From f4f9f7239516ed5297ad20af6494bc31483e8dd8 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Tue, 21 Jul 2026 12:01:35 +0200
Subject: [PATCH] [Imapsync] Add token status badge for user login flow

---
 data/web/inc/functions.syncjob.inc.php | 11 ++++++++++-
 data/web/js/build/013-mailcow.js       | 14 ++++++++++++++
 data/web/js/site/mailbox.js            |  2 ++
 data/web/js/site/user.js               |  2 ++
 data/web/lang/lang.de-de.json          |  3 +++
 data/web/lang/lang.en-gb.json          |  3 +++
 6 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/data/web/inc/functions.syncjob.inc.php b/data/web/inc/functions.syncjob.inc.php
index 557606723..ef20d29c1 100644
--- a/data/web/inc/functions.syncjob.inc.php
+++ b/data/web/inc/functions.syncjob.inc.php
@@ -1228,7 +1228,13 @@ function syncjob($_action, $_type, $_data = null, $_extra = null) {
             s.`auth_type` AS source_auth_type, s.`created_by` AS source_created_by, s.`scope` AS source_scope,
             s.`oauth_flow` AS source_oauth_flow,
             s.`oauth_token_expires` AS source_oauth_token_expires,
-            s.`oauth_last_refresh_error` AS source_oauth_last_refresh_error";
+            s.`oauth_last_refresh_error` AS source_oauth_last_refresh_error,
+            t.`token_expires` AS user_token_expires,
+            t.`last_refresh_error` AS user_token_error,
+            CASE WHEN t.`username` IS NULL THEN 0 ELSE 1 END AS user_token_exists";
+          // Per-user token status for authorization_code sources (never leaks the token itself)
+          $token_join = "LEFT JOIN `imapsync_source_oauth_token` t
+            ON t.`source_id` = i.`source_id` AND t.`username` = i.`user1`";
           if (isset($_extra) && in_array('no_log', $_extra)) {
             $field_query = $pdo->query('SHOW FIELDS FROM `imapsync` WHERE FIELD NOT IN ("returned_text", "password1")');
             $fields = $field_query->fetchAll(PDO::FETCH_ASSOC);
@@ -1237,11 +1243,13 @@ function syncjob($_action, $_type, $_data = null, $_extra = null) {
             }
             $stmt = $pdo->prepare("SELECT " . implode(',', (array)$shown_fields) . ", $source_select
                 FROM `imapsync` i LEFT JOIN `imapsync_source` s ON i.`source_id` = s.`id`
+                $token_join
                 WHERE i.`id` = :id");
           }
           elseif (isset($_extra) && in_array('with_password', $_extra)) {
             $stmt = $pdo->prepare("SELECT i.*, $source_select
                 FROM `imapsync` i LEFT JOIN `imapsync_source` s ON i.`source_id` = s.`id`
+                $token_join
                 WHERE i.`id` = :id");
           }
           else {
@@ -1252,6 +1260,7 @@ function syncjob($_action, $_type, $_data = null, $_extra = null) {
             }
             $stmt = $pdo->prepare("SELECT " . implode(',', (array)$shown_fields) . ", $source_select
                 FROM `imapsync` i LEFT JOIN `imapsync_source` s ON i.`source_id` = s.`id`
+                $token_join
                 WHERE i.`id` = :id");
           }
           $stmt->execute(array(':id' => $_data));
diff --git a/data/web/js/build/013-mailcow.js b/data/web/js/build/013-mailcow.js
index ac8b5258f..01baa547b 100644
--- a/data/web/js/build/013-mailcow.js
+++ b/data/web/js/build/013-mailcow.js
@@ -454,6 +454,20 @@ function imapsyncAuthDisplay(item) {
   return out;
 }
 
+// Per-syncjob OAuth token badge for authorization_code sources: the token is issued
+// per user (via "connect"), so a job can be pending / issued / failed. Returns '' for
+// non-XOAUTH2 or client_credentials jobs (those have no per-user token).
