New features
Scan history browser
Results from any past scan session can now be reviewed without running a new scan. On page load the latest
completed session is loaded automatically. A Sessions button opens a picker listing all past sessions with
date, sources, item count, and Delta/Latest badges. All filters, exports, and disposition tagging work
normally in history mode. Starting a new scan exits history mode.
User-scoped viewer tokens (#34)
Viewer token links can now be restricted to a specific employee so they only see their own flagged files —
across both M365 and Google Workspace. The Share modal's scope selector gains a User option with a searchable
name autocomplete. Selecting a person stores both their M365 and GWS email addresses; the server filters by
account_id IN (list) so items from either platform are included. The viewer header shows the person's full
name in a locked identity badge.
---
Bug fixes
GWS and local/SMB results missing from exports
Two silent failures caused Google Workspace and file-scan results to disappear from Art.30 and Excel exports
after a page reload:
- google_scan.py called _db.end_scan() (method doesn't exist — should be finish_scan), so GWS scan records
never got finished_at set and were permanently excluded from get_session_items()
- google_scan.py emitted scan_done instead of google_scan_done, breaking SSE teardown logic
- File scan called begin_scan() with keyword arguments it doesn't accept, silently leaving _db_scan_id = None
so local/SMB items were never written to the database
Graph sendMail reported as failure despite email being delivered
_post() called r.json() unconditionally. Graph's sendMail returns HTTP 202 with no body on success, causing a
JSONDecodeError that was caught and reported as a send failure. Fixed with r.json() if r.content else {}.
Graph error hidden by generic SMTP message
When Graph failed and no SMTP host was saved, the real Graph error was swallowed by "No SMTP host
configured". The error is now surfaced directly.
Gmail vs Google Workspace SMTP errors
Auth failure messages now distinguish between personal Gmail (@gmail.com) and Google Workspace custom-domain
accounts. Workspace errors point to the admin console (SMTP relay, 2-Step Verification policy) rather than
the user's personal security settings.
