From 551d604b8f75cf8814fd5a1779396d3fb069cf4a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 29 Mar 2026 19:37:10 +0000
Subject: [PATCH] fix: address code review - clarify plaintext note, fix
 misleading template ternary

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/0c63851e-a69a-4a76-8dd8-25618e825b8c

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 backend/app/models/mail_source.py       | 5 ++++-
 backend/app/services/gmail_client.py    | 7 ++-----
 backend/app/templates/mail_sources.html | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/backend/app/models/mail_source.py b/backend/app/models/mail_source.py
index 7bd2517..70e3961 100644
--- a/backend/app/models/mail_source.py
+++ b/backend/app/models/mail_source.py
@@ -39,7 +39,10 @@ class MailSource(Base):
     folder = Column(String, default="INBOX")
 
     # Gmail API OAuth2 credentials (used by GMAIL_API method)
-    # NOTE: tokens stored in plaintext – encrypt at the app layer in production.
+    # NOTE: tokens and secrets are stored in plaintext – in a production
+    # environment these fields should be encrypted at the application layer
+    # (e.g. using Fernet/AES) before persisting, the same way IMAP passwords
+    # should be.  Treat database access as equivalent to credential access.
     gmail_client_id = Column(String, nullable=True)
     gmail_client_secret = Column(Text, nullable=True)
     gmail_access_token = Column(Text, nullable=True)
diff --git a/backend/app/services/gmail_client.py b/backend/app/services/gmail_client.py
index 88282f1..0204195 100644
--- a/backend/app/services/gmail_client.py
+++ b/backend/app/services/gmail_client.py
@@ -11,7 +11,7 @@ import base64
 import email
 import json
 import logging
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict, List, Optional
 from urllib.parse import urlencode
 
 import httpx
@@ -295,10 +295,7 @@ class GmailClient:
         """
         try:
             msg_data = (
-                service.users()
-                .messages()
-                .get(userId="me", id=msg_id, format="raw")
-                .execute()
+                service.users().messages().get(userId="me", id=msg_id, format="raw").execute()
             )
         except HttpError as exc:
             logger.error("Gmail API: failed to fetch message %s: %s", msg_id, exc)
diff --git a/backend/app/templates/mail_sources.html b/backend/app/templates/mail_sources.html
index b7a1e9d..d691408 100644
--- a/backend/app/templates/mail_sources.html
+++ b/backend/app/templates/mail_sources.html
@@ -463,7 +463,7 @@ function mailSourcesApp() {
                 polling_interval: source.polling_interval || 60,
                 enabled: source.enabled !== false,
                 gmail_client_id: source.gmail_client_id || '',
-                gmail_client_secret: source.gmail_client_secret ? '' : '',  // never pre-fill
+                gmail_client_secret: '',  // never pre-fill client secret
             };
             this.testResult = { message: '', success: false };
             this.showForm = true;