Fix UnauthorizedAccessException with skipAuth

[rajan-chari]

Summary

Fixes #274: UnauthorizedAccessException thrown when using builder.AddTeams(skipAuth: true)

Changes

1. Token handling for skipAuth scenarios

• ExtractToken() now returns null when no Authorization header (instead of throwing)
• Created AnonymousToken class that implements IToken with default values (empty appId, serviceUrl from activity, etc.)
• When no auth header is present, creates AnonymousToken - matches Python/TypeScript SDK behavior
• Made ActivityEvent.Token nullable with null-conditional access in consumers

2. ServiceUrl normalization fix

• Added NormalizeServiceUrl() helper in Client base class
• All API clients now ensure serviceUrl has trailing slash
• Fixes 404 errors when AgentsPlayground sends serviceUrl without trailing slash (e.g., http://localhost:56150/_connector → http://localhost:56150/_connector/)

Files Changed

• Libraries/Microsoft.Teams.Api/Auth/AnonymousToken.cs (new)
• Libraries/Microsoft.Teams.Api/Clients/Client.cs
• Libraries/Microsoft.Teams.Api/Clients/ActivityClient.cs
• Libraries/Microsoft.Teams.Api/Clients/ApiClient.cs
• Libraries/Microsoft.Teams.Api/Clients/ConversationClient.cs
• Libraries/Microsoft.Teams.Api/Clients/MeetingClient.cs
• Libraries/Microsoft.Teams.Api/Clients/MemberClient.cs
• Libraries/Microsoft.Teams.Api/Clients/TeamClient.cs
• Libraries/Microsoft.Teams.Apps/App.cs
• Libraries/Microsoft.Teams.Apps/Events/ActivityEvent.cs
• Libraries/Microsoft.Teams.Plugins/Microsoft.Teams.Plugins.AspNetCore/AspNetCorePlugin.cs
• Tests/Microsoft.Teams.Plugins.AspNetCore.Tests/AspNetCorePluginTests.cs

Test plan

• Added Test_ExtractToken_ReturnsNull_WhenNoAuthHeader test
• Updated Test_Do_Http_WorksWithoutAuthHeader to verify AnonymousToken is created
• All 1,148 existing tests pass
• Manually tested with AgentsPlayground and Samples.Echo - bot responses work correctly

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes issue #274 where UnauthorizedAccessException was thrown when using skipAuth: true mode. The fix makes the authentication token optional throughout the Teams SDK to support anonymous/unauthenticated scenarios.

Changes:

• Modified ExtractToken() to return null instead of throwing an exception when no Authorization header is present
• Changed ActivityEvent.Token from required to nullable to allow activities without authentication
• Added null-conditional operators when accessing Token properties in App.cs

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
Libraries/Microsoft.Teams.Plugins/Microsoft.Teams.Plugins.AspNetCore/AspNetCorePlugin.cs	Changed ExtractToken() to return null when Authorization header is missing instead of throwing
Libraries/Microsoft.Teams.Apps/Events/ActivityEvent.cs	Made Token property nullable to support unauthenticated scenarios
Libraries/Microsoft.Teams.Apps/App.cs	Added null-conditional operators when accessing Token.ServiceUrl, Token.AppId, and Token.TenantId
Tests/Microsoft.Teams.Plugins.AspNetCore.Tests/AspNetCorePluginTests.cs	Added tests for ExtractToken returning null and Do() working without auth header

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (4)

Libraries/Microsoft.Teams.Api/Clients/ApiClient.cs:24

• The nested client instantiations (Conversations, Teams, Meetings) receive the unnormalized serviceUrl parameter instead of the normalized ServiceUrl property. This means that even though the ApiClient's ServiceUrl property is normalized, the nested clients will receive URLs without trailing slashes, potentially causing 404 errors.

The pattern should be:

Conversations = new ConversationClient(ServiceUrl, _http, cancellationToken);
Teams = new TeamClient(ServiceUrl, _http, cancellationToken);
Meetings = new MeetingClient(ServiceUrl, _http, cancellationToken);

This applies to lines 21, 23-24 in the first constructor.

