[Bug]: Google Drive Connection Fails After OpenRAG Restart Due to Missing Refresh Token

[ricofurtado]

OpenRAG Version

0.5.0

Deployment Method

Other

Operating System

macOS

Python Version

3.13

Affected Area

Connectors (Google Drive, OneDrive, SharePoint)

Bug Description

After restarting OpenRAG, clicking the Google Drive Connect option does not successfully reconnect to Google Drive. The integration appears as not connected, even though the user previously completed the OAuth flow.

The issue appears to be related to the OAuth configuration used by the Google Drive connector. Both OAuth flows currently use:

prompt=select_account

### Steps to Reproduce

Restart OpenRAG or the session is interrupted unexpectedly 

### Expected Behavior

After OpenRAG restarts, the Google Drive connector should remain connected or should be able to reconnect successfully.

The OAuth flow should ensure that OpenRAG receives and stores a valid refresh_token so that expired access tokens can be refreshed automatically.

### Actual Behavior

After OpenRAG is restarted:

Google Drive appears as not connected
Clicking Google Drive Connect does not restore the connection properly
The OAuth flow does not return a new refresh_token
The existing access token expires after approximately 1 hour
OpenRAG can no longer access Google Drive until a full consent flow is forced again

### Relevant Logs

```shell

Screenshots

No response

Additional Context

No response

Checklist

• I have searched existing issues to ensure this bug hasn't been reported before.
• I have provided all the requested information.

[ricofurtado]

This only shows the Google account picker. Google returns a refresh_token only during the first consent grant. On subsequent authorization flows, prompt=select_account skips the consent screen and does not return a new refresh_token.

Because OpenRAG does not receive or retain a valid refresh_token, the access token cannot be refreshed after it expires, which is usually around 1 hour. Once the access token expires, Google Drive appears as disconnected.

Root Cause

Both OAuth flows use:

prompt=select_account

This causes Google to only show the account picker and skip the consent screen when consent was already granted previously.

Google only returns a refresh_token on the first consent grant. Since the consent screen is skipped in later flows, no refresh_token is returned, leaving OpenRAG unable to refresh expired access tokens.

Impact

Users may lose access to Google Drive after an OpenRAG restart or after the access token expires. This makes the Google Drive connector unreliable and may block document ingestion from Google Drive.

Fix

Update the OAuth flow to force consent when a refresh_token is required.

Possible fix:

prompt=consent select_account

Also verify that OpenRAG correctly stores and reuses the refresh_token after the initial authorization.

Notes

The connector should handle the following cases:

• First-time Google Drive connection
• Reconnection after OpenRAG restart
• Access token expiration
• Missing or expired refresh token
• User re-authorizing the connector after a failed connection

[ricofurtado]

After OpenRAG restarts, the Google Drive connector loses its usable OAuth state. Because the OAuth flow uses prompt=select_account instead of forcing consent when needed, Google does not return a new refresh_token on reconnect. If OpenRAG did not persist the original refresh token, or overwrites it with an OAuth response that does not include one, the connector can no longer refresh expired access tokens. As a result, Google Drive appears disconnected after the access token expires.

[lucaseduoli]

Can be fixed by #1672 too