elevenlabs-webhook-nodejs 1.0.0

package/nestjs/src/google-calendar/google-calendar.service.ts

@@ -0,0 +1,811 @@
+import {
+  Injectable,
+  Logger,
+  NotFoundException,
+  BadRequestException,
+  Inject,
+} from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PrismaService } from '../database/prisma.service';
+import { EncryptionService } from '../integrations/encryption/encryption.service';
+import { REDIS_CLIENT } from '../redis/redis.module';
+import Redis from 'ioredis';
+import { createHmac } from 'crypto';
+
+interface CalendarEvent {
+  summary: string;
+  description?: string;
+  startTime: string; // ISO 8601
+  endTime: string;   // ISO 8601
+  attendees?: Array<{ email: string }>;
+  extendedProperties?: Record<string, any>;
+}
+
+interface CalendarEventUpdate {
+  summary?: string;
+  description?: string;
+  startTime?: string;
+  endTime?: string;
+}
+
+@Injectable()
+export class GoogleCalendarService {
+  private readonly logger = new Logger(GoogleCalendarService.name);
+  private readonly tokenLockTTL = 10_000; // 10s mutex
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly configService: ConfigService,
+    private readonly encryption: EncryptionService,
+    @Inject(REDIS_CLIENT) private readonly redis: Redis,
+  ) {}
+
+  /* ------------------------------------------------------------------ */
+  /*  OAuth: Generate Auth URL                                           */
+  /* ------------------------------------------------------------------ */
+
+  getAuthUrl(clinicId: string, stateSecret: string): string {
+    const clientId = this.configService.get<string>('GOOGLE_CLIENT_ID');
+    const callbackUrl = this.configService.get<string>('GOOGLE_CALLBACK_URL');
+
+    if (!clientId || !callbackUrl) {
+      throw new BadRequestException('Google OAuth not configured');
+    }
+
+    // HMAC-signed state = clinicId:hmac
+    const hmac = createHmac('sha256', stateSecret)
+      .update(clinicId)
+      .digest('hex');
+    const state = `${clinicId}:${hmac}`;
+
+    const params = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: callbackUrl,
+      response_type: 'code',
+      scope: [
+        'https://www.googleapis.com/auth/calendar',
+        'https://www.googleapis.com/auth/calendar.events',
+      ].join(' '),
+      access_type: 'offline',
+      prompt: 'consent',
+      state,
+    });
+
+    return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  OAuth: Handle Callback                                             */
+  /* ------------------------------------------------------------------ */
+
+  async handleCallback(
+    code: string,
+    state: string,
+    stateSecret: string,
+  ): Promise<{ clinicId: string; email: string }> {
+    // Validate HMAC state
+    const [clinicId, hmac] = state.split(':');
+    const expectedHmac = createHmac('sha256', stateSecret)
+      .update(clinicId)
+      .digest('hex');
+
+    if (hmac !== expectedHmac) {
+      throw new BadRequestException('Invalid OAuth state');
+    }
+
+    // Exchange code for tokens
+    const clientId = this.configService.get<string>('GOOGLE_CLIENT_ID');
+    const clientSecret = this.configService.get<string>('GOOGLE_CLIENT_SECRET');
+    const callbackUrl = this.configService.get<string>('GOOGLE_CALLBACK_URL');
+
+    const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        code,
+        client_id: clientId!,
+        client_secret: clientSecret!,
+        redirect_uri: callbackUrl!,
+        grant_type: 'authorization_code',
+      }),
+    });
+
+    if (!tokenRes.ok) {
+      const err = await tokenRes.text();
+      this.logger.error(`Token exchange failed: ${err}`);
+      throw new BadRequestException('Failed to exchange authorization code');
+    }
+
+    const tokens = await tokenRes.json();
+
+    // Get user email
+    const userInfoRes = await fetch(
+      'https://www.googleapis.com/oauth2/v2/userinfo',
+      { headers: { Authorization: `Bearer ${tokens.access_token}` } },
+    );
+    const userInfo = await userInfoRes.json();
+    const email = userInfo.email ?? '';
+
+    // Encrypt refresh token
+    const encryptionKey = this.configService.get<string>('GOOGLE_TOKEN_ENCRYPTION_KEY');
+    if (!encryptionKey) {
+      throw new BadRequestException('GOOGLE_TOKEN_ENCRYPTION_KEY not configured');
+    }
+    const encryptedRefreshToken = this.encryption.encrypt(
+      tokens.refresh_token,
