openclaw/extensions/msteams/src/probe.ts

// Msteams plugin module implements probe behavior.
import { isFutureDateTimestampMs } from "openclaw/plugin-sdk/number-runtime";
import {
  normalizeStringEntries,
  type BaseProbeResult,
  type MSTeamsConfig,
} from "../runtime-api.js";
import { resolveMSTeamsSdkCloudOptions } from "./cloud.js";
import { formatUnknownError } from "./errors.js";
import { withMSTeamsRequestDeadline } from "./request-timeout.js";
import { createMSTeamsTokenProvider, loadMSTeamsSdkWithAuth } from "./sdk.js";
import { readAccessToken } from "./token-response.js";
import { loadDelegatedTokens, resolveMSTeamsCredentials } from "./token.js";

export type ProbeMSTeamsResult = BaseProbeResult<string> & {
  appId?: string;
  graph?: {
    ok: boolean;
    error?: string;
    roles?: string[];
    scopes?: string[];
  };
  delegatedAuth?: {
    ok: boolean;
    error?: string;
    scopes?: string[];
    userPrincipalName?: string;
  };
};

function decodeJwtPayload(token: string): Record<string, unknown> | null {
  const parts = token.split(".");
  if (parts.length < 2) {
    return null;
  }
  const payload = parts[1] ?? "";
  const padded = payload.padEnd(payload.length + ((4 - (payload.length % 4)) % 4), "=");
  const normalized = padded.replace(/-/g, "+").replace(/_/g, "/");
  try {
    const decoded = Buffer.from(normalized, "base64").toString("utf8");
    const parsed = JSON.parse(decoded) as Record<string, unknown>;
    return parsed && typeof parsed === "object" ? parsed : null;
  } catch {
    return null;
  }
}

function readStringArray(value: unknown): string[] | undefined {
  if (!Array.isArray(value)) {
    return undefined;
  }
  const out = normalizeStringEntries(value);
  return out.length > 0 ? out : undefined;
}

function readScopes(value: unknown): string[] | undefined {
  if (typeof value !== "string") {
    return undefined;
  }
  const out = normalizeStringEntries(value.split(/\s+/));
  return out.length > 0 ? out : undefined;
}

export async function probeMSTeams(cfg?: MSTeamsConfig): Promise<ProbeMSTeamsResult> {
  const creds = resolveMSTeamsCredentials(cfg);
  if (!creds) {
    return {
      ok: false,
      error: "missing credentials (appId, appPassword, tenantId)",
    };
  }

  try {
    const { app } = await loadMSTeamsSdkWithAuth(creds, resolveMSTeamsSdkCloudOptions(cfg));
    const tokenProvider = createMSTeamsTokenProvider(app);
    // Token-manager calls can outlive the SDK HTTP timeout, so keep both probe
    // phases bounded by the shared Teams request deadline.
    const botTokenValue = await withMSTeamsRequestDeadline({
      label: "MS Teams Bot Framework probe token",
      work: () => tokenProvider.getAccessToken("https://api.botframework.com"),
    });
    if (!botTokenValue) {
      throw new Error("Failed to acquire bot token");
    }

    let graph:
      | {
          ok: boolean;
          error?: string;
          roles?: string[];
          scopes?: string[];
        }
      | undefined;
    try {
      const graphTokenValue = await withMSTeamsRequestDeadline({
        label: "MS Teams Graph probe token",
        work: () => tokenProvider.getAccessToken("https://graph.microsoft.com"),
      });
      const accessToken = readAccessToken(graphTokenValue);
      const payload = accessToken ? decodeJwtPayload(accessToken) : null;
      graph = {
        ok: true,
        roles: readStringArray(payload?.roles),
        scopes: readScopes(payload?.scp),
      };
    } catch (err) {
      graph = { ok: false, error: formatUnknownError(err) };
    }
    let delegatedAuth: ProbeMSTeamsResult["delegatedAuth"];
    if (cfg?.delegatedAuth?.enabled) {
      try {
        const tokens = loadDelegatedTokens();
        if (tokens) {
          const isExpired = !isFutureDateTimestampMs(tokens.expiresAt);
          delegatedAuth = {
            ok: !isExpired,
            scopes: tokens.scopes,
            userPrincipalName: tokens.userPrincipalName,
            ...(isExpired ? { error: "token expired (will auto-refresh on next use)" } : {}),
          };
        } else {
          delegatedAuth = { ok: false, error: "no delegated tokens found (run setup wizard)" };
        }
      } catch {
        delegatedAuth = { ok: false, error: "failed to load delegated tokens" };
      }
    }
    return {
      ok: true,
      appId: creds.appId,
      ...(graph ? { graph } : {}),
      ...(delegatedAuth ? { delegatedAuth } : {}),
    };
  } catch (err) {
    return {
      ok: false,
      appId: creds.appId,
      error: formatUnknownError(err),
    };
  }
}