refactor: consolidate calendar-provider crypto + OAuth token-refresh persistence

The three calendar-token providers (Google, Microsoft, CalDAV) plus Zoom each
hand-rolled their own AES-GCM crypto and OAuth-refresh-persistence wrapper —
built at different times, never consolidated even after a shared crypto package
existed. microsoft.go's own doc comment flagged this as intentional-for-now tech
debt ("a future cleanup can extract a shared calendar token store"). This is
that cleanup's first two pieces.

Crypto: verified byte-for-byte identical algorithm across all three providers
(AES-256-GCM, nonce prepended to ciphertext, base64.StdEncoding) before touching
anything — Zoom already correctly delegates to internal/secret; gcal/microsoft/
caldav's `encrypt`/`decrypt` methods (the token/credential storage path) now
delegate to it too, so existing stored tokens keep decrypting unchanged. Their
`encryptEncoding`/`decryptEncoding` (URLEncoding, used only for OAuth CSRF
state) are untouched — secret.Encrypt/Decrypt doesn't cover that encoding.
Verified via each provider's own encrypt/decrypt round-trip tests, which
exercise exactly this path and all still pass.

OAuth refresh persistence: gcal, microsoft, and zoom each defined an identical
struct — wrap an oauth2.TokenSource, compare AccessToken to the last-seen value,
and on change spin up a 10s context and persist the new token, logging on
failure. New internal/oauthstore.SavingTokenSource is the one implementation,
parameterized by a Save closure so each provider still calls its own saveToken
with its own identifiers (gcal/microsoft need calID+accountEmail; microsoft
additionally passes kind="" on refresh to preserve account_kind; zoom needs
neither). Added direct unit tests for the new package (saves-on-first-token,
skips-resave-when-unchanged, resaves-on-refresh, save-error-doesn't-fail-Token,
inner-error-propagates) since it's genuinely new shared code, not just moved.

Connection-loading/upsert (the third, most complex piece the same audit
finding named) is intentionally left for a follow-up — it has more business-
logic subtlety (the "claim destination only if none exists yet" rule) that's
worth its own careful pass rather than bundling into this one.

Verified: go build/vet, full test suite (including all three providers' own
suites) — all pass unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: shockalotti

internal/caldav/caldav.go

@@ -26,6 +26,7 @@ import (
 	"time"
 
 	"github.com/calnode/calnode/internal/calendar"
+	"github.com/calnode/calnode/internal/secret"
 	"github.com/calnode/calnode/internal/uid"
 )
 
@@ -259,14 +260,20 @@ func (c *Client) saveConnection(ctx context.Context, userID, accountEmail, passw
 	return tx.Commit()
 }
 
-// ----- AES-GCM helpers (same scheme as gcal/microsoft) -----
+// ----- AES-GCM helpers -----
 
+// encrypt/decrypt (credential storage, StdEncoding) delegate to the shared
+// internal/secret package — same AES-256-GCM/nonce-prepended/base64.StdEncoding
+// scheme, so existing stored credentials keep decrypting unchanged.
+// encryptEncoding/decryptEncoding below remain for EncryptState/DecryptState
+// (OAuth CSRF state, base64.URLEncoding), which secret.Encrypt/Decrypt doesn't support.
 func (c *Client) encrypt(plaintext []byte) (string, error) {
-	return c.encryptEncoding(plaintext, base64.StdEncoding)
+	return secret.Encrypt(c.key, string(plaintext))
 }
 
 func (c *Client) decrypt(ciphertext string) ([]byte, error) {
-	return c.decryptEncoding(ciphertext, base64.StdEncoding)
+	s, err := secret.Decrypt(c.key, ciphertext)
+	return []byte(s), err
 }
 
 func (c *Client) encryptEncoding(plaintext []byte, enc *base64.Encoding) (string, error) {

internal/calendar/microsoft/microsoft.go

@@ -1,9 +1,8 @@
 // Package microsoft implements calendar.Provider for Microsoft 365 / Outlook via
-// the Microsoft Graph API. It mirrors the structure of internal/gcal.
-//
-// NOTE: the token store + AES helpers below intentionally mirror internal/gcal.
-// A future cleanup can extract a shared calendar token store; kept separate here
-// to avoid destabilising the working Google path while adding Graph.
+// the Microsoft Graph API. It mirrors the structure of internal/gcal — both share
+// the internal/secret crypto helpers and the internal/oauthstore refresh-persistence
+// wrapper; the connection-loading/upsert flow is still separate per-provider (see
+// saveToken, loadConn below).
 package microsoft
 
 import (
@@ -26,6 +25,8 @@ import (
 	"golang.org/x/oauth2/microsoft"
 
