---
phase: 03-calendar-integration
plan: 04
type: execute
wave: 1
depends_on: []
files_modified: 
  - src/app/api/calendar/google/oauth/route.ts
  - src/app/api/calendar/apple/oauth/route.ts
  - src/lib/google-calendar.ts
  - src/lib/apple-calendar.ts
  - src/lib/calendar-sync.ts
  - prisma/schema.prisma
autonomous: true
gap_closure: true

must_haves:
  truths:
    - "User can connect their Google Calendar account"
    - "User can connect their Apple Calendar account" 
    - "User can view calendar events alongside tasks in weekly view"
    - "User can manage calendar connection settings from the application"
    - "User's tasks and calendar events are synchronized bidirectionally"
  artifacts:
    - path: "src/app/api/calendar/google/oauth/route.ts"
      provides: "Real Google API token exchange implementation"
    - path: "src/app/api/calendar/apple/oauth/route.ts" 
      provides: "Real Apple API token exchange implementation"
    - path: "src/lib/google-calendar.ts"
      provides: "Real Google Calendar API integration"
    - path: "src/lib/apple-calendar.ts"
      provides: "Real Apple Calendar API integration"
    - path: "src/lib/calendar-sync.ts"
      provides: "Complete bidirectional sync implementation" 
    - path: "prisma/schema.prisma"
      provides: "CalendarConnection model with all necessary fields"
  key_links:
    - from: "src/app/api/calendar/google/oauth/route.ts"
      to: "src/lib/google-calendar.ts"
      via: "token exchange via initializeOAuth function"
      pattern: "initializeOAuth.*google"
    - from: "src/app/api/calendar/apple/oauth/route.ts"
      to: "src/lib/apple-calendar.ts"
      via: "token exchange via initializeOAuth function" 
      pattern: "initializeOAuth.*apple"
    - from: "src/lib/calendar-sync.ts"
      to: "prisma/calendarConnection"
      via: "database operations for storing tokens"  
      pattern: "prisma\\.calendarConnection"
---

# Gap Closure: Calendar OAuth Implementation

## Objective
Fix incomplete Google and Apple Calendar OAuth implementations to enable real calendar account connections.

## Purpose
Enable users to securely connect their Google and Apple Calendar accounts through proper OAuth flows.

## Output
Functional OAuth endpoints that exchange authorization codes for real tokens and store them securely in the database.

## Tasks

<task type="auto">
  <name>Fix Google OAuth Callback with Real Token Exchange</name>
  <files>src/app/api/calendar/google/oauth/route.ts</files>
  <action>
    Replace the current placeholder implementation with a real token exchange:
    
    1. Remove hardcoded mock tokens from the implementation
    2. Implement real API call to exchange the authorization code for access and refresh tokens using the Google OAuth2 API
    3. Store valid tokens in the database using Prisma ORM instead of console logging
    4. Add proper error handling for token exchange failures with informative messages
    5. Implement token validation to ensure they're valid before saving
    
    The implementation should:
    - Call the Google OAuth2 token endpoint with the authorization code
    - Handle successful token exchange results
    - Handle and log token exchange errors appropriately  
    - Store the tokens in the CalendarConnection database record
  </action>
  <verify>Run `curl -X GET "http://localhost:3000/api/calendar/google/oauth?code=valid_code"` and verify tokens are stored in database instead of just console logged</verify>
  <done>Google OAuth callback endpoint exchanges real tokens and stores them in database</done>
</task>

<task type="auto">
  <name>Fix Apple OAuth Callback with Real Token Exchange</name>
  <files>src/app/api/calendar/apple/oauth/route.ts</files>
  <action>
    Replace the current placeholder implementation with a real token exchange:
    
    1. Remove hardcoded mock tokens from the implementation
    2. Implement real API call to exchange the authorization code for access and refresh tokens using Apple's OAuth2 API
    3. Store valid tokens in the database using Prisma ORM instead of console logging
    4. Add proper error handling for token exchange failures with informative messages
    5. Implement token validation to ensure they're valid before saving
    
    The implementation should:
    - Make a POST request to Apple's token endpoint with code, client_id, client_secret, and redirect_uri
    - Handle successful token exchange results
    - Handle and log token exchange errors appropriately
    - Store the tokens in the CalendarConnection database record
  </action>
  <verify>Run `curl -X GET "http://localhost:3000/api/calendar/apple/oauth?code=valid_code"` and verify tokens are stored in database instead of just console logged</verify>
  <done>Apple OAuth callback endpoint exchanges real tokens and stores them in database</done>
</task>

<task type="auto">
  <name>Implement Database Storage for OAuth Tokens</name>
  <files>prisma/schema.prisma</files>
  <action>
    Update the CalendarConnection model to include necessary fields for storing OAuth tokens properly:
    
    1. Ensure the model has all required fields for storing tokens (access_token, refresh_token, expires_at)
    2. Add proper database constraints and validations
    3. Ensure relationships with User model are properly defined
    
    Currently, we have proper fields, but we need to make sure:
    - The model properly supports both Google and Apple token formats
    - Fields are properly indexed for performance
    - The relationship with User is correctly defined
  </action>
  <verify>Check that prisma/schema.prisma defines CalendarConnection model with userId, provider, accessToken, refreshToken, expiresAt fields</verify>
  <done>CalendarConnection model properly defined with all required fields for OAuth token storage</done>
</task>
</tasks>

## Verification

After completing these tasks, the following checks should pass:
- Google OAuth callback exchanges real tokens instead of using placeholders
- Apple OAuth callback exchanges real tokens instead of using placeholders  
- OAuth tokens are stored in the database properly instead of just logged
- All error cases have proper handling and reporting

## Success Criteria

All gaps identified in the VERIFICATION.md for Google and Apple OAuth implementations are resolved:
- OAuth endpoints use real API token exchange instead of placeholder implementations
- OAuth tokens are securely stored in the database
- Proper error handling for token exchange failures