NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(microsoft-integration): enhance email permissions and consent flow for Outlook integration

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-10 14:42:19 +02:00
parent 8a930f572c
commit 291fb761c7
7 changed files with 95 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/integrations/microsoft.php
+21 -11
View File
@@ -10,7 +10,7 @@ require_once __DIR__ . '/../../config/database.php';
const MS_OAUTH_AUTHORIZE_URL = 'https://login.microsoftonline.com/%s/oauth2/v2.0/authorize';
const MS_OAUTH_TOKEN_URL = 'https://login.microsoftonline.com/%s/oauth2/v2.0/token';
const MS_GRAPH_BASE_URL = 'https://graph.microsoft.com/v1.0';
const MS_DEFAULT_SCOPES = 'offline_access User.Read Calendars.ReadWrite Mail.ReadWrite Mail.Send';
const MS_DEFAULT_SCOPES = 'offline_access User.Read Calendars.ReadWrite Mail.ReadWrite Mail.Send OnlineMeetings.ReadWrite';
/**
* Haalt de centrale Microsoft App Registratie configuratie op (Client ID, Secret, Tenant ID)
@@ -125,7 +125,7 @@ function microsoft_get_app_config(): array {
/**
* Genereert de Microsoft OAuth2 login URL
*/
function microsoft_get_auth_url(string $clientId, string $redirectUri, string $tenantId = '', string $state = ''): string {
function microsoft_get_auth_url(string $clientId, string $redirectUri, string $tenantId = '', string $state = '', bool $forceConsent = false): string {
$tenant = (!empty($tenantId) && $tenantId !== 'common') ? trim($tenantId) : 'planningsagenda.nl';
$baseUrl = sprintf(MS_OAUTH_AUTHORIZE_URL, urlencode($tenant));
@@ -136,7 +136,7 @@ function microsoft_get_auth_url(string $clientId, string $redirectUri, string $t
'response_mode' => 'query',
'scope' => MS_DEFAULT_SCOPES,
'state' => $state,
'prompt' => 'select_account',
'prompt' => $forceConsent ? 'consent' : 'select_account',
];
return $baseUrl . '?' . http_build_query($params);
@@ -1038,16 +1038,26 @@ function microsoft_fetch_inbox_messages(int $userId, int $limit = 25, bool $unre
]);
if ($res['status'] !== 200 || !isset($res['json']['value'])) {
error_log("Microsoft fetch inbox error: HTTP {$res['status']} - " . ($res['error'] ?? json_encode($res['json'])));
// Val terug op demo data indien API fout optreedt
$graphError = $res['json']['error']['message'] ?? ($res['error'] ?? 'HTTP ' . $res['status']);
$graphCode = $res['json']['error']['code'] ?? '';
error_log("Microsoft fetch inbox error: HTTP {$res['status']} [{$graphCode}] - {$graphError}");
$demo = microsoft_get_mail_demo_data();
$needsReconsent = ($res['status'] === 403 || stripos($graphError, 'access') !== false || stripos($graphError, 'privilege') !== false || stripos($graphError, 'denied') !== false || stripos($graphError, 'consent') !== false);
return [
'success' => true,
'is_demo' => true,
'messages' => array_slice($demo, 0, $limit),
'unread_count' => count(array_filter($demo, function($m) { return empty($m['is_read']); })),
'total_count' => count($demo),
'warning' => 'Kon live e-mails niet ophalen van Microsoft Graph. Demomodus actief.',
'success' => true,
'is_demo' => true,
'messages' => array_slice($demo, 0, $limit),
'unread_count' => count(array_filter($demo, function($m) { return empty($m['is_read']); })),
'total_count' => count($demo),
'warning' => $needsReconsent
? 'Je Microsoft koppeling mist machtiging voor e-mail (Mail.ReadWrite). Autoriseer opnieuw om je inbox live in te laden.'
: 'Kon live e-mails niet ophalen van Microsoft Graph (' . $graphError . '). Demomodus actief.',
'needs_reconsent' => $needsReconsent,
'graph_error' => $graphError,
'graph_code' => $graphCode,
'http_status' => $res['status'],
];
}