Skip to content

Conversation

@pontusab
Copy link
Contributor

@pontusab pontusab commented Dec 30, 2025

Note

Enables Google Drive as an inbox source with a complete OAuth flow and folder-based import of receipts/invoices.

  • API: New apps/google-drive router with install-url, oauth-callback, folders (lists top-level folders), and select-folder (persists metadata.folderId/folderName and triggers initial-setup) endpoints; mounted in apps router
  • Inbox provider: New GoogleDriveProvider implements OAuth, token refresh, folder listing, and getAttachments to download supported files (PDF/images <=10MB) from a selected folder; integrated into InboxConnector
  • DB/schema: Adds google_drive to inbox_account_providers, introduces inbox_accounts.metadata JSONB, and plumbs metadata through queries and schema
  • Dashboard UI: New ConnectGoogleDrive component to start OAuth, fetch folders, and submit folder selection; adds Icons.GoogleDrive
  • App store: Updates Google Drive app config (category to Inbox, active, description, image, settings.installUrl)

Written by Cursor Bugbot for commit 1dd34ac. This will update automatically on new commits. Configure here.

teamId: session.teamId,
provider: "google_drive",
source: "apps",
});
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OAuth state validation rejects google_drive provider

The decryptOAuthState function validates that the provider is one of ["gmail", "outlook"], but the Google Drive install URL code passes provider: "google_drive". When the OAuth callback attempts to decrypt and validate the state, it will return null because "google_drive" isn't in the allowed providers list. This completely breaks the Google Drive OAuth flow—users will always see an "Invalid or expired state" error after authorizing.

Fix in Cursor Fix in Web

accessToken: encrypt(tokens.access_token),
expiryDate: new Date(tokens.expiry_date!).toISOString(),
});
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-null assertion on potentially undefined expiry_date

The token refresh callback uses tokens.expiry_date! with a non-null assertion, but Google's OAuth library can return tokens where expiry_date is null or undefined even when access_token is present. If expiry_date is undefined, new Date(undefined) creates an Invalid Date object, and calling .toISOString() on it throws a RangeError. This could cause token refresh operations to fail unexpectedly.

Fix in Cursor Fix in Web

@pontusab pontusab closed this Jan 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants