Summary / Problem Statement

In extensions/msteams/src/probe.ts, probeMSTeams checks delegated authentication state. If the cached delegated token is expired, the function reports ok: false, marking the channel unhealthy. However, since the MS Teams client automatically refreshes expired tokens on the next API usage, an expired token does not mean the connection is broken, leading to false-positive health failures.

Detailed Technical Context

• Vulnerable Code Location: extensions/msteams/src/probe.ts
• Mechanics:

  const isExpired = !isFutureDateTimestampMs(tokens.expiresAt);
  delegatedAuth = {
    ok: !isExpired, // Fails health check if expired
    scopes: tokens.scopes,
    userPrincipalName: tokens.userPrincipalName,
    ...(isExpired ? { error: "token expired (will auto-refresh on next use)" } : {}),
  };

• This triggers false alerts in the channel monitoring system even if the refresh token is valid.

Impact Analysis

• Unnecessary alert spam and channel restarts for MS Teams connectors.
• False positive alarms in monitoring dashboards.

Proposed Solution

1. Check if the refresh token is present when the access token is expired.
2. Mark the probe as ok: true if the token is expired but has a valid refresh token.

Affected File References

• probe.ts:L101-L114