feat: Domain-wide delegation for Google Calendar and Google Meet (#16622)

* Add endpoints for testing the flow * Add MVP * new route * Fixes * Fixes * Remove enable toggle support from domainWideDelegation * Fixes * Revert "Remove enable toggle support from domainWideDelegation" This reverts commit c29e729206cd1fa063f9c9ce0cf148ef1577d60b. * Revert yarn.lock * More fixes * Fix new workspace platform add * refactor: improvements * refactor: bug fixes and improvements * fix: type errors * fix: conflicts * chore: update test * fix: logic * chore: improvements * fix: toglle * fix: bugs * fix: type err * chore: check number type * fix: after conflicts * chore: fix type err * fix: type errors and tests * fix: tets * test * chore: remove unused * fix: google meet url on booking page and secondary calendar * fix: add property * fix: type err * fix: re assingment bug * fix: use getAllCredentials * chore: fix import * fix: installed count * fix: pass event type * fix: import * fix: [Stacked PR] Review fixes (#17958) * Review fixes * fix: destination calendar bug --------- Co-authored-by: Udit Takkar <udit222001@gmail.com> * refactor: use repository * chore: remove duplicate * fix: More review fixes for domain wide delegation (#17969) * Reuse buildCredentialPayloadForCalendar * fixes --------- Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com> * fix ts error * Fix getSchedule not using dwd credentials (#17995) * fix: Remove direct DWD table access from google-calendar and remove delegatedToId column from Credential (#18015) * Remove fn rename to reduce number of files changed * chore: check feature globally * test: add unit tests * chore: move function * test: add booking test * wip * Remove domain-wide-delegation team feature flag * Make sure duplicate calendars are not shown due to DWD. Show DWD when there is conflict * Fix tests and their ts errors * Fix more tests * Move findUsersForAvailabilityCheck to separate file as it has AppStore dependency causing problem with Routing Forms. Build crashes * fix: Multiple calendar connections from Google not showing up in apps/installed * DestinationCalendar must have either credentialId or domainWideDeelgationId. Also handle the case when DWD is disabled and there was a non-dwd credential that could be used * Disable deletetion of DWD as it is destructive and prefer disabling instead * Show DWD credential calendars at the top * Fixed tests * Calendar Cache DWD support * Self-Review: Verify email required and add more selectedCalendar tests * Self Review: shorten names * Self ReviewL Dead code removal * Revert "Calendar Cache DWD support" This reverts commit 009f236470fa21eba5986117d4f6e4d4c5e38c34. * Some misc fixes * fixes * Performance improvememt in slots loading and booking * More cases for handling dwd credentials * simplify the logic. Ensure that EventManager and the modules below it in the flow have CredentialForCalendarService available * Fix tests * Fix installed/conferencing not showing gogole meet * Shorten name * Fix ApI v2 tests * Add some more tests * add getSchedule tests * Improve tests * Make Google Meet default when DWD for google is enabled * Enable feature flagging for DWD * chore: bump libraries * Encrypt serviceaccount private key * Fix ts errors * bump platform libraries * org add dwd * org add dwd * bump platform libraries * fix selected calendars * fix remove selected dwd calendar * remove oauthclient id aliad in authedCalendar * remove oauthclient id aliad in authedCalendar * refactor: OrganizationsDwdController * chore: export toggleDwdEnabled from platform-libraries * feat: v2 update (enable / disable) dwd * refactor: SelectedCalendarsController check if user belongs to dwd org & for not dwd use previous logic * wip: DestinationCalendar send domainWideDelegationCredentialId from frontend to api * try fix set destination calendar api v2 * fixup! try fix set destination calendar api v2 * setting google meet as default location working for dwd * bump platform libraries version * allow office 365 workspace slug * allow office 365 workspace slug * chore: v2 create dwd MS and Google service keys input * fix: CreateDwdInput serviceAccountKey * fix: CredentialForCalendarService type * fix: check workspace slug * feat: update serviceAccessKey of DWD * testing * fixup! testing * fix: getAuthUtl bug * fix: unit tests * fix: type err and unit test * fix: e2e test * fix: credentials bug and failing unit tests * Update CalendarService.ts * chore: refactor office365 calendar service and add testDomainWideDelegationSetup * fix: office365Calendar use correct clientId/Secret for DWD * fix: office365Calendar dwd no need refresh token * test: add unit test for outlook dwd and setup * feat: added dwd support for office365 calendar * feat: added dwd support for office365 video * test: finish test for outlook dwd * fix: create dialog bug * chore: remove console logs * fix: refreshToken bug * bump version libraries * refactor: fetch dwd credentials only in findQualifiedHosts * fixup! refactor: fetch dwd credentials only in findQualifiedHosts * fix: type err * fix: type err * fix: getUserDisplayName * fix: unit test * chore: bump platform lib --------- Co-authored-by: Syed Ali Shahbaz <52925846+alishaz-polymath@users.noreply.github.com> Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com> Co-authored-by: Udit Takkar <udit222001@gmail.com> Co-authored-by: Morgan Vernay <morgan@cal.com> Co-authored-by: supalarry <laurisskraucis@gmail.com> Co-authored-by: Somay Chauhan <somaychauhan98@gmail.com> Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
2025-03-02 16:52:57 -03:00
1 parent 2d915a1c51
commit be77ac133c
@@ -108,7 +108,7 @@ async function handler(req: NextApiRequest) {
  // ^ Workaround for the select in `create` not working

  if (createCalendarResources) {
-    const calendar = await getCalendar(credential);
+    const calendar = await getCalendar({ ...credential, delegatedTo: null });
    if (!calendar) throw new HttpError({ message: "Calendar missing for credential", statusCode: 500 });
    const calendars = await calendar.listCalendars();
    const calendarToCreate = calendars.find((calendar) => calendar.primary) || calendars[0];
@@ -2,7 +2,7 @@ import type { Prisma } from "@prisma/client";
 import type { NextApiRequest } from "next";
 import type { z } from "zod";

-import { getCalendarCredentials, getConnectedCalendars } from "@calcom/core/CalendarManager";
+import { getCalendarCredentialsWithoutDwd, getConnectedCalendars } from "@calcom/core/CalendarManager";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
 import prisma from "@calcom/prisma";
@@ -185,7 +185,7 @@ async function verifyCredentialsAndGetId({
  currentCredentialId: number | null;
 }) {
  if (parsedBody.integration && parsedBody.externalId) {
-    const calendarCredentials = getCalendarCredentials(userCredentials);
+    const calendarCredentials = getCalendarCredentialsWithoutDwd(userCredentials);

    const { connectedCalendars } = await getConnectedCalendars(
      calendarCredentials,
@@ -1,6 +1,6 @@
 import type { NextApiRequest } from "next";

