One Pantalytics-owned Azure app for every customer, instead of a registration per database #253

Problem

Every customer creates their own Azure app registration, and every Odoo host needs its own redirect URI in it (<web.base.url>/microsoft_oauth/callback). Setup is the wall five of 28 survey respondents named (docs/product-brief.md), and it is fragile: moving our own Odoo to odoo.pantalytics.com left the app registration pointing at pantalytics.odoo.com. Mail kept working only because the refresh-token grant sends no redirect URI. The first reconnect, new user or scope change would have failed with AADSTS50011.

Proposal

A multi-tenant app registration owned by Pantalytics (verified publisher), with one redirect URI on our side (mail-pro-admin), which hands the code back to the customer's Odoo via state. The customer admin clicks one consent screen; no Azure portal, no client secret in their database.

Same shape for Google: one OAuth client of ours, one verification.

Open questions

• The client secret then lives with us, so the token exchange has to happen on our side or the refresh token is minted for our app on their tenant. Decide where refresh happens and what the customer's database stores.
• Keep "bring your own app registration" as the advanced path for tenants that block third-party consent.
• Fits the "sync needs a connected instance" rule already in pan_mail_license.sync_allowed().