id: google_calendar
name: Google Calendar
version: 1.0.0
description: "Google Calendar (Calendar API v3) — manage calendar access control lists: grant a role on a calendar to a user, group, domain or the public, and list the existing ACL rules. Service-account authentication with domain-wide delegation. Runs on a remote engine. Requires the Python 'PyJWT' and 'cryptography' libraries on the engine host (pip install pyjwt cryptography)."
changelog: "1.0.0 — Initial release: ACL rule creation and listing on user calendars."
category: productivity

# Per-instance configuration. Create a Google Cloud service account with
# domain-wide delegation, authorize the https://www.googleapis.com/auth/calendar
# scope in the Workspace admin console, and paste the service account JSON key.
# The scripts sign a JWT (RS256) with the key and exchange it for an access
# token that impersonates user_id (or a per-command user override).
config_schema:
  properties:
    service_account_json:
      type: string
      description: "Service account key JSON (full file contents) with domain-wide delegation"
      x-soar-sensitive: true
    user_id:
      type: string
      description: "Default user to impersonate (primary email address)"
  required:
    - service_account_json
    - user_id

commands:
  - id: acl_add
    name: google-calendar-acl-add
    description: "Create an access control rule on a calendar (grant a role to a user, group, domain or the public)."
    inputs_schema:
      properties:
        calendar_id: { type: string, description: "Calendar identifier — use 'primary' for the impersonated user's main calendar" }
        role: { type: string, description: "Role: none, freeBusyReader, reader, writer or owner" }
        scope_type: { type: string, description: "Grantee type: default (public), user, group or domain" }
        scope_value: { type: string, description: "Email of the user/group or domain name (omit for scope_type=default)" }
        send_notifications: { type: boolean, description: "Send notifications about the sharing change (default true)" }
        user_id: { type: string, description: "Override the impersonated user" }
      required: [calendar_id, role, scope_type]
    outputs_schema: { properties: {} }
  - id: acl_list
    name: google-calendar-acl-list
    description: "List the access control rules of a calendar."
    risk: read
    inputs_schema:
      properties:
        calendar_id: { type: string, description: "Calendar identifier — use 'primary' for the impersonated user's main calendar" }
        max_results: { type: number, description: "Maximum entries per page (default 100, max 250)" }
        page_token: { type: string, description: "Token of the results page to return" }
        show_deleted: { type: boolean, description: "Include deleted ACL rules (role 'none')" }
        sync_token: { type: string, description: "nextSyncToken from a previous listing — returns only entries changed since" }
        user_id: { type: string, description: "Override the impersonated user" }
      required: [calendar_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: google-calendar-test-connection
    description: "Verify the service account key and delegation (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }