feat: warn when bot starts without credentials

packages/apps/src/microsoft_teams/apps/http/http_server.py

@@ -94,6 +94,12 @@ def initialize(
                 cloud=self._cloud,
             )
             logger.debug("JWT validation enabled for %s", self._messaging_endpoint)
+        elif not app_id:
+            logger.warning(
+                "No credentials configured (CLIENT_ID / CLIENT_SECRET / TENANT_ID). "
+                "Bot will accept unauthenticated requests on %s.",
+                self._messaging_endpoint,
+            )
 
         self._adapter.register_route("POST", self._messaging_endpoint, self.handle_request)
         self._initialized = True

packages/apps/tests/test_http_server.py

@@ -74,6 +74,28 @@ def test_initialize_registers_custom_messaging_endpoint(self, mock_adapter):
         assert call_args[0][0] == "POST"
         assert call_args[0][1] == "/bot/incoming"
 
+    def test_initialize_warns_when_no_credentials(self, server, caplog):
+        """Bot started without credentials should log a warning about anonymous traffic."""
+        import logging
+
+        with caplog.at_level(logging.WARNING, logger="microsoft_teams.apps.http.http_server"):
+            server.initialize(credentials=None)
+
+        assert any("No credentials configured" in record.message for record in caplog.records)
+
+    def test_initialize_does_not_warn_with_credentials(self, server, caplog):
+        """Bot started with credentials should not log the anonymous warning."""
+        import logging
+
+        creds = MagicMock()
+        creds.client_id = "test-app"
+        creds.tenant_id = "test-tenant"
+
+        with caplog.at_level(logging.WARNING, logger="microsoft_teams.apps.http.http_server"):
+            server.initialize(credentials=creds)
+
+        assert not any("No credentials configured" in record.message for record in caplog.records)
+
     def test_on_request_setter(self, server):
         """Test on_request callback setter."""