onenote-prod-checklist

name	onenote-prod-checklist
description	Production readiness checklist for OneNote Graph API integrations covering auth, rate limits, and failure modes. Use when preparing a OneNote integration for production deployment or conducting a launch review. Trigger with "onenote production checklist", "onenote launch review", "onenote prod ready".
allowed-tools	Read, Write, Edit, Grep
version	1.6.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","onenote","microsoft"]
compatibility	Designed for Claude Code

OneNote Production Checklist

Overview

OneNote integrations that work perfectly in development break in production in predictable ways: SharePoint document libraries exceed the 5,000-item view threshold and stop returning notebooks, image uploads silently truncate above 4MB, rate limits compound across users during business hours, and MSAL token caches lose state across container restarts. This skill is a comprehensive go/no-go checklist organized by failure category. Each item references the specific Graph API behavior that causes the production failure and provides the fix. Use this checklist during launch reviews — every unchecked item is a production incident waiting to happen.

Prerequisites

• A functional OneNote integration that works in development/staging
• Azure AD app registration with delegated permissions configured
• Access to production monitoring infrastructure (logging, alerting)
• Familiarity with your deployment environment (containers, VMs, serverless)
• Completed onenote-security-basics and onenote-rate-limits skills

Instructions

1. Authentication Checklist

#	Check	Why it matters
1.1	Using delegated auth (DeviceCodeCredential or InteractiveBrowserCredential)	App-only auth (ClientSecretCredential) deprecated for OneNote March 31, 2025
1.2	MSAL token cache serialized to persistent storage	Container restarts lose in-memory cache; users forced to re-authenticate
1.3	Silent token renewal tested (call acquire_token_silent before every request)	Access tokens expire in 1 hour; without silent renewal, users hit 401 hourly
1.4	Refresh token 90-day expiry monitored	Inactive users' refresh tokens expire silently; need re-auth flow
1.5	Token cache file permissions set to 0600 (owner-only)	Cache contains refresh tokens — world-readable is a credential leak
1.6	Multi-tenant: tid claim validated on every token	Prevents cross-tenant data leakage from token reuse

Verification test:

import os, time

 ():
    
    
    response = client.me.onenote.notebooks.get()
     response.value   , 

    
    cache_path = os.path.expanduser()
     os.path.exists(cache_path), 
    stat = os.stat(cache_path)
     (stat.st_mode)[-:] == , 

    
    response2 = client.me.onenote.notebooks.get()
     response2.value   , 
    ()