From 0529ae53ff9367dc5390c1137896b2eea33ceb64 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 9 Mar 2026 20:19:19 +0000 Subject: [PATCH] fix: 100% coverage, WCAG accessibility fixes, and documentation updates for per-user OAuth wizards Test coverage: - Add config=None branch test for dropbox, onedrive, google_drive views (100% coverage) - Add WATCH_FOLDER source-type test (folder_path vs folder key) - Add integration-not-found fallback-to-admin-mode test WCAG 2.1 AA fixes: - Add aria-labelledby="modalTitle" to role="dialog" modals in setup templates - Add aria-hidden="true" to decorative SVGs in callback templates - Add role="status" aria-label="Loading" to spinner divs - Add aria-live="polite" to processing-message and success/folder-selection regions - Add role="alert" aria-live="assertive" to error containers - Update "Return to Setup" link to preserve integration_id in user mode Docs: update DropboxSetup.md, GoogleDriveSetup.md, OneDriveSetup.md with per-user OAuth flow section Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- docs/DropboxSetup.md | 40 +++++++++----- docs/GoogleDriveSetup.md | 18 ++++++- docs/OneDriveSetup.md | 38 ++++++++----- frontend/templates/dropbox.html | 2 +- frontend/templates/dropbox_callback.html | 24 ++++++--- frontend/templates/google_drive.html | 2 +- frontend/templates/google_drive_callback.html | 30 +++++++---- frontend/templates/onedrive.html | 2 +- frontend/templates/onedrive_callback.html | 24 ++++++--- tests/test_views_dropbox.py | 53 ++++++++++++++++++- tests/test_views_google_drive.py | 31 +++++++++++ tests/test_views_onedrive.py | 53 +++++++++++++++++++ 12 files changed, 259 insertions(+), 58 deletions(-) diff --git a/docs/DropboxSetup.md b/docs/DropboxSetup.md index 37de4701..8923a595 100644 --- a/docs/DropboxSetup.md +++ b/docs/DropboxSetup.md @@ -15,23 +15,37 @@ For a complete list of configuration options, see the [Configuration Guide](Conf ## Setup Methods -You can set up Dropbox integration in two ways: +DocuElevate supports two distinct Dropbox OAuth flows: -1. **Using the Built-in Setup Wizard (Recommended)**: An interactive setup experience available at `/dropbox-setup` in the web interface -2. **Manual Setup**: Following the step-by-step instructions in this document +1. **Per-User Integration Wizard (Recommended for end users)**: Triggered from the Integrations dashboard (`/integrations`) by clicking **Authorize** on a Dropbox destination or Dropbox-backed Watch Folder. Credentials are saved securely to your personal integration record — global settings are never exposed. +2. **System-Level Setup Wizard**: Available at `/dropbox-setup` for administrators configuring the global system-wide Dropbox connection. Generates environment variables for all worker nodes. +3. **Manual Setup**: Following the step-by-step instructions in this document. -## Using the Setup Wizard +## Per-User OAuth Flow (Integrations Dashboard) -The easiest way to set up Dropbox integration is to use the built-in setup wizard: +End users authorize their own Dropbox integration from the **Integrations** dashboard: -1. Navigate to the `/dropbox-setup` page in your DocuElevate instance -2. Follow the on-screen instructions to create a Dropbox app -3. Enter your App Key and App Secret in the wizard -4. Optionally specify a custom folder path for uploads -5. Click "Start Authentication Flow" to begin the authorization process -6. Complete the Dropbox authentication process -7. The system will automatically exchange the authorization code for a refresh token -8. Copy the generated environment variables for your worker nodes +1. Navigate to `/integrations` and click **+ Add Destination** (or **+ Add Source** for Watch Folder). +2. Create a Dropbox destination integration (or a Watch Folder with `source_type = dropbox`). +3. Click the **Authorize** button next to the integration — it links directly to the OAuth wizard pre-loaded with your integration's configuration. +4. Enter your Dropbox App Key and App Secret in the wizard (or use the global admin credentials if pre-configured). +5. Click **Start Authentication Flow**, authorize access in Dropbox, and the refresh token is automatically saved to your personal integration record. +6. The page redirects back to `/integrations` on success. Re-authorization is available at any time via the **Re-Authorize** button. + +> **Note:** Your credentials are stored encrypted per-integration and are never mixed with other users' data. Each user can have multiple Dropbox integrations with independent tokens. + +## Using the System-Level Setup Wizard (Admin) + +The easiest way to configure the global Dropbox integration is to use the built-in setup wizard: + +1. Navigate to the `/dropbox-setup` page in your DocuElevate instance. +2. Follow the on-screen instructions to create a Dropbox app. +3. Enter your App Key and App Secret in the wizard. +4. Optionally specify a custom folder path for uploads. +5. Click **Start Authentication Flow** to begin the authorization process. +6. Complete the Dropbox authentication process. +7. The system will automatically exchange the authorization code for a refresh token. +8. Copy the generated environment variables for your worker nodes. The wizard handles all the token exchange steps and provides you with the exact configuration needed for your environment. diff --git a/docs/GoogleDriveSetup.md b/docs/GoogleDriveSetup.md index 73107077..e85addcc 100644 --- a/docs/GoogleDriveSetup.md +++ b/docs/GoogleDriveSetup.md @@ -16,14 +16,28 @@ This guide explains how to set up the Google Drive integration for DocuElevate. For a complete list of configuration options, see the [Configuration Guide](ConfigurationGuide.md). -## Authentication Methods +## Authentication Methods and Setup Flows DocuElevate supports two authentication methods for Google Drive: 1. **OAuth Authentication (Recommended)** - User-based authentication that provides better security and control. Recommended for most deployments. 