feat: Outlook calendar cache

[volnei]

What does this PR do?

Introduces the CalendarCache for Office365

---

Summary by cubic

Adds Outlook (Office365) calendar cache with a new subscription adapter, a standardized webhook handshake, and reliable delta syncing in the cache window. Improves event parsing and token handling; the provider remains disabled by default until validated.

• New Features

  • Office365 adapter: initial sync via calendarView/delta within the cache window; supports nextLink and deltaLink; improved parsing (busy/all‑day, time zones, etags, created/updated, recurring IDs); 7‑day subscription TTL.
  • Webhook: /api/webhooks/calendar-subscription/office365_calendar; handshake returns validationToken as text/plain; success responses return {}; validates clientState from headers/body.
  • Token management: MS_GRAPH_CLIENT_ID/MS_GRAPH_CLIENT_SECRET envs required for refresh; in‑memory refresh caching; supports delegated service‑account keys.

• Refactors

  • Subscription job logs succeeded and failed counts.

^{Written for commit 4594507. Summary will update on new commits.}

[github-actions]

Hey there and thank you for opening this pull request! 👋🏼

We require pull request titles to follow the Conventional Commits specification and it looks like your proposed title needs to be adjusted.

Details:

No release type found in pull request title "wip Outlook calendar cache". Add a prefix to indicate what kind of release this pull request corresponds to. For reference, see https://www.conventionalcommits.org/

Available types:
 - feat: A new feature
 - fix: A bug fix
 - docs: Documentation only changes
 - style: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
 - refactor: A code change that neither fixes a bug nor adds a feature
 - perf: A code change that improves performance
 - test: Adding missing tests or correcting existing tests
 - build: Changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)
 - ci: Changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)
 - chore: Other changes that don't modify src or test files
 - revert: Reverts a previous commit

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Review	Updated (UTC)
cal	Ignored		Jan 6, 2026 11:45am
cal-companion	Ignored	Preview	Jan 6, 2026 11:45am
cal-eu	Ignored		Jan 6, 2026 11:45am

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (all 1 issues)

Understand the root cause of the following 1 issues and fix them.


<file name="packages/features/calendar-subscription/adapters/Office365CalendarSubscription.adapter.ts">

<violation number="1" location="packages/features/calendar-subscription/adapters/Office365CalendarSubscription.adapter.ts:73">
If both MICROSOFT_WEBHOOK_URL and NEXT_PUBLIC_WEBAPP_URL are unset, this builds the truthy string &quot;undefined/api/webhooks/...&quot;, so subscribe() skips the missing-webhook guard and tries to register a Microsoft webhook against an invalid URL. Restore the null fallback (and config override) so we fail fast instead of sending a bad endpoint.</violation>
</file>

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

[cubic-dev-ai]

No issues found across 3 files

[cubic-dev-ai]

4 issues found across 8 files

Prompt for AI agents (all 4 issues)

Understand the root cause of the following 4 issues and fix them.


<file name="apps/web/app/api/webhooks/calendar-subscription/[provider]/route.ts">

<violation number="1" location="apps/web/app/api/webhooks/calendar-subscription/[provider]/route.ts:71">
Respond to the Office 365 validation handshake with the raw validationToken as plaintext; returning JSON causes Microsoft Graph to reject the handshake.</violation>
</file>

<file name="packages/features/calendar-subscription/lib/CalendarSubscriptionService.ts">

<violation number="1" location="packages/features/calendar-subscription/lib/CalendarSubscriptionService.ts:126">
Restoring the null return keeps the processWebhook contract for old subscriptions so callers/tests can detect stale channels.</violation>
</file>

<file name="packages/features/calendar-subscription/adapters/__tests__/Office365CalendarSubscriptionAdapter.test.ts">

<violation number="1" location="packages/features/calendar-subscription/adapters/__tests__/Office365CalendarSubscriptionAdapter.test.ts:77">
The tests replace global.fetch with vi.fn() in several cases but the afterEach teardown never restores the original fetch, so later suites will keep hitting the stub and can fail unexpectedly. Please capture the original fetch and reset it in afterEach.</violation>
</file>

<file name="packages/features/calendar-subscription/adapters/Office365CalendarSubscription.adapter.ts">

<violation number="1" location="packages/features/calendar-subscription/adapters/Office365CalendarSubscription.adapter.ts:72">
Rule violated: **Avoid Logging Sensitive Information**

Do not emit sensitive secrets in logs. Logging `this.webhookToken` exposes the MICROSOFT_WEBHOOK_TOKEN value, violating the policy against logging credentials. Remove the token from the log payload.</violation>
</file>

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

[github-actions]

Devin AI is resolving merge conflicts

This PR has merge conflicts with the main branch. A Devin session has been created to automatically resolve them.

View Devin Session

Devin will:

1. Merge the latest main into this branch
2. Resolve any conflicts intelligently
3. Run lint/type checks to ensure validity
4. Push the resolved changes

If you prefer to resolve conflicts manually, you can close the Devin session and handle it yourself.

[github-actions]

Devin AI is resolving merge conflicts

This PR has merge conflicts with the main branch. A Devin session has been created to automatically resolve them.

View Devin Session

Devin will:

1. Merge the latest main into this branch
2. Resolve any conflicts intelligently
3. Run lint/type checks to ensure validity
4. Push the resolved changes

If you prefer to resolve conflicts manually, you can close the Devin session and handle it yourself.

[github-actions]

E2E results are ready!

• Workflow #105102.1 latest results

[github-actions]

Devin AI is completing this stale PR

This PR by @volnei has been marked as stale. A Devin session has been created to complete the remaining work.

View Devin Session

---

Devin will review the PR, address any feedback, and push updates to complete this PR.

[devin-ai-integration]

Summary of changes addressing review feedback

I've completed the remaining fixes from the code review. Here's what was addressed:

Fixes applied

1. webhookUrl null fallback — webhookUrl now returns null when neither MICROSOFT_WEBHOOK_URL nor NEXT_PUBLIC_WEBAPP_URL is set, instead of constructing an invalid URL like "undefined/api/webhooks/...".

2. validationToken handshake in validate() — Microsoft Graph subscription validation pings use GET ?validationToken=… without clientState. The validate() method now checks for validationToken in query params before checking clientState, so handshake requests pass validation correctly.

3. Test fetch mock isolation — Saved/restored original global.fetch in afterEach to prevent mock leakage between tests. Fixed MICROSOFT_WEBHOOK_URL test env stub to use the base URL (the adapter appends the webhook path).

4. Added test for validationToken handshake — New test verifying that requests with ?validationToken=abc123 are correctly validated.

5. .env.example comments — Removed "Optional" prefix from MS_GRAPH_CLIENT_ID and MS_GRAPH_CLIENT_SECRET comments since they're required for Outlook calendar cache token refresh.

Previously fixed (by @volnei)

• Validation token response format (plaintext, not JSON) — commit f6580d9
• Sensitive info removed from logs — commits cd99cae, 6c6bf07

Notes

• Type check errors in packages/embeds/embed-react are pre-existing and unrelated to this PR.
• All 27 unit tests pass locally.