-import { getCalendarCredentials, getConnectedCalendars } from "@calcom/core/CalendarManager";
+import { getCalendarCredentialsWithoutDwd, getConnectedCalendars } from "@calcom/core/CalendarManager";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
 import prisma from "@calcom/prisma";
@@ -82,7 +82,7 @@ async function postHandler(req: NextApiRequest) {
      message: "Bad request, credential id invalid",
    });

-  const calendarCredentials = getCalendarCredentials(userCredentials);
+  const calendarCredentials = getCalendarCredentialsWithoutDwd(userCredentials);

  const { connectedCalendars } = await getConnectedCalendars(calendarCredentials, [], parsedBody.externalId);

@@ -30,7 +30,7 @@
    "@axiomhq/winston": "^1.2.0",
    "@calcom/platform-constants": "*",
    "@calcom/platform-enums": "*",
-    "@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.121",
+    "@calcom/platform-libraries": "npm:@calcom/platform-libraries@0.0.123",
    "@calcom/platform-libraries-0.0.2": "npm:@calcom/platform-libraries@0.0.2",
    "@calcom/platform-types": "*",
    "@calcom/platform-utils": "*",
@@ -127,6 +127,11 @@ class Primary {
  @IsInt()
  @ApiProperty()
  credentialId!: number;
+
+  @IsString()
+  @IsOptional()
+  @ApiPropertyOptional({ type: String, nullable: true })
+  domainWideDelegationCredentialId?: string | null;
 }

 export class Calendar {
@@ -165,6 +170,11 @@ export class Calendar {
  @IsInt()
  @ApiProperty()
  credentialId!: number;
+
+  @IsString()
+  @IsOptional()
+  @ApiPropertyOptional({ type: String, nullable: true })
+  domainWideDelegationCredentialId?: string | null;
 }

 export class ConnectedCalendar {
@@ -177,6 +187,11 @@ export class ConnectedCalendar {
  @ApiProperty()
  credentialId!: number;

+  @IsString()
+  @IsOptional()
+  @ApiPropertyOptional({ type: String, nullable: true })
+  domainWideDelegationCredentialId?: string | null;
+
  @ValidateNested()
  @IsObject()
  @IsOptional()
@@ -220,6 +235,11 @@ class DestinationCalendar {
  @ApiProperty({ type: Number, nullable: true })
  credentialId!: number | null;

+  @IsString()
+  @IsOptional()
+  @ApiPropertyOptional({ type: String, nullable: true })
+  domainWideDelegationCredentialId?: string | null;
+
  @IsString()
  @IsOptional()
  @ApiPropertyOptional({ type: String, nullable: true })
@@ -39,6 +39,16 @@ export class CalendarsService {
    private readonly selectedCalendarsRepository: SelectedCalendarsRepository
  ) {}

+  private buildNonDwdCredentials<TCredential>(credentials: TCredential[]) {
+    return credentials
+      .map((credential) => ({
+        ...credential,
+        delegatedTo: null,
+        delegatedToId: null,
+      }))
+      .filter((credential) => !!credential);
+  }
+
  async getCalendars(userId: number) {
    const userWithCalendars = await this.usersRepository.findByIdWithCalendars(userId);
    if (!userWithCalendars) {
@@ -73,7 +83,7 @@ export class CalendarsService {
    );
    try {
      const calendarBusyTimes = await getBusyCalendarTimes(
-        credentials,
+        this.buildNonDwdCredentials(credentials),
        dateFrom,
        dateTo,
        composedSelectedCalendars
@@ -210,6 +210,7 @@ export class EventTypesAtomService {
        credentials = credentials.concat(teamAppCredentials);
      }
    }
+    //TODO: enrich credentials for DWD
    const enabledApps = await getEnabledAppsFromCredentials(credentials, {
      where: { slug },
    });
@@ -196,10 +196,10 @@ export class ConferencingController {
  @UseGuards(ApiAuthGuard)
  @ApiOperation({ summary: "Set your default conferencing application" })
  async default(
-    @GetUser("id") userId: number,
+    @GetUser() user: UserWithProfile,
    @Param("app") app: string
  ): Promise<SetDefaultConferencingAppOutputResponseDto> {
-    await this.conferencingService.setDefaultConferencingApp(userId, app);
+    await this.conferencingService.setDefaultConferencingApp(user, app);
    return { status: SUCCESS_STATUS };
  }

@@ -5,7 +5,12 @@ import { BadRequestException, InternalServerErrorException, Logger } from "@nest
 import { Injectable } from "@nestjs/common";

 import { CONFERENCING_APPS, CAL_VIDEO } from "@calcom/platform-constants";
-import { userMetadata, handleDeleteCredential } from "@calcom/platform-libraries";
+import {
+  userMetadata,
+  handleDeleteCredential,
+  getApps,
+  getUsersCredentials,
+} from "@calcom/platform-libraries";

@Injectable()
 export class ConferencingService {
@@ -25,20 +30,24 @@ export class ConferencingService {
    return userMetadata.parse(user?.metadata)?.defaultConferencingApp;
  }

-  async checkAppIsValidAndConnected(userId: number, app: string) {
-    if (!CONFERENCING_APPS.includes(app)) {
+  async checkAppIsValidAndConnected(user: UserWithProfile, appSlug: string) {
+    if (!CONFERENCING_APPS.includes(appSlug)) {
      throw new BadRequestException("Invalid app, available apps are: ", CONFERENCING_APPS.join(", "));
    }
-    const credential = await this.conferencingRepository.findConferencingApp(userId, app);
+    const credentials = await getUsersCredentials(user);

-    if (!credential) {
-      throw new BadRequestException(`${app} not connected.`);
+    const foundApp = getApps(credentials, true).filter((app) => app.slug === appSlug)[0];
+
+    const appLocation = foundApp?.appData?.location;
+
+    if (!foundApp || !appLocation) {
+      throw new BadRequestException(`${appSlug} not connected.`);
    }
-    return credential;
+    return foundApp.credential;
  }

  async disconnectConferencingApp(user: UserWithProfile, app: string) {
-    const credential = await this.checkAppIsValidAndConnected(user.id, app);
+    const credential = await this.checkAppIsValidAndConnected(user, app);
    return handleDeleteCredential({
      userId: user.id,
      userMetadata: user?.metadata,
@@ -46,13 +55,13 @@ export class ConferencingService {
    });
  }