2. **Service Account Authentication** - Server-to-server authentication that doesn't require user interaction. Useful for specific enterprise deployments. -## Method 1: OAuth Authentication Setup (Recommended) +### Per-User OAuth Flow (Integrations Dashboard) + +End users can authorize their own Google Drive integration directly from the **Integrations** dashboard — no admin involvement required: + +1. Navigate to `/integrations` and click **+ Add Destination** (or **+ Add Source** for Watch Folder). +2. Create a Google Drive destination integration (or a Watch Folder with `source_type = google_drive`). +3. Click the **Authorize** button — it opens the OAuth wizard pre-loaded with your integration's configuration. +4. Enter your Google OAuth Client ID and Client Secret in the wizard. +5. Click **Start Authentication Flow** and authorize access in Google. +6. Credentials are saved automatically to your personal integration record; the page redirects back to `/integrations`. +7. Re-authorization is available at any time via the **Re-Authorize** button. + +> **Note:** Credentials are stored encrypted per-integration. Each user can hold multiple Google Drive integrations with independent tokens targeting different folders or accounts. + +## Method 1: OAuth Authentication Setup (System-Level) The OAuth method is preferred as it: - Provides better security with token expiration and refresh diff --git a/docs/OneDriveSetup.md b/docs/OneDriveSetup.md index 035fb61e..e9a555f4 100644 --- a/docs/OneDriveSetup.md +++ b/docs/OneDriveSetup.md @@ -16,22 +16,36 @@ For a complete list of configuration options, see the [Configuration Guide](Conf ## Setup Methods -You can set up OneDrive integration in two ways: +DocuElevate supports two distinct OneDrive OAuth flows: -1. **Using the Auth Wizard (Recommended)**: An interactive setup experience available at `/onedrive-setup` in the web interface -2. **Manual Setup**: Following the step-by-step instructions in this document +1. **Per-User Integration Wizard (Recommended for end users)**: Triggered from the Integrations dashboard (`/integrations`) by clicking **Authorize** on a OneDrive destination or OneDrive-backed Watch Folder. Credentials are saved securely to your personal integration record. +2. **System-Level Setup Wizard**: Available at `/onedrive-setup` for administrators configuring the global system-wide OneDrive connection. +3. **Manual Setup**: Following the step-by-step instructions in this document. -## Using the Auth Wizard +## Per-User OAuth Flow (Integrations Dashboard) -The easiest way to set up OneDrive integration is to use the built-in auth wizard: +End users authorize their own OneDrive integration from the **Integrations** dashboard: -1. Register an application in Azure AD (see steps below) -2. Navigate to the OneDrive Setup page at `/onedrive-setup` -3. Enter your Client ID and other required information -4. Click "Start Authentication Flow" -5. Complete the Microsoft authentication process -6. The system will automatically exchange the authorization code for a refresh token -7. Copy the generated environment variables for your worker nodes +1. Navigate to `/integrations` and click **+ Add Destination** (or **+ Add Source** for Watch Folder). +2. Create a OneDrive destination integration (or a Watch Folder with `source_type = onedrive`). +3. Click the **Authorize** button next to the integration — it links directly to the OAuth wizard pre-loaded with your integration's configuration. +4. Enter your Azure AD Client ID and Client Secret in the wizard. +5. Click **Start Authentication Flow**, authorize access via Microsoft, and the refresh token is automatically saved to your personal integration record. +6. The page redirects back to `/integrations` on success. Re-authorization is available at any time via the **Re-Authorize** button. + +> **Note:** Your credentials are stored encrypted per-integration and are never mixed with other users' data. Each user can have multiple OneDrive integrations with independent tokens. + +## Using the System-Level Auth Wizard (Admin) + +The easiest way to configure the global OneDrive integration is to use the built-in auth wizard: + +1. Register an application in Azure AD (see steps below). +2. Navigate to the OneDrive Setup page at `/onedrive-setup`. +3. Enter your Client ID and other required information. +4. Click **Start Authentication Flow**. +5. Complete the Microsoft authentication process. +6. The system will automatically exchange the authorization code for a refresh token. +7. Copy the generated environment variables for your worker nodes. The auth wizard handles all the token exchange steps and provides you with the exact configuration needed for your environment. diff --git a/frontend/templates/dropbox.html b/frontend/templates/dropbox.html index fb8fb469..a94a5b96 100644 --- a/frontend/templates/dropbox.html +++ b/frontend/templates/dropbox.html @@ -241,7 +241,7 @@ DROPBOX_FOLDER={{ folder_path|default('/Documents/Uploads', true) }} -