Skip to content

fix(teams): look up users in their own tenant in getUser() - #961

Open
Shubham-Padkonde wants to merge 1 commit into
vercel:mainfrom
Shubham-Padkonde:fix/teams-cross-tenant-get-user
Open

Shubham-Padkonde wants to merge 1 commit into
vercel:mainfrom
Shubham-Padkonde:fix/teams-cross-tenant-get-user

Conversation

@Shubham-Padkonde

Copy link
Copy Markdown
Contributor

Summary

Fixes #953.

getUser() looked users up through app.graph, whose token is issued by the app's own tenant (appTenantId). Users of other tenants do not exist in that directory, so Graph returned 404 Request_ResourceNotFound and getUser() returned null.

  • TeamsApp.graphFor(tenantId) returns a Graph client whose token is requested from the given tenant (getAppGraphToken(tenantId), same base URL as app.graph). Without a tenant, or for the app's own tenant, it returns app.graph.
  • getUser() passes the tenant already cached for the user (teams:tenantId:<userId>), the same value openDM() uses.
  • @microsoft/teams.graph moves from devDependencies to dependencies, since its Client is now constructed at runtime (it is already a dependency of @microsoft/teams.apps). The lockfile change is limited to that move.

Test plan

  • New tests: graphFor() requests the token from the given tenant, and getUser() uses the cached tenant's client; both fail before this change.
  • vitest run in packages/adapter-teams (390 tests), tsc --noEmit, and ultracite check on the changed files pass. I did not run the full pnpm validate, and I could not test against a real second tenant.

Checklist

  • All commits are signed and verified
  • All commits are signed off for the DCO (git commit -s)
  • pnpm validate passes
  • Changeset added (or N/A — see CONTRIBUTING.md)
  • Documentation updated (or N/A)

🤖 Generated with Claude Code

getUser() called Graph through the app-level client, whose token is
issued by the app's own tenant. Users of other tenants do not exist in
that directory, so Graph returned 404 and getUser() returned null.

Use the tenant cached for the user and request the Graph token from that
tenant. Move @microsoft/teams.graph to dependencies, as its client is now
constructed at runtime.

Fixes vercel#953

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Shubham Padkonde <shubhampadkonde12@gmail.com>
@Shubham-Padkonde
Shubham-Padkonde requested a review from a team September 19, 2026 04:34
@vercel

vercel Bot commented Sep 19, 2026

Copy link
Copy Markdown
Contributor

@Shubham-Padkonde is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Teams adapter: getUser() requests its Graph token for the bot's own tenant, so users in other tenants resolve to null

1 participant