@agent-native/core 0.68.1 → 0.68.3

package/corpus/templates/calendar/app/hooks/use-google-auth.ts

@@ -1,7 +1,36 @@
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
-import { agentNativePath, oauthRedirectUri } from "@agent-native/core/client";
+import {
+  agentNativePath,
+  isInBuilderFrame,
+  oauthRedirectUri,
+} from "@agent-native/core/client";
 import type { GoogleAuthStatus } from "@shared/api";
-import { useEffect } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+
+export interface DesktopAuthIssue {
+  error?: string;
+  message?: string;
+  code?: string;
+  accountId?: string;
+  existingOwner?: string;
+  attemptedOwner?: string;
+}
+
+interface DesktopAuthResult {
+  token?: string;
+  email?: string;
+}
+
+interface DesktopAuthStartOptions {
+  addAccount?: boolean;
+  previousAccountCount?: number;
+}
+
+interface DesktopAuthOptions {
+  onError?: (issue: DesktopAuthIssue) => void;
+  onSuccess?: (result: DesktopAuthResult) => void | Promise<void>;
+  timeoutMs?: number;
+}
 
 function bodyError(
   body: any,
@@ -134,6 +163,178 @@ export function useGoogleAddAccountUrl(enabled = false) {
   return query;
 }
 
+export function useGoogleDesktopAuth(options: DesktopAuthOptions = {}) {
+  const { onError, onSuccess, timeoutMs = 120_000 } = options;
+  const pollRef = useRef<ReturnType<typeof setInterval> | null>(null);
+  const [isPending, setIsPending] = useState(false);
+  const isDesktopGoogleAuth = useMemo(() => {
+    if (typeof navigator === "undefined") return false;
+    return (
+      /AgentNativeDesktop/i.test(navigator.userAgent) && !isInBuilderFrame()
+    );
+  }, []);
+
+  const clearPoll = useCallback(() => {
+    if (pollRef.current) {
+      clearInterval(pollRef.current);
+      pollRef.current = null;
+    }
+  }, []);
+
+  useEffect(() => clearPoll, [clearPoll]);
+
+  const startDesktopGoogleAuth = useCallback(
+    (startOptions: DesktopAuthStartOptions = {}) => {
+      if (!isDesktopGoogleAuth || typeof window === "undefined") return false;
+
+      clearPoll();
+      setIsPending(true);
+      const flowId =
+        globalThis.crypto?.randomUUID?.() ||
+        Math.random().toString(36).slice(2) + Date.now().toString(36);
+      const redirectUri = oauthRedirectUri("/_agent-native/google/callback");
+      const params = new URLSearchParams({
+        redirect_uri: redirectUri,
+        desktop: "1",
+        flow_id: flowId,
+      });
+      let popup: Window | null = null;
+      const reportError = (issue: DesktopAuthIssue) => {
+        clearPoll();
+        setIsPending(false);
+        onError?.(issue);
+      };
+      const openAuthUrl = (url: string) => {
+        if (popup && !popup.closed) {
+          popup.location.href = url;
+          return true;
+        }
+        popup = window.open(url, "_blank");
+        return !!popup;
+      };
+
+      const startedAt = Date.now();
+      const finish = async (result: DesktopAuthResult = {}) => {
+        clearPoll();
+        setIsPending(false);
+        await onSuccess?.(result);
+      };
+
+      if (startOptions.addAccount) {
+        popup = window.open("about:blank", "_blank");
+        void (async () => {
+          try {
+            const { url } = await fetchJson<{ url: string }>(
+              agentNativePath(
+                `/_agent-native/google/add-account/auth-url?${params.toString()}`,
+              ),
+              { credentials: "include" },
+            );
+            if (!openAuthUrl(url)) {
+              reportError({
+                code: "popup_blocked",
+                message:
+                  "Calendar could not open Google sign-in. Allow popups and try again.",
+              });
+            }
+          } catch (err) {
+            popup?.close();
+            reportError({
+              code: "desktop_auth_start_failed",
+              message:
+                err instanceof Error
+                  ? err.message
+                  : "Could not start Google sign-in.",
+            });
+          }
+        })();
+      } else {
+        params.set("redirect", "1");
+        const opened = openAuthUrl(
+          `${window.location.origin}${agentNativePath(
+            "/_agent-native/google/auth-url",
+          )}?${params.toString()}`,
+        );
+        if (!opened) {
+          reportError({
+            code: "popup_blocked",
+            message:
+              "Calendar could not open Google sign-in. Allow popups and try again.",
+          });
+          return true;
+        }
+      }
+
+      pollRef.current = setInterval(async () => {
+        try {
+          const exchangeRes = await fetch(
+            agentNativePath(
+              `/_agent-native/auth/desktop-exchange?flow_id=${flowId}`,
+            ),
+            { credentials: "include" },
+          );
+          const exchange = await exchangeRes.json();
+          if (exchange?.error) {
+            clearPoll();
+            setIsPending(false);
+            onError?.(exchange);
+            return;
+          }
+          if (exchange?.token) {
+            await fetch(
+              agentNativePath(
+                `/_agent-native/auth/session?_session=${exchange.token}`,
+              ),
+              { credentials: "include" },
+            );
+            await finish({ token: exchange.token, email: exchange.email });
+            return;
+          }
+        } catch {
+          // Keep polling; the status endpoint below may still observe success.
+        }
+
+        try {
+          const statusRes = await fetch(
+            agentNativePath("/_agent-native/google/status"),
+            { credentials: "include" },
+          );
+          if (statusRes.ok) {
+            const status = (await statusRes.json()) as GoogleAuthStatus;
+            const connected = startOptions.addAccount
+              ? (status.accounts?.length ?? 0) >
+                (startOptions.previousAccountCount ?? 0)
+              : status.connected;
+            if (connected) {
+              await finish();
+              return;
+            }
+          }
+        } catch {
+          // Keep polling until the timeout.
+        }
+
+        if (Date.now() - startedAt > timeoutMs) {
+          reportError({
+            code: "desktop_auth_timeout",
+            message:
+              "Google sign-in timed out. Finish sign-in in the browser or try again.",
+          });
+        }
+      }, 1500);
+
+      return true;
+    },
+    [clearPoll, isDesktopGoogleAuth, onError, onSuccess, timeoutMs],
+  );
+
+  return {
+    isDesktopGoogleAuth,
+    isGoogleDesktopAuthPending: isPending,
+    startDesktopGoogleAuth,
+  };
+}
+
 export function useDisconnectGoogle() {
   const queryClient = useQueryClient();
   return useMutation({

