Family Hub — Restricted OneDrive Test
A separate security test. It does not modify your live Family Hub website, Supabase, or existing OneDrive files.
1. Microsoft sign-in
Request only Files.ReadWrite.AppFolder for file access, without requesting Files.Read or Files.ReadWrite. Your existing app registration must also list this exact test URL as a Single-page application redirect.
2. Test permission boundaries
These checks report HTTP statuses without displaying or collecting any private files.
3. Optional: create harmless test file
Only use this if the app-folder check passed. The test creates one small text file inside the dedicated application folder, never elsewhere.
How to interpret the outcome
App folder 200 + root 403: candidate for least-privilege integration. Check the token scope indicator too.
App folder 403 + root 403: permission boundary is narrow, but app-folder access may be failing for this personal account. Do not change V9.
Root 200: security test failed. Current token can reach outside the app folder; do not proceed with migration.
After testing, keep V9 running and report the two HTTP status codes. Do not share access tokens.