Surface a dead OAuth grant instead of reporting it as connected

With the cancelled-context bug fixed, the refresh actually reaches Google and
the real state of the Google Tasks grant becomes visible: it answers
invalid_grant. The stored refresh token has been dead since roughly 2026-08-16.
The earlier bug had been masking this — the refresh never got far enough to be
rejected.

Settings treated the presence of a token row as "Connected", so it reported
Google Tasks as connected for a month while every fetch failed. A refresh
failure is now persisted (migration 035 adds last_error/last_error_at to
oauth_tokens) and cleared on the next success, and settings reports "connected"
only when there is no recorded failure.

invalid_grant is classified specially, because it is the one failure retrying
cannot fix: the message tells the user to reconnect, and notes that a weekly
recurrence means the OAuth client is still in Testing publishing status, where
Google expires refresh tokens after seven days. Other errors — a network blip,
a 5xx — are left as transient rather than pushing the user through consent
needlessly.

Reconnecting at /settings is still a manual step; nothing here can perform
consent on the user's behalf.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018AwnALZL6bD4VBtATDVv3B

1 files changed, 19 insertions, 2 deletions

diff --git a/internal/handlers/settings.go b/internal/handlers/settings.go
index d6d78c0..fd63518 100644
--- a/internal/handlers/settings.go
+++ b/internal/handlers/settings.go
@@ -23,6 +23,10 @@ func (h *Handler) HandleSettingsPage(w http.ResponseWriter, r *http.Request) {
 	}
 
 	googleTasksToken, _ := h.store.GetOAuthToken(api.GoogleTasksOAuthSource)
+	// A stored row is not the same as a working grant: an invalid_grant refresh
+	// failure leaves the row in place while every fetch fails. Treat a recorded
+	// error as "needs reconnecting" rather than showing a reassuring "Connected".
+	googleTasksStatus, _ := h.store.GetOAuthTokenStatus(api.GoogleTasksOAuthSource)
 	icsFeeds, _ := h.store.GetICSFeeds()
 
 	data := struct {
@@ -44,9 +48,12 @@ func (h *Handler) HandleSettingsPage(w http.ResponseWriter, r *http.Request) {
 		CSRFToken:             auth.GetCSRFTokenFromContext(r.Context()),
 		WebAuthnEnabled:       h.WebAuthnEnabled,
 		GoogleTasksOAuthReady: h.googleTasksOAuthConfig != nil,
-		GoogleTasksConnected:  googleTasksToken != nil,
+		GoogleTasksConnected:  googleTasksToken != nil && googleTasksStatus.LastError == "",
 		Feeds:                 toICSFeedViews(icsFeeds),
-		GoogleTasksError:      r.URL.Query().Get("google_tasks_error"),
+		GoogleTasksError: firstNonEmpty(
+			r.URL.Query().Get("google_tasks_error"),
+			googleTasksStatus.LastError,
+		),
 	}
 
 	if err := h.renderer.Render(w, "settings.html", data); err != nil {
@@ -160,3 +167,13 @@ func (h *Handler) HandleToggleSourceConfig(w http.ResponseWriter, r *http.Reques
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]bool{"enabled": enabled})
 }
+
+// firstNonEmpty returns the first non-empty string, or "".
+func firstNonEmpty(values ...string) string {
+	for _, v := range values {
+		if v != "" {
+			return v
+		}
+	}
+	return ""
+}