package/corpus/templates/calendar/app/lib/event-colors.ts

@@ -107,16 +107,13 @@ export function allOtherDeclined(event: CalendarEvent): boolean {
 
 /**
  * Returns a hex color for a calendar event based on its meeting type.
- * Respects user-set colors and overlay colors first.
+ * Respects user-set colors first.
  * For local (non-Google) events without a color, returns CSS var.
  */
 export function getEventAutoColor(event: CalendarEvent): string {
   // User/Google-set color takes priority
   if (event.color) return event.color;
 
-  // Overlay events keep their overlay-assigned color
-  if (event.overlayEmail) return EVENT_CATEGORY_COLORS.fallback;
-
   // Local events without a color use the theme primary
   if (event.source !== "google") return "hsl(var(--primary))";
 

package/corpus/templates/calendar/app/lib/rsvp-status.tsx

@@ -27,6 +27,12 @@ export function getRsvpStatusLabel(status?: string) {
   }
 }
 
+export function canInlineRsvp(
+  event: Pick<CalendarEvent, "source" | "overlayEmail">,
+): boolean {
+  return event.source === "google" && !event.overlayEmail;
+}
+
 export function RsvpStatusIcon({
   status,
   className,

package/corpus/templates/calendar/app/pages/CalendarView.tsx

@@ -462,16 +462,21 @@ export default function CalendarView() {
   // small non-blocking spinner instead of hiding everything behind a skeleton.
   const eventsRefreshing = isFetching && !eventsLoading;
 
-  // Apply overlay colors and filter hidden calendars
+  // Apply overlay ownership markers and filter hidden calendars
   const events = useMemo(() => {
-    const colorMap = new Map(overlayPeople.map((p) => [p.email, p.color]));
+    const ownerMap = new Map(overlayPeople.map((p) => [p.email, p]));
     const sourceEvents = draftEvent
       ? [...rawEvents.filter((e) => e.id !== draftEvent.id), draftEvent]
       : rawEvents;
     return sourceEvents
       .map((e) => {
-        if (e.overlayEmail && colorMap.has(e.overlayEmail)) {
-          return { ...e, color: colorMap.get(e.overlayEmail) };
+        if (e.overlayEmail && ownerMap.has(e.overlayEmail)) {
+          const owner = ownerMap.get(e.overlayEmail);
+          return {
+            ...e,
+            ownerColor: owner?.color,
+            ownerName: owner?.name,
+          };
         }
         const tempId = quickEditTempIds[e.id];
         return tempId && !e._tempId ? { ...e, _tempId: tempId } : e;

