lux/docs/.archive/sharepoint-reference.md

SharePoint reference mirror

Archived: guidance for the existing implementation, not a new design decision.

The Zenith user timer mirrors one selected company SharePoint document library into ~/.local/share/yookr-reference/sharepoint hourly. SharePoint is authoritative: remote updates overwrite local files and remote deletions remove local files. Never author files there; edit them in SharePoint's web UI. The job stops before more than 100 local deletions and reports the failure in the user journal. A failed run may leave earlier updates in place and is not evidence of a complete current snapshot; rclone does not delete destination files when the run has errors.

The timer remains inert until both ~/.config/rclone/rclone.conf and ~/.config/rclone/sharepoint-reference.env exist and the latter names a source. Before adding the SharePoint remote or source file, the user must explicitly start the interactive company sign-in and consent step. Use only delegated, cloud-read-only scopes: Files.Read Files.Read.All Sites.Read.All offline_access. Do not accept rclone's broader default scopes or create an application registration. Tenant policy may require administrator consent or an approved single-tenant application; involve the administrator only if the consent response requires it.

After approval, run rclone config, choose Microsoft OneDrive, set the advanced access_scopes value above, and select one company SharePoint document library (not a personal account). Before enabling the job, inspect and accept its exact scope, footprint, and first change set:

rclone config redacted company-sharepoint
rclone lsd company-sharepoint:
rclone size company-sharepoint:
rclone sync company-sharepoint: ~/.local/share/yookr-reference/sharepoint --dry-run --max-delete 100

The remote-scoped redacted output confirms the configured requested scopes, not what the tenant actually granted. Confirm the consent response also contains only the requested read scopes; stop if it denies them or offers broader authority.

Only after that preview is accepted, create the gate with mode 0600:

RCLONE_SHAREPOINT_SOURCE=company-sharepoint:

Save it as ~/.config/rclone/sharepoint-reference.env. Home Manager activation then enables the hourly timer. This is the first bounded library, not a permanent allowlist or a claim that all accessible SharePoint content is mirrored. Add another library only after its own size/preview check, using another native unit and dedicated destination rather than widening this source silently. Refresh and inspect the current unit with:

systemctl --user start sharepoint-reference-sync.service
systemctl --user status sharepoint-reference-sync.service
journalctl --user -u sharepoint-reference-sync.service

For an accepted deletion set larger than 100 files, rerun the dry-run and then a manual rclone sync without --max-delete; the scheduled guard stays in place. The mutable OAuth token remains in rclone's config outside the Nix store. The local directory is user-writable and its read-only consumer policy is not an OS permission or credential-isolation boundary. New mirror files are private to the user by default (UMask=0077), but same-user processes can still read and change them.