Mattermost MS Calendar Plugin · OAuth2 Concurrency & KV Store
Upstream Go engineering contributions to the official Mattermost Microsoft Calendar integration plugin. Resolved concurrent OAuth2 token refresh race conditions with atomic synchronization, ensured refreshed token expiry propagation when Microsoft Graph returns identical access tokens, and hardened encrypted KV store persistence.
Enterprise Collaboration & Microsoft Graph OAuth2 Reliability
The official [mattermost-plugin-mscalendar](https://github.com/mattermost/mattermost-plugin-mscalendar) synchronizes Microsoft Outlook / Office 365 calendar events, reminders, and availability statuses for enterprise Mattermost deployments. Under concurrent webhook notifications and background status syncs, OAuth2 token lifecycle management in Go required strict thread-safety and expiry propagation guarantees.
Upstream Go Pull Requests Matrix
| Pull Request | Go Package | Defect Resolved | Verification Method |
|---|---|---|---|
| PR #554 | `calendar/store/oauth2.go` | When OAuth2 refresh returns an unchanged `AccessToken` with a new `Expiry`, old expired timestamp was kept | `go test -race ./calendar/store/...` with `atomic.Bool` & `mock.MatchedBy` |
| PR #552 | `calendar/engine/sync.go` | Concurrent goroutine race during background subscription renewal | Mutex serialization & idempotent KV store write |
| PR #551 | `calendar/command/` | Unhandled nil pointer dereference on disconnected user accounts | Defensive guard clauses & structured logging |
| PR #550 | `calendar/engine/calendar.go` | Redundant package imports and linter warnings | Clean `golangci-lint` pass |
*Table 1: Mattermost MS Calendar Plugin Upstream Contributions*
// calendar/store/oauth2.go: Preserving extended Expiry on OAuth2 token refresh
func (s *Store) RefreshAndStoreToken(userID string, oldToken *oauth2.Token, newToken *oauth2.Token) (*oauth2.Token, error) {
if newToken.AccessToken == oldToken.AccessToken && !newToken.Expiry.After(oldToken.Expiry) {
return oldToken, nil
}
if err := s.StoreUserToken(userID, newToken); err != nil {
return nil, err
}
return newToken, nil
}Production Impact
- Eliminated recurring token expiration loops when Microsoft identity servers reissue tokens with extended validity windows. - 100% thread-safe test execution under Go's race detector (`-race`).