surfsense_backend/.env.example (1)

12-12: Order env keys to satisfy dotenv-linter and note prod URI requirements

• dotenv-linter warns the new key should precede GOOGLE_OAUTH_CLIENT_ID. Reorder the "Google OAuth" block alphabetically (e.g., GOOGLE_CALENDAR_REDIRECT_URI, GOOGLE_GMAIL_REDIRECT_URI, GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET) to clear the warning.
• Ensure the same redirect URI is registered in Google Cloud Console. Use HTTPS in production.

surfsense_backend/app/agents/researcher/sub_section_writer/prompts.py (1)

28-31: Grammar nit: “section’s” → “sections”; tag name alignment

Small clarity fix.

Apply:

-1. Carefully analyze all provided documents in the <document> section's.
+1. Carefully analyze all provided documents in the <documents> section.

surfsense_backend/app/config/__init__.py (1)

54-56: Add minimal validation for Gmail redirect URI when Google auth is enabled

The config entry is correct. Recommend a small guard to fail fast if Google auth is used but the Gmail redirect URI is missing.

Apply:

     # Google Gmail redirect URI
     GOOGLE_GMAIL_REDIRECT_URI = os.getenv("GOOGLE_GMAIL_REDIRECT_URI")
+    # Basic validation to catch misconfigurations early
+    if AUTH_TYPE == "GOOGLE" and not GOOGLE_GMAIL_REDIRECT_URI:
+        raise ValueError(
+            "GOOGLE_GMAIL_REDIRECT_URI is not set but AUTH_TYPE=GOOGLE. "
+            "Set it to your authorized Gmail OAuth redirect URL."
+        )

Note: Ensure the production value is HTTPS and matches the authorized redirect in Google Cloud Console.

surfsense_backend/alembic/versions/18_add_google_gmail_connector_enums.py (2)

14-15: Use a real Alembic revision hash instead of the bare number 18.

Numeric strings collide easily with other developers’ migrations and break Alembic’s topological sort.
Run alembic revision -m "add gmail connector enums" and copy the generated UUID‐like revision id instead.

---

58-65: downgrade() is a no-op – document that clearly or implement a safe rollback.

Leaving the enum in place is fine, but callers will assume downgrade reverses the migration.
Either:

-"""Remove 'GOOGLE_GMAIL_CONNECTOR' from enum types."""
+"""No-op: PostgreSQL enums cannot be removed safely in place."""

or implement the full recreate-type procedure.

surfsense_web/app/dashboard/[search_space_id]/connectors/add/google-gmail-connector/page.tsx (2)

3-13: Drop unused imports to keep bundle size lean.

zodResolver, motion, useForm, z are imported but never used.

---

52-60: Gracefully handle missing backend URL env var.

If NEXT_PUBLIC_FASTAPI_BACKEND_URL is undefined the fetch will hit undefined/api/..., producing hard-to-trace 404s. Consider:

const baseUrl = process.env.NEXT_PUBLIC_FASTAPI_BACKEND_URL;
if (!baseUrl) {
  toast.error("Backend URL not configured"); return;
}

surfsense_backend/app/services/connector_service.py (1)

1275-1287: Compile the sender-extraction regex once outside the loop.

Importing and compiling on every iteration wastes CPU when top_k is large.

-            for _i, chunk in enumerate(gmail_chunks):
-                ...
-                    import re
-                    sender_match = re.search(r"<([^>]+)>", sender)
+            import re
+            email_re = re.compile(r"<([^>]+)>")
+            for _i, chunk in enumerate(gmail_chunks):
+                ...
+                    sender_match = email_re.search(sender)

surfsense_backend/app/tasks/connectors_indexing_tasks.py (1)

3639-3642: Fix return value inconsistency

The function should return None as the error message (second element) to indicate success, but line 3641 still has the old comment format.

         return (
             total_processed,
             None,
-        )  # Return None as the error message to indicate success
+        )

surfsense_backend/app/connectors/google_gmail_connector.py (1)

270-271: Consider raising exceptions instead of returning error strings

Methods like extract_message_text return error strings on failure, which is inconsistent with tuple-based error handling used elsewhere and makes error handling more difficult for callers.

Consider either:

1. Returning a tuple (text, error) like other methods
2. Raising exceptions and handling them in the calling code
3. Returning empty string and logging the error

         except Exception as e:
-            return f"Error extracting message text: {e!s}"
+            # Log the error and return empty string
+            import logging
+            logging.error(f"Error extracting message text: {e!s}")
+            return ""

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

surfsense_backend/app/connectors/google_gmail_connector.py (2)

260-266: Fragile HTML stripping

Regex tag removal fails on complex HTML and scripts. Use html.parser (std-lib) or BeautifulSoup for reliable text extraction.

---

253-262: Incorrect base64 padding – decoding will break
Adding "===" unconditionally corrupts already-padded data (see previous review thread). Pad only when length % 4 != 0:

- decoded_data = base64.urlsafe_b64decode(data + "===").decode("utf-8", errors="ignore")
+missing = len(data) % 4
+if missing:
+    data += "=" * (4 - missing)
+decoded_data = base64.urlsafe_b64decode(data).decode("utf-8", errors="ignore")

surfsense_backend/app/routes/google_gmail_add_connector_route.py (4)

57-60: Check space_id parameter properly

if not space_id: treats 0 as “missing”. If 0 is a legitimate ID, switch to an is None test or FastAPI validation (gt=0) on the parameter.

---

72-78: Log OAuth-init failures

Any failure here is swallowed and returned to the caller without a server-side trace. Add a logger.exception("…") before raising so ops can diagnose OAuth issues.

---

100-109: Base64 decoding can fail on tampered state

urlsafe_b64decode will raise on bad padding / malformed data. Consider guarding with padding fix‐up or returning 400 when decoding fails to avoid a generic 500.

