feat(connectors): OneDrive checks follow the design's rows, copy and states

Merged
EV
1d ago
+718-166

Description

Twelfth backend PR for the connector checks redesign, stacked on #16202. OneDrive follows the design's rows, copy and states. It uses the shared Microsoft sign-in and Graph error rows from the Microsoft helpers PR.

OneDrive

  • Rows:
    • The 9 checks are the design's 8 rows, with its names: "Sign in to Microsoft", "List users", "Find selected users", "Find a OneDrive", "Read OneDrive changes", "Read file permissions", "List groups", "Read group members".
    • The drive count (a discovery check) shares the "List users" row (row_id). "List users" sets validates_binding, as the design's form unlock says.
    • Dependencies follow the design's run order. One change from the design: "Find a OneDrive" also runs after "Find selected users". When no selected user is found, there is no OneDrive to open.
  • Copy:
    • Every failure gives the design's line and description, with the grant the app needs.
    • Passing checks give what they found: "Tenant user list is readable", "Up to {n} OneDrives" (the count), "All {n} selected users found", "Opened the OneDrive of {user}", "Read changes in {user}'s OneDrive", "Read members of {group}".
  • Partial find: "Find selected users".
    • Some missing: Incomplete, for example "User not found: gone@example.com". The drive checks after it walk the found users.
    • None found: Failed ("No selected user found").
    • An entry that is not an email ("Not an email address: {entry}") and a list of blanks ("Users holds only blank entries") fail with their rows. A locked user (423) is Incomplete ("User is locked").
  • Honest passes. These checks passed while testing nothing:
    • "Read file permissions" on OneDrives with no file: now Incomplete ("No files found to test").
    • "Read group members" when every sampled group hides its members: now Incomplete ("No readable groups found").
  • Other states. A group that went away between the listing and the member read is Incomplete ("Sample group disappeared"). A user count that does not end is Incomplete ("User list did not end"), not an unexpected error. A sample with no OneDrive is Incomplete ("No OneDrives found to test").

Not in this PR: the design's two-step "List users" row ("counting…" while the count runs, and Successful with the caveat "Could not count every OneDrive" when it does not finish). That needs the planned two-step framework PR (A4). Until then, the two checks share one row through row_id.

How Has This Been Tested?

  • New unit tests (test_onedrive_check_row_text.py): the names and the shared row, the pass lines, the user denial, the partial find (and that the drive check after it runs), none found (and that it stops the drive check), the entry rows, the sample states, the group stop, and the rate limit.
  • Existing OneDrive tests updated to the new states.
  • Connector, server and EE unit tests (top of the Microsoft stack): 5599 passed, 1 failed (web/test_browser_lifecycle.py, a web connector test that also fails without this change), 25 skipped. ty and pre-commit are clean.
  • OneDrive has no live capability-check test.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.
  • [Optional] Override Linear Check

Generated by Claude Code

Summary by cubic

Redesigns the OneDrive capability checks to match the connector checks redesign: the 9 checks now map to the design's 8 rows ("List users", "Find selected users", "Find a OneDrive", …), with the drive count sharing the "List users" row, which now validates the binding. Check ordering follows the design, with one change: "Find a OneDrive" also runs after "Find selected users" so no found user stops it.

Failure rows now name the grant the app needs, and passing rows report what the check found. Checks that previously passed without testing anything now report Incomplete: an empty OneDrive for the permission read, and sample groups that all hide their members. "Find selected users" is a partial find: missing users are Incomplete and the drive checks walk the found ones, while none found fails the row. Invalid entries and blank user lists get their own rows. A drive probe that ends on its last sampled feed page now moves on to the next drive instead of raising.

The design's two-step "List users" row (counting, then a caveat) is deferred to the planned two-step framework PR; until then the two checks share one row through row_id.

Summary by CodeRabbit

  • New Features

    • OneDrive capability checks now provide clearer summaries and detailed results for users, drives, files, permissions, deltas, and groups.
    • Selected-user checks report partial results, locked accounts, missing users, and access issues.
    • Drive and group checks distinguish unavailable resources from permission failures.
    • Configuration validation now identifies blank user entries separately from invalid addresses.

  • Bug Fixes

    • Empty or exhausted OneDrive data checks are reported as incomplete or inconclusive instead of passing with advisories.
    • Permission checks continue evaluating other drives when an empty drive provides no testable files.