Complete M365/Graph API Implementation

httpClient = new Client(['timeout' => 30]);
        $this->initializeAuthentication();
    }
    
    private function initializeAuthentication(): void
    {
        $apiKey = ApiKey::where('client_id', $this->clientId)
            ->where('type', 'msgraph')
            ->first();
            
        if (!$apiKey) {
            throw new \Exception("Microsoft Graph API key not found for client {$this->clientId}");
        }
        
        $this->tenantId = $apiKey->api_company_id;
        
        // Check if we have a valid cached token
        $cacheKey = "msgraph_token_{$this->clientId}";
        $cachedToken = Cache::get($cacheKey);
        
        if ($cachedToken && $cachedToken['expires_at'] > now()->addMinutes(5)) {
            $this->accessToken = $cachedToken['access_token'];
        } else {
            // Get new token using client credentials flow
            $this->refreshAccessToken($apiKey);
        }
        
        $this->headers = [
            'Authorization' => 'Bearer ' . $this->accessToken,
            'Content-Type' => 'application/json',
            'Accept' => 'application/json'
        ];
    }
    
    private function refreshAccessToken(ApiKey $apiKey): void
    {
        $tokenUrl = "https://login.microsoftonline.com/{$this->tenantId}/oauth2/v2.0/token";
        
        try {
            $response = $this->httpClient->post($tokenUrl, [
                'form_params' => [
                    'client_id' => $apiKey->key,
                    'client_secret' => $apiKey->secret,
                    'scope' => 'https://graph.microsoft.com/.default',
                    'grant_type' => 'client_credentials'
                ]
            ]);
            
            $tokenData = json_decode($response->getBody()->getContents(), true);
            
            $this->accessToken = $tokenData['access_token'];
            $expiresIn = $tokenData['expires_in'] ?? 3600;
            
            // Cache the token
            $cacheKey = "msgraph_token_{$this->clientId}";
            Cache::put($cacheKey, [
                'access_token' => $this->accessToken,
                'expires_at' => now()->addSeconds($expiresIn)
            ], $expiresIn - 300); // Cache for 5 minutes less than expiry
            
            // Update database with new token info
            $apiKey->update([
                'access_token' => $this->accessToken,
                'expires_at' => now()->addSeconds($expiresIn)
            ]);
            
        } catch (RequestException $e) {
            Log::error("Failed to refresh Microsoft Graph token for client {$this->clientId}: " . $e->getMessage());
            throw new \Exception("Failed to authenticate with Microsoft Graph API");
        }
    }
    
    protected function graphApiCall(string $method, string $endpoint, array $params = [], bool $useBeta = false): array
    {
        $baseUrl = $useBeta ? $this->betaUrl : $this->baseUrl;
        $url = $baseUrl . '/' . ltrim($endpoint, '/');
        
        $options = [
            'headers' => $this->headers,
            'query' => $params
        ];
        
        try {
            $response = $this->httpClient->request($method, $url, $options);
            $data = json_decode($response->getBody()->getContents(), true);
            
            // Handle paginated responses
            if (isset($data['@odata.nextLink'])) {
                $data['hasMore'] = true;
                $data['nextLink'] = $data['@odata.nextLink'];
            }
            
            return $data;
            
        } catch (RequestException $e) {
            $statusCode = $e->getResponse() ? $e->getResponse()->getStatusCode() : 0;
            
            // Handle token expiration
            if ($statusCode === 401) {
                $this->handleTokenExpiration();
                // Retry once with new token
                return $this->graphApiCall($method, $endpoint, $params, $useBeta);
            }
            
            Log::error("Graph API call failed: {$method} {$url} - " . $e->getMessage());
            throw new \Exception("Microsoft Graph API call failed: " . $e->getMessage());
        }
    }
    
    private function handleTokenExpiration(): void
    {
        $apiKey = ApiKey::where('client_id', $this->clientId)
            ->where('type', 'msgraph')
            ->first();
            
        $this->refreshAccessToken($apiKey);
        
        $this->headers['Authorization'] = 'Bearer ' . $this->accessToken;
    }
    
    protected function getAllPaginatedResults(string $endpoint, array $params = [], bool $useBeta = false): array
    {
        $allResults = [];
        $nextLink = null;
        
        do {
            if ($nextLink) {
                // For subsequent calls, use the full nextLink URL
                $response = $this->httpClient->get($nextLink, ['headers' => $this->headers]);
                $data = json_decode($response->getBody()->getContents(), true);
            } else {
                $data = $this->graphApiCall('GET', $endpoint, $params, $useBeta);
            }
            
            if (isset($data['value'])) {
                $allResults = array_merge($allResults, $data['value']);
            }
            
