test(commands): cover graph_calendar_enabled in the privacy egress allowlist test (M4.4)

src-tauri/src/commands.rs

@@ -4072,6 +4072,22 @@ mod tests {
         );
     }
 
+    #[test]
+    fn privacy_self_check_graph_calendar_host_joins_the_allowlist_only_when_linked() {
+        // Off by default — the OAuth provider existing in code must not put
+        // Graph's host on the allowlist by itself (M4.4, FR-CAL-6).
+        let result = privacy_self_check_json(&default_settings(), Vec::new());
+        assert_eq!(result["allowlistedHosts"], serde_json::json!([]));
+
+        let mut settings = default_settings();
+        settings.graph_calendar_enabled = true;
+        let result = privacy_self_check_json(&settings, Vec::new());
+        assert_eq!(
+            result["allowlistedHosts"],
+            serde_json::json!(["graph.microsoft.com"])
+        );
+    }
+
     #[test]
     fn set_llm_provider_never_writes_the_api_key_into_settings() {
         // apply_llm_provider_args has no key parameter at all — this proves