feat(calendar): add scoped credential materialization port

[seonghobae]

Buyer/security outcome

Advance #129 by introducing the missing calendar credential materialization boundary between tenant/user-scoped durable connection evidence and an external encrypted secret store. LifeOS persistence continues to retain opaque secret handles only; plaintext provider material is obtained only after exact active connection authority and is returned only to an internal provider composition boundary.

Test-first scope

• exact UUIDv4 connection/workspace/user authority is required before any secret-store read;
• mismatched/revoked/missing persistence evidence fails closed before secret access;
• the secret-store/KMS port accepts only persisted opaque handles;
• external secret-store failures are sanitized and do not reflect provider errors or material;
• empty, oversized, or control-character secret material is rejected;
• refresh material remains optional rather than being invented for access-token-only providers.

Maturity

This is one bounded foundation for #129, not hosted credential-lifecycle completion. It does not yet implement a concrete KMS adapter, OAuth callback/state/PKCE, refresh single-flight, provider revocation, discovery/selection, or replace the current environment-token bootstrap in synchronization. Those remain follow-on slices after exact-head validation and review.

Validation

Require exact-current-head CI, calendar package tests/typecheck/build, configured coverage/docstrings, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness and all current review findings. No predecessor evidence transfers.

Refs #129

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 30 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e498f104-a19e-4b4c-87c9-bac07adeb36d

📥 Commits

Reviewing files that changed from the base of the PR and between 8e8f557 and b26081f.

📒 Files selected for processing (2)

• apps/integration-calendar-service/src/calendar-credential-materializer.test.ts
• apps/integration-calendar-service/src/calendar-credential-materializer.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}