-  async setDefaultConferencingApp(userId: number, app: string) {
+  async setDefaultConferencingApp(user: UserWithProfile, app: string) {
    // cal-video is global, so we can skip this check
    if (app !== CAL_VIDEO) {
-      await this.checkAppIsValidAndConnected(userId, app);
+      await this.checkAppIsValidAndConnected(user, app);
    }
-    const user = await this.usersRepository.setDefaultConferencingApp(userId, app);
-    const metadata = user.metadata as { defaultConferencingApp?: { appSlug?: string } };
+    const updatedUser = await this.usersRepository.setDefaultConferencingApp(user.id, app);
+    const metadata = updatedUser.metadata as { defaultConferencingApp?: { appSlug?: string } };
    if (metadata?.defaultConferencingApp?.appSlug !== app) {
      throw new InternalServerErrorException(`Could not set ${app} as default conferencing app`);
    }
@@ -29,11 +29,12 @@ export class DestinationCalendarsController {
    @Body() input: DestinationCalendarsInputBodyDto,
    @GetUser() user: UserWithProfile
  ): Promise<DestinationCalendarsOutputResponseDto> {
-    const { integration, externalId } = input;
+    const { integration, externalId, domainWideDelegationCredentialId } = input;
    const updatedDestinationCalendar = await this.destinationCalendarsService.updateDestinationCalendars(
      integration,
      externalId,
-      user.id
+      user.id,
+      domainWideDelegationCredentialId
    );

    return {
@@ -8,21 +8,25 @@ export class DestinationCalendarsRepository {
  async updateCalendar(
    integration: string,
    externalId: string,
-    credentialId: number,
+
    userId: number,
-    primaryEmail: string | null
+    primaryEmail: string | null,
+    credentialId?: number,
+    domainWideDelegationCredentialId?: string
  ) {
    return await this.dbWrite.prisma.destinationCalendar.upsert({
      update: {
        integration,
        externalId,
-        credentialId,
+        ...(credentialId ? { credentialId } : {}),
+        ...(domainWideDelegationCredentialId ? { domainWideDelegationCredentialId } : {}),
        primaryEmail,
      },
      create: {
        integration,
        externalId,
-        credentialId,
+        ...(credentialId ? { credentialId } : {}),
+        ...(domainWideDelegationCredentialId ? { domainWideDelegationCredentialId } : {}),
        primaryEmail,
        userId,
      },
@@ -1,6 +1,6 @@
-import { ApiProperty } from "@nestjs/swagger";
+import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
 import { Expose } from "class-transformer";
-import { IsString, IsEnum } from "class-validator";
+import { IsString, IsEnum, IsOptional } from "class-validator";

 import {
  APPLE_CALENDAR_TYPE,
@@ -33,4 +33,9 @@ export class DestinationCalendarsInputBodyDto {
    required: true,
  })
  readonly externalId!: string;
+
+  @IsString()
+  @IsOptional()
+  @ApiPropertyOptional()
+  readonly domainWideDelegationCredentialId?: string;
 }
@@ -10,9 +10,16 @@ export class DestinationCalendarsService {
    private readonly destinationCalendarsRepository: DestinationCalendarsRepository
  ) {}

-  async updateDestinationCalendars(integration: string, externalId: string, userId: number) {
+  async updateDestinationCalendars(
+    integration: string,
+    externalId: string,
+    userId: number,
+    domainWideDelegationCredentialId?: string
+  ) {
+    // note(Lauris): todo remove the log but leaving this now to confirm domainWideDelegationCredentialId is received
+    console.log("debug: domainWideDelegationCredentialId", domainWideDelegationCredentialId);
    const userCalendars = await this.calendarsService.getCalendars(userId);
-    const allCalendars = userCalendars.connectedCalendars
+    const allCalendars: Calendar[] = userCalendars.connectedCalendars
      .map((cal: ConnectedCalendar) => cal.calendars ?? [])
      .flat();
    const credentialId = allCalendars.find(
@@ -20,12 +27,26 @@ export class DestinationCalendarsService {
        cal.externalId === externalId && cal.integration === integration && cal.readOnly === false
    )?.credentialId;

-    if (!credentialId) {
+    if (!domainWideDelegationCredentialId && !credentialId) {
      throw new NotFoundException(`Could not find calendar ${externalId}`);
    }

-    const primaryEmail =
-      allCalendars.find((cal: Calendar) => cal.primary && cal.credentialId === credentialId)?.email ?? null;
+    const dwdCalendar = domainWideDelegationCredentialId
+      ? allCalendars.find(
+          (cal: Calendar) =>
+            cal.externalId === externalId &&
+            cal.integration === integration &&
+            cal.domainWideDelegationCredentialId === domainWideDelegationCredentialId
+        )
+      : undefined;
+
+    if (domainWideDelegationCredentialId && !dwdCalendar) {
+      throw new NotFoundException(`Could not find calendar ${externalId}`);
+    }
+
+    const primaryEmail = dwdCalendar
+      ? (dwdCalendar.primary && dwdCalendar?.email) || undefined
+      : allCalendars.find((cal: Calendar) => cal.primary && cal.credentialId === credentialId)?.email;

    const {
      integration: updatedCalendarIntegration,
@@ -35,9 +56,10 @@ export class DestinationCalendarsService {
    } = await this.destinationCalendarsRepository.updateCalendar(
      integration,
      externalId,
-      credentialId,
      userId,
-      primaryEmail
+      primaryEmail ?? null,
+      dwdCalendar ? undefined : credentialId,
+      dwdCalendar ? domainWideDelegationCredentialId : undefined
    );