            $nextLink = $data['@odata.nextLink'] ?? null;
            
            // Safety break to prevent infinite loops
            if (count($allResults) > 10000) {
                Log::warning("Graph API pagination exceeded 10,000 results for endpoint: {$endpoint}");
                break;
            }
            
        } while ($nextLink);
        
        return $allResults;
    }
    
    public function validateConnection(): array
    {
        try {
            // Test basic connectivity
            $organization = $this->graphApiCall('GET', '/organization');
            
            // Test required permissions
            $permissionTests = [
                'users' => '/users?$top=1',
                'groups' => '/groups?$top=1', 
                'applications' => '/applications?$top=1',
                'directoryRoles' => '/directoryRoles?$top=1'
            ];
            
            $permissions = [];
            foreach ($permissionTests as $scope => $endpoint) {
                try {
                    $this->graphApiCall('GET', $endpoint);
                    $permissions[$scope] = true;
                } catch (\Exception $e) {
                    $permissions[$scope] = false;
                    Log::warning("Missing Graph API permission for {$scope}: " . $e->getMessage());
                }
            }
            
            return [
                'connected' => true,
                'tenant_id' => $this->tenantId,
                'organization' => $organization['value'][0] ?? null,
                'permissions' => $permissions,
                'required_scopes' => $this->requiredScopes,
                'missing_permissions' => array_keys(array_filter($permissions, fn($v) => !$v))
            ];
            
        } catch (\Exception $e) {
            return [
                'connected' => false,
                'error' => $e->getMessage(),
                'tenant_id' => $this->tenantId
            ];
        }
    }
    
    public function getTenantInfo(): array
    {
        $organization = $this->graphApiCall('GET', '/organization');
        $org = $organization['value'][0] ?? [];
        
        return [
            'tenant_id' => $this->tenantId,
            'display_name' => $org['displayName'] ?? 'Unknown',
            'verified_domains' => array_column($org['verifiedDomains'] ?? [], 'name'),
            'created_date' => $org['createdDateTime'] ?? null,
            'country' => $org['countryLetterCode'] ?? null,
            'privacy_profile' => $org['privacyProfile'] ?? null,
            'technical_contacts' => $org['technicalNotificationMails'] ?? []
        ];
    }
}
?>

# Environment Configuration (.env)
MSGRAPH_CLIENT_ID=your_azure_app_client_id
MSGRAPH_CLIENT_SECRET=your_azure_app_client_secret
MSGRAPH_TENANT_ID=your_azure_tenant_id
MSGRAPH_REDIRECT_URI=https://your-app.com/auth/msgraph/callback

# Database Setup - Add to existing api_keys table
INSERT INTO api_keys (
    id, company_id, client_id, type, 
    `key`, secret, api_company_id, 
    created_by, updated_by, created_at, updated_at
) VALUES (
    'generated_id', 'company_id', 'client_id', 'msgraph',
    'your_azure_app_client_id', 'your_azure_app_client_secret', 'your_azure_tenant_id',
    'user_id', 'user_id', NOW(), NOW()
);

clientId}");
        
        // Collect application data
        $applications = $this->collectApplications();
        $servicePrincipals = $this->collectServicePrincipals();
        $oauthConsents = $this->collectOAuthConsents();
        $appRoleAssignments = $this->collectAppRoleAssignments();
        
        // Analyze security posture
        $securityAnalysis = $this->analyzeApplicationSecurity($applications, $servicePrincipals, $oauthConsents);
        
        return [
            'source' => 'msgraph',
            'collection_type' => 'application_security',
            'tenant_info' => $this->getTenantInfo(),
            'applications' => $applications,
            'service_principals' => $servicePrincipals,
            'oauth_consents' => $oauthConsents,
            'app_role_assignments' => $appRoleAssignments,
            'security_analysis' => $securityAnalysis,
            'collection_timestamp' => now()->toISOString(),
            'api_endpoints_used' => [
                '/applications',
                '/servicePrincipals', 
                '/oauth2PermissionGrants',
                '/servicePrincipals/{id}/appRoleAssignments'
            ]
        ];
    }
    
