Release 5.2.1 of Microsoft plugins for Moodle 5.2 - #71

…it conditions

…tion

…oidc

…url() instead of strpos

… user login is completed

- Dispatch the hook in all three handlelogin() branches (it previously
  only fired for already-connected users, missing the username-changed
  and new/unconnected-user paths - the latter being the main case for
  gating first-time logins).
- Dispatch only after authenticate_user_login() succeeds, immediately
  before complete_user_login(), instead of unconditionally.
- Fix the hook's PHPDoc/attribute text and $idtoken property doc, which
  were copy-pasted from unrelated core hooks.
- Add the missing @PARAM tag for the constructor.
- Document the login-rejection contract: callbacks reject a login by
  throwing an exception (e.g. \moodle_exception), since the hook manager
  does not catch callback exceptions.

- Fix typo "Nofications" -> "Notifications"
- Qualify notification frequency as the default schedule, since the
  scheduled task can be rescheduled by admins
- Use "expiry" consistently instead of "expiration" to match other
  strings in this file

…ed/unknown OIDC login state

…name

Manually matched users are keyed by Entra UPN, which often differs from the Moodle username. handlelogin() found the matched user but then discarded it, continuing with the UPN as the username and failing with "User not found in Moodle." Now it binds to the matched user's actual username instead. Also normalizes entraidupn casing on write and read to avoid case-mismatch failures.

…oodle core

…_STABLE

…_STABLE

…_STABLE

…_STABLE

…_STABLE

…_STABLE

…_STABLE

…_STABLE

…_STABLE

# Conflicts:
#	auth/oidc/db/upgrade.php
#	auth/oidc/version.php

The "Secret expiry notification" section heading was always shown once
local_o365 is installed, even when its only field (secret expiry
recipients) is JS-hidden because the client authentication method isn't
Secret or the IdP type is Other. This left an empty section with just a
heading and the page's Save button above it. Apply the same hide_if()
conditions to the heading so it hides together with the field it
introduces.

…_STABLE

auth_oidc_validate_auth_settings() in lib.php (added in a13728f, 'Re-organise
configuration pages for auth_oidc and local_o365...') calls
get_string('auth_settings_validation_error', 'auth_oidc') to build the
notification shown when settings validation fails, but the corresponding
lang string was never added.

Cherry-picked from #70
(2c8b686)

Bring in line with wip-136768-m405: drop the auth_settings_validation_error
added directly after auth_oidcdescription (from #70)
and the stale error_masked_secret_not_changed wording that predates the
"Change" checkbox UX, replacing both with the current wording already used
on m405, in the error-strings block after error_invalid_custom_claim.

Also removes a pre-existing upstream duplicate,
errorauthdisconnectinvalidmethod (added twice, identically, in
6f8e952 back in 2015). Harmless since both copies had the same
value, but redundant.

…_STABLE

…s session

Microsoft's admin-consent and add-tenant callbacks can arrive via a
cross-site navigation that drops the session cookie under
SameSite=Lax, kicking the initiating admin back to the login screen
instead of completing the flow. Capture the initiating user's id in
the OIDC state and re-establish their session on the callback when
none is currently active.

Hardening applied on top of the base fix, per code review:
- Only re-login when there is no active session (or it's a guest),
  never switching away an already-logged-in different user.
- Don't clobber a caller-provided initiatinguserid already present in
  the state params.
- Require sesskey on mode_adminconsent() and mode_tenantsaddgo() so
  the privileged flow can't be CSRF-initiated.
- Invalidate any pending OIDC CSRF state (state row + cookie) on
  logout, so an explicit logout mid-flow can't be undone by a later
  callback.
- Only allow the initiatinguserid auto-login when CSRF-cookie
  verification actually ran, closing an unauthenticated-login gap on
  non-HTTPS deployments without the CSRF cookie.

…v2 IdP

When the auth_oidc plugin is configured to use Microsoft identity platform (v2) IdP, the "Microsoft Entra tenant" and "OneDrive for Business URL" settings need to be manual filled after providing admin consent.
The local_o365 plugin settings page displays a message about it, but this is invisible unless debugging is turned on.
This commit changes how the message is displayed so it's more obvious.

…_STABLE

# Conflicts:
#	auth/oidc/version.php

…_STABLE

…onditional Access

When the auth_oidc plugin is configured to use Microsoft identity platform (v2.0) IdP, an app-only access token is requested right after admin consent to auto-detect the "Microsoft Entra tenant" and "OneDrive for Business URL" settings. Conditional Access policies can block this specific token request (AADSTS53003) even though admin consent itself succeeded, which previously surfaced as a fatal error page instead of returning the admin to the settings page.

This commit catches that specific failure and silently redirects back to the local_o365 settings page instead of throwing a fatal error, since the tenant and OneDrive for Business URL can still be auto-detected via other Graph API calls, so no warning is needed.

The re-association of the browser session with the admin who initiated consent is also moved earlier, before the token request, so a failure there no longer leaves the admin looking logged out on the resulting page.

Also removes the now-unused local_o365 language string "settings_adminconsent_error_53003".

…_STABLE

# Conflicts:
#	auth/oidc/classes/loginflow/authcode.php

The fix in the previous commit applied hide_if() to the section heading,
but core's admin_setting_heading renders only a bare <h3> with no named
form control and no .form-item wrapper, so showhidesettings.js cannot
target it and the condition was silently ignored. The heading stayed
visible with an empty section whenever the client authentication method
wasn't Secret or the IdP type was Other.

Add auth_oidc_admin_setting_section_heading, which wraps the heading in a
.form-item container with a hidden input carrying the setting's form
field name, so the admin settings show/hide JavaScript can hide it
together with the field it introduces.

…_STABLE

# Conflicts:
#	auth/oidc/settings.php

auth_oidc: reject email addresses that are not valid in the "secret
expiry notification recipients" setting when it is saved, both on the
admin settings page (new auth_oidc_admin_setting_secretexpiryrecipients
class) and in the application configuration wizard form.

local_o365: notifysecretexpiry now DNS-checks each configured recipient
domain (MX, falling back to A/AAAA) before sending, skips recipients that
cannot receive mail, and marks the task as failed so the misconfiguration
is visible to admins instead of the address being silently dropped.

(cherry picked from commit 975552ce8d3880be725cbfcbccd8cba6307b3cee)

…_STABLE

# Conflicts:
#	auth/oidc/lang/en/auth_oidc.php
#	auth/oidc/settings.php
#	auth/oidc/version.php

- Root ci.yml: rebuild matrix internal-deps from each plugin's
  version.php dependencies (including transitive ones); drop the
  no-op bare include entries.
- Check out all dependency folders via sparse-checkout and move
  whole directories (keeping dotfiles) into extra-plugins; fail
  the job if a declared dependency is missing.
- Drop MYSQL_USER=root and the MySQL env vars the mariadb image
  ignores; pin mariadb:10 -> mariadb:10.11.
- Add "permissions: contents: read" to every workflow.
- Sync per-plugin workflow templates to actions/checkout v6.1.0.

Remove the separate microsoft_365 and microsoft_365_copilot icon images.
The current microsoft.svg logo is now used for both Microsoft and
Microsoft 365, renamed to microsoft_365.svg and referred to as the
Microsoft 365 logo.

Sites that had selected the Microsoft or Microsoft 365 Copilot icon are
migrated to the Microsoft 365 logo on upgrade.

…_STABLE

# Conflicts:
#	auth/oidc/db/upgrade.php