import { createServer } from "node:http";
import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
const DEFAULT_PORT = 3978;
const DEFAULT_PATH = "/api/messages";
const DEFAULT_MAX_BODY_BYTES = 256 * 1024;
const BOT_FRAMEWORK_SCOPE = "https://api.botframework.com/.default";
const BOT_FRAMEWORK_OPENID_CONFIGURATION = "https://login.botframework.com/v1/.well-known/openidconfiguration";
const BOT_FRAMEWORK_ISSUER = "https://api.botframework.com";
const SERVICE_URL_HOST_ALLOWLIST = [
    "smba.trafficmanager.net",
    "smba.infra.gcc.teams.microsoft.com",
    "smba.infra.gov.teams.microsoft.us",
    "smba.infra.dod.teams.microsoft.us",
    "botframework.azure.cn",
];
class PayloadTooLargeError extends Error {
}
const openIdConfigurationCache = new Map();
const jwksCache = new Map();
function normalizePath(path) {
    const trimmed = path?.trim() || DEFAULT_PATH;
    return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
}
function normalizeConversationId(raw) {
    return raw.split(";")[0] ?? raw;
}
export function decodeMSTeamsHtmlEntities(html) {
    return html
        .replace(/&lt;/g, "<")
        .replace(/&gt;/g, ">")
        .replace(/&quot;/g, '"')
        .replace(/&#39;/g, "'")
        .replace(/&#x27;/g, "'")
        .replace(/&nbsp;/g, " ")
        .replace(/&amp;/g, "&");
}
export function msteamsHtmlToPlainText(html) {
    return decodeMSTeamsHtmlEntities(html
        .replace(/<[^>]*>/g, " ")
        .replace(/\s+/g, " ")
        .trim()).replace(/\s+/g, " ");
}
export function stripMSTeamsMentionTags(text) {
    return text.replace(/<at[^>]*>.*?<\/at>/gi, "").trim();
}
function normalizeMSTeamsText(raw) {
    return msteamsHtmlToPlainText(stripMSTeamsMentionTags(raw)).trim();
}
export function isAllowedMSTeamsServiceUrl(serviceUrl) {
    if (typeof serviceUrl !== "string")
        return false;
    try {
        const parsed = new URL(serviceUrl.trim());
        if (parsed.protocol !== "https:")
            return false;
        const hostname = parsed.hostname.toLowerCase();
        return SERVICE_URL_HOST_ALLOWLIST.some((allowed) => hostname === allowed || hostname.endsWith(`.${allowed}`));
    }
    catch {
        return false;
    }
}
function normalizeMSTeamsServiceUrl(serviceUrl) {
    if (!isAllowedMSTeamsServiceUrl(serviceUrl)) {
        let host = "invalid-url";
        try {
            host = new URL(serviceUrl).hostname || host;
        }
        catch { /* keep fallback */ }
        throw new Error(`Blocked Microsoft Teams serviceUrl host: ${host}`);
    }
    return serviceUrl.trim().replace(/\/+$/, "");
}
function parseActivityTimestamp(value) {
    if (typeof value !== "string" || !value.trim())
        return Date.now();
    const date = new Date(value);
    return Number.isNaN(date.getTime()) ? Date.now() : date.getTime();
}
export function msteamsActivityToInbound(activity) {
    if (activity.type !== "message")
        return null;
    const text = normalizeMSTeamsText(activity.text ?? "");
    if (!text)
        return null;
    const conversationId = normalizeConversationId(activity.conversation?.id ?? "");
    if (!conversationId)
        return null;
    const senderId = activity.from?.aadObjectId ?? activity.from?.id ?? conversationId;
    const fromMe = Boolean(activity.from?.id && activity.from.id === activity.recipient?.id);
    return {
        channelId: "msteams",
        conversationId,
        senderId,
        senderName: activity.from?.name,
        text,
        timestamp: parseActivityTimestamp(activity.timestamp),
        fromMe,
        isSelfChat: false,
    };
}
function buildReference(activity) {
    const conversationId = normalizeConversationId(activity.conversation?.id ?? "");
    if (!conversationId || !activity.serviceUrl)
        return null;
    const serviceUrl = normalizeMSTeamsServiceUrl(activity.serviceUrl);
    const tenantId = activity.channelData?.tenant?.id ?? activity.conversation?.tenantId;
    return {
        activityId: activity.id,
        serviceUrl,
        conversation: {
            id: conversationId,
            conversationType: activity.conversation?.conversationType,
            tenantId,
        },
        user: activity.from,
        bot: activity.recipient,
        tenantId,
        locale: activity.locale,
    };
}
async function readJsonBody(req, maxBytes) {
    const chunks = [];
    let total = 0;
    for await (const chunk of req) {
        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
        total += buffer.byteLength;
        if (total > maxBytes)
            throw new PayloadTooLargeError("Payload too large");
        chunks.push(buffer);
    }
    const raw = Buffer.concat(chunks).toString("utf8");
    return raw ? JSON.parse(raw) : {};
}
function sendJson(res, status, body) {
    res.statusCode = status;
    res.setHeader("Content-Type", "application/json");
    res.end(JSON.stringify(body));
}
function tokenFromAuthorization(authorization) {
    const match = /^Bearer\s+(.+)$/i.exec(authorization.trim());
    return match?.[1]?.trim() ?? "";
}
function allowedIssuers(tenantId) {
    return [
        BOT_FRAMEWORK_ISSUER,
        `https://sts.windows.net/${tenantId}/`,
        `https://login.microsoftonline.com/${tenantId}/v2.0`,
