- Shipped
- May 10, 2026 at 12:09 AM UTC
- Author
- Kamo
- Commit
- 6c3757d
Replace the UnsupportedOperationException stubs in every cloud provider with real HTTP calls against each backend's admin API: - Microsoft 365 → Microsoft Graph (/users, /domains, /verify, …) using the per-org OAuth access token. - Google Workspace → Admin SDK Directory + Site Verification using the per-org OAuth access token. - Zoho Mail → Zoho Mail Admin API **************** using the per-org OAuth access token. - IceWarp → IceWarp REST API ({serverUrl}/api/v1/…) using the apiKey stored in providerConfig. - Exchange (Online) → Microsoft Graph via a client-credentials token minted from the tenantId/clientId/clientSecret stored in providerConfig. Also expand the OAuth scopes requested by the Microsoft, Google, and Zoho flows so the per-org admin token actually has the privileges the new code needs (User.ReadWrite.All / Domain.ReadWrite.All for Graph, admin.directory.user / admin.directory.domain / siteverification for Google, **************** for Zoho). Existing connections will need to re-authorise with admin consent to pick up the new scopes. Shared HTTP plumbing lives in ProviderHttpClient — Bearer / Basic / API-key auth, JSON encoding, and error-message extraction across the various provider error envelopes. What's still stubbed (and why): - RealtimeNotifier on Microsoft 365, Google Workspace, IceWarp, and Exchange — every provider's push-notification API needs a public webhook receiver hosted by EmailService, plus (for Gmail) a Cloud Pub/Sub topic. Wiring that up is its own infra task. - On-prem Exchange (authMethod != OAUTH) — needs the SOAP EWS API; the ExchangeProvider throws a clear error in that path until EWS is added.