feat(astrolabe): implement app password provisioning for multi-user background sync

Adds complete app password provisioning workflow for multi-user BasicAuth deployments, allowing users to independently enable background sync by generating and storing Nextcloud app passwords. **New Components:** Backend (PHP): - CredentialsController: Validates and stores app passwords * Validates app password format and authenticity via OCS API * Stores encrypted passwords in oc_preferences * Provides status and credential management endpoints - AstrolabeAdminSettings: Admin configuration page for MCP server URL - AstrolabeAdminSettingsListener: Event listener for admin section - Updated McpTokenStorage: Added background sync credential methods Frontend: - personalSettings.js: Form handling for app password entry * AJAX submission with error handling * Shows success/error notifications * Triggers page reload after successful save - settings.css: Styling for settings pages - Updated personal.php template: Two-option UI * Option 1: OAuth refresh token (future, not yet available) * Option 2: App password (works today, recommended) * Shows "Active" badge when provisioned * Displays credential type and provisioned timestamp Routes: - POST /api/v1/background-sync/credentials - Store app password - GET /api/v1/background-sync/status - Get provisioning status - DELETE /api/v1/background-sync/credentials - Revoke credentials - GET /api/v1/background-sync/credentials/{userId} - Admin only **Testing:** - test_astrolabe_settings_buttons.py: Integration test for UI buttons **Workflow:** 1. User generates app password in Nextcloud Security settings 2. User navigates to Astrolabe personal settings 3. User enters app password in "Option 2: App Password" form 4. Backend validates password via OCS API call 5. Password stored encrypted in oc_preferences 6. Page reloads showing "Active" badge with credential details 7. MCP server can now use stored password for background operations 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-22 19:39:13 +01:00
parent b293258210
commit 65c3f099fa
18 changed files with 1387 additions and 232 deletions
@@ -4,11 +4,15 @@ declare(strict_types=1);

 namespace OCA\Astrolabe\AppInfo;

+use OCA\Astrolabe\Listener\AstrolabeAdminSettingsListener;
 use OCA\Astrolabe\Search\SemanticSearchProvider;
+use OCA\Astrolabe\Settings\AstrolabeAdminSettings;
 use OCP\AppFramework\App;
 use OCP\AppFramework\Bootstrap\IBootContext;
 use OCP\AppFramework\Bootstrap\IBootstrap;
 use OCP\AppFramework\Bootstrap\IRegistrationContext;
+use OCP\Settings\Events\DeclarativeSettingsGetValueEvent;
+use OCP\Settings\Events\DeclarativeSettingsSetValueEvent;

 class Application extends App implements IBootstrap {
 	public const APP_ID = 'astrolabe';
@@ -21,6 +25,19 @@ class Application extends App implements IBootstrap {
 	public function register(IRegistrationContext $context): void {
 		// Register unified search provider for semantic search
 		$context->registerSearchProvider(SemanticSearchProvider::class);
+
+		// Register declarative admin settings
+		$context->registerDeclarativeSettings(AstrolabeAdminSettings::class);
+
+		// Register event listeners for declarative settings
+		$context->registerEventListener(
+			DeclarativeSettingsGetValueEvent::class,
+			AstrolabeAdminSettingsListener::class
+		);
+		$context->registerEventListener(
+			DeclarativeSettingsSetValueEvent::class,
+			AstrolabeAdminSettingsListener::class
+		);
 	}

 	public function boot(IBootContext $context): void {
@@ -97,6 +97,12 @@ class ApiController extends Controller {
 			// TODO: Add flash message/notification for user feedback
 		} else {
 			$this->logger->info("Successfully revoked background access for user $userId");
+
+			// Delete local OAuth tokens from Nextcloud config
+			// This ensures hasBackgroundAccess() returns false on next page load
+			$this->tokenStorage->deleteUserToken($userId);
+			$this->logger->debug("Deleted local OAuth tokens for user $userId");
+
 			// TODO: Add success flash message/notification
 		}

