oleksandr-nc · Oct 22, 2026 · Oct 21, 2026
diff --git a/lib/AppInfo/Application.php b/lib/AppInfo/Application.php
@@ -12,6 +12,7 @@
 use OCP\AppFramework\Bootstrap\IBootContext;
 use OCP\AppFramework\Bootstrap\IBootstrap;
 use OCP\AppFramework\Bootstrap\IRegistrationContext;
+use OCP\AppFramework\Services\IAppConfig;
 use OCP\AppFramework\Services\IInitialState;
 use OCP\IConfig;
 use OCP\Security\CSP\AddContentSecurityPolicyEvent;
@@ -43,16 +44,17 @@ public function register(IRegistrationContext $context): void {
 	public function boot(IBootContext $context): void {
 		$context->injectFn(function (
 			IInitialState $initialState,
+			IAppConfig $appConfig,
 			IConfig $config,
 			?string $userId,
 		) {
-			$adminBaseUrl = $config->getAppValue(Application::APP_ID, 'base_url', Application::DEFAULT_BASE_URL) ?: Application::DEFAULT_BASE_URL;
+			$adminBaseUrl = $appConfig->getAppValueString('base_url', Application::DEFAULT_BASE_URL) ?: Application::DEFAULT_BASE_URL;
 			if ($userId === null) {
 				$baseUrl = $adminBaseUrl;
 			} else {
 				$baseUrl = $config->getUserValue($userId, Application::APP_ID, 'base_url', $adminBaseUrl) ?: $adminBaseUrl;
 			}
-			$overrideClick = $config->getAppValue(Application::APP_ID, 'override_link_click', '0') === '1';
+			$overrideClick = $appConfig->getAppValueString('override_link_click', '0') === '1';
 
 			$initialState->provideInitialState('base_url', $baseUrl);
 			// TODO add setting to set this value

diff --git a/lib/Controller/ConfigController.php b/lib/Controller/ConfigController.php
@@ -13,6 +13,7 @@
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataResponse;
+use OCP\AppFramework\Services\IAppConfig;
 use OCP\IConfig;
 use OCP\IRequest;
 use OCP\Security\ICrypto;
@@ -22,6 +23,7 @@ class ConfigController extends Controller {
 	public function __construct(
 		string $appName,
 		IRequest $request,
+		private IAppConfig $appConfig,
 		private IConfig $config,
 		private NuiteqAPIService $nuiteqAPIService,
 		private ICrypto $crypto,
@@ -63,6 +65,17 @@ public function setConfig(array $values): DataResponse {
 	 */
 	#[PasswordConfirmationRequired]
 	public function setAdminConfig(array $values): DataResponse {
+		// only what the admin settings send: a typed write of any other key
+		// would change the type of rows Nextcloud owns, installed_version or
+		// enabled, and the next upgrade or enable fails on the conflict
+		foreach ($values as $key => $value) {
+			if (!in_array($key, ['base_url', 'client_key'], true)) {
+				return new DataResponse(['error' => 'Unknown admin setting ' . $key], Http::STATUS_BAD_REQUEST);
+			}
+			if (!is_string($value)) {
+				return new DataResponse(['error' => 'The admin setting ' . $key . ' must be a string'], Http::STATUS_BAD_REQUEST);
+			}
+		}
 		foreach ($values as $key => $value) {
 			if (in_array($key, ['client_key']) && $value !== '') {
 				if ($value === 'dummySecret') {
@@ -71,7 +84,9 @@ public function setAdminConfig(array $values): DataResponse {
 				}
 				$value = $this->crypto->encrypt($value);
 			}
-			$this->config->setAppValue(Application::APP_ID, $key, $value);
+			// the client key is read only by this app's own settings and requests,
+			// base_url on every page
+			$this->appConfig->setAppValueString($key, $value, lazy: $key === 'client_key');
 		}
 		return new DataResponse('');
 	}

diff --git a/lib/Listener/AddContentSecurityPolicyListener.php b/lib/Listener/AddContentSecurityPolicyListener.php
@@ -9,6 +9,7 @@
 
 use OCA\Nuiteq\AppInfo\Application;
 use OCP\AppFramework\Http\ContentSecurityPolicy;
+use OCP\AppFramework\Services\IAppConfig;
 use OCP\EventDispatcher\Event;
 use OCP\EventDispatcher\IEventListener;
 use OCP\IConfig;
@@ -28,8 +29,11 @@ class AddContentSecurityPolicyListener implements IEventListener {
 	 */
 	private $userId;
 
