app/lib/graph/auth.py

import msal

from app.config import Settings


class GraphAuthProvider:
    _SCOPE = ["https://graph.microsoft.com/.default"]

    def __init__(self, settings: Settings) -> None:
        self._app = msal.ConfidentialClientApplication(
            client_id=settings.azure_client_id,
            authority=f"https://login.microsoftonline.com/{settings.azure_tenant_id}",
            client_credential=settings.azure_client_secret.get_secret_value(),
        )

    def get_access_token(self) -> str:
        result = self._app.acquire_token_silent(self._SCOPE, account=None)
        if not result:
            result = self._app.acquire_token_for_client(scopes=self._SCOPE)
        if "access_token" not in result:
            raise RuntimeError(
                f"MSAL token error: {result.get('error_description', result.get('error'))}"
            )
        return result["access_token"]