Add lookback time adjustment for Office 365 source plugin partition execution

Signed-off-by: Alekhya Parisha <aparisha@amazon.com>

Author: Alekhya Parisha

data-prepper-plugins/saas-source-plugins/microsoft-office365-source/src/main/java/org/opensearch/dataprepper/plugins/source/microsoft_office365/service/Office365Service.java

@@ -63,11 +63,11 @@ public AuditLogsResponse searchAuditLogs(final String logType,
                 return office365RestClient.searchAuditLogs(logType, startTime, endTime, nextPageUri);
             }
 
-            // Check and adjust start time for 7-day limit
+            // Adjust start time based on configured lookback hours
             Instant adjustedStartTime = startTime;
-            Instant sevenDaysAgo = Instant.now().minus(SEVEN_DAYS);
-            if (startTime.isBefore(sevenDaysAgo)) {
-                adjustedStartTime = sevenDaysAgo;
+            Instant lookBackHoursAgo = Instant.now().minus(Duration.ofHours(office365SourceConfig.getLookBackHours()));
+            if (startTime.isBefore(lookBackHoursAgo) && lookBackHoursAgo.isBefore(endTime)) {
+                adjustedStartTime = lookBackHoursAgo;
             }
 
             AuditLogsResponse response =

data-prepper-plugins/saas-source-plugins/microsoft-office365-source/src/test/java/org/opensearch/dataprepper/plugins/source/microsoft_office365/service/Office365ServiceTest.java

@@ -12,6 +12,7 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.opensearch.dataprepper.metrics.PluginMetrics;
@@ -20,21 +21,17 @@
 import org.opensearch.dataprepper.plugins.source.microsoft_office365.exception.Office365Exception;
 import org.opensearch.dataprepper.plugins.source.microsoft_office365.models.AuditLogsResponse;
 
+import java.time.Clock;
 import java.time.Duration;
 import java.time.Instant;
+import java.time.ZoneOffset;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.ArgumentMatchers.isNull;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -208,6 +205,49 @@ void testGetAuditLog() {
         verify(office365RestClient).getAuditLog("test-id");
     }
 
+    @Test
+    void testSearchAuditLogs_WithRange_AdjustsStartTime() {
+        Clock fixedClock = Clock.fixed(Instant.parse("2025-11-09T21:30:00.00Z"), ZoneOffset.UTC);
+        Instant now = Instant.now(fixedClock);
+
+        // Create a time window that's beyond our configured range:
+        // Start time = current time - (4 days + 30 minutes)
+        // This simulates the crawler creating a partition that starts slightly beyond our range
+        Instant startTime = now.minus(Duration.ofDays(4))
+                .minus(Duration.ofMinutes(30));
+        // End time = start time + 1 hour
+        Instant endTime = startTime.plus(Duration.ofHours(1));
+
+        String logType = "Exchange";
+        int lookBackHours = 96; // Configure 4 days range limit
+
+        when(sourceConfig.getLookBackHours()).thenReturn(lookBackHours);
+        when(office365RestClient.searchAuditLogs(
+                any(String.class),
+                any(Instant.class),
+                any(Instant.class),
+                any()
+        )).thenReturn(new AuditLogsResponse(new ArrayList<>(), null));
+
+        office365Service.searchAuditLogs(logType, startTime, endTime, null);
+
+        // Capture the actual start time that was passed to the REST client
+        ArgumentCaptor<Instant> startTimeCaptor = ArgumentCaptor.forClass(Instant.class);
+        verify(office365RestClient).searchAuditLogs(
+                eq(logType),
+                startTimeCaptor.capture(),
+                eq(endTime),
+                isNull()
+        );
+
+        // Verify that the service adjusted the start time correctly:
+        Instant capturedStartTime = startTimeCaptor.getValue();
+        Duration actualLookback = Duration.between(capturedStartTime, now);
+        assertEquals(96, actualLookback.toHours(),
+                "Adjusted start time should be exactly 96 hours ago");
+    }
+
+
     private Map<String, Object> createTestItem(String contentId, Instant contentCreated) {
         Map<String, Object> item = new HashMap<>();
         item.put("contentId", contentId);