fix(search): run live Calendar service search on the crawl scope

PR #8208 widened Google Calendar's domain-wide delegation scopes to include
calendar.readonly for every service-account token. Google refuses the whole
token exchange when any requested scope is not authorized for the client, so
indexed admin-mode Calendar syncs configured for calendar.events.readonly
failed every run and were eventually disabled.

Live service search only needed the wider scope to read an all-day event's
calendar time zone. events.list returns the calendar's timeZone under
calendar.events.readonly, so live search now reads it there and runs on the
same single scope as indexing; save-time validation therefore covers live
sources too.

The admin calendar picker impersonates with calendar.calendarlist.readonly and
resolves names from the admin's calendar list. When Google refuses a delegated
token, the picker, save-time validation, and live search share one message
that names the scopes an administrator must authorize, and a delegated 401/403
in service mode no longer tells the member to reconnect their own account.

Author: waleedlatif1

apps/docs/content/docs/search/google-calendar.mdx

@@ -18,11 +18,11 @@ Connecting does not ingest events or build permission records. Changes appear ac
 
 ```text
 https://www.googleapis.com/auth/calendar.events.readonly
-https://www.googleapis.com/auth/calendar.readonly
+https://www.googleapis.com/auth/calendar.calendarlist.readonly
 https://www.googleapis.com/auth/admin.directory.user.readonly
 ```
 
-`calendar.readonly` is needed for calendar metadata and the CalendarList picker; event-read scope alone is insufficient. See [CalendarList authorization](https://developers.google.com/workspace/calendar/api/v3/reference/calendarList/list).
+Search reads events with `calendar.events.readonly`. The calendar picker also needs `calendar.calendarlist.readonly` to list the delegated administrator's calendars. See [CalendarList authorization](https://developers.google.com/workspace/calendar/api/v3/reference/calendarList/list).
 
 3. In **Settings → Sources → Google Calendar**, choose **Service account**, then **Add connection**. Add or select the Google credential and set **Delegated administrator** to an active Workspace administrator with Directory user-read access.
 4. Select calendars, users, a date range, and optional event-text and attendee settings. Save and select this connection as the service source.
@@ -44,7 +44,7 @@ Sim does not copy the organizer's richer event details into an attendee's view o
 
 | Problem | Next step |
 | --- | --- |
-| Calendar picker or metadata read fails | Include `calendar.readonly` in delegation, along with the other scopes above. |
+| Calendar picker fails | Include `calendar.calendarlist.readonly` in delegation, along with the other scopes above. |
 | A member gets no matches | Check their personal connection, primary Workspace identity, Users selection, calendars, and source date window. |
 | Shared calendar is missing | Confirm both the member and delegated source identity can access that calendar ID. |
 | Event is outside the configured range | Adjust the service source's range or narrow the user's query to its allowed window. |

apps/docs/content/docs/search/google-drive.mdx

@@ -53,7 +53,7 @@ One JSON key can be used for all three service sources. Enable Drive, Gmail, Cal
 https://www.googleapis.com/auth/drive.readonly
 https://www.googleapis.com/auth/gmail.readonly
 https://www.googleapis.com/auth/calendar.events.readonly
-https://www.googleapis.com/auth/calendar.readonly
+https://www.googleapis.com/auth/calendar.calendarlist.readonly
 https://www.googleapis.com/auth/admin.directory.user.readonly
 https://www.googleapis.com/auth/admin.directory.group.readonly
 https://www.googleapis.com/auth/admin.directory.domain.readonly

apps/sim/connectors/google-calendar/company-crawl.test.ts

@@ -74,10 +74,7 @@ describe('Google Calendar company crawl', () => {
       requiredScopes: ['https://www.googleapis.com/auth/calendar'],
       adminCredentialType: 'service_account',
       adminServiceAccountScopes: ['https://www.googleapis.com/auth/admin.directory.user.readonly'],
-      serviceAccountDelegationScopes: [
-        'https://www.googleapis.com/auth/calendar.events.readonly',
-        'https://www.googleapis.com/auth/calendar.readonly',
-      ],
+      serviceAccountDelegationScopes: ['https://www.googleapis.com/auth/calendar.events.readonly'],
       serviceAccountSubjectFieldId: 'adminEmail',
     })
     expect(

