fix: route app.get_app_graph + ctx.*_graph to sovereign endpoints via cloud.graph_scope#402
Open
fix: route app.get_app_graph + ctx.*_graph to sovereign endpoints via cloud.graph_scope#402
app.get_app_graph + ctx.*_graph to sovereign endpoints via cloud.graph_scope#402Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Routes Microsoft Graph client construction in the Teams Apps framework to the correct sovereign cloud endpoint by deriving the Graph base URL from the configured CloudEnvironment.graph_scope and propagating it through App.get_app_graph() and ActivityContext graph properties.
Changes:
- Add a
base_urloverride path inmicrosoft-teams-graph’sget_graph_client()and validate behavior via new unit tests. - Derive Graph base URL from
cloud.graph_scopeinmicrosoft-teams-appsand pass it into all framework-created Graph clients. - Plumb
cloudthroughActivityProcessor→ActivityContextsoctx.app_graph/ctx.user_graphroute correctly.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/graph/src/microsoft_teams/graph/graph.py | Adds base_url override support when constructing GraphServiceClient. |
| packages/graph/tests/test_graph.py | Adds coverage ensuring default/public base URL and sovereign base URL routing + normalization. |
| packages/apps/src/microsoft_teams/apps/utils/graph.py | Derives Graph base URL from CloudEnvironment.graph_scope and forwards it to get_graph_client. |
| packages/apps/src/microsoft_teams/apps/routing/activity_context.py | Stores cloud on the context and uses it when creating user_graph/app_graph. |
| packages/apps/src/microsoft_teams/apps/app_process.py | Adds cloud to ActivityProcessor and forwards it when building ActivityContext. |
| packages/apps/src/microsoft_teams/apps/app.py | Passes self.cloud into create_graph_client() for get_app_graph(). |
| packages/apps/tests/test_optional_graph_dependencies.py | Adds tests for cloud→Graph base URL derivation and updates mocks for new Graph client signature. |
| packages/apps/tests/test_app_process.py | Updates ActivityProcessor/ActivityContext construction to pass PUBLIC cloud. |
| packages/apps/tests/test_app_oauth.py | Updates ActivityProcessor/ActivityContext construction to pass PUBLIC cloud. |
| packages/apps/tests/test_activity_context.py | Updates ActivityContext construction to pass PUBLIC cloud. |
673a31d to
90fef1a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
App.get_app_graph(),ctx.app_graph, andctx.user_graphwere routing all Microsoft Graph calls to the public-cloud endpoint (https://graph.microsoft.com) regardless of the sovereign cloud configured on the app. Sovereign customers (GCCH, DoD, China) would hit the wrong cloud. This PR derives the Graph base URL fromcloud.graph_scopeonAppand plumbs it through every Graph client the framework constructs.graph_scope = "https://graph.microsoft.com/.default"→ derived base URL =https://graph.microsoft.com= previous hardcoded default. Zero behavior change.