Merge branch 'master' into feat/escalation-expiration

Author: deanhannigan

packages/server/src/api/controllers/webhook/ms-teams.ts

@@ -445,6 +445,7 @@ const createTeamsMessageHandler = ({
 export async function MSTeamsWebhook(
   ctx: Ctx<unknown, unknown, { instance: string; agentId: string }>
 ) {
+  let serviceUrl: string | undefined
   await runChatWebhook({
     ctx,
     providerName: "Teams",
@@ -457,7 +458,7 @@ export async function MSTeamsWebhook(
       ) {
         throw new HTTPError("Missing Microsoft Teams service URL", 400)
       }
-      validateMSTeamsServiceUrl(body.serviceUrl)
+      serviceUrl = validateMSTeamsServiceUrl(body.serviceUrl)
     },
     createWebhookHandler: async ({ workspaceId, agentId }) => {
       const {
@@ -488,6 +489,8 @@ export async function MSTeamsWebhook(
             appPassword: integration.appPassword,
             appTenantId: integration.tenantId,
             appType: "SingleTenant",
+            // Card posts use the adapter URL; DM streams use the activity URL.
+            apiUrl: serviceUrl,
           }),
         },
         state: await getTeamsState(),

packages/server/src/api/controllers/webhook/runChatWebhook.ts

@@ -31,12 +31,11 @@ export const runChatWebhook = async ({
     return
   }
 
-  let handleWebhook: (request: Request) => Promise<Response>
+  const rawBody = await readRawBody(ctx.req)
   try {
-    handleWebhook = await createWebhookHandler({
-      workspaceId: prodWorkspaceId,
-      agentId: ctx.params.agentId,
-    })
+    if (ctx.get("authorization")) {
+      validateBody?.(tryParseJson(rawBody))
+    }
   } catch (error) {
     if (error instanceof HTTPError) {
       ctx.status = error.status
@@ -46,11 +45,12 @@ export const runChatWebhook = async ({
     throw error
   }
 
-  const rawBody = await readRawBody(ctx.req)
+  let handleWebhook: (request: Request) => Promise<Response>
   try {
-    if (ctx.get("authorization")) {
-      validateBody?.(tryParseJson(rawBody))
-    }
+    handleWebhook = await createWebhookHandler({
+      workspaceId: prodWorkspaceId,
+      agentId: ctx.params.agentId,
+    })
   } catch (error) {
     if (error instanceof HTTPError) {
       ctx.status = error.status

packages/server/src/api/routes/tests/ai/agentTeams.spec.ts

@@ -68,6 +68,7 @@ import os from "os"
 import path from "path"
 
 import extract from "extract-zip"
+import { createTeamsAdapter } from "@chat-adapter/teams"
 import { context, docIds } from "@budibase/backend-core"
 import { generator } from "@budibase/backend-core/tests"
 import { ChatCommands } from "@budibase/shared-core"
@@ -87,6 +88,7 @@ import { webhookChat } from "../../../controllers/ai/chatConversations"
 const { getMockChatOptions, resetMockChatState, setMockPostEphemeralResult } =
   jest.requireActual("chat") as ChatMockModule
 const mockedWebhookChat = webhookChat as jest.MockedFunction<typeof webhookChat>
+const mockedCreateTeamsAdapter = jest.mocked(createTeamsAdapter)
 const mockedGetFileUrlForAgent = jest.mocked(sdk.ai.rag.getFileUrlForAgent)
 const TEAMS_APP_ID = generator.guid()
 
