Added Microsoft 365 Gatekeeper: SharePoint, Outlook, Calendar

AGENTS.md

@@ -20,6 +20,7 @@ reviewing or answering questions about code under its directory:
 | `packages/gatekeeper-context/AGENTS.md` | Context Library collections and sharing |
 | `packages/gatekeeper-cloudflare/AGENTS.md` | Cloudflare OAuth, billing, Workers Observability |
 | `packages/gatekeeper-x/AGENTS.md` | X, whose reads are billed |
+| `packages/gatekeeper-microsoft/AGENTS.md` | Microsoft 365: SharePoint, Outlook, Calendar |
 | `packages/gatekeeper-websearch/AGENTS.md` | Web Search |
 | `packages/mcp-shared/AGENTS.md` | MCP / MCP Server Portal gatekeepers |
 | `packages/observability/AGENTS.md` | server logging, issue reporting, metrics |

README.md

@@ -215,6 +215,7 @@ Each gatekeeper package contains instructions for how to set it up:
 * [Home Assistant](packages/gatekeeper-homeassistant/README.md)
 * [Slack API](packages/gatekeeper-slack/README.md)
 * [Spotify](packages/gatekeeper-spotify/README.md)
+* [Microsoft 365](packages/gatekeeper-microsoft/README.md)
 * [X API](packages/gatekeeper-x/README.md)
 * [ZoomInfo API](packages/gatekeeper-zoominfo/README.md)
 

docs/observers.md

@@ -852,6 +852,9 @@ its resource types.
 | **context** | Context Library singleton | **C** | Track collections whose contents a read revealed (search results, a collection's listing, a document); verify each is in the observer's sharing domain and is public, is everyone-viewable, or grants the observer's Context account a viewer, editor, or owner role. Uses the kit's default observer cap to bound per-read verifier fanout. The top-level collection listing tracks nothing: its titles, descriptions and counts are discovery metadata the agent catalog already advertises unobserved. The denial never names the collection, which the refused collaborator cannot read. |
 | **x** | Account | **C** | Admit any observer with a working X connection: public posts, profiles, public Lists and follow graphs need only an X account. Reads private to the account -- bookmarks, likes, mute state, private Lists, and any page holding a protected account's post -- authorize against one synthetic `owner` collection, which admits only an observer connected as the same X user. |
 | **x** | Post / List | **C** | As Account, plus a check on every open that the observer's own X account can see the bound post or List (`canViewPost` / `canViewList`). Each check is a read billed to the observer's connection, so a passed check is trusted for an hour; a failed one never is. |
+| **microsoft** | SharePoint (all, site, library, folder, file, list, page) | **C** | Track every object a read revealed as a unit (`sharepoint-observers.ts`), since SharePoint breaks inheritance at any level and one container's ACL never vouches for its contents; verify each by probing it with the observer's own token, twenty to a `$batch`, where 403 and 404 both mean no access. A file's content and its version history are their own units, since someone may see a file they can't open; a draft the owner read pins its version, and the probe passes only if the observer is shown the same one. |
+| **microsoft** | Outlook Mailbox / Folder / Conversation / Sender | **C** | Track the mailbox, folders and messages each read revealed (`outlook-observers.ts`); verify each by a probe `GET` as the observer: the whole mailbox needs access to all of it (someone shared one folder gets 404), a folder or message needs that folder or message. |
+| **microsoft** | Outlook Calendar / Availability | **C** | Track calendar units at the detail level each read revealed (`calendar-observers.ts`): a calendar unit admits an observer only when the owner's `calendarPermissions` give them a role that sees that level (`calendar-acl.ts`, where a group entry can only lower the organization default), which only the owner can read, so a unit of someone else's calendar admits that owner alone; an `availability:<address>` unit only when `getSchedule` as the observer answers for that address; the all-calendars unit admits nobody but the owner. |
 | **x** | Profile | **C** | As Account: a public profile needs only an X account, and the `owner` collection covers a protected user's posts. Accepted over-permissiveness for every X binding: an author who has blocked the observer is still readable through the gadget, since checking each author per observer per read would cost a read each and what leaks is public. |
 