    return {
@@ -0,0 +1,34 @@
+import {
+  GoogleServiceAccountKeyInput,
+  ServiceAccountKeyValidator,
+  MicrosoftServiceAccountKeyInput,
+} from "@/modules/organizations/dwd/inputs/service-account-key.input";
+import { ApiProperty, getSchemaPath } from "@nestjs/swagger";
+import { Expose, Type } from "class-transformer";
+import { IsString, IsNotEmpty, ValidateNested, Validate } from "class-validator";
+
+export class CreateDwdInput {
+  @IsString()
+  @IsNotEmpty()
+  @ApiProperty()
+  @Expose()
+  workspacePlatformSlug!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @ApiProperty()
+  @Expose()
+  domain!: string;
+
+  @Validate(ServiceAccountKeyValidator)
+  @ApiProperty({
+    type: [GoogleServiceAccountKeyInput, MicrosoftServiceAccountKeyInput],
+    oneOf: [
+      { $ref: getSchemaPath(GoogleServiceAccountKeyInput) },
+      { $ref: getSchemaPath(MicrosoftServiceAccountKeyInput) },
+    ],
+  })
+  @Expose()
+  @Type(() => Object)
+  serviceAccountKey!: GoogleServiceAccountKeyInput | MicrosoftServiceAccountKeyInput;
+}
@@ -0,0 +1,99 @@
+import { ApiProperty } from "@nestjs/swagger";
+import { Type, plainToClass, Expose } from "class-transformer";
+import {
+  IsString,
+  IsNotEmpty,
+  ValidationOptions,
+  ValidatorConstraint,
+  ValidatorConstraintInterface,
+  validateSync,
+} from "class-validator";
+
+export class MicrosoftServiceAccountKeyInput {
+  @Expose()
+  @IsString()
+  @IsNotEmpty()
+  @ApiProperty()
+  private_key!: string;
+
+  @Expose()
+  @IsString()
+  @IsNotEmpty()
+  @ApiProperty()
+  tenant_id!: string;
+
+  @Expose()
+  @IsString()
+  @IsNotEmpty()
+  @ApiProperty()
+  client_id!: string;
+}
+
+export class GoogleServiceAccountKeyInput {
+  @Expose()
+  @IsString()
+  @IsNotEmpty()
+  @ApiProperty()
+  private_key!: string;
+
+  @Expose()
+  @IsString()
+  @IsNotEmpty()
+  @ApiProperty()
+  client_email!: string;
+
+  @Expose()
+  @IsString()
+  @IsNotEmpty()
+  @ApiProperty()
+  client_id!: string;
+}
+
+@ValidatorConstraint({ name: "isServiceAccountKey", async: false })
+export class ServiceAccountKeyValidator implements ValidatorConstraintInterface {
+  validate(value: any) {
+    if (!value || typeof value !== "object") return false;
+
+    if ("client_email" in value) {
+      const googleKey = plainToClass(GoogleServiceAccountKeyInput, value, {
+        excludeExtraneousValues: true,
+      });
+      const googleErrors = validateSync(googleKey, {
+        whitelist: true,
+        forbidNonWhitelisted: true,
+        skipMissingProperties: false,
+      });
+
+      if (googleErrors.length === 0) return true;
+      this.errors = googleErrors;
+      return false;
+    }
+
+    if ("tenant_id" in value) {
+      const msKey = plainToClass(MicrosoftServiceAccountKeyInput, value, {
+        excludeExtraneousValues: true,
+      });
+      const msErrors = validateSync(msKey, {
+        whitelist: true,
+        forbidNonWhitelisted: true,
+        skipMissingProperties: false,
+      });
+
+      if (msErrors.length === 0) return true;
+      this.errors = msErrors;
+      return false;
+    }
+
+    return false;
+  }
+
+  private errors?: any[];
+
+  defaultMessage() {
+    if (this.errors?.length) {
+      return this.errors.map((error) => Object.values(error.constraints || {}).join(", ")).join("; ");
+    }
+
+    return "Service account key must be either a Google service account key (with client_email, private_key, client_id) or Microsoft service account key (with tenant_id, private_key, client_id)";
+  }
+}
@@ -0,0 +1,29 @@
+import {
+  GoogleServiceAccountKeyInput,
+  MicrosoftServiceAccountKeyInput,
+  ServiceAccountKeyValidator,
+} from "@/modules/organizations/dwd/inputs/service-account-key.input";
+import { ApiPropertyOptional, getSchemaPath } from "@nestjs/swagger";
+import { Expose, plainToClass, Transform, Type } from "class-transformer";
+import { IsBoolean, IsOptional, Validate, ValidateNested } from "class-validator";
+
+export class UpdateDwdInput {
+  @IsBoolean()
+  @IsOptional()
+  @ApiPropertyOptional()
+  @Expose()
+  enabled?: boolean;
+
+  @IsOptional()
+  @Validate(ServiceAccountKeyValidator)
+  @ApiPropertyOptional({
+    type: [GoogleServiceAccountKeyInput, MicrosoftServiceAccountKeyInput],
+    oneOf: [
+      { $ref: getSchemaPath(GoogleServiceAccountKeyInput) },
+      { $ref: getSchemaPath(MicrosoftServiceAccountKeyInput) },
+    ],
+  })
+  @Expose()
+  @Type(() => Object)
+  serviceAccountKey?: GoogleServiceAccountKeyInput | MicrosoftServiceAccountKeyInput;
+}
@@ -0,0 +1,76 @@
+import { API_VERSIONS_VALUES } from "@/lib/api-versions";
+import { PlatformPlan } from "@/modules/auth/decorators/billing/platform-plan.decorator";
+import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
+import { Roles } from "@/modules/auth/decorators/roles/roles.decorator";
+import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
+import { PlatformPlanGuard } from "@/modules/auth/guards/billing/platform-plan.guard";
+import { IsAdminAPIEnabledGuard } from "@/modules/auth/guards/organizations/is-admin-api-enabled.guard";
+import { IsOrgGuard } from "@/modules/auth/guards/organizations/is-org.guard";
+import { RolesGuard } from "@/modules/auth/guards/roles/roles.guard";
+import { UpdateDwdInput } from "@/modules/organizations/dwd/inputs/update-dwd.input";
+import { CreateDwdOutput } from "@/modules/organizations/dwd/outputs/create-dwd.output";
+import { DwdOutput } from "@/modules/organizations/dwd/outputs/dwd.output";
+import { UpdateDwdOutput } from "@/modules/organizations/dwd/outputs/update-dwd.output";
+import { OrganizationsDwdService } from "@/modules/organizations/dwd/services/organizations-dwd.service";
+import {
+  Controller,
+  UseGuards,
+  Param,
+  ParseIntPipe,
+  Post,
+  Body,
+  HttpCode,
+  HttpStatus,
+  Patch,
+} from "@nestjs/common";
+import { ApiOperation, ApiTags as DocsTags } from "@nestjs/swagger";
+import { User } from "@prisma/client";
+import { plainToClass } from "class-transformer";
+
+import { SUCCESS_STATUS } from "@calcom/platform-constants";
+
+import { CreateDwdInput } from "./inputs/create-dwd.input";
+
+@Controller({
+  path: "/v2/organizations/:orgId/delegation-credentials",
+  version: API_VERSIONS_VALUES,
+})
+@UseGuards(ApiAuthGuard, IsOrgGuard, RolesGuard, PlatformPlanGuard, IsAdminAPIEnabledGuard)
+@DocsTags("Orgs / Delegation Credentials")
+export class OrganizationsDwdController {
+  constructor(private readonly dwdService: OrganizationsDwdService) {}
+
+  @Post("/")
+  @HttpCode(HttpStatus.CREATED)
+  @Roles("ORG_ADMIN")
+  @PlatformPlan("SCALE")
+  @ApiOperation({ summary: "Save delegation credentials for your organization." })
+  async createDwd(
+    @Param("orgId", ParseIntPipe) orgId: number,
+    @GetUser() dwdServiceAccountUser: User,
+    @Body() body: CreateDwdInput
+  ): Promise<CreateDwdOutput> {
+    const dwd = await this.dwdService.createDwd(orgId, dwdServiceAccountUser, body);
+    return {
+      status: SUCCESS_STATUS,
+      data: plainToClass(DwdOutput, dwd, { strategy: "excludeAll" }),
+    };
+  }
+
+  @Patch("/:credentialId")
+  @Roles("ORG_ADMIN")
+  @PlatformPlan("SCALE")
+  @ApiOperation({ summary: "Update delegation credentials of your organization." })
+  async updateDwd(
+    @Param("orgId", ParseIntPipe) orgId: number,
+    @GetUser() dwdServiceAccountUser: User,
+    @Body() body: UpdateDwdInput,
+    @Param("credentialId") credentialId: string
+  ): Promise<UpdateDwdOutput> {
+    const dwd = await this.dwdService.updateDwd(orgId, credentialId, dwdServiceAccountUser, body);
+    return {
+      status: SUCCESS_STATUS,
+      data: plainToClass(DwdOutput, dwd, { strategy: "excludeAll" }),
+    };
+  }
+}
@@ -0,0 +1,17 @@
+import { MembershipsModule } from "@/modules/memberships/memberships.module";
+import { OrganizationsDwdController } from "@/modules/organizations/dwd/organizations-dwd.controller";
+import { OrganizationsDwdRepository } from "@/modules/organizations/dwd/organizations-dwd.repository";
+import { OrganizationsRepository } from "@/modules/organizations/index/organizations.repository";
+import { PrismaModule } from "@/modules/prisma/prisma.module";
+import { RedisModule } from "@/modules/redis/redis.module";
+import { StripeModule } from "@/modules/stripe/stripe.module";
+import { Module } from "@nestjs/common";
+
+import { OrganizationsDwdService } from "./services/organizations-dwd.service";
+
+@Module({
+  imports: [PrismaModule, StripeModule, RedisModule, MembershipsModule],
+  providers: [OrganizationsDwdService, OrganizationsDwdRepository, OrganizationsRepository],
+  controllers: [OrganizationsDwdController],
+})
+export class OrganizationsDwdModule {}
