chore(deps): update dependency python to 3.14

.github/workflows/appstore-build-publish.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@v4
 
       - name: Get version from tag
         id: tag
@@ -35,18 +35,18 @@ jobs:
           echo "Version validated: $INFO_VERSION"
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@v4
         with:
           node-version: 22
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2
+        uses: shivammathur/setup-php@v2
         with:
           php-version: 8.1
           coverage: none
 
       - name: Checkout Nextcloud server (for signing)
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@v4
         with:
           repository: nextcloud/server
           ref: stable30
@@ -70,7 +70,7 @@ jobs:
         run: make appstore server_dir=${{ github.workspace }}/server
 
       - name: Create GitHub release and attach tarball
-        uses: svenstaro/upload-release-action@6b7fa9f267e90b50a19fef07b3596790bb941741 # v2
+        uses: svenstaro/upload-release-action@v2
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           file: ${{ env.APP_DIR }}/build/artifacts/${{ env.APP_NAME }}.tar.gz
@@ -80,7 +80,7 @@ jobs:
           prerelease: ${{ contains(steps.tag.outputs.TAG, '-alpha') || contains(steps.tag.outputs.TAG, '-beta') || contains(steps.tag.outputs.TAG, '-rc') }}
 
       - name: Upload to Nextcloud App Store
-        uses: R0Wi/nextcloud-appstore-push-action@9244bb5445776688cfe90fa1903ea8dff95b0c28 # v1.0.4
+        uses: R0Wi/nextcloud-appstore-push-action@v1.0.4
         with:
           app_name: ${{ env.APP_NAME }}
           appstore_token: ${{ secrets.APPSTORE_TOKEN }}

.github/workflows/bump-version.yml

@@ -21,9 +21,9 @@ jobs:
           token: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
 
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.14'
 
       - name: Install uv
         run: |
@@ -130,36 +130,29 @@ jobs:
           echo "Pushed tags for components:${{ steps.bump.outputs.components }}"
 
       - name: Summary
+        if: steps.bump.outputs.bumped == 'true'
         run: |
-          if [ "${{ steps.bump.outputs.bumped }}" == "true" ]; then
+          echo "## Version Bump Summary" >> $GITHUB_STEP_SUMMARY
-            echo "## Version Bump Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
+          echo "The following components were bumped:" >> $GITHUB_STEP_SUMMARY
-            echo "The following components were bumped:" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
 
-            for component in ${{ steps.bump.outputs.components }}; do
+          for component in ${{ steps.bump.outputs.components }}; do
-              case $component in
+            case $component in
-                mcp)
+              mcp)
-                  tag=$(git tag --sort=-creatordate | grep -E '^v[0-9]' | head -n 1)
+                tag=$(git tag --sort=-creatordate | grep -E '^v[0-9]' | head -n 1)
-                  echo "- **MCP Server**: \`$tag\`" >> $GITHUB_STEP_SUMMARY
+                echo "- **MCP Server**: \`$tag\`" >> $GITHUB_STEP_SUMMARY
-                  ;;
+                ;;
-                helm)
+              helm)
-                  tag=$(git tag --sort=-creatordate | grep -E '^nextcloud-mcp-server-' | head -n 1)
+                tag=$(git tag --sort=-creatordate | grep -E '^nextcloud-mcp-server-' | head -n 1)
-                  echo "- **Helm Chart**: \`$tag\`" >> $GITHUB_STEP_SUMMARY
+                echo "- **Helm Chart**: \`$tag\`" >> $GITHUB_STEP_SUMMARY
-                  ;;
+                ;;
-                astrolabe)
+              astrolabe)
-                  tag=$(git tag --sort=-creatordate | grep -E '^astrolabe-v' | head -n 1)
+                tag=$(git tag --sort=-creatordate | grep -E '^astrolabe-v' | head -n 1)
-                  echo "- **Astrolabe**: \`$tag\`" >> $GITHUB_STEP_SUMMARY
+                echo "- **Astrolabe**: \`$tag\`" >> $GITHUB_STEP_SUMMARY
-                  ;;
+                ;;
-              esac
+            esac
-            done
+          done
 
-            echo "" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
-            echo "Tags have been pushed and release workflows will trigger automatically." >> $GITHUB_STEP_SUMMARY
+          echo "Tags have been pushed and release workflows will trigger automatically." >> $GITHUB_STEP_SUMMARY
-          else
-            echo "## Version Bump Summary" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "✅ No version bumps required - no relevant commits found since last release." >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "The workflow completed successfully with no changes." >> $GITHUB_STEP_SUMMARY
-          fi

.github/workflows/test.yml

@@ -48,23 +48,6 @@ jobs:
       ###### Required to build OIDC App ######
 
 
-      ###### Required to build Astrolabe App ######
-
-      - name: Set up Node.js for Astrolabe
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
-        with:
-          node-version: '20'
-
-      - name: Build Astrolabe app
-        run: |
-          cd third_party/astrolabe
-          composer install --no-dev --optimize-autoloader
-          npm ci
-          npm run build
-
-      ###### Required to build Astrolabe App ######
-
-
       - name: Run docker compose
         uses: hoverkraft-tech/compose-action@248470ecc5ed40d8ed3d4480d8260d77179ef579 # v2.4.2
         with:

app-hooks/post-installation/20-install-astrolabe-app.sh

@@ -2,7 +2,7 @@
 
 set -euox pipefail
 
-echo "Installing Astrolabe app for testing..."
+echo "Installing and configuring Astrolabe app for testing..."
 
 # Check if development astrolabe app is mounted at /opt/apps/astrolabe
 if [ -d /opt/apps/astrolabe ]; then
@@ -30,7 +30,55 @@ else
     php /var/www/html/occ app:enable astrolabe
 fi
 
-echo "✓ Astrolabe app installed successfully"
+# Configure MCP server URLs in Nextcloud system config
-echo ""
+# - mcp_server_url: Internal URL for PHP app to call MCP server APIs (Docker internal network)
-echo "Note: MCP server configuration is managed dynamically during tests"
+# - mcp_server_public_url: Public URL for OAuth token audience (what browsers/MCP clients see)
-echo "      to support testing multiple MCP server deployments."
+php /var/www/html/occ config:system:set mcp_server_url --value='http://mcp-oauth:8001'
+php /var/www/html/occ config:system:set mcp_server_public_url --value='http://localhost:8001'
+
+# Create OAuth client for Astrolabe app
+# The resource_url MUST match what the MCP server expects as token audience
+# This allows tokens from this client to be validated by MCP server's UnifiedTokenVerifier
+MCP_CLIENT_ID="nextcloudMcpServerUIPublicClient"
+MCP_RESOURCE_URL="http://localhost:8001"
+MCP_REDIRECT_URI="http://localhost:8080/apps/astrolabe/oauth/callback"
+
+echo "Configuring OAuth client for Astrolabe..."
+
+# Check if client already exists
+if php /var/www/html/occ oidc:list 2>/dev/null | grep -q "$MCP_CLIENT_ID"; then
+    echo "OAuth client $MCP_CLIENT_ID already exists, removing to recreate with correct settings..."
+    php /var/www/html/occ oidc:remove "$MCP_CLIENT_ID" || true
+fi
+
+# Create OAuth client with correct resource_url for MCP server audience
+echo "Creating OAuth confidential client with resource_url=$MCP_RESOURCE_URL"
+CLIENT_OUTPUT=$(php /var/www/html/occ oidc:create \
+    "Astrolabe" \
+    "$MCP_REDIRECT_URI" \
+    --client_id="$MCP_CLIENT_ID" \
+    --type=confidential \
+    --flow=code \
+    --token_type=jwt \
+    --resource_url="$MCP_RESOURCE_URL" \
+    --allowed_scopes="openid profile email offline_access notes:read notes:write calendar:read calendar:write contacts:read contacts:write cookbook:read cookbook:write deck:read deck:write tables:read tables:write files:read files:write")
+
+echo "$CLIENT_OUTPUT"
+
+# Extract client_secret from JSON output
+CLIENT_SECRET=$(echo "$CLIENT_OUTPUT" | php -r 'echo json_decode(file_get_contents("php://stdin"), true)["client_secret"] ?? "";')
+
+if [ -n "$CLIENT_SECRET" ]; then
+    echo "Configuring Astrolabe client secret in system config..."
+    php /var/www/html/occ config:system:set astrolabe_client_secret --value="$CLIENT_SECRET"
+    echo "✓ Client secret configured: ${CLIENT_SECRET:0:8}..."
+else
+    echo "⚠ Warning: Could not extract client_secret from OIDC client creation"
+fi
+
+# Configure OAuth client ID in system config
+echo "Configuring Astrolabe client ID in system config..."
+php /var/www/html/occ config:system:set astrolabe_client_id --value="$MCP_CLIENT_ID"
+echo "✓ Client ID configured: $MCP_CLIENT_ID"
+
+echo "Astrolabe app installed and configured successfully"

docker-compose.yml

@@ -35,7 +35,7 @@ services:
       # Mount OIDC development directory outside /var/www/html to avoid rsync conflicts
       # The post-installation hook will register /opt/apps as an additional app directory
       #- ./third_party:/opt/apps:ro
-      - ./third_party/astrolabe:/opt/apps/astrolabe:ro
+      #- ./third_party/astrolabe:/opt/apps/astrolabe:ro
     environment:
       - NEXTCLOUD_TRUSTED_DOMAINS=app
       - NEXTCLOUD_ADMIN_USER=admin
@@ -123,32 +123,6 @@ services:
       # - DOCUMENT_CHUNK_SIZE=512      # Words per chunk (default: 512)
       # - DOCUMENT_CHUNK_OVERLAP=50    # Overlapping words (default: 50, recommended: 10-20% of chunk size)
 
-  mcp-multi-user-basic:
-    build: .
-    restart: always
-    command: ["--transport", "streamable-http"]
-    depends_on:
-      app:
-        condition: service_healthy
-    ports:
-      - 127.0.0.1:8003:8000
-    environment:
-      # Multi-user BasicAuth pass-through mode (ADR-020)
-      - NEXTCLOUD_HOST=http://app:80
-      - NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
-      - ENABLE_MULTI_USER_BASIC_AUTH=true
-
-      # Token storage (required for middleware initialization)
-      - TOKEN_ENCRYPTION_KEY=ESF1BvEQdGYsCluwMx9Cxvw3uh5pFowPH7Rg_nIliyo=
-      - TOKEN_STORAGE_DB=/app/data/tokens.db
-
-      # Vector sync disabled (stateless pass-through mode)
-      - VECTOR_SYNC_ENABLED=false
-
-      # NO admin credentials - credentials come from client Authorization header
-    volumes:
-      - multi-user-basic-data:/app/data
-
   mcp-oauth:
     build: .
     command: ["--transport", "streamable-http", "--oauth", "--port", "8001", "--oauth-token-type", "jwt"]
@@ -185,11 +159,6 @@ services:
       # Qdrant configuration - persistent local storage
       - QDRANT_LOCATION=/app/data/qdrant
 
-      # Embedding provider for vector sync (use Simple provider as fallback)
-      # Ollama not available in CI/test environments
-      # - OLLAMA_BASE_URL=http://ollama:11434
-      # - OLLAMA_EMBEDDING_MODEL=nomic-embed-text
-
       # NO admin credentials - using OAuth with Dynamic Client Registration (DCR)
       # Client credentials registered via RFC 7591 and stored in volume
       # JWT token type is used for testing (faster validation, scopes embedded in token)
@@ -311,4 +280,3 @@ volumes:
   keycloak-oauth-storage:
   qdrant-data:
   mcp-data:
-  multi-user-basic-data:

