# WY-ICARE Donor Calendar Integrations

## Providers
- Google Calendar
- Microsoft 365 / Outlook Calendar

## Setup
Create OAuth applications with redirect URLs:
- `/api/calendar/oauth/google/callback`
- `/api/calendar/oauth/microsoft/callback`

Set `GOOGLE_CALENDAR_CLIENT_ID`, `GOOGLE_CALENDAR_CLIENT_SECRET`, `MICROSOFT_CALENDAR_CLIENT_ID`, `MICROSOFT_CALENDAR_CLIENT_SECRET`, `CALENDAR_TOKEN_ENCRYPTION_KEY`, and `WYICARE_TIMEZONE`.

## Security
OAuth access/refresh tokens are encrypted with AES-256-GCM before database storage. Calendar connections are user-scoped. Sync requires `ngo.donor_reports.calendar.integrations`. Disconnect is available to the same authorised user.

## Synchronisation
WY-ICARE pushes each active donor reporting deadline as an all-day event. Events contain a stable `WYICARE_SCHEDULE_ID` marker so the system can reconcile them on subsequent syncs. If a connected calendar event is edited to a different date, the next provider-specific reconciliation job may adopt that date only when an explicit pull/reconciliation implementation is enabled; until then WY-ICARE remains the system of record.