- Shipped
- November 13, 2026 at 9:14 AM UTC
- Author
- Kamo
- Commit
- e43c7bf
One DriveSource abstraction, two providers, resolved per sending identity (?from=): - GoogleDriveSource: Workspace service-account delegation to the member's mailbox with **************** **************** now keys its cache by scope too), or a personal Gmail's own drive.file grant. - OneDriveSource: the Microsoft 365 app-only Graph token (needs Files.ReadWrite.All, read from the token's roles), or a personal Outlook's delegated Files.ReadWrite. App-only can open every drive in the tenant, so Kamo enforces the member's view: own drive, or a foreign item whose sharing names the member / org / anyone; nextLink coders must stay in the member's own drive; tenant sites are not listed. - Personal consent: OAuthFlowKind.DRIVE, routed like GROUPWARE on the registered callbacks; stored on the member's contact_integrations row (GOOGLE_DRIVE / ONEDRIVE, syncEnabled=false so no sync job or the daemon sweep touches it), refreshed on use. /api/email/drive: status, check (live probe; names the missing scope/permission and what the admin pastes), list **************** search, Google resumable upload / Graph upload session), save-attachment (Antivirus-screened), access-check, grant (no provider email), link, consent/url, consent. Send: docLinks with provider GOOGLE_DRIVE|ONEDRIVE + fileId join the DOC_ACCESS_CHECK matrix (BLOCKED when the sender can't share), are granted after the dry run (Google sendNotificationEmail=false, Graph invite sendInvitation=false / createLink), render in the same Shared docs card with the file's own URL, and a failed send takes back only the permissions this send created. driveConnected = the cached live probe. Message reads gain driveLinks[] (docs/drive.google.com, *.sharepoint.com, onedrive.live.com, 1drv.ms) described through the reader's own source within a 2.5 s budget. DL4.4 spike: referenceAttachment kept behind **************** (off) and not adopted — **************** are /beta-only on Graph.