OneGIG · IT Integration Guide

Connect OneGIG to Microsoft 365, Oracle Fusion, and the company domain

Six short tasks. Each value you produce here is entered in Admin Console → System → Integrations on OneGIG — that screen is admin-only and protected by row-level security. No OneGIG code knowledge is needed.

Microsoft sign-in (Entra ID SSO)

Goal: employees sign in to OneGIG with their GIG Microsoft account — no separate passwords.

How sign-in flows once connected: employee → Microsoft login → back to OneGIG through the Supabase callback.

Register the app

In Azure Portal → Entra ID → App registrations click New registration. Name it OneGIG Intranet, choose Accounts in this organizational directory only, and set the Web redirect URI to:
https://uhtryptvvwaiejmzupkn.supabase.co/auth/v1/callback

Copy the two IDs

From the app's Overview page copy the Directory (tenant) ID and Application (client) ID into the OneGIG Integrations screen.

Create the key

Open Certificates & secrets → New client secret (24 months). Copy the secret Value immediately — it is shown only once — and paste it into “Client secret value” on the Integrations screen.

Grant permissions

Under API permissions add Microsoft Graph — Delegated: openid profile email User.Read · Application: User.Read.All GroupMember.Read.All Mail.Send — then press Grant admin consent, or use the “Open Microsoft sign-in (grant admin consent)” button on the Integrations screen.

Where the two IDs live in Azure, and where they go in OneGIG.

Finish together: the OneGIG owner enters the same tenant ID, client ID and secret in Supabase Auth → Providers → Azure, which switches on the “Sign in with Microsoft” button. Sign-ins stay restricted to the gig.sa domain.

Directory sync (Microsoft Graph)

Goal: the Employee Directory syncs automatically from Microsoft 365 — no more manual entry or CSVs.

Field mapping — what each Microsoft 365 profile field becomes on the OneGIG directory card.

Scope it (recommended)

Create an Entra security group such as GRP-OneGIG-AllStaff containing real staff only (no service accounts or shared mailboxes) and enter its name as the sync scope.

Pick the cadence

Choose hourly, daily, or weekly on the Integrations screen and whether profile photos sync. Daily is right for most organizations.

No extra keys needed — this uses the same app registration as task 1 (the User.Read.All application permission). The sync itself runs as a scheduled server function; the secret never reaches the browser.

Email sending

Goal: announcements, digests, and welcome emails are sent from a real company mailbox such as onegig@gig.sa.

Microsoft Graph (recommended)

Create a shared mailbox onegig@gig.sa in the M365 admin center and enter it as the sender on the Integrations screen. Sending uses the Mail.Send permission from task 1 — no passwords to manage.

SMTP relay (alternative)

Provide host (e.g. smtp.office365.com), port 587, and the username. Make sure SPF/DKIM/DMARC for the sender domain permit it. Choose “SMTP” as the transport and the extra fields appear.

Oracle Fusion (HR data)

Goal: HR data flows straight from Fusion HCM — directory cross-check, leave balances, and pending approvals on the landing page.

Read-only pull from Fusion HCM into OneGIG on a schedule — nothing is written back to Fusion.

Create the integration user

With the Fusion administrator create ONEGIG_INTEGRATION with the Human Capital Management Integration Specialist role (read-only REST access).

Enter the connection

On the Integrations screen enter the pod base URL https://<pod>.fa.ocs.oraclecloud.com, the username and password (an IDCS OAuth client is also supported if policy requires it), and tick which data to pull: workers, absences, approvals.

Open the network path

Allow API calls from the OneGIG server functions (egress IPs available on request) or route through the company API gateway.

Audience sync & email analytics

Goal: Corporate Comms and HR target real employee groups from the console's Audiences & email area, and delivery is reported honestly.

Entra (or Oracle) populations flow through the server-side sync into reusable OneGIG audiences.

Entra audience groups

Create or reuse Entra security groups for the populations Comms/HR should reach (e.g. GRP-SRW-Plant, GRP-Managers) and give the OneGIG owner each group's Object ID. Uses the same app registration - just make sure GroupMember.Read.All was consented in task 1.

Oracle populations (optional)

No extra setup beyond task 4 - an audience can point at a Fusion department/population name and syncs with the same integration user.

Mail secrets

Actual sending happens only in the process-email-outbox function. In Supabase → Edge Functions → Secrets, set ONE of: RESEND_API_KEY + EMAIL_FROM, or SMTP_HOST/SMTP_PORT/SMTP_USER/SMTP_PASS + EMAIL_FROM (same relay as task 3). Until set, sends are safe dry-runs.

Delivery events (optional)

For opens/clicks/bounces in the Insights tab: set an EVENTS_SECRET function secret and configure the mail provider's webhook to POST to
https://uhtryptvvwaiejmzupkn.supabase.co/functions/v1/email-events with header x-onegig-events-secret. Without it, Insights honestly shows "Not available".

Privacy by design: audience emails go out one recipient at a time (no exposed To/CC), recipients are snapshotted at queue time, and membership data is visible only to admins and explicitly permitted staff.

Department archives: scanning, retention, backup

Goal: department documents upload into a private, per-department archive (department-archives bucket) — IT owns scanning, limits and backup.

