← back to Designer Wallcoverings

appointments: Google OAuth setup guide (Cloud Console + secrets-on-box + consent click)

a2ad63bc68316592b23c046300540f2be0e2b8ad · 2026-06-29 11:04:51 -0700 · Steve Abrams

Files touched

• A shopify/quote-api/appointments/deploy/OAUTH-setup.md

Diff

commit a2ad63bc68316592b23c046300540f2be0e2b8ad
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Jun 29 11:04:51 2026 -0700

    appointments: Google OAuth setup guide (Cloud Console + secrets-on-box + consent click)
---
 .../quote-api/appointments/deploy/OAUTH-setup.md   | 59 ++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/shopify/quote-api/appointments/deploy/OAUTH-setup.md b/shopify/quote-api/appointments/deploy/OAUTH-setup.md
new file mode 100644
index 00000000..e044173f
--- /dev/null
+++ b/shopify/quote-api/appointments/deploy/OAUTH-setup.md
@@ -0,0 +1,59 @@
+# Google Calendar OAuth — setup for info@designerwallcoverings.com
+
+This is the only piece an agent can't do — it needs your Google account + a consent
+click. ~5 minutes. Do it after Block A + Block B (api. host live with SSL).
+
+## 1. Google Cloud Console (console.cloud.google.com)
+- Pick/create a project (any project you control).
+- **APIs & Services → Library → enable "Google Calendar API".**
+- **OAuth consent screen:**
+  - User type: **External** (info@ is Purelymail, not Google Workspace, so "Internal" isn't offered).
+  - App name: `Designer Wallcoverings Appointments`; support email: info@…; developer email: yours.
+  - Scopes: add `.../auth/calendar.events` and `.../auth/calendar.readonly`.
+  - **Add the Google account that owns/manages info@'s calendar as a Test user.**
+  - ⚠️ Caveat: while the app is in **Testing**, Google expires the refresh token ~every 7 days
+    → calendar push would silently stop weekly. To make it permanent, either
+    **Publish** the app (calendar scopes are "sensitive" → Google may ask for verification),
+    or just re-run the consent when it lapses. For a single internal calendar, publishing is
+    the clean answer; if verification is a hassle, the booking + info@ email still work without
+    calendar push, so this is non-blocking.
+
+## 2. Create the OAuth client
+- **APIs & Services → Credentials → Create credentials → OAuth client ID.**
+- Application type: **Web application**, name `DW Appointments`.
+- **Authorized redirect URI (exact):**
+  `https://api.designerwallcoverings.com/api/appointments/oauth/callback`
+- Create → copy the **Client ID** and **Client Secret**.
+
+## 3. Put the secrets on the box + reload  (paste, substituting your two values)
+```bash
+ssh my-server 'bash -s' <<'EOF'
+APP=/root/Projects/koroseal-quote-api
+cp "$APP/.env" "$APP/.env.bak-pre-oauth-$(date +%Y%m%d-%H%M%S)"
+# --- replace the two placeholders ---
+CID='PASTE_CLIENT_ID'
+CSECRET='PASTE_CLIENT_SECRET'
+grep -q '^GOOGLE_OAUTH_CLIENT_ID='     "$APP/.env" || echo "GOOGLE_OAUTH_CLIENT_ID=$CID"        >> "$APP/.env"
+grep -q '^GOOGLE_OAUTH_CLIENT_SECRET=' "$APP/.env" || echo "GOOGLE_OAUTH_CLIENT_SECRET=$CSECRET" >> "$APP/.env"
+pm2 reload koroseal-quote-api --update-env && sleep 2
+curl -s https://api.designerwallcoverings.com/api/appointments/oauth/status?owner_email=info@designerwallcoverings.com; echo
+EOF
+```
+(Also paste the two values to me afterward and I'll register them in `/secrets` for the
+master registry — optional but keeps the rotation system complete.)
+
+## 4. Consent click (in a browser, signed in as info@'s calendar owner)
+Open:
+```
+https://api.designerwallcoverings.com/api/appointments/oauth/start?owner_email=info@designerwallcoverings.com
+```
+Approve calendar access → you'll land on a "Calendar connected" page.
+
+## 5. Verify
+```bash
+curl -s 'https://api.designerwallcoverings.com/api/appointments/oauth/status?owner_email=info@designerwallcoverings.com'
+# EXPECT: {"ok":true,...,"connected":true,"oauth_configured":true}
+```
+From then on, every booking auto-creates the calendar event AND respects busy times
+(freeBusy) so a blocked hour won't be offered. Until connected, bookings still persist +
+email info@ — they just don't push to Google.

← ab77a98e product: per-variant min quantity (Sold Per Yard=5, Wallcove  ·  back to Designer Wallcoverings  ·  product min-qty: step=1 — minimum is a floor, above it order 66541e4e →