Support Entra inbound Agent ID tokens

[heyitsaamir]

Adds support for validating inbound Entra ID tokens (used by Agent 365) alongside existing BotFramework tokens:

• ServiceTokenValidator now routes tokens based on issuer — Entra vs BotFramework
• Decodes unverified JWT payload to inspect iss and tid claims
• Per-tenant Entra JwtValidator instances with bounded LRU cache (max 100)
• Entra tokens validated against tenant-specific OIDC metadata
• Exports decodeJwtPayload from jwt-validator for pre-validation inspection

Note: Does not currently do service url validation (not present in Token)

[heyitsaamir]

This change is part of the following stack:

• DNP - Feature Branch ACF support #627
  • Add Agent 365 token support #628
    • Support Entra inbound Agent ID tokens #629 ◀
      • Add agentic auth provider infrastructure #630
        • Add AgenticIdentity API surface #631
          • Add agentic send helpers #632

_{Change managed by git-spice.}

[heyitsaamir]

Addressed all review comments:

"kind of a weird thing to test for JwtValidator construction times" — Agreed, removed. Now testing behavior (correct args to validateAccessToken) rather than constructor call counts.

"No need for this" / "But wait why is it called twice?" — It was called twice because once in the constructor (BotFramework validator) and once for the Entra validator. Removed those assertions — they were testing implementation details. Cache test now checks cache.size directly.

"Do we really need to mock JwtValidator? Can't we just call it?" — We need the mock because the real JwtValidator makes HTTP calls to JWKS endpoints (e.g. login.botframework.com/v1/.well-known/keys) to fetch signing keys for signature verification. Can't do that with synthetic test tokens. Added a comment explaining this.

[Copilot]

Pull request overview

Adds support for validating inbound Microsoft Entra ID JWTs (Agent 365) in addition to existing Bot Framework service tokens, by routing validation based on the token issuer and using tenant-specific Entra validation configuration.

Changes:

• Route tokens by unverified iss claim (Entra vs Bot Framework) and validate Entra tokens with per-tenant JwtValidator instances cached by tid.
• Add decodeJwtPayload export to enable pre-validation inspection of JWT payload claims.
• Extend unit tests to cover issuer routing, Entra tid requirements, and validator caching behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
packages/apps/src/middleware/auth/service-token-validator.ts	Adds issuer-based routing and per-tenant Entra validator cache.
packages/apps/src/middleware/auth/service-token-validator.spec.ts	Updates mocks and adds tests for Entra/Bot Framework routing and cache bounding.
packages/apps/src/middleware/auth/jwt-validator.ts	Exposes a helper to decode JWT payloads without verification for routing/inspection.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

[corinagum]

Qq: for Agent 365, is the bot's appId the same registration as the "blueprint app id" these Entra tokens are minted for?

[heyitsaamir]

Qq: for Agent 365, is the bot's appId the same registration as the "blueprint app id" these Entra tokens are minted for?

Yup. Bot's app id == blueprint id