Malware scanning (hook ready, off by default)

Connect an approved scanner that fetches new objects with the service role and reports report_scan_result('<version-id>', 'clean'|'flagged'). Then switch on “Malware scanning connected” in Admin Console → Doc Governance → Department archives policy. Flagged files are automatically blocked for employees; OneGIG never claims a file is virus-free without a scan.

Limits & retention

Confirm the 50 MB per-file limit and the 7-year retention default on the same console card — both configurable and audited.

Backup

Include the Supabase project (database + storage) in the corporate backup routine and record the policy in the card's backup note. A reversible plan for migrating legacy SharePoint / Media-Library files exists in the repo (LEGACY_ARCHIVE_MIGRATION_PLAN.md) and is deliberately not auto-run.

Domain & hosting (GoDaddy)

Goal: OneGIG lives on a company address such as onegig.gig.sa, managed in the company GoDaddy account.

Recommended cutover: one CNAME record in GoDaddy, zero downtime, HTTPS handled automatically.

Add the CNAME

In GoDaddy DNS for gig.sa add CNAME onegig → gig-onegig.netlify.app.

Attach the domain

In Netlify → Domain management add onegig.gig.sa as a custom domain — the HTTPS certificate is issued automatically.

Update the callbacks

Update the Site URL in Supabase Auth settings and the redirect URIs in the Entra app to the new domain.

Not recommended: moving the files onto GoDaddy shared hosting. The portal depends on server functions and scheduled jobs (email digests, occasion emails, directory sync) that GoDaddy hosting cannot run. If policy requires leaving Netlify, the equivalent is an Azure Static Web App + Functions — raise it with the OneGIG owner first.

Security headers & Content-Security-Policy

Goal: OneGIG sends a strict Content-Security-Policy from hub/netlify.toml. The browser blocks any external origin that is not explicitly listed, so this is the first place to check when an integration "silently does nothing".

Read before wiring any integration: when you connect a new API that the browser calls directly (Microsoft Graph, Oracle Fusion, etc.), you must add its host to the CSP connect-src list, or the request is refused. New embedded content (Power BI, a video, a form) goes in frame-src; a new font/image/CDN host goes in font-src/img-src/script-src.

Find the header block

Edit the [[headers]] section (for /*) in hub/netlify.toml. Already allowed: Supabase (*.supabase.co, wss://*.supabase.co), the Supabase JS CDN, Google Fonts, and the video-embed hosts (YouTube-nocookie, SharePoint, OneDrive).

Add the new origin

Append the host to the right directive, e.g. connect-src … https://graph.microsoft.com https://login.microsoftonline.com plus the Oracle Fusion base URL. Entra SSO that redirects the whole page through Supabase Auth needs no change; only browser-side fetch/XHR to a new host does.

Deploy & verify

Push to main (Netlify auto-publishes), then confirm with curl -I https://onegig.gig.sa/ | grep -i content-security-policy and a browser console check that nothing legitimate is blocked.

Also set here: X-Frame-Options, Referrer-Policy, X-Content-Type-Options: nosniff, and a Permissions-Policy (camera, microphone, geolocation and similar disabled). The homepage JavaScript now lives in hub/js/, served from the site itself — deploy the whole hub/ folder together; no new hosting is involved.

Content link rules & delete permissions

Links are validated in the database

Any admin-entered or imported link (quick links, hero/promo buttons, menu items, SENAAT/external links, media, page images) must be https://, http://, mailto:, tel:, or a site path (/…). Other schemes (e.g. javascript:) are rejected by the database and the console shows "That link isn't allowed". Keep this in mind for any bulk / CSV import that carries links.

Deleting images is admin-only

Editors may upload and replace announcement covers and hero/promo assets, but only an admin can delete stored cover/asset files. Provision roles in Admin Console → System → Users accordingly.

✓

Hand-back checklist

#	Item	Where it comes from
1	App registration “OneGIG Intranet” — tenant ID + client ID	Azure Portal → App registrations
2	Client secret value (24 months)	Azure → Certificates & secrets
3	Graph permissions granted (`User.Read`, `User.Read.All`, `GroupMember.Read.All`, `Mail.Send`)	Azure → API permissions → admin consent
4	Redirect URI added: `https://uhtryptvvwaiejmzupkn.supabase.co/auth/v1/callback`	Azure → Authentication
5	Sync scope group (optional), e.g. `GRP-OneGIG-AllStaff`	Entra ID → Groups
6	Sender mailbox `onegig@gig.sa`	M365 admin center
7	Fusion integration user + pod base URL	Oracle Fusion administrator
8	DNS CNAME `onegig → gig-onegig.netlify.app`	GoDaddy DNS
9	Entra group Object IDs for target audiences (+ `GroupMember.Read.All` consent)	Entra ID → Groups
10	Mail secrets (`RESEND_API_KEY` or `SMTP_*`, `EMAIL_FROM`)	Supabase → Edge Function secrets
11	Optional: `EVENTS_SECRET` + provider webhook to `/functions/v1/email-events`	Mail provider
12	Add every new browser-called API host to the CSP `connect-src` (Graph, Oracle Fusion…); new embeds to `frame-src`	`hub/netlify.toml` (section 7)
13	Confirm imported/admin links use https/mailto/tel/relative only — the DB rejects other schemes	section 8

Enter every value in Admin Console → System → Integrations, press Save integration settings, then tell the OneGIG owner — the server-side wiring is switched on from there.