@@ -0,0 +1,28 @@
+import { PrismaReadService } from "@/modules/prisma/prisma-read.service";
+import { Injectable } from "@nestjs/common";
+
+import { Prisma } from "@calcom/prisma/client";
+
+@Injectable()
+export class OrganizationsDwdRepository {
+  constructor(private readonly dbRead: PrismaReadService) {}
+
+  async findById(dwdId: string) {
+    return this.dbRead.prisma.domainWideDelegation.findUnique({ where: { id: dwdId } });
+  }
+
+  async findByIdWithWorkspacePlatform(dwdId: string) {
+    return this.dbRead.prisma.domainWideDelegation.findUnique({
+      where: { id: dwdId },
+      include: { workspacePlatform: true },
+    });
+  }
+
+  async updateIncludeWorkspacePlatform(dwdId: string, data: Prisma.DomainWideDelegationUncheckedUpdateInput) {
+    return this.dbRead.prisma.domainWideDelegation.update({
+      where: { id: dwdId },
+      data,
+      include: { workspacePlatform: true },
+    });
+  }
+}
@@ -0,0 +1,20 @@
+import { DwdOutput } from "@/modules/organizations/dwd/outputs/dwd.output";
+import { ApiProperty } from "@nestjs/swagger";
+import { Type } from "class-transformer";
+import { IsEnum, IsNotEmptyObject, ValidateNested } from "class-validator";
+
+import { SUCCESS_STATUS, ERROR_STATUS } from "@calcom/platform-constants";
+
+export class CreateDwdOutput {
+  @ApiProperty({ example: SUCCESS_STATUS, enum: [SUCCESS_STATUS, ERROR_STATUS] })
+  @IsEnum([SUCCESS_STATUS, ERROR_STATUS])
+  status!: typeof SUCCESS_STATUS | typeof ERROR_STATUS;
+
+  @ApiProperty({
+    type: DwdOutput,
+  })
+  @IsNotEmptyObject()
+  @ValidateNested()
+  @Type(() => DwdOutput)
+  data!: DwdOutput;
+}
@@ -0,0 +1,56 @@
+import { ApiProperty } from "@nestjs/swagger";
+import { Expose, Type } from "class-transformer";
+import { IsBoolean, IsDate, IsInt, IsObject, IsString, ValidateNested } from "class-validator";
+
+class WorkspacePlatformDto {
+  @ApiProperty()
+  @IsString()
+  @Expose()
+  name!: string;
+
+  @ApiProperty()
+  @IsString()
+  @Expose()
+  slug!: string;
+}
+
+export class DwdOutput {
+  @ApiProperty()
+  @IsString()
+  @Expose()
+  id!: string;
+
+  @ApiProperty()
+  @IsBoolean()
+  @Expose()
+  enabled!: boolean;
+
+  @ApiProperty()
+  @IsString()
+  @Expose()
+  domain!: string;
+
+  @ApiProperty()
+  @IsInt()
+  @Expose()
+  organizationId!: number;
+
+  @ApiProperty({ type: WorkspacePlatformDto })
+  @Type(() => WorkspacePlatformDto)
+  @IsObject()
+  @ValidateNested()
+  @Expose()
+  workspacePlatform!: WorkspacePlatformDto;
+
+  @ApiProperty()
+  @Type(() => Date)
+  @IsDate()
+  @Expose()
+  createdAt!: Date;
+
+  @ApiProperty()
+  @Type(() => Date)
+  @IsDate()
+  @Expose()
+  updatedAt!: Date;
+}
@@ -0,0 +1,20 @@
+import { DwdOutput } from "@/modules/organizations/dwd/outputs/dwd.output";
+import { ApiProperty } from "@nestjs/swagger";
+import { Type } from "class-transformer";
+import { IsEnum, IsNotEmptyObject, ValidateNested } from "class-validator";
+
+import { SUCCESS_STATUS, ERROR_STATUS } from "@calcom/platform-constants";
+
+export class UpdateDwdOutput {
+  @ApiProperty({ example: SUCCESS_STATUS, enum: [SUCCESS_STATUS, ERROR_STATUS] })
+  @IsEnum([SUCCESS_STATUS, ERROR_STATUS])
+  status!: typeof SUCCESS_STATUS | typeof ERROR_STATUS;
+
+  @ApiProperty({
+    type: DwdOutput,
+  })
+  @IsNotEmptyObject()
+  @ValidateNested()
+  @Type(() => DwdOutput)
+  data!: DwdOutput;
+}
@@ -0,0 +1,62 @@
+import { CreateDwdInput } from "@/modules/organizations/dwd/inputs/create-dwd.input";
+import {
+  GoogleServiceAccountKeyInput,
+  MicrosoftServiceAccountKeyInput,
+} from "@/modules/organizations/dwd/inputs/service-account-key.input";
+import { UpdateDwdInput } from "@/modules/organizations/dwd/inputs/update-dwd.input";
+import { OrganizationsDwdRepository } from "@/modules/organizations/dwd/organizations-dwd.repository";
+import { DwdOutput } from "@/modules/organizations/dwd/outputs/dwd.output";
+import { Injectable, NotFoundException } from "@nestjs/common";
+import { User } from "@prisma/client";
+
+import { addDwd, toggleDwdEnabled, encryptServiceAccountKey } from "@calcom/platform-libraries";
+
+@Injectable()
+export class OrganizationsDwdService {
+  constructor(private readonly organizationsDwdRepository: OrganizationsDwdRepository) {}
+  async createDwd(orgId: number, dwdServiceAccountUser: User, body: CreateDwdInput) {
+    console.log("asap body", JSON.stringify(body, null, 2));
+    const dwd = await addDwd({
+      input: body,
+      ctx: { user: { id: dwdServiceAccountUser.id, organizationId: orgId } },
+    });
+    return dwd;
+  }
+
+  async updateDwd(orgId: number, dwdId: string, dwdServiceAccountUser: User, body: UpdateDwdInput) {
+    if (body.enabled !== undefined) {
+      await this.updateDwdEnabled(orgId, dwdId, dwdServiceAccountUser, body.enabled);
+    }
+    if (body.serviceAccountKey !== undefined) {
+      await this.updateDwdServiceAccountKey(dwdId, body.serviceAccountKey);
+    }
+    const dwd = await this.organizationsDwdRepository.findByIdWithWorkspacePlatform(dwdId);
+    if (!dwd) {
+      throw new NotFoundException(`DWD with id ${dwdId} not found`);
+    }
+
+    return dwd;
+  }
+
+  async updateDwdEnabled(orgId: number, dwdId: string, dwdServiceAccountUser: User, enabled: boolean) {
+    const handlerUser = {
+      id: dwdServiceAccountUser.id,
+      email: dwdServiceAccountUser.email,
+      organizationId: orgId,
+    };
+    const handlerBody = { id: dwdId, enabled };
+    const dwd = await toggleDwdEnabled(handlerUser, handlerBody);
+    return dwd;
+  }
+
+  async updateDwdServiceAccountKey(
+    dwdId: string,
+    serviceAccountKey: GoogleServiceAccountKeyInput | MicrosoftServiceAccountKeyInput
+  ) {
+    const encryptedServiceAccountKey = encryptServiceAccountKey(serviceAccountKey);
+    const dwd = await this.organizationsDwdRepository.updateIncludeWorkspacePlatform(dwdId, {
+      serviceAccountKey: encryptedServiceAccountKey,
+    });
+    return dwd;
+  }
+}
@@ -11,6 +11,7 @@ import { OrganizationAttributesService } from "@/modules/organizations/attribute
 import { OrganizationAttributeOptionRepository } from "@/modules/organizations/attributes/options/organization-attribute-options.repository";
 import { OrganizationsAttributesOptionsController } from "@/modules/organizations/attributes/options/organizations-attributes-options.controller";
 import { OrganizationAttributeOptionService } from "@/modules/organizations/attributes/options/services/organization-attributes-option.service";
+import { OrganizationsDwdModule } from "@/modules/organizations/dwd/organizations-dwd.module";
 import { OrganizationsEventTypesController } from "@/modules/organizations/event-types/organizations-event-types.controller";
 import { OrganizationsEventTypesRepository } from "@/modules/organizations/event-types/organizations-event-types.repository";
 import { OutputTeamEventTypesResponsePipe } from "@/modules/organizations/event-types/pipes/team-event-types-response.transformer";
@@ -64,6 +65,7 @@ import { Module } from "@nestjs/common";
    EventTypesModule_2024_06_14,
    TeamsEventTypesModule,
    TeamsModule,
+    OrganizationsDwdModule,
    OrganizationsOrganizationsModule,
    OrganizationsTeamsRoutingFormsModule,
  ],
@@ -1,5 +1,3 @@
-import { CalendarsRepository } from "@/ee/calendars/calendars.repository";
-import { CalendarsService } from "@/ee/calendars/services/calendars.service";
 import { API_VERSIONS_VALUES } from "@/lib/api-versions";
 import { GetUser } from "@/modules/auth/decorators/get-user/get-user.decorator";
 import { ApiAuthGuard } from "@/modules/auth/guards/api-auth/api-auth.guard";
@@ -11,7 +9,7 @@ import {
  SelectedCalendarOutputResponseDto,
  SelectedCalendarOutputDto,
 } from "@/modules/selected-calendars/outputs/selected-calendars.output";
-import { SelectedCalendarsRepository } from "@/modules/selected-calendars/selected-calendars.repository";
+import { SelectedCalendarsService } from "@/modules/selected-calendars/services/selected-calendars.service";
 import { UserWithProfile } from "@/modules/users/users.repository";
 import { Body, Controller, Post, UseGuards, Delete, Query } from "@nestjs/common";
 import { ApiOperation, ApiTags as DocsTags } from "@nestjs/swagger";
@@ -25,11 +23,7 @@ import { SUCCESS_STATUS } from "@calcom/platform-constants";
 })
@DocsTags("Selected Calendars")
 export class SelectedCalendarsController {
-  constructor(
-    private readonly calendarsRepository: CalendarsRepository,
-    private readonly selectedCalendarsRepository: SelectedCalendarsRepository,
-    private readonly calendarsService: CalendarsService
-  ) {}
+  constructor(private readonly selectedCalendarsService: SelectedCalendarsService) {}

