Microsoft Teams Adapter

# Required: Azure Bot credentials
TEAMS_APP_ID=00000000-0000-0000-0000-000000000000
TEAMS_APP_SECRET=your~client.secret_here-1234567890

# Optional: Server listen address (default: 0.0.0.0:3978)
TEAMS_LISTEN_ADDR=0.0.0.0:3978

# Optional: HMAC signature validation secret
# (configured in Azure Bot → Configuration → Messaging endpoint settings)
TEAMS_HMAC_SECRET=your_webhook_secret_here

# Repository configuration
MAGPIE_REPO_DIR=/path/to/your/repo
MAGPIE_BASE_BRANCH=main
MAGPIE_GITHUB_ORG=your-org  # Optional: for org-scoped repo cloning

# CI commands
MAGPIE_TEST_CMD="npm test"
MAGPIE_LINT_CMD="npm run lint"
MAGPIE_MAX_CI_ROUNDS=2

# Optional: Plane.so issue tracking
PLANE_BASE_URL=https://your-plane.so
PLANE_API_KEY=your_plane_api_key
PLANE_WORKSPACE_SLUG=your-workspace
PLANE_PROJECT_ID=your-project-id

# Optional: Daytona sandbox execution
DAYTONA_API_KEY=your_daytona_key
DAYTONA_BASE_URL=https://app.daytona.io/api
DAYTONA_ORGANIZATION_ID=your-org-id
DAYTONA_SANDBOX_CLASS=small

pub async fn get_token(&self) -> Result<String> {
    let mut cache = self.cache.lock().await;

    if let Some(ref cached) = *cache {
        if Instant::now() < cached.expires_at {
            return Ok(cached.token.clone());
        }
    }

    let resp = self
        .client
        .post(&self.token_url)
        .form(&[
            ("grant_type", "client_credentials"),
            ("client_id", &self.app_id),
            ("client_secret", &self.app_secret),
            ("scope", SCOPE),
        ])
        .send()
        .await
        .context("failed to request token")?;

    if !resp.status().is_success() {
        let status = resp.status();
        let text = resp.text().await.unwrap_or_default();
        bail!("token request failed ({status}): {text}");
    }

    let data: TokenResponse = resp
        .json()
        .await
        .context("failed to parse token response")?;

    let ttl = Duration::from_secs(data.expires_in).saturating_sub(EXPIRY_BUFFER);
    let expires_at = Instant::now() + ttl;
    let token = data.access_token.clone();

    *cache = Some(CachedToken {
        token: data.access_token,
        expires_at,
    });

    Ok(token)
}

pub fn validate_hmac(body: &[u8], signature: &str, secret: &str) -> bool {
    let decoded = match base64::engine::general_purpose::STANDARD.decode(signature) {
        Ok(d) => d,
        Err(_) => return false,
    };

    let mut mac = match HmacSha256::new_from_slice(secret.as_bytes()) {
        Ok(m) => m,
        Err(_) => return false,
    };
    mac.update(body);

    mac.verify_slice(&decoded).is_ok()
}

pub fn strip_teams_mention(text: &str) -> String {
    let mut result = text.to_string();
    while let Some(start) = result.find("<at>") {
        if let Some(end) = result[start..].find("</at>") {
            let remove_end = start + end + "</at>".len();
            result = format!("{}{}", &result[..start], &result[remove_end..]);
        } else {
            break;
        }
    }
    result.trim().to_string()
}

FROM rust:1.75 as builder
WORKDIR /build
COPY . .
RUN cargo build --release -p magpie-teams

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y \
    ca-certificates \
    git \
    && rm -rf /var/lib/apt/lists/*

COPY --from=builder /build/target/release/magpie-teams /usr/local/bin/
EXPOSE 3978
CMD ["magpie-teams"]

version: '3.8'

services:
  magpie-teams:
    build:
      context: .
      dockerfile: Dockerfile.teams
    ports:
      - "3978:3978"
    environment:
      - TEAMS_APP_ID=${TEAMS_APP_ID}
      - TEAMS_APP_SECRET=${TEAMS_APP_SECRET}
      - TEAMS_HMAC_SECRET=${TEAMS_HMAC_SECRET}
      - MAGPIE_REPO_DIR=/workspace
      - RUST_LOG=info
    volumes:
      - ./workspace:/workspace
      - ~/.gitconfig:/root/.gitconfig:ro
      - ~/.ssh:/root/.ssh:ro
    restart: unless-stopped

apiVersion: apps/v1
kind: Deployment
metadata:
  name: magpie-teams
spec:
  replicas: 2
  selector:
    matchLabels:
      app: magpie-teams
  template:
    metadata:
      labels:
        app: magpie-teams
    spec:
      containers:
      - name: magpie
        image: your-registry/magpie-teams:latest
        ports:
        - containerPort: 3978
        envFrom:
        - secretRef:
            name: magpie-teams-secrets
        - configMapRef:
            name: magpie-config
        livenessProbe:
          httpGet:
            path: /health
            port: 3978
          initialDelaySeconds: 10
          periodSeconds: 30
        readinessProbe:
          httpGet:
            path: /health
            port: 3978
          initialDelaySeconds: 5
          periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: magpie-teams
spec:
  selector:
    app: magpie-teams
  ports:
  - protocol: TCP
    port: 80
    targetPort: 3978
  type: LoadBalancer
---
apiVersion: v1
kind: Secret
metadata:
  name: magpie-teams-secrets
type: Opaque
stringData:
  TEAMS_APP_ID: "00000000-0000-0000-0000-000000000000"
  TEAMS_APP_SECRET: "your~secret_here"
  TEAMS_HMAC_SECRET: "your_hmac_secret"

[Unit]
Description=Magpie Teams Webhook
After=network.target

[Service]
Type=simple
User=magpie
WorkingDirectory=/opt/magpie
EnvironmentFile=/opt/magpie/.env
ExecStart=/opt/magpie/magpie-teams
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

#[async_trait]
impl ChatPlatform for TeamsPlatform {
    fn name(&self) -> &str {
        "teams"
    }

    async fn fetch_history(&self, _channel_id: &str) -> Result<String> {
        // Returns empty — Graph API thread history not yet integrated.
        // Empty string keeps agent prompts clean (no placeholder noise).
        Ok(String::new())
    }

    async fn send_message(&self, channel_id: &str, text: &str) -> Result<()> {
        let token = self.auth.get_token().await?;
        let url = format!(
            "{}/v3/conversations/{}/activities",
            self.service_url, channel_id
        );

        let body = serde_json::json!({
            "type": "message",
            "text": text,
        });

        let resp = self
            .client
            .post(&url)
            .bearer_auth(&token)
            .json(&body)
            .send()
            .await
            .context("failed to send Teams message")?;

        if !resp.status().is_success() {
            let status = resp.status();
            let text = resp.text().await.unwrap_or_default();
            bail!("Teams send_message failed ({status}): {text}");
        }

        Ok(())
    }
}