Insufficient permissions getting users for Microsoft Outlook integration #18408
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 2 Skipped Deployments
|
WalkthroughPatch releases across Microsoft Outlook actions and sources and a package version bump. A functional change modifies microsoft_outlook.app.mjs to await axios and catch 403 responses, throwing a specific permission error; other modules only update version metadata. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant U as Component (options loader / caller)
participant A as Outlook App (_makeRequest)
participant G as Microsoft Graph API
U->>A: Request (e.g., GET /v1.0/users)
A->>G: HTTP request (await axios)
alt 200 OK
G-->>A: 200 + data
A-->>U: return data
else 403 Forbidden
G-->>A: 403 Forbidden + error
A->>A: detect 403 in catch
Note right of A #lightblue: Throw user-facing permission error
A-->>U: permission error (Authorization_RequestDenied)
else other errors
G-->>A: error
A->>A: rethrow original error
A-->>U: error
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (5)
components/microsoft_outlook/actions/add-label-to-email/add-label-to-email.mjs (1)
35-39: Guard against undefined categories to avoid runtime errors.
Ifmessage.categoriesis undefined,includesand spread will throw.- const labels = message?.categories; + const labels = Array.isArray(message?.categories) ? message.categories : []; @@ - if (labels.includes(this.label)) { + if (labels.includes(this.label)) { throw new ConfigurationError(`Message already contains label "${this.label}".`); } @@ - data: { - categories: [ - ...labels, - this.label, - ], - }, + data: { + categories: [ + ...labels, + this.label, + ], + },Also applies to: 45-49
components/microsoft_outlook/package.json (1)
15-20: Upgrade axios in components/microsoft_outlook/package.json (lines 15–20): ^0.21.1 → a patched 1.x (recommended ^1.11.0 — latest stable as of Sep 18, 2025; minimum safe >=1.8.3).0.21.1 is affected by multiple known vulnerabilities (ReDoS, CSRF, SSRF — including CVE‑2025‑27152); update dependency and run install/audit.
components/microsoft_outlook/actions/move-email-to-folder/move-email-to-folder.mjs (1)
18-25: Fix propDefinition mismatch: 'folderIds' (string[]) vs action 'folderId' (string).microsoft_outlook.app.mjs defines propDefinition "folderIds" as type "string[]", but components/microsoft_outlook/actions/move-email-to-folder/move-email-to-folder.mjs uses it while declaring a single-string prop "folderId". Either add a single "folderId" propDefinition in microsoft_outlook.app.mjs (type: "string", options same as folderIds) and reference that, or change the action to accept a "string[]" and handle multiple IDs.
Files: components/microsoft_outlook/microsoft_outlook.app.mjs (prop: folderIds), components/microsoft_outlook/actions/move-email-to-folder/move-email-to-folder.mjs (prop: folderId).components/microsoft_outlook/actions/find-email/find-email.mjs (1)
46-53: Add ConsistencyLevel header when using $searchfind-email passes "$search" but components/microsoft_outlook/microsoft_outlook.app.mjs::_getHeaders (lines ~261–277) does not set "ConsistencyLevel: eventual". Add logic (in _makeRequest or the paginate wrapper) to merge ConsistencyLevel: "eventual" into request headers whenever params include $search; set params["$count"]=true when a count is required. Files to update: components/microsoft_outlook/microsoft_outlook.app.mjs (≈lines 261–277) and/or the paginate wrapper; call site: components/microsoft_outlook/actions/find-email/find-email.mjs (lines 46–53).
components/microsoft_outlook/microsoft_outlook.app.mjs (1)
261-267: Allow caller-specified headers (merge, don’t overwrite)._headers ignores the incoming headers object; advanced Graph queries often need extra headers.
Apply this diff:
- _getHeaders() { - return { + _getHeaders(extra = {}) { + return { "Authorization": `Bearer ${this.$auth.oauth_access_token}`, "accept": "application/json", "Content-Type": "application/json", - }; + ...extra, + }; },
🧹 Nitpick comments (16)
components/microsoft_outlook/sources/new-email/new-email.mjs (1)
74-76: Log error details in catch to aid debugging (status/code/message).- } catch { - console.log(`Could not fetch message with ID: ${resourceId}`); + } catch (err) { + console.log(`Could not fetch message with ID: ${resourceId}`, { + status: err?.response?.status, + code: err?.response?.data?.error?.code, + message: err?.message, + }); }components/microsoft_outlook/actions/list-folders/list-folders.mjs (1)
32-34: Use strict equality in pluralization (nit).- $.export("$summary", `Successfully retrieved ${folders.length} folder${folders.length != 1 + $.export("$summary", `Successfully retrieved ${folders.length} folder${folders.length !== 1 ? "s" : ""}.`);components/microsoft_outlook/sources/new-email-in-shared-folder/new-email-in-shared-folder.mjs (2)
70-73: Use message ID for dedupe and a numeric timestamp.
conversationIdcan collide across multiple messages;tsshould be a number.- id: item.conversationId, - summary: `A new email with id: "${item.conversationId}" was received!`, - ts: item.createdDateTime, + id: item.id, + summary: `A new email with id: "${item.id}" was received!`, + ts: Date.parse(item.createdDateTime),
21-35: Clarify/verify required Graph permissions for userId options.