package/corpus/templates/calendar/app/pages/NotFound.tsx

@@ -10,7 +10,7 @@ export default function NotFound() {
   }, [location.pathname]);
 
   return (
-    <div className="min-h-screen flex items-center justify-center bg-background">
+    <div className="flex min-h-full w-full items-center justify-center bg-background px-4 py-12">
       <div className="text-center">
         <h1 className="text-6xl font-bold text-foreground/10 mb-2">404</h1>
         <p className="text-sm text-muted-foreground mb-6">

package/corpus/templates/calendar/app/pages/Settings.tsx

@@ -31,6 +31,7 @@ import {
 import {
   useGoogleAuthStatus,
   useGoogleAuthUrl,
+  useGoogleDesktopAuth,
   useDisconnectGoogle,
 } from "@/hooks/use-google-auth";
 import {
@@ -45,6 +46,15 @@ export default function Settings() {
   const updateSettings = useUpdateSettings();
   const googleStatus = useGoogleAuthStatus();
   const disconnectGoogle = useDisconnectGoogle();
+  const {
+    isDesktopGoogleAuth,
+    isGoogleDesktopAuthPending,
+    startDesktopGoogleAuth,
+  } = useGoogleDesktopAuth({
+    onError: (issue) =>
+      toast.error(issue.message || issue.error || "Google sign-in failed"),
+    onSuccess: () => window.location.reload(),
+  });
   const zoomStatus = useZoomStatus();
   const connectZoom = useConnectZoom();
   const disconnectZoom = useDisconnectZoom();
@@ -81,6 +91,12 @@ export default function Settings() {
   }
 
   function handleConnect() {
+    if (isDesktopGoogleAuth) {
+      startDesktopGoogleAuth({
+        previousAccountCount: googleStatus.data?.accounts?.length ?? 0,
+      });
+      return;
+    }
     setWantAuthUrl(true);
   }
 
@@ -179,7 +195,15 @@ export default function Settings() {
                 Disconnect
               </Button>
             ) : (
-              <Button size="sm" onClick={handleConnect}>
+              <Button
+                size="sm"
+                onClick={handleConnect}
+                disabled={
+                  authUrl.isLoading ||
+                  authUrl.isFetching ||
+                  isGoogleDesktopAuthPending
+                }
+              >
                 <IconExternalLink className="mr-1.5 h-3.5 w-3.5" />
                 Connect
               </Button>

package/corpus/templates/calendar/app/routes/_app.$.tsx

@@ -0,0 +1,9 @@
+import NotFound from "@/pages/NotFound";
+
+export function meta() {
+  return [{ title: "Not Found - Calendar" }];
+}
+
+export default function AppCatchAllRoute() {
+  return <NotFound />;
+}

package/corpus/templates/calendar/server/handlers/google-auth.ts

@@ -9,6 +9,7 @@ import {
   getSession,
   isElectron,
   getAppUrl,
+  resolveGoogleSignInCredentials,
   resolveOAuthRedirectUri,
   encodeOAuthState,
   decodeOAuthState,
@@ -19,6 +20,7 @@ import {
   oauthErrorPage,
   setDesktopExchange,
   setDesktopExchangeError,
+  safeReturnPath,
 } from "@agent-native/core/server";
 import {
   getAuthUrl,
@@ -29,6 +31,85 @@ import {
 import { OAuthAccountOwnedByOtherUserError } from "@agent-native/core/oauth-tokens";
 
 const OAUTH_STATE_APP_ID = process.env.APP_NAME || "calendar";
+const GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const GOOGLE_USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo";
+const GOOGLE_IDENTITY_SCOPES = [
+  "openid",
+  "https://www.googleapis.com/auth/userinfo.email",
+  "https://www.googleapis.com/auth/userinfo.profile",
+];
+
+function resolveCalendarOAuthCredentials() {
+  const clientId = process.env.GOOGLE_CLIENT_ID;
+  const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
+  if (!clientId || !clientSecret) return null;
+  return { clientId, clientSecret };
+}
+
+function isCalendarConnectRequest(
+  query: Record<string, any>,
+  owner: string | undefined,
+) {
+  return (
+    !!owner ||
+    query.calendar === "1" ||
+    query.calendar === "true" ||
+    query.product === "calendar"
+  );
+}
+
+async function exchangeIdentityCode(
+  code: string,
+  redirectUri: string,
+): Promise<{
+  email: string;
+  id?: string;
+  name?: string;
+}> {
+  const credentials = resolveGoogleSignInCredentials();
+  if (!credentials) {
+    throw new Error(
+      "Google sign-in credentials are not configured. Set GOOGLE_SIGN_IN_CLIENT_ID and GOOGLE_SIGN_IN_CLIENT_SECRET.",
+    );
+  }
+
+  const tokenRes = await fetch(GOOGLE_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      code,
+      client_id: credentials.clientId,
+      client_secret: credentials.clientSecret,
+      redirect_uri: redirectUri,
+      grant_type: "authorization_code",
+    }),
+  });
+  const tokens = await tokenRes.json();
+  if (!tokenRes.ok) {
+    throw new Error(
+      tokens.error_description || tokens.error || "Token exchange failed",
+    );
+  }
+
+  const userRes = await fetch(GOOGLE_USERINFO_URL, {
+    headers: { Authorization: `Bearer ${tokens.access_token}` },
+  });
+  const user = await userRes.json();
+  const email = user.email as string | undefined;
+  if (!email) throw new Error("Could not get email from Google");
+  if (user.verified_email !== true) {
+    throw new Error(
+      "Google account email is not verified. Please verify your email with Google and try again.",
+    );
+  }
+
+  return {
+    email,
+    id: typeof user.id === "string" ? user.id : undefined,
+    name: typeof user.name === "string" ? user.name : undefined,
+  };
+}
 
