src-tauri/src/sync/oauth.rs

@@ -46,6 +46,15 @@ pub fn provider_for(kind: &str) -> Option<OAuthProvider> {
             scopes: &["root_readwrite"],
             client_id_env: "WA_OAUTH_BOX_CLIENT_ID",
         }),
+        // Same identity platform as "onedrive", read-only calendar scope only
+        // (M4.4, T8.9, FR-CAL-6) — WA never requests file/mail access here.
+        "graph-calendar" => Some(OAuthProvider {
+            kind: "graph-calendar",
+            auth_endpoint: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+            token_endpoint: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+            scopes: &["offline_access", "Calendars.Read", "User.Read"],
+            client_id_env: "WA_OAUTH_GRAPH_CALENDAR_CLIENT_ID",
+        }),
         _ => None,
     }
 }