400 bad request : can't figure out the request problem - php

Question

I have to read a file in a OneDrive sheet using prestashop.
I can't use the microsoft/microsoft-graph packet with composer because it need guzzle v6 and prestashop is locked at v5 so i'm rigting the request myself but it seems i'm missing something.
I got the credential figured out, I have my access token (without it or a random string gives me an 401 error).
Now I'm trying to read a file, but even easier than that, I can't list the recent files in my drive.
I can do it on the graph explorer (beeing connected) and do whatever I want but whtin the code I always get an "400 error Bad request" with no other detail.
Here is my code, if you can point me to te right direction?
$url = 'https://graph.microsoft.com/v1.0/me/drive/recent';
$req = $guzzle->get($url, [
'headers' => [
'User-Agent' => 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.3 Safari/533.2',
'Accept' => 'application/json, text/plain, */*',
'Authorization' => 'Bearer ' . $accessToken,
],
'body' => [
],
]);
EDIT :
The problem seems to be about authorisation, here is the code :
<?php
// 1/ retrieve the access token
$guzzle = new \GuzzleHttp\Client();
$url = 'https://login.microsoftonline.com/' . $tenantId . '/oauth2/token?api-version=1.0';
$token = json_decode($guzzle->post($url, [
'body' => [
'client_id' => $clientId,
'client_secret' => $clientSecret,
'resource' => 'https://graph.microsoft.com/',
'grant_type' => 'client_credentials',
//should I use this
'roles'=>[
"Sites.Read.All",
"Files.Read.All"
],
//or this?
'scp' => 'Sites.Read.All Files.Read.All'
],
])->getBody()->getContents());
$access_token = $token->access_token;
// 2/ read file content
$userId = 'email#domain.fr';
$url = 'https://graph.microsoft.com/v1.0/users/' . $userId . '/drive/items/##FILE_ID##/workbook/worksheets(\'Export\')/range(address=\'a2:d4\')?$select=values';
//$url = 'https://graph.microsoft.com/v1.0/users/' . $userId . '/drive/list';
$guzzle = new \GuzzleHttp\Client();
$req = $guzzle->get($url, [
'headers' => [
'Authorization' => 'Bearer ' . $accessToken,
]
]);
// this return a 403 forbidden
$ret = json_decode($req->getBody()->getContents());

Answer 1

Most likely you acquire access token (application permission token) via Client credentials grant flow, in that case there is no Me context since it represents signed-in user context (applicable for delegated permission token only).
For application permission token user needs to be explicitly specified, for example:
To call List recent files endpoint at least Files.Read.All and Sites.Read.All permission levels are required.
Once permissions are granted and consented as illustrated below
roles claim should contain the following list of permissions:
"roles": [
"Sites.Read.All",
"Files.Read.All"
]
$userId = "<username>#<tenant>.onmicrosoft.com";
$url = 'https://graph.microsoft.com/v1.0/users/' . $userId . '/drive/recent';
$guzzle = new Client();
$headers = ['Authorization'=>'Bearer ' . $accessToken];
$response = $guzzle->get($url,['headers' => $headers]);
$json = json_decode($response->getBody()->getContents(),true);
To determine whether access token is delegated or application permission, jwt.io service, for instance, could be utilized:
for application permission token, the permissions are provided in the roles claim:
For delegated permission token, the permissions are specified via scp claim instead
How to get access token
function getAccessToken($tenantId, $clientId, $clientSecret){
$guzzle = new Client();
$url = 'https://login.microsoftonline.com/' . $tenantId . '/oauth2/token?api-version=1.0';
$token = json_decode($guzzle->post($url, [
'form_params' => [
'client_id' => $clientId,
'client_secret' => $clientSecret,
'resource' => 'https://graph.microsoft.com/',
'grant_type' => 'client_credentials'
],
])->getBody()->getContents());
return $token->access_token;
}