fix: route app.get_app_graph + ctx.*_graph to sovereign endpoints via cloud.graph_scope#402
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
Routes Microsoft Graph client construction in the Teams Apps framework to the correct sovereign cloud endpoint by deriving the Graph base URL from the configured CloudEnvironment.graph_scope and propagating it through App.get_app_graph() and ActivityContext graph properties.
Changes:
- Add a
base_urloverride path inmicrosoft-teams-graph’sget_graph_client()and validate behavior via new unit tests. - Derive Graph base URL from
cloud.graph_scopeinmicrosoft-teams-appsand pass it into all framework-created Graph clients. - Plumb
cloudthroughActivityProcessor→ActivityContextsoctx.app_graph/ctx.user_graphroute correctly.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/graph/src/microsoft_teams/graph/graph.py | Adds base_url override support when constructing GraphServiceClient. |
| packages/graph/tests/test_graph.py | Adds coverage ensuring default/public base URL and sovereign base URL routing + normalization. |
| packages/apps/src/microsoft_teams/apps/utils/graph.py | Derives Graph base URL from CloudEnvironment.graph_scope and forwards it to get_graph_client. |
| packages/apps/src/microsoft_teams/apps/routing/activity_context.py | Stores cloud on the context and uses it when creating user_graph/app_graph. |
| packages/apps/src/microsoft_teams/apps/app_process.py | Adds cloud to ActivityProcessor and forwards it when building ActivityContext. |
| packages/apps/src/microsoft_teams/apps/app.py | Passes self.cloud into create_graph_client() for get_app_graph(). |
| packages/apps/tests/test_optional_graph_dependencies.py | Adds tests for cloud→Graph base URL derivation and updates mocks for new Graph client signature. |
| packages/apps/tests/test_app_process.py | Updates ActivityProcessor/ActivityContext construction to pass PUBLIC cloud. |
| packages/apps/tests/test_app_oauth.py | Updates ActivityProcessor/ActivityContext construction to pass PUBLIC cloud. |
| packages/apps/tests/test_activity_context.py | Updates ActivityContext construction to pass PUBLIC cloud. |
corinagum
force-pushed
the
cg/graph-cloud-baseurl
branch
2 times, most recently
from
April 27, 2026 22:56
90fef1a to
b31472e
Compare
heyitsaamir
reviewed
Apr 29, 2026
corinagum
added a commit
that referenced
this pull request
Apr 29, 2026
- get_graph_client: make base_url keyword-only - test_graph: switch startswith to exact equality on default URL (resolves CodeQL py/incomplete-url-substring-sanitization) Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
corinagum
added a commit
that referenced
this pull request
Apr 29, 2026
- get_graph_client: make base_url keyword-only - test_graph: switch startswith to exact equality on default URL (resolves CodeQL py/incomplete-url-substring-sanitization) Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
corinagum
force-pushed
the
cg/graph-cloud-baseurl
branch
from
April 29, 2026 23:52
119c7c7 to
44f932f
Compare
- get_graph_client: make base_url keyword-only - test_graph: switch startswith to exact equality on default URL (resolves CodeQL py/incomplete-url-substring-sanitization) Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
12 tests added in PR-area files (graph package and routing/activity_context): - TokenValidator JWT missing 'exp' claim fallback path - get_graph_client unexpected exception wrapping - ActivityContext.user_graph success + caching + ImportError re-raise - ActivityContext.sign_in OAuth card flow (1:1, group chat, options override) - ActivityContext.sign_out success debug path Lifts coverage on touched files: - graph/graph.py: 92.86% -> 100% - graph/auth_provider.py: 92.00% -> 100% - routing/activity_context.py: 84.52% -> 98.71% Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
5 new tests covering closures and error branches: - Plugin route closure invokes plugin.on_activity for qualified plugins - updated_send wrapper emits on_activity_sent event - Stream chunk/close handlers emit on_activity_sent - StreamCancelledError caught with status 200 response - ValueError raised when event_manager is missing - _build_context marks is_signed_in when token API succeeds Lifts app_process.py: 77.52% -> 96.12% Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
corinagum
force-pushed
the
cg/graph-cloud-baseurl
branch
from
April 30, 2026 19:41
c4a693e to
b9089c5
Compare
heyitsaamir
approved these changes
Apr 30, 2026
heyitsaamir
left a comment
heyitsaamir
left a comment
Collaborator
There was a problem hiding this comment.
