NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(microsoft-integration): update Microsoft 365 settings and admin consent handling for improved clarity and functionality #38

Merged
NiekRabelink merged 1 commits from dev into main 2026-09-10 12:47:47 +00:00
Conversation 0 Commits 1 Files Changed 2
+27 -18
2 changed files with 27 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 5310b87fe5 - Show all commits
admin.php
+20 -12
View File
@@ -64,7 +64,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
");
$stmt->execute([$userId, $isDemo, json_encode($newSettings)]);
$message = "Centrale Microsoft 365 Azure App instellingen zijn succesvol opgeslagen.";
$message = "Centrale Microsoft 365 instellingen (Agenda, E-mail & Teams) zijn succesvol opgeslagen.";
$messageType = 'success';
}
@@ -390,7 +390,7 @@ require_once __DIR__ . '/includes/header.php';
<!-- Linkerkolom: Integraties Beheer (8 cols) -->
<div class="lg:col-span-8 space-y-8">
<!-- 1. Microsoft 365 Azure App Registratie -->
<!-- 1. Microsoft 365 Azure App Registratie (Agenda, E-mail & Teams) -->
<div class="fociz-card p-6 sm:p-7">
<div class="flex flex-col sm:flex-row sm:items-center justify-between gap-4 pb-6 border-b border-slate-100 dark:border-slate-800/80">
<div class="flex items-center space-x-3.5">
@@ -399,7 +399,7 @@ require_once __DIR__ . '/includes/header.php';
</div>
<div>
<div class="flex items-center space-x-2">
<h2 class="text-lg font-bold text-slate-900 dark:text-white tracking-tight">Microsoft 365 & Azure App Registratie</h2>
<h2 class="text-lg font-bold text-slate-900 dark:text-white tracking-tight">Microsoft 365 Koppeling (Agenda, E-mail & Teams)</h2>
<?php if ($appConfig['is_configured']): ?>
<span class="px-2.5 py-0.5 rounded-full bg-teal-50 dark:bg-teal-950/40 border border-teal-200 dark:border-teal-800/60 text-teal-700 dark:text-teal-400 text-[10px] font-bold">
Geconfigureerd
@@ -410,12 +410,12 @@ require_once __DIR__ . '/includes/header.php';
</span>
<?php endif; ?>
</div>
<p class="text-xs text-slate-500 dark:text-slate-400">Centrale OAuth 2.0 instellingen voor de hele organisatie</p>
<p class="text-xs text-slate-500 dark:text-slate-400">Centrale OAuth 2.0 koppeling voor Outlook Agenda, E-mail (Postvak IN) en Microsoft Teams</p>
</div>
</div>
<?php if ($appConfig['is_configured']): ?>
<a href="<?= htmlspecialchars($adminConsentUrl) ?>" target="_blank" rel="noopener noreferrer" class="inline-flex items-center space-x-2 px-3.5 py-2 rounded-xl bg-sky-50 hover:bg-sky-100 dark:bg-sky-950/40 dark:hover:bg-sky-900/40 text-sky-700 dark:text-sky-300 border border-sky-200 dark:border-sky-800/60 text-xs font-semibold transition" title="Verleen namens alle gebruikers beheerdersgoedkeuring in Azure">
<a href="<?= htmlspecialchars($adminConsentUrl) ?>" target="_blank" rel="noopener noreferrer" class="inline-flex items-center space-x-2 px-3.5 py-2 rounded-xl bg-sky-50 hover:bg-sky-100 dark:bg-sky-950/40 dark:hover:bg-sky-900/40 text-sky-700 dark:text-sky-300 border border-sky-200 dark:border-sky-800/60 text-xs font-semibold transition" title="Verleen namens alle gebruikers beheerdersgoedkeuring in Azure voor Agenda, E-mail en Teams">
<i data-lucide="shield-check" class="w-4 h-4 text-sky-600 dark:text-sky-400"></i>
<span>Admin Consent Verlenen</span>
<i data-lucide="external-link" class="w-3.5 h-3.5 text-sky-600 dark:text-sky-400"></i>
@@ -480,10 +480,10 @@ require_once __DIR__ . '/includes/header.php';
<div class="pt-2 flex items-center justify-between">
<div class="text-[11px] text-slate-500 dark:text-slate-400">
Zodra opgeslagen kunnen al uw collega's met 1 klik hun Outlook agenda koppelen.
