Adding support for sharepoint backed Hermes

.github/CODEOWNERS

@@ -1 +1 @@
-* @hashicorp-forge/labs
+* @hashicorp-forge/labs @hashicorp/team-scale-performance-eng

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
     branches: [main]
   push:
     branches: [main]
+  workflow_dispatch:
 
 jobs:
   build-and-test:
@@ -24,28 +25,26 @@ jobs:
         run: |
           corepack enable
           cd web
-          # Remove .yarnrc.yml to let corepack handle yarn version
-          rm -f .yarnrc.yml
           corepack prepare yarn@$(node -p "require('./package.json').packageManager.split('@')[1]") --activate
           yarn --version
 
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
-          go-version: "^1.18"
-
-      - name: Verify Yarn version
-        run: cd web && yarn --version
+          go-version: "^1.24"
 
       - name: Build web
         run: cd web && yarn install && yarn build
 
-      - name: Run web test (continue on failure)
-        run: cd web && yarn test:ember --timeout 600000 || true
-        continue-on-error: true
+      - name: Build plugin
+        run: cd hermes-plugin && npm install && npm run build
 
-      - name: Build
+      - name: Build Go binary
         run: make bin/linux
 
       - name: Run Go test
         run: make go/test
+
+      - name: Run web test (continue on failure)
+        run: cd web && yarn test:ember --timeout 600000 || true
+        continue-on-error: true

.github/workflows/docker-build-push.yml

@@ -0,0 +1,48 @@
+name: Docker Build & Push
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "18"
+
+      - name: Enable Corepack
+        run: |
+          corepack enable
+          cd web
+          corepack prepare yarn@$(node -p "require('./package.json').packageManager.split('@')[1]") --activate
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "^1.24"
+
+      - name: Build
+        run: make build/linux
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

.gitignore

@@ -9,6 +9,9 @@
 .DS_Store
 .env
 
+# TLS certs (local dev)
+/certs
+
 # Web application
 node_modules
 /web/.pnp.*

Dockerfile

@@ -0,0 +1,18 @@
+FROM alpine:3.21.5
+
+# Update the package repository and install dependencies
+RUN apk --no-cache update && \
+    apk --no-cache upgrade
+
+# Set the working directory
+WORKDIR /app
+
+# Copy the application binary and configuration
+COPY hermes /app/hermes
+COPY configs /app/configs
+
+# Set the entrypoint to run the hermes application
+ENTRYPOINT ["/app/hermes"]
+
+# Default command when container starts
+CMD ["server"]

Makefile

@@ -2,7 +2,7 @@
 default: help
 
 .PHONY: build
-build: web/build
+build: web/build plugin/build
 	rm -f ./hermes
 	CGO_ENABLED=0 go build -o ./hermes ./cmd/hermes
 
@@ -14,6 +14,15 @@ bin:
 bin/linux: # bin creates hermes binary for linux
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ./hermes ./cmd/hermes
 
+.PHONY: build/linux
+build/linux: web/build plugin/build
+	rm -f ./hermes
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ./hermes ./cmd/hermes
+
+.PHONY: plugin/build
+plugin/build:
+	cd hermes-plugin && npm install && rm -rf dist/ && npm run build
+
 .PHONY: dev
 dev: ## One command to start a dev environment
 dev: docker/postgres/start

README.md

@@ -15,6 +15,11 @@ Hermes was created and is currently maintained by HashiCorp Labs, a small team i
 
 ## Setup
 
+Hermes supports two backend modes:
+
+- Google Workspace
+- SharePoint / Microsoft 365
+
 ### Google
 
 1. Sign up for a [Google Workspace](https://workspace.google.com/) account.
@@ -92,6 +97,41 @@ Jira can be optionally configured to enable linking Hermes projects with Jira is
 
 1. Enable Jira using the `jira` block in the Hermes config file.
 
+### SharePoint / Microsoft 365
+
+1. Create a Microsoft Entra ID app registration for Hermes.
+
+1. Configure a redirect URI for the Hermes server.
+
+  - Local development example: `https://localhost:8443/authenticate`
+  - The redirect URI in Entra ID must match `sharepoint.redirect_uri` in `config.hcl`.
+
+1. Create a client secret for the app registration.
+
+1. Collect the values Hermes needs for configuration:
+
+  - Tenant ID
+  - Client ID
+  - Client secret
+  - SharePoint site ID
+  - SharePoint drive ID
+  - Your Microsoft 365 email domain (for example, `example.com`)
+
+1. Create or identify the folders Hermes will use in the SharePoint document library:
+
+  - Drafts folder
+  - Published documents folder
+  - Shortcuts folder
+
+1. Enable the `sharepoint` block in `config.hcl` and set the values above.
+
+1. If you want Microsoft distribution lists to be selectable as approvers, enable the `group_approvals` block under `sharepoint`.
+
+1. Choose an authentication mode:
+
+  - Direct Microsoft login: configure only the `sharepoint` block.
+  - ALB-fronted OIDC login: configure `sharepoint` and `oidc_alb`. Hermes prefers `oidc_alb` when it is enabled.
+
 ## Development and Usage
 
