Merge pull request 'feat(microsoft-integration): update Microsoft 365 settings and admin consent handling for improved clarity and functionality' (#38) from dev into main

Reviewed-on: #38

admin.php

@@ -64,7 +64,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         ");
         $stmt->execute([$userId, $isDemo, json_encode($newSettings)]);
 
-        $message = "Centrale Microsoft 365 Azure App instellingen zijn succesvol opgeslagen.";
+        $message = "Centrale Microsoft 365 instellingen (Agenda, E-mail & Teams) zijn succesvol opgeslagen.";
         $messageType = 'success';
     }
 
@@ -390,7 +390,7 @@ require_once __DIR__ . '/includes/header.php';
         <!-- Linkerkolom: Integraties Beheer (8 cols) -->
         <div class="lg:col-span-8 space-y-8">
             
-            <!-- 1. Microsoft 365 Azure App Registratie -->
+            <!-- 1. Microsoft 365 Azure App Registratie (Agenda, E-mail & Teams) -->
             <div class="fociz-card p-6 sm:p-7">
                 <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-4 pb-6 border-b border-slate-100 dark:border-slate-800/80">
                     <div class="flex items-center space-x-3.5">
@@ -399,7 +399,7 @@ require_once __DIR__ . '/includes/header.php';
                         </div>
                         <div>
                             <div class="flex items-center space-x-2">
-                                <h2 class="text-lg font-bold text-slate-900 dark:text-white tracking-tight">Microsoft 365 & Azure App Registratie</h2>
+                                <h2 class="text-lg font-bold text-slate-900 dark:text-white tracking-tight">Microsoft 365 Koppeling (Agenda, E-mail & Teams)</h2>
                                 <?php if ($appConfig['is_configured']): ?>
                                 <span class="px-2.5 py-0.5 rounded-full bg-teal-50 dark:bg-teal-950/40 border border-teal-200 dark:border-teal-800/60 text-teal-700 dark:text-teal-400 text-[10px] font-bold">
                                     Geconfigureerd
@@ -410,12 +410,12 @@ require_once __DIR__ . '/includes/header.php';
                                 </span>
                                 <?php endif; ?>
                             </div>
-                            <p class="text-xs text-slate-500 dark:text-slate-400">Centrale OAuth 2.0 instellingen voor de hele organisatie</p>
+                            <p class="text-xs text-slate-500 dark:text-slate-400">Centrale OAuth 2.0 koppeling voor Outlook Agenda, E-mail (Postvak IN) en Microsoft Teams</p>
                         </div>
                     </div>
 
                     <?php if ($appConfig['is_configured']): ?>
-                    <a href="<?= htmlspecialchars($adminConsentUrl) ?>" target="_blank" rel="noopener noreferrer" class="inline-flex items-center space-x-2 px-3.5 py-2 rounded-xl bg-sky-50 hover:bg-sky-100 dark:bg-sky-950/40 dark:hover:bg-sky-900/40 text-sky-700 dark:text-sky-300 border border-sky-200 dark:border-sky-800/60 text-xs font-semibold transition" title="Verleen namens alle gebruikers beheerdersgoedkeuring in Azure">
+                    <a href="<?= htmlspecialchars($adminConsentUrl) ?>" target="_blank" rel="noopener noreferrer" class="inline-flex items-center space-x-2 px-3.5 py-2 rounded-xl bg-sky-50 hover:bg-sky-100 dark:bg-sky-950/40 dark:hover:bg-sky-900/40 text-sky-700 dark:text-sky-300 border border-sky-200 dark:border-sky-800/60 text-xs font-semibold transition" title="Verleen namens alle gebruikers beheerdersgoedkeuring in Azure voor Agenda, E-mail en Teams">
                         <i data-lucide="shield-check" class="w-4 h-4 text-sky-600 dark:text-sky-400"></i>
                         <span>Admin Consent Verlenen</span>
                         <i data-lucide="external-link" class="w-3.5 h-3.5 text-sky-600 dark:text-sky-400"></i>
@@ -480,10 +480,10 @@ require_once __DIR__ . '/includes/header.php';
 
