• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In
You are now the owner of this repo.

microsoft / botbuilder-js / 20724177098

05 Jan 2026 05:50PM UTC coverage: 84.361%. Remained the same
20724177098

Pull #4917

github

web-flow
Merge b95b73580 into dc9464ec7
Pull Request #4917: bump: Latest JS security updates

8282 of 10996 branches covered (75.32%)

Branch coverage included in aggregate %.

169 of 218 new or added lines in 33 files covered. (77.52%)

240 existing lines in 14 files now uncovered.

20589 of 23227 relevant lines covered (88.64%)

3875.97 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

83.33
/libraries/botbuilder-core/src/configurationBotFrameworkAuthentication.ts
1
// Copyright (c) Microsoft Corporation.
2
// Licensed under the MIT License.
3

4
import * as z from 'zod';
1✔
5
import { Activity } from 'botframework-schema';
6
import { Configuration } from 'botbuilder-dialogs-adaptive-runtime-core';
7

8
import {
1✔
9
    AuthenticateRequestResult,
10
    AuthenticationConfiguration,
11
    AuthenticationConstants,
12
    BotFrameworkAuthentication,
13
    BotFrameworkAuthenticationFactory,
14
    BotFrameworkClient,
15
    ClaimsIdentity,
16
    ConnectorClientOptions,
17
    ConnectorFactory,
18
    ServiceClientCredentialsFactory,
19
    UserTokenClient,
20
    AseChannelValidation,
21
} from 'botframework-connector';
22

23
import {
1✔
24
    ConfigurationServiceClientCredentialFactory,
25
    ConfigurationServiceClientCredentialFactoryOptions,
26
} from './configurationServiceClientCredentialFactory';
27

28
const TypedOptions = z
1✔
29
    .object({
30
        /**
31
         * The ID assigned to your bot in the [Bot Framework Portal](https://dev.botframework.com/).
32
         */
33
        MicrosoftAppId: z.string(),
34

35
        /**
36
         * The tenant id assigned to your bot in the [Bot Framework Portal](https://dev.botframework.com/).
37
         */
38
        MicrosoftAppTenantId: z.string(),
39

40
        /**
41
         * (Optional) The OAuth URL used to get a token from OAuthApiClient. The "OAuthUrl" member takes precedence over this value.
42
         */
43
        [AuthenticationConstants.OAuthUrlKey]: z.string(),
44

45
        /**
46
         * (Optional) The OpenID metadata document used for authenticating tokens coming from the channel. The "ToBotFromChannelOpenIdMetadataUrl" member takes precedence over this value.
47
         */
48
        [AuthenticationConstants.BotOpenIdMetadataKey]: z.string().nullable(),
49

50
        /**
51
         * A string used to indicate if which cloud the bot is operating in (e.g. Public Azure or US Government).
52
         *
53
         * @remarks
54
         * A `null` or `''` value indicates Public Azure, whereas [GovernmentConstants.ChannelService](xref:botframework-connector.GovernmentConstants.ChannelService) indicates the bot is operating in the US Government cloud.
55
         *
56
         * Other values result in a custom authentication configuration derived from the values passed in on the [ConfigurationBotFrameworkAuthenticationOptions](xef:botbuilder-core.ConfigurationBotFrameworkAuthenticationOptions) instance.
57
         */
58
        [AuthenticationConstants.ChannelService]: z.string(),
59

60
        /**
61
         * Flag indicating whether or not to validate the address.
62
         */
63
        ValidateAuthority: z.union([z.string(), z.boolean()]),
64

65
        /**
66
         * The Login URL used to specify the tenant from which the bot should obtain access tokens from.
67
         */
68
        ToChannelFromBotLoginUrl: z.string(),
69

70
        /**
71
         * The Oauth scope to request.
72
         *
73
         * @remarks
74
         * This value is used when fetching a token to indicate the ultimate recipient or `audience` of an activity sent using these credentials.
75
         */
76
        ToChannelFromBotOAuthScope: z.string(),
77

78
        /**
79
         * The Token issuer for signed requests to the channel.
80
         */
81
        ToBotFromChannelTokenIssuer: z.string(),
82

83
        /**
84
         * The OAuth URL used to get a token from OAuthApiClient.
85
         */
86
        OAuthUrl: z.string(),
87

88
        /**
89
         * The OpenID metadata document used for authenticating tokens coming from the channel.
90
         */
91
        ToBotFromChannelOpenIdMetadataUrl: z.string(),
92

93
        /**
94
         * The The OpenID metadata document used for authenticating tokens coming from the Emulator.
95
         */
96
        ToBotFromEmulatorOpenIdMetadataUrl: z.string(),
97

98
        /**
99
         * A value for the CallerId.
100
         */
101
        CallerId: z.string(),
102

103
        /**
104
         * Certificate thumbprint to authenticate the appId against AAD.
105
         */
106
        [AuthenticationConstants.CertificateThumbprint]: z.string(),
107

108
        /**
109
         * Certificate key to authenticate the appId against AAD.
110
         */
111
        [AuthenticationConstants.CertificatePrivateKey]: z.string(),
112
    })
113
    .partial();
114

