fix(knowledge): treat Google Workspace users without Gmail or Calendar as out of scope, not listing failures

Admin-mode Gmail recorded a Directory user without a mailbox, and Calendar recorded a
403 notACalendarUser, as per-user listing failures. Both are standing account properties,
so the connector stayed partial, deletion reconciliation never ran, and the scheduler
re-probed the same accounts every retry window.

- Directory enumeration no longer schedules Gmail users whose mailbox is not set up; the
  hourly Directory refresh picks them up once provisioned. A partition queued earlier
  completes with an empty page instead of a failure.
- A Calendar 403 whose only reason is notACalendarUser completes the user's partition
  cleanly and re-probes it no sooner than the Directory refresh (permissions keep their
  own refresh cadence). Bare forbidden and mixed-reason 403s stay retryable failures.

Author: waleedlatif1

apps/sim/connectors/google-workspace/company-crawl.test.ts

@@ -483,44 +483,52 @@ describe('Google Workspace per-user central crawl', () => {
     }
   )
 
-  it('skips an explicitly unprovisioned Gmail mailbox before requesting a token', async () => {
+  it('skips an explicitly unprovisioned Gmail mailbox without a token or a listing failure', async () => {
     directory([USER('alice', undefined, { isMailboxSetup: false }), USER('bob')])
-    const ctx = context()
+    const ctx: Record<string, unknown> = context()
     const first = await list(ctx)
-    expect(first.listingFailures?.samples[0]).toEqual({
-      scope: 'alice@corp.com',
-      operation: 'directory.users.get',
-      reasons: ['mailboxNotSetup'],
-    })
+    expect(first).toMatchObject({ documents: [], hasMore: true })
+    expect(first.listingFailures).toBeUndefined()
+    expect(first.reconciliationSafe).toBeUndefined()
+    expect(ctx.reconciliationUnsafe).toBeUndefined()
     expect(ctx.getDelegatedAccessToken).not.toHaveBeenCalled()
     const second = await list(context(), first.nextCursor)
     expect(second.documents[0].acl).toEqual(['u:bob@corp.com'])
+    expect(second.listingFailures).toBeUndefined()
   })
 
   it('does not use Gmail mailbox eligibility for Calendar', async () => {
     directory([USER('alice', undefined, { isMailboxSetup: false })])
     expect((await list(context(), undefined, CONFIG, 'google_calendar')).documents).toHaveLength(1)
   })
 
-  it.each(['forbidden', 'notACalendarUser'])(
-    'isolates explicit Calendar list access failures (%s) without claiming a disabled service',
-    async (reason) => {
+  it.each([{ reasons: ['forbidden'] }, { reasons: ['forbidden', 'notACalendarUser'] }])(
+    'isolates explicit Calendar list access failures ($reasons) without claiming a disabled service',
+    async ({ reasons }) => {
       listUserDocuments.mockRejectedValueOnce(
-        new GoogleApiError('calendar.events.list', 403, [reason])
+        new GoogleApiError('calendar.events.list', 403, reasons)
       )
       const first = await list(context(), undefined, CONFIG, 'google_calendar')
       expect(first.listingFailures?.samples[0]).toEqual({
         scope: 'alice@corp.com',
         operation: 'calendar.events.list',
         status: 403,
-        reasons: [reason],
+        reasons,
       })
       const second = await list(context(), first.nextCursor, CONFIG, 'google_calendar')
       expect(second.documents[0].acl).toEqual(['u:bob@corp.com'])
       expect(second.reconciliationSafe).toBe(false)
     }
   )
 
+  it('leaves a user without the Calendar service to the scheduler instead of recording a failure', async () => {
+    const error = new GoogleApiError('calendar.events.list', 403, ['notACalendarUser'])
+    listUserDocuments.mockRejectedValueOnce(error)
+    const ctx: Record<string, unknown> = context()
+    await expect(list(ctx, undefined, CONFIG, 'google_calendar')).rejects.toBe(error)
+    expect(ctx.reconciliationUnsafe).toBeUndefined()
+  })
+
   it.each([{ error: { code: 403 } }, { error: { code: 403, errors: [], details: [] } }])(
     'propagates a Calendar 403 without reason codes: %j',
     async (body) => {
@@ -626,10 +634,9 @@ describe('Google Workspace per-user central crawl', () => {
   })
 
