Repository navigation
Recover Google sessions with silent Gmail token refresh - #40
bcbetterninja wants to merge 1 commit into
Conversation
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughGoogle authentication now shares access-token refresh logic and classifies OAuth errors. Gmail requests retry once after a 401. Tests cover token reuse, refresh, error handling, retry limits and concurrent requests. The README documents these behaviours and refresh-token expiry guidance. ChangesGoogle authentication and Gmail requests
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Bug fix Sequence Diagram(s)sequenceDiagram
participant GoogleGmailProvider
participant GoogleAuthService
participant GmailAPI
participant GoogleOAuthEndpoint
participant TokenStore
GoogleGmailProvider->>GoogleAuthService: Get access token
GoogleGmailProvider->>GmailAPI: Send request with access token
GmailAPI-->>GoogleGmailProvider: Return 401
GoogleGmailProvider->>GoogleAuthService: Refresh rejected access token
GoogleAuthService->>GoogleOAuthEndpoint: Submit refresh token
GoogleOAuthEndpoint-->>GoogleAuthService: Return replacement access token
GoogleAuthService->>TokenStore: Save refreshed token
GoogleGmailProvider->>GmailAPI: Retry request once
Suggested reviewers: Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 3 files. (1 skipped: 1… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: silent Gmail token refresh to recover Google sessions.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 3 files. (1 skipped: 1 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
- Fix all pre-merge checks with AI
✨ Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit watched the tokens renew,
Then saw one retry go through.
The refresh stayed shared,
The old token was spared,
And the Gmail requests hopped anew.
Comment @coderabbitai help to get the list of available commands.
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
1 participant
Gmail requests previously surfaced an authentication error when Google rejected an access token that still appeared valid locally. Refresh failures also told users to reauthenticate for any HTTP 400/401, including OAuth client configuration problems.
Retry a Gmail request once after an explicit 401 using a silently refreshed token. Concurrent rejected requests reuse the new saved token, replacement refresh tokens are persisted, and only an invalid refresh grant prompts reauthentication. Permission and service errors are not retried. Document Google's seven-day refresh-token limit for external OAuth apps in Testing; BetterMail's actual OAuth publishing status remains unverified.
Validation: solution build passes with no warnings or errors; all 674 tests pass against current master, including the merged Tunnels/Web changes. The 13 new authentication regression cases cover cached and rotated tokens, OAuth error classification, replayed request bodies, bounded retries, and concurrent 401 recovery. Seven cases reproduced failures before the fix.
This PR covers Google authentication reliability. Gmail push delivery still requires Cloud Pub/Sub provisioning and authenticated routing; it is not enabled by this change. No live-account or cloud configuration changes were made.
Summary by CodeRabbit