# Brentwood — Third-Party Services & Access Checklist

Everything third-party the current site touches, compiled from the production `.env`, `composer.json`,
`config/services.php`, the site content, and DNS. Use it to request access (to complete integrations)
or just to be aware. Grouped by **what you need to do about it**.

Legend: **[INTEGRATE]** = you'll need working access to build/migrate it · **[AWARENESS]** = stays on
its own system / verify it still works · **[NEW]** = stand up fresh for the WordPress build.

---

## 1. Infrastructure & hosting

| Service | What it is / where | Access to request | Why |
|---|---|---|---|
| **DigitalOcean** | Live droplet `159.203.48.227`, Managed MySQL (`...ondigitalocean.com:25060`), 76 GB block-storage volume | DO team/account access | **[INTEGRATE]** Need it for the new WP hosting + the launch cutover; also where the live data lives. |
| **Domain registrar / DNS** | **Rebel.ca** (`dns.rebel.ca`, `dns2.rebel.ca`) — DNS is here, not Cloudflare | Rebel.ca account login | **[INTEGRATE]** Launch = repoint `brentwood.ca` DNS. Brentwood IT owns this. |
| **Microsoft 365 (Exchange Online)** | MX → `brentwood-ca.mail.protection.outlook.com`; app sends SMTP via `smtp.office365.com` | M365 admin (or an SMTP service account) | **[INTEGRATE/AWARENESS]** WP will need an SMTP sender for form/admin mail; don't break SPF/DNS at cutover. |
| **Mailgun** | In the SPF record + configured as a Laravel mail transport | Mailgun account | **[AWARENESS]** Confirm whether transactional mail goes through it; decide WP's mail path. |
| **Google Workspace** | In SPF (Google sends mail); also the org's Drive/Docs/Calendar/Forms | Workspace admin | **[AWARENESS]** SPF/mail + lots of embedded Google content (see §4). |

## 2. App back-end integrations (the current site has live credentials for these)

| Service | What it does | Access to request | Why |
|---|---|---|---|
| **Google Cloud — OAuth** | "Log in with Google" (`OAUTH_GOOGLE_CLIENT_ID/SECRET/REDIRECT`) | Google Cloud Console project (the one holding this OAuth client) | **[INTEGRATE]** Re-implement Google login on WP → must add the new domain's redirect URIs. |
| **Google Calendar API** | The custom calendar aggregates Google Calendars (Brentwood, Socials, Admissions, Box Office) via `google/apiclient` | The **calendar IDs** + API access (API key / service account / calendar sharing) | **[INTEGRATE]** Needed to rebuild the calendar (custom calendar add-on). |
| **Google Analytics** | Existing GA (`GOOGLE_ANALYTICS_ID`) | GA account access | **[INTEGRATE]** Migrate/upgrade to GA4 (tracking add-on). |
| **MySchool SIS** | The site connects **directly to the MySchool student-information-system database** (`MYSCHOOL_HOST/DB/USER/PASS`) | MySchool admin + DB credentials/contact | **[AWARENESS — important]** Stays on its own system, but confirm what data flows from it into the site and whether WP needs any of it. |
| **Instagram / Facebook Graph API** | Social-media feed (`FB_IG_APP_TOKEN`, `IG_BUSINESS_ID`, `INSTAGRAM_TOKEN`) | Meta Business Manager + the IG Business account | **[INTEGRATE]** Rebuild the social feed (or a plugin) — and this is the same place you'll set up **Meta Pixel** (tracking add-on). |
| **FontAwesome** | Licensed icon kit (`FONTAWESOME_KIT_ID`) | FontAwesome account / kit license | **[AWARENESS]** Reuse the kit on WP or swap for an alternative. |
| **ipdata.co** | Visitor IP geolocation (`IPDATA_TOKEN`, `stevebauman/location`) | ipdata.co account | **[AWARENESS]** Used for geo on the current site; BW Lead AI / journey tracking may want similar. |
| **Pusher / Soketi (self-hosted)** | Real-time websockets for the **chat** feature | (self-hosted on the droplet) | **[AWARENESS]** Chat is being dropped in scope — no action, just know it exists. |
| **"OLD_DB"** | A second/legacy DB connection (`OLD_DB_*`) in the env | Ask Brentwood IT / Mike what it is | **[AWARENESS — confirm]** Possibly the pre-Laravel system; verify it's not needed. |

