API accounts — system description
Data model of external storage and mail accounts, the Google and Microsoft OAuth flows, the service account, folder sync, the legacy path alias, permissions and known limitations.
Overview
Master data of external storage and mail accounts (Google OAuth, Google service account, Microsoft 365): name, client ID and secret, credentials JSON, tenant, scopes, root folder. The legacy masterdata/googleaccount path inherits the same class unchanged; it has no menu item, it remains because of the OAuth bridges in the web root, and its permission checks also use the API account keys.
Data model
Table names carry the installation's own prefix in the database.
| Table | Purpose |
|---|---|
gdrive_account | the account: name, provider (if the column exists), auth type, client ID, secret, tenant, scopes, root folder, status, date |
gdrive_token | the account's OAuth token |
gdrive_folder | synchronised Drive folders (written by the masterdata/googledrive model) |
file | record of the uploaded credentials file |
Process
- List: name, provider, auth type, status, date; per row OAuth start and stop, service account start, Microsoft consent link, edit.
- Save: name 1–255 characters, client ID required; the form also shows the Microsoft redirect address.
- Google OAuth: offline access, scopes
drive,gmail.send,gmail.modify, the redirect address fixed in the installation, CSRF state in the session, redirect to Google's consent page. - Microsoft: redirect to the Microsoft authorise address based on the account's tenant and scopes (default
offline_access Files.ReadWrite.All Mail.Read). The callback compares the session's CSRF state in a timing-safe way, exchanges the code for a token, stores it and notifies the opening window. - Refresh connection: set active; stop: set inactive and delete the token.
- Service account start: Drive connection with the credentials JSON, lists at most 100 folders, sets the account active.
- Credentials upload:
.jsononly, into the credentials folder, an existing file is not overwritten; recorded in thefiletable. - Folder sync: the list of Drive folders into the
gdrive_foldertable. - Delete: physical, without a reference check.
Permissions
- Layer 1: list and form require access; every modifying operation (save, delete, OAuth, service account, upload, sync) requires modify permission.
- Layer 2:
list(only on reload),add/editon saving,delete,connect(OAuth start). Thestatuskey is not checked by the controller. - Layer 3: none.
- The Microsoft callback runs without a permission check; it is protected by the CSRF state stored in the session.
Known limitations
- The first page load renders the list even without permission; only the reload checks the function permission.
- The header delete button is visible even without permission.
- Deletion does not check the tokens or the storage references of documents.