Populate ofuserIdtypically needs delegatedUser.Read.AllorDirectory.Read.Allwith admin consent; otherwise 403s occur. Ensure the app scopes and consent flow reflect this and update the prop description in the app to inform users.components/microsoft_outlook/actions/list-labels/list-labels.mjs (1)
13-19: Defaultvalueto an empty array to avoid.lengthon undefined.- const { value } = await this.microsoftOutlook.listLabels({ + const { value = [] } = await this.microsoftOutlook.listLabels({ $, }); - $.export("$summary", `Successfully retrieved ${value.length} label${value.length != 1 + $.export("$summary", `Successfully retrieved ${value.length} label${value.length !== 1 ? "s" : ""}.`);components/microsoft_outlook/sources/new-attachment-received/new-attachment-received.mjs (3)
73-80: Avoid unnecessary base64 round‑trip; use Buffer directly.- const messageAttachment = await this.microsoftOutlook.getAttachment({ + const messageAttachment = await this.microsoftOutlook.getAttachment({ messageId: item.messageId, attachmentId: item.id, responseType: "arraybuffer", }); - const rawcontent = messageAttachment.toString("base64"); - const buffer = Buffer.from(rawcontent, "base64"); + const buffer = Buffer.isBuffer(messageAttachment) + ? messageAttachment + : Buffer.from(messageAttachment);
100-105: Stable dedupe key for attachments; fall back whencontentIdis missing.
Some attachments lackcontentId. Preferid, thencontentId, then a composite.- return { - id: item.contentId, - summary: `New attachment ${item.name}`, - ts: Date.parse(item.messageReceivedDateTime), - }; + return { + id: item.id ?? item.contentId ?? `${item.messageId}:${item.name}`, + summary: `New attachment ${item.name}`, + ts: Date.parse(item.messageReceivedDateTime), + };
130-132: Log error details in catch to aid debugging (status/code/message).- } catch { - console.log(`Could not fetch message with ID: ${resourceId}`); + } catch (err) { + console.log(`Could not fetch message with ID: ${resourceId}`, { + status: err?.response?.status, + code: err?.response?.data?.error?.code, + message: err?.message, + }); }components/microsoft_outlook/actions/update-contact/update-contact.mjs (1)
8-8: Update deprecated docs.microsoft.com URL.Prefer learn.microsoft.com to avoid redirects.
- description: "Update an existing contact, [See the docs](https://docs.microsoft.com/en-us/graph/api/user-post-contacts)", + description: "Update an existing contact, [See the docs](https://learn.microsoft.com/graph/api/user-post-contacts)",components/microsoft_outlook/actions/download-attachment/download-attachment.mjs (1)
41-53: Use the provided syncDir and avoid base64 round‑trip.Write directly to the selected dir and avoid unnecessary encode/decode.
- const response = await this.microsoftOutlook.getAttachment({ + const data = await this.microsoftOutlook.getAttachment({ $, messageId: this.messageId, attachmentId: this.attachmentId, responseType: "arraybuffer", }); - - const rawcontent = response.toString("base64"); - const buffer = Buffer.from(rawcontent, "base64"); - const downloadedFilepath = `/tmp/${this.filename}`; - fs.writeFileSync(downloadedFilepath, buffer); + const downloadedFilepath = `${this.syncDir}/${this.filename}`; + fs.writeFileSync(downloadedFilepath, Buffer.from(data));Please confirm
getAttachmentreturns the raw body (Buffer/ArrayBuffer) and not an Axios response object. If it returns{ data }, adjust accordingly.components/microsoft_outlook/actions/approve-workflow/approve-workflow.mjs (1)
31-35: Avoid spreadingthisinto message options.Limit fields to intended props to prevent leaking internal fields.
