Files
openclaw/extensions/msteams/src/errors.test.ts
Brandon eecda912ee fix(msteams): surface network errors blocking bot JWT validation and outbound replies (#77674) (#78081)
* fix(msteams): surface network errors blocking Teams bot JWT validation and outbound replies (#77674)

When login.botframework.com or smba.trafficmanager.net egress is blocked,
errors previously disappeared completely. JWT validator swallowed network
errors and returned false (401 looked identical to a bad credential), and
outbound send failures with transport-level codes had no hint pointing to
the Connector endpoint.

- sdk.ts: rethrow ECONNREFUSED/ENOTFOUND/EHOSTUNREACH/ETIMEDOUT/ECONNRESET
  from the JWKS key fetch so callers can distinguish firewall blocks from bad
  credentials; add isJwksNetworkError() helper
- monitor.ts: catch rethrown network errors in JWT middleware and log at
  runtime.error level with an actionable message pointing to
  login.botframework.com:443; upgrade allowlist resolution failures from
  runtime.log (optional/silent) to runtime.error
- errors.ts: add "network" kind to classifyMSTeamsSendError for transport-level
  errors (ECONNREFUSED, ENOTFOUND, etc.); add formatMSTeamsSendErrorHint for
  "network" kind pointing to smba.trafficmanager.net and egress rules
- monitor-handler.ts, message-handler.ts: remove spurious ?. from runtime.error
  calls (RuntimeEnv.error is a required non-optional field)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(msteams): surface blocked botframework egress

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Brad Groux <3053586+BradGroux@users.noreply.github.com>
2026-05-05 23:11:06 -05:00

164 lines
5.3 KiB
TypeScript

import { describe, expect, it, vi } from "vitest";
import {
classifyMSTeamsSendError,
formatMSTeamsSendErrorHint,
formatUnknownError,
isRevokedProxyError,
} from "./errors.js";
import { withRevokedProxyFallback } from "./revoked-context.js";
describe("msteams errors", () => {
it("formats unknown errors", () => {
expect(formatUnknownError("oops")).toBe("oops");
expect(formatUnknownError(null)).toBe("null");
});
it("classifies auth errors", () => {
expect(classifyMSTeamsSendError({ statusCode: 401 }).kind).toBe("auth");
expect(classifyMSTeamsSendError({ statusCode: 403 }).kind).toBe("auth");
});
it("classifies ContentStreamNotAllowed as permanent instead of auth", () => {
expect(
classifyMSTeamsSendError({
statusCode: 403,
response: {
body: {
error: {
code: "ContentStreamNotAllowed",
},
},
},
}),
).toMatchObject({
kind: "permanent",
statusCode: 403,
errorCode: "ContentStreamNotAllowed",
});
});
it("classifies throttling errors and parses retry-after", () => {
expect(classifyMSTeamsSendError({ statusCode: 429, retryAfter: "1.5" })).toMatchObject({
kind: "throttled",
statusCode: 429,
retryAfterMs: 1500,
});
});
it("classifies transient errors", () => {
expect(classifyMSTeamsSendError({ statusCode: 503 })).toMatchObject({
kind: "transient",
statusCode: 503,
});
});
it("classifies permanent 4xx errors", () => {
expect(classifyMSTeamsSendError({ statusCode: 400 })).toMatchObject({
kind: "permanent",
statusCode: 400,
});
});
it("provides actionable hints for common cases", () => {
expect(formatMSTeamsSendErrorHint({ kind: "auth" })).toContain("msteams");
expect(formatMSTeamsSendErrorHint({ kind: "throttled" })).toContain("throttled");
expect(
formatMSTeamsSendErrorHint({
kind: "permanent",
errorCode: "ContentStreamNotAllowed",
}),
).toContain("expired the content stream");
});
it("classifies transport-level network errors and provides smba egress hint (#77674)", () => {
const econnrefused = Object.assign(new Error("connect ECONNREFUSED"), { code: "ECONNREFUSED" });
const enotfound = Object.assign(new Error("getaddrinfo ENOTFOUND smba.trafficmanager.net"), {
code: "ENOTFOUND",
});
const etimedout = Object.assign(new Error("ETIMEDOUT"), { code: "ETIMEDOUT" });
expect(classifyMSTeamsSendError(econnrefused)).toMatchObject({
kind: "network",
errorCode: "ECONNREFUSED",
});
expect(classifyMSTeamsSendError(enotfound)).toMatchObject({
kind: "network",
errorCode: "ENOTFOUND",
});
expect(classifyMSTeamsSendError(etimedout)).toMatchObject({
kind: "network",
errorCode: "ETIMEDOUT",
});
// Hints for network errors must mention smba (Connector endpoint) and egress
expect(formatMSTeamsSendErrorHint({ kind: "network" })).toContain("smba");
expect(formatMSTeamsSendErrorHint({ kind: "network" })).toContain("egress");
});
it("still classifies HTTP errors as unknown when no status code and no network code", () => {
expect(classifyMSTeamsSendError(new Error("unexpected error")).kind).toBe("unknown");
expect(classifyMSTeamsSendError(null)).toMatchObject({ kind: "unknown" });
});
describe("isRevokedProxyError", () => {
it("returns true for revoked proxy TypeError", () => {
expect(
isRevokedProxyError(new TypeError("Cannot perform 'set' on a proxy that has been revoked")),
).toBe(true);
expect(
isRevokedProxyError(new TypeError("Cannot perform 'get' on a proxy that has been revoked")),
).toBe(true);
});
it("returns false for non-TypeError errors", () => {
expect(isRevokedProxyError(new Error("proxy that has been revoked"))).toBe(false);
});
it("returns false for unrelated TypeErrors", () => {
expect(isRevokedProxyError(new TypeError("undefined is not a function"))).toBe(false);
});
it("returns false for non-error values", () => {
expect(isRevokedProxyError(null)).toBe(false);
expect(isRevokedProxyError("proxy that has been revoked")).toBe(false);
});
});
describe("withRevokedProxyFallback", () => {
it("returns primary result when no error occurs", async () => {
await expect(
withRevokedProxyFallback({
run: async () => "ok",
onRevoked: async () => "fallback",
}),
).resolves.toBe("ok");
});
it("uses fallback when proxy-revoked TypeError is thrown", async () => {
const onRevokedLog = vi.fn();
await expect(
withRevokedProxyFallback({
run: async () => {
throw new TypeError("Cannot perform 'get' on a proxy that has been revoked");
},
onRevoked: async () => "fallback",
onRevokedLog,
}),
).resolves.toBe("fallback");
expect(onRevokedLog).toHaveBeenCalledOnce();
});
it("rethrows non-revoked errors", async () => {
const err = Object.assign(new Error("boom"), { statusCode: 500 });
await expect(
withRevokedProxyFallback({
run: async () => {
throw err;
},
onRevoked: async () => "fallback",
}),
).rejects.toBe(err);
});
});
});