   it('bounds retained failure samples while counting every unavailable user', async () => {
-    directory(
-      Array.from({ length: 15 }, (_, index) =>
-        USER(`user-${index}`, undefined, { isMailboxSetup: false })
-      )
+    directory(Array.from({ length: 15 }, (_, index) => USER(`user-${index}`)))
+    listUserDocuments.mockRejectedValue(
+      new GoogleApiError('gmail.threads.list', 400, ['failedPrecondition'])
     )
     let cursor: string | undefined
     let final
@@ -643,7 +650,7 @@ describe('Google Workspace per-user central crawl', () => {
       reconciliationSafe: false,
     })
     expect(final?.listingFailures?.samples).toHaveLength(10)
-    expect(listUserDocuments).not.toHaveBeenCalled()
+    expect(listUserDocuments).toHaveBeenCalledTimes(15)
   })
 })
 

apps/sim/connectors/google-workspace/company-crawl.ts

@@ -161,23 +161,39 @@ function ownerDocument(document: ExternalDocument, access: DelegatedUser): Exter
   return { ...document, acl: [`u:${access.user.email}`] }
 }
 
-/** Isolates narrow user-list failures; delegation, known scope errors and quota errors still fail. */
+/**
+ * Calendar answers an account without the Calendar service with exactly this reason. That is a
+ * standing property of the account, not a listing failure, so the user scheduler skips it.
+ */
+export function isGoogleWorkspaceServiceNotEnabled(error: unknown): boolean {
+  return (
+    error instanceof GoogleApiError &&
+    error.reasonsComplete &&
+    error.status === 403 &&
+    error.diagnostic?.operation === 'calendar.events.list' &&
+    error.diagnostic.reasons.length === 1 &&
+    error.diagnostic.reasons[0] === 'notACalendarUser'
+  )
+}
+
+/** Isolates narrow user-list failures; a missing Calendar service propagates for the scheduler to skip. */
 function userListingFailure(
   error: unknown,
   provider: GoogleWorkspaceProvider
 ): Omit<ExternalListingFailures['samples'][number], 'scope'> | null {
   if (!(error instanceof GoogleApiError) || !error.diagnostic || !error.reasonsComplete) return null
   const reasons = error.diagnostic.reasons
   const isolated =
-    provider === 'gmail'
+    !isGoogleWorkspaceServiceNotEnabled(error) &&
+    (provider === 'gmail'
       ? error.diagnostic.operation === 'gmail.threads.list' &&
         error.status === 400 &&
         reasons.length > 0 &&
         reasons.every((reason) => reason === 'failedPrecondition')
       : error.diagnostic.operation === 'calendar.events.list' &&
         error.status === 403 &&
         reasons.length > 0 &&
-        reasons.every((reason) => reason === 'forbidden' || reason === 'notACalendarUser')
+        reasons.every((reason) => reason === 'forbidden' || reason === 'notACalendarUser'))
   return isolated
     ? { operation: error.diagnostic.operation, status: error.status, reasons: [...reasons] }
     : null
@@ -317,9 +333,8 @@ export async function listGoogleWorkspaceDocuments(
     })
     return emptyPage(advance())
   }
-  if (provider === 'gmail' && user.isMailboxSetup === false) {
-    return failedUser({ operation: 'directory.users.get', reasons: ['mailboxNotSetup'] })
-  }
+  /** Directory refresh stops scheduling users without a mailbox; a partition queued earlier just completes. */
+  if (provider === 'gmail' && user.isMailboxSetup === false) return emptyPage(advance())
   const access: PageAccess = {
     provider,
     user,

apps/sim/lib/knowledge/connectors/google-company-scheduler.test.ts

@@ -36,8 +36,8 @@ const document: ExternalDocument = {
   contentHash: 'hash',
   mimeType: 'text/plain',
 }
-function user(id: string): GoogleWorkspaceUser {
-  return { id, email: `${id}@fixture.test`, customerId: 'customer', active: true }
+function user(id: string, extra: Partial<GoogleWorkspaceUser> = {}): GoogleWorkspaceUser {
+  return { id, email: `${id}@fixture.test`, customerId: 'customer', active: true, ...extra }
 }
 interface FakeWork extends ConnectorPartitionWorkItem<GoogleWorkspaceUser> {
   complete: boolean
@@ -227,18 +227,19 @@ describe('durable Google company user scheduling', () => {
   })
 
