fix(outlook): address calendar review findings

- Validate list-events pageToken origin with assertGraphNextPageUrl (matches the
  onedrive/microsoft_ad Graph paging guard) so a workflow-supplied URL can't receive
  the Outlook bearer token.
- All-day create/update now normalize both bounds to midnight and force an exclusive
  end day (buildAllDayRange), instead of sending a zero-length same-midnight window
  that Graph rejects.
- Drop the stale 'suggest meeting times' claim from the block longDescription.
- Remove the unused MailboxSettings.Read scope (least privilege; no tool reads it).

Author: mzxchandra

apps/sim/blocks/blocks/outlook.ts

@@ -12,7 +12,7 @@ export const OutlookBlock: BlockConfig<OutlookResponse> = {
   description: 'Send, read, search, reply, organize, and manage Outlook email and calendar',
   authMode: AuthMode.OAuth,
   longDescription:
-    'Integrate Outlook into the workflow. Can send, draft, read, search, reply, forward, move, copy, and delete email; manage mail folders and attachments; and set categories and flags on messages. Can also list, create, update, delete, and respond to calendar events and suggest meeting times. Can be used in trigger mode to trigger a workflow when a new email is received.',
+    'Integrate Outlook into the workflow. Can send, draft, read, search, reply, forward, move, copy, and delete email; manage mail folders and attachments; and set categories and flags on messages. Can also list, create, update, delete, and respond to calendar events. Can be used in trigger mode to trigger a workflow when a new email is received.',
   docsLink: 'https://docs.sim.ai/integrations/outlook',
   category: 'tools',
   integrationType: IntegrationType.Email,

apps/sim/lib/oauth/oauth.ts

@@ -397,10 +397,10 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
         icon: OutlookIcon,
         baseProviderIcon: MicrosoftIcon,
         /**
-         * Calendars.ReadWrite and MailboxSettings.Read were added to support the Outlook
-         * calendar operations. Microsoft only grants newly-added scopes on a fresh
-         * authorization, so users who connected Outlook before these scopes existed must
-         * reconnect (re-consent) their account before the calendar operations will work.
+         * Calendars.ReadWrite was added to support the Outlook calendar operations.
+         * Microsoft only grants newly-added scopes on a fresh authorization, so users who
+         * connected Outlook before this scope existed must reconnect (re-consent) their
+         * account before the calendar operations will work.
          */
         scopes: [
           'openid',
@@ -411,7 +411,6 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
           'Mail.Read',
           'Mail.Send',
           'Calendars.ReadWrite',
-          'MailboxSettings.Read',
           'offline_access',
         ],
       },

apps/sim/lib/oauth/utils.ts

@@ -238,7 +238,6 @@ export const SCOPE_DESCRIPTIONS: Record<string, string> = {
   'Mail.Read': 'Read Microsoft emails',
   'Mail.Send': 'Send emails',
   'Calendars.ReadWrite': 'Read and manage Outlook calendar events',
-  'MailboxSettings.Read': 'Read mailbox settings (timezone, working hours)',
   'Files.Read': 'Read OneDrive files',
   'Files.ReadWrite': 'Read and write OneDrive files',
   'Tasks.ReadWrite': 'Read and manage Planner tasks',

apps/sim/tools/outlook/calendar-tools.test.ts

@@ -52,12 +52,35 @@ describe('outlook calendar tools', () => {
     expect(built).toContain('%24top=5')
     expect(built).toContain('%24orderby=start%2FdateTime')
 
-    // A nextLink page token is used verbatim.
+    // A Graph-origin nextLink page token is accepted.
     expect(url({ accessToken: 't', pageToken: 'https://graph.microsoft.com/next' })).toBe(
       'https://graph.microsoft.com/next'
     )
   })
 
+  it('rejects a non-Graph pageToken so the bearer token cannot be exfiltrated', () => {
+    const url = outlookCalendarListEventsTool.request.url as (p: unknown) => string
+    expect(() => url({ accessToken: 't', pageToken: 'https://evil.example.com/steal' })).toThrow(
+      /Microsoft Graph/
+    )
+  })
+
+  it('builds an all-day create body with midnight bounds and an exclusive end day', () => {
+    const body = outlookCalendarCreateEventTool.request.body as (
+      p: unknown
+    ) => Record<string, unknown>
+    const built = body({
+      accessToken: 't',
+      subject: 'Offsite',
+      startDateTime: '2025-06-03',
+      endDateTime: '2025-06-03',
+      isAllDay: true,
+    })
+    expect(built.isAllDay).toBe(true)
+    expect(built.start).toEqual({ dateTime: '2025-06-03T00:00:00', timeZone: 'UTC' })
+    expect(built.end).toEqual({ dateTime: '2025-06-04T00:00:00', timeZone: 'UTC' })
+  })
+
   it('builds a create-event body with Graph datetime shape and attendees', () => {
     const body = outlookCalendarCreateEventTool.request.body as (
       p: unknown

