feat(outlook): add Calendars.ReadWrite.Shared for shared calendars

The calendar picker lists /me/calendars, which can include calendars other
users have shared with or delegated to the account. Calendars.ReadWrite covers
only the user's own calendars, so selecting a shared team calendar would 403 on
both read and write.

Calendars.ReadWrite is kept alongside it, not replaced: Graph documents it as
the sole accepted permission for creating and updating events and for
accept/tentativelyAccept/decline (all list "Higher: Not available"), so the
.Shared scope does not subsume it.

Added now rather than later because this PR already forces existing Outlook
users to re-consent for Calendars.ReadWrite; deferring would cost them a second
reconnect.

Author: waleedlatif1

apps/sim/lib/oauth/oauth.ts

@@ -397,10 +397,21 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
         icon: OutlookIcon,
         baseProviderIcon: MicrosoftIcon,
         /**
-         * Calendars.ReadWrite was added to support the Outlook calendar operations.
+         * Calendar scopes back the Outlook calendar operations. Both are required, and
+         * neither subsumes the other:
+         * - `Calendars.ReadWrite` is the only permission Graph accepts for creating and
+         *   updating events and for accept / tentativelyAccept / decline, which document
+         *   it as least-privileged with "Higher: Not available".
+         * - `Calendars.ReadWrite.Shared` additionally covers calendars other users have
+         *   shared with (or delegated to) the account. The calendar picker lists
+         *   `/me/calendars`, which can include those, so without it selecting a shared
+         *   team calendar would 403 on read and write.
+         *
          * Microsoft only grants newly-added scopes on a fresh authorization, so users who
-         * connected Outlook before this scope existed must reconnect (re-consent) their
+         * connected Outlook before these scopes existed must reconnect (re-consent) their
          * account before the calendar operations will work.
+         *
+         * @see https://learn.microsoft.com/en-us/graph/permissions-reference
          */
         scopes: [
           'openid',
@@ -411,6 +422,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
           'Mail.Read',
           'Mail.Send',
           'Calendars.ReadWrite',
+          'Calendars.ReadWrite.Shared',
           'offline_access',
         ],
       },

apps/sim/lib/oauth/utils.test.ts

@@ -336,6 +336,7 @@ describe('getCanonicalScopesForProvider', () => {
     expect(outlookScopes.length).toBeGreaterThan(0)
     expect(outlookScopes).toContain('Mail.ReadWrite')
     expect(outlookScopes).toContain('Calendars.ReadWrite')
+    expect(outlookScopes).toContain('Calendars.ReadWrite.Shared')
 
     const excelScopes = getCanonicalScopesForProvider('microsoft-excel')
 
@@ -620,6 +621,7 @@ describe('getScopesForService', () => {
     expect(scopes.length).toBeGreaterThan(0)
     expect(scopes).toContain('Mail.ReadWrite')
     expect(scopes).toContain('Calendars.ReadWrite')
+    expect(scopes).toContain('Calendars.ReadWrite.Shared')
   })
 
   it.concurrent('should return empty array for empty string', () => {

apps/sim/lib/oauth/utils.ts

@@ -238,6 +238,7 @@ export const SCOPE_DESCRIPTIONS: Record<string, string> = {
   'Mail.Read': 'Read Microsoft emails',
   'Mail.Send': 'Send emails',
   'Calendars.ReadWrite': 'Read and manage Outlook calendar events',
+  'Calendars.ReadWrite.Shared': 'Read and manage shared Outlook calendars',
   'Files.Read': 'Read OneDrive files',
   'Files.ReadWrite': 'Read and write OneDrive files',
   'Tasks.ReadWrite': 'Read and manage Planner tasks',