@@ -110,6 +112,7 @@ describe("agent teams integration provisioning", () => {
       "test-config"
     )
     mockedWebhookChat.mockClear()
+    mockedCreateTeamsAdapter.mockClear()
     mockedGetFileUrlForAgent.mockReset()
     resetMockChatState()
   })
@@ -524,6 +527,7 @@ describe("agent teams integration provisioning", () => {
 
       expect(response.body.error).toEqual("Invalid Microsoft Teams service URL")
       expect(mockedWebhookChat).not.toHaveBeenCalled()
+      expect(mockedCreateTeamsAdapter).not.toHaveBeenCalled()
     })
 
     it(`returns a private link prompt for ${ChatCommands.LINK} and /${ChatCommands.LINK} commands`, async () => {
@@ -800,56 +804,86 @@ describe("agent teams integration provisioning", () => {
       expect(mockedWebhookChat).toHaveBeenCalledTimes(1)
     })
 
-    it("appends downloadable RAG source links to Teams personal replies", async () => {
-      mockedGetFileUrlForAgent.mockResolvedValue(
-        "/files/signed/prod-budi-app-assets/source.pdf"
-      )
-      mockedWebhookChat.mockResolvedValueOnce({
-        messages: [
-          {
-            id: "assistant-1",
-            role: "assistant",
-            parts: [{ type: "text", text: "Answer with sources" }],
-          },
-        ] as any,
-        assistantText: "Answer with sources",
-        ragSources: [
-          {
-            sourceId: "source-1",
-            fileId: "file-1",
-            filename: "Source [One]\n@Draft.pdf",
-          },
-        ],
-        title: "Mock conversation",
-      })
+    it.each([false, true])(
+      "sends personal reply sources through the activity service URL (streaming: %s)",
+      async streaming => {
+        const serviceUrl = new URL(
+          "/emea/",
+          DEFAULT_MSTEAMS_SERVICE_URL
+        ).toString()
+        mockedGetFileUrlForAgent.mockResolvedValue(
+          "/files/signed/prod-budi-app-assets/source.pdf"
+        )
+        mockedWebhookChat.mockImplementationOnce(
+          async ({ onAssistantStream }) => {
+            if (streaming) {
+              async function* sourceAnswerStream() {
+                yield "Answer with "
+                yield "sources"
+              }
+              await onAssistantStream!(sourceAnswerStream())
+            }
+            return {
+              messages: [
+                {
+                  id: "assistant-1",
+                  role: "assistant",
+                  parts: [{ type: "text", text: "Answer with sources" }],
+                },
+              ],
+              assistantText: "Answer with sources",
+              allowKnowledgeSourceDownload: true,
+              ragSources: [
+                {
+                  sourceId: "source-1",
+                  fileId: "file-1",
+                  filename: "Source [One]\n@Draft.pdf",
+                },
+              ],
+              title: "Mock conversation",
+            }
+          }
+        )
 
-      const { agent, linkExternalUser } = await setupProvisionedTeamsAgent()
-      const path = `/api/webhooks/ms-teams/${config.getProdWorkspaceId()}/${agent._id}`
-      await linkExternalUser("user-1")
+        const { agent, linkExternalUser } = await setupProvisionedTeamsAgent()
+        const path = `/api/webhooks/ms-teams/${config.getProdWorkspaceId()}/${agent._id}`
+        await linkExternalUser("user-1")
 
-      const response = await postTeamsMessage({
-        path,
-        body: {
-          id: "activity-rag-personal",
-          type: "message",
-          text: "hello teams",
-          from: { id: "user-1", name: "Teams User" },
-          conversation: { id: "conversation-1", conversationType: "personal" },
-          channelData: { tenant: { id: "tenant-1" } },
-        },
-      })
+        const response = await postTeamsMessage({
+          path,
+          body: {
+            id: "activity-rag-personal",
+            serviceUrl,
+            type: "message",
+            text: "hello teams",
+            from: { id: "user-1", name: "Teams User" },
+            conversation: {
+              id: "conversation-1",
+              conversationType: "personal",
+            },
+            channelData: { tenant: { id: "tenant-1" } },
+          },
+        })
 