   it.each([
-    ['google_calendar', []],
-    ['google_calendar', ['notACalendarUser']],
-    ['google_drive', []],
+    ['google_calendar', [], false],
+    ['google_calendar', ['forbidden'], true],
+    ['google_calendar', ['notACalendarUser'], false],
+    ['google_drive', [], false],
   ] as const)(
-    'retains a failed %s user (%j) and continues other users',
-    async (provider, reasons) => {
+    'retains a failed %s user (%j, reasons complete: %s) and continues other users',
+    async (provider, reasons, reasonsComplete) => {
       mocks.directory.mockResolvedValue({ users: [user('a'), user('z')] })
       const f = fixture(provider)
       f.list.mockRejectedValueOnce(
         provider === 'google_drive'
           ? new GoogleDriveApiError(403, [], 'drive.files.list', false)
-          : new GoogleApiError('calendar.events.list', 403, reasons, reasons.length > 0)
+          : new GoogleApiError('calendar.events.list', 403, reasons, reasonsComplete)
       )
       await f.step(4)
       expect(f.rows.get('a:content')).toMatchObject({
@@ -273,9 +274,9 @@ describe('durable Google company user scheduling', () => {
     }
   )
 
-  it('continues past unavailable Calendar users without the unresolved-error pause and retries them later', async () => {
-    mocks.directory.mockResolvedValue({ users: ['a', 'b', 'c', 'z'].map(user) })
-    const f = fixture()
+  it('completes Calendar users without the service so the listing stays reconcilable, re-probing them at the Directory refresh', async () => {
+    mocks.directory.mockResolvedValue({ users: ['a', 'b', 'c', 'z'].map((id) => user(id)) })
+    const f = fixture('google_calendar', 15)
     const listUserDocuments = vi.fn<ConnectorConfig['listDocuments']>(
       async (_token, _config, _cursor, ctx) => ({
         documents: [{ ...document, externalId: memberDocumentId('event', ctx) }],
@@ -302,27 +303,79 @@ describe('durable Google company user scheduling', () => {
       })
     )
 
-    await f.step(5)
+    await f.step(10)
 
-    expect(f.rows.get('z:content')?.complete).toBe(true)
-    expect(f.saved()).toMatchObject({ complete: false, unsafe: true, resumeAt: null })
     for (const id of ['a', 'b', 'c']) {
       expect(f.rows.get(`${id}:content`)).toMatchObject({
-        complete: false,
-        attempts: 1,
+        complete: true,
+        attempts: 0,
         retryAt: new Date('2026-09-17T01:00:00Z'),
-        failure: { status: 403, reasons: ['notACalendarUser'] },
       })
+      expect(f.rows.get(`${id}:content`)?.failure).toBeUndefined()
     }
+    expect(f.rows.get('z:content')).toMatchObject({
+      complete: true,
+      retryAt: new Date('2026-09-17T00:15:00Z'),
+    })
+    expect(f.saved()).toMatchObject({ complete: true, unsafe: false, listingFailures: null })
+    expect(listUserDocuments).toHaveBeenCalledTimes(4)
+  })
 
-    f.advance(60 * 60 * 1000)
-    f.restart()
-    await f.step(4)
+  it('refreshes permissions for a user without the Calendar service at the permission cadence', async () => {
+    mocks.directory.mockResolvedValue({ users: [user('a'), user('z')] })
+    const f = fixture()
+    f.list.mockResolvedValue({ documents: [document], hasMore: true, nextCursor: 'next-page' })
+    await f.step(2)
+    f.advance(13 * 60 * 60 * 1000)
+    f.list.mockRejectedValueOnce(
+      new GoogleApiError('calendar.events.list', 403, ['notACalendarUser'])
+    )
+    await f.step(2)
+    expect(mocks.directory).toHaveBeenCalledTimes(2)
+    expect(f.rows.get('a:permissions')).toMatchObject({
+      attempts: 0,
+      retryAt: new Date('2026-09-18T01:00:00Z'),
+    })
+    expect(f.rows.get('a:permissions')?.failure).toBeUndefined()
+    expect(f.rows.get('a:permissions')?.cursor).toBeUndefined()
+    expect(f.saved()).toMatchObject({ unsafe: false, listingFailures: null })
+  })
 
