@open-mercato/channel-gmail 0.10.1-develop.7776.1.3032ea0741 → 0.10.1-develop.7781.1.079f42c863

package/dist/modules/channel_gmail/lib/credentials.js

@@ -21,7 +21,7 @@ const gmailUserCredentialsSchema = z.object({
   scopes: z.array(z.string()).optional(),
   /** Email address from the linked Google account. */
   email: z.string().email().optional()
-}).passthrough();
+}).strip();
 const gmailChannelStateSchema = z.object({
   historyId: z.union([z.string(), z.number()]).optional(),
   lastSyncedAt: z.string().datetime().optional(),

package/dist/modules/channel_gmail/lib/credentials.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/channel_gmail/lib/credentials.ts"],
-  "sourcesContent": ["import { z } from 'zod'\n\n/**\n * Tenant-level OAuth client configuration. Stored on `IntegrationCredentials`\n * for the `gmail` provider when the tenant has set up their own Google Cloud\n * project. Per-user OAuth tokens layer on top via `userCredentialsSchema`.\n */\nexport const gmailClientCredentialsSchema = z\n  .object({\n    clientId: z.string().min(1, 'OAuth Client ID required'),\n    clientSecret: z.string().min(1, 'OAuth Client Secret required'),\n    /** Comma-separated scopes; blank uses defaults. */\n    scopes: z.string().optional(),\n  })\n  .strict()\n\nexport type GmailClientCredentials = z.infer<typeof gmailClientCredentialsSchema>\n\n/**\n * Per-user OAuth tokens stored on `CommunicationChannel.credentials` (encrypted).\n * The hub injects the tenant client_id / client_secret at exchange/refresh time;\n * the per-channel blob only persists the user-bound tokens.\n */\nexport const gmailUserCredentialsSchema = z\n  .object({\n    accessToken: z.string({ error: 'Access token required' }).min(1, 'Access token required'),\n    /**\n     * Gmail issues a refresh token only on the first consent. If the user\n     * re-authorises, Google does NOT send a new refresh token unless we pass\n     * `prompt=consent` and `access_type=offline`; we always do. We still mark\n     * the field optional so legacy migrations from accounts that never received\n     * one don't fail the schema \u2014 the runtime treats absence as \"requires_reauth\".\n     */\n    refreshToken: z.string().optional(),\n    /** ISO timestamp of access-token expiry. */\n    expiresAt: z.string().datetime().optional(),\n    /** Scopes that were actually granted (we may have requested a subset). */\n    scopes: z.array(z.string()).optional(),\n    /** Email address from the linked Google account. */\n    email: z.string().email().optional(),\n  })\n  .passthrough()\n\nexport type GmailUserCredentials = z.infer<typeof gmailUserCredentialsSchema>\n\n/**\n * Per-channel sync state stored on `CommunicationChannel.channelState`.\n *\n *   historyId \u2014 Gmail's per-mailbox monotonic cursor used by `history.list`\n *               to fetch only changes since the previous poll. If history has\n *               expired (Gmail keeps roughly 7 days), we fall back to a full\n *               list using `gmail.users.messages.list`.\n *\n *   pendingHistoryPageToken \u2014 mid-drain resumption state when a single tick\n *               can't ingest every page of `history.list` (e.g. a high-volume\n *               mailbox returned more than our per-tick budget). The terminal\n *               `historyId` is NOT advanced until the pages drain. The next tick\n *               resumes via the stored `historyId` + this `pageToken`.\n *\n *   pendingMessagesPageToken / pendingMessagesHistoryIdSnapshot \u2014 same\n *               contract for the 404-fallback path (`messages.list`).\n *\n * See https://developers.google.com/gmail/api/guides/sync for the contract.\n */\nexport const gmailChannelStateSchema = z\n  .object({\n    historyId: z.union([z.string(), z.number()]).optional(),\n    lastSyncedAt: z.string().datetime().optional(),\n    pendingHistoryPageToken: z.string().optional(),\n    pendingMessagesPageToken: z.string().optional(),\n    pendingMessagesHistoryIdSnapshot: z.string().optional(),\n  })\n  .partial()\n  .passthrough()\n\nexport type GmailChannelState = z.infer<typeof gmailChannelStateSchema>\n\nexport const GMAIL_DEFAULT_SCOPES = [\n  'https://www.googleapis.com/auth/gmail.modify',\n  'https://www.googleapis.com/auth/userinfo.email',\n  'https://www.googleapis.com/auth/userinfo.profile',\n]\n\nexport function parseScopes(value: string | undefined): string[] {\n  if (!value || !value.trim()) return [...GMAIL_DEFAULT_SCOPES]\n  return value\n    .split(/[\\s,]+/)\n    .map((s) => s.trim())\n    .filter((s) => s.length > 0)\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAOX,MAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,0BAA0B;AAAA,EACtD,cAAc,EAAE,OAAO,EAAE,IAAI,GAAG,8BAA8B;AAAA;AAAA,EAE9D,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC,EACA,OAAO;AASH,MAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,OAAO,wBAAwB,CAAC,EAAE,IAAI,GAAG,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxF,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE1C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAErC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AACrC,CAAC,EACA,YAAY;AAuBR,MAAM,0BAA0B,EACpC,OAAO;AAAA,EACN,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,EACtD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,0BAA0B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,kCAAkC,EAAE,OAAO,EAAE,SAAS;AACxD,CAAC,EACA,QAAQ,EACR,YAAY;AAIR,MAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,YAAY,OAAqC;AAC/D,MAAI,CAAC,SAAS,CAAC,MAAM,KAAK,EAAG,QAAO,CAAC,GAAG,oBAAoB;AAC5D,SAAO,MACJ,MAAM,QAAQ,EACd,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/B;",
