diff --git a/app/assets/javascripts/app/views/office365/app_config.jst.eco b/app/assets/javascripts/app/views/office365/app_config.jst.eco
new file mode 100644
index 000000000..1c1f565ee
--- /dev/null
+++ b/app/assets/javascripts/app/views/office365/app_config.jst.eco
@@ -0,0 +1,29 @@
+
+
+ <%- @T('The tutorial on how to manage a %s is hosted on our online documentation %l.', 'Office 365 App', 'https://admin-docs.zammad.org/en/latest/channels/office365.html') %>
+
+
+ <%- @T('Enter your %s App Keys', 'Office 365') %>
+
+
+ <%- @T('Your callback URL') %>
+
+
diff --git a/app/assets/javascripts/app/views/office365/index.jst.eco b/app/assets/javascripts/app/views/office365/index.jst.eco
new file mode 100644
index 000000000..105e5292e
--- /dev/null
+++ b/app/assets/javascripts/app/views/office365/index.jst.eco
@@ -0,0 +1,12 @@
+
+
+
+
+
<%- @T('You can connect %s with Zammad. You need to connect your Zammad with %s first.', 'Office 365 Accounts', 'Office 365') %>
+
<%- @T('Connect Office 365 App') %>
+
+
diff --git a/app/assets/javascripts/app/views/office365/list.jst.eco b/app/assets/javascripts/app/views/office365/list.jst.eco
new file mode 100644
index 000000000..cf59cc286
--- /dev/null
+++ b/app/assets/javascripts/app/views/office365/list.jst.eco
@@ -0,0 +1,116 @@
+
+
+<% if !_.isEmpty(@not_used_email_addresses): %>
+
+
+
+ <%- @T('Notice') %>: <%- @T('Unassigned email addresses, assign them to a channel or delete them.') %>
+
+
+
+
+<% end %>
+
+
+<% for channel in @channels: %>
+
+
+
+
+
+
+
<%- @Icon('status', channel.status_out + " inline") %> <%- @T('Outbound') %>
+
+
+ <% if !_.isEmpty(channel.last_log_out): %>
+
+ <%= channel.last_log_out %>
+
+ <% end %>
+
+
+
+
<%- @T('Email Address') %>
+
+
+ <%- @T('Add') %>
+
+
+
+
+
<%- @T('Delete') %>
+ <% if channel.options.backup_imap_classic: %>
+
<%- @T('Rollback migration') %>
+ <% end %>
+ <% if channel.active is true: %>
+
<%- @T('Disable') %>
+ <% else: %>
+
<%- @T('Enable') %>
+ <% end %>
+
+
+<% end %>
+
diff --git a/app/controllers/channels_office365_controller.rb b/app/controllers/channels_office365_controller.rb
new file mode 100644
index 000000000..1e3ce45e0
--- /dev/null
+++ b/app/controllers/channels_office365_controller.rb
@@ -0,0 +1,100 @@
+# Copyright (C) 2012-2016 Zammad Foundation, http://zammad-foundation.org/
+
+class ChannelsOffice365Controller < ApplicationController
+ prepend_before_action -> { authentication_check && authorize! }
+
+ def index
+ system_online_service = Setting.get('system_online_service')
+
+ assets = {}
+ external_credential_ids = []
+ ExternalCredential.where(name: 'office365').each do |external_credential|
+ assets = external_credential.assets(assets)
+ external_credential_ids.push external_credential.id
+ end
+
+ channel_ids = []
+ Channel.where(area: 'Office365::Account').order(:id).each do |channel|
+ assets = channel.assets(assets)
+ channel_ids.push channel.id
+ end
+
+ not_used_email_address_ids = []
+ EmailAddress.find_each do |email_address|
+ next if system_online_service && email_address.preferences && email_address.preferences['online_service_disable']
+
+ assets = email_address.assets(assets)
+ if !email_address.channel_id || !email_address.active || !Channel.exists?(email_address.channel_id)
+ not_used_email_address_ids.push email_address.id
+ end
+ end
+
+ render json: {
+ assets: assets,
+ not_used_email_address_ids: not_used_email_address_ids,
+ channel_ids: channel_ids,
+ external_credential_ids: external_credential_ids,
+ callback_url: ExternalCredential.callback_url('office365'),
+ }
+ end
+
+ def enable
+ channel = Channel.find_by(id: params[:id], area: 'Office365::Account')
+ channel.active = true
+ channel.save!
