fix(search): run live Calendar service search on the crawl scope

PR #8208 widened Google Calendar's domain-wide delegation scopes to include
calendar.readonly for every service-account token. Google refuses the whole
token exchange when any requested scope is not authorized for the client, so
indexed admin-mode Calendar syncs configured for calendar.events.readonly
failed every run and were eventually disabled.

Live service search only needed the wider scope to read an all-day event's
calendar time zone. events.list returns the calendar's timeZone under
calendar.events.readonly, so live search now reads it there and delegates with
the same single scope as the indexed crawl, matching Drive and Gmail. The admin
calendar picker keeps its own calendar.readonly request, as documented.

Author: waleedlatif1

apps/docs/content/docs/search/google-calendar.mdx

@@ -22,7 +22,7 @@ https://www.googleapis.com/auth/calendar.readonly
 https://www.googleapis.com/auth/admin.directory.user.readonly
 ```
 
-`calendar.readonly` is needed for calendar metadata and the CalendarList picker; event-read scope alone is insufficient. See [CalendarList authorization](https://developers.google.com/workspace/calendar/api/v3/reference/calendarList/list).
+Search reads events with `calendar.events.readonly`. The calendar picker also needs `calendar.readonly` to list the delegated administrator's calendars. See [CalendarList authorization](https://developers.google.com/workspace/calendar/api/v3/reference/calendarList/list).
 
 3. In **Settings → Sources → Google Calendar**, choose **Service account**, then **Add connection**. Add or select the Google credential and set **Delegated administrator** to an active Workspace administrator with Directory user-read access.
 4. Select calendars, users, a date range, and optional event-text and attendee settings. Save and select this connection as the service source.
@@ -44,7 +44,7 @@ Sim does not copy the organizer's richer event details into an attendee's view o
 
 | Problem | Next step |
 | --- | --- |
-| Calendar picker or metadata read fails | Include `calendar.readonly` in delegation, along with the other scopes above. |
+| Calendar picker fails | Include `calendar.readonly` in delegation, along with the other scopes above. |
 | A member gets no matches | Check their personal connection, primary Workspace identity, Users selection, calendars, and source date window. |
 | Shared calendar is missing | Confirm both the member and delegated source identity can access that calendar ID. |
 | Event is outside the configured range | Adjust the service source's range or narrow the user's query to its allowed window. |

apps/sim/connectors/google-calendar/company-crawl.test.ts

@@ -74,10 +74,7 @@ describe('Google Calendar company crawl', () => {
       requiredScopes: ['https://www.googleapis.com/auth/calendar'],
       adminCredentialType: 'service_account',
       adminServiceAccountScopes: ['https://www.googleapis.com/auth/admin.directory.user.readonly'],
-      serviceAccountDelegationScopes: [
-        'https://www.googleapis.com/auth/calendar.events.readonly',
-        'https://www.googleapis.com/auth/calendar.readonly',
-      ],
+      serviceAccountDelegationScopes: ['https://www.googleapis.com/auth/calendar.events.readonly'],
       serviceAccountSubjectFieldId: 'adminEmail',
     })
     expect(

apps/sim/connectors/google-calendar/meta.ts

@@ -19,10 +19,7 @@ export const googleCalendarConnectorMeta: ConnectorMeta = {
     adminCredentialType: 'service_account',
     serviceAccountScopes: ['https://www.googleapis.com/auth/calendar.events.readonly'],
     adminServiceAccountScopes: ['https://www.googleapis.com/auth/admin.directory.user.readonly'],
-    serviceAccountDelegationScopes: [
-      'https://www.googleapis.com/auth/calendar.events.readonly',
-      'https://www.googleapis.com/auth/calendar.readonly',
-    ],
+    serviceAccountDelegationScopes: ['https://www.googleapis.com/auth/calendar.events.readonly'],
     serviceAccountSubjectFieldId: 'adminEmail',
   },
 

apps/sim/lib/knowledge/connectors/access-token.test.ts

@@ -461,10 +461,7 @@ describe.each([
     name: 'Google Calendar',
     auth: googleCalendarConnectorMeta.auth,
     contentScope: 'https://www.googleapis.com/auth/calendar.events.readonly',
-    delegatedScopes: [
-      'https://www.googleapis.com/auth/calendar.events.readonly',
-      'https://www.googleapis.com/auth/calendar.readonly',