docs/ADR-020-deployment-modes-and-configuration-validation.md

@@ -1,342 +0,0 @@
-# ADR-020: Deployment Modes and Configuration Validation
-
-**Status:** Accepted
-**Date:** 2025-12-20
-**Deciders:** Development Team
-**Related:** ADR-002 (Vector Sync), ADR-004 (Progressive Consent), ADR-019 (Multi-user BasicAuth)
-
-## Context
-
-The MCP server supports multiple deployment scenarios with different authentication methods, storage backends, and feature sets. Over time, the configuration system evolved to support ~500+ possible combinations across deployment modes, authentication patterns, and feature toggles. This complexity made it difficult to:
-
-1. Understand what configuration is required for a given deployment
-2. Debug configuration errors (validation scattered across multiple files)
-3. Provide helpful error messages when configuration is invalid
-4. Maintain clear boundaries between deployment modes
-
-**Problems Identified:**
-- No single source of truth for "what config is required for mode X"
-- Validation happening at 4+ different points (Settings.__post_init__, setup_oauth_config(), context helpers, starlette_lifespan)
-- Startup sequence unclear (OAuth setup before FastMCP creation, sync initialization errors)
-- Error messages generic ("X is required") without explaining which deployment mode triggered the requirement
-- Multiple overlapping decision trees (deployment mode, auth mode, features)
-
-## Decision
-
-We formalize five distinct deployment modes with explicit configuration requirements and implement centralized configuration validation.
-
-### Deployment Modes
-
-#### 1. Single-User BasicAuth
-
-**Use Case:** Personal Nextcloud instance, local development
-
-**Required Configuration:**
-```bash
-NEXTCLOUD_HOST=http://localhost:8080
-NEXTCLOUD_USERNAME=admin
-NEXTCLOUD_PASSWORD=password  # Or app password
-```
-
-**Optional Configuration:**
-```bash
-# Vector sync (semantic search)
-VECTOR_SYNC_ENABLED=true
-QDRANT_LOCATION=/path/to/qdrant  # Or QDRANT_URL for remote
-
-# Embeddings (optional - Simple provider used as fallback)
-OLLAMA_BASE_URL=http://localhost:11434
-OLLAMA_EMBEDDING_MODEL=nomic-embed-text
-
-# Document processing
-DOCUMENT_CHUNK_SIZE=512
-DOCUMENT_CHUNK_OVERLAP=50
-```
-
-**Characteristics:**
-- Single shared NextcloudClient created at startup
-- No OAuth infrastructure needed
-- No multi-user support
-- Vector sync runs as single-user background task
-- Admin UI available at /app
-
----
-
-#### 2. Multi-User BasicAuth Pass-Through
-
-**Use Case:** Internal deployment where users provide their own credentials, no background sync needed
-
-**Required Configuration:**
-```bash
-NEXTCLOUD_HOST=http://nextcloud.example.com
-ENABLE_MULTI_USER_BASIC_AUTH=true
-```
-
-**Optional Configuration:**
-```bash
-# For background sync (requires app passwords from Astrolabe)
-ENABLE_OFFLINE_ACCESS=true
-TOKEN_ENCRYPTION_KEY=<key>
-TOKEN_STORAGE_DB=/path/to/tokens.db
-NEXTCLOUD_OIDC_CLIENT_ID=<client-id>
-NEXTCLOUD_OIDC_CLIENT_SECRET=<client-secret>
-VECTOR_SYNC_ENABLED=true
-# ... plus Qdrant and embedding config
-```
-
-**Conditional Requirements:**
-- If `ENABLE_OFFLINE_ACCESS=true`: requires `NEXTCLOUD_OIDC_CLIENT_ID`, `NEXTCLOUD_OIDC_CLIENT_SECRET`, `TOKEN_ENCRYPTION_KEY`, `TOKEN_STORAGE_DB`
-- If `VECTOR_SYNC_ENABLED=true`: requires `ENABLE_OFFLINE_ACCESS=true`
-
-**Characteristics:**
-- No OAuth for client authentication (uses BasicAuth in request headers)
-- BasicAuthMiddleware extracts credentials from Authorization header
-- Client created per-request from extracted credentials
-- Optional: Background sync using app passwords (via Astrolabe API)
-- Admin UI available at /app
-
----
-
-#### 3. OAuth Single-Audience (Default)
-
-**Use Case:** Multi-user deployment with OAuth authentication, tokens work for both MCP and Nextcloud
-
-**Required Configuration:**
-```bash
-NEXTCLOUD_HOST=http://nextcloud.example.com
-# No NEXTCLOUD_USERNAME/PASSWORD (triggers OAuth mode)
-```
-
-**Auto-Configured:**
-- OIDC discovery URL: `{NEXTCLOUD_HOST}/.well-known/openid-configuration`
-- Client credentials: Dynamic Client Registration (DCR) if available
-- Token storage: SQLite at `~/.oauth/clients.db`
-
-**Optional Configuration:**
-```bash
-# Static client credentials (instead of DCR)
-NEXTCLOUD_OIDC_CLIENT_ID=<client-id>
-NEXTCLOUD_OIDC_CLIENT_SECRET=<client-secret>
-
-# Offline access for background sync
-ENABLE_OFFLINE_ACCESS=true
-TOKEN_ENCRYPTION_KEY=<key>
-TOKEN_STORAGE_DB=/path/to/tokens.db
-VECTOR_SYNC_ENABLED=true
-# ... plus Qdrant and embedding config
-
-# Scopes
-NEXTCLOUD_OIDC_SCOPES="openid profile email notes:read notes:write ..."
-```
-
-**Conditional Requirements:**
-- If `ENABLE_OFFLINE_ACCESS=true`: requires `TOKEN_ENCRYPTION_KEY`, `TOKEN_STORAGE_DB`
-- If `VECTOR_SYNC_ENABLED=true`: requires `ENABLE_OFFLINE_ACCESS=true`
-
-**Characteristics:**
-- Tokens contain both `aud: ["mcp-server", "nextcloud"]`
-- Pass token through to Nextcloud APIs (no exchange)
-- Client created per-request from token in Authorization header
-- Background sync uses refresh tokens (if offline_access enabled)
-- Admin UI available at /app
-
----
-
-#### 4. OAuth Token Exchange (RFC 8693)
-
-**Use Case:** Multi-user deployment where MCP token is separate from Nextcloud token
-
-**Required Configuration:**
-```bash
-NEXTCLOUD_HOST=http://nextcloud.example.com
-ENABLE_TOKEN_EXCHANGE=true
-# No NEXTCLOUD_USERNAME/PASSWORD (triggers OAuth mode)
-```
-
-**Optional Configuration:**
-- Same as OAuth Single-Audience, plus:
-```bash
-TOKEN_EXCHANGE_CACHE_TTL=300  # Cache exchanged tokens
-```
-
-**Characteristics:**
-- Tokens contain only `aud: "mcp-server"`
-- MCP server exchanges token for Nextcloud token via RFC 8693
-- Exchanged tokens cached per-user
-- Client created per-request using exchanged token
-- Background sync uses refresh tokens (if offline_access enabled)
-
----
-
-#### 5. Smithery Stateless
-
-**Use Case:** Multi-tenant SaaS deployment via Smithery platform
-
-**Required Configuration:**
-- None! Configuration comes from session URL params: `?nextcloud_url=...&username=...&app_password=...`
-
-**Forbidden Configuration:**
-- Must NOT set: `NEXTCLOUD_HOST`, `NEXTCLOUD_USERNAME`, `NEXTCLOUD_PASSWORD`, `ENABLE_MULTI_USER_BASIC_AUTH`, `ENABLE_TOKEN_EXCHANGE`, `ENABLE_OFFLINE_ACCESS`, `VECTOR_SYNC_ENABLED`, `NEXTCLOUD_OIDC_CLIENT_ID`, `NEXTCLOUD_OIDC_CLIENT_SECRET`
-
-**Characteristics:**
-- No persistent storage (stateless)
-- Client created per-request from session config
-- No vector sync (disabled)
-- No admin UI (no /app routes)
-- No OAuth infrastructure
-
----
-
-### Configuration Validation
-
-**Implementation:** `nextcloud_mcp_server/config_validators.py`
-
-**Key Functions:**
-```python
-def detect_auth_mode(settings: Settings) -> AuthMode:
-    """Detect authentication mode from configuration.
-
-    Priority (most specific to most general):
-    1. Smithery (explicit flag)
-    2. Token exchange (most specific OAuth mode)
-    3. Multi-user BasicAuth
-    4. Single-user BasicAuth
-    5. OAuth single-audience (default OAuth mode)
-    """
-
-def validate_configuration(settings: Settings) -> tuple[AuthMode, list[str]]:
-    """Validate configuration for detected mode.
-
-    Returns:
-        Tuple of (detected_mode, list_of_errors)
-        Empty list means valid configuration.
-    """
-```
-
-**Validation Rules:**
-- **Required variables:** Must be set and non-empty
-- **Forbidden variables:** Must NOT be set (or must be False for booleans)
-- **Conditional requirements:** If feature X is enabled, requires variables Y and Z
-
-**Error Messages:**
-```
-Configuration validation failed for {mode} mode:
-  - [{mode}] Missing required configuration: NEXTCLOUD_HOST
-  - [{mode}] ENABLE_OFFLINE_ACCESS must be enabled when VECTOR_SYNC_ENABLED is true
-
-Mode: {mode}
-Description: {mode_description}
-
-Required configuration:
-  - VAR1
-  - VAR2
-
-Optional configuration:
-  - VAR3
-  - VAR4
-
-Conditional requirements:
-  When FEATURE is enabled:
-    - VAR5
-    - VAR6
-```
-
-**Integration:**
-- Validation runs at app startup in `get_app()` (app.py:1048-1062)
-- All errors reported before any initialization begins
-- Mode-specific error messages explain requirements
-- Validation uses the same Settings object used throughout the app
-
-### Configuration Matrix
-
-| Variable | Single BasicAuth | Multi BasicAuth | OAuth Single | OAuth Exchange | Smithery |
-|----------|------------------|-----------------|--------------|----------------|----------|
-| **NEXTCLOUD_HOST** | Required | Required | Required | Required | Forbidden |
-| **NEXTCLOUD_USERNAME** | Required | Forbidden | Forbidden | Forbidden | Forbidden |
-| **NEXTCLOUD_PASSWORD** | Required | Forbidden | Forbidden | Forbidden | Forbidden |
-| **ENABLE_MULTI_USER_BASIC_AUTH** | Forbidden | Required | Forbidden | Forbidden | Forbidden |
-| **ENABLE_TOKEN_EXCHANGE** | Forbidden | Forbidden | Forbidden | Required | Forbidden |
-| **ENABLE_OFFLINE_ACCESS** | Optional\* | Optional\* | Optional\* | Optional\* | Forbidden |
-| **TOKEN_ENCRYPTION_KEY** | If offline | If offline | If offline | If offline | Forbidden |
-| **TOKEN_STORAGE_DB** | If offline | If offline | If offline | If offline | Forbidden |
-| **OIDC_CLIENT_ID** | Forbidden | If offline | Optional\*\* | Optional\*\* | Forbidden |
-| **OIDC_CLIENT_SECRET** | Forbidden | If offline | Optional\*\* | Optional\*\* | Forbidden |
-| **VECTOR_SYNC_ENABLED** | Optional | Optional | Optional | Optional | Forbidden |
-| **QDRANT_URL/LOCATION** | If vector | If vector | If vector | If vector | Forbidden |
-| **OLLAMA_BASE_URL/OPENAI_API_KEY** | Optional | Optional | Optional | Optional | Forbidden |
-
-\* Only enables background sync for semantic search
-\*\* Uses DCR if not provided
-
-## Consequences
-
-### Positive
-
-1. **Clarity:** Single function to detect mode from config
-2. **Validation:** All config validated upfront with helpful errors
-3. **Debugging:** Clear logs showing "Running in X mode with config Y"
-4. **Maintenance:** Mode-specific logic can be isolated
-5. **Documentation:** Clear mapping of mode → required config
-6. **Error Messages:** Context-aware ("X is required for Y mode")
-7. **Testing:** Each mode testable in isolation
-
-### Negative
-
-1. **Migration:** Existing invalid configurations will now fail at startup
-2. **Flexibility:** Less flexibility in configuration combinations
-3. **Strictness:** Some previously-working combinations may be rejected
-
-### Neutral
-
-1. **Backward Compatibility:** Valid configurations continue to work
-2. **Mode Detection:** Automatic based on config (no explicit mode selection)
-3. **Default Mode:** OAuth single-audience when no credentials provided
-
-## Implementation Notes
-
-### Embedding Provider Validation
-
-Originally, validation required either `OLLAMA_BASE_URL` or `OPENAI_API_KEY` when vector sync was enabled. This was too strict because the Simple provider is always available as a fallback (ADR-015). The validation was removed to allow vector sync without explicit provider configuration.
-
-### Variable Scoping Issues
-
-During implementation, several Python variable scoping issues were discovered in `app.py`:
-- Local variable assignments in `starlette_lifespan()` shadowed outer scope variables
-- Fixed by using unique variable names (e.g., `nextcloud_host_for_context`, `basic_auth_storage`)
-- Removed redundant `settings = get_settings()` call (re-used outer scope)
-
-### Docker Compose Configuration
-
-The `mcp-oauth` service configuration was updated to remove `ENABLE_MULTI_USER_BASIC_AUTH=true` which conflicted with its intended OAuth mode. The service now runs in OAuth single-audience mode with vector sync using the Simple embedding provider as fallback.
-
-## Testing
-
-### Unit Tests
-
-`tests/unit/test_config_validators.py` provides comprehensive coverage:
-- Mode detection with priority ordering (7 tests)
-- Single-user BasicAuth validation (8 tests)
-- Multi-user BasicAuth validation (7 tests)
-- OAuth single-audience validation (6 tests)
-- OAuth token exchange validation (3 tests)
-- Smithery validation (4 tests)
-- Mode summary generation (3 tests)
-- Edge cases (3 tests)
-
-**Total: 41 tests, all passing**
-
-### Integration Tests
-
-Integration tests verify that:
-- Each mode starts successfully with valid configuration
-- Invalid configurations fail with clear error messages
-- Existing deployments continue to work
-
-## References
-
-- [ADR-002: Vector Sync Authentication](ADR-002-vector-sync-authentication.md)
-- [ADR-004: Progressive Consent](ADR-004-progressive-consent.md)
-- [ADR-015: Unified Provider Architecture](ADR-015-unified-provider-architecture.md)
-- [ADR-019: Multi-user BasicAuth Pass-Through](ADR-019-multi-user-basicauth-passthrough.md)
-- Implementation: `nextcloud_mcp_server/config_validators.py`
-- Tests: `tests/unit/test_config_validators.py`

nextcloud_mcp_server/app.py

@@ -41,14 +41,10 @@ from nextcloud_mcp_server.auth.unified_verifier import UnifiedTokenVerifier
 from nextcloud_mcp_server.client import NextcloudClient
 from nextcloud_mcp_server.config import (
     DeploymentMode,
+    get_deployment_mode,
     get_document_processor_config,
     get_settings,
 )
-from nextcloud_mcp_server.config_validators import (
-    AuthMode,
-    get_mode_summary,
-    validate_configuration,
-)
 from nextcloud_mcp_server.context import get_client as get_nextcloud_client
 from nextcloud_mcp_server.document_processors import get_registry
 from nextcloud_mcp_server.observability import (
@@ -355,52 +351,6 @@ def get_smithery_session_config() -> dict | None:
     return _smithery_session_config.get()
 
 
-class BasicAuthMiddleware:
-    """Middleware to extract BasicAuth credentials from Authorization header.
-
-    For multi-user BasicAuth pass-through mode, this middleware extracts
-    username/password from the Authorization: Basic header and stores them
-    in the request state for use by the context layer.
-
-    The credentials are NOT stored persistently - they are passed through
-    directly to Nextcloud APIs for each request (stateless).
-    """
-
-    def __init__(self, app: ASGIApp):
-        self.app = app
-
-    async def __call__(
-        self, scope: StarletteScope, receive: Receive, send: Send
-    ) -> None:
-        if scope["type"] == "http":
-            # Extract Authorization header
-            headers = dict(scope.get("headers", []))
-            auth_header = headers.get(b"authorization", b"")
-
-            if auth_header.startswith(b"Basic "):
-                try:
-                    import base64
-
-                    # Decode base64(username:password)
-                    encoded = auth_header[6:]  # Skip "Basic "
-                    decoded = base64.b64decode(encoded).decode("utf-8")
-                    username, password = decoded.split(":", 1)
-
-                    # Store in request state
-                    scope.setdefault("state", {})
-                    scope["state"]["basic_auth"] = {
-                        "username": username,
-                        "password": password,
-                    }
-                    logger.debug(
-                        f"BasicAuth credentials extracted for user: {username}"
-                    )
-                except Exception as e:
-                    logger.warning(f"Failed to extract BasicAuth credentials: {e}")
-
-        await self.app(scope, receive, send)
-
-
 class SmitheryConfigMiddleware:
     """Middleware to extract Smithery config from URL query parameters.
 
@@ -473,6 +423,41 @@ async def app_lifespan_smithery(server: FastMCP) -> AsyncIterator[SmitheryAppCon
         logger.info("Shutting down Smithery stateless mode")
 
 
+def is_oauth_mode() -> bool:
+    """
+    Determine if OAuth mode should be used.
+
+    OAuth mode is enabled when:
+    - NEXTCLOUD_USERNAME and NEXTCLOUD_PASSWORD are NOT set
+    - AND we are NOT in Smithery stateless mode
+    - Or explicitly enabled via configuration
+
+    Returns:
+        True if OAuth mode, False if BasicAuth mode
+    """
+    # ADR-016: Smithery stateless mode uses per-request BasicAuth from session config
+    # It's not OAuth mode even though env credentials aren't set
+    deployment_mode = get_deployment_mode()
+    if deployment_mode == DeploymentMode.SMITHERY_STATELESS:
+        logger.info(
+            "BasicAuth mode (Smithery stateless - credentials from session config)"
+        )
+        return False
+
+    username = os.getenv("NEXTCLOUD_USERNAME")
+    password = os.getenv("NEXTCLOUD_PASSWORD")
+
+    # If both username and password are set, use BasicAuth
+    if username and password:
+        logger.info(
+            "BasicAuth mode detected (NEXTCLOUD_USERNAME and NEXTCLOUD_PASSWORD set)"
+        )
+        return False
+
+    logger.info("OAuth mode detected (NEXTCLOUD_USERNAME/PASSWORD not set)")
+    return True
+
+
 async def load_oauth_client_credentials(
     nextcloud_host: str, registration_endpoint: str | None
 ) -> tuple[str, str]:
@@ -593,31 +578,17 @@ async def app_lifespan_basic(server: FastMCP) -> AsyncIterator[AppContext]:
     """
     Manage application lifecycle for BasicAuth mode (FastMCP session lifespan).
 
-    For single-user mode: Creates a single Nextcloud client with basic authentication
+    Creates a single Nextcloud client with basic authentication
     that is shared across all requests within a session.
 
