chore(microsoft_ad): inline the public password-method route segment

The password authentication method id is a fixed, publicly documented Graph
route segment identical for every user in every tenant, but exporting it as
PASSWORD_..._ID = '<uuid>' matches generic secret-scanner heuristics. It has a
single call site, so inline it there with a doc reference instead.

Author: waleedlatif1

apps/sim/tools/microsoft_ad/reset_password.ts

@@ -2,9 +2,17 @@ import type {
   MicrosoftAdResetPasswordParams,
   MicrosoftAdResetPasswordResponse,
 } from '@/tools/microsoft_ad/types'
-import { PASSWORD_AUTHENTICATION_METHOD_ID } from '@/tools/microsoft_ad/utils'
 import type { ToolConfig } from '@/tools/types'
 
+/**
+ * Microsoft Graph exposes a user's password authentication method under a fixed, publicly
+ * documented object id that is identical for every user in every tenant. It is a route
+ * segment, not a credential.
+ *
+ * @see https://learn.microsoft.com/en-us/graph/api/resources/passwordauthenticationmethod
+ */
+const PASSWORD_METHOD_ROUTE_SEGMENT = '28c10230-6103-485e-b985-444c60001490'
+
 export const resetPasswordTool: ToolConfig<
   MicrosoftAdResetPasswordParams,
   MicrosoftAdResetPasswordResponse
@@ -44,7 +52,7 @@ export const resetPasswordTool: ToolConfig<
     url: (params) => {
       const userId = params.userId?.trim()
       if (!userId) throw new Error('User ID is required')
-      return `https://graph.microsoft.com/v1.0/users/${encodeURIComponent(userId)}/authentication/methods/${PASSWORD_AUTHENTICATION_METHOD_ID}/resetPassword`
+      return `https://graph.microsoft.com/v1.0/users/${encodeURIComponent(userId)}/authentication/methods/${PASSWORD_METHOD_ROUTE_SEGMENT}/resetPassword`
     },
     method: 'POST',
     headers: (params) => ({

apps/sim/tools/microsoft_ad/utils.ts

@@ -53,12 +53,6 @@ export function buildGraphCollectionUrl(
     : `https://graph.microsoft.com/v1.0/${path}`
 }
 
-/**
- * The well-known identifier of a user's password authentication method. Microsoft Graph
- * documents this ID as constant for every user.
- */
-export const PASSWORD_AUTHENTICATION_METHOD_ID = '28c10230-6103-485e-b985-444c60001490'
-
 /** The `device` properties the Microsoft Entra ID tools project into their outputs. */
 export const DEVICE_SELECT =
   'id,deviceId,displayName,operatingSystem,operatingSystemVersion,accountEnabled,isCompliant,isManaged,trustType,profileType,manufacturer,model,approximateLastSignInDateTime,registrationDateTime'