Deploy OneNote integrations with MSAL token persistence, health checks, and container best practices. Use when containerizing OneNote services, configuring health endpoints, or managing token cache in production. Trigger with "onenote deploy", "onenote docker", "onenote container", "onenote health check".
Deploying OneNote integrations into containers breaks local development assumptions: MSAL token caches vanish on restart, health checks must validate Graph API connectivity (not just HTTP 200), and graceful shutdown must flush token state. This skill provides production-ready Dockerfile, Docker Compose, and Kubernetes manifests with MSAL token persistence, health/readiness probes that verify actual Graph reachability, and SIGTERM handling.
Notes.Read, Notes.ReadWrite)FROM node:20-slim AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY tsconfig.json src/ ./
RUN npm run build
FROM node:20-slim
WORKDIR /app
RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./
RUN mkdir -p /app/.cache/msal && chown -R node:node /app/.cache
USER node
ENV NODE_ENV=production MSAL_CACHE_DIR=/app/.cache/msal
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
CMD curl -sf http://localhost:3000/health || exit 1
EXPOSE 3000
CMD ["node", "dist/index.js"]
File-based (single replica):
// src/auth/token-cache.ts
import { readFile, writeFile, mkdir } from "fs/promises";
import { existsSync } from "fs";
import path from "path";
const CACHE_DIR = process.env.MSAL_CACHE_DIR || "/app/.cache/msal";
const CACHE_FILE = path.join(CACHE_DIR, "token-cache.json");
export async function loadCache(): Promise<string | null> {
try {
if (existsSync(CACHE_FILE)) return await readFile(CACHE_FILE, "utf-8");
} catch (err) { console.error("Failed to load token cache:", err); }
return null;
}
export async function saveCache(contents: string): Promise<void> {
await mkdir(CACHE_DIR, { recursive: true });
await writeFile(CACHE_FILE, contents, { mode: 0o600 });
}
Redis-based (multi-replica):
// src/auth/redis-cache.ts
import { createClient, RedisClientType } from "redis";
const CACHE_KEY = "msal:onenote:token-cache";
let redis: RedisClientType;
export async function initRedisCache(): Promise<void> {
redis = createClient({ url: process.env.REDIS_URL || "redis://localhost:6379" });
redis.on("error", (err) => console.error("Redis cache error:", err));
await redis.connect();
}
export async function loadCache(): Promise<string | null> { return redis.get(CACHE_KEY); }
export async function saveCache(contents: string): Promise<void> {
await redis.set(CACHE_KEY, contents, { EX: 86400 }); // 24h TTL
}
export async function flushAndDisconnect(): Promise<void> { await redis.quit(); }
Validates Graph API connectivity, not just HTTP liveness:
// src/health.ts
app.get("/health", async (_req, res) => {
const checks: Record<string, string> = {};
let healthy = true;
try { await getGraphClient(); checks.auth = "ok"; }
catch { checks.auth = "failed"; healthy = false; }
try {
await (await getGraphClient()).api("/me/onenote/notebooks").top(1).get();
checks.graph_api = "ok";
} catch (err: any) {
checks.graph_api = err?.statusCode === 429 ? "rate_limited" : "failed";
if (err?.statusCode !== 429) healthy = false;
}
res.status(healthy ? 200 : 503).json({ status: healthy ? "healthy" : "unhealthy", checks });
});
app.get("/ready", async (_req, res) => {
try { await getGraphClient(); res.json({ ready: true }); }
catch { res.status(503).json({ ready: false }); }
});
// src/shutdown.ts
export function registerShutdownHandlers(server: any, getCacheContents: () => string): void {
let shuttingDown = false;
const shutdown = async (signal: string) => {
if (shuttingDown) return;
shuttingDown = true;
console.log(`${signal} received. Flushing token cache...`);
try { await saveCache(getCacheContents()); } catch (e) { console.error("Cache flush failed:", e); }
server.close(() => process.exit(0));
setTimeout(() => { console.error("Forced exit after 10s"); process.exit(1); }, 10_000);
};
process.on("SIGTERM", () => shutdown("SIGTERM"));
process.on("SIGINT", () => shutdown("SIGINT"));
}