Repository navigation
Describe the Google connectors' Disconnect, now that it exists - #76
Merged
Merged
Conversation
#75 made Disconnect real for user-held accounts: it asks Google to revoke the refresh token, then revokes the stored credential and removes the connection. The Gmail and Calendar and Google Drive pages still said it was not built and sent people to Google's settings instead.
Collaborator
Author
|
Security review: no actionable findings. Docs only. The text matches #75's behaviour: own account only, revoke at Google before removing our copy, and access is never reported withdrawn when Google couldn't be reached. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem
#75 made Disconnect work for a person's own Google account. The Gmail and Google Calendar page (
openbot/docs/plugins/google-workspace.md) and the Google Drive page (google-drive.md) still said "Not built yet" and sent people to Google's third-party access settings.The approach
Both pages now describe what Disconnect does:
revokeUrl(https://oauth2.googleapis.com/revokefor both connectors);They also cover the two failure cases: Google unreachable (nothing changes, try again), and Google refusing (access ends here; finish at myaccount.google.com/connections).
What is not covered
Removing a person from People still does not revoke their Google access at Google. That is unchanged by #75, and these pages don't claim otherwise.
Verification
Docs only. The wording was checked against #75's
disconnectHeldand the catalogue's revoke URLs. Biome format is clean.