115
type ZodOptions = z.infer<typeof TypedOptions>;
116

117
/**
118
 * Contains settings used to configure a [ConfigurationBotFrameworkAuthentication](xref:botbuilder-core.ConfigurationBotFrameworkAuthentication) instance.
119
 */
120
export interface ConfigurationBotFrameworkAuthenticationOptions extends ZodOptions {
121
    [key: string]: string | boolean | undefined;
122
}
123

124
/**
125
 * Creates a [BotFrameworkAuthentication](xref:botframework-connector.BotFrameworkAuthentication) instance from an object with the authentication values or a [Configuration](xref:botbuilder-dialogs-adaptive-runtime-core.Configuration) instance.
126
 */
127
export class ConfigurationBotFrameworkAuthentication extends BotFrameworkAuthentication {
1✔
128
    private readonly inner: BotFrameworkAuthentication;
129

130
    /**
131
     * Initializes a new instance of the [ConfigurationBotFrameworkAuthentication](xref:botbuilder-core.ConfigurationBotFrameworkAuthentication) class.
132
     *
133
     * @param botFrameworkAuthConfig A [ConfigurationBotFrameworkAuthenticationOptions](xref:botbuilder-core.ConfigurationBotFrameworkAuthenticationOptions) object.
134
     * @param credentialsFactory A [ServiceClientCredentialsFactory](xref:botframework-connector.ServiceClientCredentialsFactory) instance.
135
     * @param authConfiguration A [Configuration](xref:botframework-connector.AuthenticationConfiguration) object.
136
     * @param botFrameworkClientFetch A custom Fetch implementation to be used in the [BotFrameworkClient](xref:botframework-connector.BotFrameworkClient).
137
     * @param connectorClientOptions A [ConnectorClientOptions](xref:botframework-connector.ConnectorClientOptions) object.
138
     */
139
    constructor(
140
        botFrameworkAuthConfig: ConfigurationBotFrameworkAuthenticationOptions = {},
1✔
141
        credentialsFactory?: ServiceClientCredentialsFactory,
142
        authConfiguration?: AuthenticationConfiguration,
143
        botFrameworkClientFetch?: (input: RequestInfo, init?: RequestInit) => Promise<Response>,
144
        connectorClientOptions: ConnectorClientOptions = {},
2✔
145
    ) {
146
        super();
4✔
147

148
        try {
4✔
149
            AseChannelValidation.init(botFrameworkAuthConfig);
4✔
150
            const typedBotFrameworkAuthConfig = TypedOptions.nonstrict().parse(botFrameworkAuthConfig);
4✔
151

152
            const {
153
                CallerId,
154
                ChannelService,
155
                OAuthUrl = typedBotFrameworkAuthConfig[AuthenticationConstants.OAuthUrlKey],
1✔
156
                ToBotFromChannelOpenIdMetadataUrl = typedBotFrameworkAuthConfig[
1✔
157
                    AuthenticationConstants.BotOpenIdMetadataKey
158
                ],
159
                ToBotFromChannelTokenIssuer,
160
                ToBotFromEmulatorOpenIdMetadataUrl,
161
                ToChannelFromBotLoginUrl,
162
                ToChannelFromBotOAuthScope,
163
            } = typedBotFrameworkAuthConfig;
4✔
164

165
            let ValidateAuthority = true;
4✔
166
            try {
4✔
167
                ValidateAuthority = Boolean(JSON.parse(`${typedBotFrameworkAuthConfig.ValidateAuthority ?? true}`));
4✔
168
            } catch (_err) {
169
                // no-op
170
            }
171

172
            this.inner = BotFrameworkAuthenticationFactory.create(
4✔
173
                ChannelService,
174
                ValidateAuthority,
175
                ToChannelFromBotLoginUrl,
176
                ToChannelFromBotOAuthScope,
177
                ToBotFromChannelTokenIssuer,
178
                OAuthUrl,
179
                ToBotFromChannelOpenIdMetadataUrl,
180
                ToBotFromEmulatorOpenIdMetadataUrl,
181
                CallerId,
182
                credentialsFactory ??
12✔
183
                    new ConfigurationServiceClientCredentialFactory(
184
                        typedBotFrameworkAuthConfig as ConfigurationServiceClientCredentialFactoryOptions,
185
                    ),
186
                authConfiguration ?? { requiredEndorsements: [] },
12✔
187
                botFrameworkClientFetch,
188
                connectorClientOptions,
189
            );
190
        } catch (err) {
191
            // Throw a new error with the validation details prominently featured.
UNCOV
192
            if (z.instanceof(z.ZodError).safeParse(err).success) {
×
UNCOV
193
                throw new Error(JSON.stringify(err.errors, null, 2));
×
194
            }
UNCOV
195
            throw err;
×
196
        }
197
    }
198

199
    /**
200
     * Authenticate Bot Framework Protocol requests to Skills.
201
     *
202
     * @param authHeader The http auth header received in the skill request.
203
     * @returns  {Promise<ClaimsIdentity>} A [ClaimsIdentity](xref:botframework-connector.ClaimsIdentity).
204
     */
205
    authenticateChannelRequest(authHeader: string): Promise<ClaimsIdentity> {
UNCOV
206
        return this.inner.authenticateChannelRequest(authHeader);
×
207
    }
208

