revert(outlook): drop Calendars.ReadWrite.Shared from the outlook provider

Reverts the scope I added two rounds ago. It was the wrong call.

This provider is shared by work/school AND personal Outlook accounts, and the
.Shared calendar scopes are not confirmed supported for personal Microsoft
accounts. Requesting one risks failing consent for personal users — which would
take mail access down with it, breaking functionality that works today. The PR
already documents this exact reasoning as why findMeetingTimes was excluded, and
that decision was made against a live personal mailbox.

The evidence I added it on was a summarized read of the permissions reference
claiming MSA support; a targeted follow-up could not confirm it for
Calendars.ReadWrite.Shared specifically. Given the asymmetry — broken consent
for all personal users vs. a shared-calendar feature gap — least privilege wins.

Calendar operations therefore target calendars the account owns. The calendarId
param descriptions now say a calendar shared by another user may return 403, and
the scope list carries a comment explaining why .Shared must not be re-added.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/outlook.mdx

@@ -481,7 +481,7 @@ List Outlook calendar events within a start/end time window
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `calendarId` | string | No | ID of the calendar to read. Defaults to the mailbox default calendar. |
+| `calendarId` | string | No | ID of the calendar to read. Defaults to the mailbox default calendar. Calendars shared by another user are not supported and may return 403. |
 | `startDateTime` | string | No | Start of the time window \(ISO 8601, e.g. 2025-06-03T00:00:00-08:00\). Interpreted as UTC if no offset is given. Required unless paging with pageToken. |
 | `endDateTime` | string | No | End of the time window \(ISO 8601, e.g. 2025-06-10T00:00:00-08:00\). Interpreted as UTC if no offset is given. Required unless paging with pageToken. |
 | `maxResults` | number | No | Maximum number of events to return per page \(default: 10, max: 100\) |
@@ -565,7 +565,7 @@ Create a new Outlook calendar event
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `calendarId` | string | No | ID of the calendar to create the event in. Defaults to the default calendar. |
+| `calendarId` | string | No | ID of the calendar to create the event in. Defaults to the mailbox default calendar. Calendars shared by another user are not supported and may return 403. |
 | `subject` | string | Yes | Event subject/title |
 | `startDateTime` | string | Yes | Start time \(ISO 8601, e.g. 2025-06-03T10:00:00-08:00\). A date-only value \(2025-06-03\) for both start and end creates an all-day event. |
 | `endDateTime` | string | Yes | End time \(ISO 8601, e.g. 2025-06-03T11:00:00-08:00\). A date-only value \(2025-06-04\) for both start and end creates an all-day event. |

apps/sim/lib/oauth/oauth.ts

@@ -397,19 +397,22 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
         icon: OutlookIcon,
         baseProviderIcon: MicrosoftIcon,
         /**
-         * Calendar scopes back the Outlook calendar operations. Both are required, and
-         * neither subsumes the other:
-         * - `Calendars.ReadWrite` is the only permission Graph accepts for creating and
-         *   updating events and for accept / tentativelyAccept / decline, which document
-         *   it as least-privileged with "Higher: Not available".
-         * - `Calendars.ReadWrite.Shared` additionally covers calendars other users have
-         *   shared with (or delegated to) the account. The calendar picker lists
-         *   `/me/calendars`, which can include those, so without it selecting a shared
-         *   team calendar would 403 on read and write.
+         * `Calendars.ReadWrite` backs the Outlook calendar operations. Graph documents it
+         * as the sole accepted permission for creating and updating events and for
+         * accept / tentativelyAccept / decline ("Higher: Not available"), and it is
+         * supported for both work/school and personal Microsoft accounts.
+         *
+         * Do NOT add `Calendars.ReadWrite.Shared` here. This provider is shared by work
+         * and personal Outlook accounts, and the `.Shared` calendar scopes are not
+         * confirmed supported for personal Microsoft accounts — requesting one risks
+         * failing consent for personal users, which would take mail access down with it.
+         * That is the same reasoning that kept `findMeetingTimes` out of this integration.
+         * The consequence is that calendar operations target calendars the account owns;
+         * picking a calendar shared by another user may return 403 from Graph.
          *
          * Microsoft only grants newly-added scopes on a fresh authorization, so users who
-         * connected Outlook before these scopes existed must reconnect (re-consent) their
-         * account before the calendar operations will work.
+         * connected Outlook before `Calendars.ReadWrite` existed must reconnect
+         * (re-consent) before the calendar operations will work.
          *
          * @see https://learn.microsoft.com/en-us/graph/permissions-reference
          */
@@ -422,7 +425,6 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
           'Mail.Read',
           'Mail.Send',
           'Calendars.ReadWrite',
-          'Calendars.ReadWrite.Shared',
           'offline_access',
         ],
       },

apps/sim/lib/oauth/utils.test.ts

@@ -336,7 +336,9 @@ describe('getCanonicalScopesForProvider', () => {
     expect(outlookScopes.length).toBeGreaterThan(0)
     expect(outlookScopes).toContain('Mail.ReadWrite')
     expect(outlookScopes).toContain('Calendars.ReadWrite')
-    expect(outlookScopes).toContain('Calendars.ReadWrite.Shared')
+    // .Shared is deliberately absent: unconfirmed for personal MSA, and this provider
+    // serves personal accounts whose mail access would break if consent failed.
+    expect(outlookScopes).not.toContain('Calendars.ReadWrite.Shared')
 
     const excelScopes = getCanonicalScopesForProvider('microsoft-excel')
 
@@ -621,7 +623,7 @@ describe('getScopesForService', () => {
     expect(scopes.length).toBeGreaterThan(0)
     expect(scopes).toContain('Mail.ReadWrite')
     expect(scopes).toContain('Calendars.ReadWrite')
-    expect(scopes).toContain('Calendars.ReadWrite.Shared')
+    expect(scopes).not.toContain('Calendars.ReadWrite.Shared')
   })
 
   it.concurrent('should return empty array for empty string', () => {

apps/sim/lib/oauth/utils.ts

@@ -238,7 +238,6 @@ export const SCOPE_DESCRIPTIONS: Record<string, string> = {
   'Mail.Read': 'Read Microsoft emails',
   'Mail.Send': 'Send emails',
   'Calendars.ReadWrite': 'Read and manage Outlook calendar events',
-  'Calendars.ReadWrite.Shared': 'Read and manage shared Outlook calendars',
   'Files.Read': 'Read OneDrive files',
   'Files.ReadWrite': 'Read and write OneDrive files',
   'Tasks.ReadWrite': 'Read and manage Planner tasks',

apps/sim/tools/outlook/calendar_create_event.ts

@@ -46,7 +46,8 @@ export const outlookCalendarCreateEventTool: ToolConfig<
       type: 'string',
       required: false,
       visibility: 'user-only',
-      description: 'ID of the calendar to create the event in. Defaults to the default calendar.',
+      description:
+        'ID of the calendar to create the event in. Defaults to the mailbox default calendar. Calendars shared by another user are not supported and may return 403.',
     },
     subject: {
       type: 'string',

apps/sim/tools/outlook/calendar_list_events.ts

@@ -43,7 +43,8 @@ export const outlookCalendarListEventsTool: ToolConfig<
       type: 'string',
       required: false,
       visibility: 'user-only',
-      description: 'ID of the calendar to read. Defaults to the mailbox default calendar.',
+      description:
+        'ID of the calendar to read. Defaults to the mailbox default calendar. Calendars shared by another user are not supported and may return 403.',
     },
     // Not `required`, because a paging call supplies only `pageToken` and the window bounds
     // are baked into the nextLink. The url builder enforces "pageToken OR both bounds".