@littlebearapps/outlook-assistant 3.12.1 → 3.14.0

package/auth/tools.js

@@ -2,16 +2,26 @@
  * Authentication-related tools for the Outlook Assistant server
  */
 const config = require('../config');
-const { getAuthErrorHints } = require('./auth-errors');
+const { getAuthErrorHints, authErrorLogLabel } = require('./auth-errors');
 const fs = require('fs');
 const path = require('path');
 const tokenManager = require('./token-manager');
+const {
+  CONFIG_FILE_NAME,
+  isValidClientId,
+  saveClientId,
+  getEnvClientId,
+  getClientIdSource,
+} = require('./client-config');
 const {
   initiateDeviceCodeFlow,
   pollForToken,
   isScopeConsentError,
   isConsentRequiredError,
 } = require('./device-code');
+const { toolMetadata } = require('../utils/risk-classes');
+const { toolError } = require('../utils/tool-error');
+const { log } = require('../utils/logger');
 
 // Path for persisting device code state across MCP server restarts
 const DEVICE_CODE_STATE_PATH = path.join(
@@ -19,6 +29,112 @@ const DEVICE_CODE_STATE_PATH = path.join(
   '.outlook-assistant-pending-auth.json'
 );
 
+const SETUP_GUIDE_URL =
+  'https://github.com/littlebearapps/outlook-assistant/blob/main/docs/how-to/getting-started/connect-outlook-to-claude.md';
+const SAVED_CONFIG_DISPLAY_PATH = `~/${CONFIG_FILE_NAME}`;
+
+/**
+ * Error shown when no client ID resolves (no env var, nothing saved). Written
+ * for the AI client: it tells it what to ask the user and which call to make.
+ * @returns {object} - MCP response ({ content, isError: true })
+ */
+function buildMissingClientIdResponse() {
+  return {
+    content: [
+      {
+        type: 'text',
+        text: [
+          'Error: OUTLOOK_CLIENT_ID is not configured, so sign-in cannot start.',
+          '',
+          '1. Ask the user for the **Application (client) ID** of their Azure app registration (Azure portal → App registrations → their app → Overview). It is a GUID such as `00000000-0000-0000-0000-000000000000`.',
+          `2. Call \`auth action=authenticate clientId=<id>\`. The ID is saved to \`${SAVED_CONFIG_DISPLAY_PATH}\` (it is not a secret) and device-code sign-in starts.`,
+          '',
+          'The client secret is not needed for device-code sign-in (the default); only the browser flow uses it.',
+          `No app registration yet? Follow the setup guide: ${SETUP_GUIDE_URL}`,
+          'Alternatively, set OUTLOOK_CLIENT_ID in the MCP server environment and restart it.',
+        ].join('\n'),
+      },
+    ],
+    isError: true,
+  };
+}
+
+/**
+ * Validate and save a client ID supplied via `auth action=authenticate`.
+ * @param {unknown} clientId
+ * @returns {{error: object}|{saved: string}} - An MCP error response, or the saved ID
+ */
+function applyClientIdArg(clientId) {
+  if (!isValidClientId(clientId)) {
+    return {
+      error: {
+        content: [
+          {
+            type: 'text',
+            text: [
+              'Error: `clientId` is not a valid Azure Application (client) ID.',