+ render json: {}
+ end
+
+ def disable
+ channel = Channel.find_by(id: params[:id], area: 'Office365::Account')
+ channel.active = false
+ channel.save!
+ render json: {}
+ end
+
+ def destroy
+ channel = Channel.find_by(id: params[:id], area: 'Office365::Account')
+ email = EmailAddress.find_by(channel_id: channel.id)
+ email.destroy!
+ channel.destroy!
+ render json: {}
+ end
+
+ def group
+ channel = Channel.find_by(id: params[:id], area: 'Office365::Account')
+ channel.group_id = params[:group_id]
+ channel.save!
+ render json: {}
+ end
+
+ def inbound
+ channel = Channel.find_by(id: params[:id], area: 'Office365::Account')
+ %w[folder keep_on_server].each do |key|
+ channel.options[:inbound][:options][key] = params[:options][key]
+ end
+
+ result = EmailHelper::Probe.inbound(channel.options[:inbound])
+ raise Exceptions::UnprocessableEntity, ( result[:message_human] || result[:message] ) if result[:result] == 'invalid'
+
+ channel.status_in = 'ok'
+ channel.status_out = 'ok'
+ channel.last_log_in = nil
+ channel.last_log_out = nil
+ if params.key?(:active)
+ channel.active = params[:active]
+ end
+
+ channel.save!
+
+ render json: {}
+ end
+
+ def rollback_migration
+ channel = Channel.find_by(id: params[:id], area: 'Office365::Account')
+ raise 'Failed to find backup on channel!' if !channel.options[:backup_imap_classic]
+
+ channel.update!(channel.options[:backup_imap_classic][:attributes])
+ render json: {}
+ end
+
+end
diff --git a/app/jobs/imap_authentication_migration_cleanup_job.rb b/app/jobs/imap_authentication_migration_cleanup_job.rb
index f6e7c8472..012da6395 100644
--- a/app/jobs/imap_authentication_migration_cleanup_job.rb
+++ b/app/jobs/imap_authentication_migration_cleanup_job.rb
@@ -2,7 +2,7 @@ class ImapAuthenticationMigrationCleanupJob < ApplicationJob
include HasActiveJobLock
def perform
- Channel.where(area: 'Google::Account').find_each do |channel|
+ Channel.where(area: ['Google::Account', 'Office365::Account']).find_each do |channel|
next if channel.options.blank?
next if channel.options[:backup_imap_classic].blank?
next if channel.options[:backup_imap_classic][:migrated_at] > 7.days.ago
diff --git a/app/policies/controllers/channels_office365_controller_policy.rb b/app/policies/controllers/channels_office365_controller_policy.rb
new file mode 100644
index 000000000..1f372dcb9
--- /dev/null
+++ b/app/policies/controllers/channels_office365_controller_policy.rb
@@ -0,0 +1,3 @@
+class Controllers::ChannelsOffice365ControllerPolicy < Controllers::ApplicationControllerPolicy
+ default_permit!('admin.channel_office365')
+end
diff --git a/config/routes/office365.rb b/config/routes/office365.rb
new file mode 100644
index 000000000..eeb6895dd
--- /dev/null
+++ b/config/routes/office365.rb
@@ -0,0 +1,12 @@
+Zammad::Application.routes.draw do
+ api_path = Rails.configuration.api_path
+
+ match api_path + '/channels_office365', to: 'channels_office365#index', via: :get
+ match api_path + '/channels_office365_disable', to: 'channels_office365#disable', via: :post
+ match api_path + '/channels_office365_enable', to: 'channels_office365#enable', via: :post
+ match api_path + '/channels_office365', to: 'channels_office365#destroy', via: :delete
+ match api_path + '/channels_office365_group/:id', to: 'channels_office365#group', via: :post
+ match api_path + '/channels_office365_inbound/:id', to: 'channels_office365#inbound', via: :post
+ match api_path + '/channels_office365_rollback_migration', to: 'channels_office365#rollback_migration', via: :post
+
+end
diff --git a/lib/external_credential/office365.rb b/lib/external_credential/office365.rb
new file mode 100644
index 000000000..6b86533fc
--- /dev/null
+++ b/lib/external_credential/office365.rb
@@ -0,0 +1,267 @@
+class ExternalCredential::Office365
+
+ def self.app_verify(params)
+ request_account_to_link(params, false)
+ params
+ end
+
+ def self.request_account_to_link(credentials = {}, app_required = true)
+ external_credential = ExternalCredential.find_by(name: 'office365')
+ raise Exceptions::UnprocessableEntity, 'No Office365 app configured!' if !external_credential && app_required
+
+ if external_credential
+ if credentials[:client_id].blank?