  @Post("/")
  @UseGuards(ApiAuthGuard)
@@ -38,36 +32,24 @@ export class SelectedCalendarsController {
    @Body() input: SelectedCalendarsInputDto,
    @GetUser() user: UserWithProfile
  ): Promise<SelectedCalendarOutputResponseDto> {
-    const { integration, externalId, credentialId } = input;
-    await this.calendarsService.checkCalendarCredentials(Number(credentialId), user.id);
-
-    const newlyAddedCalendarEntry = await this.selectedCalendarsRepository.addUserSelectedCalendar(
-      user.id,
-      integration,
-      externalId,
-      credentialId
-    );
+    const selectedCalendar = await this.selectedCalendarsService.addSelectedCalendar(user, input);

    return {
      status: SUCCESS_STATUS,
-      data: plainToClass(SelectedCalendarOutputDto, newlyAddedCalendarEntry, { strategy: "excludeAll" }),
+      data: plainToClass(SelectedCalendarOutputDto, selectedCalendar, { strategy: "excludeAll" }),
    };
  }

  @Delete("/")
  @UseGuards(ApiAuthGuard)
  @ApiOperation({ summary: "Delete a selected calendar" })
-  async removeSelectedCalendar(
+  async deleteSelectedCalendar(
    @Query() queryParams: SelectedCalendarsQueryParamsInputDto,
    @GetUser() user: UserWithProfile
  ): Promise<SelectedCalendarOutputResponseDto> {
-    const { integration, externalId, credentialId } = queryParams;
-    await this.calendarsService.checkCalendarCredentials(Number(credentialId), user.id);
-
-    const removedCalendarEntry = await this.selectedCalendarsRepository.removeUserSelectedCalendar(
-      user.id,
-      integration,
-      externalId
+    const removedCalendarEntry = await this.selectedCalendarsService.deleteSelectedCalendar(
+      queryParams,
+      user
    );

    return {
@@ -1,4 +1,4 @@
-import { IsInt, IsString } from "class-validator";
+import { IsInt, IsOptional, IsString } from "class-validator";

 export class SelectedCalendarsInputDto {
  @IsString()
@@ -9,6 +9,10 @@ export class SelectedCalendarsInputDto {

