# Clean Set: Microsoft 365 SSO + SharePoint Streaming + Tracking (Plain PHP)

## What changed
- No local email/password users.
- Microsoft user identity ONLY (SSO).
- Graph calls are **delegated** (runs as signed-in user), so SharePoint permissions work naturally.

---

## Setup Checklist

### 1) Entra ID App Registration (Web)
- Redirect URI:
  - `https://YOURDOMAIN/content/oauth_callback.php`
- Create a Client Secret (copy it)
- API permissions (Delegated):
  - `openid`, `profile`, `email`, `offline_access`
  - `User.Read`
  - `Sites.Read.All`
  - `Files.Read`
- Admin consent may be required in your tenant.

### 2) Database
Create DB and import schema:

```bash
mysql -u root -p filetracker < schema.sql
```

Update `db.php`.

### 3) OAuth config
Update `oauth_config.php`:
- TENANT_ID / CLIENT_ID / CLIENT_SECRET
- REDIRECT_URI (must match exactly)

### 4) PDF.js (UMD build)
Upload into `assets/pdfjs/`:
- `pdf.min.js`
- `pdf.worker.min.js`

Downloads:
- https://cdnjs.cloudflare.com/ajax/libs/pdf.js/4.7.76/pdf.min.js
- https://cdnjs.cloudflare.com/ajax/libs/pdf.js/4.7.76/pdf.worker.min.js

### 5) Add SharePoint files
After login, use:

`sp_lookup.php?url=<URLENCODED_SHAREPOINT_LINK>`

Insert into `files`:

```sql
INSERT INTO files (title, type, sp_site_id, sp_drive_id, sp_item_id, is_active)
VALUES ('Module 1 PDF', 'pdf', '<siteId>', '<driveId>', '<itemId>', 1);
```

### 6) Run
- `/login.php` (redirects to Microsoft)
- `/dashboard.php`
- `/logs.php`

---

## Notes
- Tokens auto-refresh using refresh_token in `graph_token.php`.
- `logout.php` clears local session only.
