mcscatblog/posts/connector-consent-card-obo/

[utterances-bot]

Intercepting and Responding to Connector Consent Cards via the Agents SDK | The Custom Engine

Detect a connector consent (OBO) Adaptive Card, summarize it, and submit Allow or Cancel.

https://microsoft.github.io/mcscatblog/posts/connector-consent-card-obo/

[jlars11]

Great blog Adi. Assuming no, but can this be used to intercept the card in channels like teams/m365? I am working with a customer that would like to change the cards language in the channels.

[mrochon]

Exactly the issue I am trying to address! However, I am battling with implementing your recommendations. My client is Javascript. I figured out that to detect the relevant card, I need to test for 'Agent needs your permission' string. However, when I send the response using above example the agent goes into error handling Topic and responds with 'I'm sorry, I encountered an error while processing your message. Please try again.'. Can you confirm whether the above response format is correct? What else can I do to debug this?

[mrochon]

Sorry, that response was from my code. The agent's response was:

Error sending message: ZodError: [
  {
    "code": "invalid_type",
    "expected": "string",
    "received": "object",
    "path": [
      "text"
    ],
    "message": "Expected string, received object"
  }
]

[mrochon]

The following code works for me (I think the consent here is related to the agent's use of an MCP tool - the next message after consent was a request from the agent to open a web page to connect to the tool with user's security context):

  private isConsentCard(activity: any): boolean {
    if (!activity?.attachments || !Array.isArray(activity.attachments) || activity.attachments.length === 0) {
      return false;
    }

    const attachment = activity.attachments[0] as any;
    if (!attachment?.content?.body || !Array.isArray(attachment.content.body)) {
      return false;
    }
     const hasConnectText = attachment.content.body.some((item: any) => 
      item.type === 'TextBlock' && 
      item.text && 
      item.text.includes('Agent needs your permission to continue')
    );

    if (!hasConnectText) {
      return false;
    }
    return true;
  }

  private async respondToConsentCard(userChoice: 'Allow' | 'Cancel'): Promise<Activity[]> {
    if (!this.client || !this.conversationId) {
      throw new Error('Client or conversation not initialized');
    }

    const consentActivity = {
      type: 'message',
      from: {
        id: 'user'
      },
      channelData: {
        postBack: true
      },
      value: {
        action: userChoice,
        id: 'submit'
      }
    } as any;

    const activities = await this.client.sendActivity(consentActivity, this.conversationId);
    console.log('Received activities after consent response:', activities);
    return activities;
  }

  async sendMessage(message: string): Promise<string> {
    if (!this.client || !this.conversationId) {
      throw new Error('Client or conversation not initialized');
    }

    try {
      let activities = await this.client.askQuestionAsync(message, this.conversationId);
      console.log('Received activities from Copilot Studio:', activities);
      
      const consentActivity = activities.find(activity => this.isConsentCard(activity));
      if (consentActivity) {
        console.log('Consent card detected, automatically sending Allow response');
        // Automatically respond with "Allow" and get the next set of activities
        activities = await this.respondToConsentCard('Allow');
      }
      ...

[adilei]

Great blog Adi. Assuming no, but can this be used to intercept the card in channels like teams/m365? I am working with a customer that would like to change the cards language in the channels.

It is possible with an Agents SDK relay, but that would be costly. Is this message not localized when the appropriate system language is set?

[adilei]

The following code works for me (I think the consent here is related to the agent's use of an MCP tool - the next message after consent was a request from the agent to open a web page to connect to the tool with user's security context):

private isConsentCard(activity: any): boolean {
if (!activity?.attachments || !Array.isArray(activity.attachments) || activity.attachments.length === 0) {
return false;
}

const attachment = activity.attachments[0] as any;
if (!attachment?.content?.body || !Array.isArray(attachment.content.body)) {
  return false;
}
 const hasConnectText = attachment.content.body.some((item: any) => 
  item.type === 'TextBlock' && 
  item.text && 
  item.text.includes('Agent needs your permission to continue')
);

if (!hasConnectText) {
  return false;
}
return true;

}

private async respondToConsentCard(userChoice: 'Allow' | 'Cancel'): Promise<Activity[]> {
if (!this.client || !this.conversationId) {
throw new Error('Client or conversation not initialized');
}

const consentActivity = {
  type: 'message',
  from: {
    id: 'user'
  },
  channelData: {
    postBack: true
  },
  value: {
    action: userChoice,
    id: 'submit'
  }
} as any;

const activities = await this.client.sendActivity(consentActivity, this.conversationId);
console.log('Received activities after consent response:', activities);
return activities;

}

async sendMessage(message: string): Promise {
if (!this.client || !this.conversationId) {
throw new Error('Client or conversation not initialized');
}

try {
  let activities = await this.client.askQuestionAsync(message, this.conversationId);
  console.log('Received activities from Copilot Studio:', activities);
  
  const consentActivity = activities.find(activity => this.isConsentCard(activity));
  if (consentActivity) {
    console.log('Consent card detected, automatically sending Allow response');
    // Automatically respond with "Allow" and get the next set of activities
    activities = await this.respondToConsentCard('Allow');
  }
  ...

Glad it's working, although I don't know if I would auto-send an 'Allow' response, without prompting the user first. Consent cards are there to let users now we are signing in to additional services on their behalf.