+ credentials[:client_id] = external_credential.credentials['client_id']
+ end
+ if credentials[:client_secret].blank?
+ credentials[:client_secret] = external_credential.credentials['client_secret']
+ end
+ end
+
+ raise Exceptions::UnprocessableEntity, 'No client_id param!' if credentials[:client_id].blank?
+ raise Exceptions::UnprocessableEntity, 'No client_secret param!' if credentials[:client_secret].blank?
+
+ authorize_url = generate_authorize_url(credentials[:client_id])
+
+ {
+ authorize_url: authorize_url,
+ }
+ end
+
+ def self.link_account(_request_token, params)
+ external_credential = ExternalCredential.find_by(name: 'office365')
+ raise Exceptions::UnprocessableEntity, 'No office365 app configured!' if !external_credential
+ raise Exceptions::UnprocessableEntity, 'No code for session found!' if !params[:code]
+
+ response = authorize_tokens(external_credential.credentials[:client_id], external_credential.credentials[:client_secret], params[:code])
+ %w[refresh_token access_token expires_in scope token_type id_token].each do |key|
+ raise Exceptions::UnprocessableEntity, "No #{key} for authorization request found!" if response[key.to_sym].blank?
+ end
+
+ user_data = user_info(response[:id_token])
+ raise Exceptions::UnprocessableEntity, 'Unable to extract user preferred_username from id_token!' if user_data[:preferred_username].blank?
+
+ migrate_channel = nil
+ Channel.where(area: 'Email::Account').find_each do |channel|
+ next if channel.options.dig(:inbound, :options, :user) != user_data[:email]
+ next if channel.options.dig(:inbound, :options, :host) != 'outlook.office365.com'
+ next if channel.options.dig(:outbound, :options, :user) != user_data[:email]
+ next if channel.options.dig(:outbound, :options, :host) != 'smtp.office365.com'
+
+ migrate_channel = channel
+
+ break
+ end
+
+ channel_options = {
+ inbound: {
+ adapter: 'imap',
+ options: {
+ auth_type: 'XOAUTH2',
+ host: 'outlook.office365.com',
+ ssl: true,
+ user: user_data[:preferred_username],
+ },
+ },
+ outbound: {
+ adapter: 'smtp',
+ options: {
+ host: 'smtp.office365.com',
+ domain: 'office365.com',
+ port: 587,
+ user: user_data[:preferred_username],
+ authentication: 'xoauth2',
+ },
+ },
+ auth: response.merge(
+ provider: 'office365',
+ type: 'XOAUTH2',
+ client_id: external_credential.credentials[:client_id],
+ client_secret: external_credential.credentials[:client_secret],
+ ),
+ }
+
+ if migrate_channel
+ channel_options[:inbound][:options][:folder] = migrate_channel.options[:inbound][:options][:folder]
+ channel_options[:inbound][:options][:keep_on_server] = migrate_channel.options[:inbound][:options][:keep_on_server]
+
+ backup = {
+ attributes: {
+ area: migrate_channel.area,
+ options: migrate_channel.options,
+ last_log_in: migrate_channel.last_log_in,
+ last_log_out: migrate_channel.last_log_out,
+ status_in: migrate_channel.status_in,
+ status_out: migrate_channel.status_out,
+ },
+ migrated_at: Time.zone.now,
+ }
+
+ migrate_channel.update(
+ area: 'Office365::Account',
+ options: channel_options.merge(backup_imap_classic: backup),
+ last_log_in: nil,
+ last_log_out: nil,
+ )
+
+ return migrate_channel
+ end
+
+ email_addresses = user_aliases(response)
+ email_addresses.unshift({
+ realname: "#{Setting.get('product_name')} Support",
+ email: user_data[:preferred_username],
+ })
+
+ email_addresses.each do |email|
+ next if !EmailAddress.exists?(email: email[:preferred_username])
+
+ raise Exceptions::UnprocessableEntity, "Duplicate email address or email alias #{email[:preferred_username]} found!"
