feat(oauth): dedup, update oauth/graph samples, add dep markers on legacy methods

[Lily Du (lilyydu)]

PR 5 of the multi-connection OAuth stack.

Problem

Teams fans signin/tokenExchange out to every endpoint the user is signed in on, so one login reaches the bot several times — each copy redeems the token, emits sign_in, and runs the flow's success handlers.

Dedup

Two layers, mirroring the C# SDK:

1. In-flight guard — keyed by exchange id. A duplicate arriving mid-flight awaits the original and returns an equivalent result, including the 412 body on failure. Released on settle, so retrying a failed exchange still works.
2. Completed marker — after success the id is recorded so a late duplicate short-circuits to 200. Held in memory and in conversation state (__oauth:exchange:{id}) for cross-instance coverage, and never cleared — otherwise a late duplicate runs as a fresh exchange.

exchange_token, the sign_in emission, and the success handlers each run exactly once. In-flight is checked first, since the marker is stamped at redemption while the owner still has callbacks to run. Check-and-insert has no await between lookup and insert — that is what makes it atomic on one event loop. Both in-memory structures are bounded (5-minute TTL, 1000-entry cap, pruned on access).

Deduplicated requests return before next(), so concurrent duplicates call it once in total, matching TS. signin/verifyState and signin/failure are deliberately not deduplicated — the verify code is single-use, failure is one informational notice. Tests pin both.

Also included

• ctx.get_token_status → ctx.get_connection_status — it shadowed api.users.get_token_status while behaving differently (the context method adds a silent-SSO correction pass). Matches getConnectionStatus in teams.ts. Added in feat: add multi-connection OAuth registry and flow APIs #561, after every published tag, so no release exposed the old name.
• OAuthFlow.sign_out / get_token / is_signed_in now call api.users.* directly instead of the deprecated context methods, as teams.ts does. Verified equivalent: same request params, logs, return values, and 404 handling. sign_in still delegates — extracting it is a follow-up.
• Legacy single-connection surface deprecated in docstrings only, no decorators, so the supported flow API never warns callers about an API they did not touch.
• examples/oauth now shows multi-connection; examples/graph moved to the flow API, fixing its own copy of the bug — it built a Graph client from ctx.user_token, i.e. whichever connection last exchanged.

NOTE: Once we fully remove the old logic, we need to extractsign_in into a shared module

[Copilot]

Pull request overview

This PR adds deduplication for repeated signin/tokenExchange callbacks in the Teams OAuth handler stack, preventing multiple token redemptions and repeated sign-in side effects when Teams fans out the same exchange to multiple client endpoints.

Changes:

• Add in-process “in-flight” deduplication keyed by exchange id, with waiters mirroring the owning request’s result.
• Persist a completed-exchange marker in conversation state (__oauth:exchange:{id}) plus an in-memory marker to short-circuit late duplicates.
• Add comprehensive regression coverage for concurrent/sequential dedup behavior and update the OAuth example app to demonstrate multi-connection flows (including Graph usage).

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
uv.lock	Adds the Graph workspace package to the oauth example dependency set.
packages/apps/tests/test_app_oauth.py	Updates routing-path test to assert tokenExchange side effects run once for duplicates.
packages/apps/tests/test_app_oauth_dedup.py	New end-to-end tests pinning dedup contract (concurrent, late, failure, state interactions).
packages/apps/src/microsoft_teams/apps/oauth_state.py	Adds persisted completed-exchange marker utilities and pruning logic.
packages/apps/src/microsoft_teams/apps/diagnostics/_constants.py	Introduces an oauth_result=duplicate constant for telemetry.
packages/apps/src/microsoft_teams/apps/app_oauth.py	Implements in-flight guard + completed marker behavior in sign_in_token_exchange.
examples/oauth/src/main.py	Updates example to use state, show multi-connection OAuth flows, and call Graph.
examples/oauth/pyproject.toml	Adds microsoft-teams-graph to example dependencies.

Suppressed comments (1)

packages/apps/src/microsoft_teams/apps/app_oauth.py:363

• In-flight duplicates only stamp the completed marker on the success path. If the owner redeemed the token and then fails (e.g., a sign-in handler raises), the waiter should still stamp the completion marker into its own snapshot before re-raising, otherwise its later save can erase the owner's completion marker (last-write-wins state).

                if outcome.error is not None:
                    result = APP_OAUTH_RESULTS.failure
                    span.set_attribute(APP_ATTRIBUTE_NAMES.oauth_result, result)
                    raise outcome.error
                if outcome.token_redeemed:

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.