Add Microsoft Graph OAuth connector

[dbalders]

Summary

Adds a server-owned Microsoft Graph OAuth connector for T3 Code using Microsoft device-code sign-in from Settings -> Connections.

What changed

• Adds typed Microsoft Graph contracts and four websocket RPCs: status, start sign-in, poll sign-in, and disconnect.
• Adds a server-side Graph connection service that keeps device codes and token material off the browser boundary.
• Persists only refresh credential material through ServerSecretStore; access tokens stay in memory and refresh before server-side Graph calls.
• Adds Settings -> Connections UI for Graph status, sign-in code copy/open actions, polling, errors, scopes, metadata, and disconnect.
• Gates status/account reads with access:read; gates sign-in, poll, and disconnect with access:write.

Notes

This intentionally does not add a generic client-facing Graph proxy. The internal Graph helper is server-only, GET-only, root-relative, and constrained to https://graph.microsoft.com.

This came from the three-way parallel feature workflow. The selected base was the product-complete implementation because it had the strongest Settings UX and the safest credential persistence model.

Validation

• pnpm install --frozen-lockfile
• pnpm exec vp test run src/microsoftGraph/MicrosoftGraphConnection.test.ts --reporter=verbose --testTimeout=10000 from apps/server
• pnpm exec vp test run src/server.test.ts -t "accepts websocket rpc handshake with a bootstrapped browser session cookie" --reporter=verbose --testTimeout=15000 from apps/server
• git diff --check
• pnpm exec vp check passed with 18 unrelated existing warnings
• pnpm exec vp run typecheck
• /Users/davidbalderston/.agents/skills/autoreview/scripts/autoreview --mode local clean

Live Microsoft tenant sign-in was not exercised; tests use mocked Microsoft identity and Graph responses.

Summary by CodeRabbit

• New Features
  • Added Microsoft Graph connection management in app settings, including sign-in, status, polling, disconnect, and permission-aware visibility.
  • Exposed Microsoft Graph actions over the app’s real-time API so the UI can control and monitor connection state.
  • Added support for displaying connection details such as account info, granted scopes, and token timing.
• Bug Fixes
  • Improved error handling so sensitive connection details are not shown in surfaced failures.
  • Added validation to reject invalid Microsoft Graph request paths.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• tritonai-codex-runtime

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1d9f4a32-b8fa-451a-a755-cd8bd2395a92

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds Microsoft Graph device-code OAuth sign-in support end-to-end: new contract schemas/types/errors and RPC methods, a server-side connection service with token persistence/refresh and disconnect logic plus tests, websocket RPC handlers with scope-based redaction, server layer wiring, client-runtime command atoms, and a web settings UI section for managing the connection.

Changes

Microsoft Graph Connection

Layer / File(s)	Summary
Contracts and RPC schemas packages/contracts/src/microsoftGraph.ts, packages/contracts/src/index.ts, packages/contracts/src/rpc.ts	Adds Microsoft Graph schemas/types (status, account, sign-in results, error class), re-exports them, and registers four new WS_METHODS/RPC declarations in WsRpcGroup.
Server connection implementation and tests apps/server/src/microsoftGraph/MicrosoftGraphConnection.ts, apps/server/src/microsoftGraph/MicrosoftGraphConnection.test.ts	Implements device-code sign-in polling, token persistence/refresh via ServerSecretStore, disconnect, authenticated Graph requests with path/origin validation, error redaction, and exported Layers; tests cover sign-in completion, refresh, disconnect, error redaction, and path validation.
Server layer and websocket RPC wiring apps/server/src/server.ts, apps/server/src/ws.ts, apps/server/src/server.test.ts	Wires MicrosoftGraphConnectionLayerLive into the server layer stack, adds websocket RPC handlers with scope-based status redaction and authorization requirements, and adds test harness mocks for the connection service.
Client-runtime command atoms packages/client-runtime/src/state/server.ts	Adds four Microsoft Graph RPC command atoms with concurrency controls to createServerEnvironmentAtoms.
Web Connections settings UI apps/web/src/components/settings/ConnectionsSettings.tsx	Adds status loading, sign-in/poll/disconnect callbacks, effects, and a rendered UI section showing connection status, user code, and controls.

