Fix Microsoft 365 citation cards and Outlook links

[Paul Lizer (paullizer)]

Summary

• Fix unreadable Microsoft 365 source popups in light and dark mode by reusing the shared portaled modal and accessible local color tokens, preserving source layouts and keyboard behavior.
• Retain baseline mail/calendar metadata and request Graph webLink with custom selections. Email and calendar items now have safe Open in Outlook new-tab actions in the popup, Documents sidebar, and Sources panel; SharePoint and OneDrive links are unchanged.
• Share direct-answer guidance across citation instructions, composition, and mixed-source handoffs to discourage routine source-provenance introductions without changing citation markers, meeting details, or uncertainty disclosures.

Saved history remains unchanged. Older records without a safe online URL need a fresh recall. No additional Graph requests, OAuth permissions, or history migration are introduced.

Linked issue

N/A. No associated GitHub issue.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

This refines existing citation functionality; no Latest Feature card is proposed. Release notes remain deferred pending administrator review.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.304 -> 0.261.305. No deployer files changed.

Testing / validation

• python -m pytest .\functional_tests\test_m365_source_citations.py .\functional_tests\test_m365_mail_calendar_search.py -q - passed: 59 tests.
• npm --prefix .\application\v2_ui run build - passed: TypeScript and production build; existing large-chunk warning remains.
• python .\functional_tests\test_docs_app_surface_coverage.py - passed: 7/7 checks, including inventory synchronization.
• python .\functional_tests\test_docs_site_quality.py - passed: 6/6 checks.
• python .\scripts\check_xss_sinks.py --full-file .\application\v2_ui\src\components\chat\M365CitationChip.tsx .\application\v2_ui\src\components\chat\ConversationDrawer.tsx .\application\v2_ui\src\components\chat\MessageInspector.tsx - passed for all three components.
• git --no-pager -c 'core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol' diff --cached --check - passed.

Browser validation command:

$env:PLAYWRIGHT_SERVICE_URL = ''; $env:PYTHONPATH = "$($PWD.Path)\ui_tests\fixtures"; python -m pytest .\ui_tests\test_v2_m365_source_citations.py .\ui_tests\test_v2_workflow_change_tracking.py -k "m365_source_citations or classic_edits_show_author_previous_value_revert_and_item_rows" -q

Passed: 17 tests, 23 deselected. Coverage includes production-CSS contrast of at least 4.5:1, both themes and desktop/phone layouts, focus containment/restoration, safe URLs, unavailable links, and exact Outlook new-tab destinations. Light/dark desktop/mobile captures were also inspected during implementation. Outlook pages are intercepted synthetic fixtures, not real mailboxes.

Known pre-existing limitation: the broader test_mixed_source_manifest_contracts.py suite has 9 failures and 6 passes in this environment. The same failures were reproduced with the pre-change orchestration module and network access blocked, due to legacy authorization fixtures and missing Cosmos credentials. These unrelated fixtures and access controls are unchanged. No live Graph/mailbox or live-model evaluation was performed.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated the Microsoft 365 citation feature, chat-control reference, and email/calendar action references. Added fix details and validation. Release notes were not changed.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

Route/settings entries are N/A: no routes or settings serialization were added or changed. Existing URL validation and noopener noreferrer are retained; regression coverage verifies inert malicious-looking source metadata.