 	"github.com/calnode/calnode/internal/calendar"
+	"github.com/calnode/calnode/internal/oauthstore"
+	"github.com/calnode/calnode/internal/secret"
 	"github.com/calnode/calnode/internal/uid"
 )
 
@@ -223,12 +224,15 @@ func (c *Client) buildClient(ctx context.Context, userID, accessEnc, refreshEnc,
 		expiry = time.Now().Add(-time.Second) // force refresh of a stale/unknown token
 	}
 	tok := &oauth2.Token{AccessToken: string(access), RefreshToken: refresh, Expiry: expiry}
-	saving := &savingTokenSource{
-		inner:        oauth2.ReuseTokenSource(nil, c.config.TokenSource(ctx, tok)),
-		client:       c,
-		userID:       userID,
-		calID:        calID,
-		accountEmail: accountEmail,
+	saving := &oauthstore.SavingTokenSource{
+		Inner: oauth2.ReuseTokenSource(nil, c.config.TokenSource(ctx, tok)),
+		// kind="" → preserve the account_kind + flags already stored (refresh has no id_token).
+		Save: func(ctx context.Context, t *oauth2.Token) error {
+			return c.saveToken(ctx, userID, calID, accountEmail, "", t)
+		},
+		Logger: c.logger,
+		LogMsg: "microsoft: failed to persist refreshed token",
+		UserID: userID,
 	}
 	return oauth2.NewClient(ctx, saving), nil
 }
@@ -370,41 +374,20 @@ func (c *Client) saveToken(ctx context.Context, userID, calID, accountEmail, kin
 	return tx.Commit()
 }
 
-// savingTokenSource persists refreshed tokens to the DB when the access token changes.
-type savingTokenSource struct {
-	inner        oauth2.TokenSource
-	client       *Client
-	userID       string
-	calID        string
-	accountEmail string
-	last         string
-}
-
-func (s *savingTokenSource) Token() (*oauth2.Token, error) {
-	tok, err := s.inner.Token()
-	if err != nil {
-		return nil, err
-	}
-	if tok.AccessToken != s.last {
-		s.last = tok.AccessToken
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer cancel()
-		// kind="" → preserve the account_kind + flags already stored (refresh has no id_token).
-		if err := s.client.saveToken(ctx, s.userID, s.calID, s.accountEmail, "", tok); err != nil {
-			s.client.logger.Error("microsoft: failed to persist refreshed token", "error", err, "user_id", s.userID)
-		}
-	}
-	return tok, nil
-}
-
-// ----- AES-GCM helpers (mirror internal/gcal) -----
+// ----- AES-GCM helpers -----
 
+// encrypt/decrypt (token storage, StdEncoding) delegate to the shared internal/secret
+// package — same AES-256-GCM/nonce-prepended/base64.StdEncoding scheme, so existing
+// stored tokens keep decrypting unchanged. encryptEncoding/decryptEncoding below are
+// kept only for EncryptState/DecryptState (OAuth CSRF state, base64.URLEncoding),
+// which secret.Encrypt/Decrypt doesn't support.
 func (c *Client) encrypt(plaintext []byte) (string, error) {
-	return c.encryptEncoding(plaintext, base64.StdEncoding)
+	return secret.Encrypt(c.key, string(plaintext))
 }
 
 func (c *Client) decrypt(ciphertext string) ([]byte, error) {
-	return c.decryptEncoding(ciphertext, base64.StdEncoding)
+	s, err := secret.Decrypt(c.key, ciphertext)
+	return []byte(s), err
 }
 
 func (c *Client) encryptEncoding(plaintext []byte, enc *base64.Encoding) (string, error) {

internal/gcal/gcal.go

@@ -19,6 +19,8 @@ import (
 	"golang.org/x/oauth2/google"
 
 	"github.com/calnode/calnode/internal/calendar"
+	"github.com/calnode/calnode/internal/oauthstore"
+	"github.com/calnode/calnode/internal/secret"
 	"github.com/calnode/calnode/internal/uid"
 )
 