+ end
+
+ # create channel
+ channel = Channel.create!(
+ area: 'Office365::Account',
+ group_id: Group.first.id,
+ options: channel_options,
+ active: false,
+ created_by_id: 1,
+ updated_by_id: 1,
+ )
+
+ email_addresses.each do |user_alias|
+ EmailAddress.create!(
+ channel_id: channel.id,
+ realname: user_alias[:realname],
+ email: user_alias[:email],
+ active: true,
+ created_by_id: 1,
+ updated_by_id: 1,
+ )
+ end
+
+ channel
+ end
+
+ def self.generate_authorize_url(client_id, scope = 'https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access openid profile email')
+
+ params = {
+ 'client_id' => client_id,
+ 'redirect_uri' => ExternalCredential.callback_url('office365'),
+ 'scope' => scope,
+ 'response_type' => 'code',
+ 'access_type' => 'offline',
+ 'prompt' => 'consent',
+ }
+
+ uri = URI::HTTPS.build(
+ host: 'login.microsoftonline.com',
+ path: '/common/oauth2/v2.0/authorize',
+ query: params.to_query
+ )
+
+ uri.to_s
+ end
+
+ def self.authorize_tokens(client_id, client_secret, authorization_code)
+ params = {
+ 'client_secret' => client_secret,
+ 'code' => authorization_code,
+ 'grant_type' => 'authorization_code',
+ 'client_id' => client_id,
+ 'redirect_uri' => ExternalCredential.callback_url('office365'),
+ }
+
+ uri = URI::HTTPS.build(
+ host: 'login.microsoftonline.com',
+ path: '/common/oauth2/v2.0/token',
+ )
+
+ response = Net::HTTP.post_form(uri, params)
+ if response.code != 200 && response.body.blank?
+ Rails.logger.error "Request failed! (code: #{response.code})"
+ raise "Request failed! (code: #{response.code})"
+ end
+
+ result = JSON.parse(response.body)
+ if result['error'] && response.code != 200
+ Rails.logger.error "Request failed! ERROR: #{result['error']} (#{result['error_description']}, params: #{params.to_json})"
+ raise "Request failed! ERROR: #{result['error']} (#{result['error_description']})"
+ end
+
+ result[:created_at] = Time.zone.now
+
+ result.symbolize_keys
+ end
+
+ def self.refresh_token(token)
+ return token if token[:created_at] >= Time.zone.now - 50.minutes
+
+ params = {
+ 'client_id' => token[:client_id],
+ 'client_secret' => token[:client_secret],
+ 'refresh_token' => token[:refresh_token],
+ 'grant_type' => 'refresh_token',
+ }
+ uri = URI::HTTPS.build(
+ host: 'login.microsoftonline.com',
+ path: '/common/oauth2/v2.0/token',
+ )
+
+ response = Net::HTTP.post_form(uri, params)
+ if response.code != 200 && response.body.blank?
+ Rails.logger.error "Request failed! (code: #{response.code})"
+ raise "Request failed! (code: #{response.code})"
+ end
+
+ result = JSON.parse(response.body)
+ if result['error'] && response.code != 200
+ Rails.logger.error "Request failed! ERROR: #{result['error']} (#{result['error_description']}, params: #{params.to_json})"
+ raise "Request failed! ERROR: #{result['error']} (#{result['error_description']})"
+ end
+
+ token.merge(
+ created_at: Time.zone.now,
+ access_token: result['access_token'],
+ ).symbolize_keys
+ end
+
+ def self.user_aliases(_token)
+ # uri = URI.parse('https://www.office365apis.com/gmail/v1/users/me/settings/sendAs')
+ # http = Net::HTTP.new(uri.host, uri.port)
+ # http.use_ssl = true
+ # response = http.get(uri.request_uri, { 'Authorization' => "#{token[:token_type]} #{token[:access_token]}" })
+ # if response.code != 200 && response.body.blank?
+ # Rails.logger.error "Request failed! (code: #{response.code})"
+ # raise "Request failed! (code: #{response.code})"
+ # end
+
+ # result = JSON.parse(response.body)
+ # if result['error'] && response.code != 200
+ # Rails.logger.error "Request failed! ERROR: #{result['error']['message']}"
+ # raise "Request failed! ERROR: #{result['error']['message']}"
+ # end
+
+ # aliases = []
+ # result['sendAs'].each do |row|
+ # next if row['isPrimary']
+ # next if !row['verificationStatus']
+ # next if row['verificationStatus'] != 'accepted'
+
+ # aliases.push({
+ # realname: row['displayName'],
+ # email: row['sendAsEmail'],
+ # })
+ # end
+
+ []
+ end
+
+ def self.user_info(id_token)
+ split = id_token.split('.')[1]
+ return if split.blank?
