From c21776948d469f36f29367f7058cdfa4d09a853e Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Mon, 30 Mar 2026 00:55:31 +0200 Subject: [PATCH] fix: use app password auth for background sync in Login Flow mode Login Flow v2 is a deployment-wide mode where all users authenticate with app passwords (not OAuth refresh tokens). Set use_basic_auth=True when enable_login_flow is true so the background sync user manager queries the app_passwords table and scanners use app password authentication for Nextcloud API calls. Co-Authored-By: Claude Opus 4.6 (1M context) --- nextcloud_mcp_server/app.py | 6 +++--- nextcloud_mcp_server/vector/oauth_sync.py | 10 +--------- 2 files changed, 4 insertions(+), 12 deletions(-) diff --git a/nextcloud_mcp_server/app.py b/nextcloud_mcp_server/app.py index 551b4bcc..55028f23 100644 --- a/nextcloud_mcp_server/app.py +++ b/nextcloud_mcp_server/app.py @@ -1807,9 +1807,9 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None = break # Determine authentication mode for background sync - # Multi-user BasicAuth: use app passwords via Astrolabe (NOT OAuth) - # OAuth mode: use OAuth refresh tokens (NOT app passwords) - use_basic_auth = not oauth_enabled + # Login Flow v2 and multi-user BasicAuth: use app passwords + # OAuth mode (without Login Flow): use OAuth refresh tokens + use_basic_auth = not oauth_enabled or settings.enable_login_flow # Start background tasks using anyio TaskGroup async with anyio.create_task_group() as tg: diff --git a/nextcloud_mcp_server/vector/oauth_sync.py b/nextcloud_mcp_server/vector/oauth_sync.py index 5f6a5b9e..615977e1 100644 --- a/nextcloud_mcp_server/vector/oauth_sync.py +++ b/nextcloud_mcp_server/vector/oauth_sync.py @@ -489,21 +489,13 @@ async def user_manager_task( try: # Get current provisioned users based on mode if use_basic_auth: - # BasicAuth mode: query app_passwords table + # BasicAuth / Login Flow v2 mode: query app_passwords table provisioned_users = set( await refresh_token_storage.get_all_app_password_user_ids() ) else: # OAuth mode: query refresh_tokens table provisioned_users = set(await refresh_token_storage.get_all_user_ids()) - # Login Flow mode: also check app_passwords table - # (users provisioned via Login Flow v2 have app passwords, - # not refresh tokens) - if settings.enable_login_flow: - app_pw_users = set( - await refresh_token_storage.get_all_app_password_user_ids() - ) - provisioned_users |= app_pw_users active_users = set(user_states.keys()) # Start scanners for new users