 function oauthRedirectResponse(url: string) {
   // h3 v2 sendRedirect returns an object the framework shim can stringify as
@@ -93,14 +174,6 @@ function googleOAuthErrorResponse(
 }
 
 export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
-  if (!process.env.GOOGLE_CLIENT_ID || !process.env.GOOGLE_CLIENT_SECRET) {
-    setResponseStatus(event, 422);
-    return {
-      error: "missing_credentials",
-      message:
-        "Google OAuth credentials are not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.",
-    };
-  }
   try {
     const q = getQuery(event);
     const redirectUri = resolveOAuthRedirectUri(event);
@@ -116,17 +189,55 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
     const desktop =
       isElectron(event) || q.desktop === "1" || q.desktop === "true";
     const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
+    const calendarConnect = isCalendarConnectRequest(q, owner);
+    const credentials = calendarConnect
+      ? resolveCalendarOAuthCredentials()
+      : resolveGoogleSignInCredentials();
+
+    if (!credentials) {
+      setResponseStatus(event, 422);
+      return {
+        error: "missing_credentials",
+        message: calendarConnect
+          ? "Google Calendar OAuth credentials are not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET."
+          : "Google sign-in credentials are not configured. Set GOOGLE_SIGN_IN_CLIENT_ID and GOOGLE_SIGN_IN_CLIENT_SECRET.",
+      };
+    }
+
+    if (calendarConnect && !owner) {
+      setResponseStatus(event, 401);
+      return {
+        error: "not_authenticated",
+        message: "Sign in before connecting Google Calendar.",
+      };
+    }
+
+    const requestedReturn =
+      typeof q.return === "string" ? safeReturnPath(q.return) : "/";
+    const returnUrl = requestedReturn !== "/" ? requestedReturn : undefined;
     // Use the named-arg overload — the positional form previously passed
     // `flowId` in the `returnUrl` slot, breaking desktop completion.
     const state = encodeOAuthState({
       redirectUri,
       owner,
       desktop,
-      addAccount: false,
+      addAccount: calendarConnect,
       app: OAUTH_STATE_APP_ID,
+      returnUrl,
       flowId,
     });
-    const url = getAuthUrl(undefined, redirectUri, state);
+
+    const url = calendarConnect
+      ? getAuthUrl(undefined, redirectUri, state)
+      : `${GOOGLE_AUTH_URL}?${new URLSearchParams({
+          client_id: credentials.clientId,
+          redirect_uri: redirectUri,
+          response_type: "code",
+          scope: GOOGLE_IDENTITY_SCOPES.join(" "),
+          access_type: "online",
+          prompt: "select_account",
+          state,
+        })}`;
     if (q.redirect === "1") {
       return oauthRedirectResponse(url);
     }
@@ -172,7 +283,7 @@ export const handleGoogleCallback = defineEventHandler(
         return { error: "Missing authorization code" };
       }
 
-      const { redirectUri, owner: stateOwner, addAccount } = state;
+      const { redirectUri, owner: stateOwner, addAccount, returnUrl } = state;
 
       // 1. Resolve owner (needs session context, before exchangeCode)
       const { owner, hasProductionSession } = await resolveOAuthOwner(
@@ -180,7 +291,36 @@ export const handleGoogleCallback = defineEventHandler(
         stateOwner,
       );
 
