Adding 2nd Gmail address leads to endless spinner

[yazzbert]

Whenever I try to add a second Gmail address through the integrations function, I receive an endless "loading spinner" after going through the Authorization process.

In progress...
Scanning for invoices...

I've tried to delete the integration and reauthenticate. I've tried pausing and resuming the sync. Nothing seems to work.

[felixtosh]

Same root cause as #44 — and the endless "In progress / Scanning for invoices..." spinner is actually a UI bug on top of it.

Here's what was happening:

1. You authorized the 2nd Gmail account. The OAuth flow completed successfully on Google's side, but because our app's verification for gmail.readonly was rejected on 2026-06-09 (90-day no-response timeout), Google silently issued a token without the Gmail scope — same as in Can't pull new emails from Gmail integration #44.
2. The initial sync queue item ran and immediately hit a Gmail 403 Insufficient Permission. That should have flipped the integration to "needs reconnect"…
3. …but our queue processor was only catching token-expired-style errors as reauth-required. A 403 with reason: insufficientPermissions was getting recorded as lastSyncError while leaving needsReauth: false and initialSyncComplete: false.
4. The UI computed isSyncingNow = !isPaused && (activeSync.isActive || (!initialSyncComplete && initialSyncStartedAt)), which was true, so it kept showing the spinner indefinitely. Your yazzbert@gmail.com integration's initialSyncComplete had been false since 2026-02-15 for exactly this reason.

Fixes in PR #46:

• The queue processor now detects insufficientPermissions 403s and flips needsReauth: true (so the UI prompts Reconnect instead of looping).
• The integration card derives isStuckInitialSync when initialSyncComplete=false + lastSyncError + initialSyncStartedAt > 24h ago, and renders the Reconnect Required badge in that case — so even if a new sync somehow fails to set the flag, the UI no longer lies.
• The OAuth callback validates gmail.readonly is in the granted scopes before saving, so future "add 2nd Gmail" attempts that lose the scope upstream get a clear error instead of silently entering this stuck state.
• Both your integrations have been flagged needsReauth: true directly so the UI surfaces Reconnect right away.

What still needs to happen (same as #44): add both your emails to the OAuth consent screen Test Users list, and resubmit the OAuth verification with the CASA Tier 2 docs. I'll ping you when test-users is set so you can revoke + reconnect both addresses.

Will close this once you've successfully added a 2nd Gmail and seen the initial sync complete.