+
+ JSON.parse(Base64.decode64(split)).symbolize_keys
+ end
+
+end
diff --git a/spec/lib/external_credential/office365_spec.rb b/spec/lib/external_credential/office365_spec.rb
new file mode 100644
index 000000000..f99de3b3f
--- /dev/null
+++ b/spec/lib/external_credential/office365_spec.rb
@@ -0,0 +1,343 @@
+require 'rails_helper'
+
+RSpec.describe ExternalCredential::Office365 do
+
+ let(:token_url) { 'https://login.microsoftonline.com/common/oauth2/v2.0/token' }
+ let(:authorize_url) { "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?access_type=offline&client_id=#{client_id}&prompt=consent&redirect_uri=http%3A%2F%2Fzammad.example.com%2Fapi%2Fv1%2Fexternal_credentials%2Foffice365%2Fcallback&response_type=code&scope=https%3A%2F%2Foutlook.office.com%2FIMAP.AccessAsUser.All+https%3A%2F%2Foutlook.office.com%2FSMTP.Send+offline_access+openid+profile+email" }
+
+ let(:id_token) { 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImtnMkxZczJUMENUaklmajRydDZKSXluZW4zOCJ9.eyJhdWQiOiIyMTk4NTFhYS0wMDAwLTRhNDctMTExMS0zMmQwNzAyZTAxMjM0IiwiaXNzIjoiaHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tLzM2YTlhYjU1LWZpZmEtMjAyMC04YTc4LTkwcnM0NTRkYmNmZDJkL3YyLjAiLCJpYXQiOjEzMDE1NTE4MzUsIm5iZiI6MTMwMTU1MTgzNSwiZXhwIjoxNjAxNTU5NzQ0LCJuYW1lIjoiRXhhbXBsZSBVc2VyIiwib2lkIjoiMTExYWIyMTQtMTJzNy00M2NnLThiMTItM2ozM2UydDBjYXUyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoidGVzdEBleGFtcGxlLmNvbSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsInJoIjoiMC40MjM0LWZmZnNmZGdkaGRLZUpEU1hiejlMYXBSbUNHZGdmZ2RmZ0kwZHkwSEF1QlhaSEFNYy4iLCJzdWIiOiJYY0VlcmVyQkVnX0EzNWJlc2ZkczNMTElXNjU1NFQtUy0ycGRnZ2R1Z3c1NDNXT2xJIiwidGlkIjoiMzZhOWFiNTUtZmlmYS0yMDIwLThhNzgtOTByczQ1NGRiY2ZkMmQiLCJ1dGkiOiJEU0dGZ3Nhc2RkZmdqdGpyMzV3cWVlIiwidmVyIjoiMi4wIn0=.l0nglq4rIlkR29DFK3PQFQTjE-VeHdgLmcnXwGvT8Z-QBaQjeTAcoMrVpr0WdL6SRYiyn2YuqPnxey6N0IQdlmvTMBv0X_dng_y4CiQ8ABdZrQK0VSRWZViboJgW5iBvJYFcMmVoilHChueCzTBnS1Wp2KhirS2ymUkPHS6AB98K0tzOEYciR2eJsJ2JOdo-82oOW4w6tbbqMvzT3DzsxqPQRGe2hUbNqo6gcwJLqq4t0bNf5XiYThw1sv4IivERmqW_pfybXEseKyZGd4NnJ6WwwOgTz5tkoLwls_YeDZVcp_Fpw9XR7J0UlyPqLtoUEjVihdyrJjAbdtHFKdOjrw' }
+ let(:access_token) { '000.0000lvC3gAbjs8CYoKitfqM5LBS5N13374MCg6pNpZ28mxO2HuZvg0000_rsW00aACmFEto1BJeGDuu0000vmV6Esqv78iec-FbEe842ZevQtOOemQyQXjhMs62K1E6g3ehDLPRp6j4vtpSKSb6I-3MuDPfdzdqI23hM0' }
+ let(:refresh_token) { '1//00000VO1ES0hFCgYIARAAGAkSNwF-L9IraWQNMj5ZTqhB00006DssAYcpEyFks5OuvZ1337wrqX0D7tE5o71FIPzcWEMM5000004' }
+ let(:request_token) { nil } # not used but required by ExternalCredential API
+
+ let(:scope_payload) { 'https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access openid profile email' }
+ let(:scope_stub) { scope_payload }
+
+ let(:client_id) { '123' }
+ let(:client_secret) { '345' }
+ let(:authorization_code) { '567' }
+
+ let(:email_address) { 'test@example.com' }
+ let(:provider) { 'office365' }