+      encryptionKey,
+    );
+
+    // Upsert calendar connection
+    await this.prisma.clinicCalendarConnection.upsert({
+      where: { calcn_clinic_id: clinicId },
+      create: {
+        calcn_clinic_id: clinicId,
+        calcn_google_email: email,
+        calcn_encrypted_refresh_token: encryptedRefreshToken,
+        calcn_connected_at: new Date(),
+      },
+      update: {
+        calcn_google_email: email,
+        calcn_encrypted_refresh_token: encryptedRefreshToken,
+        calcn_connected_at: new Date(),
+      },
+    });
+
+    // Cache access token
+    if (tokens.access_token && tokens.expires_in) {
+      const ttl = Math.max(tokens.expires_in - 60, 60);
+      await this.redis.set(
+        `gcal:token:${clinicId}`,
+        tokens.access_token,
+        'EX',
+        ttl,
+      );
+    }
+
+    this.logger.log(`Google Calendar connected for clinic ${clinicId} (${email})`);
+
+    return { clinicId, email };
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  Disconnect                                                         */
+  /* ------------------------------------------------------------------ */
+
+  async disconnect(clinicId: string): Promise<void> {
+    const conn = await this.getConnection(clinicId);
+
+    // Attempt to revoke token (best effort)
+    try {
+      const accessToken = await this.getAccessToken(clinicId);
+      if (accessToken) {
+        await fetch(
+          `https://oauth2.googleapis.com/revoke?token=${accessToken}`,
+          { method: 'POST' },
+        );
+      }
+    } catch (err) {
+      this.logger.warn(`Token revocation failed for clinic ${clinicId}: ${err}`);
+    }
+
+    await this.prisma.clinicCalendarConnection.delete({
+      where: { calcn_id: conn.calcn_id },
+    });
+
+    await this.redis.del(`gcal:token:${clinicId}`);
+
+    this.logger.log(`Google Calendar disconnected for clinic ${clinicId}`);
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  List Calendars                                                     */
+  /* ------------------------------------------------------------------ */
+
+  async listCalendars(clinicId: string) {
+    const accessToken = await this.getAccessToken(clinicId);
+
+    const res = await fetch(
+      'https://www.googleapis.com/calendar/v3/users/me/calendarList',
+      { headers: { Authorization: `Bearer ${accessToken}` } },
+    );
+
+    if (!res.ok) {
+      throw new BadRequestException('Failed to list calendars');
+    }
+
+    const data = await res.json();
+
+    return (data.items ?? []).map((cal: any) => ({
+      id: cal.id,
+      name: cal.summary,
+      primary: cal.primary ?? false,
+      accessRole: cal.accessRole,
+    }));
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  Select Calendar                                                    */
+  /* ------------------------------------------------------------------ */
+
+  async selectCalendar(
+    clinicId: string,
+    calendarId: string,
+    calendarName: string,
+  ) {
+    await this.getConnection(clinicId); // verify connection exists
+
+    return this.prisma.clinicCalendarConnection.update({
+      where: { calcn_clinic_id: clinicId },
+      data: {
+        calcn_calendar_id: calendarId,
+        calcn_calendar_name: calendarName,
+      },
+    });
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  Get Access Token (cached with mutex)                               */
+  /* ------------------------------------------------------------------ */
+
+  async getAccessToken(clinicId: string): Promise<string> {
+    // Check cache
+    const cached = await this.redis.get(`gcal:token:${clinicId}`);
+    if (cached) return cached;
+
+    // Acquire mutex to prevent concurrent refresh
+    const lockKey = `gcal:lock:${clinicId}`;
+    const acquired = await this.redis.set(lockKey, '1', 'PX', this.tokenLockTTL, 'NX');
+
+    if (!acquired) {
+      // Another process is refreshing — wait and retry
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+      const retried = await this.redis.get(`gcal:token:${clinicId}`);
+      if (retried) return retried;
+      throw new BadRequestException('Unable to refresh access token');
+    }
+
+    try {
+      const conn = await this.getConnection(clinicId);
+
+      if (!conn.calcn_encrypted_refresh_token) {
+        throw new BadRequestException('No refresh token stored');