+              '',
+              'It must be the GUID shown as **Application (client) ID** on the app registration Overview page in the Azure portal, e.g. `00000000-0000-0000-0000-000000000000`. Do not use the Directory (tenant) ID, the Object ID or a client secret.',
+              `Setup guide: ${SETUP_GUIDE_URL}`,
+            ].join('\n'),
+          },
+        ],
+        isError: true,
+      },
+    };
+  }
+
+  const env = getEnvClientId();
+  if (env && env.value.trim().toLowerCase() !== clientId.trim().toLowerCase()) {
+    return {
+      error: {
+        content: [
+          {
+            type: 'text',
+            text: [
+              `Error: the ${env.name} environment variable is set to a different client ID, and it takes precedence over a saved one, so the \`clientId\` you supplied would be ignored.`,
+              '',
+              `To use the new ID, change or remove ${env.name} in the MCP server configuration, restart the server, then call \`auth action=authenticate\` again. Nothing was saved.`,
+            ].join('\n'),
+          },
+        ],
+        isError: true,
+      },
+    };
+  }
+
+  try {
+    return { saved: saveClientId(clientId) };
+  } catch (error) {
+    return {
+      error: {
+        content: [
+          {
+            type: 'text',
+            text: `Error: could not save the client ID to ${SAVED_CONFIG_DISPLAY_PATH}: ${error.message}`,
+          },
+        ],
+        isError: true,
+      },
+    };
+  }
+}
+
+/**
+ * Client ID row for `auth about`. The ID itself is never shown.
+ * @returns {string}
+ */
+function describeClientIdStatus() {
+  const source = getClientIdSource();
+  if (source === 'env') {
+    return `Configured (environment: ${getEnvClientId().name})`;
+  }
+  if (source === 'saved') {
+    return `Configured (saved in ${SAVED_CONFIG_DISPLAY_PATH})`;
+  }
+  return 'Not set (run `auth action=authenticate clientId=<Application (client) ID>`)';
+}
+
 // Dynamic tool count — set by index.js after TOOLS array is built
 let _toolCount = 0;
 function setToolCount(count) {
@@ -122,12 +238,14 @@ async function handleAbout() {
     `| Setting | Value |`,
     `|---------|-------|`,
     `| Mailbox | ${identity} |`,
+    `| Client ID | ${describeClientIdStatus()} |`,
     `| Tools | ${_toolCount} across 9 modules |`,
     `| Modules | auth, email, calendar, folder, rules, contacts, categories, settings, advanced |`,
     `| Timezone | ${config.DEFAULT_TIMEZONE} |`,
     `| Test Mode | ${testMode} |`,
     `| Rate Limit | ${rateLimit} |`,
     `| Recipient Allowlist | ${allowlist} |`,
+    `| Read-only mode | ${config.READ_ONLY ? 'On (OUTLOOK_READ_ONLY): only read tools and actions run' : 'Off (set OUTLOOK_READ_ONLY=true and restart to refuse every change)'} |`,
     `| Scopes | ${scopes.length} configured |`,
     `| Shared mailboxes | ${describeSharedMailboxStatus(granted)} |`,
     ``,
@@ -185,19 +303,54 @@ async function handleAuthenticate(args) {
     };
   }
 