@@ -0,0 +1,258 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\Astrolabe\Controller;
+
+use OCA\Astrolabe\Service\McpServerClient;
+use OCA\Astrolabe\Service\McpTokenStorage;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\Http\Client\IClientService;
+use OCP\IConfig;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use OCP\IUserSession;
+use Psr\Log\LoggerInterface;
+
+/**
+ * Controller for managing background sync credentials (app passwords).
+ *
+ * Handles storing and validating app passwords for multi-user BasicAuth mode.
+ */
+class CredentialsController extends Controller {
+	private $tokenStorage;
+	private $userSession;
+	private $logger;
+	private $config;
+	private $client;
+	private $httpClientService;
+	private $urlGenerator;
+
+	public function __construct(
+		string $appName,
+		IRequest $request,
+		McpTokenStorage $tokenStorage,
+		IUserSession $userSession,
+		LoggerInterface $logger,
+		IConfig $config,
+		McpServerClient $client,
+		IClientService $httpClientService,
+		IURLGenerator $urlGenerator,
+	) {
+		parent::__construct($appName, $request);
+		$this->tokenStorage = $tokenStorage;
+		$this->userSession = $userSession;
+		$this->logger = $logger;
+		$this->config = $config;
+		$this->client = $client;
+		$this->httpClientService = $httpClientService;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	/**
+	 * Store app password for background sync.
+	 *
+	 * Validates the app password by making a test request to Nextcloud,
+	 * then stores it encrypted if valid.
+	 *
+	 * @param string $appPassword Nextcloud app password
+	 * @return JSONResponse
+	 */
+	#[NoAdminRequired]
+	public function storeAppPassword(string $appPassword): JSONResponse {
+		$user = $this->userSession->getUser();
+		if (!$user) {
+			$this->logger->error('storeAppPassword called without authenticated user');
+			return new JSONResponse([
+				'success' => false,
+				'error' => 'User not authenticated'
+			], Http::STATUS_UNAUTHORIZED);
+		}
+
+		$userId = $user->getUID();
+
+		// Validate app password format (xxxxx-xxxxx-xxxxx-xxxxx-xxxxx)
+		if (!preg_match('/^[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}-[a-zA-Z0-9]{5}$/', $appPassword)) {
+			$this->logger->warning("Invalid app password format for user: $userId");
+			return new JSONResponse([
+				'success' => false,
+				'error' => 'Invalid app password format'
+			], Http::STATUS_BAD_REQUEST);
+		}
+
+		// Validate app password with Nextcloud
+		$isValid = $this->validateAppPassword($userId, $appPassword);
+
+		if (!$isValid) {
+			$this->logger->warning("App password validation failed for user: $userId");
+			return new JSONResponse([
+				'success' => false,
+				'error' => 'Invalid app password. Please check the password and try again.'
+			], Http::STATUS_UNAUTHORIZED);
+		}
+
+		// Store encrypted app password
+		try {
+			$this->tokenStorage->storeBackgroundSyncPassword($userId, $appPassword);
+			$this->logger->info("Successfully stored app password for user: $userId");
+
+			return new JSONResponse([
+				'success' => true,
+				'message' => 'App password saved successfully'
+			], Http::STATUS_OK);
+		} catch (\Exception $e) {
+			$this->logger->error("Failed to store app password for user $userId", [
+				'error' => $e->getMessage()
+			]);
+			return new JSONResponse([
+				'success' => false,
+				'error' => 'Failed to save app password'
+			], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+	}
+
+	/**
+	 * Validate app password by making a test request to Nextcloud.
+	 *
+	 * @param string $userId User ID
+	 * @param string $appPassword App password to validate
+	 * @return bool True if valid, false otherwise
+	 */
+	private function validateAppPassword(string $userId, string $appPassword): bool {
