feat(microsoft-teams): microsoft: Obtain tenantId by decoding the access token instead of calling the /organizations endpoint

[lordsarcastic]

This PR updates the Microsoft Teams post-connection logic to decode the access token using JWT. It introduces a new interface for the decoded token structure and retrieves the tenant ID directly from the decoded token instead of making an API call. This change improves efficiency by reducing unnecessary network requests and streamlining the connection configuration process.

• Ticket: EXT-699

---

Microsoft Teams Authentication Optimization: JWT Token Decoding for TenantID

This PR optimizes the Microsoft Teams authentication flow by replacing an API call with direct JWT token decoding. Instead of making a network request to the '/v1.0/organization' endpoint, the code now extracts the tenant ID directly from the access token. This approach reduces latency, eliminates a potential failure point, and improves overall connection efficiency by removing an unnecessary network dependency.

Key Changes:
• Replaced API call to /v1.0/organization with JWT token decoding
• Created comprehensive MicrosoftDecodedToken interface for token structure
• Extracted tenant ID (tid) directly from the decoded token
• Removed dependency on axios for this operation

Affected Areas:
• Microsoft Teams post-connection handler
• Authentication flow for Microsoft Teams integration

Potential Impact:

Functionality: More reliable tenant ID retrieval with fewer dependencies on external API calls

Performance: Reduced latency by eliminating an HTTP request during connection setup

Security: Potential security concern due to using jwt.decode() without proper token verification

Scalability: Improved scalability by reducing external API dependencies and network traffic

Review Focus:
• Security concern: Using jwt.decode() without verification
• Completeness of the MicrosoftDecodedToken interface
• Error handling when token is not decodable
• Type assertion safety when handling the decoded JWT

Testing Needed

• Verify tenant ID extraction works for tokens from different Microsoft tenants
• Test with various token structures to ensure the interface is complete
• Verify error handling when token cannot be decoded properly
• Test with expired/invalid tokens to ensure graceful failure

Code Quality Assessment

packages/server/lib/hooks/connection/providers/microsoft-teams/post-connection.ts: Well-structured with clear type definitions. The interface is comprehensive but could potentially be simplified if not all properties are needed.

Best Practices

Code Organization:
• Well-defined interfaces
• Type safety

Error Handling:
• Defensive coding with type and existence checks

Performance:
• Reducing API calls
• Local processing instead of network requests

Possible Issues

• Security vulnerability from using jwt.decode() without verification
• Token structure might change in Microsoft API updates
• Interface may need updates if Microsoft adds/removes fields from their tokens

---

This summary was automatically generated by @propel-code-bot

[linear]

EXT-699 microsoft: Obtain `tenantId` by decoding the access token instead of calling the /organizations endpoint

[cubic-dev-ai]

Your mrge subscription is currently inactive. Please reactivate your subscription to receive AI reviews and use mrge.

[propel-code-bot]

[Security]

The JWT is being decoded without verification, which is a potential security risk. Since you're using the JWT's claims for retrieving the tenant ID, you should verify the token's authenticity using jwt.verify() instead of jwt.decode(). This helps prevent accepting manipulated or forged tokens.