From 3e88653dccda5536f25640f403abb67d475ddd61 Mon Sep 17 00:00:00 2001
From: Victor Lyuboslavsky <victor@fleetdm.com>
Date: Wed, 18 Jun 2025 17:03:06 -0500
Subject: [PATCH] Fixed error deleting calendar event for non-existent user.
 (#30009)

Fixes #27961

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
---
 changes/27961-delete-calendar-event        |  1 +
 ee/server/calendar/google_calendar.go      | 11 +++++++++++
 ee/server/calendar/google_calendar_test.go | 17 +++++++++++++++--
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 changes/27961-delete-calendar-event

diff --git a/changes/27961-delete-calendar-event b/changes/27961-delete-calendar-event
new file mode 100644
index 0000000000..a4744075d9
--- /dev/null
+++ b/changes/27961-delete-calendar-event
@@ -0,0 +1 @@
+Fixed error when deleting a calendar event for a Google Workspace user that no longer exists.
diff --git a/ee/server/calendar/google_calendar.go b/ee/server/calendar/google_calendar.go
index 91abdcf07d..e7bfb6c51b 100644
--- a/ee/server/calendar/google_calendar.go
+++ b/ee/server/calendar/google_calendar.go
@@ -515,6 +515,14 @@ func isAlreadyDeleted(err error) bool {
 	return ok && ae.Code == http.StatusGone
 }
 
+// Checks whether the credentials are incorrect. `invalid_grant` is a standard OAuth 2.0 error used by Google.
+func isInvalidGrant(err error) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(err.Error(), `"error": "invalid_grant"`)
+}
+
 func isRateLimited(err error) bool {
 	if err == nil {
 		return false
@@ -767,6 +775,9 @@ func (c *GoogleCalendar) DeleteEvent(event *fleet.CalendarEvent) error {
 	switch {
 	case isAlreadyDeleted(err):
 		return nil
+	case isInvalidGrant(err):
+		level.Warn(c.config.Logger).Log("msg", "could not delete calendar event due to invalid_grant", "user", c.adjustedUserEmail, "err", err)
+		return nil
 	case err != nil:
 		return ctxerr.Wrap(c.config.Context, err, "deleting Google calendar event")
 	}
diff --git a/ee/server/calendar/google_calendar_test.go b/ee/server/calendar/google_calendar_test.go
index 1c37b919b3..d1e53110f4 100644
--- a/ee/server/calendar/google_calendar_test.go
+++ b/ee/server/calendar/google_calendar_test.go
@@ -2,7 +2,9 @@ package calendar
 
 import (
 	"context"
+	"errors"
 	"net/http"
+	"net/url"
 	"os"
 	"testing"
 	"time"
@@ -163,18 +165,29 @@ func TestGoogleCalendar_DeleteEvent(t *testing.T) {
 	assert.NoError(t, err)
 
 	// API error test
-	mockAPI.DeleteEventFunc = func(id string) error {
+	mockAPI.DeleteEventFunc = func(_ string) error {
 		return assert.AnError
 	}
 	err = cal.DeleteEvent(&fleet.CalendarEvent{Data: []byte(`{"ID":"event-id"}`)})
 	assert.ErrorIs(t, err, assert.AnError)
 
 	// Event already deleted
-	mockAPI.DeleteEventFunc = func(id string) error {
+	mockAPI.DeleteEventFunc = func(_ string) error {
 		return &googleapi.Error{Code: http.StatusGone}
 	}
 	err = cal.DeleteEvent(&fleet.CalendarEvent{Data: []byte(`{"ID":"event-id"}`)})
 	assert.NoError(t, err)
+
+	// Invalid grant (i.e., user was deleted). We ignore this error.
+	mockAPI.DeleteEventFunc = func(_ string) error {
+		return &url.Error{
+			Op:  "Delete",
+			URL: "https://www.googleapis.com/calendar/v3/calendars/primary/events/8kof698stgkche95kqcn16g4h0?alt=json&prettyPrint=false",
+			Err: errors.New("oauth2: cannot fetch token: 400 Bad Request\nResponse: {\n  \"error\": \"invalid_grant\",\n  \"error_description\": \"Invalid email or User ID\"\n}"),
+		}
+	}
+	err = cal.DeleteEvent(&fleet.CalendarEvent{Data: []byte(`{"ID":"event-id"}`)})
+	assert.NoError(t, err)
 }
 
 func TestGoogleCalendar_unmarshalDetails(t *testing.T) {