+  "sourcesContent": ["import { z } from 'zod'\n\n/**\n * Tenant-level OAuth client configuration. Stored on `IntegrationCredentials`\n * for the `gmail` provider when the tenant has set up their own Google Cloud\n * project. Per-user OAuth tokens layer on top via `userCredentialsSchema`.\n */\nexport const gmailClientCredentialsSchema = z\n  .object({\n    clientId: z.string().min(1, 'OAuth Client ID required'),\n    clientSecret: z.string().min(1, 'OAuth Client Secret required'),\n    /** Comma-separated scopes; blank uses defaults. */\n    scopes: z.string().optional(),\n  })\n  .strict()\n\nexport type GmailClientCredentials = z.infer<typeof gmailClientCredentialsSchema>\n\n/**\n * Per-user OAuth tokens stored on `CommunicationChannel.credentials` (encrypted).\n * The hub injects the tenant client_id / client_secret at exchange/refresh time;\n * the per-channel blob only persists the user-bound tokens.\n */\nexport const gmailUserCredentialsSchema = z\n  .object({\n    accessToken: z.string({ error: 'Access token required' }).min(1, 'Access token required'),\n    /**\n     * Gmail issues a refresh token only on the first consent. If the user\n     * re-authorises, Google does NOT send a new refresh token unless we pass\n     * `prompt=consent` and `access_type=offline`; we always do. We still mark\n     * the field optional so legacy migrations from accounts that never received\n     * one don't fail the schema \u2014 the runtime treats absence as \"requires_reauth\".\n     */\n    refreshToken: z.string().optional(),\n    /** ISO timestamp of access-token expiry. */\n    expiresAt: z.string().datetime().optional(),\n    /** Scopes that were actually granted (we may have requested a subset). */\n    scopes: z.array(z.string()).optional(),\n    /** Email address from the linked Google account. */\n    email: z.string().email().optional(),\n  })\n  .strip()\n\nexport type GmailUserCredentials = z.infer<typeof gmailUserCredentialsSchema>\n\n/**\n * Per-channel sync state stored on `CommunicationChannel.channelState`.\n *\n *   historyId \u2014 Gmail's per-mailbox monotonic cursor used by `history.list`\n *               to fetch only changes since the previous poll. If history has\n *               expired (Gmail keeps roughly 7 days), we fall back to a full\n *               list using `gmail.users.messages.list`.\n *\n *   pendingHistoryPageToken \u2014 mid-drain resumption state when a single tick\n *               can't ingest every page of `history.list` (e.g. a high-volume\n *               mailbox returned more than our per-tick budget). The terminal\n *               `historyId` is NOT advanced until the pages drain. The next tick\n *               resumes via the stored `historyId` + this `pageToken`.\n *\n *   pendingMessagesPageToken / pendingMessagesHistoryIdSnapshot \u2014 same\n *               contract for the 404-fallback path (`messages.list`).\n *\n * See https://developers.google.com/gmail/api/guides/sync for the contract.\n */\nexport const gmailChannelStateSchema = z\n  .object({\n    historyId: z.union([z.string(), z.number()]).optional(),\n    lastSyncedAt: z.string().datetime().optional(),\n    pendingHistoryPageToken: z.string().optional(),\n    pendingMessagesPageToken: z.string().optional(),\n    pendingMessagesHistoryIdSnapshot: z.string().optional(),\n  })\n  .partial()\n  .passthrough()\n\nexport type GmailChannelState = z.infer<typeof gmailChannelStateSchema>\n\nexport const GMAIL_DEFAULT_SCOPES = [\n  'https://www.googleapis.com/auth/gmail.modify',\n  'https://www.googleapis.com/auth/userinfo.email',\n  'https://www.googleapis.com/auth/userinfo.profile',\n]\n\nexport function parseScopes(value: string | undefined): string[] {\n  if (!value || !value.trim()) return [...GMAIL_DEFAULT_SCOPES]\n  return value\n    .split(/[\\s,]+/)\n    .map((s) => s.trim())\n    .filter((s) => s.length > 0)\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAOX,MAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,0BAA0B;AAAA,EACtD,cAAc,EAAE,OAAO,EAAE,IAAI,GAAG,8BAA8B;AAAA;AAAA,EAE9D,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC,EACA,OAAO;AASH,MAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,OAAO,wBAAwB,CAAC,EAAE,IAAI,GAAG,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxF,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE1C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAErC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AACrC,CAAC,EACA,MAAM;AAuBF,MAAM,0BAA0B,EACpC,OAAO;AAAA,EACN,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,EACtD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,0BAA0B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,kCAAkC,EAAE,OAAO,EAAE,SAAS;AACxD,CAAC,EACA,QAAQ,EACR,YAAY;AAIR,MAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,YAAY,OAAqC;AAC/D,MAAI,CAAC,SAAS,CAAC,MAAM,KAAK,EAAG,QAAO,CAAC,GAAG,oBAAoB;AAC5D,SAAO,MACJ,MAAM,QAAQ,EACd,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/B;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/channel-gmail",
-  "version": "0.10.1-develop.7776.1.3032ea0741",
+  "version": "0.10.1-develop.7781.1.079f42c863",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,19 +62,19 @@
     }
   },
   "dependencies": {
-    "@open-mercato/core": "0.10.1-develop.7776.1.3032ea0741",
-    "@open-mercato/ui": "0.10.1-develop.7776.1.3032ea0741",
+    "@open-mercato/core": "0.10.1-develop.7781.1.079f42c863",
+    "@open-mercato/ui": "0.10.1-develop.7781.1.079f42c863",
     "@types/mailparser": "^3.4.5",
     "mailparser": "^3.9.17"
   },
   "peerDependencies": {
     "@mikro-orm/postgresql": "^7.0.14",
-    "@open-mercato/shared": "0.10.1-develop.7776.1.3032ea0741",
+    "@open-mercato/shared": "0.10.1-develop.7781.1.079f42c863",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7776.1.3032ea0741",
+    "@open-mercato/shared": "0.10.1-develop.7781.1.079f42c863",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.5",

