Mail setup inside the app: admins save the Microsoft app ID, secret and expiry in Settings, with the redirect address to copy, an expiry warning, and plain-language Microsoft errors

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tools/push-test.js

@@ -47,6 +47,17 @@ const users = require('../users'), push = require('../push');
   await push.tick(new Date(Date.now() + 60e3), true);
   ok('and only once', sent.filter(s => s.title === 'Dentist').length === 1, sent);
 
+  // the Microsoft client secret for Mail is about to expire: admins are warned once per stage
+  const admin = users.create({ name: 'Boss', role: 'admin' }), ad = users.dirOf(admin.id);
+  fs.writeFileSync(path.join(ad, 'push.json'), JSON.stringify({ tz: TZ, tasks: false, events: false, subs: [{ sub: { endpoint: 'https://push.example/admin', keys: { p256dh: 'x', auth: 'y' } } }] }));
+  const in5 = new Date(Date.now() + 5 * 864e5).toISOString().slice(0, 10);
+  fs.writeFileSync(path.join(dir, 'mail-config.json'), JSON.stringify({ data: require('../vault')('nehub-mail').seal({ clientId: 'aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb', clientSecret: 's', secretExpires: in5 }) }));
+  sent.length = 0; await push.tick(new Date(), true);
+  ok('an admin is warned that the mail secret expires soon', sent.some(s => /Mail sign-in expires in [456] days/.test(s.title) && s.sub.endpoint.endsWith('/admin')), sent);
+  const n1 = sent.length; await push.tick(new Date(Date.now() + 60e3), true);
+  ok('and only once for that stage', sent.length === n1, sent.length);
+  ok('an ordinary person is not told about it', !sent.some(s => /Mail sign-in/.test(s.title) && !s.sub.endpoint.endsWith('/admin')), sent);
+
   // a subscription the push service says is gone is dropped
   dead = true; writePush({ tasks: true, tasksAt: '00:00', tasksDay: '' }); fs.writeFileSync(path.join(d, 'tasks.json'), JSON.stringify({ lists: [{ id: 'inbox', name: 'Tasks' }], tasks: [{ id: 't1', list: 'inbox', title: 'X', due: '2000-01-01', done: false }] }));
   await push.tick(new Date());