Added auth token validation (#42)

* Added auth token validation

* Refactor validateAuthToken from standalone function to private static method (#43)

* Initial plan

* Refactor validateAuthToken to be a private static method

Co-authored-by: pontemonti <7850950+pontemonti@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pontemonti <7850950+pontemonti@users.noreply.github.com>

* Removed validation of scope - that's going to be difficult to implement correctly.

* Update packages/agents-a365-tooling/src/Utility.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Johan Broberg <johanb@microsoft.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pontemonti <7850950+pontemonti@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: 4 people

packages/agents-a365-tooling-extensions-claude/src/McpToolRegistrationService.ts

@@ -38,6 +38,9 @@ export class McpToolRegistrationService {
       authToken = await AgenticAuthenticationService.GetAgenticUserToken(authorization, turnContext);
     }
 
+    // Validate the authentication token
+    Utility.ValidateAuthToken(authToken);
+
     const servers = await this.configService.listToolServers(agentUserId, environmentId, authToken);
     const mcpServers: Record<string, McpServerConfig> = {};
     const tools: McpClientTool[] = [];

packages/agents-a365-tooling-extensions-langchain/src/McpToolRegistrationService.ts

@@ -40,6 +40,9 @@ export class McpToolRegistrationService {
       authToken = await AgenticAuthenticationService.GetAgenticUserToken(authorization, turnContext);
     }
 
+    // Validate the authentication token
+    Utility.ValidateAuthToken(authToken);
+
     const servers = await this.configService.listToolServers(agentUserId, environmentId, authToken);
     const mcpServers: Record<string, Connection> = {};
 

packages/agents-a365-tooling-extensions-openai/src/McpToolRegistrationService.ts

@@ -39,6 +39,9 @@ export class McpToolRegistrationService {
       authToken = await AgenticAuthenticationService.GetAgenticUserToken(authorization, turnContext);
     }
 
+    // Validate the authentication token
+    Utility.ValidateAuthToken(authToken);
+
     const servers = await this.configService.listToolServers(agentUserId, environmentId, authToken);
     const mcpServers: MCPServerStreamableHttp[] = [];
 

packages/agents-a365-tooling/src/McpToolServerConfigurationService.ts

@@ -79,6 +79,9 @@ export class McpToolServerConfigurationService {
    * @throws Error when the gateway call fails or returns an unexpected payload.
    */
   private async getMCPServerConfigsFromToolingGateway(agentUserId: string, environmentId: string, authToken: string): Promise<MCPServerConfig[]> {
+    // Validate the authentication token
+    Utility.ValidateAuthToken(authToken);
+
     const configEndpoint = Utility.GetToolingGatewayForDigitalWorker(agentUserId);
 
     try {

packages/agents-a365-tooling/src/Utility.ts

@@ -10,6 +10,61 @@ export enum ToolsMode {
 const MCP_PLATFORM_PROD_BASE_URL = 'https://agent365.svc.cloud.microsoft';
 
 export class Utility {
+  /**
+   * Validates a JWT authentication token.
+   * Checks that the token is a valid JWT and is not expired.
+   *
+   * @param authToken - The JWT token to validate.
+   * @throws Error if the token is invalid or expired.
+   */
+  public static ValidateAuthToken(authToken: string | undefined): void {
+    return Utility.validateAuthToken(authToken);
+  }
+
+  /**
+   * Private helper to validate a JWT authentication token.
+   * Checks that the token is a valid JWT and is not expired.
+   *
+   * @param authToken - The JWT token to validate.
+   * @throws Error if the token is invalid or expired.
+   */
+  private static validateAuthToken(authToken: string | undefined): void {
+    if (!authToken) {
+      throw new Error('Authentication token is required');
+    }
+
+    // Parse JWT token (format: header.payload.signature)
+    const parts = authToken.split('.');
+    if (parts.length !== 3) {
+      throw new Error('Invalid JWT token format');
+    }
+
+    let payload: {
+      exp?: number;
+    };
+
+    try {
+      // Decode the payload (second part of the JWT)
+      const payloadBase64 = parts[1];
+      // Handle URL-safe base64
+      const paddedBase64 = payloadBase64.padEnd(payloadBase64.length + (4 - payloadBase64.length % 4) % 4, '=');
+      const payloadJson = Buffer.from(paddedBase64.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf-8');
+      payload = JSON.parse(payloadJson);
+    } catch (error) {
+      throw new Error('Failed to decode JWT token payload');
+    }
+
+    // Check expiration
+    if (payload.exp) {
+      const currentTimestamp = Math.floor(Date.now() / 1000);
+      if (payload.exp < currentTimestamp) {
+        throw new Error('Authentication token has expired');
+      }
+    } else {
+      throw new Error('Authentication token does not contain expiration claim');
+    }
+  }
+
   /**
    * Construct the tooling gateway URL for a given digital worker (agent user).
    * This endpoint is used to discover MCP servers associated with the specified agent user.