Route BotBuilder auth through HttpServer.handle_request

[heyitsaamir]

Summary

• Make HttpServer.handle_request public so plugins can route through SDK-level JWT validation
• Change DI from HttpServerAdapter to HttpServer — plugins now inject HttpServer and access the adapter via .adapter
• BotBuilderPlugin runs CloudAdapter auth first, then calls http_server.handle_request() for SDK auth + Teams pipeline (previously bypassed TokenValidator entirely)
• Remove pass-through methods (register_route, serve_static, start, stop) from HttpServer — callers go through server.adapter directly

Test plan

• uv run pyright — no new type errors
• poe test — all apps, botbuilder, mcpplugin tests pass (153 tests)

[Copilot]

Pull request overview

This PR updates the HTTP server and plugin integration so plugins (notably BotBuilder) can route inbound activity requests through HttpServer.handle_request() to ensure SDK-level JWT validation and the Teams activity pipeline are applied consistently.

Changes:

• Made HttpServer.handle_request public and wired it as the default /api/messages handler.
• Switched plugin DI from HttpServerAdapter to HttpServer (accessing adapters via .adapter).
• Updated BotBuilderPlugin to run CloudAdapter auth first, then forward to http_server.handle_request(); removed HttpServer pass-through lifecycle/route helpers and updated call sites/tests accordingly.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/mcpplugin/src/microsoft_teams/mcpplugin/server_plugin.py	Update DI to HttpServer and mount MCP FastAPI app via http_server.adapter.
packages/botbuilder/tests/test_botbuilder_plugin.py	Adjust tests for new DI shape and verify routing through HttpServer.handle_request.
packages/botbuilder/src/microsoft_teams/botbuilder/botbuilder_plugin.py	Register /api/messages via http_server.adapter and forward requests through http_server.handle_request() after CloudAdapter processing.
packages/apps/tests/test_http_server.py	Update tests to call server.handle_request() (public API) instead of private handler.
packages/apps/tests/test_app.py	Update app lifecycle and route/static serving tests to call server.adapter.* after removing HttpServer pass-through methods.
packages/apps/src/microsoft_teams/apps/http/http_server.py	Expose handle_request() publicly, use it as default /api/messages handler, and remove pass-through adapter methods.
packages/apps/src/microsoft_teams/apps/app.py	Provide HttpServer via DI and call adapter lifecycle/static/route APIs directly.
packages/a2aprotocol/src/microsoft_teams/a2a/server/plugin.py	Update DI to HttpServer and mount A2A FastAPI app via http_server.adapter.

---

You can also share your feedback on Copilot code review. Take the survey.