    private function collectApplications(): array
    {
        $apps = $this->getAllPaginatedResults('/applications', [
            '$select' => implode(',', [
                'id', 'appId', 'displayName', 'createdDateTime', 'publisherDomain',
                'signInAudience', 'web', 'spa', 'api', 'requiredResourceAccess',
                'passwordCredentials', 'keyCredentials', 'identifierUris'
            ])
        ]);
        
        return array_map(function($app) {
            return [
                'id' => $app['id'],
                'app_id' => $app['appId'],
                'display_name' => $app['displayName'],
                'created_date' => $app['createdDateTime'],
                'publisher_domain' => $app['publisherDomain'],
                'signin_audience' => $app['signInAudience'],
                'redirect_uris' => $this->extractRedirectUris($app),
                'api_permissions' => $app['requiredResourceAccess'] ?? [],
                'has_secrets' => !empty($app['passwordCredentials']) || !empty($app['keyCredentials']),
                'secret_count' => count($app['passwordCredentials'] ?? []),
                'cert_count' => count($app['keyCredentials'] ?? []),
                'identifier_uris' => $app['identifierUris'] ?? [],
                'security_analysis' => $this->analyzeApplicationSecurityProfile($app),
                'compliance_flags' => $this->generateApplicationComplianceFlags($app)
            ];
        }, $apps);
    }
    
    private function analyzeApplicationSecurityProfile(array $app): array
    {
        $security = [
            'risk_level' => 'low',
            'risk_factors' => [],
            'security_score' => 100
        ];
        
        // Check publisher verification
        if (empty($app['publisherDomain']) || $app['publisherDomain'] === 'mssubstratus.com') {
            $security['risk_factors'][] = 'Unverified publisher';
            $security['security_score'] -= 20;
        }
        
        // Check audience scope
        $audience = $app['signInAudience'] ?? '';
        if (in_array($audience, ['AzureADMultipleOrgs', 'AzureADandPersonalMicrosoftAccount'])) {
            $security['risk_factors'][] = 'Broad sign-in audience allows external users';
            $security['security_score'] -= 15;
        }
        
        // Check redirect URIs security
        $redirectUris = $this->extractRedirectUris($app);
        foreach ($redirectUris as $uri) {
            if (!str_starts_with($uri, 'https://')) {
                $security['risk_factors'][] = 'Insecure redirect URI (non-HTTPS)';
                $security['security_score'] -= 25;
                break;
            }
            if (str_contains($uri, 'localhost') || str_contains($uri, '127.0.0.1')) {
                $security['risk_factors'][] = 'Development redirect URI in production';
                $security['security_score'] -= 10;
            }
        }
        
        // Check API permissions risk
        $permissions = $app['requiredResourceAccess'] ?? [];
        $highRiskPermissions = $this->checkHighRiskPermissions($permissions);
        if (!empty($highRiskPermissions)) {
            $security['risk_factors'][] = 'High-risk API permissions: ' . implode(', ', $highRiskPermissions);
            $security['security_score'] -= count($highRiskPermissions) * 10;
        }
        
        // Check credential security
        $passwordCreds = $app['passwordCredentials'] ?? [];
        foreach ($passwordCreds as $cred) {
            if (isset($cred['endDateTime'])) {
                $expiryDate = Carbon::parse($cred['endDateTime']);
                if ($expiryDate->isPast()) {
                    $security['risk_factors'][] = 'Expired client secret';
                    $security['security_score'] -= 15;
                } elseif ($expiryDate->diffInDays(now()) < 30) {
                    $security['risk_factors'][] = 'Client secret expires soon';
                    $security['security_score'] -= 5;
                }
            }
        }
        
        // Determine risk level
        if ($security['security_score'] >= 80) {
            $security['risk_level'] = 'low';
        } elseif ($security['security_score'] >= 60) {
            $security['risk_level'] = 'medium';
        } else {
            $security['risk_level'] = 'high';
        }
        
        return $security;
    }
    
    private function checkHighRiskPermissions(array $requiredResourceAccess): array
    {
        $highRiskPermissions = [];
        
