Complete PDF Sort and Merge Flask Application

- Full-featured web application for PDF processing
- Microsoft Entra (Azure AD) authentication with PKCE
- Parallel PDF sorting and merging capabilities
- Job management system with real-time progress tracking
- Modern web UI with responsive design
- Comprehensive error handling and logging
- Ubuntu installation script for easy deployment
- Environment configuration for secure credential management

AZURE_AD_SETUP.md

@@ -0,0 +1,93 @@
+# Microsoft Entra Authentication Setup Guide
+
+This application uses Microsoft Entra (Azure Active Directory) for authentication. Follow these steps to configure it:
+
+## 1. Create an Azure AD App Registration
+
+1. Go to the [Azure Portal](https://portal.azure.com)
+2. Navigate to **Azure Active Directory** > **App registrations**
+3. Click **New registration**
+4. Enter a name for your app (e.g., "PDF Processor")
+5. For **Supported account types**, select "Accounts in this organizational directory only"
+6. For **Redirect URI**, select "Web" and enter: `http://localhost:5000/auth/callback`
+7. Click **Register**
+
+## 2. Configure Authentication
+
+1. In your app registration, go to **Authentication**
+2. Under **Redirect URIs**, ensure `http://localhost:5000/auth/callback` is listed
+3. Under **Implicit grant and hybrid flows**, check:
+   - [x] Access tokens
+   - [x] ID tokens
+4. Click **Save**
+
+## 3. Get Application Credentials
+
+1. Go to **Overview** in your app registration
+2. Copy the **Application (client) ID** - this is your `AZURE_CLIENT_ID`
+3. Copy the **Directory (tenant) ID** - this is your `AZURE_TENANT_ID`
+
+## 4. Create a Client Secret
+
+1. Go to **Certificates & secrets**
+2. Click **New client secret**
+3. Enter a description and select an expiration
+4. Click **Add**
+5. **Important**: Copy the secret value immediately - this is your `AZURE_CLIENT_SECRET`
+
+## 5. Configure API Permissions
+
+1. Go to **API permissions**
+2. Click **Add a permission**
+3. Select **Microsoft Graph**
+4. Select **Delegated permissions**
+5. Add these permissions:
+   - `openid`
+   - `profile`
+   - `email`
+6. Click **Add permissions**
+7. Click **Grant admin consent** for your organization
+
+## 6. Configure Environment Variables
+
+Create a `.env` file in the project root with your Azure AD settings:
+
+```env
+# Azure AD Configuration
+AZURE_TENANT_ID=your-tenant-id-here
+AZURE_CLIENT_ID=your-client-id-here
+AZURE_CLIENT_SECRET=your-client-secret-here
+AZURE_AUTHORITY=https://login.microsoftonline.com/your-tenant-id-here
+AZURE_REDIRECT_URI=http://localhost:5000/auth/callback
+AZURE_SCOPES=openid profile email
+```
+
+## 7. Update Redirect URI for Production
+
+When deploying to production, update the redirect URI in both:
+- Azure AD app registration
+- Your `.env` file (change localhost to your production domain)
+
+**Note**: For local development, the app runs on port 5000, so use `http://localhost:5000/auth/callback` as the redirect URI.
+
+## 8. Test the Authentication
+
+1. Start the application: `python app.py`
+2. Visit `http://localhost:5000`
+3. Click "Login with Microsoft"
+4. You should be redirected to Microsoft login
+5. After authentication, you'll be redirected back to the app
+
+## Troubleshooting
+
+- **"invalid_client" error**: Check your client ID and secret
+- **"invalid_request" error**: Verify the redirect URI matches exactly
+- **Permission denied**: Ensure you've granted admin consent for the API permissions
+- **Token errors**: Check that your tenant ID is correct
+
+## Security Notes
+
+- Never commit the `.env` file to version control
+- Use strong client secrets and rotate them regularly
+- In production, use HTTPS for all authentication flows
+- Consider implementing token refresh logic for long-running sessions