+		try {
+			// Use 127.0.0.1 for internal validation (we're running inside Nextcloud container)
+			// Using IP address instead of 'localhost' to avoid Nextcloud's overwrite.cli.url rewriting
+			// getAbsoluteURL() returns the external URL which isn't accessible from inside the container
+			$baseUrl = 'http://127.0.0.1';
+
+			// Make a test request to Nextcloud API with BasicAuth
+			// Using OCS API user endpoint as a lightweight test
+			$testUrl = $baseUrl . '/ocs/v1.php/cloud/user?format=json';
+
+			$this->logger->debug("Validating app password for user: $userId against $testUrl");
+
+			// Use Nextcloud's HTTP client
+			$httpClient = $this->httpClientService->newClient();
+
+			$response = $httpClient->get($testUrl, [
+				'auth' => [$userId, $appPassword],
+				'headers' => [
+					'OCS-APIRequest' => 'true',
+					'Accept' => 'application/json',
+				],
+				'timeout' => 10,
+			]);
+
+			$statusCode = $response->getStatusCode();
+
+			// Success is 200 OK
+			if ($statusCode === 200) {
+				$this->logger->debug("App password validation successful for user: $userId");
+				return true;
+			}
+
+			$this->logger->warning("App password validation failed for user: $userId (HTTP $statusCode)");
+			return false;
+		} catch (\Exception $e) {
+			$this->logger->error("Exception during app password validation for user $userId", [
+				'error' => $e->getMessage()
+			]);
+			return false;
+		}
+	}
+
+	/**
+	 * Get background sync credentials status for the current user.
+	 *
+	 * @return JSONResponse
+	 */
+	#[NoAdminRequired]
+	public function getStatus(): JSONResponse {
+		$user = $this->userSession->getUser();
+		if (!$user) {
+			return new JSONResponse([
+				'success' => false,
+				'error' => 'User not authenticated'
+			], Http::STATUS_UNAUTHORIZED);
+		}
+
+		$userId = $user->getUID();
+
+		$hasAccess = $this->tokenStorage->hasBackgroundSyncAccess($userId);
+		$syncType = $this->tokenStorage->getBackgroundSyncType($userId);
+		$provisionedAt = $this->tokenStorage->getBackgroundSyncProvisionedAt($userId);
+
+		return new JSONResponse([
+			'success' => true,
+			'has_background_access' => $hasAccess,
+			'sync_type' => $syncType,
+			'provisioned_at' => $provisionedAt,
+		], Http::STATUS_OK);
+	}
+
+	/**
+	 * Get credentials for a specific user (admin only).
+	 *
+	 * Note: This does NOT return the actual password, only metadata.
+	 *
+	 * @param string $userId User ID to check
+	 * @return JSONResponse
+	 */
+	public function getCredentials(string $userId): JSONResponse {
+		// This endpoint should only be accessible by admins
+		// For now, just return metadata (not actual credentials)
+		$hasAccess = $this->tokenStorage->hasBackgroundSyncAccess($userId);
+		$syncType = $this->tokenStorage->getBackgroundSyncType($userId);
+		$provisionedAt = $this->tokenStorage->getBackgroundSyncProvisionedAt($userId);
+
+		return new JSONResponse([
+			'success' => true,
+			'user_id' => $userId,
+			'has_background_access' => $hasAccess,
+			'sync_type' => $syncType,
+			'provisioned_at' => $provisionedAt,
+		], Http::STATUS_OK);
+	}
+
+	/**
+	 * Delete background sync credentials for the current user.
+	 *
+	 * @return JSONResponse
+	 */
+	#[NoAdminRequired]
+	public function deleteCredentials(): JSONResponse {
+		$user = $this->userSession->getUser();
+		if (!$user) {
+			return new JSONResponse([
+				'success' => false,
+				'error' => 'User not authenticated'
+			], Http::STATUS_UNAUTHORIZED);
+		}
+
+		$userId = $user->getUID();
+
+		try {
+			// Delete both OAuth tokens and app password (if any exist)
+			$this->tokenStorage->deleteUserToken($userId);
+			$this->tokenStorage->deleteBackgroundSyncPassword($userId);
+
