json,
+    )
+
+
+def search_response(result: dict | str) -> AdaptiveCardInvokeResponse:
+    return AdaptiveCardInvokeResponse(
+        status_code=HTTPStatus.OK,
+        type=ContentTypes.search_response,
+        value=result,
+    )
+
+
+def message(msg: str) -> AdaptiveCardInvokeResponse:
+    return AdaptiveCardInvokeResponse(
+        status_code=HTTPStatus.OK,
+        type=ContentTypes.message,
+        value=msg,
+    )
+
+
+def login(card: OAuthCard) -> AdaptiveCardInvokeResponse:
+    return AdaptiveCardInvokeResponse(
+        status_code=HTTPStatus.UNAUTHORIZED,
+        type=ContentTypes.login_request,
+        value=card,
+    )
+
+
+def incorrect_auth_code() -> AdaptiveCardInvokeResponse:
+    return AdaptiveCardInvokeResponse(
+        status_code=HTTPStatus.UNAUTHORIZED,
+        type=ContentTypes.incorrect_auth_code,
+    )
+
+
+def precondition_failed(
+    message: str, code: str | None = None
+) -> AdaptiveCardInvokeResponse:
+    return AdaptiveCardInvokeResponse(
+        status_code=HTTPStatus.PRECONDITION_FAILED,
+        type=ContentTypes.precondition_failed,
+        value={
+            "message": message,
+            "code": code or str(HTTPStatus.PRECONDITION_FAILED),
+        },
+    )
+
+
+def error(
+    status_code: int, message: str, code: str | None = None
+) -> AdaptiveCardInvokeResponse:
+    return AdaptiveCardInvokeResponse(
+        status_code=status_code,
+        type=ContentTypes.error,
+        value={
+            "code": code or str(status_code),
+            "message": message,
+        },
+    )
+
+
+def bad_request(message: str) -> AdaptiveCardInvokeResponse:
+    return error(
+        HTTPStatus.BAD_REQUEST,
+        message,
+        "BadRequest",
+    )
+
+
+def not_supported(message: str) -> AdaptiveCardInvokeResponse:
+    return error(
+        HTTPStatus.NOT_IMPLEMENTED,
+        message,
+        "NotSupported",
+    )
+
+
+def internal_error(message: str) -> AdaptiveCardInvokeResponse:
+    return error(
+        HTTPStatus.INTERNAL_SERVER_ERROR,
+        message,
+        "InternalError",
+    )

microsoft_agents_hosting_core-1.5.0.dev8/microsoft_agents/hosting/core/app/adaptive_card/models.py

@@ -0,0 +1,29 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from dataclasses import dataclass
+from typing import Generic, TypeVar
+
+ParamsT = TypeVar("ParamsT")
+
+
+@dataclass
+class AdaptiveCardSearchParams:
+
+    query_text: str
+    dataset: str
+
+
+@dataclass
+class AdaptiveCardSearchResult:
+
+    title: str
+    value: str
+
+
+@dataclass
+class Query(Generic[ParamsT]):
+
+    count: int
+    skip: int
+    parameters: ParamsT