Add Microsoft Teams channel#1366
Merged
Merged
Conversation
Contributor
PR Summary by QodoAdd Microsoft Teams channel integration plugin Description
Diagram
High-Level Assessment
Files changed (22)
|
Contributor
Code Review by Qodo
1. ConversationReference stored by reference
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+10
to
+23
| public Task SaveAsync(string userId, ConversationReference reference) | ||
| { | ||
| _references[userId] = reference; | ||
| return Task.CompletedTask; | ||
| } | ||
|
|
||
| public Task<ConversationReference?> GetAsync(string userId) | ||
| { | ||
| _references.TryGetValue(userId, out var reference); | ||
| return Task.FromResult(reference); | ||
| } | ||
|
|
||
| public Task<IReadOnlyCollection<ConversationReference>> GetAllAsync() | ||
| => Task.FromResult((IReadOnlyCollection<ConversationReference>)_references.Values.ToList()); |
Contributor
There was a problem hiding this comment.
1. conversationreference stored by reference 📘 Rule violation ⛨ Security
InMemoryConversationReferenceStore stores and returns mutable ConversationReference instances by reference, allowing callers/other code paths to mutate cached state. This can cause cross-request state leakage and incorrect proactive message routing.
Agent Prompt
## Issue description
`InMemoryConversationReferenceStore` stores the caller-provided `ConversationReference` directly and returns the same instance from `GetAsync`/`GetAllAsync`. Since `ConversationReference` is mutable, downstream mutation can leak state across requests/components.
## Issue Context
The compliance requirement mandates defensive copies when storing caller-provided mutable objects or returning cached/shared mutable objects.
## Fix Focus Areas
- src/Plugins/BotSharp.Plugin.MicrosoftTeams/Services/InMemoryConversationReferenceStore.cs[10-23]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+108
to
+113
| var agentService = _services.GetRequiredService<IAgentService>(); | ||
| var agent = await agentService.GetAgent(agentId); | ||
|
|
||
| var welcomeTemplate = agent?.Templates?.FirstOrDefault(x => x.Name == ".welcome"); | ||
| if (welcomeTemplate == null) | ||
| { |
Contributor
There was a problem hiding this comment.
2. .welcome compared case-sensitively 📘 Rule violation ≡ Correctness
The code matches template name using x.Name == ".welcome", which is case-sensitive and may break identifier-like matching across locales/inputs. This can cause the welcome flow to be skipped unexpectedly.
Agent Prompt
## Issue description
Template name lookup uses case-sensitive equality (`==`) for an identifier-like string.
## Issue Context
Compliance requires ordinal, case-insensitive comparisons for identifier-like strings to avoid mismatches.
## Fix Focus Areas
- src/Plugins/BotSharp.Plugin.MicrosoftTeams/Services/TeamsActivityBot.cs[108-113]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+50
to
+55
| public async Task<IActionResult> NotifyAsync([FromBody] TeamsNotifyRequest request, CancellationToken cancellationToken) | ||
| { | ||
| if (string.IsNullOrEmpty(request.UserId)) | ||
| { | ||
| return BadRequest("userId is required."); | ||
| } |
Contributor
There was a problem hiding this comment.
3. notifyasync missing null body check 📘 Rule violation ☼ Reliability
NotifyAsync dereferences request.UserId without guarding against a null request body, which can produce a 500 error instead of a predictable 400 response. This violates fail-fast boundary validation expectations.
Agent Prompt
## Issue description
The controller action assumes `[FromBody]` binding always provides a non-null `request`, but ASP.NET Core can pass null for missing/invalid bodies. The code then dereferences `request.UserId`.
## Issue Context
System boundary inputs (request bodies/routes) must be validated for null/empty and return a predictable error (e.g., `BadRequest`) rather than throwing.
## Fix Focus Areas
- src/Plugins/BotSharp.Plugin.MicrosoftTeams/Controllers/TeamsMessageController.cs[50-55]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+8
to
+13
| private readonly ConcurrentDictionary<string, ConversationReference> _references = new(); | ||
|
|
||
| public Task SaveAsync(string userId, ConversationReference reference) | ||
| { | ||
| _references[userId] = reference; | ||
| return Task.CompletedTask; |
Contributor
There was a problem hiding this comment.
4. Proactive message misrouting 🐞 Bug ⛨ Security
InMemoryConversationReferenceStore stores only one ConversationReference per userId and overwrites it on every inbound turn, so a user chatting in multiple Teams scopes (personal vs channel/group) will have their last scope win. As a result, /teams/notify can send a proactive message into the wrong conversation (including a public channel) for that userId.
Agent Prompt
### Issue description
`IConversationReferenceStore` currently keys references only by `userId`, and `TeamsActivityBot` overwrites that value every turn. This can cause proactive messages to be delivered to the wrong Teams conversation (e.g., a team/channel thread instead of a 1:1 chat) when the same user interacts with the bot in multiple scopes.
### Issue Context
- `TeamsNotifyRequest.UserId` is an AAD object id.
- `TeamsActivityBot.GetUserId` prefers `Activity.From.AadObjectId`, which is stable across scopes, so all of that user's conversations collapse into a single key.
- Proactive send later does a single lookup by `userId` and uses that reference.
### Fix Focus Areas
- src/Plugins/BotSharp.Plugin.MicrosoftTeams/Services/InMemoryConversationReferenceStore.cs[6-23]
- src/Plugins/BotSharp.Plugin.MicrosoftTeams/Services/TeamsActivityBot.cs[34-43]
- src/Plugins/BotSharp.Plugin.MicrosoftTeams/Services/TeamsActivityBot.cs[138-142]
- src/Plugins/BotSharp.Plugin.MicrosoftTeams/Models/TeamsNotifyRequest.cs[3-19]
- src/Plugins/BotSharp.Plugin.MicrosoftTeams/Services/TeamsNotificationService.cs[30-64]
### Implementation direction
- Store conversation references under a composite key (at least `userId + conversationId`, optionally also tenant/team/channel scope).
- Extend `TeamsNotifyRequest` (and controller validation) to accept either `conversationId`/`scope` so callers can choose the correct destination, or implement deterministic selection logic (e.g., prefer personal-scope references and never use channel-scope for user-targeted notifications).
- Update `IConversationReferenceStore` to support saving and retrieving multiple references per user and selecting by scope/conversation.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.