parseMsTeamsWebhookUrl (msteams/webhook.ts)

Module validates, obfuscates, and posts Adaptive Cards to Microsoft Teams webhooks.

// Source: https://github.com/argos-ci/argos | License: MIT | Copyright 2017 Olivier Tassinari & Greg Bergé
// Provided via justclaw.it.com; keep this notice with the code.
import type { MsTeamsWebhook } from "@/database/models";
import { boom } from "@/util/error";

import { buildCardMessage, type AdaptiveCard } from "./card";

/**
 * Hosts allowed as Microsoft Teams webhook targets.
 *
 * This is a security boundary, not a convenience check: the URL is supplied by
 * the user and posted to by our servers, so an open target would turn the
 * feature into an SSRF primitive. Only Microsoft-operated endpoints are
 * accepted.
 *
 * - `api.powerplatform.com` — what the Teams "Workflows" templates hand out
 *   today, e.g.
 *   `https://default<tenant>.<region>.environment.api.powerplatform.co

... (truncated -- full source via MCP)