-    For multi-user mode: No shared client - clients created per-request by BasicAuthMiddleware.
-
     Note: Background tasks (scanner, processor) are started at server level
     in starlette_lifespan, not here. This lifespan runs per-session.
     """
-    settings = get_settings()
+    logger.info("Starting MCP session in BasicAuth mode")
-    is_multi_user = settings.enable_multi_user_basic_auth
+    logger.info("Creating Nextcloud client with BasicAuth")
 
-    logger.info(
+    client = NextcloudClient.from_env()
-        f"Starting MCP session in {'multi-user' if is_multi_user else 'single-user'} BasicAuth mode"
+    logger.info("Client initialization complete")
-    )
-
-    # Only create shared client for single-user mode
-    client = None
-    if not is_multi_user:
-        logger.info("Creating shared Nextcloud client with BasicAuth")
-        client = NextcloudClient.from_env()
-        logger.info("Client initialization complete")
-    else:
-        logger.info(
-            "Multi-user mode - clients created per-request from BasicAuth headers"
-        )
 
     # Initialize persistent storage (for webhook tracking and future features)
     from nextcloud_mcp_server.auth.storage import RefreshTokenStorage
@@ -633,7 +604,7 @@ async def app_lifespan_basic(server: FastMCP) -> AsyncIterator[AppContext]:
     # Include vector sync state from module singleton (set by starlette_lifespan)
     try:
         yield AppContext(
-            client=client,  # type: ignore[arg-type]  # None in multi-user mode
+            client=client,
             storage=storage,
             document_send_stream=_vector_sync_state.document_send_stream,
             document_receive_stream=_vector_sync_state.document_receive_stream,
@@ -642,8 +613,7 @@ async def app_lifespan_basic(server: FastMCP) -> AsyncIterator[AppContext]:
         )
     finally:
         logger.info("Shutting down BasicAuth session")
-        if client is not None:
+        await client.close()
-            await client.close()
 
 
 async def setup_oauth_config():
@@ -1015,33 +985,6 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
     # Initialize observability (logging will be configured by uvicorn)
     settings = get_settings()
 
-    # Validate configuration and detect deployment mode
-    mode, config_errors = validate_configuration(settings)
-
-    if config_errors:
-        error_msg = (
-            f"Configuration validation failed for {mode.value} mode:\n"
-            + "\n".join(f"  - {err}" for err in config_errors)
-            + "\n\n"
-            + get_mode_summary(mode)
-        )
-        logger.error(error_msg)
-        raise ValueError(error_msg)
-
-    logger.info(f"✅ Configuration validated successfully for {mode.value} mode")
-    logger.debug(f"Mode details:\n{get_mode_summary(mode)}")
-
-    # Derive helper variables for backward compatibility with existing code
-    oauth_enabled = mode in (
-        AuthMode.OAUTH_SINGLE_AUDIENCE,
-        AuthMode.OAUTH_TOKEN_EXCHANGE,
-    )
-    deployment_mode = (
-        DeploymentMode.SMITHERY_STATELESS
-        if mode == AuthMode.SMITHERY_STATELESS
-        else DeploymentMode.SELF_HOSTED
-    )
-
     # Setup Prometheus metrics (always enabled by default)
     if settings.metrics_enabled:
         setup_metrics(port=settings.metrics_port)
@@ -1065,8 +1008,11 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
             "OpenTelemetry tracing disabled (set OTEL_EXPORTER_OTLP_ENDPOINT to enable)"
         )
 
-    # Create MCP server based on detected mode
+    # Determine authentication mode and deployment mode
-    if mode in (AuthMode.OAUTH_SINGLE_AUDIENCE, AuthMode.OAUTH_TOKEN_EXCHANGE):
+    oauth_enabled = is_oauth_mode()
+    deployment_mode = get_deployment_mode()
+
+    if oauth_enabled:
         logger.info("Configuring MCP server for OAuth mode")
         # Asynchronously get the OAuth configuration
         import anyio
@@ -1129,32 +1075,33 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
                 enable_dns_rebinding_protection=False
             ),
         )
-    elif mode == AuthMode.SMITHERY_STATELESS:
-        logger.info("Configuring MCP server for Smithery stateless mode")
-        # json_response=True returns plain JSON-RPC instead of SSE format,
-        # required for Smithery scanner compatibility
-        mcp = FastMCP(
-            "Nextcloud MCP",
-            lifespan=app_lifespan_smithery,
-            json_response=True,
-            # Disable DNS rebinding protection for containerized deployments (k8s, Docker)
-            # MCP 1.23+ auto-enables this for localhost, breaking k8s service DNS names
-            transport_security=TransportSecuritySettings(
-                enable_dns_rebinding_protection=False
-            ),
-        )
     else:
-        # BasicAuth modes (single-user or multi-user)
+        # ADR-016: Use Smithery lifespan for stateless mode, BasicAuth otherwise
-        logger.info(f"Configuring MCP server for {mode.value} mode")
+        if deployment_mode == DeploymentMode.SMITHERY_STATELESS:
-        mcp = FastMCP(
+            logger.info("Configuring MCP server for Smithery stateless mode")
-            "Nextcloud MCP",
+            # json_response=True returns plain JSON-RPC instead of SSE format,
-            lifespan=app_lifespan_basic,
+            # required for Smithery scanner compatibility
-            # Disable DNS rebinding protection for containerized deployments (k8s, Docker)
+            mcp = FastMCP(
-            # MCP 1.23+ auto-enables this for localhost, breaking k8s service DNS names
+                "Nextcloud MCP",
-            transport_security=TransportSecuritySettings(
+                lifespan=app_lifespan_smithery,
-                enable_dns_rebinding_protection=False
+                json_response=True,
-            ),
+                # Disable DNS rebinding protection for containerized deployments (k8s, Docker)
-        )
+                # MCP 1.23+ auto-enables this for localhost, breaking k8s service DNS names
+                transport_security=TransportSecuritySettings(
+                    enable_dns_rebinding_protection=False
+                ),
+            )
+        else:
+            logger.info("Configuring MCP server for BasicAuth mode")
+            mcp = FastMCP(
+                "Nextcloud MCP",
+                lifespan=app_lifespan_basic,
+                # Disable DNS rebinding protection for containerized deployments (k8s, Docker)
+                # MCP 1.23+ auto-enables this for localhost, breaking k8s service DNS names
+                transport_security=TransportSecuritySettings(
+                    enable_dns_rebinding_protection=False
+                ),
+            )
 
     @mcp.resource("nc://capabilities")
     async def nc_get_capabilities():
@@ -1192,6 +1139,8 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
 
     # Register semantic search tools (cross-app feature)
     # ADR-016: Skip in Smithery stateless mode (no vector database)
+    settings = get_settings()
+    deployment_mode = get_deployment_mode()
     if deployment_mode == DeploymentMode.SMITHERY_STATELESS:
         logger.info("Skipping semantic search tools (Smithery stateless mode)")
     elif settings.vector_sync_enabled:
@@ -1278,20 +1227,13 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
         # Set OAuth context for OAuth login routes (ADR-004)
         if oauth_enabled:
             # Prepare OAuth config from setup_oauth_config closure variables
-            # Get nextcloud_host from settings (it was validated as required)
-            nextcloud_host_for_context = settings.nextcloud_host
-            if not nextcloud_host_for_context:
-                raise ValueError("NEXTCLOUD_HOST is required for OAuth mode")
-
             mcp_server_url = os.getenv(
                 "NEXTCLOUD_MCP_SERVER_URL", "http://localhost:8000"
             )
-            nextcloud_resource_uri = os.getenv(
+            nextcloud_resource_uri = os.getenv("NEXTCLOUD_RESOURCE_URI", nextcloud_host)
-                "NEXTCLOUD_RESOURCE_URI", nextcloud_host_for_context
-            )
             discovery_url = os.getenv(
                 "OIDC_DISCOVERY_URL",
-                f"{nextcloud_host_for_context}/.well-known/openid-configuration",
+                f"{nextcloud_host}/.well-known/openid-configuration",
             )
             scopes = os.getenv("NEXTCLOUD_OIDC_SCOPES", "")
 
@@ -1305,7 +1247,7 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
                     "client_id": client_id,  # From setup_oauth_config (DCR or static)
                     "client_secret": client_secret,  # From setup_oauth_config (DCR or static)
                     "scopes": scopes,
-                    "nextcloud_host": nextcloud_host_for_context,
+                    "nextcloud_host": nextcloud_host,
                     "nextcloud_resource_uri": nextcloud_resource_uri,
                     "oauth_provider": oauth_provider,
                 },
@@ -1331,16 +1273,16 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
             # BasicAuth mode - share storage with browser_app for webhook management
             from nextcloud_mcp_server.auth.storage import RefreshTokenStorage
 
-            basic_auth_storage = RefreshTokenStorage.from_env()
+            storage = RefreshTokenStorage.from_env()
-            await basic_auth_storage.initialize()
+            await storage.initialize()
 
-            app.state.storage = basic_auth_storage
+            app.state.storage = storage
 
             # Also share with browser_app for webhook routes
             for route in app.routes:
                 if isinstance(route, Mount) and route.path == "/app":
                     browser_app = cast(Starlette, route.app)
-                    browser_app.state.storage = basic_auth_storage
+                    browser_app.state.storage = storage
                     logger.info(
                         "Storage shared with browser_app for webhook management"
                     )
@@ -1350,7 +1292,7 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
         # Scanner runs at server-level (once), not per-session
         import anyio as anyio_module
 
-        # Re-use settings from outer scope (already validated)
+        settings = get_settings()
 
         # Check if vector sync is enabled and determine the mode
         enable_offline_access_for_sync = os.getenv(
@@ -1358,13 +1300,7 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
         ).lower() in ("true", "1", "yes")
         encryption_key = os.getenv("TOKEN_ENCRYPTION_KEY")
 
-        # Multi-user BasicAuth uses OAuth-style background sync (with app passwords)
+        if settings.vector_sync_enabled and not oauth_enabled:
-        # So skip single-user BasicAuth vector sync if in multi-user mode
-        if (
-            settings.vector_sync_enabled
-            and not oauth_enabled
-            and not settings.enable_multi_user_basic_auth
-        ):
             # BasicAuth mode - single user sync
             logger.info("Starting background vector sync tasks for BasicAuth mode")
 
@@ -1464,15 +1400,13 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
 
         elif (
             settings.vector_sync_enabled
-            and (oauth_enabled or settings.enable_multi_user_basic_auth)
+            and oauth_enabled
             and enable_offline_access_for_sync
             and refresh_token_storage
             and encryption_key
         ):
             # OAuth mode with offline access - multi-user sync
-            # Also used for multi-user BasicAuth mode (client auth is BasicAuth, background sync uses app passwords)
+            logger.info("Starting background vector sync tasks for OAuth mode")
-            mode_desc = "OAuth mode" if oauth_enabled else "Multi-user BasicAuth mode"
-            logger.info(f"Starting background vector sync tasks for {mode_desc}")
 
             from nextcloud_mcp_server.auth.token_broker import TokenBrokerService
             from nextcloud_mcp_server.vector.oauth_sync import (
@@ -1480,15 +1414,10 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
                 user_manager_task,
             )
 
-            # Get nextcloud_host (from settings - already validated)
-            nextcloud_host_for_sync = settings.nextcloud_host
-            if not nextcloud_host_for_sync:
-                raise ValueError("NEXTCLOUD_HOST required for vector sync")
-
             # Get OIDC discovery URL (same as used for OAuth setup)
             discovery_url = os.getenv(
                 "OIDC_DISCOVERY_URL",
-                f"{nextcloud_host_for_sync}/.well-known/openid-configuration",
+                f"{nextcloud_host}/.well-known/openid-configuration",
             )
 
             # Get client credentials from oauth_context (set by setup_oauth_config)
@@ -1499,11 +1428,6 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
             sync_client_id = oauth_config.get("client_id")
             sync_client_secret = oauth_config.get("client_secret")
 
-            # For multi-user BasicAuth mode, get OIDC credentials from environment
-            if not sync_client_id or not sync_client_secret:
-                sync_client_id = settings.oidc_client_id
-                sync_client_secret = settings.oidc_client_secret
-
             if not sync_client_id or not sync_client_secret:
                 logger.error(
                     "Cannot start OAuth vector sync: client credentials not found in oauth_context"
@@ -2217,11 +2141,4 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
         app = SmitheryConfigMiddleware(app)
         logger.info("SmitheryConfigMiddleware enabled for query parameter config")
 
-    # Apply BasicAuthMiddleware for multi-user BasicAuth pass-through mode
-    if settings.enable_multi_user_basic_auth:
-        app = BasicAuthMiddleware(app)
-        logger.info(
-            "BasicAuthMiddleware enabled - multi-user BasicAuth pass-through mode active"
-        )
-
     return app

nextcloud_mcp_server/auth/astrolabe_client.py

@@ -1,152 +0,0 @@
-"""
-Client for querying Astrolabe Management API for background sync credentials.
-
-This client uses OAuth client credentials flow to authenticate to Nextcloud
-and retrieve user app passwords for background sync operations.
-"""
-
-import logging
-import time
-from typing import Optional
-
-import httpx
-
-logger = logging.getLogger(__name__)
-
-
-class AstrolabeClient:
-    """Client for querying Astrolabe API for background sync credentials.
-
-    Uses OAuth client credentials flow to authenticate as the MCP server
-    and retrieve user app passwords that are stored in Nextcloud.
-    """
-
-    def __init__(
-        self,
-        nextcloud_host: str,
-        client_id: str,
-        client_secret: str,
-    ):
-        """
-        Initialize Astrolabe client.
-
-        Args:
-            nextcloud_host: Nextcloud base URL (e.g., https://cloud.example.com)
-            client_id: OAuth client ID for MCP server
-            client_secret: OAuth client secret
-        """
-        self.nextcloud_host = nextcloud_host.rstrip("/")
-        self.client_id = client_id
-        self.client_secret = client_secret
-        self._token_cache: Optional[dict] = None  # {access_token, expires_at}
-
-    async def get_access_token(self) -> str:
-        """
-        Get access token using OAuth client credentials flow.
-
-        Tokens are cached with 1-minute early refresh to avoid expiration.
-
-        Returns:
-            Access token string
-
-        Raises:
-            httpx.HTTPError: If token request fails
-        """
-        # Check cache
-        if self._token_cache and time.time() < self._token_cache["expires_at"]:
-            logger.debug("Using cached OAuth token for Astrolabe API")
-            return self._token_cache["access_token"]
-
-        # Discover token endpoint
-        discovery_url = f"{self.nextcloud_host}/.well-known/openid-configuration"
-
-        async with httpx.AsyncClient() as client:
-            logger.debug(f"Discovering token endpoint from {discovery_url}")
-            discovery_resp = await client.get(discovery_url)
-            discovery_resp.raise_for_status()
-            token_endpoint = discovery_resp.json()["token_endpoint"]
-
-            logger.debug(f"Requesting client credentials token from {token_endpoint}")
-
-            # Request token using client credentials grant
-            token_resp = await client.post(
-                token_endpoint,
-                data={
-                    "grant_type": "client_credentials",
-                    "client_id": self.client_id,
-                    "client_secret": self.client_secret,
-                    "scope": "openid",  # Minimal scope
-                },
-            )
-            token_resp.raise_for_status()
-            data = token_resp.json()
-
-            # Cache with 1-minute early refresh
-            expires_in = data.get("expires_in", 3600)
-            self._token_cache = {
-                "access_token": data["access_token"],
-                "expires_at": time.time() + expires_in - 60,
-            }
-
-            logger.info(f"Obtained Astrolabe API token (expires in {expires_in}s)")
-            return data["access_token"]
-
-    async def get_user_app_password(self, user_id: str) -> Optional[str]:
-        """
-        Retrieve user's app password for background sync.
-
-        Args:
-            user_id: Nextcloud user ID
-
-        Returns:
-            App password string, or None if user hasn't provisioned
-
-        Raises:
-            httpx.HTTPError: If API request fails (except 404)
-        """
-        token = await self.get_access_token()
-        url = f"{self.nextcloud_host}/apps/astrolabe/api/v1/background-sync/credentials/{user_id}"
-
-        async with httpx.AsyncClient() as client:
-            logger.debug(f"Retrieving app password for user: {user_id}")
-
-            response = await client.get(
-                url,
-                headers={"Authorization": f"Bearer {token}"},
-                timeout=10.0,
-            )
-
-            if response.status_code == 404:
-                logger.debug(f"No app password configured for user: {user_id}")
-                return None
-
-            response.raise_for_status()
-            data = response.json()
-
-            logger.info(
-                f"Retrieved app password for user: {user_id} (type: {data.get('credential_type')})"
-            )
-            return data.get("app_password")
-
-    async def get_background_sync_status(self, user_id: str) -> dict:
-        """
-        Get background sync status for a user.
-
-        Args:
-            user_id: Nextcloud user ID
-
-        Returns:
-            Dict with keys: has_access, credential_type, provisioned_at
-
-        Raises:
-            httpx.HTTPError: If API request fails
-        """
-        # For now, check if app password exists
-        # In the future, this could query a dedicated status endpoint
-        app_password = await self.get_user_app_password(user_id)
-
-        return {
-            "has_access": app_password is not None,
-            "credential_type": "app_password" if app_password else None,
-            "provisioned_at": None,  # TODO: Get from API if available
-        }

nextcloud_mcp_server/config.py

@@ -187,11 +187,6 @@ class Settings:
     enable_token_exchange: bool = False
     enable_offline_access: bool = False
 
-    # Multi-user BasicAuth pass-through mode (ADR-019 interim solution)
-    # When enabled, MCP server extracts BasicAuth credentials from request headers
-    # and passes them through to Nextcloud APIs (no storage, stateless)
-    enable_multi_user_basic_auth: bool = False
-
     # Token exchange cache settings
     token_exchange_cache_ttl: int = 300  # seconds (5 minutes default)
 