    ];
}
function openIdConfigurationUrlForIssuer(issuer, tenantId) {
    if (issuer === BOT_FRAMEWORK_ISSUER)
        return BOT_FRAMEWORK_OPENID_CONFIGURATION;
    if (issuer === `https://sts.windows.net/${tenantId}/`) {
        return `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/.well-known/openid-configuration`;
    }
    if (issuer === `https://login.microsoftonline.com/${tenantId}/v2.0`) {
        return `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/v2.0/.well-known/openid-configuration`;
    }
    return null;
}
async function jwksForIssuer(issuer, tenantId, fetchImpl) {
    const configUrl = openIdConfigurationUrlForIssuer(issuer, tenantId);
    if (!configUrl)
        throw new Error(`Unsupported Microsoft Teams token issuer: ${issuer}`);
    const cached = jwksCache.get(configUrl);
    if (cached)
        return cached;
    const jwksUriPromise = openIdConfigurationCache.get(configUrl) ?? (async () => {
        const res = await fetchImpl(configUrl);
        if (!res.ok)
            throw new Error(`Failed to fetch OpenID configuration (HTTP ${res.status})`);
        const json = await res.json();
        if (typeof json.jwks_uri !== "string" || !json.jwks_uri) {
            throw new Error("OpenID configuration did not include jwks_uri");
        }
        return json.jwks_uri;
    })();
    openIdConfigurationCache.set(configUrl, jwksUriPromise);
    const jwks = createRemoteJWKSet(new URL(await jwksUriPromise));
    jwksCache.set(configUrl, jwks);
    return jwks;
}
export async function validateMSTeamsAuthorization(params) {
    const token = tokenFromAuthorization(params.authorization);
    if (!token)
        throw new Error("Missing Bearer token");
    const decoded = decodeJwt(token);
    const issuer = typeof decoded.iss === "string" ? decoded.iss : "";
    if (!allowedIssuers(params.tenantId).includes(issuer)) {
        throw new Error("Unsupported Microsoft Teams token issuer");
    }
    const jwks = await jwksForIssuer(issuer, params.tenantId, params.fetchImpl ?? fetch);
    await jwtVerify(token, jwks, {
        audience: params.appId,
        issuer,
    });
}
export class MSTeamsConnector {
    id = "msteams";
    label = "Microsoft Teams";
    deps;
    host;
    port;
    path;
    maxBodyBytes;
    _status = "stopped";
    server = null;
    events = null;
    tokenCache = null;
    references = new Map();
    constructor(deps = {}) {
        this.deps = deps;
        this.host = deps.host ?? process.env.MSTEAMS_WEBHOOK_HOST ?? "0.0.0.0";
        this.port = deps.port ?? Number.parseInt(process.env.MSTEAMS_WEBHOOK_PORT ?? `${DEFAULT_PORT}`, 10);
        this.path = normalizePath(deps.path ?? process.env.MSTEAMS_WEBHOOK_PATH);
        this.maxBodyBytes = deps.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
    }
    status() { return this._status; }
    currentQr() { return null; }
    listenPort() {
        const address = this.server?.address();
        return typeof address === "object" && address ? address.port : null;
    }
    log(msg, ...args) {
        (this.deps.log ?? ((m, ...a) => console.log("[msteams]", m, ...a)))(msg, ...args);
    }
    now() {
        return this.deps.now?.() ?? Date.now();
    }
    fetch() {
        return this.deps.fetchImpl ?? fetch;
    }
    credentials() {
        const appId = this.deps.appId ?? process.env.MSTEAMS_APP_ID ?? "";
        const appPassword = this.deps.appPassword ?? process.env.MSTEAMS_APP_PASSWORD ?? "";
        const tenantId = this.deps.tenantId ?? process.env.MSTEAMS_TENANT_ID ?? "";
        if (!appId || !appPassword || !tenantId)
            return null;
        return { appId, appPassword, tenantId };
    }
    setStatus(status, detail) {
        this._status = status;
        this.events?.onStatus(status, detail);
    }
    async start(events) {
        this.events = events;
        const creds = this.credentials();
        if (!creds) {
            this.setStatus("error", {
                error: "MSTEAMS_APP_ID, MSTEAMS_APP_PASSWORD, and MSTEAMS_TENANT_ID are required",
            });
            return;
        }
        if (this.server)
            return;
        this.setStatus("connecting");
        const server = createServer((req, res) => {
            void this.handleRequest(req, res, creds);
        });
        this.server = server;
        try {
            await new Promise((resolve, reject) => {
                const onError = (err) => {
                    server.off("listening", onListening);
                    reject(err);
                };
                const onListening = () => {
                    server.off("error", onError);
                    resolve();
                };
                server.once("error", onError);
                server.once("listening", onListening);
                server.listen(this.port, this.host);
            });
            this.setStatus("connected");
            this.log(`listening on ${this.host}:${this.listenPort() ?? this.port}${this.path}`);
        }
        catch (err) {
            this.server = null;
            this.setStatus("error", { error: err instanceof Error ? err.message : String(err) });
        }
    }
    async stop() {
        const server = this.server;
