Push the week's plan to Google Calendar (Feature 16)

POST /api/v1/plans/{weekStart}/push-calendar writes one event per plan
day to the chosen calendar: "Dinner: {name}" from the household dinner
time for 60 minutes in the household zone, with the dinner name,
"Start by {time}" for crock-pot dinners and the
{MEALQUEST_PUBLIC_URL}/dinner/{id} link. Event ids are the lowercase
base32hex SHA-256 of "mealquest|{weekStart}|{date}"; each event is
inserted, and a 409 updates it instead.

gcal.Service.PushEvents does the Calendar writes under the account lock,
with the same redaction as listing. plan.Service.Push records a push only
when every event was written: the plan becomes synced with
calendar_synced_at and each day stores its event id. A partial failure
records nothing; a plan edited mid-push is 409 plan_changed.

A swap, or a redraft to another dinner, clears the day's
calendar_event_id, so the next push writes just those days; a push with
none pending writes every day again.

No calendar chosen is 409 no_calendar; a deleted or read-only chosen
calendar is 409 calendar_unavailable; a refused grant is 502
reconnect_required, leaving the connection as it is.

Maestro task 5885d2b1-cf06-44ff-abf3-242d7763c3c9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/plans.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/gcal"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/plan"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
 )
@@ -93,6 +94,58 @@ func putPlanDay(logger *slog.Logger, svc *plan.Service) http.HandlerFunc {
 	}
 }
 
+// postPlanPush pushes the week's plan to the chosen Google calendar
+// (Push to Calendar) and answers with the plan as synced.
+func postPlanPush(logger *slog.Logger, svc *plan.Service) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		week, ok := weekStartOrFail(w, r, logger)
+		if !ok {
+			return
+		}
+		p, err := svc.Push(r.Context(), week)
+		if err != nil {
+			writePlanPushError(w, r, logger, err)
+			return
+		}
+		writeJSON(w, r, logger, http.StatusOK, p)
+	}
+}
+
+// writePlanPushError maps a Push to Calendar error to its API error: 409
+// not_connected when Google Calendar is not connected, no_calendar when no
+// calendar is chosen, calendar_unavailable when the chosen calendar was
+// deleted or is no longer writable, and plan_changed when the plan was
+// edited during the push; 502 reconnect_required when Google no longer
+// accepts the grant, and google_failed when Google refused or could not be
+// reached. A failed push leaves the plan's status as it was. Any other
+// error is the plan's, as writePlanError maps it.
+func writePlanPushError(w http.ResponseWriter, r *http.Request, logger *slog.Logger, err error) {
+	var calendar *gcal.CalendarError
+	switch {
+	case errors.Is(err, gcal.ErrNotConnected):
+		writeError(w, r, logger, http.StatusConflict, "not_connected", "Google Calendar is not connected")
+	case errors.Is(err, gcal.ErrNoCalendar):
+		writeError(w, r, logger, http.StatusConflict, "no_calendar",
+			"choose the calendar to push dinners to in Settings, then push again")
+	case errors.Is(err, gcal.ErrCalendarUnavailable):
+		logger.WarnContext(r.Context(), "push plan to Calendar", "error", err)
+		writeError(w, r, logger, http.StatusConflict, "calendar_unavailable",
+			"the chosen calendar was deleted or MealQuest can no longer add dinners to it; choose another calendar in Settings")
+	case errors.Is(err, plan.ErrPlanChanged):
+		writeError(w, r, logger, http.StatusConflict, "plan_changed", err.Error())
+	case errors.Is(err, gcal.ErrReconnect):
+		logger.WarnContext(r.Context(), "push plan to Calendar", "error", err)
+		writeError(w, r, logger, http.StatusBadGateway, "reconnect_required",
+			"Google no longer accepts MealQuest's access to your calendar; connect Google Calendar again")
+	case errors.As(err, &calendar):
+		logger.WarnContext(r.Context(), "push plan to Calendar", "error", err)
+		writeError(w, r, logger, http.StatusBadGateway, "google_failed",
+			"Google Calendar could not be reached; push again")
+	default:
+		writePlanError(w, r, logger, "push plan to Calendar", err)
+	}
+}
+
 // weekStartOrFail parses the {weekStart} path parameter, or answers 400
 // when it is not a Monday date.
 func weekStartOrFail(w http.ResponseWriter, r *http.Request, logger *slog.Logger) (store.LocalDate, bool) {