+ let(:token_ttl) { 3599 }
+
+ let!(:token_response_payload) do
+ {
+ 'access_token' => access_token,
+ 'expires_in' => token_ttl,
+ 'refresh_token' => refresh_token,
+ 'scope' => scope_stub,
+ 'token_type' => 'Bearer',
+ 'id_token' => id_token,
+ 'type' => 'XOAUTH2',
+ }
+ end
+
+ describe '.link_account' do
+ let!(:authorization_payload) do
+ {
+ code: authorization_code,
+ scope: scope_payload,
+ authuser: '4',
+ hd: 'example.com',
+ prompt: 'consent',
+ controller: 'external_credentials',
+ action: 'callback',
+ provider: provider
+ }
+ end
+
+ before do
+ # we check the TTL of tokens and therefore need freeze the time
+ freeze_time
+ end
+
+ context 'success' do
+
+ let(:request_payload) do
+ {
+ 'client_secret' => client_secret,
+ 'code' => authorization_code,
+ 'grant_type' => 'authorization_code',
+ 'client_id' => client_id,
+ 'redirect_uri' => ExternalCredential.callback_url(provider),
+ }
+ end
+
+ before do
+ stub_request(:post, token_url)
+ .with(body: hash_including(request_payload))
+ .to_return(status: 200, body: token_response_payload.to_json, headers: {})
+
+ create(:external_credential, name: provider, credentials: { client_id: client_id, client_secret: client_secret } )
+ end
+
+ it 'creates a Channel instance' do
+
+ channel = described_class.link_account(request_token, authorization_payload)
+
+ expect(channel.options).to match(
+ a_hash_including(
+ 'inbound' => a_hash_including(
+ 'options' => a_hash_including(
+ 'auth_type' => 'XOAUTH2',
+ 'host' => 'outlook.office365.com',
+ 'ssl' => true,
+ 'user' => email_address,
+ )
+ ),
+ 'outbound' => a_hash_including(
+ 'options' => a_hash_including(
+ 'authentication' => 'xoauth2',
+ 'host' => 'smtp.office365.com',
+ 'domain' => 'office365.com',
+ 'port' => 587,
+ 'user' => email_address,
+ )
+ ),
+ 'auth' => a_hash_including(
+ 'access_token' => access_token,
+ 'expires_in' => token_ttl,
+ 'refresh_token' => refresh_token,
+ 'scope' => scope_stub,
+ 'token_type' => 'Bearer',
+ 'id_token' => id_token,
+ 'created_at' => Time.zone.now,
+ 'type' => 'XOAUTH2',
+ 'client_id' => client_id,
+ 'client_secret' => client_secret,
+ ),
+ )
+ )
+ end
+ end
+
+ context 'API errors' do
+
+ before do
+ stub_request(:post, token_url).to_return(status: response_status, body: response_payload&.to_json, headers: {})
+
+ create(:external_credential, name: provider, credentials: { client_id: client_id, client_secret: client_secret } )
+ end
+
+ shared_examples 'failed attempt' do
+ it 'raises an exception' do
+ expect do
+ described_class.link_account(request_token, authorization_payload)
+ end.to raise_error(RuntimeError, exception_message)
+ end
+ end
+
+ context '404 invalid_client' do
+ let(:response_status) { 404 }
+ let(:response_payload) do
+ {
+ "error": 'invalid_client',
+ "error_description": 'The OAuth client was not found.'