-	public function __construct(IConfig $config,
-		?string $userId) {
+	public function __construct(
+		IConfig $config,
+		private IAppConfig $appConfig,
+		?string $userId,
+	) {
 		$this->config = $config;
 		$this->userId = $userId;
 	}
@@ -39,7 +43,7 @@ public function handle(Event $event): void {
 			return;
 		}
 
-		$adminBaseUrl = $this->config->getAppValue(Application::APP_ID, 'base_url', Application::DEFAULT_BASE_URL) ?: Application::DEFAULT_BASE_URL;
+		$adminBaseUrl = $this->appConfig->getAppValueString('base_url', Application::DEFAULT_BASE_URL) ?: Application::DEFAULT_BASE_URL;
 		if ($this->userId === null) {
 			$baseUrl = $adminBaseUrl;
 		} else {

diff --git a/lib/Migration/Version1200Date202410151354.php b/lib/Migration/Version1200Date202410151354.php
@@ -13,7 +13,7 @@
 use OCA\Nuiteq\AppInfo\Application;
 use OCP\DB\ISchemaWrapper;
 use OCP\DB\QueryBuilder\IQueryBuilder;
-use OCP\IConfig;
+use OCP\IAppConfig;
 use OCP\IDBConnection;
 use OCP\Migration\IOutput;
 use OCP\Migration\SimpleMigrationStep;
@@ -24,7 +24,7 @@ class Version1200Date202410151354 extends SimpleMigrationStep {
 	public function __construct(
 		private IDBConnection $connection,
 		private ICrypto $crypto,
-		private IConfig $config,
+		private IAppConfig $appConfig,
 	) {
 	}
 
@@ -37,10 +37,10 @@ public function __construct(
 	 */
 	public function postSchemaChange(IOutput $output, Closure $schemaClosure, array $options) {
 		// encrypt "client_key" in the appconfig
-		$clientSecret = $this->config->getAppValue(Application::APP_ID, 'client_key');
+		$clientSecret = $this->appConfig->getValueString(Application::APP_ID, 'client_key', lazy: true);
 		if ($clientSecret !== '') {
 			$clientSecret = $this->crypto->encrypt($clientSecret);
-			$this->config->setAppValue(Application::APP_ID, 'client_key', $clientSecret);
+			$this->appConfig->setValueString(Application::APP_ID, 'client_key', $clientSecret, lazy: true);
 		}
 
 		// encrypt user's "client_key"

diff --git a/lib/Migration/Version1301Date202610211026.php b/lib/Migration/Version1301Date202610211026.php
@@ -0,0 +1,41 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+namespace OCA\Nuiteq\Migration;
+
+use Closure;
+use OCA\Nuiteq\AppInfo\Application;
+use OCP\DB\ISchemaWrapper;
+use OCP\IAppConfig;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+class Version1301Date202610211026 extends SimpleMigrationStep {
+
+	public function __construct(
+		private IAppConfig $appConfig,
+	) {
+	}
+
+	/**
+	 * @param IOutput $output
+	 * @param Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
+	 * @param array $options
+	 *
+	 * @return null|ISchemaWrapper
+	 */
+	public function postSchemaChange(IOutput $output, Closure $schemaClosure, array $options) {
+		// the admin client key is read only by this app's own settings and
+		// requests; base_url and override_link_click are read on every page
+		// and stay non-lazy
+		$this->appConfig->updateLazy(Application::APP_ID, 'client_key', true);
+
+		return null;
+	}
+}
diff --git a/lib/Service/NuiteqAPIService.php b/lib/Service/NuiteqAPIService.php
@@ -11,6 +11,7 @@
 use GuzzleHttp\Exception\ClientException;
 use GuzzleHttp\Exception\ServerException;
 use OCA\Nuiteq\AppInfo\Application;
+use OCP\AppFramework\Services\IAppConfig;
 use OCP\Http\Client\IClientService;
 use OCP\IConfig;
 use OCP\IL10N;
@@ -29,6 +30,7 @@ public function __construct(
 		private string $appName,
 		private LoggerInterface $logger,
 		private IL10N $l10n,
+		private IAppConfig $appConfig,
 		private IConfig $config,
 		private ICrypto $crypto,
 		IClientService $clientService,
@@ -41,7 +43,7 @@ public function __construct(
 	 * @return string
 	 */
 	private function getClientKey(string $userId): string {
-		$adminClientKey = $this->config->getAppValue(Application::APP_ID, 'client_key', Application::DEFAULT_CLIENT_KEY) ?: Application::DEFAULT_CLIENT_KEY;
+		$adminClientKey = $this->appConfig->getAppValueString('client_key', Application::DEFAULT_CLIENT_KEY, lazy: true) ?: Application::DEFAULT_CLIENT_KEY;
 		$clientKey = $this->config->getUserValue($userId, Application::APP_ID, 'client_key', $adminClientKey) ?: $adminClientKey;
 
