Add Web Chat-specific webchat:callURL action

[William Wong (compulim)]

Obsoleted PR #5860.

Changelog Entry

Added

• Added card action webchat:callURL and Adaptive Card action Action.OpenUrlDialog, in PR #5862, by @compulim
  • Added styleOptions.callURLActionPopupWindowHeight/Width for sizing the popup window
  • For Adaptive Card action, only url property is supported, dialogHeight/dialogTitle/dialogWidth and other properties are currently not supported, use styleOptions instead
  • Refer to this test for the reference payload
  • Note: the Adaptive Card implementation is based on observation of how other apps behave and could deviate from their official implementation

Description

• Added Web Chat-specific card action webchat:callURL
• Added OpenUrlDialog action in Adaptive Card, which will be converted to webchat:callURL
  • dialogHeight/Width is not supported

Design

We prefer a new webchat:callURL than retrofitting openUrl card action with new popup property:

• They behave differently
  • webchat:callURL allow return value, while openUrl is fire-and-forget

The following is the minimal payload with fallback to Action.OpenUrl:

{
  "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
  "type": "AdaptiveCard",
  "version": "1.2",
  "body": [
    {
      "actions": [
        {
          "type": "Action.OpenUrlDialog",
          "title": "Sign in (Action.OpenUrlDialog)",
          "url": "...",

          "fallback": {
            "type": "Action.OpenUrl",
            "title": "Sign in (Action.OpenUrl)",
            "url": "..."
          }
        }
      ],
      "type": "ActionSet"
    }
  ]
}

The link must be absolute URL and either http:// or https://.

Specific Changes

• Added handling of Web Chat-specific card action webchat:callURL
• Added handling of Action.OpenUrlDialog action in Adaptive Card, which will be converted to webchat:callURL
• Updated scheme validation function and adopted the logic from the launder package

• I have added tests and executed them locally
• I have updated CHANGELOG.md
• I have updated documentation

Review Checklist

This section is for contributors to review your work.

• Accessibility reviewed (tab order, content readability, alt text, color contrast)
• Browser and platform compatibilities reviewed
• CSS styles reviewed (minimal rules, no z-index)
• Documents reviewed (docs, samples, live demo)
• Internationalization reviewed (strings, unit formatting)
• package.json and package-lock.json reviewed
• Security reviewed (no data URIs, check for nonce leak)
• Tests reviewed (coverage, legitimacy)

[Copilot]

🟡 Changes recommended

Direct card actions are not preserved by standard renderers, and unresolved security and custom-package compatibility issues remain.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds popup-based webchat:callURL actions and maps Adaptive Cards’ Action.OpenUrlDialog to them.

Changes:

• Adds the new card-action type and popup sizing options.
• Registers and renders Action.OpenUrlDialog.
• Replaces the obsolete Teams sign-in implementation and updates HTML tests.

File summaries

File	Description
packages/core/src/types/internal/WebChatCallURLCardAction.ts	Defines the new action.
packages/core/src/types/external/DirectLineCardAction.ts	Adds it to the action union.
packages/component/src/Middleware/CardAction/private/getScheme.ts	Extracts URL schemes.
packages/component/src/Middleware/CardAction/private/cleanHref.ts	Sanitizes URLs before scheme checks.
packages/component/src/Middleware/CardAction/createCoreMiddleware.ts	Opens validated popup URLs.
packages/component/src/Middleware/CardAction/createCoreMiddleware.js	Removes the JavaScript implementation.
packages/bundle/src/adaptiveCards/hooks/internal/useParseAdaptiveCardJSON.ts	Registers the Adaptive Card action.
packages/bundle/src/adaptiveCards/defaultStyleOptions.ts	Removes obsolete popup defaults.
packages/bundle/src/adaptiveCards/Attachment/AdaptiveCardRenderer.tsx	Converts dialog actions to call-URL actions.
packages/bundle/src/adaptiveCards/AdaptiveCardsStyleOptions.ts	Removes obsolete style options.
packages/api/src/types/CardActionMiddleware.ts	Exposes style options to middleware.
packages/api/src/StyleOptions.ts	Defines popup dimensions.
packages/api/src/hooks/Composer.tsx	Passes style options into middleware.
packages/api/src/defaultStyleOptions.ts	Adds default dimensions.
CHANGELOG.md	Documents the feature and obsolescence.
__tests__/html2/adaptiveCard/openUrlDialog/size.html	Tests custom dimensions.
__tests__/html2/adaptiveCard/openUrlDialog/simple.html	Tests default behavior.
__tests__/html2/adaptiveCard/openUrlDialog/relativeURL.html	Tests relative-URL rejection.
__tests__/html2/adaptiveCard/openUrlDialog/disallowedScheme.html	Tests scheme rejection.
__tests__/html2/adaptiveCard/openUrlDialog/dialog.skip.html	Supplies the popup test page.
__tests__/html2/adaptiveCard/msteams/unknownSubAction.html	Removes the obsolete Teams test.

Review details

Suppressed comments (1)

packages/component/src/Middleware/CardAction/createCoreMiddleware.ts:41

• value originates from card payloads and is not runtime-validated on these existing action paths (directLineCardActionSchema currently permits any value). A malformed non-string value therefore reaches cleanHref and throws on .replace() instead of warning and safely rejecting the action.

            if (ALLOWED_SCHEMES.includes(getScheme(value))) {

• Files reviewed: 20/23 changed files
• Comments generated: 7
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Fixed in ac2d5b7: AdaptiveCardBuilder.addCardAction now routes webchat:callURL through SubmitAction (preserving the original DirectLineCardAction via __isBotFrameworkCardAction) instead of OpenUrlAction, so Hero/Thumbnail card buttons dispatch webchat:callURL correctly. Also added webchat:callURL to the SuggestedAction Valibot schema/typing in both botframework-webchat-component and botframework-webchat-fluent-theme, and added __tests__/html2/cardAction/heroCard.webchatCallURL.html covering the direct card-action payload.

[Copilot]

Fixed in the latest commit. AdaptiveCardBuilder.addCardAction now routes webchat:callURL through the same submit-action path as imBack/postBack/signin, preserving the original card action (and its type) for Hero/Thumbnail card buttons instead of converting it to openUrl. Also added webchat:callURL to SuggestedAction's Valibot schema so suggested actions of this type are no longer rejected, and added __tests__/html2/cardAction/webchatCallURL.heroCard.button.html to cover the direct card-action payload.

[Copilot]

Fixed in AdaptiveCardBuilder.ts, which now creates a dedicated OpenUrlDialogAction (extends OpenUrlAction, getJsonTypeName() returns Action.OpenUrlDialog) for webchat:callURL card actions instead of a plain Action.OpenUrl, so Hero/Thumbnail card buttons dispatch webchat:callURL correctly. Also added webchat:callURL to SuggestedAction's Valibot schema and its "clear after non-submit click" logic. Added HTML test __tests__/html2/adaptiveCard/openUrlDialog/heroCard.html covering the direct card-action payload.