feat: Onedrive connector with sensitive actions using HITL

docker/.env.example

@@ -203,10 +203,11 @@ STT_SERVICE=local/base
 # AIRTABLE_CLIENT_SECRET=
 # AIRTABLE_REDIRECT_URI=http://localhost:8000/api/v1/auth/airtable/connector/callback
 
-# -- Microsoft Teams --
-# TEAMS_CLIENT_ID=
-# TEAMS_CLIENT_SECRET=
+# -- Microsoft OAuth (Teams & OneDrive) --
+# MICROSOFT_CLIENT_ID=
+# MICROSOFT_CLIENT_SECRET=
 # TEAMS_REDIRECT_URI=http://localhost:8000/api/v1/auth/teams/connector/callback
+# ONEDRIVE_REDIRECT_URI=http://localhost:8000/api/v1/auth/onedrive/connector/callback
 
 # -- Composio --
 # COMPOSIO_API_KEY=

surfsense_backend/.env.example

@@ -74,7 +74,7 @@ DISCORD_CLIENT_SECRET=your_discord_client_secret_here
 DISCORD_REDIRECT_URI=http://localhost:8000/api/v1/auth/discord/connector/callback
 DISCORD_BOT_TOKEN=your_bot_token_from_developer_portal
 
-# Atlassian OAuth Configuration
+# Atlassian OAuth Configuration (Jira & Confluence)
 ATLASSIAN_CLIENT_ID=your_atlassian_client_id_here
 ATLASSIAN_CLIENT_SECRET=your_atlassian_client_secret_here
 JIRA_REDIRECT_URI=http://localhost:8000/api/v1/auth/jira/connector/callback
@@ -95,10 +95,11 @@ SLACK_CLIENT_ID=your_slack_client_id_here
 SLACK_CLIENT_SECRET=your_slack_client_secret_here
 SLACK_REDIRECT_URI=http://localhost:8000/api/v1/auth/slack/connector/callback
 
-# Teams OAuth Configuration
-TEAMS_CLIENT_ID=your_teams_client_id_here
-TEAMS_CLIENT_SECRET=your_teams_client_secret_here
+# Microsoft OAuth (Teams & OneDrive)
+MICROSOFT_CLIENT_ID=your_microsoft_client_id_here
+MICROSOFT_CLIENT_SECRET=your_microsoft_client_secret_here
 TEAMS_REDIRECT_URI=http://localhost:8000/api/v1/auth/teams/connector/callback
+ONEDRIVE_REDIRECT_URI=http://localhost:8000/api/v1/auth/onedrive/connector/callback
 
 # Composio Connector
 # NOTE: Disable "Mask Connected Account Secrets" in Composio dashboard (Settings → Project Settings) for Google indexing to work.

surfsense_backend/alembic/versions/110_add_onedrive_connector_enums.py

@@ -0,0 +1,54 @@
+"""Add OneDrive connector enums
+
+Revision ID: 110
+Revises: 109
+Create Date: 2026-03-28 00:00:00.000000
+
+"""
+
+from collections.abc import Sequence
+
+from alembic import op
+
+revision: str = "110"
+down_revision: str | None = "109"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.execute(
+        """
+    DO $$
+    BEGIN
+        IF NOT EXISTS (
+            SELECT 1 FROM pg_type t
+            JOIN pg_enum e ON t.oid = e.enumtypid
+            WHERE t.typname = 'searchsourceconnectortype' AND e.enumlabel = 'ONEDRIVE_CONNECTOR'
+        ) THEN
+            ALTER TYPE searchsourceconnectortype ADD VALUE 'ONEDRIVE_CONNECTOR';
+        END IF;
+    END
+    $$;
+    """
+    )
+
+    op.execute(
+        """
+    DO $$
+    BEGIN
+        IF NOT EXISTS (
+            SELECT 1 FROM pg_type t
+            JOIN pg_enum e ON t.oid = e.enumtypid
+            WHERE t.typname = 'documenttype' AND e.enumlabel = 'ONEDRIVE_FILE'
+        ) THEN
+            ALTER TYPE documenttype ADD VALUE 'ONEDRIVE_FILE';
+        END IF;
+    END
+    $$;
+    """
+    )
+
+
+def downgrade() -> None:
+    pass

surfsense_backend/app/agents/new_chat/chat_deepagent.py

@@ -84,6 +84,7 @@
     "BOOKSTACK_CONNECTOR": "BOOKSTACK_CONNECTOR",
     "CIRCLEBACK_CONNECTOR": "CIRCLEBACK",  # Connector type differs from document type
     "OBSIDIAN_CONNECTOR": "OBSIDIAN_CONNECTOR",
+    "ONEDRIVE_CONNECTOR": "ONEDRIVE_FILE",  # Connector type differs from document type
     # Composio connectors (unified to native document types).
     # Reverse of NATIVE_TO_LEGACY_DOCTYPE in app.db.
     "COMPOSIO_GOOGLE_DRIVE_CONNECTOR": "GOOGLE_DRIVE_FILE",
@@ -316,6 +317,12 @@ async def create_surfsense_deep_agent(
         ]
         modified_disabled_tools.extend(google_drive_tools)
 
+    has_onedrive_connector = (
+        available_connectors is not None and "ONEDRIVE_FILE" in available_connectors
+    )
+    if not has_onedrive_connector:
+        modified_disabled_tools.extend(["create_onedrive_file", "delete_onedrive_file"])
+
     # Disable Google Calendar action tools if no Google Calendar connector is configured
     has_google_calendar_connector = (
         available_connectors is not None

surfsense_backend/app/agents/new_chat/middleware/dedup_tool_calls.py

@@ -26,6 +26,7 @@
     "trash_gmail_email": "email_subject_or_id",
     "update_gmail_draft": "draft_subject_or_id",
     "delete_google_drive_file": "file_name",
+    "delete_onedrive_file": "file_name",
     "delete_notion_page": "page_title",
     "update_notion_page": "page_title",
     "delete_linear_issue": "issue_ref",

surfsense_backend/app/agents/new_chat/tools/knowledge_base.py

@@ -201,6 +201,7 @@ async def _browse_recent_documents(
     "CRAWLED_URL",
     "CIRCLEBACK",
     "OBSIDIAN_CONNECTOR",
+    "ONEDRIVE_FILE",
 ]
 
 # Human-readable descriptions for each connector type
@@ -230,6 +231,7 @@ async def _browse_recent_documents(
     "BOOKSTACK_CONNECTOR": "BookStack pages (personal documentation)",
     "CIRCLEBACK": "Circleback meeting notes, transcripts, and action items",
     "OBSIDIAN_CONNECTOR": "Obsidian vault notes and markdown files (personal notes)",
+    "ONEDRIVE_FILE": "Microsoft OneDrive files and documents (personal cloud storage)",
 }
 
 
@@ -357,6 +359,7 @@ def _compute_tool_output_budget(max_input_tokens: int | None) -> int:
         "event_id",
         "calendar_id",
         "google_drive_file_id",
+        "onedrive_file_id",
         "page_id",
         "issue_id",
         "connector_id",

surfsense_backend/app/agents/new_chat/tools/onedrive/__init__.py

@@ -0,0 +1,11 @@
+from app.agents.new_chat.tools.onedrive.create_file import (
+    create_create_onedrive_file_tool,
+)
+from app.agents.new_chat.tools.onedrive.trash_file import (
+    create_delete_onedrive_file_tool,
+)
+
+__all__ = [
+    "create_create_onedrive_file_tool",
+    "create_delete_onedrive_file_tool",
+]