-      expect(response.body.messages).toContain("Answer with sources")
-      const cardMessage = response.body.messages.find((message: string) =>
-        message.includes("Source One Draft.pdf")
-      )
-      expect(cardMessage).toContain('"title":"Sources"')
-      expect(cardMessage).toContain(
-        "http://localhost:10000/files/signed/prod-budi-app-assets/source.pdf"
-      )
-      expect(mockedWebhookChat).toHaveBeenCalledTimes(1)
-      expect(mockedGetFileUrlForAgent).toHaveBeenCalledWith(agent._id, "file-1")
-    })
+        expect(response.body.messages).toHaveLength(2)
+        expect(response.body.messages[0]).toEqual("Answer with sources")
+        expect(mockedCreateTeamsAdapter).toHaveBeenLastCalledWith(
+          expect.objectContaining({ apiUrl: serviceUrl })
+        )
+        const cardMessage = response.body.messages.find((message: string) =>
+          message.includes("Source One Draft.pdf")
+        )
+        expect(cardMessage).toContain('"title":"Sources"')
+        expect(cardMessage).toContain(
+          "http://localhost:10000/files/signed/prod-budi-app-assets/source.pdf"
+        )
+        expect(mockedWebhookChat).toHaveBeenCalledTimes(1)
+        expect(mockedGetFileUrlForAgent).toHaveBeenCalledWith(
+          agent._id,
+          "file-1"
+        )
+      }
+    )
 
     it("does not append RAG source links to Teams channel replies", async () => {
       mockedWebhookChat.mockResolvedValueOnce({

packages/server/src/integrations/mongodb.ts

@@ -386,6 +386,17 @@ export class MongoIntegration implements IntegrationBase {
   }
 
   async connect() {
+    const { tlsCAFile, tlsCertificateKeyFile, tlsCRLFile } = this.client.options
+    if (
+      !environment.SELF_HOSTED &&
+      (tlsCAFile !== undefined ||
+        tlsCertificateKeyFile !== undefined ||
+        tlsCRLFile !== undefined)
+    ) {
+      throw new Error(
+        "MongoDB TLS file options are only supported on self-hosted installations"
+      )
+    }
     return this.client.connect()
   }
 

packages/server/src/integrations/tests/mongodb.spec.ts

@@ -1,9 +1,15 @@
-import { buildMongoClientOptions, MongoDBConfig } from "../mongodb"
+import { promises as fs } from "fs"
+import { MongoClient } from "mongodb"
+import {
+  buildMongoClientOptions,
+  MongoIntegration,
+  type MongoDBConfig,
+} from "../mongodb"
 import { withEnv } from "../../environment"
 
