Add Microsoft xoauth2 support

appinfo/routes.php

@@ -369,6 +369,21 @@
 			'url' => '/integration/google-auth',
 			'verb' => 'GET',
 		],
+		[
+			'name' => 'microsoftIntegration#configure',
+			'url' => '/api/integration/microsoft',
+			'verb' => 'POST',
+		],
+		[
+			'name' => 'microsoftIntegration#unlink',
+			'url' => '/api/integration/microsoft',
+			'verb' => 'DELETE',
+		],
+		[
+			'name' => 'microsoftIntegration#oauthRedirect',
+			'url' => '/integration/microsoft-auth',
+			'verb' => 'GET',
+		],
 	],
 	'resources' => [
 		'accounts' => ['url' => '/api/accounts'],

lib/Controller/MicrosoftIntegrationController.php

@@ -0,0 +1,167 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * @copyright 2022 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @author 2022 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+namespace OCA\Mail\Controller;
+
+use OCA\Mail\AppInfo\Application;
+use OCA\Mail\Exception\ClientException;
+use OCA\Mail\Http\JsonResponse;
+use OCA\Mail\Integration\MicrosoftIntegration;
+use OCA\Mail\Service\AccountService;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Response;
+use OCP\AppFramework\Http\StandaloneTemplateResponse;
+use OCP\IRequest;
+use Psr\Log\LoggerInterface;
+use function filter_var;
+
+class MicrosoftIntegrationController extends Controller {
+	private ?string $userId;
+	private AccountService $accountService;
+	private MicrosoftIntegration $microsoftIntegration;
+	private LoggerInterface $logger;
+
+	public function __construct(IRequest $request,
+								?string $UserId,
+								AccountService $accountService,
+								MicrosoftIntegration $microsoftIntegration,
+								LoggerInterface $logger) {
+		parent::__construct(Application::APP_ID, $request);
+		$this->userId = $UserId;
+		$this->accountService = $accountService;
+		$this->microsoftIntegration = $microsoftIntegration;
+		$this->logger = $logger;
+	}
+
+	/**
+	 * @param string|null $tenantId
+	 * @param string $clientId
+	 * @param string $clientSecret
+	 *
+	 * @return JsonResponse
+	 */
+	public function configure(?string $tenantId, string $clientId, string $clientSecret): JsonResponse {
+		if (empty($clientId) || empty($clientSecret)) {
+			return JsonResponse::fail(null, Http::STATUS_UNPROCESSABLE_ENTITY);
+		}
+
+		$this->microsoftIntegration->configure(
+			$tenantId,
+			$clientId,
+			$clientSecret,
+		);
+
+		return JsonResponse::success([
+			'clientId' => $clientId,
+		]);
+	}
+
+	/*
+	 * @return JsonResponse
+	 */
+	public function unlink(): JsonResponse {
+		$this->microsoftIntegration->unlink();
+
+		return JsonResponse::success([]);
+	}
+
+	/**
+	 * @param int $id
+	 * @param string|null $code
+	 * @param string|null $state
+	 * @param string|null $session_state
+	 * @param string|null $error
+	 *
+	 * @NoAdminRequired
+	 * @NoCSRFRequired
+	 *
+	 * @return Response
+	 */
+	public function oauthRedirect(?string $code, ?string $state, ?string $session_state, ?string $error): Response {
+		if ($this->userId === null) {
+			// TODO: redirect to main nextcloud page
+			return new StandaloneTemplateResponse(
+				Application::APP_ID,
+				'oauth_done',
+				[],
+				'guest',
+			);
+		}
+
+		if (!isset($code, $state)) {
+			// TODO: handle error
+			return new StandaloneTemplateResponse(
+				Application::APP_ID,
+				'oauth_done',
+				[],
+				'guest',
+			);
+		}
+		if (!filter_var($state, FILTER_VALIDATE_INT)) {
+			$this->logger->warning('Can not link Microsoft account due to invalid state/account id {state}', [
+				'state' => $state,
+			]);
+			// TODO: redirect to main nextcloud page
+			return new StandaloneTemplateResponse(
+				Application::APP_ID,
+				'oauth_done',
+				[],
+				'guest',
+			);
+		}
+
+		try {
+			$account = $this->accountService->find(
+				$this->userId,
+				(int) $state,
+			);
+		} catch (ClientException $e) {
+			$this->logger->warning('Attempted Microsoft authentication redirect for account: ' . $e->getMessage(), [
+				'exception' => $e,
+			]);
+			// TODO: redirect to main nextcloud page
+			return new StandaloneTemplateResponse(
+				Application::APP_ID,
+				'oauth_done',
+				[],
+				'guest',
+			);
+		}
+
+		$updated = $this->microsoftIntegration->finishConnect(
+			$account,
+			$code,
+		);
+		$this->accountService->update($updated->getMailAccount());
+
+		return new StandaloneTemplateResponse(
+			Application::APP_ID,
+			'oauth_done',
+			[],
+			'guest',
+		);
+	}
+}

lib/Controller/PageController.php

@@ -186,12 +186,12 @@ public function index(): TemplateResponse {
 			'outbox-messages',
 			$this->outboxService->getMessages($user->getUID())
 		);
-		$clientId = $this->config->getAppValue(Application::APP_ID, 'google_oauth_client_id');
-		if (!empty($clientId)) {
+		$googleOauthclientId = $this->config->getAppValue(Application::APP_ID, 'google_oauth_client_id');
+		if (!empty($googleOauthclientId)) {
 			$this->initialStateService->provideInitialState(
 				'google-oauth-url',
 				'https://accounts.google.com/o/oauth2/v2/auth?' . http_build_query([
-					'client_id' => $clientId,
+					'client_id' => $googleOauthclientId,
 					'redirect_uri' => $this->urlGenerator->linkToRouteAbsolute('mail.googleIntegration.oauthRedirect'),
 					'response_type' => 'code',
 					'prompt' => 'consent',
@@ -202,6 +202,24 @@ public function index(): TemplateResponse {
 				]),
 			);
 		}
+		$microsoftOauthClientId = $this->config->getAppValue(Application::APP_ID, 'microsoft_oauth_client_id');
+		$microsoftOauthTenantId = $this->config->getAppValue(Application::APP_ID, 'microsoft_oauth_tenant_id', 'common');
+		if (!empty($microsoftOauthClientId) && !empty($microsoftOauthTenantId)) {
+			$this->initialStateService->provideInitialState(
+				'microsoft-oauth-url',
+				"https://login.microsoftonline.com/$microsoftOauthTenantId/oauth2/v2.0/authorize?" . http_build_query([
+					'client_id' => $microsoftOauthClientId,
+					'redirect_uri' => $this->urlGenerator->linkToRouteAbsolute('mail.microsoftIntegration.oauthRedirect'),
+					'response_type' => 'code',
+					'response_mode' => 'query',
+					'prompt' => 'consent',
+					'state' => '_accountId_', // Replaced by frontend
+					'scope' => 'offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send',
+					'access_type' => 'offline',
+					'login_hint' => '_email_', // Replaced by frontend
+				]),
+			);
+		}
 
 		// Disable scheduled send in frontend if ajax cron is used because it is unreliable
 		$cronMode = $this->config->getAppValue('core', 'backgroundjobs_mode', 'ajax');