-    ],
+    delegatedScopes: ['https://www.googleapis.com/auth/calendar.events.readonly'],
   },
 ])('$name declared company authentication', ({ auth, contentScope, delegatedScopes }) => {
   const directoryScope = 'https://www.googleapis.com/auth/admin.directory.user.readonly'

apps/sim/lib/sim-search/live/README.md

@@ -48,7 +48,7 @@ Selected labels are alternatives. Source date/query settings are authoritative r
 
 ### Google Calendar
 
-Member mode searches calendars accessible through the member's account. Service mode verifies the account's primary-calendar identity, Directory customer, and source user selection before delegating to that same Workspace user. Selected calendar IDs constrain retrieval and source verification; `primary` means that member's primary calendar. The admin picker browses the delegated administrator's calendar list and stores `primary` as a per-member alias. Domain-wide delegation must authorize both Calendar events read and Calendar read scopes; CalendarList requires the latter ([CalendarList authorization](https://developers.google.com/workspace/calendar/api/v3/reference/calendarList/list)).
+Member mode searches calendars accessible through the member's account. Service mode verifies the account's primary-calendar identity, Directory customer, and source user selection before delegating to that same Workspace user. Selected calendar IDs constrain retrieval and source verification; `primary` means that member's primary calendar. The admin picker browses the delegated administrator's calendar list and stores `primary` as a per-member alias. Service search delegates with only `calendar.events.readonly` (plus `admin.directory.user.readonly` for the Directory check), the same scope as the indexed crawl; all-day events take the calendar's time zone from the events list response. The picker additionally needs `calendar.readonly` ([CalendarList authorization](https://developers.google.com/workspace/calendar/api/v3/reference/calendarList/list)).
 
 Each event must exist under the source's delegated token, be in an allowed calendar, not be cancelled, and overlap the source's configured rolling time window. The existing default is 30 days before and after the request. A stable UTC-day envelope around that window is intersected with the user's date bounds in the provider query, ensuring recurring events expand and query bounds stay stable between pages. The exact rolling source window is still checked for each result. Nonoverlapping date ranges return no results; continuations spanning a UTC-day change may require a fresh search. A source search query is checked with Calendar's event search and exact event-ID matching. All-day events use the calendar's timezone. Attendee details follow the source's include-attendees setting. The member's API access still determines which event details they can see.
 

apps/sim/lib/sim-search/live/google-service.test.ts

@@ -269,6 +269,13 @@ describe('Google service source filtering', () => {
         container: 'primary',
       })
     ).toBe(true)
+    expect(delegated.json).toHaveBeenCalledWith(
+      '/calendar/v3/calendars/reader%40example.com/events',
+      {
+        query: { maxResults: '1', fields: 'timeZone' },
+      }
+    )
+    for (const [path] of delegated.json.mock.calls) expect(path).toMatch(/\/events(\/|$)/)
   })
   it('verifies twenty all-day events within the request budget and refreshes timezones next session', async () => {
     vi.setSystemTime(new Date('2026-09-22T02:00:00Z'))

apps/sim/lib/sim-search/live/google-service.ts

@@ -120,12 +120,15 @@ export async function createGoogleServiceVerifier(input: {
   }
   const calendarTimeZones = new Map<string, Promise<string>>()
   const calendarWindow = calendarSourceWindow(config, Date.now())
+  /** An events.list response carries the calendar's time zone under the crawl's events-only scope. */
   const calendarTimeZone = (subject: string, calendarId: string, client: NativeClient) => {
     const key = JSON.stringify([subject, calendarId])
     let pending = calendarTimeZones.get(key)
     if (!pending) {
       pending = client
-        .json(`/calendar/v3/calendars/${segment(calendarId)}`)
+        .json(`/calendar/v3/calendars/${segment(calendarId)}/events`, {
+          query: { maxResults: '1', fields: 'timeZone' },
+        })
         .then((row) => string(object(row).timeZone))
       calendarTimeZones.set(key, pending)
     }