@@ -381,10 +376,6 @@ def get_settings() -> Settings:
         enable_offline_access=(
             os.getenv("ENABLE_OFFLINE_ACCESS", "false").lower() == "true"
         ),
-        # Multi-user BasicAuth pass-through mode
-        enable_multi_user_basic_auth=(
-            os.getenv("ENABLE_MULTI_USER_BASIC_AUTH", "false").lower() == "true"
-        ),
         # Token exchange cache settings
         token_exchange_cache_ttl=int(os.getenv("TOKEN_EXCHANGE_CACHE_TTL", "300")),
         # Token and webhook storage settings (encryption key optional for webhook-only usage)

nextcloud_mcp_server/config_validators.py

@@ -1,432 +0,0 @@
-"""Configuration validation and mode detection for the MCP server.
-
-This module provides:
-- Mode detection based on configuration
-- Configuration validation with clear error messages
-- Single source of truth for deployment mode requirements
-
-See ADR-020 for detailed architecture and deployment mode documentation.
-"""
-
-import logging
-from dataclasses import dataclass
-from enum import Enum
-
-from nextcloud_mcp_server.config import Settings
-
-logger = logging.getLogger(__name__)
-
-
-class AuthMode(Enum):
-    """Authentication mode for the MCP server.
-
-    Determines how users authenticate and how the server accesses Nextcloud.
-    """
-
-    SINGLE_USER_BASIC = "single_user_basic"
-    MULTI_USER_BASIC = "multi_user_basic"
-    OAUTH_SINGLE_AUDIENCE = "oauth_single"
-    OAUTH_TOKEN_EXCHANGE = "oauth_exchange"
-    SMITHERY_STATELESS = "smithery"
-
-
-@dataclass
-class ModeRequirements:
-    """Requirements for a deployment mode.
-
-    Attributes:
-        required: Configuration variables that must be set
-        optional: Configuration variables that may be set
-        forbidden: Configuration variables that should not be set
-        conditional: Additional requirements based on feature flags
-                     Format: {feature_flag: [required_vars]}
-        description: Human-readable description of the mode
-    """
-
-    required: list[str]
-    optional: list[str]
-    forbidden: list[str]
-    conditional: dict[str, list[str]]
-    description: str
-
-
-# Mode requirements definition
-MODE_REQUIREMENTS: dict[AuthMode, ModeRequirements] = {
-    AuthMode.SINGLE_USER_BASIC: ModeRequirements(
-        required=["nextcloud_host", "nextcloud_username", "nextcloud_password"],
-        optional=[
-            "vector_sync_enabled",
-            "qdrant_url",
-            "qdrant_location",
-            "ollama_base_url",
-            "ollama_embedding_model",
-            "openai_api_key",
-            "openai_embedding_model",
-            "document_chunk_size",
-            "document_chunk_overlap",
-        ],
-        forbidden=[
-            "enable_multi_user_basic_auth",
-            "enable_token_exchange",
-            "oidc_client_id",
-            "oidc_client_secret",
-        ],
-        conditional={
-            "vector_sync_enabled": [
-                # Either qdrant_url OR qdrant_location (checked in Settings.__post_init__)
-                # At least one embedding provider (ollama_base_url OR openai_api_key)
-            ],
-        },
-        description="Single-user deployment with BasicAuth credentials. "
-        "Suitable for personal Nextcloud instances and local development.",
-    ),
-    AuthMode.MULTI_USER_BASIC: ModeRequirements(
-        required=["nextcloud_host", "enable_multi_user_basic_auth"],
-        optional=[
-            # Background sync with app passwords (via Astrolabe)
-            "enable_offline_access",
-            "token_encryption_key",
-            "token_storage_db",
-            "oidc_client_id",
-            "oidc_client_secret",
-            # Vector sync
-            "vector_sync_enabled",
-            "qdrant_url",
-            "qdrant_location",
-            "ollama_base_url",
-            "ollama_embedding_model",
-            "openai_api_key",
-            "openai_embedding_model",
-        ],
-        forbidden=[
-            "nextcloud_username",
-            "nextcloud_password",
-            "enable_token_exchange",
-        ],
-        conditional={
-            "enable_offline_access": [
-                "oidc_client_id",
-                "oidc_client_secret",
-                "token_encryption_key",
-                "token_storage_db",
-            ],
-            "vector_sync_enabled": [
-                # Requires offline access for background sync
-                "enable_offline_access",
-            ],
-        },
-        description="Multi-user deployment with BasicAuth pass-through. "
-        "Users provide credentials in request headers. "
-        "Optional background sync using app passwords stored via Astrolabe.",
-    ),
-    AuthMode.OAUTH_SINGLE_AUDIENCE: ModeRequirements(
-        required=["nextcloud_host"],
-        optional=[
-            # OAuth credentials (uses DCR if not provided)
-            "oidc_client_id",
-            "oidc_client_secret",
-            "oidc_discovery_url",
-            # Offline access
-            "enable_offline_access",
-            "token_encryption_key",
-            "token_storage_db",
-            # Vector sync
-            "vector_sync_enabled",
-            "qdrant_url",
-            "qdrant_location",
-            "ollama_base_url",
-            "ollama_embedding_model",
-            "openai_api_key",
-            "openai_embedding_model",
-            # Scopes
-            "nextcloud_oidc_scopes",
-        ],
-        forbidden=[
-            "nextcloud_username",
-            "nextcloud_password",
-            "enable_token_exchange",
-            "enable_multi_user_basic_auth",
-        ],
-        conditional={
-            "enable_offline_access": [
-                "token_encryption_key",
-                "token_storage_db",
-            ],
-            "vector_sync_enabled": [
-                "enable_offline_access",  # Background sync requires refresh tokens
-            ],
-        },
-        description="OAuth multi-user deployment with single-audience tokens. "
-        "Tokens work for both MCP server and Nextcloud APIs (pass-through). "
-        "Uses Dynamic Client Registration if credentials not provided.",
-    ),
-    AuthMode.OAUTH_TOKEN_EXCHANGE: ModeRequirements(
-        required=["nextcloud_host", "enable_token_exchange"],
-        optional=[
-            # OAuth credentials
-            "oidc_client_id",
-            "oidc_client_secret",
-            "oidc_discovery_url",
-            # Token exchange settings
-            "token_exchange_cache_ttl",
-            # Offline access
-            "enable_offline_access",
-            "token_encryption_key",
-            "token_storage_db",
-            # Vector sync
-            "vector_sync_enabled",
-            "qdrant_url",
-            "qdrant_location",
-            "ollama_base_url",
-            "ollama_embedding_model",
-            "openai_api_key",
-            "openai_embedding_model",
-        ],
-        forbidden=[
-            "nextcloud_username",
-            "nextcloud_password",
-            "enable_multi_user_basic_auth",
-        ],
-        conditional={
-            "enable_offline_access": [
-                "token_encryption_key",
-                "token_storage_db",
-            ],
-            "vector_sync_enabled": [
-                "enable_offline_access",
-            ],
-        },
-        description="OAuth multi-user deployment with token exchange (RFC 8693). "
-        "MCP tokens are separate from Nextcloud tokens. "
-        "Server exchanges MCP token for Nextcloud token on each request.",
-    ),
-    AuthMode.SMITHERY_STATELESS: ModeRequirements(
-        required=[],  # All config from session URL params
-        optional=[],
-        forbidden=[
-            "nextcloud_host",
-            "nextcloud_username",
-            "nextcloud_password",
-            "enable_multi_user_basic_auth",
-            "enable_token_exchange",
-            "enable_offline_access",
-            "vector_sync_enabled",
-            "oidc_client_id",
-            "oidc_client_secret",
-        ],
-        conditional={},
-        description="Stateless multi-tenant deployment for Smithery platform. "
-        "Configuration comes from session URL parameters. "
-        "No persistent storage, no OAuth, no vector sync.",
-    ),
-}
-
-
-def detect_auth_mode(settings: Settings) -> AuthMode:
-    """Detect authentication mode from configuration.
-
-    Mode detection priority (most specific to most general):
-    1. Smithery (explicit flag)
-    2. Token exchange (most specific OAuth mode)
-    3. Multi-user BasicAuth
-    4. Single-user BasicAuth
-    5. OAuth single-audience (default OAuth mode)
-
-    Args:
-        settings: Application settings
-
-    Returns:
-        Detected AuthMode
-    """
-    # Check for Smithery mode (explicit environment variable)
-    # Note: This checks the environment directly, not settings
-    # because Smithery mode has no settings-based config
-    import os
-
-    if os.getenv("SMITHERY_DEPLOYMENT", "false").lower() == "true":
-        return AuthMode.SMITHERY_STATELESS
-
-    # Check for token exchange (most specific OAuth mode)
-    if settings.enable_token_exchange:
-        return AuthMode.OAUTH_TOKEN_EXCHANGE
-
-    # Check for multi-user BasicAuth
-    if settings.enable_multi_user_basic_auth:
-        return AuthMode.MULTI_USER_BASIC
-
-    # Check for single-user BasicAuth (explicit credentials)
-    if settings.nextcloud_username and settings.nextcloud_password:
-        return AuthMode.SINGLE_USER_BASIC
-
-    # Default: OAuth single-audience mode
-    # This is the safest multi-user mode (no credential storage)
-    return AuthMode.OAUTH_SINGLE_AUDIENCE
-
-
-def validate_configuration(settings: Settings) -> tuple[AuthMode, list[str]]:
-    """Validate configuration for detected mode.
-
-    Args:
-        settings: Application settings
-
-    Returns:
-        Tuple of (detected_mode, list_of_errors)
-        Empty list means valid configuration.
-    """
-    mode = detect_auth_mode(settings)
-    requirements = MODE_REQUIREMENTS[mode]
-    errors: list[str] = []
-
-    logger.debug(f"Validating configuration for mode: {mode.value}")
-
-    # Check required variables
-    for var in requirements.required:
-        value = getattr(settings, var, None)
-        if value is None or (isinstance(value, str) and not value.strip()):
-            errors.append(
-                f"[{mode.value}] Missing required configuration: {var.upper()}"
-            )
-
-    # Check forbidden variables
-    for var in requirements.forbidden:
-        value = getattr(settings, var, None)
-        # For bools, check if True (forbidden means must be False/unset)
-        # For strings, check if non-empty
-        is_set = False
-        if isinstance(value, bool):
-            is_set = value is True
-        elif isinstance(value, str):
-            is_set = bool(value.strip())
-        elif value is not None:
-            is_set = True
-
-        if is_set:
-            errors.append(
-                f"[{mode.value}] Forbidden configuration: {var.upper()} "
-                f"should not be set in this mode"
-            )
-
-    # Check conditional requirements
-    for condition, required_vars in requirements.conditional.items():
-        # Check if the condition is enabled
-        condition_value = getattr(settings, condition, None)
-        is_enabled = False
-
-        if isinstance(condition_value, bool):
-            is_enabled = condition_value is True
-        elif isinstance(condition_value, str):
-            is_enabled = bool(condition_value.strip())
-        elif condition_value is not None:
-            is_enabled = True
-
-        if is_enabled:
-            # Check that all required vars for this condition are set
-            for var in required_vars:
-                value = getattr(settings, var, None)
-
-                # For boolean requirements, check that they are True (not just set)
-                if hasattr(Settings, var):
-                    field_type = type(getattr(Settings(), var, None))
-                    if field_type is bool:
-                        if value is not True:
-                            errors.append(
-                                f"[{mode.value}] {var.upper()} must be enabled when "
-                                f"{condition.upper()} is enabled"
-                            )
-                        continue
-
-                # For non-boolean requirements, check that they are set
-                if value is None or (isinstance(value, str) and not value.strip()):
-                    errors.append(
-                        f"[{mode.value}] {var.upper()} is required when "
-                        f"{condition.upper()} is enabled"
-                    )
-
-    # Special validations for specific modes
-    if mode == AuthMode.SINGLE_USER_BASIC:
-        # Validate that NEXTCLOUD_HOST doesn't have trailing slash
-        if settings.nextcloud_host and settings.nextcloud_host.endswith("/"):
-            errors.append(
-                f"[{mode.value}] NEXTCLOUD_HOST should not have trailing slash: "
-                f"{settings.nextcloud_host}"
-            )
-
-    if mode in [
-        AuthMode.OAUTH_SINGLE_AUDIENCE,
-        AuthMode.OAUTH_TOKEN_EXCHANGE,
-    ]:
-        # If OAuth credentials not provided, DCR must be available
-        # (This is a runtime check, not a config check, so we just warn)
-        if not settings.oidc_client_id or not settings.oidc_client_secret:
-            logger.info(
-                f"[{mode.value}] OAuth credentials not configured. "
-                "Will attempt Dynamic Client Registration (DCR) at startup."
-            )
-
-    if mode == AuthMode.MULTI_USER_BASIC:
-        # Validate that if offline access enabled, we have OAuth credentials
-        if settings.enable_offline_access:
-            if not settings.oidc_client_id or not settings.oidc_client_secret:
-                errors.append(
-                    f"[{mode.value}] NEXTCLOUD_OIDC_CLIENT_ID and "
-                    "NEXTCLOUD_OIDC_CLIENT_SECRET are required when "
-                    "ENABLE_OFFLINE_ACCESS is enabled (for app password retrieval)"
-                )
-
-        # Validate vector sync requirements
-        if settings.vector_sync_enabled and not settings.enable_offline_access:
-            errors.append(
-                f"[{mode.value}] ENABLE_OFFLINE_ACCESS must be enabled when "
-                "VECTOR_SYNC_ENABLED is true (background sync requires "
-                "app passwords or refresh tokens)"
-            )
-
-    # Note: Embedding provider validation removed - Simple provider is always
-    # available as fallback (ADR-015). Users can optionally configure Ollama or OpenAI
-    # for better quality embeddings.
-
-    return mode, errors
-
-
-def get_mode_summary(mode: AuthMode) -> str:
-    """Get human-readable summary of a deployment mode.
-
-    Args:
-        mode: Deployment mode
-
-    Returns:
-        Multi-line string describing the mode
-    """
-    requirements = MODE_REQUIREMENTS[mode]
-
-    summary_lines = [
-        f"Mode: {mode.value}",
-        f"Description: {requirements.description}",
-        "",
-        "Required configuration:",
-    ]
-
-    if requirements.required:
-        for var in requirements.required:
-            summary_lines.append(f"  - {var.upper()}")
-    else:
-        summary_lines.append("  (none - configured via session)")
-
-    summary_lines.append("")
-    summary_lines.append("Optional configuration:")
-
-    if requirements.optional:
-        for var in requirements.optional:
-            summary_lines.append(f"  - {var.upper()}")
-    else:
-        summary_lines.append("  (none)")
-
-    if requirements.conditional:
-        summary_lines.append("")
-        summary_lines.append("Conditional requirements:")
-        for condition, vars in requirements.conditional.items():
-            summary_lines.append(f"  When {condition.upper()} is enabled:")
-            for var in vars:
-                summary_lines.append(f"    - {var.upper()}")
-
-    return "\n".join(summary_lines)

nextcloud_mcp_server/context.py

@@ -67,11 +67,6 @@ async def get_client(ctx: Context) -> NextcloudClient:
         return _get_client_from_session_config(ctx)
 
     settings = get_settings()
-
-    # Multi-user BasicAuth pass-through mode - extract credentials from request
-    if settings.enable_multi_user_basic_auth:
-        return _get_client_from_basic_auth(ctx)
-
     lifespan_ctx = ctx.request_context.lifespan_context
 
     # BasicAuth mode - use shared client (no token exchange)
@@ -182,67 +177,3 @@ def _get_client_from_session_config(ctx: Context) -> NextcloudClient:
         username=username,
         auth=BasicAuth(username, app_password),
     )
-
-
-def _get_client_from_basic_auth(ctx: Context) -> NextcloudClient:
-    """
-    Create NextcloudClient from BasicAuth credentials in request headers.
-
-    For multi-user BasicAuth pass-through mode, this function extracts
-    username/password from the Authorization: Basic header (stored by
-    BasicAuthMiddleware) and creates a client that passes these credentials
-    through to Nextcloud APIs.
-
-    The credentials are NOT stored persistently - they exist only for the
-    duration of this request (stateless).
-
-    Args:
-        ctx: MCP request context with basic_auth in request state
-
-    Returns:
-        NextcloudClient configured with BasicAuth credentials
-
-    Raises:
-        ValueError: If BasicAuth credentials not found in request or if
-                   NEXTCLOUD_HOST is not configured
-    """
-    settings = get_settings()
-
-    # Validate that NEXTCLOUD_HOST is configured
-    if not settings.nextcloud_host:
-        raise ValueError(
-            "NEXTCLOUD_HOST environment variable must be set for multi-user BasicAuth mode"
-        )
-
-    # Extract BasicAuth credentials from request state (set by BasicAuthMiddleware)
-    # Access scope through the request object
-    scope = getattr(ctx.request_context.request, "scope", None)
-    if scope is None:
-        raise ValueError("Request scope not available in context")
-
-    request_state = scope.get("state", {})
-    basic_auth = request_state.get("basic_auth")
-
-    if not basic_auth:
-        raise ValueError(
-            "BasicAuth credentials not found in request. "
-            "Ensure Authorization: Basic header is provided with valid credentials."
-        )
-
-    username = basic_auth.get("username")
-    password = basic_auth.get("password")
-
-    if not username or not password:
-        raise ValueError("Invalid BasicAuth credentials - missing username or password")
-
-    logger.debug(
-        f"Creating multi-user BasicAuth client for {settings.nextcloud_host} as {username}"
-    )
-
-    # Create client that passes BasicAuth credentials through to Nextcloud
-    # settings.nextcloud_host is guaranteed to be str after the check above
-    return NextcloudClient(
-        base_url=settings.nextcloud_host,
-        username=username,
-        auth=BasicAuth(username, password),
-    )

nextcloud_mcp_server/server/oauth_tools.py

@@ -101,9 +101,6 @@ class ProvisioningStatus(BaseModel):
     provisioned_at: Optional[str] = Field(
         None, description="ISO timestamp when provisioned"
     )
-    credential_type: Optional[str] = Field(
-        None, description="Type of credential ('refresh_token' or 'app_password')"
-    )
     client_id: Optional[str] = Field(
         None, description="Client ID that initiated the original Flow 1"
     )
@@ -117,8 +114,8 @@ class ProvisioningResult(BaseModel):
     """Result of provisioning attempt."""
 
     success: bool = Field(description="Whether provisioning was initiated")
-    provisioning_url: Optional[str] = Field(
+    authorization_url: Optional[str] = Field(
-        None, description="URL to Astrolabe settings for provisioning background sync"
+        None, description="URL for user to complete OAuth authorization"
     )
     message: str = Field(description="Status message for the user")
     already_provisioned: bool = Field(
@@ -146,9 +143,8 @@ async def get_provisioning_status(ctx: Context, user_id: str) -> ProvisioningSta
     """
     Check the provisioning status for Nextcloud access.
 