Estimated code review effort: 4 (Complex) | ~75 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant ConnectionsSettingsUI
  participant WsRpcLayer
  participant MicrosoftGraphConnection
  participant MicrosoftEndpoint

  User->>ConnectionsSettingsUI: click Sign In
  ConnectionsSettingsUI->>WsRpcLayer: microsoftGraphStartSignIn
  WsRpcLayer->>MicrosoftGraphConnection: startSignIn()
  MicrosoftGraphConnection->>MicrosoftEndpoint: request device code
  MicrosoftEndpoint-->>MicrosoftGraphConnection: userCode, verificationUri
  MicrosoftGraphConnection-->>ConnectionsSettingsUI: sign-in flow details

  loop poll until connected
    ConnectionsSettingsUI->>WsRpcLayer: microsoftGraphPollSignIn
    WsRpcLayer->>MicrosoftGraphConnection: pollSignIn(flowId)
    MicrosoftGraphConnection->>MicrosoftEndpoint: poll token endpoint
    MicrosoftEndpoint-->>MicrosoftGraphConnection: pending/connected
    MicrosoftGraphConnection-->>WsRpcLayer: status
    WsRpcLayer-->>ConnectionsSettingsUI: status (redacted if write-only)
  end

Loading

Estimated code review effort: 4 (Complex) | ~75 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding a Microsoft Graph OAuth connector.
Description check	✅ Passed	The description is well structured and covers summary, changes, notes, and validation, but it omits the template's explicit Why section and UI screenshots.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch microsoft-graph-oauth-connector

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dbalders]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[dbalders]

Implemented the requested Microsoft Graph access control in commit e0f14460c.

What changed

• Added a sign-in choice between Read only (default/recommended) and Full access.
• Read only requests:
  • User.Read
  • Mail.Read
  • Calendars.Read
  • offline_access
• Full access requests:
  • User.Read
  • Mail.ReadWrite
  • Mail.Send
  • Calendars.ReadWrite
  • offline_access
• The selected level now flows through the RPC and device-code request, is persisted with the server-side credential, and is reused for refresh-token requests.
• Connection status shows the selected access level while preserving the existing redaction behavior.
• Existing connector credentials and older clients that omit accessLevel safely default to Read only.
• The browser still receives no Graph token material, and there is still no generic client-facing Graph proxy.

Verification

• Rendered and exercised the two-choice dialog in the local TritonAI Harness.
• Microsoft Graph focused tests: 6 passed.
• vp run typecheck: passed.
• vp check: passed with 0 errors and the same 18 pre-existing warnings.
• Autoreview found one client/server version-skew issue; fixed it by making omitted access default to Read only.
• Final autoreview rerun: clean, no actionable findings.

[dbalders]

Local Codex PR Review

Verdict: APPROVE
Confidence: medium

Summary
Reviewed PR #43 adding a server-owned Microsoft Graph OAuth/device-code connector.

Notable Changes
Adds Graph contracts/RPCs, server-side token handling through ServerSecretStore, Settings -> Connections UI, scope-gated WS handlers, and focused mocked Graph tests.

Review Notes
No blocking correctness, security, privacy, or upstream-divergence issue found. Current GitHub checks are still queued/pending, so this approval assumes CI completes successfully.

Findings

• None.

Upstream Alignment

• This is a downstream TritonAI/T3 Code integration and appears intentionally scoped to the connector surface: contracts, server service, WS RPCs, client-runtime commands, and Settings UI.
• No broad formatting churn, unrelated refactor, vendored-source edits, or unnecessary upstream divergence was evident in the changed file set.

Security and Privacy

• Token material remains server-side: device codes are kept in memory, refresh credential material is stored via ServerSecretStore, and access tokens are not persisted or exposed in RPC status.
• RPC authorization matches the stated policy: status requires access:read; sign-in, poll, and disconnect require access:write; poll status is redacted for write-only sessions.
• The internal Graph helper is server-only, GET-only by type, constrains paths to root-relative Microsoft Graph URLs, and is not exposed as a generic client-facing proxy.
• Hard-coded Microsoft client and tenant IDs are public OAuth app metadata, not secrets. No private URLs, client secrets, access tokens, or refresh tokens were visible in the diff.

Risk Notes

• Current GitHub checks are queued/pending; do not treat this review as CI passing.
• The PR body says validation passed locally, including vp check and vp run typecheck; I did not independently rerun them in this read-only review environment.
• Live Microsoft tenant sign-in was not exercised per the PR body; Graph/identity behavior is covered with mocked responses.
• Existing bot comments report no actionable findings, and there are no formal or inline review comments to carry forward.

---

Automated local Codex review for e0f14460cecd6257f5fb5b6d3af8bb3b0ad15bc5 updated 2026-07-09T23:40:46+00:00.