 ### Requirements
@@ -109,6 +149,36 @@ cp configs/config.hcl ./
 # Edit config.hcl...
 ```
 
+For Google Workspace deployments, configure the `google_workspace` block.
+
+For SharePoint deployments, enable and configure the `sharepoint` block in `config.hcl`:
+
+```hcl
+sharepoint {
+  redirect_uri     = "https://localhost:8443/authenticate"
+  client_id        = "YOUR_SHAREPOINT_CLIENT_ID"
+  client_secret    = "YOUR_SHAREPOINT_CLIENT_SECRET"
+  tenant_id        = "YOUR_AZURE_AD_TENANT_ID"
+  site_id          = "YOUR_SHAREPOINT_SITE_ID"
+  drive_id         = "YOUR_SHAREPOINT_DRIVE_ID"
+  domain           = "your-domain.com"
+  drafts_folder    = "DraftDocuments"
+  docs_folder      = "PublishedDocuments"
+  shortcuts_folder = "ShortcutsFolder"
+
+  group_approvals {
+    enabled = true
+    #search_prefix = "team-"
+  }
+}
+```
+
+Notes:
+
+- `group_approvals` is optional. When enabled, Hermes exposes the group search API and can validate Microsoft group membership for approver checks.
+- `search_prefix` is optional. When set, Hermes searches both `{search_prefix}{query}` and `{query}` and merges the results.
+- If `oidc_alb` is enabled, Hermes uses it ahead of direct Microsoft auth.
+
 ### Build the Project
 
 ```sh
@@ -140,8 +210,12 @@ The database password can be configured via the Hermes config.hcl or the `HERMES
 
 NOTE: when not using a Google service account, this will automatically open a browser to authenticate the server to read and create documents, send emails, etc.
 
+For SharePoint deployments without `oidc_alb`, Hermes uses the Microsoft login flow and serves the `/authenticate` callback route directly.
+
 ## Running Hermes in Production
 
+### Google Workspace
+
 1. [Create Service Account](https://developers.google.com/workspace/guides/create-credentials#service-account)
 
 - Create a new key (JSON type) for the service account and download it.
@@ -153,6 +227,16 @@ NOTE: when not using a Google service account, this will automatically open a br
 
 1. If enabling group approvals, add the `https://www.googleapis.com/auth/admin.directory.group.readonly` role to the service user configured as the `subject` in the `auth` block (from previous step).
 
+### SharePoint / Microsoft 365
+
+For SharePoint deployments, configure the `sharepoint` block instead of the Google service account.
+
+- `redirect_uri` must match the app registration callback URL.
+- `site_id` and `drive_id` identify the SharePoint document library Hermes will use.
+- `drafts_folder`, `docs_folder`, and `shortcuts_folder` are the SharePoint folders Hermes manages.
+- `group_approvals` is optional and enables Microsoft distribution-list search for approvers.
+- `oidc_alb` is optional and can be used when Hermes is deployed behind an AWS ALB handling OIDC.
+
 ## Architecture
 
 ### Server

configs/config.hcl

@@ -1,7 +1,7 @@
 // base_url is the base URL used for building links. This should be the public
 // URL of the application.
 base_url = "http://localhost:8000"
-
+//base_url = "https://localhost:8443"
 // log_format configures the logging format. Supported values are "standard" or
 // "json".
 log_format = "standard"
@@ -98,12 +98,12 @@ email {
 feature_flags {
   // api_v2 enables v2 of the API.
   flag "api_v2" {
-    enabled = false
+    enabled = true
   }
 
   // projects enables the projects feature in the UI.
   flag "projects" {
-    enabled = false
+    enabled = true
   }
 }
 
@@ -178,7 +178,7 @@ indexer {
 
   // use_database_for_document_data will use the database instead of Algolia as
   // the source of truth for document data, if true.
-  use_database_for_document_data = false
+  use_database_for_document_data = true
 }
 
 // jira is the configuration for Hermes to work with Jira.
@@ -238,8 +238,47 @@ products {
   }
 }
 
+// --------------------------------------------------------------------------
+// SharePoint Backend Configuration (alternative to google_workspace)
+// --------------------------------------------------------------------------
+// Uncomment and configure these blocks to use SharePoint instead of Google.
+
+// sharepoint {
+//   redirect_uri  = "https://localhost:8443/authenticate"
+//   client_id  = "YOUR_SHAREPOINT_CLIENT_ID"
+//   client_secret = "YOUR_SHAREPOINT_CLIENT_SECRET"
+//   tenant_id  = "YOUR_AZURE_AD_TENANT_ID"
+//   site_id    = "YOUR_SHAREPOINT_SITE_ID"
+//   drive_id   = "YOUR_SHAREPOINT_DRIVE_ID"
+//   domain     = "your-domain.com"
+//
+//   shortcuts_folder = "ShortcutsFolder"
+//   docs_folder = ""
+//
+//   drafts_folder = ""
+//   group_approvals {
+//     enabled = true
+//     #search_prefix = "test-"
+//   }
+// }
+
+oidc_alb {
+  // auth_server_url is the OIDC discovery URL.
+  auth_server_url = "https://your-oidc-provider.com"
+  // aws_region is the region of the AWS ALB.
+  aws_region = "us-east-1"
+  // client_id is the OIDC client ID.
+  client_id = "ClientID"
+  // disabled disables OIDC ALB authorization.
+  disabled = false
+  // jwt_signer is the ARN of the ALB for JWT verification.
+  jwt_signer = "arn:aws:elasticloadbalancing:..."
+}
+
 // server contains the configuration for the server.
 server {
-  // addr is the address to bind to for listening.
   addr = "127.0.0.1:8000"
+//   addr     = "0.0.0.0:8443"
+//   tls_cert = "/path/to/cert.pem"
+//   tls_key  = "/path/to/key.pem"
 }