- const opts = { - content: `Click here to approve the workflow: ${resume_url}, \nand cancel here: ${cancel_url}`, - ccRecipients: [], - bccRecipients: [], - ...this, - }; + const opts = { + content: `Click here to approve the workflow: ${resume_url}, \nand cancel here: ${cancel_url}`, + ccRecipients: [], + bccRecipients: [], + recipients: this.recipients, + subject: this.subject, + };components/microsoft_outlook/actions/create-contact/create-contact.mjs (1)
49-55: Guard against undefinedemailAddresses.Current code throws if
emailAddressesis not provided.- emailAddresses: this.emailAddresses.map((a, i) => ({ + emailAddresses: (this.emailAddresses || []).map((a, i) => ({ address: a, name: `Email #${i + 1}`, })),components/microsoft_outlook/actions/find-contacts/find-contacts.mjs (1)
31-46: Make matching case‑insensitive and use strict equality.Improves UX for searches.
- if ( - contact?.displayName?.includes(this.searchString) || - contact?.givenName?.includes(this.searchString) || - contact?.surname?.includes(this.searchString) || - contact?.emailAddresses?.find( - (e) => e?.address == this.searchString || e?.name?.includes(this.searchString), - ) - ) { + const q = (this.searchString || "").toLowerCase(); + const match = + contact?.displayName?.toLowerCase?.().includes(q) || + contact?.givenName?.toLowerCase?.().includes(q) || + contact?.surname?.toLowerCase?.().includes(q) || + contact?.emailAddresses?.some((e) => + e?.address?.toLowerCase?.() === q || e?.name?.toLowerCase?.().includes(q), + ); + if (match) {components/microsoft_outlook/actions/remove-label-from-email/remove-label-from-email.mjs (1)
34-39: Guard against missing categories to avoid runtime error.labels can be undefined; labels.indexOf will throw.
Apply this diff:
- let labels = message?.categories; - - const index = labels.indexOf(this.label); + let labels = message?.categories ?? []; + if (!Array.isArray(labels)) labels = []; + const index = labels.indexOf(this.label);components/microsoft_outlook/microsoft_outlook.app.mjs (2)
274-279: Auto-add ConsistencyLevel for advanced queries ($search/$count).Graph requires ConsistencyLevel: eventual for these; set it centrally.
Apply this diff:
const config = { url: this._getUrl(path), headers: this._getHeaders(headers), ...otherConfig, }; + if (otherConfig?.params?.$search != null || otherConfig?.params?.$count != null) { + config.headers["ConsistencyLevel"] = "eventual"; + }
91-95: Fix typos and labels in prop definitions.Minor text polish.
Apply this diff:
- emailAddresses: { - label: "Email adresses", + emailAddresses: { + label: "Email addresses", description: "Email addresses", type: "string[]", optional: true, }, - businessPhones: { - label: "Recipients", + businessPhones: { + label: "Business Phones", description: "Array of phone numbers", type: "string[]", optional: true, }, - search: { + search: { type: "string", label: "Search", - description: "Search for an email in Microsoft Outlook. Can search for specific message properties such as `to:example@example.com` or `subject:example`. If the property is excluded, the search targets the default propertes `from`, `subject`, and `body`. For example, `pizza` will search for messages with the word `pizza` in the subject, body, or from address, but `to:example@example.com` will only search for messages to `example@example.com`.", + description: "Search for an email in Microsoft Outlook. Can search for specific message properties such as `to:example@example.com` or `subject:example`. If the property is excluded, the search targets the default properties `from`, `subject`, and `body`. For example, `pizza` will search for messages with the word `pizza` in the subject, body, or from address, but `to:example@example.com` will only search for messages to `example@example.com`.", optional: true, },Also applies to: 97-101, 239-243
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (22)
