fix(msteams): keep delegated auth healthy when an expired token can auto-refresh (#106566)

lonexreb · lonexreb · commit 89254d612679 · 2026-07-13T19:01:06.000-05:00
diff --git a/extensions/msteams/src/probe.test.ts b/extensions/msteams/src/probe.test.ts
@@ -103,7 +103,9 @@ describe("msteams probe", () => {
     });
   });
 
-  it("reports delegated tokens expired when the process clock is invalid", async () => {
+  it("treats an expired delegated access token as healthy when a refresh token is present", async () => {
+    // NaN clock forces the expiry check to fail; a stored refresh token means
+    // the client auto-refreshes, so the probe must not report a health failure.
     const nowSpy = vi.spyOn(Date, "now").mockReturnValue(Number.NaN);
     hostMockState.delegatedTokens = {
       accessToken: "delegated-token",
@@ -120,6 +122,39 @@ describe("msteams probe", () => {
       delegatedAuth: { enabled: true },
     } as unknown as MSTeamsConfig;
 
+    try {
+      await expect(probeMSTeams(cfg)).resolves.toEqual({
+        ok: true,
+        appId: "app",
+        graph: { ok: true, roles: undefined, scopes: undefined },
+        delegatedAuth: {
+          ok: true,
+          scopes: ["ChatMessage.Send"],
+          userPrincipalName: "user@example.com",
+        },
+      });
+    } finally {
+      nowSpy.mockRestore();
+    }
+  });
+
+  it("reports delegated auth unhealthy when the token is expired and no refresh token is stored", async () => {
+    const nowSpy = vi.spyOn(Date, "now").mockReturnValue(Number.NaN);
+    hostMockState.delegatedTokens = {
+      accessToken: "delegated-token",
+      refreshToken: "",
+      expiresAt: Date.parse("2030-01-01T00:00:00.000Z"),
+      scopes: ["ChatMessage.Send"],
+      userPrincipalName: "user@example.com",
+    };
+    const cfg = {
+      enabled: true,
+      appId: "app",
+      appPassword: "pw",
+      tenantId: "tenant",
+      delegatedAuth: { enabled: true },
+    } as unknown as MSTeamsConfig;
+
     try {
       await expect(probeMSTeams(cfg)).resolves.toEqual({
         ok: true,
@@ -129,7 +164,7 @@ describe("msteams probe", () => {
           ok: false,
           scopes: ["ChatMessage.Send"],
           userPrincipalName: "user@example.com",
-          error: "token expired (will auto-refresh on next use)",
+          error: "token expired and no refresh token available (re-run setup wizard)",
         },
       });
     } finally {
diff --git a/extensions/msteams/src/probe.ts b/extensions/msteams/src/probe.ts
@@ -103,11 +103,17 @@ export async function probeMSTeams(cfg?: MSTeamsConfig): Promise<ProbeMSTeamsRes
         const tokens = loadDelegatedTokens();
         if (tokens) {
           const isExpired = !isFutureDateTimestampMs(tokens.expiresAt);
+          // An expired access token is not a health failure while a refresh
+          // token is stored: the client refreshes it on the next API call. Only
+          // an expired token with no refresh token needs operator re-auth.
+          const canAutoRefresh = Boolean(tokens.refreshToken);
           delegatedAuth = {
-            ok: !isExpired,
+            ok: !isExpired || canAutoRefresh,
             scopes: tokens.scopes,
             userPrincipalName: tokens.userPrincipalName,
-            ...(isExpired ? { error: "token expired (will auto-refresh on next use)" } : {}),
+            ...(isExpired && !canAutoRefresh
+              ? { error: "token expired and no refresh token available (re-run setup wizard)" }
+              : {}),
           };
         } else {
           delegatedAuth = { ok: false, error: "no delegated tokens found (run setup wizard)" };