 		// Decrypt the clientKey if it's encrypted
@@ -73,7 +75,7 @@ private function getClientKey(string $userId): string {
 	 * @return string
 	 */
 	public function getBaseUrl(string $userId): string {
-		$adminBaseUrl = $this->config->getAppValue(Application::APP_ID, 'base_url', Application::DEFAULT_BASE_URL) ?: Application::DEFAULT_BASE_URL;
+		$adminBaseUrl = $this->appConfig->getAppValueString('base_url', Application::DEFAULT_BASE_URL) ?: Application::DEFAULT_BASE_URL;
 		return $this->config->getUserValue($userId, Application::APP_ID, 'base_url', $adminBaseUrl) ?: $adminBaseUrl;
 	}
 

diff --git a/lib/Settings/Admin.php b/lib/Settings/Admin.php
@@ -9,14 +9,14 @@
 
 use OCA\Nuiteq\AppInfo\Application;
 use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IAppConfig;
 use OCP\AppFramework\Services\IInitialState;
-use OCP\IConfig;
 use OCP\Settings\ISettings;
 
 class Admin implements ISettings {
 
 	public function __construct(
-		private IConfig $config,
+		private IAppConfig $appConfig,
 		private IInitialState $initialStateService,
 	) {
 	}
@@ -25,8 +25,8 @@ public function __construct(
 	 * @return TemplateResponse
 	 */
 	public function getForm(): TemplateResponse {
-		$baseUrl = $this->config->getAppValue(Application::APP_ID, 'base_url', 'https://nuiteqstage.se');
-		$clientKey = $this->config->getAppValue(Application::APP_ID, 'client_key');
+		$baseUrl = $this->appConfig->getAppValueString('base_url', 'https://nuiteqstage.se');
+		$clientKey = $this->appConfig->getAppValueString('client_key', lazy: true);
 
 		$adminConfig = [
 			'base_url' => $baseUrl,

diff --git a/lib/Settings/Personal.php b/lib/Settings/Personal.php
@@ -10,6 +10,7 @@
 use Exception;
 use OCA\Nuiteq\AppInfo\Application;
 use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IAppConfig;
 use OCP\AppFramework\Services\IInitialState;
 use OCP\IConfig;
 use OCP\Security\ICrypto;
@@ -20,6 +21,7 @@
 class Personal implements ISettings {
 
 	public function __construct(
+		private IAppConfig $appConfig,
 		private IConfig $config,
 		private IInitialState $initialStateService,
 		private ICrypto $crypto,
@@ -32,7 +34,7 @@ public function __construct(
 	 * @return TemplateResponse
 	 */
 	public function getForm(): TemplateResponse {
-		$adminBaseUrl = $this->config->getAppValue(Application::APP_ID, 'base_url', 'https://nuiteqstage.se') ?: 'https://nuiteqstage.se';
+		$adminBaseUrl = $this->appConfig->getAppValueString('base_url', 'https://nuiteqstage.se') ?: 'https://nuiteqstage.se';
 		$baseUrl = $this->config->getUserValue($this->userId, Application::APP_ID, 'base_url', $adminBaseUrl) ?: $adminBaseUrl;
 
 		$apiKey = $this->config->getUserValue($this->userId, Application::APP_ID, 'api_key');