+      }
+
+      const encryptionKey = this.configService.get<string>('GOOGLE_TOKEN_ENCRYPTION_KEY');
+      const refreshToken = this.encryption.decrypt(
+        conn.calcn_encrypted_refresh_token,
+        encryptionKey!,
+      );
+
+      const clientId = this.configService.get<string>('GOOGLE_CLIENT_ID');
+      const clientSecret = this.configService.get<string>('GOOGLE_CLIENT_SECRET');
+
+      const res = await fetch('https://oauth2.googleapis.com/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          client_id: clientId!,
+          client_secret: clientSecret!,
+          refresh_token: refreshToken,
+          grant_type: 'refresh_token',
+        }),
+      });
+
+      if (!res.ok) {
+        throw new BadRequestException('Failed to refresh Google access token');
+      }
+
+      const data = await res.json();
+      const ttl = Math.max((data.expires_in ?? 3600) - 60, 60);
+      await this.redis.set(`gcal:token:${clinicId}`, data.access_token, 'EX', ttl);
+
+      return data.access_token;
+    } finally {
+      await this.redis.del(lockKey);
+    }
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  Check Availability                                                 */
+  /* ------------------------------------------------------------------ */
+
+  async checkAvailability(clinicId: string, date: string) {
+    const conn = await this.getConnection(clinicId);
+
+    if (!conn.calcn_calendar_id) {
+      throw new BadRequestException('No calendar selected');
+    }
+
+    const accessToken = await this.getAccessToken(clinicId);
+
+    // Get working hours for the day of week
+    const targetDate = new Date(date);
+    const dayOfWeek = targetDate.getDay(); // 0=Sun
+    const workingHours = conn.calcn_working_hours as any[];
+    const dayHours = Array.isArray(workingHours)
+      ? workingHours.find((wh: any) => wh.day === dayOfWeek)
+      : null;
+
+    // Check blocked dates
+    const blockedDates = conn.calcn_blocked_dates as any[];
+    if (Array.isArray(blockedDates) && blockedDates.includes(date)) {
+      return { available: false, reason: 'blocked_date', slots: [] };
+    }
+
+    if (!dayHours || !dayHours.enabled) {
+      return { available: false, reason: 'no_working_hours', slots: [] };
+    }
+
+    // Query Google FreeBusy API
+    const timeMin = `${date}T${dayHours.start}:00`;
+    const timeMax = `${date}T${dayHours.end}:00`;
+
+    const freeBusyRes = await fetch(
+      'https://www.googleapis.com/calendar/v3/freeBusy',
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          timeMin: new Date(timeMin).toISOString(),
+          timeMax: new Date(timeMax).toISOString(),
+          items: [{ id: conn.calcn_calendar_id }],
+        }),
+      },
+    );
+
+    if (!freeBusyRes.ok) {
+      throw new BadRequestException('Failed to check availability');
+    }
+
+    const freeBusyData = await freeBusyRes.json();
+    const busySlots =
+      freeBusyData.calendars?.[conn.calcn_calendar_id]?.busy ?? [];
+
+    // Calculate available slots
+    const duration = conn.calcn_appointment_duration ?? 30;
+    const slots = this.calculateAvailableSlots(
+      dayHours.start,
+      dayHours.end,
+      duration,
+      busySlots,
+      date,
+    );
+
+    return { available: slots.length > 0, slots };
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  Create Event                                                       */
+  /* ------------------------------------------------------------------ */
+
+  async createEvent(clinicId: string, event: CalendarEvent) {
+    const conn = await this.getConnection(clinicId);
+
+    if (!conn.calcn_calendar_id) {
+      throw new BadRequestException('No calendar selected');
+    }
+
+    const accessToken = await this.getAccessToken(clinicId);
+
+    const googleEvent: any = {
+      summary: event.summary,
+      description: event.description ?? '',
+      start: { dateTime: event.startTime },
+      end: { dateTime: event.endTime },
+    };
+
+    if (event.attendees) {
+      googleEvent.attendees = event.attendees;
+    }
+
+    if (event.extendedProperties) {
+      googleEvent.extendedProperties = event.extendedProperties;
+    }
+
+    const res = await fetch(
+      `https://www.googleapis.com/calendar/v3/calendars/${encodeURIComponent(conn.calcn_calendar_id)}/events`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(googleEvent),
