eve/dist/src/public/channels/teams/verify.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{createLogger}from"#internal/logging.js";import{isObject}from"#shared/guards.js";import{importJWK,jwtVerify}from"#compiled/jose/index.js";import{resolveTeamsAppId}from"#public/channels/teams/api.js";const log=createLogger(`teams.verify`);async function verifyTeamsRequest(e,t){let n=await e.text();if(t.webhookVerifier!==void 0){let r=await t.webhookVerifier(e,n);if(!r)throw Error(`teamsChannel: inbound webhook verifier rejected the request.`);return typeof r==`string`?r:n}let r=readBearerToken(e.headers.get(`authorization`)??``);if(!r)throw Error(`teamsChannel: inbound request missing bearer token.`);return await verifyTeamsJwt(r,t),n}async function verifyTeamsJwt(e,t){let a=await resolveTeamsAppId(t.appId),o=await loadJwks(t);return(await jwtVerify(e,async e=>importJWK(selectJwk(o,e),typeof e.alg==`string`?e.alg:void 0),{audience:a,clockTolerance:t.maxSkewSeconds??300,issuer:`https://api.botframework.com`})).payload}function readBearerToken(e){let[t,n]=e.split(/\s+/,2);return t?.toLowerCase()!==`bearer`||!n?null:n}async function loadJwks(e){let n=e.fetch??fetch,r=await n(e.jwksUrl??await loadJwksUrl(e,n),{headers:{accept:`application/json`}});if(!r.ok)throw Error(`Teams JWKS route returned HTTP ${r.status}.`);let i=await r.json();if(!isObject(i)||!Array.isArray(i.keys))throw Error(`Teams JWKS response is malformed.`);return i.keys.filter(isObject)}async function loadJwksUrl(e,n){let r=await n(e.openIdMetadataUrl??`https://login.botframework.com/v1/.well-known/openidconfiguration`,{headers:{accept:`application/json`}});if(!r.ok)throw Error(`Teams OpenID metadata route returned HTTP ${r.status}.`);let i=await r.json();if(!isObject(i)||typeof i.jwks_uri!=`string`)throw Error(`Teams OpenID metadata response is missing jwks_uri.`);return i.jwks_uri}function selectJwk(e,t){let n=typeof t.kid==`string`?t.kid:void 0,r=typeof t.x5t==`string`?t.x5t:void 0,i=e.find(e=>n!==void 0&&e.kid===n||r!==void 0&&e.x5t===r)??(e.length===1?e[0]:void 0);if(i===void 0)throw log.debug(`Teams JWT key not found`,{kid:n,x5t:r}),Error(`teamsChannel: inbound JWT key was not found in JWKS.`);return i}export{verifyTeamsJwt,verifyTeamsRequest};