internal/server/plans_test.go

@@ -1,14 +1,15 @@
 package server
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"encoding/json"
 	"errors"
-	"io"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strings"
 	"sync"
 	"testing"
@@ -17,6 +18,8 @@ import (
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/harness"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/skills"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/db"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/gcal"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/gcal/gcaltest"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/jobs"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/plan"
@@ -34,6 +37,12 @@ type plansEnv struct {
 	st       *store.Store
 	svc      *plan.Service
 	questLog string
+	// google is the fake Google the plan service pushes to; it starts
+	// unconnected.
+	google *gcaltest.Google
+	gcal   *gcal.Service
+	// logs holds every log line the router writes.
+	logs *bytes.Buffer
 }
 
 func newPlansRouter(t *testing.T) plansEnv {
@@ -43,7 +52,8 @@ func newPlansRouter(t *testing.T) plansEnv {
 	if err := household.SeedSettings(ctx, st, "America/New_York"); err != nil {
 		t.Fatal(err)
 	}
-	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	logs := &bytes.Buffer{}
+	logger := slog.New(slog.NewJSONHandler(logs, &slog.HandlerOptions{Level: slog.LevelDebug}))
 	runner, err := jobs.NewRunner(st, logger, 1)
 	if err != nil {
 		t.Fatal(err)
@@ -51,12 +61,26 @@ func newPlansRouter(t *testing.T) plansEnv {
 	fail := func(context.Context, string, skills.WeekRequest) (skills.Week, error) {
 		return skills.Week{}, errors.New("no model in this test")
 	}
-	svc, err := plan.NewService(st, fail, runner, logger)
+	pub := &url.URL{Scheme: "https", Host: "mealquest.example"}
+	google := gcaltest.New(t, "https://mealquest.example"+gcal.CallbackPath)
+	googleSvc, err := gcal.NewService(st, newTestBox(t), gcal.Config{
+		ClientID:     gcaltest.ClientID,
+		ClientSecret: gcaltest.ClientSecret,
+		PublicURL:    pub,
+		SecretKey:    []byte("server-secret-key"),
+		Endpoint:     google.Endpoint(),
+		RevokeURL:    google.RevokeURL(),
+		CalendarAPI:  google.CalendarAPI(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	svc, err := plan.NewService(st, fail, runner, googleSvc, pub, logger)
 	if err != nil {
 		t.Fatal(err)
 	}
 	h, err := NewRouter(logger, "dev", nil, stubAuth{}, stubSessions{}, newTestSettings(t), newTestSearch(t), newTestAI(t),
-		newTestDinners(t), newTestSuggest(t), svc, newTestGoogle(t), runner, newTestPhotos(t), fstest.MapFS{"index.html": {Data: []byte(fixtureIndex)}})
+		newTestDinners(t), newTestSuggest(t), svc, googleSvc, runner, newTestPhotos(t), fstest.MapFS{"index.html": {Data: []byte(fixtureIndex)}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -90,7 +114,8 @@ func newPlansRouter(t *testing.T) plansEnv {
 			t.Fatal(err)
 		}
 	}
-	return plansEnv{h: h, st: st, svc: svc, questLog: dinner("Pad Thai", "quest_log", "stovetop", 35)}
+	return plansEnv{h: h, st: st, svc: svc, questLog: dinner("Pad Thai", "quest_log", "stovetop", 35),
+		google: google, gcal: googleSvc, logs: logs}
 }
 
