Skip to content

Add server-to-server Exchange calendar presence#41327

Draft
milton-rucks wants to merge 2 commits into
developfrom
codex/enterprise-calendar-server-sync
Draft

Add server-to-server Exchange calendar presence#41327
milton-rucks wants to merge 2 commits into
developfrom
codex/enterprise-calendar-server-sync

Conversation

@milton-rucks

@milton-rucks milton-rucks commented Jul 12, 2026

Copy link
Copy Markdown

Summary

  • add a provider-independent enterprise calendar synchronization package
  • implement Microsoft Graph app-only authentication with certificate and client-secret credentials
  • add bounded calendar delta synchronization, notification validation, subscription renewal, reconciliation, retry/backoff, and persistent state
  • project privacy-minimal availability intervals into Rocket.Chat presence without storing event content
  • add encrypted credential configuration, explicit mailbox mappings, health/resync APIs, safe legacy coexistence, metrics, assessment, ADR, and administrator documentation
  • define and test the EWS provider boundary without claiming operational EWS support

Why

The current Outlook integration is desktop-driven and requires per-user authentication. This change lets an administrator configure an organization-level Exchange Online connection once, while keeping calendar providers independent from Rocket.Chat presence and persistence.

Security and privacy

  • requires only Microsoft Graph application permission Calendars.Read
  • supports Exchange Online App RBAC mailbox scoping
  • encrypts credentials with AES-256-GCM using a deployment-supplied key
  • caches access tokens in memory and never exposes or logs them
  • HMACs mailbox and provider event identifiers before projection persistence
  • never requests or stores subject, body, attendees, location, attachments, or meeting links
  • validates webhook client state, deduplicates notifications, bounds payloads, and validates Graph cursor origins
  • keeps enterprise projections invisible to the legacy busy-event scheduler during rolling upgrades

Validation

  • @rocket.chat/enterprise-calendar: 10 suites, 28 tests passing
  • focused CalendarService: 25 tests passing
  • enterprise-calendar lint and typecheck passing
  • focused Meteor adapter lint passing
  • models typecheck passing
  • core typings build passing
  • git diff --check passing

Full monorepo verification is environment-blocked: dependency installation could not build unrelated native packages, the dependency build later stopped because Deno is unavailable, and standalone whole-Meteor type checking lacks generated workspace/Meteor declarations.

EWS status

This PR provides EWS contracts, configuration validation boundaries, hybrid routing, and explicit unsupported-state tests. It does not implement EWS SOAP operations, authentication transports, impersonation, notifications, or XML handling, and no administrator UI claims that EWS is operational.

@dionisio-bot

dionisio-bot Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Looks like this PR is not ready to merge, because of the following issues:

  • This PR is missing the 'stat: QA assured' label
  • This PR is missing the required milestone or project
  • This PR has an invalid title

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

@changeset-bot

changeset-bot Bot commented Jul 12, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 5e40886

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@CLAassistant

CLAassistant commented Jul 12, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

Milton Rucks seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

@coderabbitai

coderabbitai Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4a3d1a78-6590-4cf0-8840-22377ba8848f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

github-advanced-security[bot]
github-advanced-security AI found potential problems Jul 12, 2026
View reviewed changes
Comment thread ee/packages/enterprise-calendar/src/graphTokenProvider.ts
const { credential } = this.configuration;
if (credential.type !== 'certificate') throw new Error('certificate-credential-required');
const certificate = new X509Certificate(credential.certificate);
const x5t = createHash('sha1').update(certificate.raw).digest('base64url');
@codecov

codecov Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 76.44628% with 114 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.04%. Comparing base (edbaeef) to head (f006152).

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff            @@
##           develop   #41327    +/-   ##
=========================================
  Coverage    69.04%   69.04%            
=========================================
  Files         3757     3769    +12     
  Lines       147735   148355   +620     
  Branches     26395    26548   +153     
=========================================
+ Hits        102000   102430   +430     
- Misses       41234    41415   +181     
- Partials      4501     4510     +9
Flag Coverage Δ
unit 70.47% <76.44%> (-0.04%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

Invalid PR Title

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@milton-rucks @CLAassistant @github-advanced-security