PowerOn/gateway
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

disable auth: use system bot display name, do not send credentials to browser bot

Browse source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
patrick-motsch 2026-02-16 20:37:09 +01:00
parent 1b70c07026
commit 3f9d791688
1 changed files with 24 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

62
modules/features/teamsbot/routeFeatureTeamsbot.py
View file

@ -196,46 +196,32 @@ async def startSession(
userId = str(context.user.id)
effectiveConfig = _getEffectiveConfig(instanceId, userId, interface)
# Determine effective join mode
joinMode = body.joinMode
if not joinMode:
# Default: check if a system bot exists for this mandate
systemBot = interface.getActiveSystemBot(mandateId)
if systemBot:
joinMode = TeamsbotJoinMode.SYSTEM_BOT
elif effectiveConfig.botAccountEmail and effectiveConfig.botAccountPassword:
# Legacy fallback: credentials in config (will be removed in future)
joinMode = TeamsbotJoinMode.SYSTEM_BOT
else:
joinMode = TeamsbotJoinMode.ANONYMOUS
# Resolve credentials based on join mode
effectiveEmail = None
effectivePassword = None
if joinMode == TeamsbotJoinMode.SYSTEM_BOT:
# First try: system bot from database (secure, encrypted)
systemBot = interface.getActiveSystemBot(mandateId)
if systemBot:
effectiveEmail = systemBot.get("email")
encPwd = systemBot.get("encryptedPassword")
if encPwd:
from modules.shared.configuration import handleSecretText
effectivePassword = handleSecretText(encPwd, userId="system", keyName="systemBotPassword")
# Fallback: legacy credentials from config (will be deprecated)
if not effectiveEmail:
effectiveEmail = effectiveConfig.botAccountEmail
effectivePassword = effectiveConfig.botAccountPassword
elif joinMode == TeamsbotJoinMode.USER_ACCOUNT:
# TODO: Resolve OAuth token from user's Microsoft connection
logger.info(f"User account join mode requested but not yet implemented - falling back to anonymous")
joinMode = TeamsbotJoinMode.ANONYMOUS
# ANONYMOUS mode: no credentials
# Determine effective join mode and bot name.
# NOTE: Authentication is currently disabled. The bot always joins as an anonymous
# guest with the system bot's display name. See Teamsbot-Auth-Join-Learnings.md.
# Credentials are NOT sent to the browser bot.
joinMode = body.joinMode or TeamsbotJoinMode.ANONYMOUS
effectiveBotName = body.botName
# Build session config with resolved credentials and user settings
# If a system bot exists, use its display name as the bot name (e.g. "Nyla Larsson")
systemBot = interface.getActiveSystemBot(mandateId)
if systemBot:
if not effectiveBotName:
effectiveBotName = systemBot.get("name") or effectiveConfig.botName
logger.info(f"System bot found: {systemBot.get('name')} ({systemBot.get('email')}), using name: {effectiveBotName}")
if not effectiveBotName:
effectiveBotName = effectiveConfig.botName
# Update session with the effective bot name (may differ from initial creation)
if effectiveBotName != (body.botName or config.botName):
interface.updateSession(sessionId, {"botName": effectiveBotName})
# Build session config — no credentials sent (auth disabled)
sessionConfig = effectiveConfig.model_copy(update={
"botAccountEmail": effectiveEmail,
"botAccountPassword": effectivePassword,
"botAccountEmail": None,
"botAccountPassword": None,
"botName": effectiveBotName,
})
# Start the bot in background (join meeting via bridge)