Single sign-on with Microsoft

@sign-in @security
Feature: Single sign-on with Microsoft
  As a staff member
  I want to sign in with my Microsoft work account
  So that I never manage a separate password, and only active, listed staff can get in

  Staff do not carry a second portal password; sign-in reuses the Microsoft work account they already have.

  Background:
    Given the approved company email domains are configured
    And the staff list is maintained by an administrator
    And each staff member is matched to their directory account, pinned to its immutable object id on first sign-in

  Rule: Microsoft proves who the person is; the staff list decides access

    Scenario: A listed, active staff member signs in
      Given a staff member has an active Microsoft work account on an approved domain
      And that person is on the staff list
      When they sign in with Microsoft
      Then they land on the dashboard for their role
      And the sign-in is recorded

    Scenario: The role decides the landing page
      Given an administrator has set a staff member's role in the staff list
      When that staff member signs in
      Then they land on the dashboard for that role

  Rule: Only active, listed accounts may sign in

    Scenario: An account not on the staff list is refused
      Given a person signs in with Microsoft but is not on the staff list
      When the application checks them against the staff list
      Then they are refused and returned to sign-in
      And no account is created

    Scenario: A sign-in from a domain that is not approved is refused
      Given a person signs in with Microsoft from a domain that is not on the approved list
      When the application checks the domain
      Then they are refused before any account is resolved

    Scenario: An account disabled in the directory cannot sign in again
      Given a staff member has been disabled in the Microsoft directory
      When they try to sign in
      Then Microsoft refuses the sign-in
      And on return the application shows the returned error

  Rule: Access ends when an administrator deactivates the user in the staff list

    Scenario: Deactivation ends access on the next request
      Given a staff member is signed in
      And an administrator deactivates them in the staff list
      When the staff member takes their next action
      Then the action is refused because the active flag is re-checked on every request
      And their session ends without waiting for the idle timer

    Scenario: A role change ends the open session
      Given a staff member is signed in
      When an administrator changes their role
      Then their session ends on the next request, as for deactivation

  Rule: A session left idle is signed out

    Scenario: Idle timeout
      Given a staff member has been idle for the configured timeout
      When they take their next action
      Then they are signed out
      And returned to sign-in with a "session expired" notice

  Rule: The sign-in callback is validated before any session starts
    @edge-cases

    Scenario Outline: A tampered or invalid callback is refused
      Given a person returns from Microsoft to the sign-in callback
      And the callback is "<condition>"
      When the application validates the callback
      Then sign-in is refused and no session is started
      Examples:
        | condition |
        | carrying a state or nonce that does not match |
        | reusing an authorization code already spent |
        | carrying a token issued for another tenant |
        | cancelled by the person at Microsoft |

    Scenario: An off-site return path is sanitised, and sign-in proceeds
      Given a person returns from Microsoft to the sign-in callback
      And the return path points off-site
      When the application validates the callback
      Then the return path is sanitised to an internal application path
      And sign-in proceeds and the person lands on an internal page, with no open redirect