-    for (const id of ['a', 'b', 'c']) {
-      expect(f.rows.get(`${id}:content`)).toMatchObject({ complete: true, attempts: 0 })
-      expect(f.rows.get(`${id}:content`)?.failure).toBeUndefined()
+  it.each([
+    ['gmail', false],
+    ['google_calendar', true],
+  ] as const)(
+    'for %s, schedules a Directory user without a mailbox: %s',
+    async (provider, scheduled) => {
+      mocks.directory.mockResolvedValue({
+        users: [user('a', { isMailboxSetup: false }), user('z')],
+      })
+      const f = fixture(provider)
+      await f.step(4)
+      expect(f.rows.has('a:content')).toBe(scheduled)
+      expect(f.rows.get('z:content')?.complete).toBe(true)
+      expect(f.saved()).toMatchObject({ unsafe: false, listingFailures: null })
     }
+  )
+
+  it('picks up a Gmail user on the Directory refresh after their mailbox is provisioned', async () => {
+    mocks.directory
+      .mockResolvedValueOnce({ users: [user('a', { isMailboxSetup: false }), user('z')] })
+      .mockResolvedValue({ users: [user('a', { isMailboxSetup: true }), user('z')] })
+    const f = fixture('gmail')
+    let page = 0
+    f.list.mockImplementation(async () => ({
+      documents: [document],
+      hasMore: true,
+      nextCursor: `page-${++page}`,
+    }))
+    await f.step(3)
+    expect(f.rows.has('a:content')).toBe(false)
+    f.advance(61 * 60_000)
+    f.restart()
+    await f.step(2)
+    expect(mocks.directory).toHaveBeenCalledTimes(2)
+    expect(f.rows.has('a:content')).toBe(true)
   })
 
   it('bounds a run of unresolved user errors rather than marking the tenant complete', async () => {
@@ -457,8 +510,9 @@ describe('durable Google company user scheduling', () => {
             samples: [
               {
                 scope: 'a@fixture.test',
-                operation: 'directory.users.get',
-                reasons: ['mailboxNotSetup'],
+                operation: 'gmail.threads.list',
+                status: 400,
+                reasons: ['failedPrecondition'],
               },
             ],
           },

apps/sim/lib/knowledge/connectors/google-company-scheduler.ts

@@ -6,7 +6,10 @@ import type {
 import { googleDriveCompanyCursorAdapter } from '@/connectors/google-drive/company-crawl'
 import { GoogleDriveApiError } from '@/connectors/google-drive/google-drive-errors'
 import { GoogleApiError } from '@/connectors/google-workspace/api-errors'
-import { googleWorkspaceCompanyCursorAdapter } from '@/connectors/google-workspace/company-crawl'
+import {
+  googleWorkspaceCompanyCursorAdapter,
+  isGoogleWorkspaceServiceNotEnabled,
+} from '@/connectors/google-workspace/company-crawl'
 import type {
   GoogleCompanyCursorAdapter,
   GoogleCompanyUserWork,
@@ -183,8 +186,12 @@ export function createGoogleCompanyScheduler(input: {
           nextCursor: nextCursor({ ...state, directoryCursor: undefined }, {}),
         }
       }
+      /** A user without a mailbox is out of scope like an inactive one until a later refresh sees it. */
       const users = page.users.filter(
-        (user) => user.active && (!selected.length || selected.includes(user.email))
+        (user) =>
+          user.active &&
+          (input.provider !== 'gmail' || user.isMailboxSetup !== false) &&
+          (!selected.length || selected.includes(user.email))
       )
       return {
         documents: [],
@@ -296,6 +303,29 @@ export function createGoogleCompanyScheduler(input: {
           : {}),
       }
     }
+    /** A user without the service completes cleanly and is re-probed no sooner than the Directory refresh. */
+    const skipped = (): ExternalDocumentList => ({
+      documents: [],
+      currentCursor,
+      hasMore: true,
+      nextCursor: nextCursor(next, {
+        update: {
+          partitionKey: work.partitionKey,
+          kind: work.kind,
+          cursor: null,
+          completed: true,
+          attempts: 0,
+          failure: null,
+          retryAt: new Date(
+            now().getTime() +
+              (work.kind === 'permissions'
+                ? GOOGLE_COMPANY_PERMISSION_REFRESH_MS
+                : Math.max(DIRECTORY_REFRESH_MS, input.syncIntervalMinutes * 60_000))
+          ),
+          ...(work.kind === 'permissions' ? { permissionStartedAt: null } : {}),
+        },
+      }),
+    })
     let page: ExternalDocumentList
     try {
       page = await input.listDocuments(
@@ -312,6 +342,7 @@ export function createGoogleCompanyScheduler(input: {
           false,
           true
         )
+      if (isGoogleWorkspaceServiceNotEnabled(error)) return skipped()
       const failure = deferredUserFailure(error, work.context)
       if (!failure) throw error
       return failed(failure, true)