  @IsInt()
  readonly credentialId!: number;
+
+  @IsString()
+  @IsOptional()
+  readonly domainWideDelegationCredentialId?: string;
 }

 export class SelectedCalendarsQueryParamsInputDto {
@@ -20,4 +24,8 @@ export class SelectedCalendarsQueryParamsInputDto {

  @IsString()
  readonly credentialId!: string;
+
+  @IsString()
+  @IsOptional()
+  readonly domainWideDelegationCredentialId?: string;
 }
@@ -2,9 +2,13 @@ import { CalendarsRepository } from "@/ee/calendars/calendars.repository";
 import { CalendarsService } from "@/ee/calendars/services/calendars.service";
 import { AppsRepository } from "@/modules/apps/apps.repository";
 import { CredentialsRepository } from "@/modules/credentials/credentials.repository";
+import { OrganizationsDwdRepository } from "@/modules/organizations/dwd/organizations-dwd.repository";
+import { OrganizationsMembershipRepository } from "@/modules/organizations/memberships/organizations-membership.repository";
+import { OrganizationsMembershipService } from "@/modules/organizations/memberships/services/organizations-membership.service";
 import { PrismaModule } from "@/modules/prisma/prisma.module";
 import { SelectedCalendarsController } from "@/modules/selected-calendars/controllers/selected-calendars.controller";
 import { SelectedCalendarsRepository } from "@/modules/selected-calendars/selected-calendars.repository";
+import { SelectedCalendarsService } from "@/modules/selected-calendars/services/selected-calendars.service";
 import { UsersRepository } from "@/modules/users/users.repository";
 import { Module } from "@nestjs/common";

@@ -17,6 +21,10 @@ import { Module } from "@nestjs/common";
    UsersRepository,
    CredentialsRepository,
    AppsRepository,
+    OrganizationsMembershipService,
+    OrganizationsDwdRepository,
+    OrganizationsMembershipRepository,
+    SelectedCalendarsService,
  ],
  controllers: [SelectedCalendarsController],
  exports: [SelectedCalendarsRepository],
@@ -85,13 +85,19 @@ export class SelectedCalendarsRepository {
    });
  }