+  // Optional runtime client ID (for clients that can't set env vars, e.g.
+  // plugin marketplaces): validate, refuse if an env var would override it,
+  // save, then carry on with the normal flow.
+  // null / blank counts as not supplied: some clients send empty optionals.
+  let savedPrefix;
+  const suppliedClientId = args?.clientId;
+  if (
+    suppliedClientId !== undefined &&
+    suppliedClientId !== null &&
+    String(suppliedClientId).trim() !== ''
+  ) {
+    const result = applyClientIdArg(suppliedClientId);
+    if (result.error) {
+      return result.error;
+    }
+    savedPrefix = `Saved your Azure Application (client) ID to \`${SAVED_CONFIG_DISPLAY_PATH}\`.`;
+  }
+
   const method = args?.method || config.AUTH_CONFIG.defaultAuthMethod;
 
   if (method === 'device-code') {
-    return handleDeviceCodeAuth();
+    return handleDeviceCodeAuth(savedPrefix);
   }
 
   // Browser redirect flow (existing behaviour)
-  const authUrl = `${config.AUTH_CONFIG.authServerUrl}/auth?client_id=${config.AUTH_CONFIG.clientId}`;
+  const clientId = config.AUTH_CONFIG.clientId;
+  if (!clientId) {
+    return buildMissingClientIdResponse();
+  }
+  const authUrl = `${config.AUTH_CONFIG.authServerUrl}/auth?client_id=${encodeURIComponent(clientId)}`;
+  const lines = [];
+  if (savedPrefix) {
+    lines.push(savedPrefix, '');
+  }
+  lines.push(
+    `Authentication required. Please visit the following URL to authenticate with Microsoft: ${authUrl}\n\nAfter authentication, you will be redirected back to this application.\n\nNote: The auth server must be running on port 3333. If working remotely, consider using method=device-code instead.`
+  );
+  if (getClientIdSource() !== 'env') {
+    lines.push(
+      '',
+      'The browser flow also needs the client secret: the auth server (`npm run auth-server`) reads OUTLOOK_CLIENT_ID and OUTLOOK_CLIENT_SECRET from its own environment and does not use a saved client ID. Device-code sign-in (the default) needs only the client ID.'
+    );
+  }
   return {
     content: [
       {
         type: 'text',
-        text: `Authentication required. Please visit the following URL to authenticate with Microsoft: ${authUrl}\n\nAfter authentication, you will be redirected back to this application.\n\nNote: The auth server must be running on port 3333. If working remotely, consider using method=device-code instead.`,
+        text: lines.join('\n'),
       },
     ],
   };
@@ -221,7 +374,7 @@ function saveDeviceCodeState(state) {
       fs.unlinkSync(DEVICE_CODE_STATE_PATH);
     }
   } catch (error) {
-    console.error(
+    log.debug(
       `[AUTH] Failed to ${state ? 'save' : 'clean up'} device code state: ${error.message}`
     );
   }
@@ -239,13 +392,13 @@ function loadDeviceCodeState() {
     }
     const state = JSON.parse(fs.readFileSync(DEVICE_CODE_STATE_PATH, 'utf8'));
     if (Date.now() > state.expiresAt) {
-      console.error('[AUTH] Persisted device code has expired, cleaning up');
+      log.debug('[AUTH] Persisted device code has expired, cleaning up');
       saveDeviceCodeState(null);
       return null;
     }
     return state;
   } catch (error) {
-    console.error(`[AUTH] Failed to load device code state: ${error.message}`);
+    log.debug(`[AUTH] Failed to load device code state: ${error.message}`);
     return null;
   }
 }
@@ -254,26 +407,20 @@ function loadDeviceCodeState() {
  * Device code flow step 1 — request a code for the user to enter.
  * Returns the code + URL immediately. Call device-code-complete to finish.
  * State is persisted to disk so it survives MCP server restarts.
+ * @param {string} [prefix] - Optional leading line (e.g. "client ID saved")
  * @returns {object} - MCP response
  */
-async function handleDeviceCodeAuth() {
+async function handleDeviceCodeAuth(prefix) {
   const clientId = config.AUTH_CONFIG.clientId;
   if (!clientId) {
-    return {
-      content: [
-        {
-          type: 'text',
-          text: 'Error: OUTLOOK_CLIENT_ID is not configured.',
-        },
-      ],
-    };
+    return buildMissingClientIdResponse();
   }
 
-  console.error('[AUTH] Starting device code flow...');
+  log.debug('[AUTH] Starting device code flow...');
   // Attempt the configured scope set (base, plus `.Shared` when
   // OUTLOOK_SHARED_MAILBOX opts in). If the account can't consent to
   // `.Shared`, handleDeviceCodeComplete re-issues with base scopes.
-  return initiateDeviceCode(config.AUTH_CONFIG.scopes, 'full');
+  return initiateDeviceCode(config.AUTH_CONFIG.scopes, 'full', prefix);
 }
 
 /**
@@ -306,7 +453,7 @@ async function initiateDeviceCode(scopes, scopesUsed, prefix) {
       !isConsentRequiredError(error) &&
       isScopeConsentError(error)
     ) {
-      console.error(
+      log.debug(
         '[AUTH] Shared-mailbox scopes rejected at device-code request; retrying with base scopes.'
       );
       return initiateDeviceCode(
@@ -318,18 +465,21 @@ async function initiateDeviceCode(scopes, scopesUsed, prefix) {
     return buildDeviceCodeErrorResponse(error);
   }
 