---

155-160: Generic exception drops front-end redirect

On an unexpected error the endpoint now logs and implicitly returns a 500 JSON response, unlike the happy-path redirect. Return a RedirectResponse to an error page so the UX remains consistent.

surfsense_backend/app/connectors/google_gmail_connector.py (2)

51-63: Expired-credential branch never reached

if self._credentials and not self._credentials.expired: returns early when not expired; everything else (including already-valid but expired==False creds) goes through the refresh logic. Drop the redundant truthy check and test only not self._credentials.expired for clarity.

---

94-113: Return signature hides errors

You return ({}, "msg") on failure. Callers must remember to inspect index 1 for error. Consider raising exceptions or returning None/error objects to avoid silent failures.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

surfsense_web/app/dashboard/[search_space_id]/documents/(manage)/components/DocumentTypeIcon.tsx (1)

35-35: Gmail mapping added correctly; consider a shorter label

The mapping to IconMail looks good and preserves fallback behavior.

Optional UX improvement: If you prefer a shorter chip label than the default "Google Gmail Connector", add a label override:

// Above getDocumentTypeLabel
const documentTypeLabelOverrides: Partial<Record<string, string>> = {
  GOOGLE_GMAIL_CONNECTOR: "Gmail",
};

export function getDocumentTypeLabel(type: string): string {
  if (documentTypeLabelOverrides[type]) return documentTypeLabelOverrides[type]!;
  return type
    .split("_")
    .map((word) => word.charAt(0) + word.slice(1).toLowerCase())
    .join(" ");
}

Also consider extracting icon/label mappings into a shared module so DocumentTypeIcon.tsx and any other UI (e.g., connector lists) reuse the same source of truth.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

surfsense_backend/app/schemas/search_source_connector.py (1)

191-197: Address the acknowledged refactoring tasks in upcoming PRs.

The Gmail connector validation duplicates the Calendar logic exactly, as noted in previous reviews. While the author acknowledged this will be addressed in future PRs, the current implementation works correctly and validates all required Google OAuth credentials.

As discussed in previous reviews:

1. Consolidate both Google connector validations into a single branch handling both GOOGLE_CALENDAR_CONNECTOR and GOOGLE_GMAIL_CONNECTOR
2. Enforce strict key validation (checking for unexpected extra keys)
3. Implement encryption for sensitive credential fields (access_token, refresh_token, client_secret)

This refactoring can be tracked in the next PR as previously agreed.

surfsense_backend/app/tasks/connector_indexers/google_gmail_indexer.py (7)

86-90: Missing metadata in error response

The function returns an error tuple but the log failure call passes metadata as a positional argument instead of using the additional_metadata parameter.

Apply this diff to fix the parameter passing:

 if not connector:
     error_msg = f"Gmail connector with ID {connector_id} not found"
     await task_logger.log_task_failure(
-        log_entry, error_msg, {"error_type": "ConnectorNotFound"}
+        log_entry, error_msg, additional_metadata={"error_type": "ConnectorNotFound"}
     )
     return 0, error_msg

---

36-36: Consider validating the end_date parameter

The end_date parameter is defined but never used in the function. If it's intended for future use, consider adding a TODO comment. Otherwise, it should either be implemented or removed.

If you intend to use end_date for filtering messages, you could modify the Gmail query to include both date boundaries. Otherwise, consider removing this unused parameter or adding a TODO comment explaining its future purpose.

---

133-135: Missing error details in log failure

The task failure logging call is missing the error_details parameter, passing an empty dict as the third positional argument.

Apply this diff to properly pass error details:

 if error:
     await task_logger.log_task_failure(
-        log_entry, f"Failed to fetch messages: {error}", {}
+        log_entry, f"Failed to fetch messages: {error}", error_details=str(error)
     )
     return 0, f"Failed to fetch Gmail messages: {error}"

---

238-238: Incorrect log message content

The log message shows summary_content which includes newlines and full text, making the log entry difficult to read. It should log the message subject or ID instead.

Apply this diff to improve the log message:

-logger.info(f"Successfully indexed new email {summary_content}")
+logger.info(f"Successfully indexed new email: {subject} (ID: {message_id})")

---

250-252: Logic issue with conditional connector update

The update_connector_last_indexed is called only when total_processed > 0, but the update_last_indexed parameter should control whether to update the timestamp, not the number of processed documents.

Consider updating the logic to respect the update_last_indexed parameter regardless of the number of processed documents:

 # Update the last_indexed_at timestamp for the connector only if requested
-total_processed = documents_indexed
-if total_processed > 0:
-    await update_connector_last_indexed(session, connector, update_last_indexed)
+if update_last_indexed:
+    await update_connector_last_indexed(session, connector, True)
+total_processed = documents_indexed

---

275-278: Inconsistent return value on success

The function returns None as the error message on success (line 277), but the docstring states it returns a "status_message" without clarifying that None indicates success. This could be confusing for callers.

Consider updating the docstring to clarify the return value semantics:

 Returns:
-    Tuple of (number_of_indexed_messages, status_message)
+    Tuple of (number_of_indexed_messages, error_message).
+    On success, error_message is None. On failure, error_message contains the error description.

---

240-247: Missing message_id in error handling

When an exception occurs during message processing, the error log references message_id (line 242) which might not be defined if the error occurs before line 153.

Apply this diff to handle the case where message_id might not be defined:

 except Exception as e:
+    message_id = message.get("id", "unknown") if message else "unknown"
     logger.error(
         f"Error processing the email {message_id}: {e!s}",
         exc_info=True,
     )
     skipped_messages.append(f"{subject} (processing error)")
     documents_skipped += 1
     continue  # Skip this message and continue with others

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.