-  async removeUserSelectedCalendar(userId: number, integration: string, externalId: string) {
+  async removeUserSelectedCalendar(
+    userId: number,
+    integration: string,
+    externalId: string,
+    domainWideDelegationCredentialId?: string
+  ) {
    // Using deleteMany because userId_externalId_integration_eventTypeId is a unique constraint but with eventTypeId being nullable, causing it to be not used as a unique constraint
    const records = await this.dbWrite.prisma.selectedCalendar.findMany({
      where: {
        userId,
        externalId,
        integration,
+        domainWideDelegationCredentialId,
        ...ensureUserLevelWhere,
      },
    });
@@ -0,0 +1,112 @@
+import { CalendarsService } from "@/ee/calendars/services/calendars.service";
+import { OrganizationsDwdRepository } from "@/modules/organizations/dwd/organizations-dwd.repository";
+import { OrganizationsMembershipService } from "@/modules/organizations/memberships/services/organizations-membership.service";
+import {
+  SelectedCalendarsInputDto,
+  SelectedCalendarsQueryParamsInputDto,
+} from "@/modules/selected-calendars/inputs/selected-calendars.input";
+import { SelectedCalendarsRepository } from "@/modules/selected-calendars/selected-calendars.repository";
+import { UserWithProfile } from "@/modules/users/users.repository";
+import { Injectable, NotFoundException } from "@nestjs/common";
+
+import { SelectedCalendarRepository } from "@calcom/platform-libraries";
+
+type SelectedCalendarsInputDwd = SelectedCalendarsInputDto & { domainWideDelegationCredentialId: string };
+
+@Injectable()
+export class SelectedCalendarsService {
+  constructor(
+    private readonly calendarsService: CalendarsService,
+    private readonly selectedCalendarsRepository: SelectedCalendarsRepository,
+    private readonly organizationsMembershipService: OrganizationsMembershipService,
+    private readonly organizationsDwdRepository: OrganizationsDwdRepository
+  ) {}
+
+  async addSelectedCalendar(user: UserWithProfile, input: SelectedCalendarsInputDto) {
+    if (input.domainWideDelegationCredentialId) {
+      const dwdInput = {
+        ...input,
+        domainWideDelegationCredentialId: input.domainWideDelegationCredentialId,
+      };
+      return this.addSelectedCalendarDwd(user, dwdInput);
+    }
+    return this.addSelectedCalendarUser(user, input);
+  }
+
+  private async addSelectedCalendarUser(user: UserWithProfile, selectedCalendar: SelectedCalendarsInputDto) {
+    const { integration, externalId, credentialId } = selectedCalendar;
+    await this.calendarsService.checkCalendarCredentials(Number(credentialId), user.id);
+
+    const userSelectedCalendar = await this.selectedCalendarsRepository.addUserSelectedCalendar(
+      user.id,
+      integration,
+      externalId,
+      credentialId
+    );
+
+    return userSelectedCalendar;
+  }
+
+  private async addSelectedCalendarDwd(user: UserWithProfile, selectedCalendar: SelectedCalendarsInputDwd) {
+    const isMemberOfOrganization = await this.isMemberOfDwdOrganization(
+      user.id,
+      selectedCalendar.domainWideDelegationCredentialId
+    );
+    if (!isMemberOfOrganization) {
+      throw new NotFoundException("User is not a member of the organization that owns the DWD credential");
+    }
+
+    const { integration, externalId, credentialId, domainWideDelegationCredentialId } = selectedCalendar;
+    const dwdSelectedCalendar = await SelectedCalendarRepository.upsert({
+      userId: user.id,
+      integration,
+      externalId,
+      credentialId,
+      domainWideDelegationCredentialId,
+      eventTypeId: null,
+    });
+    return dwdSelectedCalendar;
+  }
+
+  private async isMemberOfDwdOrganization(userId: number, domainWideDelegationCredentialId: string) {
+    const dwd = await this.organizationsDwdRepository.findById(domainWideDelegationCredentialId);
+    if (!dwd) {
+      throw new NotFoundException("DWD with provided domainWideDelegationCredentialId not found");
+    }
+
+    const isMemberOfOrganization = await this.organizationsMembershipService.getOrgMembershipByUserId(
+      dwd.organizationId,
+      userId
+    );
+
+    return isMemberOfOrganization;
+  }
+
+  async deleteSelectedCalendar(
+    selectedCalendar: SelectedCalendarsQueryParamsInputDto,
+    user: UserWithProfile
+  ) {
+    const { integration, externalId, credentialId, domainWideDelegationCredentialId } = selectedCalendar;
+
+    if (!domainWideDelegationCredentialId) {
+      await this.calendarsService.checkCalendarCredentials(Number(credentialId), user.id);
+    } else {
+      const isMemberOfOrganization = await this.isMemberOfDwdOrganization(
+        user.id,
+        domainWideDelegationCredentialId
+      );
+      if (!isMemberOfOrganization) {
+        throw new NotFoundException("User is not a member of the organization that owns the DWD credential");
+      }
+    }
+
+    const removedCalendarEntry = await this.selectedCalendarsRepository.removeUserSelectedCalendar(
+      user.id,
+      integration,
+      externalId,
+      domainWideDelegationCredentialId
+    );
+
+    return removedCalendarEntry;
+  }
+}
@@ -1091,6 +1091,96 @@
        ]
      }
    },
+    "/v2/organizations/{orgId}/delegation-credentials": {
+      "post": {
+        "operationId": "OrganizationsDwdController_createDwd",
+        "summary": "Save delegation credentials for your organization.",
+        "parameters": [
+          {
+            "name": "orgId",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "number"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateDwdInput"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CreateDwdOutput"
+                }
+              }
+            }
+          }
+        },
+        "tags": [
+          "Orgs / Delegation Credentials"
+        ]
+      }
+    },
+    "/v2/organizations/{orgId}/delegation-credentials/{credentialId}": {
+      "patch": {
+        "operationId": "OrganizationsDwdController_updateDwd",
+        "summary": "Update delegation credentials of your organization.",
+        "parameters": [
+          {
+            "name": "orgId",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "number"
+            }
+          },
+          {
+            "name": "credentialId",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateDwdInput"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UpdateDwdOutput"
+                }
+              }
+            }
+          }
+        },
+        "tags": [
+          "Orgs / Delegation Credentials"
+        ]
+      }
+    },
    "/v2/organizations/{orgId}/teams/{teamId}/event-types": {
      "post": {
        "operationId": "OrganizationsEventTypesController_createTeamEventType",
@@ -5819,7 +5909,7 @@
        ]
      },
      "delete": {
-        "operationId": "SelectedCalendarsController_removeSelectedCalendar",
+        "operationId": "SelectedCalendarsController_deleteSelectedCalendar",
        "summary": "Delete a selected calendar",
        "parameters": [
          {
@@ -5845,6 +5935,14 @@
            "schema": {
              "type": "string"
            }
+          },
+          {
+            "name": "domainWideDelegationCredentialId",
+            "required": false,
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
          }
        ],
        "responses": {
@@ -7980,7 +8078,9 @@
            "example": "cal-video",
            "enum": [
              "cal-video",
-              "google-meet"
+              "google-meet",
+              "office365-video",
+              "zoom"
            ]
          }
        },
@@ -11374,6 +11474,9 @@
          },
          "credentialId": {
            "type": "number"
+          },
+          "domainWideDelegationCredentialId": {
+            "type": "string"
          }
        },
        "required": [
@@ -15018,6 +15121,167 @@
          "data"
        ]
      },
+      "GoogleServiceAccountKeyInput": {
+        "type": "object",
+        "properties": {
+          "private_key": {
+            "type": "string"
+          },
+          "client_email": {
+            "type": "string"
+          },
+          "client_id": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "private_key",
+          "client_email",
+          "client_id"
+        ]
+      },
+      "CreateDwdInput": {
+        "type": "object",
+        "properties": {
+          "workspacePlatformSlug": {
+            "type": "string"
+          },
+          "domain": {
+            "type": "string"
+          },
+          "serviceAccountKey": {
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "$ref": "#/components/schemas/GoogleServiceAccountKeyInput"
+                },
+                {
+                  "$ref": "#/components/schemas/MicrosoftServiceAccountKeyInput"
+                }
+              ]
+            }
+          }
+        },
+        "required": [
+          "workspacePlatformSlug",
+          "domain",
+          "serviceAccountKey"
+        ]
+      },
+      "WorkspacePlatformDto": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "slug": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "slug"
+        ]
+      },
+      "DwdOutput": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "enabled": {
+            "type": "boolean"
+          },
+          "domain": {
+            "type": "string"
+          },
+          "organizationId": {
+            "type": "number"
+          },
+          "workspacePlatform": {
+            "$ref": "#/components/schemas/WorkspacePlatformDto"
+          },
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "updatedAt": {
+            "format": "date-time",
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "enabled",
+          "domain",
+          "organizationId",
+          "workspacePlatform",
+          "createdAt",
+          "updatedAt"
+        ]
+      },
+      "CreateDwdOutput": {
+        "type": "object",
+        "properties": {
+          "status": {
+            "type": "string",
+            "example": "success",
+            "enum": [
+              "success",
+              "error"
+            ]
+          },
+          "data": {
+            "$ref": "#/components/schemas/DwdOutput"
+          }
+        },
+        "required": [
+          "status",
+          "data"
+        ]
+      },
+      "UpdateDwdInput": {
+        "type": "object",
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          },
+          "serviceAccountKey": {
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "$ref": "#/components/schemas/GoogleServiceAccountKeyInput"
+                },
+                {
+                  "$ref": "#/components/schemas/MicrosoftServiceAccountKeyInput"
+                }
+              ]
+            }
+          }
+        }
+      },
+      "UpdateDwdOutput": {
+        "type": "object",
+        "properties": {
+          "status": {
+            "type": "string",
+            "example": "success",
+            "enum": [
+              "success",
+              "error"
+            ]
+          },
+          "data": {
+            "$ref": "#/components/schemas/DwdOutput"
+          }
+        },
+        "required": [
+          "status",
+          "data"
+        ]
+      },
      "CreateOrganizationInput": {
        "type": "object",
        "properties": {
@@ -15619,6 +15883,10 @@
          },
          "credentialId": {
            "type": "number"
+          },
+          "domainWideDelegationCredentialId": {
+            "type": "string",
+            "nullable": true
          }
        },
        "required": [
@@ -15656,6 +15924,10 @@
          },
          "credentialId": {
            "type": "number"
+          },
+          "domainWideDelegationCredentialId": {
+            "type": "string",
+            "nullable": true
          }
        },
        "required": [
@@ -15674,6 +15946,10 @@
          "credentialId": {
            "type": "number"
          },
+          "domainWideDelegationCredentialId": {
+            "type": "string",
+            "nullable": true
+          },
          "primary": {
            "$ref": "#/components/schemas/Primary"
          },
@@ -15717,6 +15993,10 @@
            "type": "number",
            "nullable": true
          },
+          "domainWideDelegationCredentialId": {
+            "type": "string",
+            "nullable": true
+          },
          "name": {
            "type": "string",
            "nullable": true
@@ -18072,6 +18352,9 @@
            "type": "string",
            "example": "https://caldav.icloud.com/26962146906/calendars/1644422A-1945-4438-BBC0-4F0Q23A57R7S/",
            "description": "Unique identifier used to represent the specfic calendar, as returned by the /calendars endpoint"
+          },
+          "domainWideDelegationCredentialId": {
+            "type": "string"
          }
        },
        "required": [