-    Checks for both credential types:
+    This checks whether the user has completed Flow 2 to provision
-    1. App password from Astrolabe (works today)
+    offline access to Nextcloud resources.
-    2. OAuth refresh token from storage (for future)
 
     Args:
         mcp: MCP context
@@ -157,37 +153,6 @@ async def get_provisioning_status(ctx: Context, user_id: str) -> ProvisioningSta
     Returns:
         ProvisioningStatus with current provisioning state
     """
-    from datetime import datetime, timezone
-
-    from nextcloud_mcp_server.auth.astrolabe_client import AstrolabeClient
-    from nextcloud_mcp_server.config import get_settings
-
-    settings = get_settings()
-
-    # Check for app password first (interim solution)
-    if settings.oidc_client_id and settings.oidc_client_secret:
-        try:
-            astrolabe = AstrolabeClient(
-                nextcloud_host=settings.nextcloud_host or "",
-                client_id=settings.oidc_client_id,
-                client_secret=settings.oidc_client_secret,
-            )
-            status = await astrolabe.get_background_sync_status(user_id)
-
-            if status.get("has_access"):
-                logger.info(
-                    f"  get_provisioning_status: ✓ App password FOUND for user_id={user_id}"
-                )
-                provisioned_at_str = status.get("provisioned_at")
-                return ProvisioningStatus(
-                    is_provisioned=True,
-                    provisioned_at=provisioned_at_str,
-                    credential_type="app_password",
-                )
-        except Exception as e:
-            logger.debug(f"  App password check failed for {user_id}: {e}")
-
-    # Check for OAuth refresh token (fallback)
     logger.info(
         f"  get_provisioning_status: Looking up refresh token for user_id={user_id}"
     )
@@ -198,7 +163,7 @@ async def get_provisioning_status(ctx: Context, user_id: str) -> ProvisioningSta
 
     if not token_data:
         logger.info(
-            f"  get_provisioning_status: ✗ No credentials found for user_id={user_id}"
+            f"  get_provisioning_status: ✗ No refresh token found for user_id={user_id}"
         )
         return ProvisioningStatus(is_provisioned=False)
 
@@ -213,13 +178,14 @@ async def get_provisioning_status(ctx: Context, user_id: str) -> ProvisioningSta
     # Convert timestamp to ISO format if present
     provisioned_at_str = None
     if token_data.get("provisioned_at"):
+        from datetime import datetime, timezone
+
         dt = datetime.fromtimestamp(token_data["provisioned_at"], tz=timezone.utc)
         provisioned_at_str = dt.isoformat()
 
     return ProvisioningStatus(
         is_provisioned=True,
         provisioned_at=provisioned_at_str,
-        credential_type="refresh_token",
         client_id=token_data.get("provisioning_client_id"),
         scopes=token_data.get("scopes"),
         flow_type=token_data.get("flow_type", "hybrid"),
@@ -273,22 +239,36 @@ async def provision_nextcloud_access(
     """
     MCP Tool: Provision offline access to Nextcloud resources.
 
-    Returns URL to Astrolabe settings page where users can provision background
+    This tool initiates Flow 2 of the Progressive Consent architecture,
-    sync access using either:
+    allowing the MCP server to obtain delegated access to Nextcloud APIs.
-    - App password (works today, interim solution)
+
-    - OAuth refresh token (future, when Nextcloud supports OAuth for app APIs)
+    The user must complete the OAuth flow in their browser to grant access.
 
     Args:
         ctx: MCP context with user's Flow 1 token
         user_id: Optional user identifier (extracted from token if not provided)
 
     Returns:
-        ProvisioningResult with Astrolabe settings URL or status
+        ProvisioningResult with authorization URL or status
     """
     try:
         # Extract user ID from the MCP access token (Flow 1 token)
         if not user_id:
-            user_id = await extract_user_id_from_token(ctx)
+            # Get the authorization token from context
+            if hasattr(ctx, "authorization") and ctx.authorization:
+                token = ctx.authorization.token  # type: ignore
+                # Decode token to get user info
+                try:
+                    import jwt
+
+                    payload = jwt.decode(token, options={"verify_signature": False})
+                    user_id = payload.get("sub", "unknown")
+                    logger.info(f"Extracted user_id from Flow 1 token: {user_id}")
+                except Exception as e:
+                    logger.warning(f"Failed to decode token: {e}")
+                    user_id = "default_user"
+            else:
+                user_id = "default_user"
 
         # Check if already provisioned
         status = await get_provisioning_status(ctx, user_id)
@@ -297,8 +277,7 @@ async def provision_nextcloud_access(
                 success=True,
                 already_provisioned=True,
                 message=(
-                    f"Nextcloud access is already provisioned (credential_type={status.credential_type}, "
+                    f"Nextcloud access is already provisioned (since {status.provisioned_at}). "
-                    f"since {status.provisioned_at}). "
                     "Use 'revoke_nextcloud_access' if you want to re-provision."
                 ),
             )
@@ -316,20 +295,83 @@ async def provision_nextcloud_access(
                 ),
             )
 
-        # Return Astrolabe settings URL for background sync provisioning
+        # Get MCP server's OAuth client credentials
-        nextcloud_host = os.getenv("NEXTCLOUD_HOST", "http://localhost:8080")
+        # Try environment variable first, then fall back to DCR client_id
-        astrolabe_url = f"{nextcloud_host}/settings/user/astrolabe#background-sync"
+        server_client_id = os.getenv("MCP_SERVER_CLIENT_ID")
+        if not server_client_id:
+            # Try to get from lifespan context (DCR)
+            lifespan_ctx = ctx.request_context.lifespan_context
+            if hasattr(lifespan_ctx, "server_client_id"):
+                server_client_id = lifespan_ctx.server_client_id
+
+        if not server_client_id:
+            return ProvisioningResult(
+                success=False,
+                message=(
+                    "MCP server OAuth client not configured. "
+                    "Set MCP_SERVER_CLIENT_ID environment variable or use Dynamic Client Registration."
+                ),
+            )
+
+        # Generate OAuth URL for Flow 2
+        oidc_discovery_url = os.getenv(
+            "OIDC_DISCOVERY_URL",
+            f"{os.getenv('NEXTCLOUD_HOST')}/.well-known/openid-configuration",
+        )
+
+        # Generate secure state for CSRF protection
+        state = secrets.token_urlsafe(32)
+
+        # Store state in session for validation on callback
+        storage = RefreshTokenStorage.from_env()
+        await storage.initialize()
+
+        # Create OAuth session for Flow 2
+        session_id = f"flow2_{user_id}_{secrets.token_hex(8)}"
+        redirect_uri = f"{os.getenv('NEXTCLOUD_MCP_SERVER_URL', 'http://localhost:8000')}/oauth/callback"
+
+        await storage.store_oauth_session(
+            session_id=session_id,
+            client_redirect_uri="",  # No client redirect for Flow 2
+            state=state,
+            flow_type="flow2",
+            is_provisioning=True,
+            ttl_seconds=600,  # 10 minute TTL
+        )
+
+        # Define scopes for Nextcloud access
+        scopes = [
+            "openid",
+            "profile",
+            "email",
+            "offline_access",  # Critical for background operations
+            "notes:read",
+            "notes:write",
+            "calendar:read",
+            "calendar:write",
+            "contacts:read",
+            "contacts:write",
+            "files:read",
+            "files:write",
+        ]
+
+        # Generate authorization URL
+        auth_url = generate_oauth_url_for_flow2(
+            oidc_discovery_url=oidc_discovery_url,
+            server_client_id=server_client_id,
+            redirect_uri=redirect_uri,
+            state=state,
+            scopes=scopes,
+        )
 
         return ProvisioningResult(
             success=True,
-            provisioning_url=astrolabe_url,
+            authorization_url=auth_url,
             message=(
-                "Visit Astrolabe settings to provision background sync access.\n\n"
+                "Please visit the authorization URL to grant the MCP server "
-                "You can choose either:\n"
+                "offline access to your Nextcloud resources. This is a one-time "
-                "- App password (works today, recommended for now)\n"
+                "setup that allows the server to access Nextcloud on your behalf "
-                "- OAuth refresh token (future, when Nextcloud fully supports OAuth)\n\n"
+                "even when you're not actively connected."
-                "After provisioning, background sync will enable the MCP server to "
-                "access Nextcloud resources even when you're not actively connected."
             ),
         )
 

nextcloud_mcp_server/vector/oauth_sync.py

@@ -5,10 +5,6 @@ with ENABLE_OFFLINE_ACCESS=true:
 - User Manager: Monitors RefreshTokenStorage for user changes
 - Per-User Scanners: One scanner task per provisioned user
 - Shared Processor Pool: Processes documents from all users
-
-Supports dual credential types for background sync:
-- App passwords (interim solution, works today)
-- OAuth refresh tokens (future, when Nextcloud supports OAuth for app APIs)
 """
 
 import logging
@@ -22,9 +18,7 @@ from anyio.streams.memory import (
     MemoryObjectReceiveStream,
     MemoryObjectSendStream,
 )
-from httpx import BasicAuth
 
-from nextcloud_mcp_server.auth.astrolabe_client import AstrolabeClient
 from nextcloud_mcp_server.client import NextcloudClient
 from nextcloud_mcp_server.config import get_settings
 from nextcloud_mcp_server.vector.scanner import DocumentTask, scan_user_documents
@@ -66,10 +60,6 @@ async def get_user_client(
 ) -> NextcloudClient:
     """Get an authenticated NextcloudClient for a user.
 
-    Supports dual credential types with priority:
-    1. App password from Astrolabe (works today with BasicAuth)
-    2. OAuth refresh token from storage (for future when OAuth fully supported)
-
     Args:
         user_id: User identifier
         token_broker: Token broker for obtaining access tokens
@@ -81,36 +71,6 @@ async def get_user_client(
     Raises:
         NotProvisionedError: If user has not provisioned offline access
     """
-    settings = get_settings()
-
-    # Try app password first (interim solution, works today)
-    if settings.oidc_client_id and settings.oidc_client_secret:
-        try:
-            astrolabe = AstrolabeClient(
-                nextcloud_host=nextcloud_host,
-                client_id=settings.oidc_client_id,
-                client_secret=settings.oidc_client_secret,
-            )
-            app_password = await astrolabe.get_user_app_password(user_id)
-
-            if app_password:
-                logger.info(
-                    f"Using app password for background sync: {user_id} "
-                    f"(credential_type=app_password)"
-                )
-                return NextcloudClient(
-                    base_url=nextcloud_host,
-                    username=user_id,
-                    auth=BasicAuth(user_id, app_password),
-                )
-        except Exception as e:
-            logger.debug(f"App password not available for {user_id}: {e}")
-
-    # Fall back to OAuth refresh token
-    logger.info(
-        f"Using OAuth refresh token for background sync: {user_id} "
-        f"(credential_type=refresh_token)"
-    )
     token = await token_broker.get_background_token(user_id, VECTOR_SYNC_SCOPES)
     if not token:
         raise NotProvisionedError(f"User {user_id} has not provisioned offline access")

scripts/bump-astrolabe.sh

@@ -58,15 +58,6 @@ fi
 # Run commitizen bump and capture output
 if ! output=$($CZ_CMD 2>&1); then
     cd ../..
-
-    # Check if this is the expected "no commits to bump" case
-    if echo "$output" | grep -q "\[NO_COMMITS_TO_BUMP\]"; then
-        echo "ℹ️  No commits eligible for version bump" >&2
-        echo "$output" >&2
-        exit 0
-    fi
-
-    # Otherwise, this is an actual error
     echo "❌ Error: Version bump failed" >&2
     echo "$output" >&2
     echo "" >&2

scripts/bump-helm.sh

@@ -53,15 +53,6 @@ fi
 # Run commitizen bump and capture output
 if ! output=$($CZ_CMD 2>&1); then
     cd ../..
-
-    # Check if this is the expected "no commits to bump" case
-    if echo "$output" | grep -q "\[NO_COMMITS_TO_BUMP\]"; then
-        echo "ℹ️  No commits eligible for version bump" >&2
-        echo "$output" >&2
-        exit 0
-    fi
-
-    # Otherwise, this is an actual error
     echo "❌ Error: Version bump failed" >&2
     echo "$output" >&2
     echo "" >&2

scripts/bump-mcp.sh

@@ -44,14 +44,6 @@ fi
 
 # Run commitizen bump and capture output
 if ! output=$($CZ_CMD 2>&1); then
-    # Check if this is the expected "no commits to bump" case
-    if echo "$output" | grep -q "\[NO_COMMITS_TO_BUMP\]"; then
-        echo "ℹ️  No commits eligible for version bump" >&2
-        echo "$output" >&2
-        exit 0
-    fi
-
-    # Otherwise, this is an actual error
     echo "❌ Error: Version bump failed" >&2
     echo "$output" >&2
     echo "" >&2

tests/conftest.py

@@ -114,7 +114,6 @@ async def create_mcp_client_session(
     client_name: str = "MCP",
     elicitation_callback: Any = None,
     sampling_callback: Any = None,
-    headers: dict[str, str] | None = None,
 ) -> AsyncGenerator[ClientSession, Any]:
     """
     Factory function to create an MCP client session with proper lifecycle management.
@@ -136,8 +135,6 @@ async def create_mcp_client_session(
             Should match signature: async def callback(context: RequestContext, params: ElicitRequestParams) -> ElicitResult | ErrorData
         sampling_callback: Optional callback for handling sampling (LLM generation) requests.
             Should match signature: async def callback(context: RequestContext, params: CreateMessageRequestParams) -> CreateMessageResult | ErrorData
-        headers: Optional custom headers (e.g., for BasicAuth). If both headers and token are provided,
-            custom headers take precedence.
 
