Fix: refuse to refresh OAuth tokens for non-OAuth accounts or missing refresh tokens

src/paperless_mail/oauth.py

@@ -89,6 +89,9 @@ class PaperlessMailOAuth2Manager:
         """
         logger = logging.getLogger("paperless_mail")
         logger.debug(f"Attempting to refresh oauth token for account {account}")
+        if account.refresh_token is None:
+            logger.error(f"Account {account} has no refresh token to use")
+            return False
         try:
             result: OAuth2Token
             if account.account_type == MailAccount.MailAccountType.GMAIL_OAUTH:
@@ -103,6 +106,9 @@ class PaperlessMailOAuth2Manager:
                         refresh_token=account.refresh_token,
                     ),
                 )
+            else:
+                logger.error(f"Account {account} does not use OAuth")
+                return False
             if "refresh_token" in result:
                 # Outlook returns a new refresh token on refresh, Gmail does not
                 account.refresh_token = result["refresh_token"]

src/paperless_mail/tests/test_mail_oauth.py

@@ -388,3 +388,39 @@ class TestMailOAuth(
                 f"Failed to refresh oauth token for account {mail_account}: test_error",
                 cm.output[0],
             )
+
+    def test_refresh_account_oauth_token_non_oauth_account(self) -> None:
+        """
+        GIVEN:
+            - A mail account which does not use OAuth
+        WHEN:
+            - A token refresh is requested
+        THEN:
+            - False is returned rather than an unbound variable error
+        """
+        account = MailAccountFactory(
+            account_type=MailAccount.MailAccountType.IMAP,
+            refresh_token="token",
+        )
+
+        self.assertFalse(
+            PaperlessMailOAuth2Manager().refresh_account_oauth_token(account),
+        )
+
+    def test_refresh_account_oauth_token_without_refresh_token(self) -> None:
+        """
+        GIVEN:
+            - An OAuth mail account with no refresh token stored
+        WHEN:
+            - A token refresh is requested
+        THEN:
+            - False is returned
+        """
+        account = MailAccountFactory(
+            account_type=MailAccount.MailAccountType.GMAIL_OAUTH,
+            refresh_token=None,
+        )
+
+        self.assertFalse(
+            PaperlessMailOAuth2Manager().refresh_account_oauth_token(account),
+        )