Simplify permissions

README.md

@@ -225,11 +225,7 @@ Go to [Microsoft Azure Portal](https://portal.azure.com/). Create a new Azure Ac
       - offline_access
       - Mail.ReadWrite
       - Mail.Send
-      - Mail.ReadBasic
-      - Mail.Read
-      - Mail.Read.Shared
       - MailboxSettings.ReadWrite
-      - Contacts.ReadWrite
 
    6. Click "Add permissions"
    7. Click "Grant admin consent" if you're an admin

apps/web/utils/auth.ts

@@ -19,7 +19,7 @@ import { captureException } from "@/utils/error";
 import { getContactsClient as getGoogleContactsClient } from "@/utils/gmail/client";
 import { SCOPES as GMAIL_SCOPES } from "@/utils/gmail/scopes";
 import { createScopedLogger } from "@/utils/logger";
-import { getContactsClient as getOutlookContactsClient } from "@/utils/outlook/client";
+import { createOutlookClient } from "@/utils/outlook/client";
 import { SCOPES as OUTLOOK_SCOPES } from "@/utils/outlook/scopes";
 import { updateAccountSeats } from "@/utils/premium/server";
 import prisma from "@/utils/prisma";
@@ -301,7 +301,7 @@ async function getProfileData(providerId: string, accessToken: string) {
   }
 
   if (isMicrosoftProvider(providerId)) {
-    const client = getOutlookContactsClient({ accessToken });
+    const client = createOutlookClient(accessToken);
     try {
       const profileResponse = await client.getUserProfile();
 

apps/web/utils/outlook/client.ts

@@ -8,13 +8,6 @@ import { SafeError } from "@/utils/error";
 
 const logger = createScopedLogger("outlook/client");
 
-type AuthOptions = {
-  accessToken?: string | null;
-  refreshToken?: string | null;
-  expiryDate?: number | null;
-  expiresAt?: number | null;
-};
-
 // Wrapper class to hold both the Microsoft Graph client and its access token
 export class OutlookClient {
   private readonly client: Client;
@@ -80,13 +73,9 @@ export class OutlookClient {
 }
 
 // Helper to create OutlookClient instance
-const createOutlookClient = (accessToken: string) => {
-  return new OutlookClient(accessToken);
-};
-
-export const getContactsClient = ({ accessToken }: AuthOptions) => {
+export const createOutlookClient = (accessToken: string) => {
   if (!accessToken) throw new SafeError("No access token provided");
-  return createOutlookClient(accessToken);
+  return new OutlookClient(accessToken);
 };
 
 // Similar to Gmail's getGmailClientWithRefresh

apps/web/utils/outlook/scopes.ts

@@ -1,7 +1,5 @@
 // https://learn.microsoft.com/en-us/graph/permissions-reference
 
-import { env } from "@/env";
-
 export const SCOPES = [
   "openid",
   "profile",
@@ -10,11 +8,7 @@ export const SCOPES = [
   "offline_access", // Required for refresh tokens
   "Mail.ReadWrite", // Read and write access to mailbox
   "Mail.Send", // Send emails
-  "Mail.ReadBasic", // Read basic mail properties
-  "Mail.Read", // Read mail in all mailboxes
-  "Mail.Read.Shared", // Read mail in shared mailboxes
   "MailboxSettings.ReadWrite", // Read and write mailbox settings
-  ...(env.NEXT_PUBLIC_CONTACTS_ENABLED ? ["Contacts.ReadWrite"] : []),
 ] as const;
 
 export const CALENDAR_SCOPES = [