Zodra opgeslagen en goedgekeurd kunnen al uw collega's met 1 klik hun Outlook agenda én e-mail koppelen.
</div>
<button type="submit" class="px-5 py-2.5 rounded-xl bg-indigo-600 hover:bg-indigo-500 text-white text-xs font-bold transition shadow-xs cursor-pointer">
Azure Gegevens Opslaan
Microsoft Gegevens Opslaan
</button>
</div>
</form>
@@ -493,7 +493,7 @@ require_once __DIR__ . '/includes/header.php';
<button type="button" onclick="toggleAdminGuide()" class="w-full flex items-center justify-between text-xs font-semibold text-slate-700 dark:text-slate-300 hover:text-slate-900 dark:hover:text-white transition cursor-pointer">
<span class="flex items-center space-x-2">
<i data-lucide="help-circle" class="w-4 h-4 text-sky-500"></i>
<span>Hoe configureer ik de Azure App Registratie in 4 stappen?</span>
<span>Hoe configureer ik de complete Microsoft Koppeling (Agenda, E-mail & Teams) in 4 stappen?</span>
</span>
<i data-lucide="chevron-down" class="w-4 h-4 transition-transform duration-200" id="guideArrow"></i>
</button>
@@ -502,28 +502,36 @@ require_once __DIR__ . '/includes/header.php';
<div class="flex items-start space-x-2.5">
<span class="w-5 h-5 rounded-full bg-sky-500/20 text-sky-600 dark:text-sky-400 flex items-center justify-center font-bold text-[10px] flex-shrink-0 mt-0.5">1</span>
<div>
<strong class="text-slate-900 dark:text-white">Azure Portal:</strong> Ga naar <a href="https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps" target="_blank" class="text-sky-600 dark:text-sky-400 underline">portal.azure.com</a> &rarr; <em>Microsoft Entra ID</em> &rarr; <em>App registrations</em> &rarr; <em>New registration</em>. Kies "Accounts in this organizational directory only" (single-tenant).
<strong class="text-slate-900 dark:text-white">Azure Portal:</strong> Ga naar <a href="https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps" target="_blank" class="text-sky-600 dark:text-sky-400 underline">portal.azure.com</a> &rarr; <em>Microsoft Entra ID</em> &rarr; <em>App registrations</em> &rarr; <em>New registration</em> (of open de bestaande Fociz app). Kies "Accounts in this organizational directory only" (single-tenant).
</div>
</div>
<div class="flex items-start space-x-2.5">
<span class="w-5 h-5 rounded-full bg-sky-500/20 text-sky-600 dark:text-sky-400 flex items-center justify-center font-bold text-[10px] flex-shrink-0 mt-0.5">2</span>
<div>
<strong class="text-slate-900 dark:text-white">Redirect URI:</strong> Kies platform <strong>Web</strong> en vul exact in: <code class="text-indigo-600 dark:text-indigo-400 font-mono"><?= htmlspecialchars($redirectUri) ?></code>.
<strong class="text-slate-900 dark:text-white">Redirect URI:</strong> Ga naar <em>Authentication</em>, kies platform <strong>Web</strong> en vul exact in: <code class="text-indigo-600 dark:text-indigo-400 font-mono"><?= htmlspecialchars($redirectUri) ?></code>.
</div>
</div>
<div class="flex items-start space-x-2.5">
<span class="w-5 h-5 rounded-full bg-sky-500/20 text-sky-600 dark:text-sky-400 flex items-center justify-center font-bold text-[10px] flex-shrink-0 mt-0.5">3</span>
<div>
<strong class="text-slate-900 dark:text-white">API Permissions:</strong> Ga naar <em>API permissions</em> &rarr; <em>Add a permission</em> &rarr; <em>Microsoft Graph</em> &rarr; <strong>Delegated permissions</strong> &rarr; Vink aan: <code class="text-sky-600 dark:text-sky-400">User.Read</code>, <code class="text-sky-600 dark:text-sky-400">Calendars.ReadWrite</code>, <code class="text-sky-600 dark:text-sky-400">Mail.ReadWrite</code> en <code class="text-sky-600 dark:text-sky-400">Mail.Send</code>.