## 3. Application platform — enrollment / forms

| Service | What it does | Access to request | Why |
|---|---|---|---|
| **FinalSite** | Application/enrollment + the embedded inquiry forms (`brentwood.fsenrollment.ca`) — **embed-only, no public API** | FinalSite admin (co-ordinate via **Tracy**) | **[INTEGRATE — critical]** The discovery call, re-embedding forms, and what tracking is possible all depend on this. |

## 4. Front-end / content embeds (third-party widgets & heavy links in page content)

| Service | Where it shows up | Access to request | Why |
|---|---|---|---|
| **YouTube** | The livestream module + video embeds | Brentwood YouTube channel | **[INTEGRATE]** Confirm channel access for the events-livestream rebuild. |
| **Hudl / HUDL TV** | Sports streaming — **link-out only** (`fan.hudl.com/.../73025`) | Brentwood Hudl org (awareness) | **[AWARENESS]** Just recreate the link/button. |
| **Zoom** (`brentwood.zoom.us`) | Embedded meetings/webinars (1,000+ refs) | Brentwood Zoom admin | **[AWARENESS]** Links/embeds carry over; confirm they still resolve. |
| **Google Drive / Docs / Forms / Sites** | Embedded & linked content (5,000+ Drive refs, Forms `forms.gle`, Sites) | Workspace admin / file-sharing owners | **[AWARENESS]** Verify sharing permissions persist after migration. |
| **POWR.io** | Embedded widgets (`powr.io`) | POWR account | **[AWARENESS]** Confirm if those widgets must keep working. |
| **EBSCO** | Library databases (`research/publications.ebsco.com`) | Library / EBSCO admin | **[AWARENESS]** Mostly links; some may be authenticated. |
| **RegattaCentral / RegattaData** | Rowing/regatta data (`regattacentral.com`, `secure.regattadata.com`) | (awareness) | **[AWARENESS]** Rowing program links/embeds. |

## 5. Other Brentwood platforms (stay on their own systems — per scope exclusions)

These are out of build scope but worth confirming they're untouched at launch:
- **LMS / Moodle**, **giving.brentwood.ca** (advancement/donations), **MailChimp** (parent newsletter).
**[AWARENESS]** — integration touchpoints only.

## 6. NEW accounts/services to stand up for the WordPress build (scope add-ons)

- **[NEW] Google Tag Manager** container — GTM access (Google account).
- **[NEW] GA4** property — Google Analytics (alongside existing GA).
- **[NEW] Meta Pixel** — via the Meta Business Manager above.
- **[NEW] Looker Studio** dashboard — Google.
- **[NEW] Cloudflare (or chosen CDN)** — proposed CDN layer (DNS currently at Rebel, no CF today).
- **[NEW] Caching/optimization** — WP Rocket (license) + image optimization (BW `bw-dev`, or ShortPixel/Imagify).
- **Premium plugin licenses** — Kadence Pro / Blocks Pro, ACF Pro, Gravity Forms (already covered via the template), UpdraftPlus.

---

## Top priority to request first
1. **DigitalOcean** (hosting + the live data) and **Rebel.ca DNS** (launch cutover) — Brentwood IT.
2. **FinalSite** admin (via Tracy) — gates the whole tracking workstream.
3. **Google Cloud project** (OAuth client) + **Google Analytics/Tag Manager** + **Meta Business** — the login + tracking add-ons.
4. **Google Calendar IDs/API** — the calendar rebuild.
5. **MySchool SIS** contact — confirm the data dependency before assuming it's out of scope.

