Mail setup inside the app: admins save the Microsoft app ID, secret and expiry in Settings, with the redirect address to copy, an expiry warning, and plain-language Microsoft errors

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

push.js

@@ -8,6 +8,7 @@ const atomicWrite = require('./atomic');
 const users = require('./users');
 const tasks = require('./tasks');
 const cal = require('./cal');
+const mail = require('./mail');
 
 const DATA_DIR = process.env.DATA_DIR || path.join(__dirname, 'data');
 const readBody = req => new Promise((ok, no) => { const c = []; let n = 0; req.on('data', d => { n += d.length; if (n > 20000) { no(new Error('Too large')); req.destroy(); } else c.push(d); }); req.on('end', () => ok(Buffer.concat(c).toString())); req.on('error', no); });
@@ -64,6 +65,16 @@ async function tick(now = new Date(), force = false) {
           }
         } catch (e) { console.warn('[push] tasks check failed:', e.message); }
       }
+      if (u.role === 'admin' && checkEvents) { // the Microsoft client secret (for Mail) is about to expire
+        const ss = mail.secretStatus();
+        if (ss && ss.days <= 30) {
+          const bucket = ss.days <= 0 ? 0 : [1, 3, 7, 14, 30].find(t => ss.days <= t), key = `mailsecret:${ss.expires}:${bucket}`;
+          if (!st.sent.includes(key)) {
+            st.sent.push(key); dirty = true;
+            await send(dir, st, { title: ss.days <= 0 ? 'Mail sign-in has expired' : `Mail sign-in expires in ${ss.days} day${ss.days === 1 ? '' : 's'}`, body: 'Make a new client secret in Microsoft Entra and paste it in Settings -> Microsoft app.', url: '#/settings', tag: 'mailsecret' });
+          }
+        }
+      }
       if (checkEvents && st.events && users.can(u, 'calendar')) {
         try {
           const from = now.getTime(), to = from + (st.eventMins + 5) * 60e3;