        Conversations = new ConversationClient(serviceUrl, _http, cancellationToken);
        Users = new UserClient(_http, cancellationToken);
        Teams = new TeamClient(serviceUrl, _http, cancellationToken);
        Meetings = new MeetingClient(serviceUrl, _http, cancellationToken);

Libraries/Microsoft.Teams.Api/Clients/ApiClient.cs:34

• The nested client instantiations (Conversations, Teams, Meetings) receive the unnormalized serviceUrl parameter instead of the normalized ServiceUrl property. This means that even though the ApiClient's ServiceUrl property is normalized, the nested clients will receive URLs without trailing slashes, potentially causing 404 errors.

The pattern should be:

Conversations = new ConversationClient(ServiceUrl, _http, cancellationToken);
Teams = new TeamClient(ServiceUrl, _http, cancellationToken);
Meetings = new MeetingClient(ServiceUrl, _http, cancellationToken);

        Conversations = new ConversationClient(serviceUrl, _http, cancellationToken);
        Users = new UserClient(_http, cancellationToken);
        Teams = new TeamClient(serviceUrl, _http, cancellationToken);
        Meetings = new MeetingClient(serviceUrl, _http, cancellationToken);

Libraries/Microsoft.Teams.Api/Clients/ApiClient.cs:44

• The nested client instantiations (Conversations, Teams, Meetings) receive the unnormalized serviceUrl parameter instead of the normalized ServiceUrl property. This means that even though the ApiClient's ServiceUrl property is normalized, the nested clients will receive URLs without trailing slashes, potentially causing 404 errors.

The pattern should be:

Conversations = new ConversationClient(ServiceUrl, _http, cancellationToken);
Teams = new TeamClient(ServiceUrl, _http, cancellationToken);
Meetings = new MeetingClient(ServiceUrl, _http, cancellationToken);

        Conversations = new ConversationClient(serviceUrl, _http, cancellationToken);
        Users = new UserClient(_http, cancellationToken);
        Teams = new TeamClient(serviceUrl, _http, cancellationToken);
        Meetings = new MeetingClient(serviceUrl, _http, cancellationToken);

Libraries/Microsoft.Teams.Api/Clients/ApiClient.cs:54

• The nested client instantiations (Conversations, Teams, Meetings) receive the unnormalized serviceUrl parameter instead of the normalized ServiceUrl property. This means that even though the ApiClient's ServiceUrl property is normalized, the nested clients will receive URLs without trailing slashes, potentially causing 404 errors.

The pattern should be:

Conversations = new ConversationClient(ServiceUrl, _http, cancellationToken);
Teams = new TeamClient(ServiceUrl, _http, cancellationToken);
Meetings = new MeetingClient(ServiceUrl, _http, cancellationToken);

        Conversations = new ConversationClient(serviceUrl, _http, cancellationToken);
        Users = new UserClient(_http, cancellationToken);
        Teams = new TeamClient(serviceUrl, _http, cancellationToken);
        Meetings = new MeetingClient(serviceUrl, _http, cancellationToken);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

When activity.ServiceUrl is an empty string (not null), it will be passed to AnonymousToken, which will normalize it to just "/" due to the trailing slash logic. This could cause issues when making API calls. Consider using string.IsNullOrEmpty(activity.ServiceUrl) instead of just the null coalescing operator to ensure empty strings also fall back to the default service URL.

[Copilot]

The constructor accepts a serviceUrl parameter that could be an empty string. When an empty string is passed, the normalization logic will convert it to "/", which is not a valid service URL. Consider adding validation to handle empty strings, either by throwing an exception or falling back to a default service URL like "https://smba.trafficmanager.net/teams".

Suggested change

	// Ensure serviceUrl has trailing slash for consistency
	ServiceUrl = serviceUrl.EndsWith('/') ? serviceUrl : serviceUrl + '/';
	// Use a default service URL if the provided value is null, empty, or whitespace
	var normalizedServiceUrl = string.IsNullOrWhiteSpace(serviceUrl)
	? "https://smba.trafficmanager.net/teams"
	: serviceUrl;
	// Ensure serviceUrl has trailing slash for consistency
	ServiceUrl = normalizedServiceUrl.EndsWith('/')
	? normalizedServiceUrl
	: normalizedServiceUrl + '/';