        this.server = null;
        this.tokenCache = null;
        this.references.clear();
        if (server) {
            await new Promise((resolve) => {
                server.close(() => resolve());
            });
        }
        this.setStatus("stopped");
    }
    async send(msg) {
        const creds = this.credentials();
        if (!creds)
            throw new Error("Microsoft Teams credentials are not configured");
        const conversationId = normalizeConversationId(msg.conversationId);
        const ref = this.references.get(conversationId);
        if (!ref) {
            throw new Error(`No Microsoft Teams conversation reference for '${conversationId}'. The bot must receive a message first.`);
        }
        const token = await this.botToken(creds);
        const url = `${ref.serviceUrl}/v3/conversations/${encodeURIComponent(conversationId)}/activities`;
        const channelData = ref.tenantId ? { tenant: { id: ref.tenantId } } : undefined;
        const activity = {
            type: "message",
            text: msg.text,
            channelId: "msteams",
            from: ref.bot ?? { id: creds.appId, role: "bot" },
            recipient: ref.user,
            conversation: ref.conversation,
            serviceUrl: ref.serviceUrl,
            locale: ref.locale,
            ...(channelData ? { channelData } : {}),
        };
        const res = await this.fetch()(url, {
            method: "POST",
            headers: {
                Authorization: `Bearer ${token}`,
                "Content-Type": "application/json",
            },
            body: JSON.stringify(activity),
        });
        if (!res.ok) {
            const body = await res.text().catch(() => "");
            throw new Error(`Microsoft Teams send failed (HTTP ${res.status})${body ? `: ${body}` : ""}`);
        }
    }
    async handleRequest(req, res, creds) {
        const requestUrl = new URL(req.url ?? "/", "http://localhost");
        if (req.method !== "POST" || requestUrl.pathname !== this.path) {
            sendJson(res, 404, { error: "Not found" });
            return;
        }
        const auth = req.headers.authorization ?? "";
        if (!auth.startsWith("Bearer ")) {
            sendJson(res, 401, { error: "Unauthorized" });
            return;
        }
        try {
            const body = await readJsonBody(req, this.maxBodyBytes);
            const activity = body && typeof body === "object" ? body : {};
            await this.validateAuth(auth, activity, creds);
            const reference = buildReference(activity);
            if (reference) {
                this.references.set(reference.conversation.id, reference);
            }
            const inbound = msteamsActivityToInbound(activity);
            if (inbound) {
                this.events?.onInbound(inbound);
            }
            sendJson(res, 202, { ok: true });
        }
        catch (err) {
            if (err instanceof PayloadTooLargeError) {
                sendJson(res, 413, { error: "Payload too large" });
                return;
            }
            const message = err instanceof Error ? err.message : String(err);
            const status = message.includes("token") || message.includes("issuer") ? 401 : 400;
            sendJson(res, status, { error: message });
        }
    }
    async validateAuth(authorization, activity, creds) {
        if (this.deps.validateAuth) {
            await this.deps.validateAuth(authorization, activity);
            return;
        }
        if (process.env.MSTEAMS_SKIP_AUTH_VALIDATION === "true") {
            return;
        }
        await validateMSTeamsAuthorization({
            authorization,
            appId: creds.appId,
            tenantId: creds.tenantId,
            fetchImpl: this.fetch(),
        });
    }
    async botToken(creds) {
        if (this.tokenCache && this.tokenCache.expiresAt > this.now() + 60_000) {
            return this.tokenCache.accessToken;
        }
        const form = new URLSearchParams({
            client_id: creds.appId,
            client_secret: creds.appPassword,
            grant_type: "client_credentials",
            scope: BOT_FRAMEWORK_SCOPE,
        });
        const res = await this.fetch()(`https://login.microsoftonline.com/${encodeURIComponent(creds.tenantId)}/oauth2/v2.0/token`, {
            method: "POST",
            headers: { "Content-Type": "application/x-www-form-urlencoded" },
            body: form,
        });
        if (!res.ok) {
            const body = await res.text().catch(() => "");
            throw new Error(`Microsoft Teams token request failed (HTTP ${res.status})${body ? `: ${body}` : ""}`);
        }
        const json = await res.json();
        if (typeof json.access_token !== "string" || !json.access_token) {
            throw new Error("Microsoft Teams token response did not include access_token");
        }
        const expiresInSeconds = typeof json.expires_in === "number" ? json.expires_in : 3600;
        this.tokenCache = {
            accessToken: json.access_token,
            expiresAt: this.now() + expiresInSeconds * 1000,
        };
        return json.access_token;
    }
}
//# sourceMappingURL=connector.js.map