From a9fe0bf59830ed623b275ef3ad4d09c87e27e710 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Fri, 25 Sep 2026 11:12:45 -0400
Subject: [PATCH 01/18] fix(encryption): clarify home storage encryption
 setting

- Replace the "main storage" wording with "home storage."
- Clarify that this setting does not control separately mounted external storage or trigger bulk encryption or decryption of existing files.

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/src/components/SettingsAdminHomeStorage.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/encryption/src/components/SettingsAdminHomeStorage.vue b/apps/encryption/src/components/SettingsAdminHomeStorage.vue
index 3c2a9a9ceb58d..35e2512d12942 100644
--- a/apps/encryption/src/components/SettingsAdminHomeStorage.vue
+++ b/apps/encryption/src/components/SettingsAdminHomeStorage.vue
@@ -39,7 +39,7 @@ watchDebounced(encryptHomeStorage, async (encryptHomeStorage, oldValue) => {
 	<NcCheckboxRadioSwitch
 		v-model="encryptHomeStorage"
 		:loading="isSavingHomeStorageEncryption"
-		:description="t('encryption', 'Enabling this option encrypts all files stored on the main storage, otherwise only files on external storage will be encrypted')"
+		:description="t('encryption', 'Controls whether server-side encryption applies to files within the home storage of accounts. Modifying this setting does not control separately mounted external storage, and does not trigger bulk encryption or decryption of existing files.')"
 		type="switch">
 		{{ t('encryption', 'Encrypt the home storage') }}
 	</NcCheckboxRadioSwitch>

From 5cdfdb694dd109a14d7e0f7c9c8d1f227170b792 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Fri, 25 Sep 2026 11:43:30 -0400
Subject: [PATCH 02/18] fix(encryption): clarify admin recovery key description

Clarify that enabling the administrator recovery key makes it available for account recovery, and that each account must opt in separately. And change control labels for accuracy.

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/src/components/SettingsAdminRecoveryKey.vue | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/encryption/src/components/SettingsAdminRecoveryKey.vue b/apps/encryption/src/components/SettingsAdminRecoveryKey.vue
index 2268cff59e8ee..163f564f636ca 100644
--- a/apps/encryption/src/components/SettingsAdminRecoveryKey.vue
+++ b/apps/encryption/src/components/SettingsAdminRecoveryKey.vue
@@ -66,8 +66,8 @@ async function onSubmit() {
 <template>
 	<form ref="form" @submit.prevent="onSubmit">
 		<NcFormGroup
-			:label="recoveryEnabled ? t('encryption', 'Disable recovery key') : t('encryption', 'Enable recovery key')"
-			:description="t('encryption', 'The recovery key is an additional encryption key used to encrypt files. It is used to recover files from an account if the password is forgotten.')">
+			:label="recoveryEnabled ? t('encryption', 'Disable administrator recovery key') : t('encryption', 'Enable administrator recovery key')"
+			:description="t('encryption', 'Controls whether the administrator recovery key is available to help restore access to encrypted files if an account login password is lost. Each account must also opt in to recovery separately in its personal settings.')">
 			<NcPasswordField
 				v-model="password"
 				required
@@ -82,7 +82,7 @@ async function onSubmit() {
 				:label="t('encryption', 'Repeat recovery key password')" />
 
 			<NcButton type="submit" :variant="recoveryEnabled ? 'error' : 'primary'">
-				{{ recoveryEnabled ? t('encryption', 'Disable recovery key') : t('encryption', 'Enable recovery key') }}
+				{{ recoveryEnabled ? t('encryption', 'Disable administrator recovery key') : t('encryption', 'Enable administrator recovery key') }}
 			</NcButton>
 
 			<NcNoteCard v-if="hasError" type="error">

From 8e05dba4db72be7d60b0d162ddd52be59124b2d8 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Fri, 25 Sep 2026 12:06:35 -0400
Subject: [PATCH 03/18] fix(encryption): clarify personal recovery setting

Clarify that opting in is required, that this option allows the admin to use the recovery key to restore access to encrypted files if the account login password is lost, and that it does not recovery the account's password.