apps/sim/connectors/google-calendar/meta.ts

@@ -19,10 +19,7 @@ export const googleCalendarConnectorMeta: ConnectorMeta = {
     adminCredentialType: 'service_account',
     serviceAccountScopes: ['https://www.googleapis.com/auth/calendar.events.readonly'],
     adminServiceAccountScopes: ['https://www.googleapis.com/auth/admin.directory.user.readonly'],
-    serviceAccountDelegationScopes: [
-      'https://www.googleapis.com/auth/calendar.events.readonly',
-      'https://www.googleapis.com/auth/calendar.readonly',
-    ],
+    serviceAccountDelegationScopes: ['https://www.googleapis.com/auth/calendar.events.readonly'],
     serviceAccountSubjectFieldId: 'adminEmail',
   },
 

apps/sim/lib/knowledge/application/connectors.test.ts

@@ -112,15 +112,6 @@ vi.mock('@/lib/credentials/application/organization-credentials', () => ({
 }))
 
 vi.mock('@/lib/oauth/credential-service', () => ({
-  ServiceAccountTokenError: class extends Error {
-    constructor(
-      readonly statusCode: number,
-      readonly errorDescription: string,
-      readonly errorCode?: string
-    ) {
-      super(errorDescription)
-    }
-  },
   resolveCredentialTokenBundle: mocks.resolveTokenBundle,
   resolveOAuthAccountId: vi.fn(async () => null),
   getServiceAccountToken: vi.fn(),
@@ -185,12 +176,9 @@ import {
 import type { ConnectorAccessToken } from '@/lib/knowledge/connectors/access-token'
 import { MAX_KNOWLEDGE_CONNECTOR_DOCUMENT_SEARCH_LENGTH } from '@/lib/knowledge/constants'
 import { classifyKnowledgeFailure } from '@/lib/knowledge/orchestration/shared'
-import {
-  getServiceAccountToken,
-  resolveOAuthAccountId,
-  ServiceAccountTokenError,
-} from '@/lib/oauth/credential-service'
+import { getServiceAccountToken, resolveOAuthAccountId } from '@/lib/oauth/credential-service'
 import * as githubInstallation from '@/lib/oauth/github-installation'
+import { ServiceAccountTokenError } from '@/lib/oauth/service-account-token-error'
 import { capabilityRefusal } from '@/lib/permission-groups/capability-assertions'
 import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/lib/permission-groups/fields'
 import { confluenceConnectorMeta } from '@/connectors/confluence/meta'

apps/sim/lib/knowledge/application/connectors.ts

@@ -113,7 +113,7 @@ import { requireOrganizationSearchApproval } from '@/lib/knowledge/search/integr
 import { escapeLikePattern } from '@/lib/knowledge/tags/utils'
 import { isMemberSyncStatus } from '@/lib/knowledge/types'
 import { credentialProviderMatchesService, type ServiceProviderIdentity } from '@/lib/oauth'
-import { ServiceAccountTokenError } from '@/lib/oauth/credential-service'
+import { describeServiceAccountTokenError } from '@/lib/oauth/service-account-token-error'
 import { CAPABILITY_RULES, refuseCapability } from '@/lib/permission-groups/capabilities'
 import { resolvePermissionGroupConfig } from '@/lib/permission-groups/config-scope.server'
 import { getUserPermissionConfigForOrganization } from '@/lib/permission-groups/resolve.server'
@@ -341,30 +341,8 @@ export async function resolveConnectorCredentialAccessToken(input: {
 