                     <div class="pt-2 flex items-center justify-between">
                         <div class="text-[11px] text-slate-500 dark:text-slate-400">
-                            Zodra opgeslagen kunnen al uw collega's met 1 klik hun Outlook agenda koppelen.
+                            Zodra opgeslagen en goedgekeurd kunnen al uw collega's met 1 klik hun Outlook agenda én e-mail koppelen.
                         </div>
                         <button type="submit" class="px-5 py-2.5 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-white text-xs font-bold transition shadow-xs cursor-pointer">
-                            Azure Gegevens Opslaan
+                            Microsoft Gegevens Opslaan
                         </button>
                     </div>
                 </form>
@@ -493,7 +493,7 @@ require_once __DIR__ . '/includes/header.php';
                     <button type="button" onclick="toggleAdminGuide()" class="w-full flex items-center justify-between text-xs font-semibold text-slate-700 dark:text-slate-300 hover:text-slate-900 dark:hover:text-white transition cursor-pointer">
                         <span class="flex items-center space-x-2">
                             <i data-lucide="help-circle" class="w-4 h-4 text-sky-500"></i>
-                            <span>Hoe configureer ik de Azure App Registratie in 4 stappen?</span>
+                            <span>Hoe configureer ik de complete Microsoft Koppeling (Agenda, E-mail & Teams) in 4 stappen?</span>
                         </span>
                         <i data-lucide="chevron-down" class="w-4 h-4 transition-transform duration-200" id="guideArrow"></i>
                     </button>
@@ -502,28 +502,36 @@ require_once __DIR__ . '/includes/header.php';
                         <div class="flex items-start space-x-2.5">
                             <span class="w-5 h-5 rounded-full bg-sky-500/20 text-sky-600 dark:text-sky-400 flex items-center justify-center font-bold text-[10px] flex-shrink-0 mt-0.5">1</span>
                             <div>
-                                <strong class="text-slate-900 dark:text-white">Azure Portal:</strong> Ga naar <a href="https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps" target="_blank" class="text-sky-600 dark:text-sky-400 underline">portal.azure.com</a> &rarr; <em>Microsoft Entra ID</em> &rarr; <em>App registrations</em> &rarr; <em>New registration</em>. Kies "Accounts in this organizational directory only" (single-tenant).
+                                <strong class="text-slate-900 dark:text-white">Azure Portal:</strong> Ga naar <a href="https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps" target="_blank" class="text-sky-600 dark:text-sky-400 underline">portal.azure.com</a> &rarr; <em>Microsoft Entra ID</em> &rarr; <em>App registrations</em> &rarr; <em>New registration</em> (of open de bestaande Fociz app). Kies "Accounts in this organizational directory only" (single-tenant).
                             </div>
                         </div>
 
                         <div class="flex items-start space-x-2.5">
                             <span class="w-5 h-5 rounded-full bg-sky-500/20 text-sky-600 dark:text-sky-400 flex items-center justify-center font-bold text-[10px] flex-shrink-0 mt-0.5">2</span>
                             <div>
-                                <strong class="text-slate-900 dark:text-white">Redirect URI:</strong> Kies platform <strong>Web</strong> en vul exact in: <code class="text-indigo-600 dark:text-indigo-400 font-mono"><?= htmlspecialchars($redirectUri) ?></code>.
+                                <strong class="text-slate-900 dark:text-white">Redirect URI:</strong> Ga naar <em>Authentication</em>, kies platform <strong>Web</strong> en vul exact in: <code class="text-indigo-600 dark:text-indigo-400 font-mono"><?= htmlspecialchars($redirectUri) ?></code>.
                             </div>
                         </div>
 
                         <div class="flex items-start space-x-2.5">
                             <span class="w-5 h-5 rounded-full bg-sky-500/20 text-sky-600 dark:text-sky-400 flex items-center justify-center font-bold text-[10px] flex-shrink-0 mt-0.5">3</span>
                             <div>
-                                <strong class="text-slate-900 dark:text-white">API Permissions:</strong> Ga naar <em>API permissions</em> &rarr; <em>Add a permission</em> &rarr; <em>Microsoft Graph</em> &rarr; <strong>Delegated permissions</strong> &rarr; Vink aan: <code class="text-sky-600 dark:text-sky-400">User.Read</code>, <code class="text-sky-600 dark:text-sky-400">Calendars.ReadWrite</code>, <code class="text-sky-600 dark:text-sky-400">Mail.ReadWrite</code> en <code class="text-sky-600 dark:text-sky-400">Mail.Send</code>.
+                                <strong class="text-slate-900 dark:text-white">API Permissions (Agenda, E-mail & Teams):</strong> Ga naar <em>API permissions</em> &rarr; <em>Add a permission</em> &rarr; <em>Microsoft Graph</em> &rarr; <strong>Delegated permissions</strong> &rarr; Vink de volgende machtigingen aan:
+                                <ul class="list-disc list-inside mt-1.5 space-y-1 text-[11px] text-slate-700 dark:text-slate-300">
+                                    <li><code class="text-sky-600 dark:text-sky-400 font-mono">User.Read</code> &mdash; Aanmelden en basisprofiel</li>
+                                    <li><code class="text-sky-600 dark:text-sky-400 font-mono">Calendars.ReadWrite</code> &mdash; Outlook agenda synchronisatie & afspraken inplannen</li>
+                                    <li><code class="text-sky-600 dark:text-sky-400 font-mono">Mail.ReadWrite</code> &mdash; Outlook inbox e-mails lezen, inplannen & beheren</li>
+                                    <li><code class="text-sky-600 dark:text-sky-400 font-mono">Mail.Send</code> &mdash; E-mails direct beantwoorden en doorsturen vanuit Fociz</li>
+                                    <li><code class="text-sky-600 dark:text-sky-400 font-mono">OnlineMeetings.ReadWrite</code> &mdash; Automatische Teams-vergaderingen koppelen</li>
+                                    <li><code class="text-sky-600 dark:text-sky-400 font-mono">offline_access</code> &mdash; Verbinding actief houden op de achtergrond</li>
+                                </ul>
                             </div>
                         </div>
 
                         <div class="flex items-start space-x-2.5">
                             <span class="w-5 h-5 rounded-full bg-sky-500/20 text-sky-600 dark:text-sky-400 flex items-center justify-center font-bold text-[10px] flex-shrink-0 mt-0.5">4</span>
                             <div>
-                                <strong class="text-slate-900 dark:text-white">Beheerdersgoedkeuring (Admin Consent):</strong> Klik op <em>"Grant admin consent for [Uw Organisatie]"</em>. Er verschijnt direct een groen vinkje bij alle regels. Hiermee hoeven individuele collega's geen beheerder meer te vragen!
+                                <strong class="text-slate-900 dark:text-white">Beheerdersgoedkeuring (Admin Consent):</strong> Klik in Azure op <em>"Grant admin consent for [Uw Organisatie]"</em> (of gebruik de knop <em>"Admin Consent Verlenen"</em> hierboven). Er verschijnt direct een groen vinkje bij alle regels. Hiermee hoeven collega's niet afzonderlijk om beheerderstoestemming te vragen en werkt zowel de agenda als de mailbox direct live!
                             </div>
                         </div>
                     </div>

auth/callback_microsoft.php

@@ -52,6 +52,13 @@ if (!empty($_GET['error'])) {
     exit;
 }
 
+// 3b. Afhandeling van beheerderstoestemming (Admin Consent)
+// Microsoft stuurt bij het /adminconsent endpoint geen state mee, enkel ?admin_consent=True&tenant=...
+if (!empty($_GET['admin_consent'])) {
+    header('Location: /admin.php?success=' . urlencode('Beheerdersgoedkeuring voor uw organisatie is succesvol verleend! U en uw collega\'s kunnen nu direct hun Outlook agenda en e-mail koppelen via Fociz.'));
+    exit;
+}
+
 // 4. Valideer de state (via HMAC handtekening of fallback sessiestate)
 $expectedState = $_SESSION['ms_oauth_state'] ?? '';
 unset($_SESSION['ms_oauth_state'], $_SESSION['ms_oauth_user_id']);
@@ -61,12 +68,6 @@ if (!$stateUserId && (empty($receivedState) || empty($expectedState) || !hash_eq
     exit;
 }
 
-// Afhandeling van beheerderstoestemming (Admin Consent)
-if (!empty($_GET['admin_consent'])) {
-    header('Location: /admin.php?success=' . urlencode('Beheerdersgoedkeuring voor uw organisatie is succesvol verleend! U en uw collega\'s kunnen nu direct hun Outlook agenda koppelen via Mijn Profiel.'));
-    exit;
-}
-
 // 5. Autorisatiecode controleren
 $code = $_GET['code'] ?? '';
 if (empty($code)) {