{"record":{"id":"ac6bfd1fd9d69194","repo":"infiniflow/ragflow","slug":"failed-to-fetch-search-list","errorCode":null,"errorMessage":"Failed to fetch search list","messagePattern":"Failed to fetch search list","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"web/src/pages/next-searches/hooks.ts","lineNumber":137,"sourceCode":"        filterValue,\n        ...pagination,\n      },\n    ],\n    queryFn: async () => {\n      const { data: response } = await searchService.getSearchList(\n        {\n          params: {\n            keywords: debouncedSearchString,\n            page_size: pagination.pageSize,\n            page: pagination.current,\n            owner_ids: filterValue.owner,\n          },\n          paramsSerializer: { indexes: null },\n        },\n        true,\n      );\n      if (response.code !== 0) {\n        throw new Error(response.message || 'Failed to fetch search list');\n      }\n      return response;\n    },\n  });\n\n  return {\n    data,\n    isLoading,\n    isError,\n    pagination,\n    searchString,\n    handleInputChange,\n    setPagination,\n    refetch,\n    filterValue,\n    handleFilterSubmit,\n  };\n};","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/web/src/pages/next-searches/hooks.ts#L119-L155","documentation":"google_auth_oauthlib emits a Warning('Scope has changed') when the scopes requested at run time differ from those previously granted/consented — practically, Google refused one of the requested scopes. This handler converts it into a RuntimeError with concrete remediation: add the scopes in the consent screen or override the requested set via GOOGLE_OAUTH_SCOPE_OVERRIDE.","triggerScenarios":"Running the OAuth flow requesting Drive metadata + Admin Directory read scopes when the GCP app's configured consent screen does not include them (unverified app scope restrictions, internal-only app missing scope registration), or Google's default run_local_server behavior detecting a scope delta.","commonSituations":"New deployments where the OAuth consent screen was never updated with the admin-directory scope, Workspace policies restricting sensitive scopes until the app is verified, custom scope lists diverging from what was consented previously.","solutions":["GCP Console > APIs & Services > OAuth consent screen: add the Drive metadata and Admin Directory read scopes, then re-run the flow","If policy blocks those scopes, set GOOGLE_OAUTH_SCOPE_OVERRIDE=<comma-separated allowed scopes> and re-run — accept the reduced functionality","For testing apps in testing status, add your test users so scope grants succeed"],"exampleFix":"# before: flow requests fixed scopes the app can't grant\nscopes = _get_requested_scopes(source)  # includes admin.directory...\nflow.run_local_server(scopes=scopes)  # Warning → RuntimeError\n\n# after: restrict to permitted scopes via env\n# export GOOGLE_OAUTH_SCOPE_OVERRIDE=\"https://www.googleapis.com/auth/drive.readonly.metadata\"\nflow.run_local_server()  # _get_requested_scopes honors the override","handlingStrategy":"validation","validationCode":"REQUIRED_FLOW_SCOPES = {\n    \"https://www.googleapis.com/auth/drive.readonly.metadata\",\n    \"https://www.googleapis.com/auth/admin.directory.user.readonly\",\n}\n\ndef consent_screen_covers_required() -> bool:\n    configured = fetch_oauth_app_scopes()  # via GCP API or config export\n    return REQUIRED_FLOW_SCOPES <= configured or bool(os.environ.get(\"GOOGLE_OAUTH_SCOPE_OVERRIDE\"))","typeGuard":null,"tryCatchPattern":"try:\n    token_dict = run_google_oauth_flow(source)\nexcept RuntimeError as e:\n    if \"Scope has changed\" in str(e) or \"requested OAuth scopes\" in str(e):\n        os.environ[\"GOOGLE_OAUTH_SCOPE_OVERRIDE\"] = ask_admin_for_allowed_scopes()\n        token_dict = run_google_oauth_flow(source)  # retry with reduced set\n    else:\n        raise","preventionTips":["Add required scopes to the OAuth consent screen before first rollout","Treat scope changes as breaking config changes: update console + docs + re-consent together","Keep GOOGLE_OAUTH_SCOPE_OVERRIDE documented as the escape hatch for locked-down tenants"],"tags":["google-oauth","scopes","consent-screen","configuration"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}