 /** Exposes actionable credential refusals without returning raw provider payloads. */
 function rethrowConnectorCredentialError(error: unknown): never {
-  if (error instanceof ServiceAccountTokenError && [400, 401, 403].includes(error.statusCode)) {
-    let message: string
-    switch (error.errorCode) {
-      case 'unauthorized_client':
-        message =
-          "Google rejected service-account authorization (unauthorized_client). In Google Admin, authorize the JSON key's numeric client ID with the exact domain-wide delegation scopes in this connector's service-account setup section. Verify the delegated user's Workspace email and allow time for recent delegation changes to propagate."
-        break
-      case 'invalid_grant':
-        message =
-          "Google rejected the service-account grant (invalid_grant). Check that the JSON key is valid and the delegated user's primary Workspace email is correct."
-        break
-      case 'invalid_scope':
-        message =
-          "Google rejected the service-account scopes (invalid_scope). In Google Admin, authorize the exact domain-wide delegation scopes in this connector's service-account setup section."
-        break
-      case 'access_denied':
-        message =
-          'Google denied service-account access (access_denied). Ask your Workspace administrator to check API access policies and domain-wide delegation.'
-        break
-      default:
-        throw error
-    }
-    throw new OrchestrationError('validation', message)
-  }
+  const message = describeServiceAccountTokenError(error)
+  if (message) throw new OrchestrationError('validation', message)
   rethrowGitHubInstallationSourceError(error)
 }
 

apps/sim/lib/knowledge/connectors/access-token.test.ts

@@ -461,10 +461,7 @@ describe.each([
     name: 'Google Calendar',
     auth: googleCalendarConnectorMeta.auth,
     contentScope: 'https://www.googleapis.com/auth/calendar.events.readonly',
-    delegatedScopes: [
-      'https://www.googleapis.com/auth/calendar.events.readonly',
-      'https://www.googleapis.com/auth/calendar.readonly',
-    ],
+    delegatedScopes: ['https://www.googleapis.com/auth/calendar.events.readonly'],
   },
 ])('$name declared company authentication', ({ auth, contentScope, delegatedScopes }) => {
   const directoryScope = 'https://www.googleapis.com/auth/admin.directory.user.readonly'

apps/sim/lib/oauth/credential-service.test.ts

@@ -83,11 +83,11 @@ import {
   refreshTokenIfNeeded,
   resolveCredentialTokenBundle,
   resolveServiceAccountToken,
-  ServiceAccountTokenError,
 } from '@/lib/oauth/credential-service'
 import { isInstagramProvider, shouldProactivelyRefreshInstagramToken } from '@/lib/oauth/instagram'
 import { isMicrosoftProvider } from '@/lib/oauth/microsoft'
 import { getOAuthRefreshCoordinationIdentity } from '@/lib/oauth/refresh-coordination'
+import { ServiceAccountTokenError } from '@/lib/oauth/service-account-token-error'
 import { fanOutSlackTokenChain } from '@/lib/oauth/slack'
 import { isTerminalRefreshError, markCredentialDead } from '@/lib/oauth/terminal-errors'
 import { GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
@@ -825,7 +825,7 @@ describe('Google service-account token minting', () => {
     expect(JSON.stringify(mocks.logger.error.mock.calls)).not.toContain(RAW_PROVIDER_ERROR)
   })
 
-  it('keeps token errors private for selectors', async () => {
+  it('keeps token error details private for selectors while retaining the documented code', async () => {
     queueTableRows(credential, [row])
     fetchMock.mockResolvedValueOnce(
       Response.json(
@@ -839,7 +839,7 @@ describe('Google service-account token minting', () => {
       })
     ).rejects.toMatchObject({
       statusCode: 401,
-      errorCode: undefined,
+      errorCode: 'unauthorized_client',
       errorDescription: 'Token exchange failed: 401',
     })
     expect(JSON.stringify(mocks.logger.error.mock.calls)).not.toContain(RAW_PROVIDER_ERROR)

apps/sim/lib/oauth/credential-service.ts

@@ -39,6 +39,7 @@ import {
 import { refreshOAuthToken, TOKEN_REFRESH_TIMEOUT_MS } from '@/lib/oauth/oauth'
 import { decryptQuickBooksOAuthClientConfig } from '@/lib/oauth/quickbooks-client-config'
 import { getOAuthRefreshCoordinationIdentity } from '@/lib/oauth/refresh-coordination'
+import { ServiceAccountTokenError } from '@/lib/oauth/service-account-token-error'
 import {
   extractSlackTeamId,
   fanOutSlackTokenChain,
@@ -87,17 +88,6 @@ function privateCredentialIdentity(namespace: string, value: string): string {
     .digest('base64url')
 }
 