+      },
+    );
+
+    if (!res.ok) {
+      const err = await res.text();
+      this.logger.error(`Failed to create event: ${err}`);
+      throw new BadRequestException('Failed to create Google Calendar event');
+    }
+
+    return res.json();
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  Delete Event                                                       */
+  /* ------------------------------------------------------------------ */
+
+  async deleteEvent(clinicId: string, eventId: string) {
+    const conn = await this.getConnection(clinicId);
+
+    if (!conn.calcn_calendar_id) {
+      throw new BadRequestException('No calendar selected');
+    }
+
+    const accessToken = await this.getAccessToken(clinicId);
+
+    const res = await fetch(
+      `https://www.googleapis.com/calendar/v3/calendars/${encodeURIComponent(conn.calcn_calendar_id)}/events/${encodeURIComponent(eventId)}`,
+      {
+        method: 'DELETE',
+        headers: { Authorization: `Bearer ${accessToken}` },
+      },
+    );
+
+    if (!res.ok && res.status !== 404) {
+      throw new BadRequestException('Failed to delete Google Calendar event');
+    }
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  Update Event                                                       */
+  /* ------------------------------------------------------------------ */
+
+  async updateEvent(
+    clinicId: string,
+    eventId: string,
+    updates: CalendarEventUpdate,
+  ) {
+    const conn = await this.getConnection(clinicId);
+
+    if (!conn.calcn_calendar_id) {
+      throw new BadRequestException('No calendar selected');
+    }
+
+    const accessToken = await this.getAccessToken(clinicId);
+
+    const patch: any = {};
+    if (updates.summary !== undefined) patch.summary = updates.summary;
+    if (updates.description !== undefined) patch.description = updates.description;
+    if (updates.startTime !== undefined) patch.start = { dateTime: updates.startTime };
+    if (updates.endTime !== undefined) patch.end = { dateTime: updates.endTime };
+
+    const res = await fetch(
+      `https://www.googleapis.com/calendar/v3/calendars/${encodeURIComponent(conn.calcn_calendar_id)}/events/${encodeURIComponent(eventId)}`,
+      {
+        method: 'PATCH',
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(patch),
+      },
+    );
+
+    if (!res.ok) {
+      throw new BadRequestException('Failed to update Google Calendar event');
+    }
+
+    return res.json();
+  }
+
+  /* ------------------------------------------------------------------ */
+  /*  PRIVATE HELPERS                                                    */
+  /* ------------------------------------------------------------------ */
+
+  private async getConnection(clinicId: string) {
+    const conn = await this.prisma.clinicCalendarConnection.findUnique({
+      where: { calcn_clinic_id: clinicId },
+    });
+
+    if (!conn) {
+      throw new NotFoundException('Google Calendar not connected for this clinic');
+    }
+
+    return conn;
+  }
+
+  private calculateAvailableSlots(
+    startHour: string,
+    endHour: string,
+    durationMinutes: number,
+    busySlots: Array<{ start: string; end: string }>,
+    date: string,
+  ): Array<{ start: string; end: string }> {
+    const slots: Array<{ start: string; end: string }> = [];
+
+    const dayStart = new Date(`${date}T${startHour}:00`);
+    const dayEnd = new Date(`${date}T${endHour}:00`);
+
+    let cursor = dayStart.getTime();
+    const slotMs = durationMinutes * 60 * 1000;
+
+    while (cursor + slotMs <= dayEnd.getTime()) {
+      const slotStart = cursor;
+      const slotEnd = cursor + slotMs;
+
+      // Check for overlap with busy slots
+      const isBusy = busySlots.some((busy) => {
+        const busyStart = new Date(busy.start).getTime();
+        const busyEnd = new Date(busy.end).getTime();
+        return slotStart < busyEnd && slotEnd > busyStart;
+      });
+
+      if (!isBusy) {
+        slots.push({
+          start: new Date(slotStart).toISOString(),
+          end: new Date(slotEnd).toISOString(),
+        });
+      }
+
+      cursor += slotMs;
+    }
+
+    return slots;
+  }
+
+  /* ================================================================== */
+  /*  DOCTOR-LEVEL GOOGLE CALENDAR                                       */
+  /* ================================================================== */
