fix(msteams): accept Bot Framework audience in JWT validation (#58249) by sudie-codes · Pull Request #62674 · openclaw/openclaw

sudie-codes · 2026-04-07T19:03:36Z

Summary

Replaces @microsoft/teams.apps JwtValidator with direct jsonwebtoken + jwks-rsa for webhook JWT validation
Adds https://api.botframework.com to the accepted audience list, matching the legacy @microsoft/agents-hosting behavior
The Teams SDK's JwtValidator hardcodes audience to [clientId, api://clientId] with no way to extend it, causing valid Bot Framework tokens to be rejected

What changed

sdk.ts: createBotFrameworkJwtValidator now uses jsonwebtoken.verify() directly with audience [appId, api://appId, https://api.botframework.com] and issuer-specific JWKS endpoints (Bot Framework, Entra, STS Windows)
sdk.test.ts: 8 new tests covering audience validation, issuer allowlist, signature failures, missing kid/issuer edge cases
package.json: Added jsonwebtoken, jwks-rsa, @types/jsonwebtoken as explicit extension deps

Fixes #58249

Test plan

JWT validator tests pass (8/8) — audience, issuer, signature, edge cases
Manual verification with a live Teams bot receiving webhook messages
Verify tokens with aud: "https://api.botframework.com" are now accepted

🤖 Generated with Claude Code

…ct audience (openclaw#58249)

greptile-apps · 2026-04-07T19:07:00Z

Greptile Summary

This PR replaces the @microsoft/teams.apps JwtValidator with a direct jsonwebtoken + jwks-rsa implementation to include https://api.botframework.com in the accepted audience list, fixing the root cause of #58249 where valid Bot Framework service tokens were rejected. The new validator correctly enforces signature verification (issuer-specific JWKS endpoints), audience, issuer allowlist, and expiry; 8 new tests cover the critical paths including the aud: https://api.botframework.com scenario.

Confidence Score: 5/5

Safe to merge — all remaining findings are P2 style suggestions, no correctness or security issues.

The implementation correctly enforces all JWT security invariants: signature via issuer-specific JWKS, audience allowlist, issuer allowlist, and clock-tolerant expiry. Only two minor P2 findings remain: an unused optional parameter in the return type signature, and a missing test for the STS Windows v1 issuer path.

No files require special attention.

Comments Outside Diff (1)

extensions/msteams/src/sdk.test.ts, line 194-272 (link)

STS Windows v1 issuer has no test coverage

BOT_FRAMEWORK_ISSUERS includes a third entry for https://sts.windows.net/d6d49420-f39b-4df7-a1dc-d59a935871db/ but none of the 8 new test cases exercise it. The Bot Framework and Entra v2 issuers are covered — adding a case like jwtState.decodedPayload = { iss: "https://sts.windows.net/d6d49420-f39b-4df7-a1dc-d59a935871db/" } would complete the issuer-allowlist coverage.

Prompt To Fix With AI

This is a comment left during a code review.
Path: extensions/msteams/src/sdk.test.ts
Line: 194-272

Comment:
**STS Windows v1 issuer has no test coverage**

`BOT_FRAMEWORK_ISSUERS` includes a third entry for `https://sts.windows.net/d6d49420-f39b-4df7-a1dc-d59a935871db/` but none of the 8 new test cases exercise it. The Bot Framework and Entra v2 issuers are covered — adding a case like `jwtState.decodedPayload = { iss: "https://sts.windows.net/d6d49420-f39b-4df7-a1dc-d59a935871db/" }` would complete the issuer-allowlist coverage.

How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: extensions/msteams/src/sdk.ts
Line: 512-513

Comment:
**Unused `serviceUrl` parameter in return type**

The declared return type includes `validate: (authHeader: string, serviceUrl?: string) => Promise<boolean>`, but the implementation only accepts `authHeader` — the optional second argument is silently dropped. `monitor.ts` also calls `validate(authHeader)` without a service URL. Either remove the parameter from the return-type signature for a clean contract, or accept it as `_serviceUrl` to make the intentional omission explicit.

```suggestion
    async validate(authHeader: string, _serviceUrl?: string): Promise<boolean> {
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: extensions/msteams/src/sdk.test.ts
Line: 194-272

Comment:
**STS Windows v1 issuer has no test coverage**

`BOT_FRAMEWORK_ISSUERS` includes a third entry for `https://sts.windows.net/d6d49420-f39b-4df7-a1dc-d59a935871db/` but none of the 8 new test cases exercise it. The Bot Framework and Entra v2 issuers are covered — adding a case like `jwtState.decodedPayload = { iss: "https://sts.windows.net/d6d49420-f39b-4df7-a1dc-d59a935871db/" }` would complete the issuer-allowlist coverage.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(msteams): use jsonwebtoken directly ..." | Re-trigger Greptile}

greptile-apps · 2026-04-07T19:07:04Z

  return {
-    async validate(authHeader: string, serviceUrl?: string): Promise<boolean> {
+    async validate(authHeader: string): Promise<boolean> {


Unused serviceUrl parameter in return type

The declared return type includes validate: (authHeader: string, serviceUrl?: string) => Promise<boolean>, but the implementation only accepts authHeader — the optional second argument is silently dropped. monitor.ts also calls validate(authHeader) without a service URL. Either remove the parameter from the return-type signature for a clean contract, or accept it as _serviceUrl to make the intentional omission explicit.

Suggested change

return {

async validate(authHeader: string, serviceUrl?: string): Promise<boolean> {

async validate(authHeader: string): Promise<boolean> {

async validate(authHeader: string, _serviceUrl?: string): Promise<boolean> {

Prompt To Fix With AI

This is a comment left during a code review. Path: extensions/msteams/src/sdk.ts Line: 512-513 Comment: **Unused `serviceUrl` parameter in return type** The declared return type includes `validate: (authHeader: string, serviceUrl?: string) => Promise<boolean>`, but the implementation only accepts `authHeader` — the optional second argument is silently dropped. `monitor.ts` also calls `validate(authHeader)` without a service URL. Either remove the parameter from the return-type signature for a clean contract, or accept it as `_serviceUrl` to make the intentional omission explicit. ```suggestion async validate(authHeader: string, _serviceUrl?: string): Promise<boolean> { ``` How can I resolve this? If you propose a fix, please make it concise.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 831b89d645

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-07T19:08:55Z

+    "jsonwebtoken": "^9.0.3",
+    "jwks-rsa": "^4.0.1"


Update lockfile alongside new msteams dependencies

Adding jsonwebtoken/jwks-rsa (and new dev typings) in extensions/msteams/package.json without updating pnpm-lock.yaml leaves the workspace lock out of sync; on any fresh checkout or CI lane that runs pnpm install --frozen-lockfile, install will fail because the extensions/msteams importer in the lockfile does not include these new specifiers yet.

Useful? React with 👍 / 👎.

#62674) * fix(msteams): use jsonwebtoken directly for JWT validation with correct audience (#58249) * chore(msteams): regenerate lockfile for jwt deps * fix(msteams): clean up unused serviceUrl parameter in JWT validator * test(msteams): cover STS issuer in JWT validation * fix(msteams): type jwt verify audiences and issuers --------- Co-authored-by: Brad Groux <bradgroux@users.noreply.github.com>

…aw#58249) (openclaw#62674) * fix(msteams): use jsonwebtoken directly for JWT validation with correct audience (openclaw#58249) * chore(msteams): regenerate lockfile for jwt deps * fix(msteams): clean up unused serviceUrl parameter in JWT validator * test(msteams): cover STS issuer in JWT validation * fix(msteams): type jwt verify audiences and issuers --------- Co-authored-by: Brad Groux <bradgroux@users.noreply.github.com>

fix(msteams): use jsonwebtoken directly for JWT validation with corre…

831b89d

…ct audience (openclaw#58249)

openclaw-barnacle Bot added channel: msteams Channel integration: msteams size: M labels Apr 7, 2026

greptile-apps Bot reviewed Apr 7, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Apr 7, 2026

View reviewed changes

sudie-codes and others added 4 commits April 9, 2026 10:47

chore(msteams): regenerate lockfile for jwt deps

e317b94

fix(msteams): clean up unused serviceUrl parameter in JWT validator

fb068ab

test(msteams): cover STS issuer in JWT validation

f00d580

fix(msteams): type jwt verify audiences and issuers

65b2976

BradGroux merged commit a59a9bf into openclaw:main Apr 10, 2026
33 of 35 checks passed

BradGroux mentioned this pull request Apr 10, 2026

WORKING: All Microsoft Issues and PRs #49126

Closed

shaojun0 mentioned this pull request Apr 10, 2026

Feature Request: Fully offline mode for local LLM #53028

Closed

sudie-codes mentioned this pull request Apr 11, 2026

fix(msteams): accept SingleTenant sts.windows.net issuer in JWT validator (#64270) #64641

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(msteams): accept Bot Framework audience in JWT validation (#58249)#62674

fix(msteams): accept Bot Framework audience in JWT validation (#58249)#62674
BradGroux merged 5 commits intoopenclaw:mainfrom
sudie-codes:fix/msteams-jwt-audience-58249

sudie-codes commented Apr 7, 2026

Uh oh!

greptile-apps Bot commented Apr 7, 2026 •

edited

Loading

Comments Outside Diff (1)

Uh oh!

greptile-apps Bot Apr 7, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

sudie-codes commented Apr 7, 2026

Summary

What changed

Test plan

Uh oh!

greptile-apps Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Comments Outside Diff (1)

Uh oh!

greptile-apps Bot Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

greptile-apps Bot commented Apr 7, 2026 •

edited

Loading