-      // 2. Exchange code with Google (template-specific)
+      if (!addAccount) {
+        const identity = await exchangeIdentityCode(code, redirectUri);
+        const { sessionToken } = await createOAuthSession(
+          event,
+          identity.email,
+          {
+            hasProductionSession,
+            desktop,
+            trackSignup: {
+              authProvider: "google",
+              authUserId: identity.id,
+              name: identity.name,
+            },
+          },
+        );
+
+        if (flowId && sessionToken) {
+          setDesktopExchange(flowId, sessionToken, identity.email);
+        }
+
+        return oauthCallbackResponse(event, identity.email, {
+          sessionToken,
+          desktop,
+          returnUrl,
+          flowId,
+          appName: "Calendar",
+        });
+      }
+
+      // 2. Exchange code with Google (template-specific Calendar connect)
       const email = await exchangeCode(code, undefined, redirectUri, owner);
 
       // 3. Create session token (after we have the email)

package/corpus/templates/calendar/server/lib/google-calendar.ts

@@ -46,21 +46,59 @@ interface GoogleTokens {
   photoUrl?: string;
 }
 
+interface GoogleOAuthCredentials {
+  clientId: string;
+  clientSecret: string;
+}
+
 function optionalString(value: unknown): string | undefined {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
 
 function getOAuth2Credentials() {
-  const clientId = process.env.GOOGLE_CLIENT_ID;
-  const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
-  if (!clientId || !clientSecret) {
+  const credentials = resolveGoogleProviderCredentialCandidates()[0];
+  if (!credentials) {
     throw new Error(
       "GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET must be set in environment",
     );
   }
+  return credentials;
+}
+
+function getOAuth2RefreshCredentials() {
+  const candidates = resolveGoogleProviderCredentialCandidates();
+  if (!candidates.length) {
+    throw new Error(
+      "GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET must be set in environment",
+    );
+  }
+  return candidates;
+}
+
+function readCredentialPair(
+  clientIdKey: string,
+  clientSecretKey: string,
+): GoogleOAuthCredentials | null {
+  const clientId = process.env[clientIdKey];
+  const clientSecret = process.env[clientSecretKey];
+  if (!clientId || !clientSecret) return null;
   return { clientId, clientSecret };
 }
 
+function resolveGoogleProviderCredentialCandidates(): GoogleOAuthCredentials[] {
+  const primary = readCredentialPair(
+    "GOOGLE_CLIENT_ID",
+    "GOOGLE_CLIENT_SECRET",
+  );
+  const legacy = readCredentialPair(
+    "GOOGLE_LEGACY_CLIENT_ID",
+    "GOOGLE_LEGACY_CLIENT_SECRET",
+  );
+  if (!primary) return legacy ? [legacy] : [];
+  if (!legacy || legacy.clientId === primary.clientId) return [primary];
+  return [primary, legacy];
+}
+
 /**
  * Permanent OAuth refresh failures Google can return. When we hit one of
  * these, the refresh_token is dead — keeping the row around makes
@@ -316,17 +354,27 @@ async function getValidAccessToken(
       );
     }
     try {
-      const { clientId, clientSecret } = getOAuth2Credentials();
-      const oauth2 = createOAuth2Client(clientId, clientSecret, "");
-      const newTokens = await oauth2.refreshToken(tokens.refresh_token);
-      const merged = { ...tokens, ...newTokens };
-      await saveOAuthTokens(
-        "google",
-        accountId,
-        merged as unknown as Record<string, unknown>,
-        owner ?? accountId,
-      );
-      return merged.access_token;
+      let lastRefreshError: any;
+      for (const { clientId, clientSecret } of getOAuth2RefreshCredentials()) {
+        try {
+          const oauth2 = createOAuth2Client(clientId, clientSecret, "");
+          const newTokens = await oauth2.refreshToken(tokens.refresh_token);
+          const merged = { ...tokens, ...newTokens };
+          await saveOAuthTokens(
+            "google",
+            accountId,
+            merged as unknown as Record<string, unknown>,
+            owner ?? accountId,
+          );
+          return merged.access_token;
+        } catch (err: any) {
+          lastRefreshError = err;
+          if (!isPermanentRefreshError(err?.message || "")) {
+            throw err;
+          }
+        }
+      }
+      throw lastRefreshError;
     } catch (err: any) {
       if (isPermanentRefreshError(err?.message || "")) {
         // Drop the dead row so isOAuthConnected returns false and the UI
@@ -860,6 +908,7 @@ export async function listOverlayEvents(
           eventType: event.eventType || "default",
           accountEmail: undefined,
           overlayEmail,
+          ...mapColor(event),
           attendees: mapAttendees(event),
           organizer: mapOrganizer(event),
           createdAt: event.created || new Date().toISOString(),