@@ -166,12 +168,14 @@ func (c *Client) buildClient(ctx context.Context, userID, accessEnc, refreshEnc,
 		expiry = time.Now().Add(-time.Second)
 	}
 	tok := &oauth2.Token{AccessToken: string(access), RefreshToken: refresh, Expiry: expiry}
-	saving := &savingTokenSource{
-		inner:        oauth2.ReuseTokenSource(nil, c.config.TokenSource(ctx, tok)),
-		client:       c,
-		userID:       userID,
-		calID:        calID,
-		accountEmail: accountEmail,
+	saving := &oauthstore.SavingTokenSource{
+		Inner: oauth2.ReuseTokenSource(nil, c.config.TokenSource(ctx, tok)),
+		Save: func(ctx context.Context, t *oauth2.Token) error {
+			return c.saveToken(ctx, userID, calID, accountEmail, t)
+		},
+		Logger: c.logger,
+		LogMsg: "gcal: failed to persist refreshed token",
+		UserID: userID,
 	}
 	return oauth2.NewClient(ctx, saving), nil
 }
@@ -343,41 +347,20 @@ func (c *Client) saveToken(ctx context.Context, userID, calID, accountEmail stri
 	return tx.Commit()
 }
 
-// savingTokenSource wraps oauth2.TokenSource and persists new tokens to the DB
-// whenever the access token changes (i.e. after a refresh).
-type savingTokenSource struct {
-	inner        oauth2.TokenSource
-	client       *Client
-	userID       string
-	calID        string
-	accountEmail string
-	last         string
-}
-
-func (s *savingTokenSource) Token() (*oauth2.Token, error) {
-	tok, err := s.inner.Token()
-	if err != nil {
-		return nil, err
-	}
-	if tok.AccessToken != s.last {
-		s.last = tok.AccessToken
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer cancel()
-		if err := s.client.saveToken(ctx, s.userID, s.calID, s.accountEmail, tok); err != nil {
-			s.client.logger.Error("gcal: failed to persist refreshed token", "error", err, "user_id", s.userID)
-		}
-	}
-	return tok, nil
-}
-
 // ----- AES-GCM helpers -----
 
+// encrypt/decrypt (token storage, StdEncoding) delegate to the shared internal/secret
+// package — same AES-256-GCM/nonce-prepended/base64.StdEncoding scheme, so existing
+// stored tokens keep decrypting unchanged. encryptEncoding/decryptEncoding below are
+// kept only for EncryptState/DecryptState (OAuth CSRF state, base64.URLEncoding),
+// which secret.Encrypt/Decrypt doesn't support.
 func (c *Client) encrypt(plaintext []byte) (string, error) {
-	return c.encryptEncoding(plaintext, base64.StdEncoding)
+	return secret.Encrypt(c.key, string(plaintext))
 }
 
 func (c *Client) decrypt(ciphertext string) ([]byte, error) {
-	return c.decryptEncoding(ciphertext, base64.StdEncoding)
+	s, err := secret.Decrypt(c.key, ciphertext)
+	return []byte(s), err
 }
 
 func (c *Client) encryptEncoding(plaintext []byte, enc *base64.Encoding) (string, error) {

internal/oauthstore/oauthstore.go

@@ -0,0 +1,46 @@
+// Package oauthstore holds small pieces shared by every OAuth-based calendar/meeting
+// integration (Google Calendar, Microsoft Graph, Zoom) so their token-refresh
+// persistence doesn't get re-derived from scratch per provider.
+package oauthstore
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"golang.org/x/oauth2"
+)
+
+// SaveFunc persists a refreshed token. Providers close over their own identifiers
+// (user ID, plus calendar ID / account email where relevant) and call their own
+// saveToken/saveConnection.
+type SaveFunc func(ctx context.Context, tok *oauth2.Token) error
+
+// SavingTokenSource wraps an oauth2.TokenSource and calls Save whenever the access
+// token actually changes (i.e. after a refresh) — every provider needs exactly this,
+// differing only in what Save does with the new token.
+type SavingTokenSource struct {
+	Inner  oauth2.TokenSource
+	Save   SaveFunc
+	Logger *slog.Logger
+	LogMsg string // e.g. "gcal: failed to persist refreshed token"
+	UserID string // log context only
+
+	last string
+}
+
+func (s *SavingTokenSource) Token() (*oauth2.Token, error) {
+	tok, err := s.Inner.Token()
+	if err != nil {
+		return nil, err
+	}
+	if tok.AccessToken != s.last {
+		s.last = tok.AccessToken
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		if err := s.Save(ctx, tok); err != nil {
+			s.Logger.Error(s.LogMsg, "error", err, "user_id", s.UserID)
+		}
+	}
+	return tok, nil
+}