+
+  getDoctorAuthUrl(doctorUserId: string, stateSecret: string): string {
+    const clientId = this.configService.get<string>('GOOGLE_CLIENT_ID');
+    const callbackUrl = this.configService.get<string>('GOOGLE_CALLBACK_URL');
+
+    if (!clientId || !callbackUrl) {
+      throw new BadRequestException('Google OAuth not configured');
+    }
+
+    // State = "doctor:{userId}:{hmac}"
+    const hmac = createHmac('sha256', stateSecret)
+      .update(`doctor:${doctorUserId}`)
+      .digest('hex');
+    const state = `doctor:${doctorUserId}:${hmac}`;
+
+    const params = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: callbackUrl,
+      response_type: 'code',
+      scope: [
+        'https://www.googleapis.com/auth/calendar',
+        'https://www.googleapis.com/auth/calendar.events',
+      ].join(' '),
+      access_type: 'offline',
+      prompt: 'consent',
+      state,
+    });
+
+    return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+  }
+
+  async handleDoctorCallback(
+    code: string,
+    doctorUserId: string,
+  ): Promise<{ doctorUserId: string; email: string }> {
+    const clientId = this.configService.get<string>('GOOGLE_CLIENT_ID');
+    const clientSecret = this.configService.get<string>('GOOGLE_CLIENT_SECRET');
+    const callbackUrl = this.configService.get<string>('GOOGLE_CALLBACK_URL');
+
+    const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        code,
+        client_id: clientId!,
+        client_secret: clientSecret!,
+        redirect_uri: callbackUrl!,
+        grant_type: 'authorization_code',
+      }),
+    });
+
+    if (!tokenRes.ok) {
+      const err = await tokenRes.text();
+      this.logger.error(`Doctor token exchange failed: ${err}`);
+      throw new BadRequestException('Failed to exchange authorization code');
+    }
+
+    const tokens = await tokenRes.json();
+
+    // Get user email
+    const userInfoRes = await fetch(
+      'https://www.googleapis.com/oauth2/v2/userinfo',
+      { headers: { Authorization: `Bearer ${tokens.access_token}` } },
+    );
+    const userInfo = await userInfoRes.json();
+    const email = userInfo.email ?? '';
+
+    // Encrypt refresh token
+    const encryptionKey = this.configService.get<string>('GOOGLE_TOKEN_ENCRYPTION_KEY');
+    if (!encryptionKey) {
+      throw new BadRequestException('GOOGLE_TOKEN_ENCRYPTION_KEY not configured');
+    }
+    const encryptedToken = this.encryption.encrypt(tokens.refresh_token, encryptionKey);
+
+    // Upsert on doctor profile
+    await this.prisma.doctorProfile.upsert({
+      where: { dprofile_user_id: doctorUserId },
+      create: {
+        dprofile_user_id: doctorUserId,
+        dprofile_google_email: email,
+        dprofile_google_encrypted_token: encryptedToken,
+        dprofile_google_connected_at: new Date(),
+      },
+      update: {
+        dprofile_google_email: email,
+        dprofile_google_encrypted_token: encryptedToken,
+        dprofile_google_connected_at: new Date(),
+      },
+    });
+
+    // Cache access token
+    if (tokens.access_token && tokens.expires_in) {
+      const ttl = Math.max(tokens.expires_in - 60, 60);
+      await this.redis.set(`gcal:doctor:${doctorUserId}`, tokens.access_token, 'EX', ttl);
+    }
+
+    this.logger.log(`Google Calendar connected for doctor ${doctorUserId} (${email})`);
+    return { doctorUserId, email };
+  }
+
+  async disconnectDoctor(doctorUserId: string): Promise<void> {
+    const profile = await this.prisma.doctorProfile.findUnique({
+      where: { dprofile_user_id: doctorUserId },
+    });
+
+    if (!profile?.dprofile_google_encrypted_token) {
+      throw new NotFoundException('Doctor has no Google Calendar connected');
+    }
+
+    // Revoke token (best effort)
+    try {
+      const token = await this.getDoctorAccessToken(doctorUserId);
+      if (token) {
+        await fetch(`https://oauth2.googleapis.com/revoke?token=${token}`, { method: 'POST' });
+      }
+    } catch {}
+
+    await this.prisma.doctorProfile.update({
+      where: { dprofile_user_id: doctorUserId },
+      data: {
+        dprofile_google_email: null,
+        dprofile_google_encrypted_token: null,
+        dprofile_google_calendar_id: null,
+        dprofile_google_calendar_name: null,
+        dprofile_google_connected_at: null,
+      },
+    });
+
+    await this.redis.del(`gcal:doctor:${doctorUserId}`);