---

## Appendix A — Google Cloud & Calendar specifics

**One Google Cloud project holds it all: `brentwood-cms-274415`.** It contains the calendar service
account, a directory/groups service account, and (almost certainly) the Google-login OAuth client.

| Thing | Identifier | API needed |
|---|---|---|
| GCP project | `brentwood-cms-274415` | — |
| Calendar service account | `sa-calendar-read-only@brentwood-cms-274415.iam.gserviceaccount.com` | Google Calendar API |
| Directory service account | `directory-listing@brentwood-cms-274415.iam.gserviceaccount.com` | Admin SDK (Directory) |
| Impersonated Workspace user | `sa_developer@brentwood.ca` (domain-wide delegation) | — |
| Google login | OAuth 2.0 client (in this project's Credentials) | — |
| SA key files (on live + in repo) | `laravel/sa/calendar.json`, `laravel/sa/directory.json` | — |

**How the calendar reads today:** the calendar SA uses **domain-wide delegation**, impersonating
`sa_developer@brentwood.ca` — which required a **Workspace super-admin** to authorize. BUT at least the
Admissions calendar exposes a **public ICS feed**, so the calendars are (at least partly) public — the
WP rebuild can likely use a plain **Calendar API key** and skip the whole delegation setup.

**Source calendars (confirm the current set with Marketing):**
- Brentwood Calendar / "Upcoming Events": `brentwood.ca_3pgnmrpebak3vo7npopp05gp1c@group.calendar.google.com`
- Socials: `c_hllrl4oo2218oa92jo8sh3d4rs@group.calendar.google.com`
- Admissions: `c_1941a70ed96b81b0cd0b2f381a8ed645c9489c79a81125faecf8b9507906ad1a@group.calendar.google.com`
- Box Office: `c_5e90381c2aed03c46a90906299d473693dea61b1bc460c4f7944a099477d4e75@group.calendar.google.com`
- Athletics (imported): `6ovbh1ibasfak0m7rsvi22n5m8pshqv7@import.calendar.google.com`
- Also seen: LLC, B-Well, Arts, internal "Leave Dates" calendars.

**What to request (for `brentwood.ca.web@gmail.com`):**
1. **IAM Owner (or Editor) on project `brentwood-cms-274415`.** A `@gmail.com` account *can* own/manage
   a GCP project — service accounts, API keys, OAuth client, enabling APIs. This one grant covers
   calendar credentials + editing the Google-login OAuth client (add the new domain's redirect URIs).
2. **Make the source calendars public** (or confirm they already are) → then WP reads them with a simple
   **Calendar API key** (no Workspace admin, no service account). *If any must stay private:* share that
   calendar (See all event details) with `sa-calendar-read-only@brentwood-cms-274415.iam.gserviceaccount.com`
   — works without domain-wide delegation.
3. Ask IT whether there are **other GCP projects** under the brentwood.ca org.

**What you can SKIP:** the **directory/groups SA** (`directory-listing@…`) syncs the old CMS roles from
Workspace groups. WP uses its own simplified roles, so this (and the Workspace super-admin / Admin SDK it
needs) is almost certainly **not** being rebuilt — don't request it unless Adi confirms otherwise.

**Caveat — the `@gmail.com` limit:** that account can fully manage the *GCP project*, but **cannot** be a
`brentwood.ca` **Workspace admin**. Anything needing Workspace admin (domain-wide delegation, the
`sa_developer@` account, Admin SDK/Directory) needs a `@brentwood.ca` super-admin. The public-calendars +
API-key path avoids needing that entirely.

---

## Access status update — 2026-06-15

**Obtained (granted to `rian@rian.ca`):**
- **Google Analytics** — access granted.
- **Google Search Console** — access granted.
- **Google Cloud project that powers the calendar** (`brentwood-cms-274415`, see Appendix A) — access granted.

**Important account note:** these were added to **`rian@rian.ca`**, NOT to the
`brentwood.ca.web@gmail.com` account that Appendix A was written around — **that gmail account isn't
working.** So the "What to request for brentwood.ca.web@gmail.com" plan in Appendix A is superseded for
these three: the access now lives on `rian@rian.ca`. Re-check Appendix A's calendar/OAuth steps against the
`rian@rian.ca` grant (e.g. whether it has the IAM role needed to edit the OAuth client / manage the calendar
service account), since the gmail-account caveats there may no longer apply.