From 6431cad59bda3da4bafb58fdf91f6a946e42af43 Mon Sep 17 00:00:00 2001 From: Peter Stone Date: Sun, 20 Sep 2026 17:44:02 +0000 Subject: Surface a dead OAuth grant instead of reporting it as connected MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With the cancelled-context bug fixed, the refresh actually reaches Google and the real state of the Google Tasks grant becomes visible: it answers invalid_grant. The stored refresh token has been dead since roughly 2026-08-16. The earlier bug had been masking this — the refresh never got far enough to be rejected. Settings treated the presence of a token row as "Connected", so it reported Google Tasks as connected for a month while every fetch failed. A refresh failure is now persisted (migration 035 adds last_error/last_error_at to oauth_tokens) and cleared on the next success, and settings reports "connected" only when there is no recorded failure. invalid_grant is classified specially, because it is the one failure retrying cannot fix: the message tells the user to reconnect, and notes that a weekly recurrence means the OAuth client is still in Testing publishing status, where Google expires refresh tokens after seven days. Other errors — a network blip, a 5xx — are left as transient rather than pushing the user through consent needlessly. Reconnecting at /settings is still a manual step; nothing here can perform consent on the user's behalf. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_018AwnALZL6bD4VBtATDVv3B --- internal/handlers/settings.go | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) (limited to 'internal/handlers/settings.go') diff --git a/internal/handlers/settings.go b/internal/handlers/settings.go index d6d78c0..fd63518 100644 --- a/internal/handlers/settings.go +++ b/internal/handlers/settings.go @@ -23,6 +23,10 @@ func (h *Handler) HandleSettingsPage(w http.ResponseWriter, r *http.Request) { } googleTasksToken, _ := h.store.GetOAuthToken(api.GoogleTasksOAuthSource) + // A stored row is not the same as a working grant: an invalid_grant refresh + // failure leaves the row in place while every fetch fails. Treat a recorded + // error as "needs reconnecting" rather than showing a reassuring "Connected". + googleTasksStatus, _ := h.store.GetOAuthTokenStatus(api.GoogleTasksOAuthSource) icsFeeds, _ := h.store.GetICSFeeds() data := struct { @@ -44,9 +48,12 @@ func (h *Handler) HandleSettingsPage(w http.ResponseWriter, r *http.Request) { CSRFToken: auth.GetCSRFTokenFromContext(r.Context()), WebAuthnEnabled: h.WebAuthnEnabled, GoogleTasksOAuthReady: h.googleTasksOAuthConfig != nil, - GoogleTasksConnected: googleTasksToken != nil, + GoogleTasksConnected: googleTasksToken != nil && googleTasksStatus.LastError == "", Feeds: toICSFeedViews(icsFeeds), - GoogleTasksError: r.URL.Query().Get("google_tasks_error"), + GoogleTasksError: firstNonEmpty( + r.URL.Query().Get("google_tasks_error"), + googleTasksStatus.LastError, + ), } if err := h.renderer.Render(w, "settings.html", data); err != nil { @@ -160,3 +167,13 @@ func (h *Handler) HandleToggleSourceConfig(w http.ResponseWriter, r *http.Reques w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]bool{"enabled": enabled}) } + +// firstNonEmpty returns the first non-empty string, or "". +func firstNonEmpty(values ...string) string { + for _, v := range values { + if v != "" { + return v + } + } + return "" +} -- cgit v1.2.3