        // Define high-risk permission patterns
        $riskPatterns = [
            'Directory.ReadWrite.All' => 'Full directory write access',
            'User.ReadWrite.All' => 'Read/write all user profiles', 
            'Group.ReadWrite.All' => 'Read/write all groups',
            'Application.ReadWrite.All' => 'Read/write all applications',
            'RoleManagement.ReadWrite.Directory' => 'Manage directory roles',
            'Policy.ReadWrite.ConditionalAccess' => 'Manage conditional access policies',
            'DeviceManagementConfiguration.ReadWrite.All' => 'Manage device configuration',
            'SecurityEvents.ReadWrite.All' => 'Read/write security events'
        ];
        
        foreach ($requiredResourceAccess as $resource) {
            foreach ($resource['resourceAccess'] ?? [] as $permission) {
                // This would need to be enhanced with actual permission ID to name mapping
                // For now, we'll check against common high-risk permission IDs
                $permissionId = $permission['id'];
                if ($this->isHighRiskPermissionId($permissionId)) {
                    $highRiskPermissions[] = $permissionId;
                }
            }
        }
        
        return $highRiskPermissions;
    }
    
    private function generateApplicationComplianceFlags(array $app): array
    {
        $flags = [];
        
        // SOC 2 CC6.7 - Logical and Physical Access Controls
        if (empty($app['publisherDomain']) || $app['publisherDomain'] === 'mssubstratus.com') {
            $flags[] = [
                'flag' => 'unverified_publisher',
                'severity' => 'medium',
                'description' => 'Application publisher is not verified',
                'framework_relevance' => ['SOC2_CC6.7', 'ISO27001_A.14.2.5']
            ];
        }
        
        // Check for overprivileged applications
        $permissions = $app['requiredResourceAccess'] ?? [];
        if (count($permissions) > 10) {
            $flags[] = [
                'flag' => 'excessive_permissions',
                'severity' => 'medium',
                'description' => 'Application requests excessive API permissions',
                'framework_relevance' => ['SOC2_CC6.7', 'ISO27001_A.14.2.2', 'NIST_CSF_PR.AC-4']
            ];
        }
        
        // HTTPS redirect requirement
        $redirectUris = $this->extractRedirectUris($app);
        $insecureUris = array_filter($redirectUris, fn($uri) => !str_starts_with($uri, 'https://'));
        if (!empty($insecureUris)) {
            $flags[] = [
                'flag' => 'insecure_redirect_uris',
                'severity' => 'high',
                'description' => 'Application uses non-HTTPS redirect URIs',
                'framework_relevance' => ['SOC2_CC6.7', 'ISO27001_A.14.1.3', 'NIST_CSF_PR.DS-2']
            ];
        }
        
        return $flags;
    }
    
    private function collectOAuthConsents(): array
    {
        try {
            return $this->getAllPaginatedResults('/oauth2PermissionGrants');
        } catch (\Exception $e) {
            Log::warning("Could not collect OAuth consents: " . $e->getMessage());
            return [];
        }
    }
    
    private function analyzeApplicationSecurity(array $applications, array $servicePrincipals, array $oauthConsents): array
    {
        $totalApps = count($applications);
        $highRiskApps = array_filter($applications, fn($app) => $app['security_analysis']['risk_level'] === 'high');
        $unverifiedApps = array_filter($applications, fn($app) => empty($app['publisher_domain']) || $app['publisher_domain'] === 'mssubstratus.com');
        $overPrivilegedApps = array_filter($applications, fn($app) => count($app['api_permissions']) > 10);
        
        return [
            'summary_metrics' => [
                'total_applications' => $totalApps,
                'high_risk_applications' => count($highRiskApps),
                'unverified_publishers' => count($unverifiedApps),
                'overprivileged_applications' => count($overPrivilegedApps),
                'total_service_principals' => count($servicePrincipals),
                'oauth_consents' => count($oauthConsents)
            ],
            'risk_distribution' => [
                'high' => count(array_filter($applications, fn($app) => $app['security_analysis']['risk_level'] === 'high')),
                'medium' => count(array_filter($applications, fn($app) => $app['security_analysis']['risk_level'] === 'medium')),
                'low' => count(array_filter($applications, fn($app) => $app['security_analysis']['risk_level'] === 'low'))
            ],
            'compliance_summary' => [
                'soc2_cc67_score' => $this->calculateSOC2ApplicationScore($applications),
                'iso27001_a142_score' => $this->calculateISO27001ApplicationScore($applications),
                'nist_csf_prds2_score' => $this->calculateNISTApplicationScore($applications)
            ],
            'recommendations' => $this->generateApplicationRecommendations($applications)
        ];
    }
}
?>