<strong class="text-slate-900 dark:text-white">API Permissions (Agenda, E-mail & Teams):</strong> Ga naar <em>API permissions</em> &rarr; <em>Add a permission</em> &rarr; <em>Microsoft Graph</em> &rarr; <strong>Delegated permissions</strong> &rarr; Vink de volgende machtigingen aan:
<ul class="list-disc list-inside mt-1.5 space-y-1 text-[11px] text-slate-700 dark:text-slate-300">
<li><code class="text-sky-600 dark:text-sky-400 font-mono">User.Read</code> &mdash; Aanmelden en basisprofiel</li>
<li><code class="text-sky-600 dark:text-sky-400 font-mono">Calendars.ReadWrite</code> &mdash; Outlook agenda synchronisatie & afspraken inplannen</li>
<li><code class="text-sky-600 dark:text-sky-400 font-mono">Mail.ReadWrite</code> &mdash; Outlook inbox e-mails lezen, inplannen & beheren</li>
<li><code class="text-sky-600 dark:text-sky-400 font-mono">Mail.Send</code> &mdash; E-mails direct beantwoorden en doorsturen vanuit Fociz</li>
<li><code class="text-sky-600 dark:text-sky-400 font-mono">OnlineMeetings.ReadWrite</code> &mdash; Automatische Teams-vergaderingen koppelen</li>
<li><code class="text-sky-600 dark:text-sky-400 font-mono">offline_access</code> &mdash; Verbinding actief houden op de achtergrond</li>
</ul>
</div>
</div>
<div class="flex items-start space-x-2.5">
<span class="w-5 h-5 rounded-full bg-sky-500/20 text-sky-600 dark:text-sky-400 flex items-center justify-center font-bold text-[10px] flex-shrink-0 mt-0.5">4</span>
<div>
<strong class="text-slate-900 dark:text-white">Beheerdersgoedkeuring (Admin Consent):</strong> Klik op <em>"Grant admin consent for [Uw Organisatie]"</em>. Er verschijnt direct een groen vinkje bij alle regels. Hiermee hoeven individuele collega's geen beheerder meer te vragen!
<strong class="text-slate-900 dark:text-white">Beheerdersgoedkeuring (Admin Consent):</strong> Klik in Azure op <em>"Grant admin consent for [Uw Organisatie]"</em> (of gebruik de knop <em>"Admin Consent Verlenen"</em> hierboven). Er verschijnt direct een groen vinkje bij alle regels. Hiermee hoeven collega's niet afzonderlijk om beheerderstoestemming te vragen en werkt zowel de agenda als de mailbox direct live!
</div>
</div>
</div>
auth/callback_microsoft.php
+7 -6
View File
@@ -52,6 +52,13 @@ if (!empty($_GET['error'])) {
exit;
}
// 3b. Afhandeling van beheerderstoestemming (Admin Consent)
// Microsoft stuurt bij het /adminconsent endpoint geen state mee, enkel ?admin_consent=True&tenant=...
if (!empty($_GET['admin_consent'])) {
header('Location: /admin.php?success=' . urlencode('Beheerdersgoedkeuring voor uw organisatie is succesvol verleend! U en uw collega\'s kunnen nu direct hun Outlook agenda en e-mail koppelen via Fociz.'));
exit;
}
// 4. Valideer de state (via HMAC handtekening of fallback sessiestate)
$expectedState = $_SESSION['ms_oauth_state'] ?? '';
unset($_SESSION['ms_oauth_state'], $_SESSION['ms_oauth_user_id']);
@@ -61,12 +68,6 @@ if (!$stateUserId && (empty($receivedState) || empty($expectedState) || !hash_eq
exit;
}
// Afhandeling van beheerderstoestemming (Admin Consent)
if (!empty($_GET['admin_consent'])) {
header('Location: /admin.php?success=' . urlencode('Beheerdersgoedkeuring voor uw organisatie is succesvol verleend! U en uw collega\'s kunnen nu direct hun Outlook agenda koppelen via Mijn Profiel.'));
exit;
}
// 5. Autorisatiecode controleren
$code = $_GET['code'] ?? '';
if (empty($code)) {