-  // Store in memory and persist to disk
+  // Store in memory and persist to disk. The client ID is recorded because
+  // the device code is bound to it: completion must poll with the same one.
   pendingDeviceCode = {
     deviceCode: response.deviceCode,
     interval: response.interval,
     expiresIn: response.expiresIn,
     expiresAt: Date.now() + response.expiresIn * 1000,
     scopesUsed,
+    clientId,
   };
   saveDeviceCodeState(pendingDeviceCode);
 
-  console.error(
-    `[AUTH] Device code (${scopesUsed} scopes): ${response.userCode}, expires in ${response.expiresIn}s`
+  // Never log the user code: it is for the user (via the tool result) only.
+  log.debug(
+    `[AUTH] Device code issued (${scopesUsed} scopes), expires in ${response.expiresIn}s`
   );
 
   const lines = [];
@@ -387,7 +537,8 @@ function buildDeviceCodeErrorResponse(error) {
     lines.push('', 'Suggested fixes:', ...hints.map((h) => `- ${h}`));
   }
 
-  console.error(`[AUTH] Device code initiation failed: ${msg}`);
+  log.note('auth', authErrorLogLabel('device-code-failed', error));
+  log.debug(`[AUTH] Device code initiation failed: ${msg}`);
 
   return {
     content: [{ type: 'text', text: lines.join('\n') }],
@@ -407,30 +558,27 @@ async function handleDeviceCodeComplete() {
   }
 
   if (!pendingDeviceCode) {
-    return {
-      content: [
-        {
-          type: 'text',
-          text: 'No pending device code flow. Call authenticate with method=device-code first.',
-        },
-      ],
-    };
+    return toolError('No pending device code flow.', {
+      nextStep: 'Start one with the `auth` tool with action=authenticate.',
+    });
   }
 
   if (Date.now() > pendingDeviceCode.expiresAt) {
     pendingDeviceCode = null;
     saveDeviceCodeState(null);
-    return {
-      content: [
-        {
-          type: 'text',
-          text: 'Device code has expired. Please start a new authentication with action=authenticate.',
-        },
-      ],
-    };
+    return toolError(
+      'Device code has expired. Please start a new authentication with action=authenticate.'
+    );
   }
 
-  const clientId = config.AUTH_CONFIG.clientId;
+  // Poll with the client ID the code was issued to (older state files don't
+  // record it, so fall back to the current one).
+  const clientId = pendingDeviceCode.clientId || config.AUTH_CONFIG.clientId;
+  if (!clientId) {
+    pendingDeviceCode = null;
+    saveDeviceCodeState(null);
+    return buildMissingClientIdResponse();
+  }
   // Capture which scope set this pending flow attempted, before any mutation.
   const scopesUsed = pendingDeviceCode.scopesUsed || 'full';
   // The scopes we attempted — used as the granted_scopes fallback when the
@@ -441,7 +589,7 @@ async function handleDeviceCodeComplete() {
       : config.AUTH_CONFIG.scopes;
 
   try {
-    console.error('[AUTH] Polling for device code completion...');
+    log.debug('[AUTH] Polling for device code completion...');
     const tokenResponse = await pollForToken(
       clientId,
       pendingDeviceCode.deviceCode,
@@ -455,7 +603,7 @@ async function handleDeviceCodeComplete() {
     // Save tokens using TokenStorage — mark as device-code auth
     const TokenStorage = require('./token-storage');
     const tokenStorage = new TokenStorage({
-      clientId: config.AUTH_CONFIG.clientId,
+      clientId,
       clientSecret: config.AUTH_CONFIG.clientSecret,
       tokenStorePath: config.AUTH_CONFIG.tokenStorePath,
       scopes: config.AUTH_CONFIG.scopes,
@@ -481,7 +629,7 @@ async function handleDeviceCodeComplete() {
     };
     await tokenStorage._saveTokensToFile();
 
