fix: a Google token refresh with no answer is not a rejection

Merged
EV
1d ago
+268-7

Description

A Google OAuth or service-account token refresh that gets no answer from Google is no longer read as a rejected credential.

  • google_auth.py has a new GoogleUnreachableError(ConnectionError). Transport errors, connection errors and timeouts during the refresh raise it, with the original error as its cause. A refresh that Google rejects (RefreshError, e.g. invalid_grant) still returns None, then PermissionError, as before.
  • Drive: sign-in now reads "Cannot reach Google Drive" or "Sign-in timed out". That is FAILED on a form run and INCOMPLETE on a stored run, through the handler from #16255. Drive needed no other change.
  • Gmail (generic row): "Cannot reach the source", where it used to read "Unexpected response".
  • GET /admin/connector/google-drive/check-auth/{id}: no answer from Google returns OnyxError(BAD_GATEWAY), not authenticated=false. A rejected token still returns authenticated=false.

For review: after google-auth's own retries, a 5xx from Google's token endpoint arrives as RefreshError(retryable=True) and still reads as rejected.

How Has This Been Tested?

New test_google_token_refresh_errors.py. It covers:

  • a refresh with no answer;
  • a timeout that stays detectable;
  • a rejected refresh;
  • the service-account path;
  • Gmail's row;
  • check-auth's 502 and authenticated=false.

Also Drive sign-in row tests and the gateway pass-through test. The google_utils, google_drive and gmail unit tests pass.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.
  • [Optional] Override Linear Check

🤖 Generated with Claude Code

Summary by cubic

A Google token refresh that gets no answer from Google, or only a server error, is no longer treated as a rejected credential; it now surfaces as an unreachable error. A refresh Google rejects still behaves as before.

What changed

  • A refresh with no answer or a token-endpoint 5xx (which google-auth surfaces as a retryable RefreshError) now raises GoogleUnreachableError; a rejected refresh still returns None and later raises PermissionError.
  • Drive sign-in reports "Cannot reach Google Drive" or "Sign-in timed out" (FAILED on a form run, INCOMPLETE on a stored run); Gmail's generic row reports "Cannot reach the source" instead of "Unexpected response".
  • GET /admin/connector/google-drive/check-auth/{id} returns OnyxError(BAD_GATEWAY) on no answer, not authenticated=false.

Summary by CodeRabbit

  • Bug Fixes
    • Improved Google authentication error handling by distinguishing temporary connectivity issues from invalid or rejected credentials.
    • Google service interruptions now produce clearer gateway or unreachable-service errors instead of authentication failures.
    • Improved timeout reporting during Google Drive sign-in and validation.
    • Invalid or expired credentials continue to receive appropriate authentication errors.
    • Google Drive operations now preserve accurate error details when authentication services are temporarily unavailable.