fix(msteams): accept SingleTenant sts.windows.net issuer in JWT validator (#64270)#64641
Conversation
Greptile SummaryThis PR fixes a JWT validation bug (#64270) where Confidence Score: 5/5Safe to merge — minimal, targeted fix using an established pattern with correct tests and no security regressions. The production change is a one-line replacement following an existing pattern already used in the same array. resolveIssuerEntry and allowedIssuers both already handle the function form correctly, so no call-site changes are needed. The two new tests cover both the happy path and the cross-tenant rejection path. No unrelated changes are introduced. No files require special attention. Reviews (1): Last reviewed commit: "fix(msteams): accept SingleTenant sts.wi..." | Re-trigger Greptile |
3e8dc3f to
ed07129
Compare
f37fa12 to
7e381df
Compare
Summary
Fixes SingleTenant bot JWT validation failures. SingleTenant has been Microsoft's default bot type since 2025-07-31, so every new Teams bot deployment was hitting
401 Unauthorizedon incoming webhooks.Root cause
The
sts.windows.netv1 issuer entry inBOT_FRAMEWORK_ISSUERSwas hardcoded to one specific tenant UUID (d6d49420-f39b-4df7-a1dc-d59a935871db). SingleTenant tokens carry issuerhttps://sts.windows.net/{tenantId}/scoped to the bot's own tenant, so every other deployment failed issuer validation.The second half of the bug report, missing
https://api.botframework.comfrom the audience list, was already fixed in #62674. The currentcreateBotFrameworkJwtValidatorbuildsallowedAudiences = [appId, api://appId, https://api.botframework.com], so no further audience changes are needed. Verified againstextensions/msteams/src/sdk.ts.Fix
sts.windows.netentry from a hardcoded string to(tenantId) => \https://sts.windows.net/${tenantId}/\``, matching the shape of the existinglogin.microsoftonline.com/.../v2.0v2 entry.createBotFrameworkJwtValidatoralready resolves function-form issuers againstcreds.tenantId, so no caller changes are needed.creds.tenantIdso it exercises the tenant-aware path.Note on related PR
#64276 (by @mschaepers, the issue reporter) proposes the same
sts.windows.netfix. This PR builds on their approach with identical production semantics, plus an extra regression test for the cross-tenant case and a code comment that documents why the function form exists. If #64276 lands first, this PR becomes a small test-only follow-up.Test plan
pnpm test extensions/msteams/src/sdk.test.ts(13 passed, including the two new SingleTenant cases)Fixes #64270
Generated with Claude Code