+function imapsyncJobTokenBadge(item) {
+  if (item.source_auth_type !== 'XOAUTH2' || item.source_oauth_flow !== 'authorization_code') return '';
+  if (item.user_token_error) {
+    return '<span class="badge bg-danger" title="' + escapeHtml(item.user_token_error) + '">' + lang.syncjobs.token_state_failed + '</span>';
+  }
+  if (item.user_token_expires && item.user_token_expires * 1000 > Date.now()) {
+    return '<span class="badge bg-success" title="' + lang.syncjobs.source_token_status + ': ' + new Date(item.user_token_expires * 1000).toLocaleString() + '">' + lang.syncjobs.token_state_issued + '</span>';
+  }
+  return '<span class="badge bg-warning">' + lang.syncjobs.token_state_pending + '</span>';
+}
+
 // (Re)build every imapsync-source dropdown from the ACL-filtered API (fresh on modal open)
 function populateImapsyncSourceSelects() {
   $.get("/api/v1/get/syncjob_source/all", function(sources) {
diff --git a/data/web/js/site/mailbox.js b/data/web/js/site/mailbox.js
index ccfa4a7fc..f03d19337 100644
--- a/data/web/js/site/mailbox.js
+++ b/data/web/js/site/mailbox.js
@@ -2174,6 +2174,8 @@ jQuery(function($){
               item.exclude  = '<code>' + escapeHtml(item.exclude) + '</code>';
             }
             item.server_w_port = escapeHtml(item.user1) + '@' + escapeHtml(item.source_name || '?') + ' (' + escapeHtml(item.source_host || '?') + ':' + escapeHtml(item.source_port || '?') + ')';
+            var tokenBadge = imapsyncJobTokenBadge(item);
+            if (tokenBadge) item.server_w_port += '<div class="mt-1">' + tokenBadge + '</div>';
             item.action = '<div class="btn-group">' +
               '<a href="/edit/syncjob/' + item.id + '" class="btn btn-sm btn-xs-lg btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
               '<a href="#" data-action="delete_selected" data-id="single-syncjob" data-api-url="delete/syncjob" data-item="' + item.id + '" class="btn btn-sm btn-xs-lg btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
diff --git a/data/web/js/site/user.js b/data/web/js/site/user.js
index ceee0a377..7bd6e3151 100644
--- a/data/web/js/site/user.js
+++ b/data/web/js/site/user.js
@@ -286,6 +286,8 @@ jQuery(function($){
               item.exclude  = '<code>' + escapeHtml(item.exclude) + '</code>';
             }
             item.server_w_port = escapeHtml(item.user1 + '@' + (item.source_name || '?') + ' (' + (item.source_host || '?') + ':' + (item.source_port || '?') + ')');
+            var tokenBadge = imapsyncJobTokenBadge(item);
+            if (tokenBadge) item.server_w_port += '<div class="mt-1">' + tokenBadge + '</div>';
             if (acl_data.syncjobs === 1) {
               item.action = '<div class="btn-group">' +
                 '<a href="/edit/syncjob/' + item.id + '" class="btn btn-xs btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
diff --git a/data/web/lang/lang.de-de.json b/data/web/lang/lang.de-de.json
index 1956de59e..36fd2ba61 100644
--- a/data/web/lang/lang.de-de.json
+++ b/data/web/lang/lang.de-de.json
@@ -1258,6 +1258,9 @@
         "source_oauth_flow_user": "Benutzer-Login (Authorization Code)",
         "source_flow_badge_app": "Client Credentials",
         "source_flow_badge_user": "Benutzer-Login",
+        "token_state_issued": "Token ausgestellt",
+        "token_state_pending": "Token wird ausgestellt",
+        "token_state_failed": "Token fehlgeschlagen",
         "source_authorize_endpoint": "Authorize-Endpoint",
         "source_userinfo_endpoint": "Userinfo-Endpoint",
         "source_redirect_uri": "Redirect-URI",
diff --git a/data/web/lang/lang.en-gb.json b/data/web/lang/lang.en-gb.json
index c1822c39e..503462d38 100644
--- a/data/web/lang/lang.en-gb.json
+++ b/data/web/lang/lang.en-gb.json
@@ -1265,6 +1265,9 @@
         "source_oauth_flow_user": "User login (authorization code)",
         "source_flow_badge_app": "Client credentials",
         "source_flow_badge_user": "User login",
+        "token_state_issued": "Token issued",
+        "token_state_pending": "Token pending",
+        "token_state_failed": "Token failed",
         "source_authorize_endpoint": "Authorize endpoint",
         "source_userinfo_endpoint": "Userinfo endpoint",
         "source_redirect_uri": "Redirect URI",