 func (e plansEnv) setStatus(t *testing.T, status string) {
@@ -324,3 +349,141 @@ func TestPutPlanDay(t *testing.T) {
 		t.Errorf("PUT archived dinner = %d %v, want 409 dinner_not_plannable", rec.Code, body)
 	}
 }
+
+// pushCalendar is the calendar the push tests choose.
+var pushCalendar = gcaltest.Calendar{ID: "dinners@group.calendar.google.com", Summary: "Dinners", AccessRole: "owner"}
+
+// connectCalendar connects the fake Google and, when choose, chooses
+// pushCalendar.
+func (e plansEnv) connectCalendar(t *testing.T, choose bool) {
+	t.Helper()
+	e.google.SetCalendars(0, pushCalendar)
+	e.google.Connect(t, e.gcal)
+	if !choose {
+		return
+	}
+	if _, err := e.gcal.SelectCalendar(t.Context(), pushCalendar.ID); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// push calls POST /plans/{weekStart}/push-calendar and checks that neither
+// the response nor any log line holds a secret.
+func (e plansEnv) push(t *testing.T, weekStart string) (*httptest.ResponseRecorder, map[string]any) {
+	t.Helper()
+	rec, body := callDinners(t, e.h, http.MethodPost, plansPath+weekStart+"/push-calendar", "")
+	for _, secret := range []string{gcaltest.RefreshToken, gcaltest.AccessToken, gcaltest.ClientSecret} {
+		if strings.Contains(rec.Body.String(), secret) {
+			t.Errorf("response holds a secret: %s", rec.Body)
+		}
+		if strings.Contains(e.logs.String(), secret) {
+			t.Errorf("logs hold a secret: %s", e.logs)
+		}
+	}
+	return rec, body
+}
+
+func TestPushPlanToCalendar(t *testing.T) {
+	t.Parallel()
+	e := newPlansRouter(t)
+	e.connectCalendar(t, true)
+
+	rec, body := e.push(t, "2026-10-12")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("push = %d: %s", rec.Code, rec.Body)
+	}
+	if body["status"] != "synced" || body["calendar_synced_at"] == nil {
+		t.Errorf("pushed plan = %v, want synced", body)
+	}
+	if days, _ := body["days"].([]any); len(days) != 7 {
+		t.Errorf("days = %v, want 7", body["days"])
+	}
+	if n := len(e.google.Events(pushCalendar.ID)); n != 7 {
+		t.Errorf("calendar has %d events, want 7", n)
+	}
+	monday := e.google.Events(pushCalendar.ID)[plan.EventID(mustLocalDate(t, "2026-10-12"), mustLocalDate(t, "2026-10-12"))]
+	if !strings.HasPrefix(monday.Description, "Beef Chili\nStart by 1:30 pm\nhttps://mealquest.example/dinner/") {
+		t.Errorf("Monday's description = %q", monday.Description)
+	}
+}
+
+func TestPushPlanToCalendarErrors(t *testing.T) {
+	t.Parallel()
+	for _, tc := range []struct {
+		name   string
+		week   string
+		setup  func(t *testing.T, e plansEnv)
+		status int
+		code   string
+	}{
+		{"not connected", "2026-10-12", func(*testing.T, plansEnv) {}, http.StatusConflict, "not_connected"},
+		{"no calendar chosen", "2026-10-12", func(t *testing.T, e plansEnv) { e.connectCalendar(t, false) }, http.StatusConflict, "no_calendar"},
+		{"calendar deleted", "2026-10-12", func(t *testing.T, e plansEnv) {
+			e.connectCalendar(t, true)
+			e.google.SetCalendars(0)
+		}, http.StatusConflict, "calendar_unavailable"},
+		{"calendar read-only", "2026-10-12", func(t *testing.T, e plansEnv) {
+			e.connectCalendar(t, true)
+			e.google.SetCalendars(0, gcaltest.Calendar{ID: pushCalendar.ID, Summary: "Dinners", AccessRole: "reader"})
+		}, http.StatusConflict, "calendar_unavailable"},
+		{"grant revoked", "2026-10-12", func(t *testing.T, e plansEnv) {
+			e.connectCalendar(t, true)
+			e.google.RevokeGrant()
+		}, http.StatusBadGateway, "reconnect_required"},
+		{"Google fails part way", "2026-10-12", func(t *testing.T, e plansEnv) {
+			e.connectCalendar(t, true)
+			e.google.FailEventWrite(3, http.StatusServiceUnavailable)
+		}, http.StatusBadGateway, "google_failed"},
+		{"no plan", "2026-10-19", func(t *testing.T, e plansEnv) { e.connectCalendar(t, true) }, http.StatusNotFound, "not_found"},
+		{"not a Monday", "2026-10-13", func(t *testing.T, e plansEnv) { e.connectCalendar(t, true) }, http.StatusBadRequest, "invalid_week"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			e := newPlansRouter(t)
+			tc.setup(t, e)
+			rec, body := e.push(t, tc.week)
+			if rec.Code != tc.status || errorCode(body) != tc.code {
+				t.Errorf("push = %d %s, want %d %s", rec.Code, rec.Body, tc.status, tc.code)
+			}
+			p, err := e.svc.Get(t.Context(), mustLocalDate(t, "2026-10-12"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if p.Status != plan.StatusDraft || p.CalendarSyncedAt != nil {
+				t.Errorf("plan = %s synced at %v after a failed push, want draft", p.Status, p.CalendarSyncedAt)
+			}
+		})
+	}
+}
+
+func TestPushPlanChangedWhilePushing(t *testing.T) {
+	t.Parallel()
+	e := newPlansRouter(t)
+	e.connectCalendar(t, true)
+	arrived, release := e.google.HoldEvents()
+	defer release()
+	pushed := make(chan *httptest.ResponseRecorder, 1)
+	go func() {
+		rec := httptest.NewRecorder()
+		e.h.ServeHTTP(rec, signedIn(http.MethodPost, plansPath+"2026-10-12/push-calendar", nil))
+		pushed <- rec
+	}()
+	<-arrived
+	if _, err := e.svc.Swap(t.Context(), mustLocalDate(t, "2026-10-12"), "2026-10-13", e.questLog); err != nil {
+		t.Fatal(err)
+	}
+	release()
+	rec := <-pushed
+	if rec.Code != http.StatusConflict || !strings.Contains(rec.Body.String(), `"code":"plan_changed"`) {
+		t.Errorf("push = %d %s, want 409 plan_changed", rec.Code, rec.Body)
+	}
+}
+
+func mustLocalDate(t *testing.T, s string) store.LocalDate {
+	t.Helper()
+	d, err := store.ParseLocalDate(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return d
+}