-export class ServiceAccountTokenError extends Error {
-  constructor(
-    public readonly statusCode: number,
-    public readonly errorDescription: string,
-    public readonly errorCode?: string
-  ) {
-    super(errorDescription)
-    this.name = 'ServiceAccountTokenError'
-  }
-}
-
 interface AccountInsertData {
   id: string
   userId: string
@@ -305,29 +295,32 @@ export async function getServiceAccountToken(
     const errorBody = response.body
     let description = `Token exchange failed: ${response.status}`
     let errorCode: string | undefined
-    if (options?.privacyMode !== 'selector') {
-      try {
-        const parsed: unknown = JSON.parse(errorBody)
-        if (typeof parsed === 'object' && parsed !== null) {
-          if ('error' in parsed && typeof parsed.error === 'string') {
-            errorCode = parsed.error
-          }
-          if (
-            'error_description' in parsed &&
-            typeof parsed.error_description === 'string' &&
-            parsed.error_description.length > 0
-          ) {
-            const raw = parsed.error_description
-            if (raw.includes('SignatureException') || raw.includes('Invalid signature')) {
-              description = 'Invalid account credentials.'
-            } else {
-              description = raw
-            }
+    try {
+      const parsed: unknown = JSON.parse(errorBody)
+      if (typeof parsed === 'object' && parsed !== null) {
+        if (
+          'error' in parsed &&
+          typeof parsed.error === 'string' &&
+          (options?.privacyMode !== 'selector' || SA_DIAGNOSTIC_ERROR_CODES.has(parsed.error))
+        ) {
+          errorCode = parsed.error
+        }
+        if (
+          options?.privacyMode !== 'selector' &&
+          'error_description' in parsed &&
+          typeof parsed.error_description === 'string' &&
+          parsed.error_description.length > 0
+        ) {
+          const raw = parsed.error_description
+          if (raw.includes('SignatureException') || raw.includes('Invalid signature')) {
+            description = 'Invalid account credentials.'
+          } else {
+            description = raw
           }
         }
-      } catch {
-        /** Retain the status-based description when Google returns a non-JSON error. */
       }
+    } catch {
+      /** Retain the status-based description when Google returns a non-JSON error. */
     }
     logger.error('Service account token exchange failed', {
       status: response.status,

apps/sim/lib/oauth/service-account-token-error.ts

@@ -0,0 +1,40 @@
+/** A refused Google service-account JWT token exchange, with Google's OAuth error code when known. */
+export class ServiceAccountTokenError extends Error {
+  constructor(
+    public readonly statusCode: number,
+    public readonly errorDescription: string,
+    public readonly errorCode?: string
+  ) {
+    super(errorDescription)
+    this.name = 'ServiceAccountTokenError'
+  }
+}
+
+/**
+ * The admin action for a refused Google service-account token exchange, or
+ * `null` when the error is not one. Names `scopes` as the domain-wide
+ * delegation scopes to authorize when given; otherwise points at the
+ * connector's setup section.
+ */
+export function describeServiceAccountTokenError(
+  error: unknown,
+  scopes?: readonly string[]
+): string | null {
+  if (!(error instanceof ServiceAccountTokenError) || ![400, 401, 403].includes(error.statusCode))
+    return null
+  const delegationScopes = scopes?.length
+    ? `these domain-wide delegation scopes: ${scopes.join(', ')}`
+    : "the exact domain-wide delegation scopes in this connector's service-account setup section"
+  switch (error.errorCode) {
+    case 'unauthorized_client':
+      return `Google rejected service-account authorization (unauthorized_client). In Google Admin, authorize the JSON key's numeric client ID with ${delegationScopes}. Verify the delegated user's Workspace email and allow time for recent delegation changes to propagate.`
+    case 'invalid_grant':
+      return "Google rejected the service-account grant (invalid_grant). Check that the JSON key is valid and the delegated user's primary Workspace email is correct."
+    case 'invalid_scope':
+      return `Google rejected the service-account scopes (invalid_scope). In Google Admin, authorize ${delegationScopes}.`
+    case 'access_denied':
+      return 'Google denied service-account access (access_denied). Ask your Workspace administrator to check API access policies and domain-wide delegation.'
+    default:
+      return null
+  }
+}