-    console.error('[AUTH] Device code flow completed successfully.');
+    log.debug('[AUTH] Device code flow completed successfully.');
 
     return {
       content: [
@@ -504,7 +652,7 @@ async function handleDeviceCodeComplete() {
       !isConsentRequiredError(error) &&
       isScopeConsentError(error)
     ) {
-      console.error(
+      log.debug(
         '[AUTH] Shared-mailbox scopes rejected; falling back to base scopes.'
       );
       // Do NOT clear pendingDeviceCode — initiateDeviceCode replaces it.
@@ -525,19 +673,14 @@ async function handleDeviceCodeComplete() {
       } catch (reissueError) {
         pendingDeviceCode = null;
         saveDeviceCodeState(null);
-        return {
-          content: [
-            {
-              type: 'text',
-              text: `Authentication failed: ${reissueError.message}`,
-            },
-          ],
-        };
+        return toolError(`Authentication failed: ${reissueError.message}`);
       }
     }
 
     pendingDeviceCode = null;
     saveDeviceCodeState(null);
+    log.note('auth', authErrorLogLabel('device-code-complete-failed', error));
+    log.debug(`[AUTH] Device code completion failed: ${error.message}`);
 
     // Consent required (AADSTS65001) — remediable, so surface it instead of
     // silently downgrading to base scopes (which would strip shared-mailbox
@@ -545,30 +688,18 @@ async function handleDeviceCodeComplete() {
     // Only when the shared scopes were requested — otherwise the generic
     // path below (with its AADSTS hint table) is unchanged.
     if (config.SHARED_SCOPES.length > 0 && isConsentRequiredError(error)) {
-      return {
-        content: [
-          {
-            type: 'text',
-            text: [
-              'Authentication failed: consent was not granted (AADSTS65001).',
-              '',
-              `An administrator may need to grant consent for the shared-mailbox scopes (${config.SHARED_SCOPES.join(', ')}), or re-run \`auth action=authenticate\` and approve every requested permission.`,
-              'If your organisation will not consent to them, unset OUTLOOK_SHARED_MAILBOX and restart the server to sign in with the standard scopes.',
-              'No scopes were changed — your configured capability is unchanged.',
-            ].join('\n'),
-          },
-        ],
-      };
+      return toolError(
+        [
+          'Authentication failed: consent was not granted (AADSTS65001).',
+          '',
+          `An administrator may need to grant consent for the shared-mailbox scopes (${config.SHARED_SCOPES.join(', ')}), or re-run \`auth action=authenticate\` and approve every requested permission.`,
+          'If your organisation will not consent to them, unset OUTLOOK_SHARED_MAILBOX and restart the server to sign in with the standard scopes.',
+          'No scopes were changed — your configured capability is unchanged.',
+        ].join('\n')
+      );
     }
 
-    return {
-      content: [
-        {
-          type: 'text',
-          text: `Authentication failed: ${error.message}`,
-        },
-      ],
-    };
+    return toolError(`Authentication failed: ${error.message}`);
   }
 }
 
@@ -577,7 +708,7 @@ async function handleDeviceCodeComplete() {
  * @returns {object} - MCP response
  */
 async function handleCheckAuthStatus() {
-  console.error('[CHECK-AUTH-STATUS] Starting authentication status check');
+  log.debug('[CHECK-AUTH-STATUS] Starting authentication status check');
 
   // Use TokenStorage for accurate status (includes refresh attempt)
   const TokenStorage = require('./token-storage');
@@ -592,9 +723,13 @@ async function handleCheckAuthStatus() {
   const accessToken = await tokenStorage.getValidAccessToken();
 
   if (!accessToken) {
-    console.error('[CHECK-AUTH-STATUS] No valid access token');
+    log.debug('[CHECK-AUTH-STATUS] No valid access token');
+    const text =
+      getClientIdSource() === 'none'
+        ? `Not authenticated. No Azure Application (client) ID is configured yet: ask the user for the Application (client) ID of their Azure app registration, then call \`auth action=authenticate clientId=<id>\`. Setup guide: ${SETUP_GUIDE_URL}`
+        : 'Not authenticated';
     return {
-      content: [{ type: 'text', text: 'Not authenticated' }],
+      content: [{ type: 'text', text }],
     };
   }
 
@@ -603,7 +738,7 @@ async function handleCheckAuthStatus() {
     ? Math.round((expiresAt - Date.now()) / 60000)
     : 'unknown';
 
-  console.error(
+  log.debug(
     `[CHECK-AUTH-STATUS] Authenticated, token expires in ~${expiresIn} min`
   );
 
@@ -622,13 +757,8 @@ const authTools = [
   {
     name: 'auth',
     description:
-      'Manage authentication with the Microsoft Graph API. action=`status` (default) returns the current auth state and auto-refreshes the access token if it\'s expired but the refresh token is still valid (~90-day window) — call this first to check before other tools. action=`authenticate` starts the OAuth flow: with `method: "device-code"` (default, works headlessly) it returns a code + URL for the user to visit; with `method: "browser"` it opens the local auth server on :3333 (run `npm run auth-server` first). Pass `force: true` to re-authenticate over an existing valid session. action=`device-code-complete` finishes device-code auth after the user enters the code in their browser — call this once authentication shows as successful in the browser. action=`about` returns server version, configured audience, scope list, and other diagnostic info. Tokens persist to `~/.outlook-assistant-tokens.json` and survive server restarts.',
-    annotations: {
-      title: 'Authentication',
-      readOnlyHint: false,
-      destructiveHint: false,
-      openWorldHint: false,
-    },
+      'Manage authentication with the Microsoft Graph API. action=`status` (default) returns the current auth state, refreshing an expired access token while the refresh token is still valid (~90 days); call it first to check before other tools. action=`authenticate` starts sign-in: `method: "device-code"` (default, works headlessly) returns a code + URL for the user to visit; `method: "browser"` uses the local auth server on :3333 (run `npm run auth-server` first). `force: true` re-authenticates over an existing valid session. If sign-in reports that OUTLOOK_CLIENT_ID is not configured, ask the user for their Azure Application (client) ID and pass it as `clientId`. action=`device-code-complete` finishes device-code sign-in once the browser shows it succeeded. action=`about` returns server version, configured audience, scope list and other diagnostics. Tokens persist to `~/.outlook-assistant-tokens.json` and survive server restarts.',
+    ...toolMetadata('auth', 'Authentication'),
     inputSchema: {
       type: 'object',
       properties: {
@@ -648,6 +778,11 @@ const authTools = [
           description:
             'Force re-authentication even if already authenticated (action=authenticate only)',
         },
+        clientId: {
+          type: 'string',
+          description:
+            "Optional, action=authenticate only. The user's Azure Application (client) ID (a GUID from the app registration's Overview page). Saved to `~/.outlook-assistant-config.json` and used from then on; it is not a secret. The OUTLOOK_CLIENT_ID environment variable takes precedence when set.",
+        },
       },
       additionalProperties: false,
       required: [],
@@ -664,14 +799,9 @@ const authTools = [
         case 'status':
           return handleCheckAuthStatus();
         default:
-          return {
-            content: [
-              {
-                type: 'text',
-                text: `Unknown action '${action}'. Valid actions: status, authenticate, device-code-complete, about.`,
-              },
-            ],
-          };
+          return toolError(
+            `Unknown action '${action}'. Valid actions: status, authenticate, device-code-complete, about.`
+          );
       }
     },
   },

package/calendar/attendees.js

@@ -9,6 +9,9 @@
  * new address. An explicit type always wins.
  */
 
+const { findBlockedRecipients } = require('../utils/safety');
+const { toolError } = require('../utils/tool-error');
+
 const ATTENDEE_TYPES = ['required', 'optional', 'resource'];
 const ATTENDEE_FIELDS = new Set(['email', 'type']);
 
