4 integration points
1. OIDC SSO
Setup: Google Cloud Console > OAuth 2.0 Client (Web). Redirect URI: https://[tenant].studeia.com/api/auth/sso/[slug]/oidc/callback. Studeia > Settings > SSO > Add Provider > OIDC. Discovery URL: https://accounts.google.com/.well-known/openid-configuration. JIT provisioning.
2. Google Drive
Same OAuth Client + enable Drive API and Google Picker API (plus a browser API key restricted to the Picker API). Scope: drive.file (non-sensitive — only files Studeia creates + files the user picks via the Google Picker). We do NOT use the restricted drive scope (CASA assessment + annual recertification). Operations: import (via Google Picker), export, backup. Automatic folder/bidirectional sync exists only for OneDrive; on Google, import via the Picker. Cron /api/cron/drive-sync.
3. Google Calendar
Same Client + enable Calendar API. When admin creates LiveClass → Calendar event created for all class students. Schedule changes update event.
4. Google Meet (video provider)
Same Client + Meet REST API v2. LiveClass created with videoProvider=google_meet. Student joins via joinMethod=external (new tab). Limitation: endMeeting NOT supported via API (marks as completed locally). Recording started manually by host.
Setup (30 min)
- Enable 4 APIs in Google Cloud Console (5min)
- Create OAuth 2.0 Client (3min)
- Configure SSO in Studeia (5min)
- Connect Drive + Calendar + Meet (10min)
- Validate with test user (5min)
- Communicate to teachers/students (2min)
LGPD considerations
OAuth tokens AES-256-GCM encrypted. OAuth state HMAC-SHA256 + Redis nonce 15min anti-replay. Drive sync respects minimum scopes.