 ### 9.3 The "broad binding" lens

packages/gatekeeper-microsoft/AGENTS.md

@@ -0,0 +1,12 @@
+# Microsoft 365 gatekeeper
+
+Microsoft 365 (Entra ID OAuth, Microsoft Graph). It has three resources. **SharePoint**'s binding is one of: all of SharePoint & OneDrive, a site, a library or OneDrive, a folder, a file, a list, or a page; its configurator starts at "all" and drills down. **Outlook**'s is one mailbox (own or shared), optionally narrowed to a folder, a conversation or senders, at `read`/`draft`/`send`. **Calendar**'s is every calendar (for chat), one calendar (own or shared) at `freeBusy`/`limited`/`full` detail (for a gadget shared with that calendar's sharees), or availability only, at `read`/`edit`/`schedule`; `CALENDAR_RESOURCE` (`…/calendar/*`) must stay ahead of `OUTLOOK_RESOURCE` (`…/*`) in `ALL_RESOURCES`, since the Workshop takes the first matching pattern. `plans/microsoft-365-gatekeeper.md`, `plans/microsoft-outlook.md` and `plans/microsoft-calendar.md` are the design records and `storage-schema.md` the storage layout.
+
+- Agents act with the user's delegated permissions; the binding narrows further, and `ScopeGuard` (`sharepoint-scope.ts`) is the chokepoint. Every ID is checked before Graph is called (a folder by walking its ancestry), paths are measured from the binding's top, and a temporary `~N` ID is resolved at every entry point. `graph-api.ts` is the only code that holds a token: it refuses non-Graph hosts, and follows a download redirect once, only to a SharePoint or conversion host, without the `Authorization` header.
+- A connection and its bindings are pinned to `(tenantId, objectId)` from the `id_token`, confirmed against `/me`. Tenant policy (`tenantPolicy` in `microsoft-env.ts`) refuses `common`/`consumers`, and refuses `organizations` without a GUID allowlist. Each resource's effective access is the lowest of the binding's own level (Outlook and Calendar), the deployment ceiling (`MICROSOFT_SHAREPOINT_ACCESS`, `MICROSOFT_OUTLOOK_ACCESS`, `MICROSOFT_CALENDAR_ACCESS`) and the grant's scopes, and a SharePoint file, folder or library binding drops to read when Graph's undocumented `shared.effectiveRoles` says the user can only read it (only ever lowering). `MICROSOFT_SHAREPOINT_SITES=selected` asks for `Sites.Selected` instead of the `.All` permissions, but a connection's behavior follows what it was granted (`grantedSharePoint`), never the setting; a read-only binding's session (`SharePointReader`, `OutlookReader`, `CalendarReader`) has no write methods at all.
+- Observers use tracked collections of *access units* (site/drive/item/list/listItem/page), because SharePoint breaks inheritance at any level. One container's ACL never stands for its contents.
+- Graph behaviours that return wrong-but-plausible data, verified live: `/sites?search=` can return nothing on a working tenant, so sites come from Microsoft Search (`/search/query`) plus followed sites; `/sites/{id}/lists` omits Site Pages, so pages are detected through the pages endpoint; search lags uploads by hours on a new tenant, so nothing may depend on finding a fresh file.
+- Outlook's chokepoint is `OutlookContext.guarded` (`outlook-session.ts`): every message ID is read with its metadata and checked against the scope before anything else is read or changed, and a listing's Graph filter is only an optimization. 400, 403 and 404 all mean "not in this binding". Every request sends `Prefer: IdType="ImmutableId"`, so IDs survive moves and sending. Send is never auto-approvable and is exactly-once through a Message-ID fixed at proposal, found across the whole mailbox before `/send` (`submit` in `outlook-actions.ts` handles the half-second after a 202 when a second `/send` is 403). Inbox rules, permanent deletion, permissions and send-as are deliberately not offered.
+- Exchange gives a mailbox four concurrent requests, so `$batch` entries can 429 individually and `GraphApi.batch` resends them; Sent Items' `from` is a legacy X.500 DN, replaced with the owner's address on read; Outlook web links use EWS IDs, converted in `parseOutlookUrl`. New-message hooks run through one `OutlookHookDriver` per connection and mailbox, which reads by cursor and treats Graph change notifications (when `BASE_URL` is public https) only as a prompt to read sooner.
+- Calendar's chokepoint is `CalendarContext.guarded` (`calendar-session.ts`): an event's parent entry ID (`Binary 0x0E09`) must equal the bound calendar's (`Binary 0x0FFF`, pinned at binding) before anything is shown, and listings are re-confirmed the same way, because a calendar-scoped `calendarView` is not trusted. Redaction to the binding's detail level is the gatekeeper's (`eventInfo` in `calendar-events.ts`), not Graph's: the user's own token sees everything. Observers (`calendar-observers.ts`) admit someone to a calendar unit only when the owner's `calendarPermissions` give them a role that sees that level (`calendar-acl.ts`; a group entry can only lower the org default), to `availability:<address>` only when `getSchedule` as them answers, and to `calendars:<id>` never but the user. Anything that mails someone (`calendar.invitations`, `calendar.responses`) is never auto-approvable and is `claimBeforeApply`; changes are fenced with If-Match on the change key, creations with a `transactionId`.
+- Tests: Node (`vitest.config.ts`, where the configurator frame suites drive the generated frames in Chromium through `__tests__/frame-host.ts`) and workerd against a fake Graph (`vitest.worker.config.ts`), both run by `pnpm --filter @gadgets/microsoft-gatekeeper test:run` after it builds the configurator frames; and a live-tenant contract suite (`vitest.contract.config.ts`), run by `test:contract`, which is skipped unless `.dev.vars` and a tokens file are present.