From 6b2a9101c46c34ea4f3aa4adb4160957f57258a1 Mon Sep 17 00:00:00 2001
From: stumpylog <797416+stumpylog@users.noreply.github.com>
Date: Thu, 29 Oct 2026 14:57:17 -0700
Subject: [PATCH] Fix: refuse to refresh OAuth tokens for non-OAuth accounts or
 missing refresh tokens

---
 src/paperless_mail/oauth.py                 |  6 ++++
 src/paperless_mail/tests/test_mail_oauth.py | 36 +++++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/src/paperless_mail/oauth.py b/src/paperless_mail/oauth.py
index 08b5d9647..30c9b8933 100644
--- a/src/paperless_mail/oauth.py
+++ b/src/paperless_mail/oauth.py
@@ -89,6 +89,9 @@ class PaperlessMailOAuth2Manager:
         """
         logger = logging.getLogger("paperless_mail")
         logger.debug(f"Attempting to refresh oauth token for account {account}")
+        if account.refresh_token is None:
+            logger.error(f"Account {account} has no refresh token to use")
+            return False
         try:
             result: OAuth2Token
             if account.account_type == MailAccount.MailAccountType.GMAIL_OAUTH:
@@ -103,6 +106,9 @@ class PaperlessMailOAuth2Manager:
                         refresh_token=account.refresh_token,
                     ),
                 )
+            else:
+                logger.error(f"Account {account} does not use OAuth")
+                return False
             if "refresh_token" in result:
                 # Outlook returns a new refresh token on refresh, Gmail does not
                 account.refresh_token = result["refresh_token"]
diff --git a/src/paperless_mail/tests/test_mail_oauth.py b/src/paperless_mail/tests/test_mail_oauth.py
index 6745d1c54..8e0768a88 100644
--- a/src/paperless_mail/tests/test_mail_oauth.py
+++ b/src/paperless_mail/tests/test_mail_oauth.py
@@ -388,3 +388,39 @@ class TestMailOAuth(
                 f"Failed to refresh oauth token for account {mail_account}: test_error",
                 cm.output[0],
             )
+
+    def test_refresh_account_oauth_token_non_oauth_account(self) -> None:
+        """
+        GIVEN:
+            - A mail account which does not use OAuth
+        WHEN:
+            - A token refresh is requested
+        THEN:
+            - False is returned rather than an unbound variable error
+        """
+        account = MailAccountFactory(
+            account_type=MailAccount.MailAccountType.IMAP,
+            refresh_token="token",
+        )
+
+        self.assertFalse(
+            PaperlessMailOAuth2Manager().refresh_account_oauth_token(account),
+        )
+
+    def test_refresh_account_oauth_token_without_refresh_token(self) -> None:
+        """
+        GIVEN:
+            - An OAuth mail account with no refresh token stored
+        WHEN:
+            - A token refresh is requested
+        THEN:
+            - False is returned
+        """
+        account = MailAccountFactory(
+            account_type=MailAccount.MailAccountType.GMAIL_OAUTH,
+            refresh_token=None,
+        )
+
+        self.assertFalse(
+            PaperlessMailOAuth2Manager().refresh_account_oauth_token(account),
+        )