Release 5.2.1 of Microsoft plugins for Moodle 5.2

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: [ "*" ]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -10,6 +10,9 @@ on:
       - 'MOODLE_*_STABLE'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
@@ -27,31 +30,26 @@ jobs:
       mariadb:
         image: mariadb:10.11
         env:
-          MYSQL_USER: 'root'
           MYSQL_ALLOW_EMPTY_PASSWORD: "true"
-          MYSQL_CHARACTER_SET_SERVER: "utf8mb4"
-          MYSQL_COLLATION_SERVER: "utf8mb4_unicode_ci"
-          MYSQL_INNODB_FILE_PER_TABLE: "1"
-          MYSQL_INNODB_FILE_FORMAT: "Barracuda"
         ports:
           - 3306:3306
         options: --health-cmd="mysqladmin ping" --health-interval 10s --health-timeout 5s --health-retries 3
 
     strategy:
       fail-fast: false
       matrix:
-        moodle-branch: ['MOODLE_502_STABLE']
-        php: [8.3, 8.4]
-        database: [pgsql, mariadb]
+        moodle-branch: [ 'MOODLE_502_STABLE' ]
+        php: [ 8.3, 8.4 ]
+        database: [ pgsql, mariadb ]
 
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           path: plugin
 
       - name: Setup PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php }}
           ini-values: max_input_vars=5000

classes/adminsetting/auth_oidc_admin_setting_loginflow.php

@@ -30,7 +30,7 @@
  */
 class auth_oidc_admin_setting_loginflow extends \admin_setting {
     /** @var array Array of valid login flow types. */
-    protected $flowtypes = ['authcode', 'rocreds'];
+    protected $flowtypes = ['authcode'];
 
     /**
      * Return the setting

classes/adminsetting/auth_oidc_admin_setting_secretexpiryrecipients.php

@@ -0,0 +1,59 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Admin setting class for the secret expiry notification recipients setting.
+ *
+ * @package    auth_oidc
+ * @author     Lai Wei <lai.wei@enovation.ie>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @copyright  (C) 2026 onwards Microsoft, Inc. (http://microsoft.com/)
+ */
+
+namespace auth_oidc\adminsetting;
+
+defined('MOODLE_INTERNAL') || die();
+
+require_once($CFG->dirroot . '/auth/oidc/lib.php');
+
+/**
+ * Admin setting for the comma-separated list of secret expiry notification recipients.
+ *
+ * Extends the standard text setting with validation that rejects the value when any entry is
+ * not a valid email address, so the local_o365 notifysecretexpiry task is not left silently
+ * dropping recipients at run time.
+ */
+class auth_oidc_admin_setting_secretexpiryrecipients extends \admin_setting_configtext {
+    /**
+     * Validate the submitted list of recipient email addresses.
+     *
+     * @param string $data The submitted value.
+     * @return string|true True when valid; a translatable error string otherwise.
+     */
+    public function validate($data) {
+        $result = parent::validate($data);
+        if ($result !== true) {
+            return $result;
+        }
+
+        $invalidemails = auth_oidc_validate_secret_expiry_recipients((string) $data);
+        if ($invalidemails) {
+            return get_string('error_secretexpiryrecipients_invalid', 'auth_oidc', implode(', ', $invalidemails));
+        }
+
+        return true;
+    }
+}

classes/adminsetting/auth_oidc_admin_setting_section_heading.php

@@ -0,0 +1,60 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Definition of a section heading admin setting that can be hidden with hide_if().
+ *
+ * @package auth_oidc
+ * @author Lai Wei <lai.wei@enovation.ie>
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @copyright (C) 2021 onwards Microsoft, Inc. (http://microsoft.com/)
+ */
+
+namespace auth_oidc\adminsetting;
+
+use admin_setting_heading;
+use html_writer;
+
+/**
+ * A section heading that participates in admin settings hide_if() dependencies.
+ *
+ * The core {@see admin_setting_heading} renders only a bare <h3>, with no named
+ * form control and no .form-item wrapper, so the admin settings show/hide
+ * JavaScript (lib/amd/src/showhidesettings.js) cannot target it and any
+ * hide_if() condition applied to it is silently ignored. This subclass wraps the
+ * heading in a .form-item container and adds a hidden input carrying the
+ * setting's form field name, so the heading is shown and hidden together with
+ * the settings it introduces.
+ */
+class auth_oidc_admin_setting_section_heading extends admin_setting_heading {
+    /**
+     * Output the heading wrapped so that hide_if() dependencies can act on it.
+     *
+     * @param mixed $data
+     * @param string $query
+     * @return string
+     */
+    public function output_html($data, $query = '') {
+        $heading = parent::output_html($data, $query);
+        $hiddeninput = html_writer::empty_tag('input', [
+            'type' => 'hidden',
+            'name' => 's_' . $this->plugin . '_' . $this->name,
+            'value' => 1,
+        ]);
+
+        return html_writer::div($hiddeninput . $heading, 'form-item', ['id' => 'admin-' . $this->name]);
+    }
+}