@@ -93,8 +96,41 @@ function buildAttendees(list, current = []) {
   }));
 }
 
+/**
+ * Refuse an attendee list that OUTLOOK_ALLOWED_RECIPIENTS doesn't fully
+ * allow: Graph emails every attendee (rooms and resources included) an
+ * invitation or update carrying the event body. The whole call is refused,
+ * never sent with the blocked attendees dropped, and a dry run reports the
+ * refusal too. Needs no Graph call.
+ * @param {Array<{emailAddress: {address: string}}>} attendees - Graph attendees
+ * @param {{operation?: 'create'|'update', dryRun?: boolean}} [options]
+ * @returns {object|null} - toolError naming the blocked addresses, or null
+ */
+function checkAttendeeAllowlist(
+  attendees,
+  { operation = 'create', dryRun = false } = {}
+) {
+  if (!attendees || attendees.length === 0) return null;
+  const result = findBlockedRecipients(attendees);
+  if (!result) return null;
+
+  const subject = operation === 'update' ? 'Event update' : 'Event';
+  const lead = dryRun
+    ? `DRY RUN — ${subject.toLowerCase()} would be refused`
+    : `${subject} refused`;
+  const outcome = operation === 'update' ? 'changed' : 'created';
+  return toolError(
+    `${lead}: OUTLOOK_ALLOWED_RECIPIENTS does not allow attendee ${result.blocked.join(', ')} (allowed recipients/domains: ${result.allowed.join(', ')}). Graph emails every attendee, so nothing was ${outcome}; the call is refused whole rather than sent without them.`,
+    {
+      nextStep:
+        'Remove those attendees and retry, or ask the user to add them to OUTLOOK_ALLOWED_RECIPIENTS in the server configuration and restart the server.',
+    }
+  );
+}
+
 module.exports = {
   ATTENDEE_TYPES,
+  checkAttendeeAllowlist,
   normaliseAttendeeInput,
   normaliseAttendees,
   buildAttendees,

package/calendar/cancel.js

@@ -3,6 +3,8 @@
  */
 const { callGraphAPI } = require('../utils/graph-api');
 const { ensureAuthenticated } = require('../auth');
+const { toolError, authRequiredError } = require('../utils/tool-error');
+const { previewCancelEvent } = require('./preview');
 
 /**
  * Cancel event handler
@@ -10,23 +12,19 @@ const { ensureAuthenticated } = require('../auth');
  * @returns {object} - MCP response
  */
 async function handleCancelEvent(args) {
-  const { eventId, comment } = args;
+  const { eventId, comment, dryRun = false } = args;
 
   if (!eventId) {
-    return {
-      content: [
-        {
-          type: 'text',
-          text: 'Event ID is required to cancel an event.',
-        },
-      ],
-    };
+    return toolError('Event ID is required to cancel an event.');
   }
 
   try {
     // Get access token
     const accessToken = await ensureAuthenticated();
 
+    // dryRun: read the event and say who would be emailed; send nothing.
+    if (dryRun) return await previewCancelEvent(accessToken, args);
+
     // Build API endpoint
     const endpoint = `me/events/${eventId}/cancel`;
 
@@ -49,24 +47,10 @@ async function handleCancelEvent(args) {
     };
   } catch (error) {
     if (error.message === 'Authentication required') {
-      return {
-        content: [
-          {
-            type: 'text',
-            text: "Authentication required. Please use the 'authenticate' tool first.",
-          },
-        ],
-      };
+      return authRequiredError();
     }
 
-    return {
-      content: [
-        {
-          type: 'text',
-          text: `Error cancelling event: ${error.message}`,
-        },
-      ],
-    };
+    return toolError(`Error cancelling event: ${error.message}`);
   }
 }