components/microsoft_outlook/actions/add-label-to-email/add-label-to-email.mjs(1 hunks)components/microsoft_outlook/actions/approve-workflow/approve-workflow.mjs(1 hunks)components/microsoft_outlook/actions/create-contact/create-contact.mjs(1 hunks)components/microsoft_outlook/actions/create-draft-email/create-draft-email.mjs(1 hunks)components/microsoft_outlook/actions/download-attachment/download-attachment.mjs(1 hunks)components/microsoft_outlook/actions/find-contacts/find-contacts.mjs(1 hunks)components/microsoft_outlook/actions/find-email/find-email.mjs(1 hunks)components/microsoft_outlook/actions/find-shared-folder-email/find-shared-folder-email.mjs(1 hunks)components/microsoft_outlook/actions/list-contacts/list-contacts.mjs(1 hunks)components/microsoft_outlook/actions/list-folders/list-folders.mjs(1 hunks)components/microsoft_outlook/actions/list-labels/list-labels.mjs(1 hunks)components/microsoft_outlook/actions/move-email-to-folder/move-email-to-folder.mjs(1 hunks)components/microsoft_outlook/actions/remove-label-from-email/remove-label-from-email.mjs(1 hunks)components/microsoft_outlook/actions/reply-to-email/reply-to-email.mjs(1 hunks)components/microsoft_outlook/actions/send-email/send-email.mjs(1 hunks)components/microsoft_outlook/actions/update-contact/update-contact.mjs(1 hunks)components/microsoft_outlook/microsoft_outlook.app.mjs(1 hunks)components/microsoft_outlook/package.json(1 hunks)components/microsoft_outlook/sources/new-attachment-received/new-attachment-received.mjs(1 hunks)components/microsoft_outlook/sources/new-contact/new-contact.mjs(1 hunks)components/microsoft_outlook/sources/new-email-in-shared-folder/new-email-in-shared-folder.mjs(1 hunks)components/microsoft_outlook/sources/new-email/new-email.mjs(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Publish TypeScript components
- GitHub Check: Verify TypeScript components
- GitHub Check: Lint Code Base
🔇 Additional comments (23)
components/microsoft_outlook/sources/new-email/new-email.mjs (1)
10-10: Version bump only — LGTM.components/microsoft_outlook/actions/add-label-to-email/add-label-to-email.mjs (1)
8-8: Version bump only — LGTM.components/microsoft_outlook/actions/list-folders/list-folders.mjs (1)
7-7: Version bump only — LGTM.components/microsoft_outlook/sources/new-contact/new-contact.mjs (1)
8-8: Version bump only — LGTM.components/microsoft_outlook/sources/new-email-in-shared-folder/new-email-in-shared-folder.mjs (1)
9-9: Version bump only — LGTM.components/microsoft_outlook/actions/list-labels/list-labels.mjs (1)
7-7: Version bump only — LGTM.components/microsoft_outlook/actions/create-draft-email/create-draft-email.mjs (1)
7-7: Version bump only — LGTM.components/microsoft_outlook/sources/new-attachment-received/new-attachment-received.mjs (1)
9-9: Version bump only — LGTM.components/microsoft_outlook/actions/update-contact/update-contact.mjs (1)
6-6: Version bump LGTM.No functional changes in this action.
components/microsoft_outlook/package.json (1)
3-3: Package version bump LGTM.components/microsoft_outlook/actions/download-attachment/download-attachment.mjs (1)
9-9: Version bump LGTM.components/microsoft_outlook/actions/approve-workflow/approve-workflow.mjs (1)
7-7: Version bump LGTM.components/microsoft_outlook/actions/create-contact/create-contact.mjs (1)
6-6: Version bump LGTM.components/microsoft_outlook/actions/move-email-to-folder/move-email-to-folder.mjs (1)
7-7: Version bump LGTM.components/microsoft_outlook/actions/find-contacts/find-contacts.mjs (1)
6-6: Version bump LGTM.components/microsoft_outlook/actions/find-email/find-email.mjs (1)
7-7: Version bump LGTM.components/microsoft_outlook/actions/list-contacts/list-contacts.mjs (1)
6-6: LGTM — metadata bump only.components/microsoft_outlook/actions/send-email/send-email.mjs (1)
7-7: LGTM — metadata bump only.components/microsoft_outlook/actions/find-shared-folder-email/find-shared-folder-email.mjs (1)
7-7: LGTM — metadata bump only.components/microsoft_outlook/actions/remove-label-from-email/remove-label-from-email.mjs (1)
7-7: LGTM — metadata bump only.components/microsoft_outlook/actions/reply-to-email/reply-to-email.mjs (1)
7-7: LGTM — metadata bump only.components/microsoft_outlook/microsoft_outlook.app.mjs (2)
194-207: Harden user label rendering when mail is null; fall back to UPN.Some users don’t have mail; use userPrincipalName.
[suggest_minor_refactor]
Apply this diff:- async options() { - const { value: users } = await this.listUsers(); - return users?.map(({ - id: value, displayName, mail, - }) => ({ - value, - label: `${displayName} (${mail})`, - })) || []; - }, + async options() { + const { value: users } = await this.listUsers(); + return users?.map(({ + id: value, displayName, mail, userPrincipalName, + }) => ({ + value, + label: `${displayName || userPrincipalName || value} (${mail || userPrincipalName || "no mailbox"})`, + })) || []; + },
194-207: Confirm scopes to resolve issue #18375.The /users endpoint typically requires admin‑granted Graph scopes. After merging the 403 handling, please re‑test the User ID prop options with an account that has User.Read.All (delegated) or appropriate directory-read permissions.
Resolves #18375
Summary by CodeRabbit
Bug Fixes
Chores