classes/adminsetting/auth_oidc_admin_setting_stateexpiry.php

@@ -0,0 +1,54 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <https://www.gnu.org/licenses/>.
+
+/**
+ * Admin setting class for the OIDC login state expiry setting.
+ *
+ * @package    auth_oidc
+ * @author     Lai Wei <lai.wei@enovation.ie>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @copyright  (C) 2026 onwards Microsoft, Inc. (http://microsoft.com/)
+ */
+
+namespace auth_oidc\adminsetting;
+
+/**
+ * Admin setting for the OIDC login state expiry, in minutes.
+ *
+ * Extends the standard text setting with validation that rejects values below one minute. A
+ * value of zero (or less) would cause the state cleanup task to delete login state records
+ * almost immediately, breaking any login that is currently in progress.
+ */
+class auth_oidc_admin_setting_stateexpiry extends \admin_setting_configtext {
+    /**
+     * Validate the submitted expiry value.
+     *
+     * @param string $data The submitted value.
+     * @return string|true True when valid; a translatable error string otherwise.
+     */
+    public function validate($data) {
+        $result = parent::validate($data);
+        if ($result !== true) {
+            return $result;
+        }
+
+        if ((int) $data < 1) {
+            return get_string('error_stateexpiry_min', 'auth_oidc');
+        }
+
+        return true;
+    }
+}

classes/adminsetting/iconselect.css

@@ -7,6 +7,7 @@ label.iconselect img {
     width: 25px;
     height: 25px;
     padding: 10px;
+    margin-right: 0;
 }
 input.iconselect {
     display: none;

classes/form/application.php

@@ -397,6 +397,15 @@ public function validation($data, $files) {
             }
         }
 
+        // Validate secret expiry notification recipients (only relevant with secret auth).
+        if (isset($data['secretexpiryrecipients']) && $data['clientauthmethod'] == AUTH_OIDC_AUTH_METHOD_SECRET) {
+            $invalidemails = auth_oidc_validate_secret_expiry_recipients((string) $data['secretexpiryrecipients']);
+            if ($invalidemails) {
+                $errors['secretexpiryrecipients'] =
+                    get_string('error_secretexpiryrecipients_invalid', 'auth_oidc', implode(', ', $invalidemails));
+            }
+        }
+
         return $errors;
     }
 

classes/hook/before_login_completed.php

@@ -0,0 +1,50 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace auth_oidc\hook;
+
+use auth_oidc\jwt;
+
+/**
+ * Allow plugins to perform additional checks before a user login is completed.
+ *
+ * This hook is dispatched by auth_oidc after authenticate_user_login() has
+ * succeeded, but before complete_user_login() is called. The hook manager
+ * does not catch exceptions raised by callbacks, so a callback can reject
+ * the login by throwing an exception (e.g. \moodle_exception) - doing so
+ * will propagate out of the hook dispatch and prevent complete_user_login()
+ * from being called. There is no other signal (e.g. a flag on this hook) to
+ * reject the login; a plain return from a callback allows the login to
+ * proceed.
+ *
+ * @package    auth_oidc
+ * @copyright  2026 Ariadne
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+#[\core\attribute\label('Allow plugins to perform additional checks before a user login is completed.')]
+#[\core\attribute\tags('user', 'login')]
+class before_login_completed {
+    /**
+     * Constructor for the hook.
+     *
+     * @param jwt $idtoken The id_token of the user attempting to log in.
+     */
+    public function __construct(
+        /** @var jwt The id_token of the user attempting to log in */
+        public readonly jwt $idtoken
+    ) {
+    }
+}