+			$this->logger->info("Deleted background sync credentials for user: $userId");
+
+			return new JSONResponse([
+				'success' => true,
+				'message' => 'Credentials deleted successfully'
+			], Http::STATUS_OK);
+		} catch (\Exception $e) {
+			$this->logger->error("Failed to delete credentials for user $userId", [
+				'error' => $e->getMessage()
+			]);
+			return new JSONResponse([
+				'success' => false,
+				'error' => 'Failed to delete credentials'
+			], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+	}
+}
@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\Astrolabe\Listener;
+
+use OCA\Astrolabe\AppInfo\Application;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\IConfig;
+use OCP\Settings\Events\DeclarativeSettingsGetValueEvent;
+use OCP\Settings\Events\DeclarativeSettingsSetValueEvent;
+use Psr\Log\LoggerInterface;
+
+/**
+ * @template-implements IEventListener<DeclarativeSettingsGetValueEvent|DeclarativeSettingsSetValueEvent>
+ */
+class AstrolabeAdminSettingsListener implements IEventListener {
+	public function __construct(
+		private IConfig $config,
+		private LoggerInterface $logger,
+	) {
+	}
+
+	public function handle(Event $event): void {
+		if (!$event instanceof DeclarativeSettingsGetValueEvent && !$event instanceof DeclarativeSettingsSetValueEvent) {
+			return;
+		}
+
+		if ($event->getApp() !== Application::APP_ID) {
+			return;
+		}
+
+		if ($event->getFormId() !== 'astrolabe-admin-settings') {
+			return;
+		}
+
+		if ($event instanceof DeclarativeSettingsGetValueEvent) {
+			$this->handleGetValue($event);
+		} elseif ($event instanceof DeclarativeSettingsSetValueEvent) {
+			$this->handleSetValue($event);
+		}
+	}
+
+	private function handleGetValue(DeclarativeSettingsGetValueEvent $event): void {
+		$fieldId = $event->getFieldId();
+
+		// Map field IDs to system config keys
+		$value = match($fieldId) {
+			'mcp_server_url' => $this->config->getSystemValue('mcp_server_url', ''),
+			'mcp_server_api_key' => '****', // Never leak the API key on read
+			'astrolabe_client_id' => $this->config->getSystemValue('astrolabe_client_id', ''),
+			'astrolabe_client_secret' => '****', // Never leak the secret on read
+			default => null,
+		};
+
+		if ($value !== null) {
+			$event->setValue($value);
+		}
+	}
+
+	private function handleSetValue(DeclarativeSettingsSetValueEvent $event): void {
+		$fieldId = $event->getFieldId();
+		$value = $event->getValue();
+
+		// Only save if value is not empty (allow clearing by setting to empty string)
+		// For password fields, if the value is '****', don't update (user didn't change it)
+		if ($fieldId === 'mcp_server_api_key' && $value === '****') {
+			$event->stopPropagation();
+			return;
+		}
+		if ($fieldId === 'astrolabe_client_secret' && $value === '****') {
+			$event->stopPropagation();
+			return;
+		}
+
+		try {
+			match($fieldId) {
+				'mcp_server_url' => $this->config->setSystemValue('mcp_server_url', (string)$value),
+				'mcp_server_api_key' => $this->config->setSystemValue('mcp_server_api_key', (string)$value),
+				'astrolabe_client_id' => $this->config->setSystemValue('astrolabe_client_id', (string)$value),
+				'astrolabe_client_secret' => $this->config->setSystemValue('astrolabe_client_secret', (string)$value),
+				default => null,
+			};
+
+			$this->logger->info('Astrolabe admin setting updated', [
+				'field' => $fieldId,
+				'app' => Application::APP_ID,
+			]);
+		} catch (\Exception $e) {
+			$this->logger->error('Failed to update Astrolabe admin setting', [
+				'field' => $fieldId,
+				'error' => $e->getMessage(),
+				'app' => Application::APP_ID,
+			]);
+			throw $e;
+		}
+
+		$event->stopPropagation();
+	}
+}
@@ -202,4 +202,176 @@ class McpTokenStorage {

 		return $token['access_token'];
 	}
+
+	/**
+	 * Store app password for background sync.
+	 *
+	 * App passwords are encrypted before storage and used as an alternative
+	 * to OAuth refresh tokens for background sync operations.
+	 *
+	 * @param string $userId User ID
+	 * @param string $appPassword Nextcloud app password
+	 */
+	public function storeBackgroundSyncPassword(
+		string $userId,
+		string $appPassword,
+	): void {
+		try {
+			// Encrypt app password before storage
+			$encrypted = $this->crypto->encrypt($appPassword);
+
+			// Store in user preferences
+			$this->config->setUserValue(
+				$userId,
+				'astrolabe',
+				'background_sync_password',
+				$encrypted
+			);
+
+			// Mark credential type
+			$this->config->setUserValue(
+				$userId,
+				'astrolabe',
+				'background_sync_type',
+				'app_password'
+			);
+
+			// Store provisioned timestamp
+			$this->config->setUserValue(
+				$userId,
+				'astrolabe',
+				'background_sync_provisioned_at',
+				(string)time()
+			);
+
+			$this->logger->info("Stored background sync app password for user: $userId");
+		} catch (\Exception $e) {
+			$this->logger->error("Failed to store app password for user $userId", [
+				'error' => $e->getMessage()
+			]);
+			throw $e;
+		}
+	}
+
+	/**
+	 * Get app password for background sync.
+	 *
+	 * @param string $userId User ID
+	 * @return string|null Decrypted app password, or null if not set
+	 */
+	public function getBackgroundSyncPassword(string $userId): ?string {
+		try {
+			$encrypted = $this->config->getUserValue(
+				$userId,
+				'astrolabe',
+				'background_sync_password',
+				''
+			);
+
+			if (empty($encrypted)) {
+				return null;
+			}
+
+			// Decrypt app password
+			return $this->crypto->decrypt($encrypted);
+		} catch (\Exception $e) {
+			$this->logger->error("Failed to retrieve app password for user $userId", [
+				'error' => $e->getMessage()
+			]);
+			return null;
+		}
+	}
+
+	/**
+	 * Delete background sync app password for a user.
+	 *
+	 * @param string $userId User ID
+	 */
+	public function deleteBackgroundSyncPassword(string $userId): void {
+		try {
+			$this->config->deleteUserValue(
+				$userId,
+				'astrolabe',
+				'background_sync_password'
+			);
+
+			$this->config->deleteUserValue(
+				$userId,
+				'astrolabe',
+				'background_sync_type'
+			);
+
+			$this->config->deleteUserValue(
+				$userId,
+				'astrolabe',
+				'background_sync_provisioned_at'
+			);
+
+			$this->logger->info("Deleted background sync app password for user: $userId");
+		} catch (\Exception $e) {
+			$this->logger->error("Failed to delete app password for user $userId", [
+				'error' => $e->getMessage()
+			]);
+			throw $e;
+		}
+	}
+
+	/**
+	 * Check if user has provisioned background sync access.
+	 *
+	 * Returns true if either OAuth tokens or app password is configured.
+	 *
+	 * @param string $userId User ID
+	 * @return bool True if background sync is provisioned
+	 */
+	public function hasBackgroundSyncAccess(string $userId): bool {
+		// Check for OAuth tokens
+		$oauthToken = $this->getUserToken($userId);
+		if ($oauthToken !== null) {
+			return true;
+		}
+
+		// Check for app password
+		$appPassword = $this->getBackgroundSyncPassword($userId);
+		return $appPassword !== null;
+	}
+
+	/**
+	 * Get background sync credential type for a user.
+	 *
+	 * @param string $userId User ID
+	 * @return string|null 'oauth' or 'app_password', or null if not provisioned
+	 */
+	public function getBackgroundSyncType(string $userId): ?string {
+		$type = $this->config->getUserValue(
+			$userId,
+			'astrolabe',
+			'background_sync_type',
+			''
+		);
+
+		// Fallback to OAuth if tokens exist but type not set
+		if (empty($type) && $this->getUserToken($userId) !== null) {
+			return 'oauth';
+		}
+
+		return empty($type) ? null : $type;
+	}
+
+	/**
+	 * Get background sync provisioned timestamp for a user.
+	 *
+	 * @param string $userId User ID
+	 * @return int|null Unix timestamp, or null if not provisioned
+	 */
+	public function getBackgroundSyncProvisionedAt(string $userId): ?int {
+		$timestamp = $this->config->getUserValue(
+			$userId,
+			'astrolabe',
+			'background_sync_provisioned_at',
+			''
+		);
+
+		return empty($timestamp) ? null : (int)$timestamp;
+	}
 }
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\Astrolabe\Settings;
+
+use OCP\IL10N;
+use OCP\Settings\DeclarativeSettingsTypes;
+use OCP\Settings\IDeclarativeSettingsForm;
+
+class AstrolabeAdminSettings implements IDeclarativeSettingsForm {
+	public function __construct(
+		private IL10N $l,
+	) {
+	}
+
+	public function getSchema(): array {
+		return [
+			'id' => 'astrolabe-admin-settings',
+			'priority' => 10,
+			'section_type' => DeclarativeSettingsTypes::SECTION_TYPE_ADMIN,
+			'section_id' => 'astrolabe',
+			'storage_type' => DeclarativeSettingsTypes::STORAGE_TYPE_EXTERNAL,
+			'title' => $this->l->t('MCP Server Configuration'),
+			'description' => $this->l->t('Configure the connection to your Nextcloud MCP Server'),
+			'doc_url' => 'https://github.com/cbcoutinho/nextcloud-mcp-server',
+
+			'fields' => [
+				[
+					'id' => 'mcp_server_url',
+					'title' => $this->l->t('MCP Server URL'),
+					'description' => $this->l->t('The base URL of your Nextcloud MCP Server instance (e.g., http://localhost:8000)'),
+					'type' => DeclarativeSettingsTypes::URL,
+					'placeholder' => 'http://localhost:8000',
+					'default' => '',
+				],
+				[
+					'id' => 'mcp_server_api_key',
+					'title' => $this->l->t('API Key'),
+					'description' => $this->l->t('Authentication key for the MCP server (leave empty if not required)'),
+					'type' => DeclarativeSettingsTypes::PASSWORD,
+					'placeholder' => $this->l->t('Enter API key'),
+					'default' => '',
+				],
+				[
+					'id' => 'astrolabe_client_id',
+					'title' => $this->l->t('OAuth Client ID'),
+					'description' => $this->l->t('The OAuth client ID for Astrolabe (required for multi-user deployments)'),
+					'type' => DeclarativeSettingsTypes::TEXT,
+					'placeholder' => $this->l->t('Enter OAuth client ID'),
+					'default' => '',
+				],
+				[
+					'id' => 'astrolabe_client_secret',
+					'title' => $this->l->t('OAuth Client Secret'),
+					'description' => $this->l->t('Optional: Client secret for OAuth. If not set, PKCE will be used as fallback.'),
+					'type' => DeclarativeSettingsTypes::PASSWORD,
+					'placeholder' => $this->l->t('Enter client secret (optional)'),
+					'default' => '',
+				],
+			],
+		];
+	}
+}
@@ -55,11 +55,87 @@ class Personal implements ISettings {

