# SharePoint reference mirror

Archived: guidance for the existing implementation, not a new design decision.

The Zenith user timer mirrors one selected company SharePoint document library
into `~/.local/share/yookr-reference/sharepoint` hourly. SharePoint is
authoritative: remote updates overwrite local files and remote deletions remove
local files. Never author files there; edit them in SharePoint's web UI. The job
stops before more than 100 local deletions and reports the failure in the user
journal. A failed run may leave earlier updates in place and is not evidence of a
complete current snapshot; rclone does not delete destination files when the run
has errors.

The timer remains inert until both `~/.config/rclone/rclone.conf` and
`~/.config/rclone/sharepoint-reference.env` exist and the latter names a source.
Before adding the SharePoint remote or source file, the user must explicitly
start the interactive company sign-in and consent step. Use only delegated,
cloud-read-only scopes:
`Files.Read Files.Read.All Sites.Read.All offline_access`. Do not accept rclone's
broader default scopes or create an application registration. Tenant policy may
require administrator consent or an approved single-tenant application; involve
the administrator only if the consent response requires it.

After approval, run `rclone config`, choose Microsoft OneDrive, set the advanced
`access_scopes` value above, and select one company SharePoint document library
(not a personal account). Before enabling the job, inspect and accept its exact
scope, footprint, and first change set:

```console
rclone config redacted company-sharepoint
rclone lsd company-sharepoint:
rclone size company-sharepoint:
rclone sync company-sharepoint: ~/.local/share/yookr-reference/sharepoint --dry-run --max-delete 100
```

The remote-scoped redacted output confirms the configured requested scopes, not
what the tenant actually granted. Confirm the consent response also contains only
the requested read scopes; stop if it denies them or offers broader authority.

Only after that preview is accepted, create the gate with mode `0600`:

```text
RCLONE_SHAREPOINT_SOURCE=company-sharepoint:
```

Save it as `~/.config/rclone/sharepoint-reference.env`. Home Manager activation
then enables the hourly timer. This is the first bounded library, not a permanent
allowlist or a claim that all accessible SharePoint content is mirrored. Add
another library only after its own size/preview check, using another native unit
and dedicated destination rather than widening this source silently. Refresh and
inspect the current unit with:

```console
systemctl --user start sharepoint-reference-sync.service
systemctl --user status sharepoint-reference-sync.service
journalctl --user -u sharepoint-reference-sync.service
```

For an accepted deletion set larger than 100 files, rerun the dry-run and then a
manual `rclone sync` without `--max-delete`; the scheduled guard stays in place.
The mutable OAuth token remains in rclone's config outside the Nix store. The
local directory is user-writable and its read-only consumer policy is not an OS
permission or credential-isolation boundary. New mirror files are private to the
user by default (`UMask=0077`), but same-user processes can still read and change
them.