Migrate HTTP API calls to libre-graph-api-go SDK

[kobergj]

Context

Currently the MCP server hand-rolls all LibreGraph API calls using internal
client.GetJSON/client.ListJSON/client.PostJSON helpers with hardcoded
path strings (e.g. fmt.Sprintf("/graph/v1beta1/drives/%s/items/%s/invite", ...)).

This was flagged in #11 by @DeepDiver1975 — the ownCloud org already maintains
a generated Go SDK at https://github.com/owncloud/libre-graph-api-go that covers
the full API surface.

Problem

Hand-rolling paths leads to subtle bugs (wrong API version prefix, wrong response
envelope format, etc.) that are hard to catch without a live instance. PR #11 is
a direct result of this — several endpoints were broken because v1.0 was used
instead of v1beta1.

Proposed Solution

Replace the internal HTTP helpers with the libre-graph-api-go SDK:

• Proper Go types for all requests/responses
• API paths and version prefixes maintained by the SDK
• Future API changes are picked up via dependency update

Acceptance Criteria

• libre-graph-api-go added as a dependency
• All tools in shares.go, spaces.go, workflows.go, resources.go
  use SDK clients instead of raw HTTP helpers
• Internal client.ListJSON/client.GetJSON/client.PostJSON helpers
  removed or scoped to endpoints not covered by the SDK
• All existing tests pass

[dj4oC]

I started on this and hit a blocker worth surfacing before any migration PR: the latest released libre-graph-api-go (v1.0.4) doesn't contain the endpoints most of this issue targets. The drive-permissions / sharing API only exists on the SDK's unreleased main branch.

What the released SDK covers

go get github.com/owncloud/libre-graph-api-go resolves to v1.0.4 (the latest tag). Mapping that against the files in the acceptance criteria:

File	Needs	In v1.0.4?
spaces.go	drives, drives.get, drives.root	✅ yes
resources.go	me/drive/children ✅, driveItem ❌	⚠️ partial
shares.go	drivesPermissions (invite, list/update/delete, createLink)	❌ no
workflows.go	activities	❌ no

api_drives_permissions.go, api_activities.go, api_drive_item.go and api_role_management.go are present only on main (currently 67 commits ahead of v1.0.4, last commit 2026-05-28). So shares.go and workflows.go — the bulk of the value here — can't be migrated against any tagged release today.

Decision needed

Migrating shares.go/workflows.go now would mean pinning an unreleased SDK commit (go get …@<main-pseudo-version>), which ties this server to untagged code that can change without a release. Two clean paths:

1. Cut a libre-graph-api-go release that includes the drive-permissions / activities API, then migrate against that tag. (Preferred — keeps a stable, released dependency.)
2. Accept an unreleased SDK pin if that's acceptable for this project's dependency policy.

spaces.go could be migrated independently against v1.0.4 today as a first step, if useful.

Why this is worth doing (verified on a live oCIS 8.0.1)

The hand-rolled envelopes really are drifting from the API. The /invite response is {"value":[…]}, but handleCreateShare parses InviteOutput{Permissions []Permission \json:"permissions"`}— so create-share returns an **empty** permissions list even on a successfulHTTP 200. The SDK's CollectionOfPermissions{ Value []Permission `json:"value"` }` has the correct shape. This is the same class of bug as #11 and exactly what the SDK migration would prevent.

Proposed migration shape (for when the SDK is available)

• Add a helper on client.Client that builds a libregraph.APIClient: NewConfiguration() with Servers = [{URL: baseURL + "/graph"}], the existing *http.Client (preserving the 429-retry transport), and per-request auth via context.WithValue(ctx, libregraph.ContextBasicAuth, …) (app-token) or libregraph.ContextAccessToken (OIDC), derived from cfg.AuthMode.
• Replace the raw PostJSON/GetJSON/... calls in the Graph-backed handlers with typed SDK calls (e.g. Invite(ctx, driveID, itemID).DriveItemInvite(inv).Execute()), mapping SDK response models onto the existing tool output structs to keep the tool JSON contract stable.
• Keep WebDAV operations (search REPORT, uploads, PROPFIND) hand-rolled — the SDK is Graph-only.
• Tests point the SDK Configuration at an httptest server returning the real envelopes (e.g. {"value":[…]}).

Happy to proceed with whichever path you prefer — including migrating spaces.go against v1.0.4 now, or doing the full migration once a release lands.

---

For reference, the two concrete bugs are fixed independently of this refactor: #14 in #22 and #15 in #21 (both verified against live oCIS 8.0.1).