eve/dist/src/public/channels/teams/verify.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{createLogger}from"#internal/logging.js";import{isObject}from"#shared/guards.js";import{importJWK,jwtVerify}from"#compiled/jose/index.js";import{resolveTeamsAppId}from"#public/channels/teams/api.js";const log=createLogger(`teams.verify`);async function verifyTeamsRequest(e,t){let n=await e.text();if(t.webhookVerifier!==void 0){let r=await t.webhookVerifier(e,n);if(!r)throw Error(`teamsChannel: inbound webhook verifier rejected the request.`);return typeof r==`string`?r:n}let r=readBearerToken(e.headers.get(`authorization`)??``);if(!r)throw Error(`teamsChannel: inbound request missing bearer token.`);return await verifyTeamsJwt(r,t),n}async function verifyTeamsJwt(e,t){let n=await resolveTeamsAppId(t.appId),r=await loadJwks(t);return(await jwtVerify(e,async e=>{let t=selectJwk(r,e),n=typeof e.alg==`string`?e.alg:void 0;return importJWK(t,n)},{audience:n,clockTolerance:t.maxSkewSeconds??300,issuer:`https://api.botframework.com`})).payload}function readBearerToken(e){let[t,n]=e.split(/\s+/,2);return t?.toLowerCase()!==`bearer`||!n?null:n}async function loadJwks(e){let t=e.fetch??fetch,n=await t(e.jwksUrl??await loadJwksUrl(e,t),{headers:{accept:`application/json`}});if(!n.ok)throw Error(`Teams JWKS route returned HTTP ${n.status}.`);let r=await n.json();if(!isObject(r)||!Array.isArray(r.keys))throw Error(`Teams JWKS response is malformed.`);return r.keys.filter(isObject)}async function loadJwksUrl(e,t){let n=await t(e.openIdMetadataUrl??`https://login.botframework.com/v1/.well-known/openidconfiguration`,{headers:{accept:`application/json`}});if(!n.ok)throw Error(`Teams OpenID metadata route returned HTTP ${n.status}.`);let r=await n.json();if(!isObject(r)||typeof r.jwks_uri!=`string`)throw Error(`Teams OpenID metadata response is missing jwks_uri.`);return r.jwks_uri}function selectJwk(e,t){let n=typeof t.kid==`string`?t.kid:void 0,r=typeof t.x5t==`string`?t.x5t:void 0,i=e.find(e=>n!==void 0&&e.kid===n||r!==void 0&&e.x5t===r)??(e.length===1?e[0]:void 0);if(i===void 0)throw log.debug(`Teams JWT key not found`,{kid:n,x5t:r}),Error(`teamsChannel: inbound JWT key was not found in JWKS.`);return i}export{verifyTeamsJwt,verifyTeamsRequest};