fix(excel): request the SharePoint scopes the file picker needs

The Excel block exposes a SharePoint site picker and a drive picker, and
builds `/drives/{driveId}/items/{id}` for arbitrary drives, but the
integration only requested `Files.Read` and `Files.ReadWrite`. Those cover
the signed-in user's own OneDrive, so a workbook in a document library
came back as insufficient privileges and the drive picker's
`GET /sites/{id}/drives` call failed outright.

Add `Files.Read.All`, `Files.ReadWrite.All` and `Sites.Read.All`. Word
already carries the first two for exactly this reason. All are
user-consentable, so this does not push Excel behind admin consent, and
none grants access to anything the signed-in account could not already
open.

Microsoft only grants newly-added scopes on a fresh authorization, so
existing connections must reconnect. No migration needed: the block's
credential selector already computes `requiredScopes` from
`getScopesForService('microsoft-excel')`, so those connections now show
as needing an update on their own.

The shared `Files.*` labels name OneDrive, which reads as the wrong
product on the Excel consent screen, so add Excel-specific wording
alongside the Word overrides that solve the same problem.

Author: mzxchandra

apps/docs/content/docs/integrations/microsoft_excel.mdx

@@ -42,8 +42,11 @@ Connecting Microsoft Excel requests these scopes.
 | `openid` | Standard authentication |
 | `profile` | Access profile information |
 | `email` | Access email address |
-| `Files.Read` | Read OneDrive files |
-| `Files.ReadWrite` | Read and write OneDrive files |
+| `Files.Read` | Read your workbooks in OneDrive |
+| `Files.ReadWrite` | Read, create, and edit your workbooks in OneDrive |
+| `Files.Read.All` | Read workbooks shared with you, including SharePoint libraries |
+| `Files.ReadWrite.All` | Read, create, and edit workbooks you have access to, including SharePoint libraries |
+| `Sites.Read.All` | List the SharePoint sites and document libraries you can open |
 | `offline_access` | Access account when not using the application |
 
 

apps/docs/content/docs/platform/self-hosting/integrations-oauth.mdx

@@ -252,7 +252,7 @@ Every connector below also requests `openid`, `profile`, `email`, `offline_acces
 | --- | --- | --- |
 | Azure AD | `microsoft-ad` | `User.ReadWrite.All`, `Group.ReadWrite.All`, `GroupMember.ReadWrite.All`, `LicenseAssignment.Read.All`, `LicenseAssignment.ReadWrite.All`, `UserAuthenticationMethod.ReadWrite.All`, `AuditLog.Read.All`, `Application.Read.All`, `AppRoleAssignment.ReadWrite.All`, `RoleManagement.ReadWrite.Directory`, `Device.Read.All`, `Policy.Read.All` |
 | Microsoft Dataverse | `microsoft-dataverse` | `https://dynamics.microsoft.com/user_impersonation` |
-| Microsoft Excel | `microsoft-excel` | `Files.Read`, `Files.ReadWrite` |
+| Microsoft Excel | `microsoft-excel` | `Files.Read`, `Files.ReadWrite`, `Files.Read.All`, `Files.ReadWrite.All`, `Sites.Read.All` |
 | Microsoft Planner | `microsoft-planner` | `Group.ReadWrite.All`, `Group.Read.All`, `Tasks.ReadWrite` |
 | Microsoft Teams | `microsoft-teams` | `User.Read`, `Chat.Read`, `Chat.ReadWrite`, `Chat.ReadBasic`, `ChatMessage.Send`, `Channel.ReadBasic.All`, `ChannelMessage.Send`, `ChannelMessage.Read.All`, `ChannelMessage.ReadWrite`, `ChannelMember.Read.All`, `Group.Read.All`, `Group.ReadWrite.All`, `Team.ReadBasic.All`, `TeamMember.Read.All`, `Files.Read`, `Sites.Read.All` |
 | Microsoft Word | `microsoft-word` | `Files.Read`, `Files.ReadWrite`, `Files.Read.All`, `Files.ReadWrite.All` |

apps/sim/lib/oauth/scopes.ts

@@ -139,12 +139,34 @@ export const OAUTH_SCOPES = {
     'https://dynamics.microsoft.com/user_impersonation',
     'offline_access',
   ],
+  /**
+   * Workbooks are ordinary drive items, so the integration reads and writes them
+   * through the Files permissions rather than an Excel-specific scope. Microsoft
+   * Graph exposes no Excel permission of its own.
+   *
+   * The `.All` variants and `Sites.Read.All` are what make the block's SharePoint
+   * file picker work. `Files.ReadWrite` alone covers only the signed-in user's own
+   * OneDrive, so a workbook in a document library is rejected for insufficient
+   * privileges, and the drive picker's `GET /sites/{id}/drives` call needs the
+   * Sites read. All four are user-consentable, so this does not push the
+   * integration behind admin consent, and none of them grants access to anything
+   * the signed-in account could not already open.
+   *
+   * Microsoft only grants newly-added scopes on a fresh authorization, so accounts
+   * connected before these existed must reconnect before a SharePoint-hosted
+   * workbook will open.
+   *
+   * @see https://learn.microsoft.com/en-us/graph/permissions-reference
+   */
   'microsoft-excel': [
     'openid',
     'profile',
     'email',
     'Files.Read',
     'Files.ReadWrite',
+    'Files.Read.All',
+    'Files.ReadWrite.All',
+    'Sites.Read.All',
     'offline_access',
   ],
   'microsoft-planner': [
@@ -1031,11 +1053,19 @@ export const SCOPE_DESCRIPTIONS: Record<string, string> = {
 /** Scope labels that cannot be keyed by scope alone because providers reuse names. */
 const PROVIDER_SCOPE_DESCRIPTIONS: Readonly<Record<string, Readonly<Record<string, string>>>> = {
   /**
-   * Word documents are ordinary drive items, so the integration asks for the
-   * generic Files permissions. The shared labels name OneDrive specifically,
-   * which reads as the wrong product on the Word consent screen and omits the
-   * SharePoint libraries the same scopes cover.
+   * Workbooks and Word documents are ordinary drive items, so both integrations
+   * ask for the generic Files permissions. The shared labels name OneDrive
+   * specifically, which reads as the wrong product on either consent screen and
+   * omits the SharePoint libraries the same scopes cover.
    */
+  'microsoft-excel': {
+    'Files.Read': 'Read your workbooks in OneDrive',
+    'Files.ReadWrite': 'Read, create, and edit your workbooks in OneDrive',
+    'Files.Read.All': 'Read workbooks shared with you, including SharePoint libraries',
+    'Files.ReadWrite.All':
+      'Read, create, and edit workbooks you have access to, including SharePoint libraries',
+    'Sites.Read.All': 'List the SharePoint sites and document libraries you can open',
+  },
   'microsoft-word': {
     'Files.Read': 'Read your Word documents in OneDrive',
     'Files.ReadWrite': 'Read, create, and edit your Word documents in OneDrive',