[ForeignKeyCN]

Summary

Two things, to bring OneDrive in line with Outlook (#4163) and Teams (#4164) and with n8n's Microsoft OneDrive node.

1. Each user signs in (new Mode on the API Key credential, next to Service Principal)

Today an OneDrive authorization is shared: everyone using the tool works on the OneDrive of the one person who signed in from the console (OAuth), or of a named user (Service Principal). For a chat agent that many people use ("save this to my OneDrive", "find my Q3 report"), each person should work on their own OneDrive.

• The credential holds only the app registration (tenant, client ID, secret, cloud) and the Sign-in Callback URL; no user token is stored in Dify's credential. Default Drive Owner is now optional (it was required for Service Principal, which still reports a clear error at run time when neither it nor the tool's Drive Owner is set).
• The first time a chat user needs OneDrive, the tool returns a Microsoft sign-in link (authorization code + PKCE + random state). A new plugin endpoint (GET /onedrive/callback) receives the browser's return and only stores the one-time code under its state; it never sees the client secret or the PKCE verifier.
• The tool redeems the code and keeps the user's tokens in plugin storage, keyed by a hash of client_id | Dify user ID and Fernet-encrypted with a key derived (HKDF) from the client secret. Tokens never appear in tool output or logs; the user ID comes from Dify's runtime, never from the LLM. The tools then act on that user's /me/drive; the Drive Owner parameter is refused in this mode.
• Delegated scopes: User.Read Files.Read.All Files.ReadWrite.All offline_access (the OAuth credential's, plus User.Read to name the signed-in account and offline_access explicitly).
• Sign Out of OneDrive tool, onedrive_sign_out: the new Agent exposes tools by their bare name and rejects duplicates, so it cannot share a name with Outlook's or Teams' sign-out.
• Search works in this mode: it runs as the user, so it does not have the Service Principal limitation (SharePoint search with app-only tokens).
• Validation, the callback page (forwarded-link warning and cancel link) and the "signed in as" note are the same as in Outlook and Teams; the sign-in code is shared apart from the scopes, endpoint path and key-derivation label.

2. n8n parity

n8n's node has file copy/delete/download/get/rename/search/share/upload and folder create/delete/get children/rename/search/share. The existing four tools covered get, download, delete, search and upload; this adds the rest:

n8n	New tool
Folder > Get Children	List Folder (onedrive_list_folder): items in a folder (root by default), up to 200, following Graph's paging links only on the Graph host
Folder > Create	Create Folder (onedrive_create_folder): a name or a path such as Reports/2026; missing folders are created, existing ones reused; .. refused
File / Folder > Rename	Rename File or Folder (onedrive_rename)
File > Copy	Copy File (onedrive_copy): same or another folder, optional new name; a taken name gets a number appended. OneDrive copies asynchronously: the tool polls the monitor URL for up to 15 s without the bearer token (it is pre-authenticated and on another host) and otherwise reports in_progress
File / Folder > Share	Create Sharing Link (onedrive_share): view / edit / embed, organization / anonymous; defaults to a view link for the organization, with a hint when the tenant refuses the link type
File > Upload	Upload File gains File Content (text), to save text an agent was asked to save, and Parent Folder ID (both optional, so existing workflows are unchanged)

New tool names carry an onedrive_ prefix for the same Agent name-uniqueness reason; the existing four keep their names so workflows do not break.

Existing OAuth and Service Principal authorizations keep working unchanged; the version goes to 1.0.0, matching Outlook and Teams.

Release Notes

• Each user signs in: a new authorization mode for chat agents. Each person chatting with the agent signs in once with their own Microsoft account, and the tools work on their own OneDrive. Needs the new sign-in endpoint (plugin details → Endpoints) registered as a Web redirect URI on the app, and delegated Graph permissions.
• New Sign Out of OneDrive tool for this mode.
• New tools matching n8n: List Folder, Create Folder, Rename File or Folder, Copy File, Create Sharing Link.
• Upload File can save text as a file and upload into a given folder.
• Default Drive Owner is optional on the API Key credential (still needed for Service Principal).
• Existing OAuth and Service Principal authorizations are unchanged.

Change Type

• Documentation / non-plugin change
• Non-LLM plugin (tools, extensions, datasource, etc.)
• LLM plugin

Screenshots / Videos

Agent on a self-hosted Dify with Outlook, Teams and OneDrive, each using Each user signs in:

Each plugin with its own per-user authorization	Upload an attached file: sign-in, then upload	Download link, then sign out

Authorization form	Callback URL, Default Drive Owner left empty

Testing

• Unit tests: 94 passed (pytest): per-user sign-in (full flow, cached and refreshed tokens, per-user isolation and encryption at rest, secret rotation, revoked vs. temporarily failing refresh, callback state checks and the cancel link), per-user validation (secret check, localhost, wrong path), the new tools (paging and the foreign-host link guard, nested folder creation and reuse, a file in the way, rename validation, copy body / conflict behaviour / monitor polled without the token, share defaults and refused links, text upload into a folder), and every tool's output variables on success and on a Graph error.
• End to end on a self-hosted Dify (Community 1.16.1) with an Agent app that also has Outlook (feat(outlook): Each user signs in, so a chat agent works on each user's own mailbox (1.0.0) #4163) and Teams (feat(teams): Each user signs in, so a chat agent acts as each user (1.0.0) #4164), against a Microsoft 365 tenant: a PDF attached in the chat → OneDrive sign-in link → Microsoft sign-in → uploaded to the user's OneDrive; a download link for it; "Sign out of OneDrive" → signed out, while the Outlook sign-in stays (checked in plugin storage).
• Checked on the server: the OneDrive plugin's storage holds only Fernet ciphertext, separate from Outlook's and Teams', and the plugin daemon, API and worker logs contain no tokens.
• Not run end to end yet: the five new tools (list folder, create folder, rename, copy, share) and the text upload are covered by the unit tests above, not by a live chat; copy timing and which link types a tenant allows depend on the tenant.
• Existing OAuth authorization upgraded in place and kept working.

Checklist

• I have read the contribution guidelines
• Version bumped in manifest.yaml (0.1.1 → 1.0.0)