Surface Drive-connection failures instead of swallowing them

Every failure in the Connect Drive / silent-refresh path was being
caught and turned into a generic re-show-the-button state, with no
way to tell what actually went wrong (missing refresh_token from
Google, expired/revoked token, cookie decrypt failure from a changed
encryption key). Now each failure mode shows a specific message, and
a 'Drive connection diagnostics' expander reports whether a token
cookie is present. Also switched the cookie's SameSite from this
library's default 'strict' to 'lax', matching Streamlit's own auth
cookie policy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app.py

@@ -58,13 +58,20 @@ def _handle_drive_oauth_callback(cookie_manager) -> None:
             _drive_redirect_uri(),
             code,
         )
-    except Exception:
+    except Exception as e:
         st.query_params.clear()
-        st.error("Failed to connect Google Drive. Please try again.")
+        st.error(f"Failed to connect Google Drive: {e}")
         return
 
     refresh_token = tokens.get("refresh_token")
-    if refresh_token and cookie_manager is not None:
+    if not refresh_token:
+        st.warning(
+            "Google didn't return a refresh_token (this happens if the app was "
+            "already authorized without prompt=consent taking effect). "
+            "Drive access will work for this session only -- try disconnecting "
+            "the app at myaccount.google.com/permissions and reconnecting."
+        )
+    elif cookie_manager is not None:
         cookie_token_store.save_refresh_token(cookie_manager, st.user.email, refresh_token)
     _store_access_token(tokens)
     st.query_params.clear()
@@ -90,7 +97,8 @@ def _ensure_drive_access(cookie_manager) -> None:
                 )
                 _store_access_token(tokens)
                 return
-            except Exception:
+            except Exception as e:
+                st.warning(f"Stored Drive access expired or was revoked ({e}); reconnecting.")
                 cookie_token_store.delete_refresh_token(cookie_manager, st.user.email)
 
     state = uuid.uuid4().hex
@@ -100,6 +108,14 @@ def _ensure_drive_access(cookie_manager) -> None:
     )
     st.link_button("Connect Google Drive", authorize_url)
 
+    with st.expander("Drive connection diagnostics"):
+        st.write("Logged in as:", st.user.email)
+        st.write("Cookie storage configured:", cookie_manager is not None)
+        if cookie_manager is not None:
+            found = cookie_token_store.get_refresh_token(cookie_manager, st.user.email) is not None
+            st.write("Refresh token cookie present:", found)
+            st.write("Raw cookies seen by the app:", list(cookie_manager.cookies.keys()))
+
 
 # Constructed at most once per script run -- see get_cookie_manager's docstring.
 _cookie_manager = cookie_token_store.get_cookie_manager() if "cookies" in st.secrets else None

src/cookie_token_store.py

@@ -34,7 +34,9 @@ def save_refresh_token(cookie_manager: stx.CookieManager, email: str, refresh_to
     encrypted = _fernet().encrypt(refresh_token.encode()).decode()
     expires_at = datetime.now(timezone.utc) + timedelta(days=_COOKIE_MAX_AGE_DAYS)
     name = _cookie_name(email)
-    cookie_manager.set(name, encrypted, expires_at=expires_at, key=f"set_{name}")
+    # same_site="lax" (this library defaults to "strict") to match the SameSite
+    # policy Streamlit's own auth cookie uses.
+    cookie_manager.set(name, encrypted, expires_at=expires_at, key=f"set_{name}", same_site="lax")
 
 
 def get_refresh_token(cookie_manager: stx.CookieManager, email: str) -> str | None:
@@ -44,6 +46,10 @@ def get_refresh_token(cookie_manager: stx.CookieManager, email: str) -> str | No
     try:
         return _fernet().decrypt(encrypted.encode()).decode()
     except Exception:
+        st.warning(
+            "Found a stored Drive cookie but couldn't decrypt it (likely the "
+            "encryption key changed since it was saved). Treating it as absent."
+        )
         return None