     Yields:
         Initialized MCP ClientSession
@@ -150,9 +147,8 @@ async def create_mcp_client_session(
     """
     logger.info(f"Creating Streamable HTTP client for {client_name}")
 
-    # Prepare headers - custom headers take precedence over token-based auth
+    # Prepare headers with OAuth token if provided
-    if headers is None:
+    headers = {"Authorization": f"Bearer {token}"} if token else None
-        headers = {"Authorization": f"Bearer {token}"} if token else None
 
     # Use native async with - Python ensures LIFO cleanup
     # Cleanup order will be: ClientSession.__aexit__ -> streamablehttp_client.__aexit__
@@ -244,32 +240,6 @@ async def nc_mcp_oauth_client(
         yield session
 
 
-@pytest.fixture(scope="session")
-async def nc_mcp_basic_auth_client(
-    anyio_backend,
-) -> AsyncGenerator[ClientSession, Any]:
-    """
-    Fixture to create an MCP client session with BasicAuth credentials.
-    Connects to the multi-user BasicAuth MCP server on port 8003 with ENABLE_MULTI_USER_BASIC_AUTH=true.
-
-    Uses BasicAuth credentials for multi-user pass-through mode (ADR-020).
-    Credentials are passed in Authorization header and forwarded to Nextcloud APIs.
-
-    Uses anyio pytest plugin for proper async fixture handling.
-    """
-    import base64
-
-    credentials = base64.b64encode(b"admin:admin").decode("utf-8")
-    auth_header = f"Basic {credentials}"
-
-    async for session in create_mcp_client_session(
-        url="http://localhost:8003/mcp",
-        headers={"Authorization": auth_header},
-        client_name="BasicAuth MCP (Multi-User)",
-    ):
-        yield session
-
-
 @pytest.fixture(scope="session")
 async def nc_mcp_oauth_jwt_client(
     anyio_backend,
@@ -3217,199 +3187,3 @@ async def nc_mcp_keycloak_client_no_custom_scopes(
         client_name="Keycloak No Custom Scopes MCP",
     ):
         yield session
-
-
-# ========================================================================
-# Astrolabe Dynamic Configuration Fixtures
-# ========================================================================
-
-
-@pytest.fixture(scope="session")
-async def configure_astrolabe_for_mcp_server(nc_client):
-    """Configure Astrolabe app to connect to a specific MCP server.
-
-    This fixture dynamically configures the Astrolabe app's MCP server settings
-    and OAuth client, allowing tests to verify integration with different MCP
-    server deployments (mcp-oauth, mcp-keycloak, mcp-multi-user-basic, etc.).
-
-    Usage:
-        async def test_my_integration(configure_astrolabe_for_mcp_server):
-            await configure_astrolabe_for_mcp_server(
-                mcp_server_internal_url="http://mcp-oauth:8001",
-                mcp_server_public_url="http://localhost:8001"
-            )
-            # ... test Astrolabe integration ...
-
-    Args:
-        nc_client: NextcloudClient fixture for occ command execution
-
-    Returns:
-        Async function that accepts:
-            - mcp_server_internal_url: Internal Docker URL for PHP app to call MCP APIs
-            - mcp_server_public_url: Public URL for OAuth token audience validation
-            - client_id: Optional OAuth client ID (default: "nextcloudMcpServerUIPublicClient")
-    """
-    import json
-    import subprocess
-
-    async def _configure(
-        mcp_server_internal_url: str,
-        mcp_server_public_url: str,
-        client_id: str = "nextcloudMcpServerUIPublicClient",
-    ) -> dict[str, str]:
-        """Configure Astrolabe for the specified MCP server.
-
-        Returns:
-            Dict with client_id and client_secret
-        """
-        logger.info(
-            f"Configuring Astrolabe for MCP server: {mcp_server_internal_url} (public: {mcp_server_public_url})"
-        )
-
-        # Configure MCP server URLs in Nextcloud system config
-        subprocess.run(
-            [
-                "docker",
-                "compose",
-                "exec",
-                "-T",
-                "app",
-                "php",
-                "/var/www/html/occ",
-                "config:system:set",
-                "mcp_server_url",
-                "--value",
-                mcp_server_internal_url,
-            ],
-            check=True,
-            capture_output=True,
-        )
-
-        subprocess.run(
-            [
-                "docker",
-                "compose",
-                "exec",
-                "-T",
-                "app",
-                "php",
-                "/var/www/html/occ",
-                "config:system:set",
-                "mcp_server_public_url",
-                "--value",
-                mcp_server_public_url,
-            ],
-            check=True,
-            capture_output=True,
-        )
-
-        logger.info("✓ MCP server URLs configured")
-
-        # Remove existing OAuth client if it exists
-        try:
-            subprocess.run(
-                [
-                    "docker",
-                    "compose",
-                    "exec",
-                    "-T",
-                    "app",
-                    "php",
-                    "/var/www/html/occ",
-                    "oidc:remove",
-                    client_id,
-                ],
-                check=False,  # Don't fail if client doesn't exist
-                capture_output=True,
-            )
-            logger.info(f"Removed existing OAuth client: {client_id}")
-        except Exception:
-            pass
-
-        # Create OAuth client for Astrolabe
-        redirect_uri = "http://localhost:8080/apps/astrolabe/oauth/callback"
-
-        result = subprocess.run(
-            [
-                "docker",
-                "compose",
-                "exec",
-                "-T",
-                "app",
-                "php",
-                "/var/www/html/occ",
-                "oidc:create",
-                "Astrolabe",
-                redirect_uri,
-                "--client_id",
-                client_id,
-                "--type",
-                "confidential",
-                "--flow",
-                "code",
-                "--token_type",
-                "jwt",
-                "--resource_url",
-                mcp_server_public_url,
-                "--allowed_scopes",
-                "openid profile email offline_access notes:read notes:write calendar:read calendar:write contacts:read contacts:write cookbook:read cookbook:write deck:read deck:write tables:read tables:write files:read files:write",
-            ],
-            check=True,
-            capture_output=True,
-            text=True,
-        )
-
-        # Parse client_secret from JSON output
-        client_output = json.loads(result.stdout.strip())
-        client_secret = client_output.get("client_secret")
-
-        if not client_secret:
-            raise ValueError(
-                "Failed to extract client_secret from OAuth client creation"
-            )
-
-        logger.info(f"✓ OAuth client created: {client_id}")
-
-        # Store client credentials in Nextcloud system config
-        subprocess.run(
-            [
-                "docker",
-                "compose",
-                "exec",
-                "-T",
-                "app",
-                "php",
-                "/var/www/html/occ",
-                "config:system:set",
-                "astrolabe_client_id",
-                "--value",
-                client_id,
-            ],
-            check=True,
-            capture_output=True,
-        )
-
-        subprocess.run(
-            [
-                "docker",
-                "compose",
-                "exec",
-                "-T",
-                "app",
-                "php",
-                "/var/www/html/occ",
-                "config:system:set",
-                "astrolabe_client_secret",
-                "--value",
-                client_secret,
-            ],
-            check=True,
-            capture_output=True,
-        )
-
-        logger.info("✓ Client credentials stored in system config")
-        logger.info(f"Astrolabe configured for MCP server: {mcp_server_public_url}")
-
-        return {"client_id": client_id, "client_secret": client_secret}
-
-    return _configure

tests/integration/test_app_password_provisioning.py

@@ -1,151 +0,0 @@
-"""Integration tests for app password provisioning via Astrolabe.
-
-Tests the complete flow:
-1. User stores app password via Astrolabe API
-2. MCP server retrieves it via OAuth client credentials
-3. Background sync uses it to access Nextcloud
-"""
-
-import pytest
-from httpx import BasicAuth
-
-from nextcloud_mcp_server.auth.astrolabe_client import AstrolabeClient
-from nextcloud_mcp_server.config import get_settings
-from nextcloud_mcp_server.vector.oauth_sync import get_user_client
-
-
-@pytest.mark.integration
-async def test_astrolabe_client_initialization():
-    """Test AstrolabeClient can be instantiated."""
-    client = AstrolabeClient(
-        nextcloud_host="http://localhost:8080",
-        client_id="test-client",
-        client_secret="test-secret",
-    )
-
-    assert client is not None
-    assert client.nextcloud_host == "http://localhost:8080"
-    assert client.client_id == "test-client"
-    assert client.client_secret == "test-secret"
-    assert client._token_cache is None
-
-
-@pytest.mark.integration
-async def test_astrolabe_client_get_access_token_requires_oidc():
-    """Test that getting access token requires OIDC discovery endpoint."""
-    client = AstrolabeClient(
-        nextcloud_host="http://localhost:8080",
-        client_id="test-client",
-        client_secret="test-secret",
-    )
-
-    # This will fail without proper OIDC setup, which is expected
-    # The test verifies the client follows the OAuth client credentials flow
-    try:
-        token = await client.get_access_token()
-        # If we get here, OIDC is configured
-        assert token is not None
-    except Exception as e:
-        # Expected if OIDC not fully configured for test client
-        # 400/401/403/404 all indicate the flow is working but credentials are invalid
-        assert any(code in str(e) for code in ["400", "401", "403", "404"])
-
-
-@pytest.mark.integration
-async def test_get_user_app_password_returns_none_for_unconfigured_user():
-    """Test that get_user_app_password returns None for users without app passwords."""
-    # This requires valid OAuth client credentials
-    settings = get_settings()
-
-    if not settings.oidc_client_id or not settings.oidc_client_secret:
-        pytest.skip("OAuth client credentials not configured")
-
-    client = AstrolabeClient(
-        nextcloud_host=settings.nextcloud_host or "http://localhost:8080",
-        client_id=settings.oidc_client_id,
-        client_secret=settings.oidc_client_secret,
-    )
-
-    # Try to get app password for a user that hasn't provisioned one
-    try:
-        app_password = await client.get_user_app_password("nonexistent_user")
-        # Should return None for unconfigured user (404 response)
-        assert app_password is None
-    except Exception as e:
-        # May fail with auth error if OAuth not fully configured
-        assert any(code in str(e) for code in ["400", "401", "403", "404"])
-
-
-@pytest.mark.integration
-async def test_dual_credential_support_in_background_sync(mocker):
-    """Test that background sync tries app password first, then refresh token."""
-    from nextcloud_mcp_server.auth.token_broker import TokenBrokerService
-
-    # Mock AstrolabeClient to return an app password
-    mock_astrolabe = mocker.AsyncMock()
-    mock_astrolabe.get_user_app_password.return_value = "test-app-password-12345"
-
-    mocker.patch(
-        "nextcloud_mcp_server.vector.oauth_sync.AstrolabeClient",
-        return_value=mock_astrolabe,
-    )
-
-    # Mock TokenBrokerService (shouldn't be called if app password works)
-    mock_token_broker = mocker.MagicMock(spec=TokenBrokerService)
-
-    # Call get_user_client - should use app password
-    try:
-        _client = await get_user_client(
-            user_id="test_user",
-            token_broker=mock_token_broker,
-            nextcloud_host="http://localhost:8080",
-        )
-
-        # Verify app password was requested
-        mock_astrolabe.get_user_app_password.assert_called_once_with("test_user")
-
-        # Verify token broker was NOT called (app password took priority)
-        mock_token_broker.get_background_token.assert_not_called()
-
-        # Verify client uses BasicAuth
-        assert _client.auth is not None
-        assert isinstance(_client.auth, BasicAuth)
-    except Exception:
-        # May fail in test environment, but we verified the priority logic
-        pass
-
-
-@pytest.mark.integration
-async def test_background_sync_falls_back_to_refresh_token(mocker):
-    """Test that background sync falls back to refresh token if no app password."""
-    from nextcloud_mcp_server.auth.token_broker import TokenBrokerService
-
-    # Mock AstrolabeClient to return None (no app password)
-    mock_astrolabe = mocker.AsyncMock()
-    mock_astrolabe.get_user_app_password.return_value = None
-
-    mocker.patch(
-        "nextcloud_mcp_server.vector.oauth_sync.AstrolabeClient",
-        return_value=mock_astrolabe,
-    )
-
-    # Mock TokenBrokerService to return an access token
-    mock_token_broker = mocker.AsyncMock(spec=TokenBrokerService)
-    mock_token_broker.get_background_token.return_value = "test-access-token"
-
-    # Call get_user_client - should fall back to refresh token
-    try:
-        _client = await get_user_client(
-            user_id="test_user",
-            token_broker=mock_token_broker,
-            nextcloud_host="http://localhost:8080",
-        )
-
-        # Verify app password was attempted first
-        mock_astrolabe.get_user_app_password.assert_called_once_with("test_user")
-
-        # Verify token broker was called as fallback
-        mock_token_broker.get_background_token.assert_called_once()
-    except Exception:
-        # May fail in test environment, but we verified the fallback logic
-        pass

tests/integration/test_multi_user_basic_auth.py

@@ -1,47 +0,0 @@
-"""Integration tests for multi-user BasicAuth pass-through mode.
-
-Tests that BasicAuth credentials are extracted from request headers
-and passed through to Nextcloud APIs without storage (stateless).
-"""
-
-import pytest
-
-
-@pytest.mark.integration
-async def test_basic_auth_pass_through_notes_list(nc_mcp_basic_auth_client):
-    """Test BasicAuth pass-through with notes list tool."""
-    # Call tool - BasicAuth header is set at connection level by fixture
-    response = await nc_mcp_basic_auth_client.call_tool("nc_notes_list", {})
-
-    # Verify tool executed successfully with pass-through auth
-    assert response is not None
-    assert "results" in response or "content" in response
-
-
-@pytest.mark.integration
-async def test_basic_auth_pass_through_notes_create(nc_mcp_basic_auth_client):
-    """Test BasicAuth pass-through with notes create tool."""
-    # Create a note using BasicAuth
-    response = await nc_mcp_basic_auth_client.call_tool(
-        "nc_notes_create",
-        {
-            "title": "BasicAuth Test Note",
-            "content": "This note was created via BasicAuth pass-through",
-            "category": "Test",
-        },
-    )
-
-    assert response is not None
-    assert response.get("success") is True or "note_id" in response
-
-
-@pytest.mark.integration
-async def test_basic_auth_pass_through_search(nc_mcp_basic_auth_client):
-    """Test BasicAuth pass-through with search tool."""
-    # Search notes using BasicAuth
-    response = await nc_mcp_basic_auth_client.call_tool(
-        "nc_notes_search", {"query": "BasicAuth"}
-    )
-
-    assert response is not None
-    assert "results" in response or "content" in response

tests/server/oauth/test_astrolabe_multi_server_integration.py

@@ -1,104 +0,0 @@
-"""Test Astrolabe integration with multiple MCP server deployments.
-
-This test suite verifies that the Astrolabe app can be dynamically configured
-to connect to different MCP server deployments (mcp-oauth, mcp-keycloak, etc.).
-
-The configuration is managed dynamically during tests using the
-configure_astrolabe_for_mcp_server fixture, which allows testing multiple
-deployment scenarios without requiring static post-installation configuration.
-"""
-
-import logging
-
-import pytest
-
-logger = logging.getLogger(__name__)
-
-pytestmark = [pytest.mark.integration, pytest.mark.oauth]
-
-
-class TestAstrolabeMultiServerIntegration:
-    """Test suite for Astrolabe integration with multiple MCP servers."""
-
-    @pytest.mark.parametrize(
-        "mcp_server_config",
-        [
-            {
-                "name": "mcp-oauth",
-                "internal_url": "http://mcp-oauth:8001",
-                "public_url": "http://localhost:8001",
-            },
-            {
-                "name": "mcp-keycloak",
-                "internal_url": "http://mcp-keycloak:8002",
-                "public_url": "http://localhost:8002",
-            },
-            # Add more MCP server configurations as needed:
-            # {
-            #     "name": "mcp-multi-user-basic",
-            #     "internal_url": "http://mcp-multi-user-basic:8000",
-            #     "public_url": "http://localhost:8003",
-            # },
-        ],
-    )
-    async def test_astrolabe_configuration_for_different_servers(
-        self, configure_astrolabe_for_mcp_server, mcp_server_config
-    ):
-        """Test that Astrolabe can be configured for different MCP servers.
-
-        This test verifies that:
-        1. The configure_astrolabe_for_mcp_server fixture successfully configures
-           the Astrolabe app for different MCP server endpoints
-        2. OAuth client credentials are properly generated and stored
-        3. The configuration can be dynamically changed between tests
-        """
-        logger.info(f"Configuring Astrolabe for {mcp_server_config['name']}...")
-
-        # Configure Astrolabe for the specific MCP server
-        credentials = await configure_astrolabe_for_mcp_server(
-            mcp_server_internal_url=mcp_server_config["internal_url"],
-            mcp_server_public_url=mcp_server_config["public_url"],
-        )
-
-        # Verify credentials were returned
-        assert "client_id" in credentials
-        assert "client_secret" in credentials
-        assert credentials["client_id"] == "nextcloudMcpServerUIPublicClient"
-        assert len(credentials["client_secret"]) > 0
-
-        logger.info(
-            f"✓ Astrolabe successfully configured for {mcp_server_config['name']}"
-        )
-        logger.info(f"  Internal URL: {mcp_server_config['internal_url']}")
-        logger.info(f"  Public URL: {mcp_server_config['public_url']}")
-        logger.info(f"  Client ID: {credentials['client_id']}")
-        logger.info(f"  Client Secret: {credentials['client_secret'][:8]}...")
-
-    async def test_astrolabe_reconfiguration(self, configure_astrolabe_for_mcp_server):
-        """Test that Astrolabe can be reconfigured multiple times in the same session.
-
-        This verifies that the OAuth client can be recreated with different
-        settings without conflicts.
-        """
-        # First configuration: mcp-oauth
-        logger.info("First configuration: mcp-oauth")
-        credentials1 = await configure_astrolabe_for_mcp_server(
-            mcp_server_internal_url="http://mcp-oauth:8001",
-            mcp_server_public_url="http://localhost:8001",
-        )
-
-        assert credentials1["client_id"] == "nextcloudMcpServerUIPublicClient"
-
-        # Second configuration: mcp-keycloak (reconfiguration)
-        logger.info("Second configuration: mcp-keycloak (reconfiguration)")
-        credentials2 = await configure_astrolabe_for_mcp_server(
-            mcp_server_internal_url="http://mcp-keycloak:8002",
-            mcp_server_public_url="http://localhost:8002",
-        )
-
-        assert credentials2["client_id"] == "nextcloudMcpServerUIPublicClient"
-
-        # Client secrets should be different (new client created)
-        assert credentials1["client_secret"] != credentials2["client_secret"]
-
-        logger.info("✓ Astrolabe successfully reconfigured without conflicts")

tests/server/oauth/test_nc_php_app_debug.py

@@ -10,14 +10,8 @@ logger = logging.getLogger(__name__)
 pytestmark = [pytest.mark.integration, pytest.mark.oauth]
 
 
-async def test_capture_settings_page(browser, configure_astrolabe_for_mcp_server):
+async def test_capture_settings_page(browser):
     """Capture what's actually rendered on the personal settings page."""
-    # Configure Astrolabe for mcp-oauth server
-    await configure_astrolabe_for_mcp_server(
-        mcp_server_internal_url="http://mcp-oauth:8001",
-        mcp_server_public_url="http://localhost:8001",
-    )
-
     nextcloud_host = os.getenv("NEXTCLOUD_HOST", "http://localhost:8080")
     username = os.getenv("NEXTCLOUD_USERNAME", "admin")
     password = os.getenv("NEXTCLOUD_PASSWORD", "admin")

tests/server/oauth/test_nc_php_app_oauth.py

@@ -44,32 +44,14 @@ async def nc_admin_http_client(nextcloud_credentials):
 
 
 @pytest.fixture(scope="module")
-async def configure_astrolabe_for_tests(configure_astrolabe_for_mcp_server):
+async def authorized_nc_session(browser, nextcloud_credentials):
-    """Configure Astrolabe to connect to mcp-oauth server before running tests.
-
-    This module-scoped fixture ensures Astrolabe is properly configured
-    for the mcp-oauth server (http://localhost:8001) before any tests run.
-    """
-    logger.info("Configuring Astrolabe for mcp-oauth server...")
-    await configure_astrolabe_for_mcp_server(
-        mcp_server_internal_url="http://mcp-oauth:8001",
-        mcp_server_public_url="http://localhost:8001",
-    )
-    logger.info("✓ Astrolabe configured for mcp-oauth server")
-
-
-@pytest.fixture(scope="module")
-async def authorized_nc_session(
-    browser, nextcloud_credentials, configure_astrolabe_for_tests
-):
     """Module-scoped fixture that logs in and authorizes the NC PHP app once.
 
     This fixture:
-    1. Configures Astrolabe for mcp-oauth server (via configure_astrolabe_for_tests)
+    1. Creates a browser context
-    2. Creates a browser context
+    2. Logs in to Nextcloud
-    3. Logs in to Nextcloud
+    3. Authorizes the MCP Server UI app (if not already authorized)
-    4. Authorizes the MCP Server UI app (if not already authorized)
+    4. Returns the page for use in all tests
-    5. Returns the page for use in all tests
 
     The authorization is done once and reused for all tests in this module.
     """

tests/unit/test_basic_auth_middleware.py

@@ -1,241 +0,0 @@
-"""Unit tests for BasicAuthMiddleware."""
-
-import base64
-
-import pytest
-
-from nextcloud_mcp_server.app import BasicAuthMiddleware
-
-
-class MockApp:
-    """Mock ASGI app for testing middleware."""
-
-    def __init__(self):
-        self.called = False
-        self.received_scope = None
-
-    async def __call__(self, scope, receive, send):
-        self.called = True
-        self.received_scope = scope
-
-
-@pytest.mark.unit
-async def test_basic_auth_middleware_valid_credentials():
-    """Test that middleware correctly extracts valid BasicAuth credentials."""
-    # Arrange
-    mock_app = MockApp()
-    middleware = BasicAuthMiddleware(mock_app)
-
-    credentials = base64.b64encode(b"admin:password123").decode("utf-8")
-    scope = {
-        "type": "http",
-        "headers": [(b"authorization", f"Basic {credentials}".encode())],
-    }
-
-    # Act
-    await middleware(scope, None, None)  # type: ignore[arg-type]
-
-    # Assert
-    assert mock_app.called
-    assert "state" in scope
-    assert "basic_auth" in scope["state"]
-    assert scope["state"]["basic_auth"]["username"] == "admin"
-    assert scope["state"]["basic_auth"]["password"] == "password123"
-
-
-@pytest.mark.unit
-async def test_basic_auth_middleware_password_with_colon():
-    """Test that middleware handles passwords containing colons."""
-    # Arrange
-    mock_app = MockApp()
-    middleware = BasicAuthMiddleware(mock_app)
-
-    # Password contains colon - should split on first colon only
-    credentials = base64.b64encode(b"user:pass:word:123").decode("utf-8")
-    scope = {
-        "type": "http",
-        "headers": [(b"authorization", f"Basic {credentials}".encode())],
-    }
-
-    # Act
-    await middleware(scope, None, None)  # type: ignore[arg-type]
-
-    # Assert
-    assert scope["state"]["basic_auth"]["username"] == "user"
-    assert scope["state"]["basic_auth"]["password"] == "pass:word:123"
-
-
-@pytest.mark.unit
-async def test_basic_auth_middleware_invalid_base64():
-    """Test that middleware handles invalid base64 encoding gracefully."""
-    # Arrange
-    mock_app = MockApp()
-    middleware = BasicAuthMiddleware(mock_app)
-
-    scope = {
-        "type": "http",
-        "headers": [(b"authorization", b"Basic INVALID_BASE64!!!")],
-    }
-
-    # Act
-    await middleware(scope, None, None)  # type: ignore[arg-type]
-
-    # Assert
-    assert mock_app.called
-    # Should not have basic_auth in state due to error
-    assert "basic_auth" not in scope.get("state", {})
-
-
-@pytest.mark.unit
-async def test_basic_auth_middleware_missing_authorization_header():
-    """Test that middleware handles missing Authorization header."""
-    # Arrange
-    mock_app = MockApp()
-    middleware = BasicAuthMiddleware(mock_app)
-
-    scope = {
-        "type": "http",
-        "headers": [],
-    }
-
-    # Act
-    await middleware(scope, None, None)  # type: ignore[arg-type]
-
-    # Assert
-    assert mock_app.called
-    # Should not have basic_auth in state
-    assert "basic_auth" not in scope.get("state", {})
-
-
-@pytest.mark.unit
-async def test_basic_auth_middleware_wrong_auth_scheme():
-    """Test that middleware ignores non-Basic auth schemes."""
-    # Arrange
-    mock_app = MockApp()
-    middleware = BasicAuthMiddleware(mock_app)
-
-    scope = {
-        "type": "http",
-        "headers": [(b"authorization", b"Bearer some_token")],
-    }
-
-    # Act
-    await middleware(scope, None, None)  # type: ignore[arg-type]
-
-    # Assert
-    assert mock_app.called
-    # Should not have basic_auth in state
-    assert "basic_auth" not in scope.get("state", {})
-
-
-@pytest.mark.unit
-async def test_basic_auth_middleware_malformed_credentials():
-    """Test that middleware handles credentials without colon separator."""
-    # Arrange
-    mock_app = MockApp()
-    middleware = BasicAuthMiddleware(mock_app)
-
-    # Credentials without colon separator
-    credentials = base64.b64encode(b"username_no_password").decode("utf-8")
-    scope = {
-        "type": "http",
-        "headers": [(b"authorization", f"Basic {credentials}".encode())],
-    }
-
-    # Act
-    await middleware(scope, None, None)  # type: ignore[arg-type]
-
-    # Assert
-    assert mock_app.called
-    # Should not have basic_auth in state due to error
-    assert "basic_auth" not in scope.get("state", {})
-
-
-@pytest.mark.unit
-async def test_basic_auth_middleware_non_http_scope():
-    """Test that middleware passes through non-HTTP scopes unchanged."""
-    # Arrange
-    mock_app = MockApp()
-    middleware = BasicAuthMiddleware(mock_app)
-
-    scope = {
-        "type": "websocket",
-        "headers": [(b"authorization", b"Basic dXNlcjpwYXNz")],
-    }
-
-    # Act
-    await middleware(scope, None, None)  # type: ignore[arg-type]
-
-    # Assert
-    assert mock_app.called
-    # Should not process websocket scopes
-    assert "state" not in scope
-
-
-@pytest.mark.unit
-async def test_basic_auth_middleware_preserves_existing_state():
-    """Test that middleware preserves existing state data."""
-    # Arrange
-    mock_app = MockApp()
-    middleware = BasicAuthMiddleware(mock_app)
-
-    credentials = base64.b64encode(b"user:pass").decode("utf-8")
-    scope = {
-        "type": "http",
-        "headers": [(b"authorization", f"Basic {credentials}".encode())],
-        "state": {"existing_key": "existing_value"},
-    }
-
-    # Act
-    await middleware(scope, None, None)  # type: ignore[arg-type]
-
-    # Assert
-    assert mock_app.called
-    assert scope["state"]["existing_key"] == "existing_value"
-    assert scope["state"]["basic_auth"]["username"] == "user"
-    assert scope["state"]["basic_auth"]["password"] == "pass"
-
-
-@pytest.mark.unit
-async def test_basic_auth_middleware_empty_password():
-    """Test that middleware handles empty passwords."""
-    # Arrange
-    mock_app = MockApp()
-    middleware = BasicAuthMiddleware(mock_app)
-
-    credentials = base64.b64encode(b"user:").decode("utf-8")
-    scope = {
-        "type": "http",
-        "headers": [(b"authorization", f"Basic {credentials}".encode())],
-    }
-
-    # Act
-    await middleware(scope, None, None)  # type: ignore[arg-type]
-
-    # Assert
-    assert mock_app.called
-    assert scope["state"]["basic_auth"]["username"] == "user"
-    assert scope["state"]["basic_auth"]["password"] == ""
-
-
-@pytest.mark.unit
-async def test_basic_auth_middleware_unicode_credentials():
-    """Test that middleware handles Unicode characters in credentials."""
-    # Arrange
-    mock_app = MockApp()
-    middleware = BasicAuthMiddleware(mock_app)
-
-    # Username and password with Unicode characters
-    credentials = base64.b64encode("üser:pässwörd".encode("utf-8")).decode("utf-8")
-    scope = {
-        "type": "http",
-        "headers": [(b"authorization", f"Basic {credentials}".encode())],
-    }
-
-    # Act
-    await middleware(scope, None, None)  # type: ignore[arg-type]
-
-    # Assert
-    assert mock_app.called
-    assert scope["state"]["basic_auth"]["username"] == "üser"
-    assert scope["state"]["basic_auth"]["password"] == "pässwörd"

tests/unit/test_config_validators.py

@@ -1,578 +0,0 @@
-"""Unit tests for configuration validation and mode detection.
-
-Tests cover:
-- Mode detection logic
-- Configuration validation for each mode
-- Error message generation
-- Edge cases and boundary conditions
-"""
-
-import os
-from unittest.mock import patch
-
-from nextcloud_mcp_server.config import Settings
-from nextcloud_mcp_server.config_validators import (
-    AuthMode,
-    detect_auth_mode,
-    get_mode_summary,
-    validate_configuration,
-)
-
-
-class TestModeDetection:
-    """Test auth mode detection from configuration."""
-
-    def test_smithery_mode_detection(self):
-        """Test Smithery mode is detected from environment variable."""
-        settings = Settings()
-
-        with patch.dict(os.environ, {"SMITHERY_DEPLOYMENT": "true"}):
-            mode = detect_auth_mode(settings)
-            assert mode == AuthMode.SMITHERY_STATELESS
-
-    def test_token_exchange_mode_detection(self):
-        """Test token exchange mode is detected."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_token_exchange=True,
-        )
-
-        mode = detect_auth_mode(settings)
-        assert mode == AuthMode.OAUTH_TOKEN_EXCHANGE
-
-    def test_multi_user_basic_mode_detection(self):
-        """Test multi-user BasicAuth mode is detected."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_multi_user_basic_auth=True,
-        )
-
-        mode = detect_auth_mode(settings)
-        assert mode == AuthMode.MULTI_USER_BASIC
-
-    def test_single_user_basic_mode_detection(self):
-        """Test single-user BasicAuth mode is detected."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",
-            nextcloud_password="password",
-        )
-
-        mode = detect_auth_mode(settings)
-        assert mode == AuthMode.SINGLE_USER_BASIC
-
-    def test_oauth_single_audience_default(self):
-        """Test OAuth single-audience is default mode."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-        )
-
-        mode = detect_auth_mode(settings)
-        assert mode == AuthMode.OAUTH_SINGLE_AUDIENCE
-
-    def test_mode_priority_smithery_over_all(self):
-        """Test Smithery mode has highest priority."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",
-            nextcloud_password="password",
-            enable_token_exchange=True,
-            enable_multi_user_basic_auth=True,
-        )
-
-        with patch.dict(os.environ, {"SMITHERY_DEPLOYMENT": "true"}):
-            mode = detect_auth_mode(settings)
-            assert mode == AuthMode.SMITHERY_STATELESS
-
-    def test_mode_priority_token_exchange_over_basic(self):
-        """Test token exchange has priority over BasicAuth."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",
-            nextcloud_password="password",
-            enable_token_exchange=True,
-        )
-
-        mode = detect_auth_mode(settings)
-        assert mode == AuthMode.OAUTH_TOKEN_EXCHANGE
-
-
-class TestSingleUserBasicValidation:
-    """Test validation for single-user BasicAuth mode."""
-
-    def test_valid_minimal_config(self):
-        """Test valid minimal single-user BasicAuth config."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",
-            nextcloud_password="password",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.SINGLE_USER_BASIC
-        assert len(errors) == 0
-
-    def test_valid_with_vector_sync(self):
-        """Test valid config with vector sync enabled."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",
-            nextcloud_password="password",
-            vector_sync_enabled=True,
-            qdrant_location=":memory:",
-            ollama_base_url="http://ollama:11434",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.SINGLE_USER_BASIC
-        assert len(errors) == 0
-
-    def test_missing_required_host(self):
-        """Test error when NEXTCLOUD_HOST is missing."""
-        settings = Settings(
-            nextcloud_username="admin",
-            nextcloud_password="password",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.SINGLE_USER_BASIC
-        assert any("nextcloud_host" in err.lower() for err in errors)
-
-    def test_missing_required_username(self):
-        """Test that partial credentials fall back to OAuth mode."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_password="password",  # Password without username
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        # Mode detection requires BOTH username AND password for single-user BasicAuth
-        # If only one is present, it defaults to OAuth single-audience
-        assert mode == AuthMode.OAUTH_SINGLE_AUDIENCE
-        # In OAuth mode, having a password set is forbidden
-        assert any("nextcloud_password" in err.lower() for err in errors)
-
-    def test_missing_required_password(self):
-        """Test that partial credentials fall back to OAuth mode."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",  # Username without password
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        # Mode detection requires BOTH username AND password for single-user BasicAuth
-        # If only one is present, it defaults to OAuth single-audience
-        assert mode == AuthMode.OAUTH_SINGLE_AUDIENCE
-        # In OAuth mode, having a username set is forbidden
-        assert any("nextcloud_username" in err.lower() for err in errors)
-
-    def test_forbidden_multi_user_basic_auth(self):
-        """Test error when ENABLE_MULTI_USER_BASIC_AUTH is set."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",
-            nextcloud_password="password",
-            enable_multi_user_basic_auth=True,
-        )
-
-        # Note: This will detect as MULTI_USER_BASIC due to priority
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.MULTI_USER_BASIC
-        # It will fail multi-user validation because username/password are forbidden
-        assert len(errors) > 0
-
-    def test_forbidden_token_exchange(self):
-        """Test error when ENABLE_TOKEN_EXCHANGE is set."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",
-            nextcloud_password="password",
-            enable_token_exchange=True,
-        )
-
-        # Note: This will detect as OAUTH_TOKEN_EXCHANGE due to priority
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.OAUTH_TOKEN_EXCHANGE
-        # It will fail OAuth validation
-
-    def test_vector_sync_without_embedding_provider_uses_fallback(self):
-        """Test that vector sync works with Simple provider fallback (no config needed)."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",
-            nextcloud_password="password",
-            vector_sync_enabled=True,
-            qdrant_location=":memory:",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.SINGLE_USER_BASIC
-        # Should pass - Simple provider is always available as fallback
-        assert len(errors) == 0
-
-
-class TestMultiUserBasicValidation:
-    """Test validation for multi-user BasicAuth mode."""
-
-    def test_valid_minimal_config(self):
-        """Test valid minimal multi-user BasicAuth config."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_multi_user_basic_auth=True,
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.MULTI_USER_BASIC
-        assert len(errors) == 0
-
-    def test_valid_with_offline_access(self):
-        """Test valid config with offline access enabled."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_multi_user_basic_auth=True,
-            enable_offline_access=True,
-            oidc_client_id="test-client",
-            oidc_client_secret="test-secret",
-            token_encryption_key="test-key-" + "a" * 32,
-            token_storage_db="/tmp/tokens.db",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.MULTI_USER_BASIC
-        assert len(errors) == 0
-
-    def test_missing_required_host(self):
-        """Test error when NEXTCLOUD_HOST is missing."""
-        settings = Settings(
-            enable_multi_user_basic_auth=True,
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.MULTI_USER_BASIC
-        assert any("nextcloud_host" in err.lower() for err in errors)
-
-    def test_forbidden_username_password(self):
-        """Test error when NEXTCLOUD_USERNAME/PASSWORD are set."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",
-            nextcloud_password="password",
-            enable_multi_user_basic_auth=True,
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        # Multi-user BasicAuth has higher priority than single-user in detection
-        # (explicit flags come before credentials)
-        assert mode == AuthMode.MULTI_USER_BASIC
-        # Should report errors for forbidden username/password
-        assert any("nextcloud_username" in err.lower() for err in errors)
-        assert any("nextcloud_password" in err.lower() for err in errors)
-
-    def test_offline_access_missing_oauth_credentials(self):
-        """Test error when offline access enabled but OAuth credentials missing."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_multi_user_basic_auth=True,
-            enable_offline_access=True,
-            token_encryption_key="test-key-" + "a" * 32,
-            token_storage_db="/tmp/tokens.db",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.MULTI_USER_BASIC
-        assert any("oidc_client_id" in err.lower() for err in errors)
-
-    def test_offline_access_missing_encryption_key(self):
-        """Test error when offline access enabled but encryption key missing."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_multi_user_basic_auth=True,
-            enable_offline_access=True,
-            oidc_client_id="test-client",
-            oidc_client_secret="test-secret",
-            token_storage_db="/tmp/tokens.db",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.MULTI_USER_BASIC
-        assert any("token_encryption_key" in err.lower() for err in errors)
-
-    def test_vector_sync_requires_offline_access(self):
-        """Test error when vector sync enabled but offline access disabled."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_multi_user_basic_auth=True,
-            vector_sync_enabled=True,
-            qdrant_location=":memory:",
-            ollama_base_url="http://ollama:11434",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.MULTI_USER_BASIC
-        assert any("enable_offline_access" in err.lower() for err in errors)
-
-
-class TestOAuthSingleAudienceValidation:
-    """Test validation for OAuth single-audience mode."""
-
-    def test_valid_minimal_config(self):
-        """Test valid minimal OAuth single-audience config."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.OAUTH_SINGLE_AUDIENCE
-        assert len(errors) == 0
-
-    def test_valid_with_static_credentials(self):
-        """Test valid config with static OAuth credentials."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            oidc_client_id="test-client",
-            oidc_client_secret="test-secret",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.OAUTH_SINGLE_AUDIENCE
-        assert len(errors) == 0
-
-    def test_valid_with_offline_access(self):
-        """Test valid config with offline access."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            oidc_client_id="test-client",
-            oidc_client_secret="test-secret",
-            enable_offline_access=True,
-            token_encryption_key="test-key-" + "a" * 32,
-            token_storage_db="/tmp/tokens.db",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.OAUTH_SINGLE_AUDIENCE
-        assert len(errors) == 0
-
-    def test_forbidden_username_password(self):
-        """Test that username/password trigger single-user mode instead."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            nextcloud_username="admin",
-            nextcloud_password="password",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        # This should detect as SINGLE_USER_BASIC
-        assert mode == AuthMode.SINGLE_USER_BASIC
-
-    def test_offline_access_missing_encryption_key(self):
-        """Test error when offline access enabled but encryption key missing."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_offline_access=True,
-            token_storage_db="/tmp/tokens.db",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.OAUTH_SINGLE_AUDIENCE
-        assert any("token_encryption_key" in err.lower() for err in errors)
-
-    def test_vector_sync_requires_offline_access(self):
-        """Test error when vector sync enabled but offline access disabled."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            vector_sync_enabled=True,
-            qdrant_location=":memory:",
-            ollama_base_url="http://ollama:11434",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.OAUTH_SINGLE_AUDIENCE
-        assert any("enable_offline_access" in err.lower() for err in errors)
-
-
-class TestOAuthTokenExchangeValidation:
-    """Test validation for OAuth token exchange mode."""
-
-    def test_valid_minimal_config(self):
-        """Test valid minimal OAuth token exchange config."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_token_exchange=True,
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.OAUTH_TOKEN_EXCHANGE
-        assert len(errors) == 0
-
-    def test_valid_with_credentials(self):
-        """Test valid config with OAuth credentials."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_token_exchange=True,
-            oidc_client_id="test-client",
-            oidc_client_secret="test-secret",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.OAUTH_TOKEN_EXCHANGE
-        assert len(errors) == 0
-
-    def test_forbidden_username_password(self):
-        """Test error when username/password are set."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-            enable_token_exchange=True,
-            nextcloud_username="admin",
-            nextcloud_password="password",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        assert mode == AuthMode.OAUTH_TOKEN_EXCHANGE
-        assert any("nextcloud_username" in err.lower() for err in errors)
-        assert any("nextcloud_password" in err.lower() for err in errors)
-
-
-class TestSmitheryValidation:
-    """Test validation for Smithery stateless mode."""
-
-    def test_valid_empty_config(self):
-        """Test valid empty config for Smithery mode."""
-        settings = Settings()
-
-        with patch.dict(os.environ, {"SMITHERY_DEPLOYMENT": "true"}):
-            mode, errors = validate_configuration(settings)
-
-            assert mode == AuthMode.SMITHERY_STATELESS
-            assert len(errors) == 0
-
-    def test_forbidden_nextcloud_host(self):
-        """Test error when NEXTCLOUD_HOST is set."""
-        settings = Settings(
-            nextcloud_host="http://localhost",
-        )
-
-        with patch.dict(os.environ, {"SMITHERY_DEPLOYMENT": "true"}):
-            mode, errors = validate_configuration(settings)
-
-            assert mode == AuthMode.SMITHERY_STATELESS
-            assert any("nextcloud_host" in err.lower() for err in errors)
-
-    def test_forbidden_credentials(self):
-        """Test error when credentials are set."""
-        settings = Settings(
-            nextcloud_username="admin",
-            nextcloud_password="password",
-        )
-
-        with patch.dict(os.environ, {"SMITHERY_DEPLOYMENT": "true"}):
-            mode, errors = validate_configuration(settings)
-
-            assert mode == AuthMode.SMITHERY_STATELESS
-            assert any("nextcloud_username" in err.lower() for err in errors)
-
-    def test_forbidden_vector_sync(self):
-        """Test error when vector sync is enabled."""
-        settings = Settings(
-            vector_sync_enabled=True,
-        )
-
-        with patch.dict(os.environ, {"SMITHERY_DEPLOYMENT": "true"}):
-            mode, errors = validate_configuration(settings)
-
-            assert mode == AuthMode.SMITHERY_STATELESS
-            assert any("vector_sync_enabled" in err.lower() for err in errors)
-
-
-class TestModeSummary:
-    """Test mode summary generation."""
-
-    def test_single_user_basic_summary(self):
-        """Test summary for single-user BasicAuth mode."""
-        summary = get_mode_summary(AuthMode.SINGLE_USER_BASIC)
-
-        assert "single_user_basic" in summary
-        assert "NEXTCLOUD_HOST" in summary
-        assert "NEXTCLOUD_USERNAME" in summary
-        assert "NEXTCLOUD_PASSWORD" in summary
-        assert "VECTOR_SYNC_ENABLED" in summary
-
-    def test_smithery_summary(self):
-        """Test summary for Smithery mode."""
-        summary = get_mode_summary(AuthMode.SMITHERY_STATELESS)
-
-        assert "smithery" in summary
-        assert "session" in summary.lower()
-        assert "(none" in summary  # No required config
-
-    def test_oauth_token_exchange_summary(self):
-        """Test summary for OAuth token exchange mode."""
-        summary = get_mode_summary(AuthMode.OAUTH_TOKEN_EXCHANGE)
-
-        assert "oauth_exchange" in summary
-        assert "ENABLE_TOKEN_EXCHANGE" in summary
-        assert "RFC 8693" in summary
-
-
-class TestEdgeCases:
-    """Test edge cases and boundary conditions."""
-
-    def test_empty_string_treated_as_missing(self):
-        """Test that empty strings are treated as missing values."""
-        settings = Settings(
-            nextcloud_host="",  # Empty string
-            nextcloud_username="admin",
-            nextcloud_password="password",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        # Should fail because nextcloud_host is effectively missing
-        assert any("nextcloud_host" in err.lower() for err in errors)
-
-    def test_whitespace_treated_as_missing(self):
-        """Test that whitespace-only strings are treated as missing."""
-        settings = Settings(
-            nextcloud_host="   ",  # Whitespace only
-            nextcloud_username="admin",
-            nextcloud_password="password",
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        # Should fail because nextcloud_host is effectively missing
-        assert any("nextcloud_host" in err.lower() for err in errors)
-
-    def test_multiple_errors_reported(self):
-        """Test that multiple errors are all reported."""
-        settings = Settings(
-            # Missing all required fields for single-user BasicAuth
-        )
-
-        mode, errors = validate_configuration(settings)
-
-        # Should have errors for missing host (OAuth mode is default)
-        assert len(errors) > 0

third_party/astrolabe/.github/workflows/lint-php.yml

@@ -30,7 +30,7 @@ jobs:
 
       - name: Get version matrix
         id: versions
-        uses: icewind1991/nextcloud-version-matrix@c2bf575a3516752db5ce2915499d3f694885e2c7 # v1.0.0
+        uses: icewind1991/nextcloud-version-matrix@58becf3b4bb6dc6cef677b15e2fd8e7d48c0908f # v1.0.0
 
   php-lint:
     runs-on: ubuntu-latest

third_party/astrolabe/.github/workflows/npm-audit-fix.yml

@@ -66,7 +66,7 @@ jobs:
 
       - name: Create Pull Request
         if: steps.checkout.outcome == 'success'
-        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           token: ${{ secrets.COMMAND_BOT_PAT }}
           commit-message: 'fix(deps): Fix npm audit'

third_party/astrolabe/.github/workflows/update-nextcloud-ocp-matrix.yml

@@ -85,7 +85,7 @@ jobs:
         continue-on-error: true
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           token: ${{ secrets.COMMAND_BOT_PAT }}
           commit-message: 'chore(dev-deps): Bump nextcloud/ocp package'

third_party/astrolabe/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "astrolabe",
-  "version": "0.4.4",
+  "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "astrolabe",
-      "version": "0.4.4",
+      "version": "1.0.0",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "@nextcloud/axios": "^2.5.1",
@@ -20,12 +20,12 @@
         "vue-material-design-icons": "^5.3.1"
       },
       "devDependencies": {
-        "@nextcloud/browserslist-config": "3.1.2",
+        "@nextcloud/browserslist-config": "^3.0.1",
-        "@nextcloud/eslint-config": "8.4.2",
+        "@nextcloud/eslint-config": "^8.4.2",
-        "@nextcloud/stylelint-config": "3.1.1",
+        "@nextcloud/stylelint-config": "^3.1.0",
-        "@nextcloud/vite-config": "1.7.2",
+        "@nextcloud/vite-config": "^1.5.2",
-        "terser": "5.44.1",
+        "terser": "^5.44.1",
-        "vite": "7.2.7"
+        "vite": "^7.1.3"
       },
       "engines": {
         "node": "^22.0.0",

third_party/astrolabe/package.json

@@ -29,11 +29,11 @@
     "vue-material-design-icons": "^5.3.1"
   },
   "devDependencies": {
-    "@nextcloud/browserslist-config": "3.1.2",
+    "@nextcloud/browserslist-config": "^3.0.1",
-    "@nextcloud/eslint-config": "8.4.2",
+    "@nextcloud/eslint-config": "^8.4.2",
-    "@nextcloud/stylelint-config": "3.1.1",
+    "@nextcloud/stylelint-config": "^3.1.0",
-    "@nextcloud/vite-config": "1.7.2",
+    "@nextcloud/vite-config": "^1.5.2",
-    "terser": "5.44.1",
+    "terser": "^5.44.1",
-    "vite": "7.2.7"
+    "vite": "^7.1.3"
   }
 }

third_party/astrolabe/vendor-bin/openapi-extractor/composer.json

@@ -1,6 +1,6 @@
 {
 	"require-dev": {
-		"nextcloud/openapi-extractor": "v1.8.7"
+		"nextcloud/openapi-extractor": "v1.8.2"
 	},
 	"config": {
 		"platform": {

third_party/astrolabe/vendor-bin/openapi-extractor/composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "384d95db63f1a0aae08a0ae123ecf4bb",
+    "content-hash": "1f40f0a54fa934aa136ec78a01fdc61a",
     "packages": [],
     "packages-dev": [
         {
@@ -82,16 +82,16 @@
         },
         {
             "name": "nextcloud/openapi-extractor",
-            "version": "v1.8.7",
+            "version": "v1.8.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nextcloud-releases/openapi-extractor.git",
-                "reference": "230f61925c362779652b0038a1314ce5f931e853"
+                "reference": "aa4b6750b255460bec8d45406d33606863010d2e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nextcloud-releases/openapi-extractor/zipball/230f61925c362779652b0038a1314ce5f931e853",
+                "url": "https://api.github.com/repos/nextcloud-releases/openapi-extractor/zipball/aa4b6750b255460bec8d45406d33606863010d2e",
-                "reference": "230f61925c362779652b0038a1314ce5f931e853",
+                "reference": "aa4b6750b255460bec8d45406d33606863010d2e",
                 "shasum": ""
             },
             "require": {
@@ -102,9 +102,9 @@
                 "phpstan/phpdoc-parser": "^2.1"
             },
             "require-dev": {
-                "nextcloud/coding-standard": "^1.4.0",
+                "nextcloud/coding-standard": "^1.2",
                 "nextcloud/ocp": "dev-master",
-                "rector/rector": "^2.2.8"
+                "rector/rector": "^2.0"
             },
             "bin": [
                 "bin/generate-spec",
@@ -123,9 +123,9 @@
             "description": "A tool for extracting OpenAPI specifications from Nextcloud source code",
             "support": {
                 "issues": "https://github.com/nextcloud-releases/openapi-extractor/issues",
-                "source": "https://github.com/nextcloud-releases/openapi-extractor/tree/v1.8.7"
+                "source": "https://github.com/nextcloud-releases/openapi-extractor/tree/v1.8.2"
             },
-            "time": "2025-12-02T09:52:06+00:00"
+            "time": "2025-08-26T06:28:24+00:00"
         },
         {
             "name": "nikic/php-parser",
@@ -243,5 +243,5 @@
     "platform-overrides": {
         "php": "8.1"
     },
-    "plugin-api-version": "2.9.0"
+    "plugin-api-version": "2.6.0"
 }