Won't block, but I would encourage a second think on
CloudEnvironment.graph_scope is typed as `str` (not Optional), so the fallback is dead defense. Addresses Aamir review feedback. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
7 tasks
corinagum
added a commit
that referenced
this pull request
May 27, 2026
## Summary Brings `origin/main` into `release` for the **2.0.12** release. **No carve-outs this time** — Quoted Replies (PR #321) is included. `version.json`: `2.0.11` → `2.0.12`. Aligns with teams.ts/teams.net cadence. ## What's in this release (delta from 2.0.11) **Features** - Quoted Replies & new quotes features (#321) — previously held back - SuggestedActionSubmitActivity for `suggestedAction/submit` invoke (#434) - Default targeted replies for targeted inbound messages (#439) - Reactions API marked GA (#427) — already shipped in 2.0.11 actually, ignore if duplicate - Prompt Preview support (#397) - Sample: opt targeted-messages into slash commands (#430) - Sample: a2a-in-teams (#401) - Sample: proactive message update (#405) - Allow custom HTTP client via `AppOptions` (#416) **Security & fixes** - Lock JsonWebToken trust-boundary contract (#432) - Bump starlette 1.0.0 -> 1.1.0 for PYSEC-2026-161 / BadHost (#441) - warn when bot starts without credentials (#435) - fix(apps): support AAD v1 issuers in Entra token validation (#422) - fix(apps): log inbound activities at info, warn on missing Authorization (#425) - fix(http-stream): wait for in-flight flush before sending final close (#419) - Mark reactions API as GA and fix sample remove flow (#427) - Revert serviceUrl allowlist (ADO 5310460) (#415) - Route `app.get_app_graph` + `ctx.*_graph` to sovereign endpoints via `cloud.graph_scope` (#402) **Deprecations / package changes** - Remove ai, openai, mcpplugin, a2a, and devtools packages (#413) - Restore and deprecate devtools package (#410) - Deprecate ai, openai, mcpplugin, a2a packages (#406) - Add agent framework example, remove chatprompt/mcp client samples (#386) **Dependency bumps** - urllib3 2.6.3 → 2.7.0 (#426) - python-multipart 0.0.26 → 0.0.27 (#424) - microsoft-kiota-http 1.9.7 → 1.9.9 (#423) - idna 3.11 → 3.15 (#431) - starlette 1.0.0 → 1.1.0 (#441, security) - /examples/tab/Web: qs, postcss, uuid, follow-redirects bumps ## Quoted Replies inclusion notes - Teams client rendering is in-sync with the wire format as of 2026-05-06. - APX QR rollout completed: Public 2026-04-10, GCCH/DoD/Gallatin 2026-04-14. - Builder methods (`prepend_quote()`, `add_quote()`), `ctx.quote()`, and the quote-aware `ctx.reply()` behavior are all present in this release. - `examples/quoting` is included. ## Conflict resolution The 2.0.11 release branch had the QR-removed shape for four files; took `main`'s (QR-included) version for all of them: - `examples/targeted-messages/src/main.py` - `packages/api/src/microsoft_teams/api/activities/message/message.py` - `packages/apps/src/microsoft_teams/apps/routing/activity_context.py` - `packages/apps/tests/test_activity_context.py` `version.json` conflict resolved to `2.0.12`. ## Test plan - [x] `uv sync` clean - [x] `poe check` (ruff format + lint) — clean - [x] `poe test` — 609 passed - [x] `pyright` — 0 errors, 0 warnings - [ ] Pipeline build + test stages green on `release` after merge - [ ] Publish pipeline run with **Public** → ESRP approval → PyPI - [ ] `pip install microsoft-teams-apps==2.0.12` smoke install --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Aamir Jawaid <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]> Co-authored-by: Shanmathi Mayuram Krithivasan <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
App.get_app_graph(),ctx.app_graph, andctx.user_graphwere routing all Microsoft Graph calls to the public-cloud endpoint (https://graph.microsoft.com) regardless of the sovereign cloud configured on the app. Sovereign customers (GCCH, DoD, China) would hit the wrong cloud. This PR derives the Graph base URL fromcloud.graph_scopeonAppand plumbs it through every Graph client the framework constructs.graph_scope = "https://graph.microsoft.com/.default"→ derived base URL =https://graph.microsoft.com= previous hardcoded default. Zero behavior change.