internal/oauthstore/oauthstore_test.go

@@ -0,0 +1,108 @@
+package oauthstore
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"testing"
+
+	"golang.org/x/oauth2"
+)
+
+type fakeTokenSource struct {
+	tok *oauth2.Token
+	err error
+}
+
+func (f *fakeTokenSource) Token() (*oauth2.Token, error) { return f.tok, f.err }
+
+func testLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func TestSavingTokenSource_savesOnFirstToken(t *testing.T) {
+	var saved *oauth2.Token
+	s := &SavingTokenSource{
+		Inner:  &fakeTokenSource{tok: &oauth2.Token{AccessToken: "a1"}},
+		Save:   func(ctx context.Context, tok *oauth2.Token) error { saved = tok; return nil },
+		Logger: testLogger(),
+	}
+	tok, err := s.Token()
+	if err != nil {
+		t.Fatalf("Token() error: %v", err)
+	}
+	if tok.AccessToken != "a1" {
+		t.Errorf("AccessToken = %q; want a1", tok.AccessToken)
+	}
+	if saved == nil || saved.AccessToken != "a1" {
+		t.Error("Save was not called with the new token")
+	}
+}
+
+func TestSavingTokenSource_doesNotResaveUnchangedToken(t *testing.T) {
+	calls := 0
+	inner := &fakeTokenSource{tok: &oauth2.Token{AccessToken: "a1"}}
+	s := &SavingTokenSource{
+		Inner:  inner,
+		Save:   func(ctx context.Context, tok *oauth2.Token) error { calls++; return nil },
+		Logger: testLogger(),
+	}
+	if _, err := s.Token(); err != nil {
+		t.Fatalf("Token() error: %v", err)
+	}
+	if _, err := s.Token(); err != nil {
+		t.Fatalf("Token() error: %v", err)
+	}
+	if calls != 1 {
+		t.Errorf("Save called %d times; want 1 (token unchanged on second call)", calls)
+	}
+}
+
+func TestSavingTokenSource_resavesOnRefresh(t *testing.T) {
+	calls := 0
+	inner := &fakeTokenSource{tok: &oauth2.Token{AccessToken: "a1"}}
+	s := &SavingTokenSource{
+		Inner:  inner,
+		Save:   func(ctx context.Context, tok *oauth2.Token) error { calls++; return nil },
+		Logger: testLogger(),
+	}
+	if _, err := s.Token(); err != nil {
+		t.Fatalf("Token() error: %v", err)
+	}
+	inner.tok = &oauth2.Token{AccessToken: "a2"} // simulate a refresh
+	if _, err := s.Token(); err != nil {
+		t.Fatalf("Token() error: %v", err)
+	}
+	if calls != 2 {
+		t.Errorf("Save called %d times; want 2 (token changed)", calls)
+	}
+}
+
+func TestSavingTokenSource_saveErrorDoesNotFailToken(t *testing.T) {
+	s := &SavingTokenSource{
+		Inner:  &fakeTokenSource{tok: &oauth2.Token{AccessToken: "a1"}},
+		Save:   func(ctx context.Context, tok *oauth2.Token) error { return errors.New("db down") },
+		Logger: testLogger(),
+		LogMsg: "test: persist failed",
+		UserID: "u1",
+	}
+	tok, err := s.Token()
+	if err != nil {
+		t.Fatalf("Token() error = %v; want nil (Save failures are logged, not propagated)", err)
+	}
+	if tok.AccessToken != "a1" {
+		t.Errorf("AccessToken = %q; want a1", tok.AccessToken)
+	}
+}
+
+func TestSavingTokenSource_innerErrorPropagates(t *testing.T) {
+	wantErr := errors.New("refresh failed")
+	s := &SavingTokenSource{
+		Inner:  &fakeTokenSource{err: wantErr},
+		Save:   func(ctx context.Context, tok *oauth2.Token) error { t.Fatal("Save should not be called"); return nil },
+		Logger: testLogger(),
+	}
+	_, err := s.Token()
+	if !errors.Is(err, wantErr) {
+		t.Errorf("err = %v; want %v", err, wantErr)
+	}
+}