This is a comment left during a code review.
Path: extensions/msteams/src/thread-approval.ts
Line: 502-526

Comment:
**Authorization check runs after expiry handling**

The `approvalExpired` branch (lines 502–522) runs before the approver-ID guard (line 523), so any sender who clicks an expired card triggers `claimActionApprovalFlow` with their `ctx.senderId` recorded as `actorId` — embedding an unauthorized user's ID in the expiry audit record. Moving the approver check before the expiry block prevents this.

```suggestion
      if (!ctx.senderId || !loaded.snapshot.approverIds.includes(ctx.senderId)) {
        await ctx.respond.reply({ text: "You are not allowed to approve this action." });
        return { handled: true };
      }
      const now = Date.now();
      const approvalExpired =
        loaded.state.status === "expired" ||
        (loaded.state.expiresAt !== undefined && now >= loaded.state.expiresAt);
      if (approvalExpired) {
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: extensions/msteams/src/thread-approval.ts
Line: 571

Comment:
**`as never` type escape**

`as never` is being used as a shortcut to satisfy the `JsonValue` parameter, but `never` is assignable to every type, making it a silent type bypass that hides future mismatches. Prefer an explicit widening cast or annotate `executeThreadAction`'s return type as `{ ok: true; result: JsonValue }` upstream so no cast is needed here.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: extensions/msteams/src/thread-approval.ts
Line: 107-112

Comment:
**Unused `toolContext` parameter**

`normalizeApproverIds` accepts `toolContext` in its params object but never uses it — only `rawParams` is forwarded to `readMSTeamsApproverIds`. If context-based approver resolution is not planned, the parameter can be removed to avoid misleading callers.

```suggestion
function normalizeApproverIds(params: {
  rawParams: Record<string, unknown>;
}): string[] {
  return readMSTeamsApproverIds(params.rawParams);
}
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: extensions/msteams/src/thread-approval.ts
Line: 279-283

Comment:
**`normalizeMediaLocalRoots` called twice**

`normalizeMediaLocalRoots(params.toolContext)` is invoked twice — once to check truthiness and again to read the value. Extracting it to a variable avoids the redundant call:

```suggestion
    const mediaLocalRoots = normalizeMediaLocalRoots(params.toolContext);
    return {
      ...base,
      operation,
      text,
      mediaUrl,
      ...(readTrimmedString(params.rawParams.filename)
        ? { filename: readTrimmedString(params.rawParams.filename) }
        : {}),
      ...(mediaLocalRoots ? { mediaLocalRoots } : {}),
    };
```

How can I resolve this? If you propose a fix, please make it concise.