api/schedule/availability.js checks the owner's calendar with events.list and authenticates with the calendar.readonly scope. Google's purpose-built endpoint for this is freebusy.query.
Why it is worth switching:
- Least privilege.
calendar.readonly permits downloading any calendar in full. calendar.freebusy returns only busy blocks. A leaked token would then reveal when Caleb is busy, not what with, who the attendees are, or what the events are called. Google's guidance is to choose the most narrowly focused scope available.
- Less data over the wire.
events.list returns whole event objects that get reduced to start and end times anyway.
- Correctness.
freebusy.query handles recurring events, declined invitations and all-day events the way Google itself does, rather than relying on the local expansion in getBusyTimes.
The scope and the endpoint have to change together: setting calendar.freebusy while still calling events.list returns 403 and takes availability down.
Related: #273 narrowed book.js from the full calendar scope to calendar.events for the same reason. availability.js was deliberately left alone there because it needs this endpoint change first.
Not urgent. Google Calendar credentials are not configured in production yet, so this route currently takes its no-credentials path and reads booked slots from Supabase instead.
api/schedule/availability.jschecks the owner's calendar withevents.listand authenticates with thecalendar.readonlyscope. Google's purpose-built endpoint for this isfreebusy.query.Why it is worth switching:
calendar.readonlypermits downloading any calendar in full.calendar.freebusyreturns only busy blocks. A leaked token would then reveal when Caleb is busy, not what with, who the attendees are, or what the events are called. Google's guidance is to choose the most narrowly focused scope available.events.listreturns whole event objects that get reduced to start and end times anyway.freebusy.queryhandles recurring events, declined invitations and all-day events the way Google itself does, rather than relying on the local expansion ingetBusyTimes.The scope and the endpoint have to change together: setting
calendar.freebusywhile still callingevents.listreturns 403 and takes availability down.Related: #273 narrowed
book.jsfrom the fullcalendarscope tocalendar.eventsfor the same reason.availability.jswas deliberately left alone there because it needs this endpoint change first.Not urgent. Google Calendar credentials are not configured in production yet, so this route currently takes its no-credentials path and reads booked slots from Supabase instead.