apps/sim/tools/outlook/calendar-utils.test.ts

@@ -3,6 +3,7 @@
  */
 import { describe, expect, it } from 'vitest'
 import {
+  buildAllDayRange,
   buildGraphEventDateTime,
   DEFAULT_OUTLOOK_TIME_ZONE,
   flattenGraphEvent,
@@ -48,6 +49,26 @@ describe('buildGraphEventDateTime', () => {
   })
 })
 
+describe('buildAllDayRange', () => {
+  it('advances a same-day end to the next day (exclusive end) at midnight', () => {
+    expect(buildAllDayRange('2025-06-03', '2025-06-03', 'America/Los_Angeles')).toEqual({
+      start: { dateTime: '2025-06-03T00:00:00', timeZone: 'America/Los_Angeles' },
+      end: { dateTime: '2025-06-04T00:00:00', timeZone: 'America/Los_Angeles' },
+    })
+  })
+
+  it('preserves an already-multi-day range and strips any time component', () => {
+    expect(buildAllDayRange('2025-06-03T09:30:00', '2025-06-05T14:00:00')).toEqual({
+      start: { dateTime: '2025-06-03T00:00:00', timeZone: DEFAULT_OUTLOOK_TIME_ZONE },
+      end: { dateTime: '2025-06-05T00:00:00', timeZone: DEFAULT_OUTLOOK_TIME_ZONE },
+    })
+  })
+
+  it('advances across a month boundary', () => {
+    expect(buildAllDayRange('2025-06-30', '2025-06-30').end.dateTime).toBe('2025-07-01T00:00:00')
+  })
+})
+
 describe('normalizeAttendees', () => {
   it('returns an empty array for undefined', () => {
     expect(normalizeAttendees(undefined)).toEqual([])

apps/sim/tools/outlook/calendar-utils.ts

@@ -76,6 +76,46 @@ export function buildGraphEventDateTime(value: string, timeZone?: string): Graph
   return { dateTime: trimmed, timeZone: timeZone || DEFAULT_OUTLOOK_TIME_ZONE }
 }
 
+/** Extract the `YYYY-MM-DD` date portion from a date or datetime string. */
+function toDateOnly(value: string): string {
+  const trimmed = value.trim()
+  const tIndex = trimmed.indexOf('T')
+  return tIndex === -1 ? trimmed : trimmed.slice(0, tIndex)
+}
+
+/** Add one calendar day to a `YYYY-MM-DD` string. */
+function nextDay(dateOnly: string): string {
+  const d = new Date(`${dateOnly}T00:00:00Z`)
+  d.setUTCDate(d.getUTCDate() + 1)
+  return d.toISOString().slice(0, 10)
+}
+
+/**
+ * Build the Graph `start`/`end` pair for an all-day event.
+ *
+ * Graph requires all-day events to have midnight `dateTime` values and an **exclusive**
+ * end day strictly after the start day. Callers routinely pass the same date (or timed
+ * placeholders) for both bounds, which Graph rejects with a 400. This normalizes both
+ * bounds to midnight and advances the end to at least the day after the start.
+ */
+export function buildAllDayRange(
+  startInput: string,
+  endInput: string,
+  timeZone?: string
+): { start: GraphDateTimeTimeZone; end: GraphDateTimeTimeZone } {
+  const tz = timeZone || DEFAULT_OUTLOOK_TIME_ZONE
+  const startDate = toDateOnly(startInput)
+  let endDate = toDateOnly(endInput)
+  // `YYYY-MM-DD` strings compare correctly lexicographically.
+  if (endDate <= startDate) {
+    endDate = nextDay(startDate)
+  }
+  return {
+    start: { dateTime: `${startDate}T00:00:00`, timeZone: tz },
+    end: { dateTime: `${endDate}T00:00:00`, timeZone: tz },
+  }
+}
+
 /**
  * Normalize a comma/newline-separated string (or array) of email addresses into the Graph
  * attendee payload shape.

