From b08355ee45ce3b03f7756ad28097a7585a3e562a Mon Sep 17 00:00:00 2001
From: patrick-motsch <p.motsch@valueon.ch>
Date: Mon, 16 Feb 2026 21:37:37 +0100
Subject: [PATCH] teams test auth bot

---
 .../features/teamsbot/routeFeatureTeamsbot.py | 67 +++++++++++++++++++
 1 file changed, 67 insertions(+)

diff --git a/modules/features/teamsbot/routeFeatureTeamsbot.py b/modules/features/teamsbot/routeFeatureTeamsbot.py
index 7491e132..18a560ce 100644
--- a/modules/features/teamsbot/routeFeatureTeamsbot.py
+++ b/modules/features/teamsbot/routeFeatureTeamsbot.py
@@ -700,6 +700,73 @@ async def testVoice(
         raise HTTPException(status_code=500, detail=f"TTS-Test fehlgeschlagen: {str(e)}")
 
 
+# =========================================================================
+# Auth Detection Test Endpoint
+# =========================================================================
+
+@router.post("/{instanceId}/test-auth")
+@limiter.limit("3/minute")
+async def testAuth(
+    request: Request,
+    instanceId: str,
+    context: RequestContext = Depends(getRequestContext),
+):
+    """
+    Run auth detection tests against a Teams meeting URL.
+    Tests 5 browser configuration variants to determine which ones
+    receive the /v2/ (authenticated) vs light-meetings (anonymous) page.
+    Does NOT join the meeting — only checks which page Teams serves.
+    """
+    import aiohttp
+
+    mandateId = _validateInstanceAccess(instanceId, context)
+    interface = _getInterface(context, instanceId)
+    effectiveConfig = _getInstanceConfig(instanceId)
+
+    body = await request.json()
+    meetingUrl = body.get("meetingUrl")
+    if not meetingUrl:
+        raise HTTPException(status_code=400, detail="meetingUrl is required")
+
+    # Load system bot credentials for the auth test variant
+    email = None
+    password = None
+    systemBot = interface.getActiveSystemBot(mandateId)
+    if systemBot:
+        email = systemBot.get("email")
+        encryptedPwd = systemBot.get("encryptedPassword")
+        if encryptedPwd:
+            from modules.shared.configuration import decryptValue
+            password = decryptValue(encryptedPwd, userId=str(context.user.id), keyName="systemBotPassword")
+
+    # Forward to browser bot service
+    browserBotUrl = effectiveConfig._getEffectiveBrowserBotUrl()
+    if not browserBotUrl:
+        raise HTTPException(status_code=503, detail="Browser Bot URL not configured")
+
+    browserBotUrl = browserBotUrl.rstrip("/")
+    payload = {
+        "meetingUrl": meetingUrl,
+        "botAccountEmail": email,
+        "botAccountPassword": password,
+    }
+
+    try:
+        # Generous timeout: 5 variants × ~45s each = ~225s max
+        timeout = aiohttp.ClientTimeout(total=300)
+        async with aiohttp.ClientSession(timeout=timeout) as session:
+            async with session.post(f"{browserBotUrl}/api/bot/test-auth", json=payload) as resp:
+                if resp.status == 200:
+                    return await resp.json()
+                else:
+                    errorText = await resp.text()
+                    logger.error(f"Auth test failed: {resp.status} - {errorText}")
+                    raise HTTPException(status_code=resp.status, detail=f"Browser Bot error: {errorText}")
+    except aiohttp.ClientError as e:
+        logger.error(f"Auth test connection error: {e}")
+        raise HTTPException(status_code=503, detail=f"Browser Bot connection failed: {str(e)}")
+
+
 # =========================================================================
 # Browser Bot Communication Endpoints (HTTP Fallback + WebSocket)
 # =========================================================================