209
    /**
210
     * Validate Bot Framework Protocol requests.
211
     *
212
     * @param activity The inbound Activity.
213
     * @param authHeader The HTTP auth header.
214
     * @returns {Promise<AuthenticateRequestResult>} An [AuthenticateRequestResult](xref:botframework-connector.AuthenticateRequestResult).
215
     */
216
    authenticateRequest(activity: Activity, authHeader: string): Promise<AuthenticateRequestResult> {
217
        return this.inner.authenticateRequest(activity, authHeader);
1✔
218
    }
219

220
    /**
221
     * Validate Bot Framework Protocol requests.
222
     *
223
     * @param authHeader The HTTP auth header.
224
     * @param channelIdHeader The channel ID HTTP header.
225
     * @returns {Promise<AuthenticateRequestResult>} An [AuthenticateRequestResult](xref:botframework-connector.AuthenticateRequestResult).
226
     */
227
    authenticateStreamingRequest(authHeader: string, channelIdHeader: string): Promise<AuthenticateRequestResult> {
UNCOV
228
        return this.inner.authenticateStreamingRequest(authHeader, channelIdHeader);
×
229
    }
230

231
    /**
232
     * Creates a BotFrameworkClient for calling Skills.
233
     *
234
     * @returns A [BotFrameworkClient](xref:botframework-connector.BotFrameworkClient).
235
     */
236
    createBotFrameworkClient(): BotFrameworkClient {
UNCOV
237
        return this.inner.createBotFrameworkClient();
×
238
    }
239

240
    /**
241
     * Creates a ConnectorFactory that can be used to create ConnectorClients that can use credentials from this particular Cloud Environment.
242
     *
243
     * @param claimsIdentity The inbound Activity's ClaimsIdentity.
244
     * @returns A [ConnectorFactory](xref:botframework-connector.ConnectorFactory).
245
     */
246
    createConnectorFactory(claimsIdentity: ClaimsIdentity): ConnectorFactory {
247
        return this.inner.createConnectorFactory(claimsIdentity);
1✔
248
    }
249

250
    /**
251
     * Creates the appropriate UserTokenClient instance.
252
     *
253
     * @param claimsIdentity The inbound Activity's ClaimsIdentity.
254
     * @returns {Promise<UserTokenClient>} An [UserTokenClient](xref:botframework-connector.UserTokenClient).
255
     */
256
    createUserTokenClient(claimsIdentity: ClaimsIdentity): Promise<UserTokenClient> {
UNCOV
257
        return this.inner.createUserTokenClient(claimsIdentity);
×
258
    }
259
}
260

261
/**
262
 * Creates a new instance of the [ConfigurationBotFrameworkAuthentication](xref:botbuilder-core.ConfigurationBotFrameworkAuthentication) class.
263
 *
264
 * @remarks
265
 * The [Configuration](xref:botbuilder-dialogs-adaptive-runtime-core.Configuration) instance provided to the constructor should
266
 * have the desired authentication values available at the root, using the properties of [ConfigurationBotFrameworkAuthenticationOptions](xref:botbuilder-core.ConfigurationBotFrameworkAuthenticationOptions) as its keys.
267
 * @param configuration A [Configuration](xref:botbuilder-dialogs-adaptive-runtime-core.Configuration) instance.
268
 * @param credentialsFactory A [ServiceClientCredentialsFactory](xref:botframework-connector.ServiceClientCredentialsFactory) instance.
269
 * @param authConfiguration A [Configuration](xref:botframework-connector.AuthenticationConfiguration) object.
270
 * @param botFrameworkClientFetch A custom Fetch implementation to be used in the [BotFrameworkClient](xref:botframework-connector.BotFrameworkClient).
271
 * @param connectorClientOptions A [ConnectorClientOptions](xref:botframework-connector.ConnectorClientOptions) object.
272
 * @returns A [ConfigurationBotFrameworkAuthentication](xref:botbuilder-core.ConfigurationBotFrameworkAuthentication) instance.
273
 */
274
export function createBotFrameworkAuthenticationFromConfiguration(
1✔
275
    configuration: Configuration | null,
276
    credentialsFactory?: ServiceClientCredentialsFactory,
277
    authConfiguration?: AuthenticationConfiguration,
278
    botFrameworkClientFetch?: (input: RequestInfo, init?: RequestInit) => Promise<Response>,
279
    connectorClientOptions: ConnectorClientOptions = {},
2✔
280
): BotFrameworkAuthentication {
281
    const botFrameworkAuthConfig = configuration?.get<ConfigurationBotFrameworkAuthenticationOptions>();
2✔
282

283
    return new ConfigurationBotFrameworkAuthentication(
2✔
284
        botFrameworkAuthConfig,
285
        credentialsFactory,
286
        authConfiguration,
287
        botFrameworkClientFetch,
288
        connectorClientOptions,
289
    );
290
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc