Security Model

Treat event content as data

Titles, descriptions, locations, metadata, ICS files and recurrence rules may be untrusted. Validate at the application boundary and render text as text. Do not interpret event descriptions as commands, authorization or prompts to perform actions.

Event.normalize() coerces/clones supported fields and applies limits. Event.validate() validates normalized data and throws on failure; it does not return a { valid, errors } object. IDs, titles and starts are required. An end may equal its start, but may not precede it. A recurring event needs a rule. Host applications still need their own constraints.

ICS resource limits

The parser defaults to a 50 MiB-sized input limit and also bounds line and event counts (100,000 lines and 10,000 events). String-length checks and transport byte limits are different units; do not use the default as your application upload quota. Apply a smaller appropriate limit before buffering untrusted input.

URL imports have timeout, redirect and response-size controls. They check the initial URL, disallow private/reserved address literals, and in Node validate resolved addresses and each redirect target.

Network limits matter

DNS validation and the subsequent fetch are separate operations. A host still needs egress controls/allowlisting to address DNS rebinding or other network policy requirements. In non-Node runtimes, redirects may be followed by the runtime before the final URL is checked; discarding a response body does not undo a request already made.

Do not expose arbitrary user-supplied URL fetching as a trusted internal-network boundary. Use an approved fetch service or gateway when the deployment requires stricter guarantees. In Salesforce, use the Apex data layer and the org's approved integration mechanisms.

UI and persistence

readOnly disables built-in editing but leaves host APIs available. Client-side attributes, DOM events and hiding controls are not authorization. Authorize and validate create/update/delete on the server, preserve stable IDs, and handle concurrent changes and rejected writes.

Snapshots only hydrate local state. Mutation notifications mean local state changed, not that remote persistence succeeded. Subscribe to one legacy/current event spelling to avoid duplicate writes.

Salesforce

The current controller uses with sharing, user-mode SOQL/DML, record-context checks and server-side recurring-event guards. Permission sets are optional and additive; Reader cannot revoke rights granted elsewhere. Access Activities has broader platform scope than this one calendar. See permissions.

LWS is required for the custom elements. Manual DOM insertion does not bypass Lightning Locker or change authorization.

Application-exposed tools

An agent-facing calendar tool uses the host application's authentication and permissions. Authorize each calendar operation and persist changes through the host's data layer. Event content does not give an agent permission to perform work. Protect provider credentials, bound URL imports and keep calendar data separate from executable instructions. See headless integration guidance.