+ }
+ end
+ let(:exception_message) { 'Request failed! ERROR: invalid_client (The OAuth client was not found.)' }
+
+ include_examples 'failed attempt'
+ end
+
+ context '500 Internal Server Error' do
+ let(:response_status) { 500 }
+ let(:response_payload) { nil }
+ let(:exception_message) { 'Request failed! (code: 500)' }
+
+ include_examples 'failed attempt'
+ end
+ end
+ end
+
+ describe '.refresh_token' do
+ let!(:authorization_payload) do
+ {
+ code: authorization_code,
+ scope: scope_payload,
+ authuser: '4',
+ hd: 'example.com',
+ prompt: 'consent',
+ controller: 'external_credentials',
+ action: 'callback',
+ provider: provider
+ }
+ end
+ let!(:channel) do
+ stub_request(:post, token_url).to_return(status: 200, body: token_response_payload.to_json, headers: {})
+
+ create(:external_credential, name: provider, credentials: { client_id: client_id, client_secret: client_secret } )
+ channel = described_class.link_account(request_token, authorization_payload)
+
+ # remove stubs and allow new stubbing for tested requests
+ WebMock.reset!
+
+ channel
+ end
+
+ before do
+ # we check the TTL of tokens and therefore need freeze the time
+ freeze_time
+ end
+
+ context 'success' do
+
+ let!(:expired_at) { channel.options['auth']['created_at'] }
+
+ before do
+ stub_request(:post, token_url).to_return(status: 200, body: response_payload.to_json, headers: {})
+ end
+
+ context 'access_token still valid' do
+ let(:response_payload) do
+ {
+ 'access_token' => access_token,
+ 'expires_in' => token_ttl,
+ 'scope' => scope_stub,
+ 'token_type' => 'Bearer',
+ 'type' => 'XOAUTH2',
+ }
+ end
+
+ it 'does not refresh' do
+ expect do
+ channel.refresh_xoaut2!
+ end.not_to change { channel.options['auth']['created_at'] }
+ end
+ end
+
+ context 'access_token expired' do
+ let(:refreshed_access_token) { 'some_new_token' }
+
+ let(:response_payload) do
+ {
+ 'access_token' => refreshed_access_token,
+ 'expires_in' => token_ttl,
+ 'scope' => scope_stub,
+ 'token_type' => 'Bearer',
+ 'type' => 'XOAUTH2',
+ }
+ end
+
+ before do
+ travel 1.hour
+ end
+
+ it 'refreshes token' do
+ expect do
+ channel.refresh_xoaut2!
+ end.to change { channel.options['auth'] }.to a_hash_including(
+ 'created_at' => Time.zone.now,
+ 'access_token' => refreshed_access_token,
+ )
+ end
+ end
+ end
+
+ context 'API errors' do
+
+ before do
+ stub_request(:post, token_url).to_return(status: response_status, body: response_payload&.to_json, headers: {})
+
+ # invalidate existing token
+ travel 1.hour
+ end
+
+ shared_examples 'failed attempt' do
+ it 'raises an exception' do
+ expect do
+ channel.refresh_xoaut2!
+ end.to raise_error(RuntimeError, exception_message)
+ end
+ end
+
+ context '400 invalid_client' do
+ let(:response_status) { 400 }
+ let(:response_payload) do
+ {
+ "error": 'invalid_client',
+ "error_description": 'The OAuth client was not found.'
+ }
+ end
+ let(:exception_message) { /The OAuth client was not found/ }
+
+ include_examples 'failed attempt'
+ end
+
+ context '500 Internal Server Error' do
+ let(:response_status) { 500 }
+ let(:response_payload) { nil }
+ let(:exception_message) { /code: 500/ }
+
+ include_examples 'failed attempt'
+ end
+ end
+ end
+
+ describe '.request_account_to_link' do
+ it 'generates authorize_url from credentials' do
+ office365 = create(:external_credential, name: provider, credentials: { client_id: client_id, client_secret: client_secret } )
+ request = described_class.request_account_to_link(office365.credentials)
+
+ expect(request[:authorize_url]).to eq(authorize_url)
+ end
+
+ context 'errors' do
+
+ shared_examples 'failed attempt' do
+ it 'raises an exception' do
+ expect do
+ described_class.request_account_to_link(credentials, app_required)
+ end.to raise_error(Exceptions::UnprocessableEntity, exception_message)
+ end
+ end
+
+ context 'missing credentials' do