internal/server/server.go

@@ -133,6 +133,7 @@ func NewRouter(logger *slog.Logger, version string, trusted forwarded.Trusted, a
 	apiV1.Get("/plans/{weekStart}", getPlan(logger, planSvc))
 	apiV1.Post("/plans/{weekStart}/draft", postPlanDraft(logger, planSvc))
 	apiV1.Put("/plans/{weekStart}/days/{date}", putPlanDay(logger, planSvc))
+	apiV1.Post("/plans/{weekStart}/push-calendar", postPlanPush(logger, planSvc))
 	apiV1.Get("/rotation-reviews", getRotationReviews(logger, planSvc))
 	apiV1.Post("/dinners/{id}/rotation-review", postRotationReview(logger, planSvc))
 	// connect and callback are top-level browser navigations, so they are

internal/server/server_test.go

@@ -202,7 +202,7 @@ func newTestPlan(t *testing.T) *plan.Service {
 	fail := func(context.Context, string, skills.WeekRequest) (skills.Week, error) {
 		return skills.Week{}, errors.New("no model in this test")
 	}
-	svc, err := plan.NewService(st, fail, runner, logger)
+	svc, err := plan.NewService(st, fail, runner, newTestGoogle(t), &url.URL{Scheme: "https", Host: "mealquest.example"}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}