+    this.logger.log(`Google Calendar disconnected for doctor ${doctorUserId}`);
+  }
+
+  async listAllDoctorsCalendarStatus(tenantId: string) {
+    const doctors = await this.prisma.user.findMany({
+      where: {
+        user_tenant_id: tenantId,
+        user_role: 'doctor',
+        user_is_active: true,
+      },
+      select: {
+        user_id: true,
+        user_first_name: true,
+        user_last_name: true,
+        user_email: true,
+        doctor_profile: {
+          select: {
+            dprofile_google_email: true,
+            dprofile_google_calendar_id: true,
+            dprofile_google_calendar_name: true,
+            dprofile_google_connected_at: true,
+          },
+        },
+      },
+    });
+
+    return doctors.map((d) => ({
+      userId: d.user_id,
+      firstName: d.user_first_name,
+      lastName: d.user_last_name,
+      email: d.user_email,
+      googleConnected: !!d.doctor_profile?.dprofile_google_email,
+      googleEmail: d.doctor_profile?.dprofile_google_email ?? null,
+      calendarId: d.doctor_profile?.dprofile_google_calendar_id ?? null,
+      calendarName: d.doctor_profile?.dprofile_google_calendar_name ?? null,
+      connectedAt: d.doctor_profile?.dprofile_google_connected_at ?? null,
+    }));
+  }
+
+  async getDoctorCalendarStatus(doctorUserId: string) {
+    const profile = await this.prisma.doctorProfile.findUnique({
+      where: { dprofile_user_id: doctorUserId },
+      select: {
+        dprofile_google_email: true,
+        dprofile_google_calendar_id: true,
+        dprofile_google_calendar_name: true,
+        dprofile_google_connected_at: true,
+      },
+    });
+
+    return {
+      connected: !!profile?.dprofile_google_email,
+      email: profile?.dprofile_google_email ?? null,
+      calendarId: profile?.dprofile_google_calendar_id ?? null,
+      calendarName: profile?.dprofile_google_calendar_name ?? null,
+      connectedAt: profile?.dprofile_google_connected_at ?? null,
+    };
+  }
+
+  async listDoctorCalendars(doctorUserId: string) {
+    const accessToken = await this.getDoctorAccessToken(doctorUserId);
+
+    const res = await fetch(
+      'https://www.googleapis.com/calendar/v3/users/me/calendarList',
+      { headers: { Authorization: `Bearer ${accessToken}` } },
+    );
+
+    if (!res.ok) throw new BadRequestException('Failed to list calendars');
+
+    const data = await res.json();
+    return (data.items ?? []).map((cal: any) => ({
+      id: cal.id,
+      summary: cal.summary,
+      primary: cal.primary ?? false,
+    }));
+  }
+
+  async selectDoctorCalendar(doctorUserId: string, calendarId: string, calendarName: string) {
+    await this.prisma.doctorProfile.update({
+      where: { dprofile_user_id: doctorUserId },
+      data: {
+        dprofile_google_calendar_id: calendarId,
+        dprofile_google_calendar_name: calendarName,
+      },
+    });
+    return { calendarId, calendarName };
+  }
+
+  private async getDoctorAccessToken(doctorUserId: string): Promise<string> {
+    // Check cache
+    const cached = await this.redis.get(`gcal:doctor:${doctorUserId}`);
+    if (cached) return cached;
+
+    // Refresh
+    const profile = await this.prisma.doctorProfile.findUnique({
+      where: { dprofile_user_id: doctorUserId },
+    });
+
+    if (!profile?.dprofile_google_encrypted_token) {
+      throw new NotFoundException('Doctor has no Google Calendar connected');
+    }
+
+    const encryptionKey = this.configService.get<string>('GOOGLE_TOKEN_ENCRYPTION_KEY')!;
+    const refreshToken = this.encryption.decrypt(profile.dprofile_google_encrypted_token, encryptionKey);
+
+    const clientId = this.configService.get<string>('GOOGLE_CLIENT_ID');
+    const clientSecret = this.configService.get<string>('GOOGLE_CLIENT_SECRET');
+
+    const res = await fetch('https://oauth2.googleapis.com/token', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        client_id: clientId!,
+        client_secret: clientSecret!,
+        refresh_token: refreshToken,
+        grant_type: 'refresh_token',
+      }),
+    });
+
+    if (!res.ok) throw new BadRequestException('Failed to refresh doctor access token');
+
+    const data = await res.json();
+    const ttl = Math.max((data.expires_in ?? 3600) - 60, 60);
+    await this.redis.set(`gcal:doctor:${doctorUserId}`, data.access_token, 'EX', ttl);
+
+    return data.access_token;
+  }
+}