apps/sim/tools/outlook/calendar_create_event.ts

@@ -1,5 +1,6 @@
 import { ErrorExtractorId } from '@/tools/error-extractors'
 import {
+  buildAllDayRange,
   buildGraphEventDateTime,
   CALENDAR_RETRY,
   flattenGraphEvent,
@@ -119,10 +120,18 @@ export const outlookCalendarCreateEventTool: ToolConfig<
       }
     },
     body: (params) => {
-      const event: Record<string, unknown> = {
-        subject: params.subject,
-        start: buildGraphEventDateTime(params.startDateTime, params.timeZone),
-        end: buildGraphEventDateTime(params.endDateTime, params.timeZone),
+      const isAllDay = toBool(params.isAllDay)
+      const event: Record<string, unknown> = { subject: params.subject }
+
+      if (isAllDay) {
+        // All-day events need midnight bounds with an exclusive end day.
+        const range = buildAllDayRange(params.startDateTime, params.endDateTime, params.timeZone)
+        event.isAllDay = true
+        event.start = range.start
+        event.end = range.end
+      } else {
+        event.start = buildGraphEventDateTime(params.startDateTime, params.timeZone)
+        event.end = buildGraphEventDateTime(params.endDateTime, params.timeZone)
       }
 
       if (params.body) {
@@ -138,10 +147,6 @@ export const outlookCalendarCreateEventTool: ToolConfig<
         event.attendees = attendees
       }
 
-      if (toBool(params.isAllDay)) {
-        event.isAllDay = true
-      }
-
       if (toBool(params.isOnlineMeeting)) {
         // Let Graph use the mailbox's default online-meeting provider (Teams on
         // work/school accounts) rather than hardcoding teamsForBusiness. Personal

apps/sim/tools/outlook/calendar_list_events.ts

@@ -6,6 +6,7 @@ import type {
   OutlookCalendarListEventsResponse,
 } from '@/tools/outlook/types'
 import { OUTLOOK_EVENT_OUTPUT_PROPERTIES } from '@/tools/outlook/types'
+import { assertGraphNextPageUrl } from '@/tools/sharepoint/utils'
 import type { ToolConfig } from '@/tools/types'
 
 const GRAPH_CALENDAR_VIEW_URL = 'https://graph.microsoft.com/v1.0/me/calendarView'
@@ -69,9 +70,11 @@ export const outlookCalendarListEventsTool: ToolConfig<
 
   request: {
     url: (params) => {
-      // A nextLink is a fully-formed Graph URL; use it verbatim to continue paging.
+      // A nextLink is a fully-formed Graph URL. Validate the origin before reusing it
+      // as the request URL — otherwise a workflow-supplied token would receive the
+      // Outlook bearer. Mirrors the onedrive / microsoft_ad Graph paging guard.
       if (params.pageToken) {
-        return params.pageToken
+        return assertGraphNextPageUrl(params.pageToken.trim())
       }
 
       const maxResults = params.maxResults

apps/sim/tools/outlook/calendar_update_event.ts

@@ -1,5 +1,6 @@
 import { ErrorExtractorId } from '@/tools/error-extractors'
 import {
+  buildAllDayRange,
   buildGraphEventDateTime,
   CALENDAR_RETRY,
   flattenGraphEvent,
@@ -126,17 +127,25 @@ export const outlookCalendarUpdateEventTool: ToolConfig<
     body: (params) => {
       // PATCH is a partial update: only include fields the caller actually provided.
       const event: Record<string, unknown> = {}
+      const settingAllDay = params.isAllDay !== undefined && toBool(params.isAllDay)
 
       if (params.subject !== undefined) {
         event.subject = params.subject
       }
 
-      if (params.startDateTime) {
-        event.start = buildGraphEventDateTime(params.startDateTime, params.timeZone)
-      }
-
-      if (params.endDateTime) {
-        event.end = buildGraphEventDateTime(params.endDateTime, params.timeZone)
+      if (settingAllDay && params.startDateTime && params.endDateTime) {
+        // Converting to all-day needs midnight bounds with an exclusive end day; send
+        // both together so Graph doesn't reject a zero-length all-day window.
+        const range = buildAllDayRange(params.startDateTime, params.endDateTime, params.timeZone)
+        event.start = range.start
+        event.end = range.end
+      } else {
+        if (params.startDateTime) {
+          event.start = buildGraphEventDateTime(params.startDateTime, params.timeZone)
+        }
+        if (params.endDateTime) {
+          event.end = buildGraphEventDateTime(params.endDateTime, params.timeZone)
+        }
       }
 
       if (params.body !== undefined) {