+ let(:credentials) { nil }
+ let(:app_required) { true }
+ let(:exception_message) { 'No Office365 app configured!' }
+
+ include_examples 'failed attempt'
+ end
+
+ context 'missing client_id' do
+ let(:credentials) do
+ {
+ client_secret: client_secret
+ }
+ end
+ let(:app_required) { false }
+ let(:exception_message) { 'No client_id param!' }
+
+ include_examples 'failed attempt'
+ end
+
+ context 'missing client_secret' do
+ let(:credentials) do
+ {
+ client_id: client_id
+ }
+ end
+ let(:app_required) { false }
+ let(:exception_message) { 'No client_secret param!' }
+
+ include_examples 'failed attempt'
+ end
+ end
+ end
+
+ describe '.generate_authorize_url' do
+ it 'generates valid URL' do
+ url = described_class.generate_authorize_url(client_id)
+ expect(url).to eq(authorize_url)
+ end
+ end
+
+ describe '.user_info' do
+ it 'extracts user information from id_token' do
+ info = described_class.user_info(id_token)
+ expect(info[:email]).to eq(email_address)
+ end
+ end
+end
diff --git a/spec/requests/integration/office365_spec.rb b/spec/requests/integration/office365_spec.rb
new file mode 100644
index 000000000..714bb1187
--- /dev/null
+++ b/spec/requests/integration/office365_spec.rb
@@ -0,0 +1,77 @@
+require 'rails_helper'
+RSpec.describe 'Office365 XOAUTH2' do # rubocop:disable RSpec/DescribeClass
+ let(:channel) do
+ create(:channel,
+ area: 'Office365::Account',
+ options: {
+ 'inbound' => {
+ 'adapter' => 'imap',
+ 'options' => {
+ 'auth_type' => 'XOAUTH2',
+ 'host' => 'outlook.office365.com',
+ 'ssl' => true,
+ 'user' => ENV['OFFICE365_USER'],
+ 'folder' => '',
+ 'keep_on_server' => false,
+ }
+ },
+ 'outbound' => {
+ 'adapter' => 'smtp',
+ 'options' => {
+ 'host' => 'smtp.office365.com',
+ 'domain' => 'office365.com',
+ 'port' => 587,
+ 'user' => ENV['OFFICE365_USER'],
+ 'authentication' => 'xoauth2',
+ }
+ },
+ 'auth' => {
+ 'type' => 'XOAUTH2',
+ 'provider' => 'office365',
+ 'access_token' => 'xxx',
+ 'expires_in' => 3599,
+ 'refresh_token' => ENV['OFFICE365_REFRESH_TOKEN'],
+ 'scope' => 'https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access openid profile email',
+ 'token_type' => 'Bearer',
+ 'id_token' => 'xxx',
+ 'created_at' => 30.days.ago,
+ 'client_id' => ENV['OFFICE365_CLIENT_ID'],
+ 'client_secret' => ENV['OFFICE365_CLIENT_SECRET'],
+ }
+ })
+ end
+
+ before do
+ required_envs = %w[OFFICE365_REFRESH_TOKEN OFFICE365_CLIENT_ID OFFICE365_CLIENT_SECRET OFFICE365_USER]
+ required_envs.each do |key|
+ skip("NOTICE: Missing environment variable #{key} for test! (Please fill up: #{required_envs.join(' && ')})") if ENV[key].blank?
+ end
+ end
+
+ context 'inbound' do
+ it 'succeeds' do
+ result = EmailHelper::Probe.inbound(channel.options[:inbound])
+ expect(result[:result]).to eq('ok')
+ end
+ end
+
+ context 'outbound' do
+ it 'succeeds' do
+ result = EmailHelper::Probe.outbound(channel.options[:outbound], ENV['OFFICE365_USER'], "test office365 oauth unittest #{Random.new_seed}")
+ expect(result[:result]).to eq('ok')
+ end
+ end
+
+ context 'when non-Office365 channels are present' do
+
+ let!(:email_address) { create(:email_address, channel: create(:channel, area: 'Some::Other')) }
+
+ before do
+ channel
+ end
+
+ it "doesn't remove email address assignments" do
+ expect { Channel.where(area: 'Office365::Account').find_each {} }.not_to change { email_address.reload.channel_id }
+ end
+ end
+end
diff --git a/spec/support/vcr.rb b/spec/support/vcr.rb
index b3d496990..2267e036d 100644
--- a/spec/support/vcr.rb
+++ b/spec/support/vcr.rb
@@ -1,4 +1,4 @@
-VCR_IGNORE_MATCHING_HOSTS = %w[zammad.com google.com elasticsearch selenium].freeze
+VCR_IGNORE_MATCHING_HOSTS = %w[zammad.com google.com elasticsearch selenium login.microsoftonline.com].freeze
VCR_IGNORE_MATCHING_REGEXPS = [/^192\.168\.\d+\.\d+$/].freeze
VCR.configure do |config|