package/src/modules/channel_gmail/lib/__tests__/adapter.test.ts

@@ -436,6 +436,39 @@ describe('GmailChannelAdapter OAuth flow', () => {
       expect(refreshToken).not.toHaveBeenCalled()
     })
 
+    it('refreshes a legacy blob using only the trusted OAuth client and known token fields', async () => {
+      const refreshToken = jest.fn(async () => ({
+        access_token: 'new-access',
+        expires_in: 1800,
+        token_type: 'Bearer',
+      }))
+      setGoogleOAuthClient(stubOAuth({ refreshToken }))
+
+      const result = await getGmailChannelAdapter().refreshCredentials!({
+        channelId: 'channel-1',
+        credentials: {
+          ...userCredentials,
+          _client: { clientId: 'untrusted-client', clientSecret: 'untrusted-secret' },
+          extra: 'legacy-metadata',
+        },
+        scope: { tenantId: 't', organizationId: 'o' },
+        oauthClient: { clientId: 'trusted-client', clientSecret: 'trusted-secret' },
+      })
+
+      expect(refreshToken).toHaveBeenCalledWith({
+        clientId: 'trusted-client',
+        clientSecret: 'trusted-secret',
+        refreshToken: userCredentials.refreshToken,
+      })
+      expect(result.credentials).toEqual({
+        accessToken: 'new-access',
+        refreshToken: userCredentials.refreshToken,
+        expiresAt: expect.any(String),
+        scopes: undefined,
+        email: userCredentials.email,
+      })
+    })
+
     it('throws a clear error when oauthClient is absent', async () => {
       setGoogleOAuthClient(stubOAuth({}))
       await expect(

package/src/modules/channel_gmail/lib/__tests__/credentials.test.ts

@@ -41,6 +41,27 @@ describe('gmailUserCredentialsSchema', () => {
     expect(() => gmailUserCredentialsSchema.parse({ refreshToken: 'r' })).toThrow(/Access token/i)
   })
 
+  it.each([
+    { accessToken: 'a' },
+    {
+      accessToken: 'a',
+      refreshToken: 'r',
+      expiresAt: '2026-05-26T10:00:00.000Z',
+      scopes: ['https://www.googleapis.com/auth/gmail.modify'],
+      email: 'alice@gmail.com',
+    },
+  ])('discards unknown stored fields while retaining known credentials: %j', (credentials) => {
+    const extraFields = {
+      _client: { clientId: 'untrusted-client', clientSecret: 'untrusted-secret' },
+      clientSecret: 'unexpected-secret',
+      metadata: { arbitrary: true },
+    }
+    const storedCredentials = { ...credentials, ...extraFields }
+
+    expect(gmailUserCredentialsSchema.parse(storedCredentials)).toEqual(credentials)
+    expect(storedCredentials).toEqual({ ...credentials, ...extraFields })
+  })
+
   it('rejects invalid expiresAt format', () => {
     expect(() => gmailUserCredentialsSchema.parse({ accessToken: 'a', expiresAt: 'soon' })).toThrow()
   })

package/src/modules/channel_gmail/lib/credentials.ts

@@ -39,7 +39,7 @@ export const gmailUserCredentialsSchema = z
     /** Email address from the linked Google account. */
     email: z.string().email().optional(),
   })
-  .passthrough()
+  .strip()
 
 export type GmailUserCredentials = z.infer<typeof gmailUserCredentialsSchema>