update

backend/app/auth_routes.py

@@ -313,6 +313,32 @@ async def google_login(
     redirect_uri = _redirect_uri(request)
     request.session["google_oauth_state"] = state
     request.session["google_oauth_redirect_uri"] = redirect_uri
+
+    # Google only reliably returns a refresh_token (needed for gmail.send) when the user sees
+    # the consent screen. Match "Reconnect Google" behavior on every sign-in unless we already
+    # have a stored token; ?reauth_gmail=1 always forces consent (e.g. revoked token).
+    force_consent = bool(reauth_gmail and reauth_gmail.strip().lower() not in ("0", "false", "no"))
+    need_prompt_consent = True
+    if not force_consent:
+        uid = request.session.get("user_id")
+        if uid is not None:
+            try:
+                uid_int = int(uid)
+            except (TypeError, ValueError):
+                uid_int = None
+            if uid_int is not None:
+                db = SessionLocal()
+                try:
+                    u = db.query(User).filter(User.id == uid_int).first()
+                    if (
+                        u
+                        and getattr(u, "google_refresh_token", None)
+                        and str(u.google_refresh_token).strip()
+                    ):
+                        need_prompt_consent = False
+                finally:
+                    db.close()
+
     params = {
         "client_id": client_id,
         "redirect_uri": redirect_uri,
@@ -322,8 +348,7 @@ async def google_login(
         "access_type": "offline",
         "include_granted_scopes": "true",
     }
-    # Force consent so Google returns a refresh_token when (re)adding gmail.send for existing users.
-    if reauth_gmail and reauth_gmail.strip() not in ("0", "false", "no"):
+    if need_prompt_consent:
         params["prompt"] = "consent"
     return RedirectResponse(url=f"{GOOGLE_AUTH_URI}?{urlencode(params)}")
 

frontend/src/components/workspace/WonBillingModal.jsx

@@ -31,8 +31,9 @@ function fmtMoneyAmount(n) {
 
 /**
  * Modal to capture PO / customer / line items before marking a deal Won (invoicing).
+ * @param {boolean | undefined} gmailInvitesReady — from /api/auth/me; false blocks submit until user reconnects Gmail.
  */
-export default function WonBillingModal({ dealName, busy, onCancel, onSubmit }) {
+export default function WonBillingModal({ dealName, busy, onCancel, onSubmit, gmailInvitesReady }) {
     const [poNumber, setPoNumber] = useState('');
     const [customerLegalName, setCustomerLegalName] = useState('');
     const [customerAddress, setCustomerAddress] = useState('');
@@ -86,6 +87,10 @@ export default function WonBillingModal({ dealName, busy, onCancel, onSubmit })
 
     const handleSubmit = () => {
         setLocalError('');
+        if (gmailInvitesReady === false) {
+            setLocalError('Connect Gmail below before marking this deal won.');
+            return;
+        }
         if (!poNumber.trim()) {
             setLocalError('PO number is required.');
             return;
@@ -181,6 +186,20 @@ export default function WonBillingModal({ dealName, busy, onCancel, onSubmit })
                     agreement. Errors here can cause invoice mistakes.
                 </div>
 
+                {gmailInvitesReady === false ? (
+                    <p className="mt-3 text-xs text-amber-900 bg-amber-50 border border-amber-200 rounded-lg px-3 py-2">
+                        Workspace admins get an email when you mark a deal won. Sign in with Google again (consent
+                        screen) or use{' '}
+                        <a
+                            href="/api/auth/google?reauth_gmail=1"
+                            className="font-medium text-violet-700 underline"
+                        >
+                            Reconnect Google for invites
+                        </a>
+                        , then return here and submit again.
+                    </p>
+                ) : null}
+
                 <div className="mt-5 grid grid-cols-1 gap-3 sm:grid-cols-2">
                     <div>
                         <label className="mb-1 block text-xs font-medium text-slate-600">PO number</label>
@@ -383,7 +402,7 @@ export default function WonBillingModal({ dealName, busy, onCancel, onSubmit })
                         type="button"
                         className="bg-emerald-600 hover:bg-emerald-700"
                         onClick={handleSubmit}
-                        disabled={busy}
+                        disabled={busy || gmailInvitesReady === false}
                     >
                         {busy ? (
                             <>

frontend/src/pages/Deals.jsx

@@ -904,13 +904,21 @@ export default function Deals() {
     const isAdmin = me?.current_role === 'admin';
     const currentUserId = me?.user_id ?? null;
 
-    useEffect(() => {
+    const refreshMe = useCallback(() => {
         apiFetch('/api/auth/me')
             .then((r) => (r.ok ? r.json() : null))
             .then(setMe)
             .catch(() => setMe(null));
     }, []);
 
+    useEffect(() => {
+        refreshMe();
+    }, [refreshMe]);
+
+    useEffect(() => {
+        if (wonDialog) refreshMe();
+    }, [wonDialog, refreshMe]);
+
     useEffect(() => {
         if (!me || me.current_role !== 'admin') {
             setTenantMembers([]);
@@ -1797,6 +1805,7 @@ export default function Deals() {
                     key={wonDialog.dealId}
                     dealName={deals.find((d) => d.id === wonDialog.dealId)?.name || ''}
                     busy={wonModalBusy}
+                    gmailInvitesReady={me?.gmail_invites_ready}
                     onCancel={() => {
                         if (!wonModalBusy) setWonDialog(null);
                     }}

frontend/src/pages/Settings.jsx

@@ -268,7 +268,8 @@ export default function Settings() {
                     </p>
                     {me?.gmail_invites_ready === false ? (
                         <p className="text-xs text-amber-900 bg-amber-50 border border-amber-200 rounded-lg px-3 py-2 mb-4">
-                            Connect Gmail once so &quot;Send invite&quot; can send mail from your address:{' '}
+                            Sign in with Google again (you will see a consent screen) so invites can send from your
+                            address, or use{' '}
                             <a
                                 href="/api/auth/google?reauth_gmail=1"
                                 className="font-medium text-violet-700 underline"