 describe("MongoDB Integration", () => {
   const baseConfig: MongoDBConfig = {
-    connectionString: "mongodb://localhost:27017",
+    connectionString: "mongodb://example.com:27017",
     db: "test",
     tlsCertificateKeyFile: "/etc/passwd",
     tlsCAFile: "/etc/shadow",
@@ -25,4 +31,115 @@ describe("MongoDB Integration", () => {
       })
     })
   })
+
+  describe("connection string TLS file options", () => {
+    const fileOptions = ["tlsCAFile", "tlsCertificateKeyFile", "tlsCRLFile"]
+    const policyError =
+      "MongoDB TLS file options are only supported on self-hosted installations"
+
+    it.each([
+      { name: "mongodb with TLS", scheme: "mongodb", tls: "tls=true&" },
+      { name: "mongodb with SSL alias", scheme: "mongodb", tls: "ssl=true&" },
+      { name: "mongodb+srv with TLS", scheme: "mongodb+srv", tls: "tls=true&" },
+      { name: "mongodb+srv with implicit TLS", scheme: "mongodb+srv", tls: "" },
+    ])(
+      "rejects normalized $name URI file options on cloud",
+      async ({ scheme, tls }) => {
+        await withEnv({ SELF_HOSTED: undefined }, async () => {
+          for (const option of fileOptions) {
+            const encoded = [...option]
+              .map(
+                character =>
+                  `%${character.charCodeAt(0).toString(16).padStart(2, "0")}`
+              )
+              .join("")
+            for (const key of [option, option.toUpperCase(), encoded]) {
+              const integration = new MongoIntegration({
+                ...baseConfig,
+                connectionString: `${scheme}://example.com/test?${tls}${key}=/file.pem`,
+              })
+              await expect(integration.connect()).rejects.toThrow(policyError)
+            }
+          }
+        })
+      }
+    )
+
+    it("returns the usual verification failure without reading a file or connecting", async () => {
+      const readFile = jest.spyOn(fs, "readFile")
+      const connect = jest.spyOn(MongoClient.prototype, "connect")
+      try {
+        await withEnv({ SELF_HOSTED: undefined }, async () => {
+          const integration = new MongoIntegration({
+            ...baseConfig,
+            connectionString:
+              "mongodb://example.com/?tls=true&tlsCertificateKeyFile=/file.pem",
+          })
+          await expect(integration.testConnection()).resolves.toEqual({
+            connected: false,
+            error: policyError,
+          })
+        })
+        expect(readFile).not.toHaveBeenCalled()
+        expect(connect).not.toHaveBeenCalled()
+      } finally {
+        readFile.mockRestore()
+        connect.mockRestore()
+      }
+    })
+
+    it("preserves ordinary cloud URI settings", async () => {
+      await withEnv({ SELF_HOSTED: undefined }, async () => {
+        const integration = new MongoIntegration({
+          ...baseConfig,
+          connectionString:
+            "mongodb://example.com/test?tls=true&replicaSet=rs0&appName=tlsCAFile%3D%2Ffile.pem&readPreference=secondary",
+        })
+
+        expect(integration["client"].options).toMatchObject({
+          tls: true,
+          dbName: "test",
+          replicaSet: "rs0",
+          appName: "tlsCAFile=/file.pem",
+          readPreference: { mode: "secondary" },
+        })
+        expect(integration["client"].options.tlsCAFile).toBeUndefined()
+        expect(
+          integration["client"].options.tlsCertificateKeyFile
+        ).toBeUndefined()
+        expect(integration["client"].options.tlsCRLFile).toBeUndefined()
+
+        const connect = jest
+          .spyOn(integration["client"], "connect")
+          .mockResolvedValue(integration["client"])
+        await integration.connect()
+        expect(connect).toHaveBeenCalledTimes(1)
+      })
+    })
+
+    it("preserves self-hosted URI TLS file options", async () => {
+      await withEnv({ SELF_HOSTED: "true" }, async () => {
+        const integration = new MongoIntegration({
+          ...baseConfig,
+          tlsCAFile: "",
+          tlsCertificateKeyFile: "",
+          connectionString:
+            "mongodb://example.com/?tls=true&TLSCAFILE=/ca.pem&%74lsCertificateKeyFile=/key.pem&TlScRlFiLe=/crl.pem",
+        })
+
+        expect(integration["client"].options).toMatchObject({
+          tls: true,
+          tlsCAFile: "/ca.pem",
+          tlsCertificateKeyFile: "/key.pem",
+          tlsCRLFile: "/crl.pem",
+        })
+
+        const connect = jest
+          .spyOn(integration["client"], "connect")
+          .mockResolvedValue(integration["client"])
+        await integration.connect()
+        expect(connect).toHaveBeenCalledTimes(1)
+      })
+    })
+  })
 })

yarn.lock

@@ -21868,9 +21868,9 @@ undici@^7.19.0, undici@^7.28.0:
   integrity sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==
 
 undici@^8.5.0, undici@^8.9.0:
-  version "8.10.0"
-  resolved "https://registry.yarnpkg.com/undici/-/undici-8.10.0.tgz#67ed7c4087f0f40fba7bef3a46f2be80572f2473"
-  integrity sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==
+  version "8.10.2"
+  resolved "https://registry.yarnpkg.com/undici/-/undici-8.10.2.tgz#960bcb0b43c267f86910ea7ca408ada843a44bc7"
+  integrity sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ==
 
 unicode-canonical-property-names-ecmascript@^2.0.0:
   version "2.0.1"