fix: require GOOGLE_PUBSUB_VERIFICATION_TOKEN for webhook security

apps/web/app/(app)/[emailAccountId]/assistant/bulk-run-rules-reducer.test.ts

@@ -366,7 +366,7 @@ describe("getProgressMessage", () => {
       status: "processing",
     };
 
-    const result = getProgressMessage(state, 0);
+    const result = getProgressMessage(state);
 
     expect(result).toBeNull();
   });
@@ -376,9 +376,10 @@ describe("getProgressMessage", () => {
       ...initialBulkRunState,
       status: "processing",
       processedThreadIds: new Set(["t1", "t2", "t3", "t4", "t5"]),
+      completedThreadIds: new Set(["t1", "t2"]), // 2 completed out of 5
     };
 
-    const result = getProgressMessage(state, 3);
+    const result = getProgressMessage(state);
 
     expect(result).toBe("Progress: 2/5 emails completed");
   });
@@ -388,10 +389,11 @@ describe("getProgressMessage", () => {
       ...initialBulkRunState,
       status: "stopped",
       processedThreadIds: new Set(["t1", "t2", "t3", "t4", "t5"]),
+      completedThreadIds: new Set(["t1", "t2", "t3", "t4", "t5"]), // All completed
       stoppedCount: 3,
     };
 
-    const result = getProgressMessage(state, 0);
+    const result = getProgressMessage(state);
 
     expect(result).toBe("Processed 3 emails");
   });
@@ -401,9 +403,10 @@ describe("getProgressMessage", () => {
       ...initialBulkRunState,
       status: "idle",
       processedThreadIds: new Set(["t1", "t2", "t3", "t4", "t5"]),
+      completedThreadIds: new Set(["t1", "t2", "t3", "t4", "t5"]), // All completed
     };
 
-    const result = getProgressMessage(state, 0);
+    const result = getProgressMessage(state);
 
     expect(result).toBe("Processed 5 emails");
   });
@@ -413,9 +416,10 @@ describe("getProgressMessage", () => {
       ...initialBulkRunState,
       status: "paused",
       processedThreadIds: new Set(["t1", "t2", "t3", "t4"]),
+      completedThreadIds: new Set(["t1", "t2"]), // 2 completed out of 4
     };
 
-    const result = getProgressMessage(state, 2);
+    const result = getProgressMessage(state);
 
     expect(result).toBe("Progress: 2/4 emails completed");
   });

apps/web/app/api/google/calendar/auth-url/route.ts

@@ -22,7 +22,7 @@ const getAuthUrl = ({ emailAccountId }: { emailAccountId: string }) => {
     access_type: "offline",
     scope: CALENDAR_SCOPES,
     state,
-    prompt: "consent",
+    prompt: "select_account",
   });
 
   return { url, state };

apps/web/app/api/google/linking/auth-url/route.ts

@@ -18,7 +18,7 @@ const getAuthUrl = ({ userId }: { userId: string }) => {
   const url = googleAuth.generateAuthUrl({
     access_type: "offline",
     scope: [...new Set([...SCOPES, "openid", "email"])].join(" "),
-    prompt: "consent",
+    prompt: "select_account",
     state,
   });
 

apps/web/app/api/google/webhook/route.ts

@@ -15,10 +15,19 @@ export const POST = withError("google/webhook", async (request) => {
 
   let logger = request.logger;
 
-  if (
-    env.GOOGLE_PUBSUB_VERIFICATION_TOKEN &&
-    token !== env.GOOGLE_PUBSUB_VERIFICATION_TOKEN
-  ) {
+  if (!env.GOOGLE_PUBSUB_VERIFICATION_TOKEN) {
+    logger.error(
+      "GOOGLE_PUBSUB_VERIFICATION_TOKEN is not configured - rejecting webhook for security",
+    );
+    return NextResponse.json(
+      {
+        message: "Webhook verification not configured",
+      },
+      { status: 500 },
+    );
+  }
+
+  if (token !== env.GOOGLE_PUBSUB_VERIFICATION_TOKEN) {
     logger.error("Invalid verification token", { token });
     return NextResponse.json(
       {

apps/web/utils/auth.ts

@@ -102,7 +102,7 @@ export const betterAuthConfig = betterAuth({
       clientSecret: env.GOOGLE_CLIENT_SECRET,
       scope: [...GMAIL_SCOPES],
       accessType: "offline",
-      prompt: "select_account consent",
+      prompt: "select_account",
       disableIdTokenSignIn: true,
     },
     microsoft: {