Security hardening: token validation and service URL improvements

[corinagum]

Summary

Security hardening for token validation, service URL handling, and development tooling.

• Service URL validation: Validate inbound serviceUrl against allowed hostnames from the configured cloud environment preset. Configurable via additional_allowed_domains for non-standard channels or sovereign clouds without presets.
• Scope validation: Use exact set membership instead of substring matching for JWT scope checks.
• Issuer validation: Log a warning when Entra token validation is configured without a tenant ID, making the silent issuer validation skip visible.
• DevTools: Prevent the DevTools plugin from starting in production environments.

Test plan

• Unit tests for domain allowlist (cloud preset FQDNs, rejected domains, attacker trafficmanager, localhost, custom domains, wildcard, botframework.com rejected by default)
• Unit tests for exact scope matching
• Unit test for issuer validation warning
• Unit tests for DevTools production guard
• E2E validated in Teams -- no regressions
• E2E validated DevTools blocked on PYTHON_ENV=production

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Security hardening for token validation and inbound serviceUrl handling, plus preventing DevTools from running in production.

Changes:

• Added serviceUrl domain allowlist validation (with additional_allowed_domains) and strengthened JWT scope checks to exact set membership.
• Added issuer-validation warning when Entra validation is configured without a tenant ID.
• Added a production-environment guard to prevent the DevTools plugin from starting, with accompanying unit tests.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
packages/devtools/src/microsoft_teams/devtools/devtools_plugin.py	Blocks DevTools plugin initialization when environment indicates production.
packages/devtools/tests/test_devtools_plugin.py	Adds tests for DevTools production guard and basic plugin initialization behavior.
packages/apps/src/microsoft_teams/apps/auth/token_validator.py	Adds service URL allowlist logic, warning for missing tenant ID, and exact scope matching.
packages/apps/src/microsoft_teams/apps/http/http_server.py	Adds serviceUrl allowlist validation and plumbs additional_allowed_domains into server init.
packages/apps/src/microsoft_teams/apps/options.py	Adds additional_allowed_domains to app options/internal options.
packages/apps/src/microsoft_teams/apps/app.py	Passes additional_allowed_domains from app options into server initialization.
packages/apps/tests/test_token_validator.py	Adds unit tests for domain allowlist, exact scope matching, and issuer warning.
packages/apps/tests/test_http_server.py	Adds unit tests for idempotent initialize, endpoint validation, auth rejection, and serviceUrl allowlist behavior.
packages/apps/tests/test_app.py	Adds unit test for merging app options with defaults.
examples/cards/src/main.py	Formatting-only change (single-line method chaining).