 		$userId = $user->getUID();

+		// Fetch server status to determine auth mode
+		$serverStatus = $this->client->getStatus();
+
+		// Check for server connection error
+		if (isset($serverStatus['error'])) {
+			return new TemplateResponse(
+				Application::APP_ID,
+				'settings/error',
+				[
+					'error' => 'Cannot connect to MCP server',
+					'details' => $serverStatus['error'],
+					'server_url' => $this->client->getPublicServerUrl(),
+				],
+				TemplateResponse::RENDER_AS_BLANK
+			);
+		}
+
+		// Get auth mode from server (defaults to oauth if not specified)
+		$authMode = $serverStatus['auth_mode'] ?? 'oauth';
+		$supportsAppPasswords = $serverStatus['supports_app_passwords'] ?? false;
+
 		// Check if user has MCP OAuth token
 		$token = $this->tokenStorage->getUserToken($userId);

-		// If no token or token is expired, show OAuth authorization UI
-		if (!$token || $this->tokenStorage->isExpired($token)) {
+		// For multi_user_basic mode with app password support, check if user has app password
+		if ($authMode === 'multi_user_basic' && $supportsAppPasswords) {
+			// Check if user has already provided an app password
+			$hasBackgroundAccess = $this->tokenStorage->hasBackgroundSyncAccess($userId);
+
+			if (!$hasBackgroundAccess) {
+				// No app password yet - show app password entry form
+				return new TemplateResponse(
+					Application::APP_ID,
+					'settings/personal',
+					[
+						'serverUrl' => $this->client->getPublicServerUrl(), // Changed from server_url to serverUrl
+						'serverStatus' => $serverStatus,
+						'auth_mode' => $authMode,
+						'authMode' => $authMode, // Add camelCase version for template
+						'supports_app_passwords' => $supportsAppPasswords,
+						'supportsAppPasswords' => $supportsAppPasswords, // Add camelCase version
+						'session' => null, // No session yet
+						'hasBackgroundAccess' => false, // FIXED: Add missing parameter
+						'backgroundAccessGranted' => false, // FIXED: Add missing parameter
+						'vectorSyncEnabled' => $serverStatus['vector_sync_enabled'] ?? false,
+						'hasToken' => false, // No OAuth token in multi_user_basic mode
+						'requesttoken' => \OCP\Util::callRegister(),
+					],
+					TemplateResponse::RENDER_AS_BLANK
+				);
+			} else {
+				// User has app password - show active status
+				$backgroundSyncType = $this->tokenStorage->getBackgroundSyncType($userId);
+				$backgroundSyncProvisionedAt = $this->tokenStorage->getBackgroundSyncProvisionedAt($userId);
+
+				$parameters = [
+					'userId' => $userId,
+					'serverStatus' => $serverStatus,
+					'session' => null, // No user session for app passwords
+					'vectorSyncEnabled' => $serverStatus['vector_sync_enabled'] ?? false,
+					'backgroundAccessGranted' => true, // App password grants background access
+					'serverUrl' => $this->client->getPublicServerUrl(),
+					'hasToken' => false, // No OAuth token
+					'hasBackgroundAccess' => true,
+					'backgroundSyncType' => $backgroundSyncType,
+					'backgroundSyncProvisionedAt' => $backgroundSyncProvisionedAt,
+					'authMode' => $authMode,
+					'supportsAppPasswords' => $supportsAppPasswords,
+					'requesttoken' => \OCP\Util::callRegister(),
+				];
+
+				return new TemplateResponse(
+					Application::APP_ID,
+					'settings/personal',
+					$parameters,
+					TemplateResponse::RENDER_AS_BLANK
+				);
+			}
+		}
+		// For OAuth modes, if no token or token is expired, show OAuth authorization UI
+		elseif (!$token || $this->tokenStorage->isExpired($token)) {
 			$oauthUrl = $this->urlGenerator->linkToRoute('astrolabe.oauth.initiateOAuth');

 			return new TemplateResponse(
@@ -117,6 +193,11 @@ class Personal implements ISettings {
 			);
 		}

+		// Check background sync credential status
+		$hasBackgroundAccess = $this->tokenStorage->hasBackgroundSyncAccess($userId);
+		$backgroundSyncType = $this->tokenStorage->getBackgroundSyncType($userId);
+		$backgroundSyncProvisionedAt = $this->tokenStorage->getBackgroundSyncProvisionedAt($userId);
+
 		// Provide initial state for Vue.js frontend (if needed)
 		$this->initialState->provideInitialState('user-data', [
 			'userId' => $userId,
@@ -132,6 +213,9 @@ class Personal implements ISettings {
 			'backgroundAccessGranted' => $userSession['background_access_granted'] ?? false,
 			'serverUrl' => $this->client->getPublicServerUrl(),
 			'hasToken' => true,
+			'hasBackgroundAccess' => $hasBackgroundAccess,
+			'backgroundSyncType' => $backgroundSyncType,
+			'backgroundSyncProvisionedAt' => $backgroundSyncProvisionedAt,
 		];

 		return new TemplateResponse(