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 .../src/components/SettingsPersonalEnableRecovery.vue         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/encryption/src/components/SettingsPersonalEnableRecovery.vue b/apps/encryption/src/components/SettingsPersonalEnableRecovery.vue
index b3aacd4fece1e..312e72c79691e 100644
--- a/apps/encryption/src/components/SettingsPersonalEnableRecovery.vue
+++ b/apps/encryption/src/components/SettingsPersonalEnableRecovery.vue
@@ -48,7 +48,7 @@ watchDebounced([userEnableRecovery], async ([newValue], [oldValue]) => {
 		v-model="userEnableRecovery"
 		type="switch"
 		:loading="isLoading"
-		:description="t('encryption', 'Enabling this option will allow you to reobtain access to your encrypted files in case of password loss')">
-		{{ t('encryption', 'Enable password recovery') }}
+		:description="t('encryption', 'Controls whether the administrator can use the recovery key to restore access to your encrypted files if you lose your login password.')">
+		{{ t('encryption', 'Allow recovery of my encrypted files') }}
 	</NcCheckboxRadioSwitch>
 </template>

From bd629875eb11270a37d3e7beef6a52f4f80d2b0f Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 18:28:48 -0400
Subject: [PATCH 04/18] fix(encryption): clarify key initialization warning

Explain that signing in with the account password initializes the encryption key for the session. Use concise, specific wording that is clear to users and easier to translate.

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/src/views/SettingsAdmin.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/encryption/src/views/SettingsAdmin.vue b/apps/encryption/src/views/SettingsAdmin.vue
index 4fb4aa40f58ff..f346d23e952cb 100644
--- a/apps/encryption/src/views/SettingsAdmin.vue
+++ b/apps/encryption/src/views/SettingsAdmin.vue
@@ -27,7 +27,7 @@ const recoveryEnabled = ref(adminSettings.recoveryEnabled!)
 <template>
 	<NcSettingsSection :name="t('encryption', 'Default encryption module')">
 		<NcNoteCard v-if="adminSettings.initStatus === InitStatus.NotInitialized && !adminSettings.masterKeyEnabled" type="warning">
-			{{ t('encryption', 'Encryption app is enabled but your keys are not initialized, please log-out and log-in again') }}
+			{{ t('encryption', 'Your encryption keys are not initialized for this session. Please sign out and sign back in.') }}
 		</NcNoteCard>
 
 		<template v-else>

From d5dd5457a69286ad3fa0132a897dcacb1d8a58da Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 18:41:50 -0400
Subject: [PATCH 05/18] fix(encryption): clarify personal settings with admin
 wording

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/src/views/SettingsPersonal.vue | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/encryption/src/views/SettingsPersonal.vue b/apps/encryption/src/views/SettingsPersonal.vue
index e3d35db929fb5..edda69e852c0b 100644
--- a/apps/encryption/src/views/SettingsPersonal.vue
+++ b/apps/encryption/src/views/SettingsPersonal.vue
@@ -44,9 +44,9 @@ async function reloadStatus() {
 </script>
 
 <template>
-	<NcSettingsSection :name="t('encryption', 'Basic encryption module')">
+	<NcSettingsSection :name="t('encryption', 'Default encryption module')">
 		<NcNoteCard v-if="initialized === InitStatus.NotInitialized" type="warning">
-			{{ t('encryption', 'Encryption app is enabled but your keys are not initialized, please log-out and log-in again') }}
+			{{ t('encryption', 'Your encryption keys are not initialized for this session. Please sign out and sign back in.') }}
 		</NcNoteCard>
 
 		<SettingsPersonalChangePrivateKey

From 9826a3ea04f6c0c89ba9ba9e4df1af23b1d6d42c Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 19:00:14 -0400
Subject: [PATCH 06/18] fix(encryption): clarify status messages

Make encryption status messages clearer and provide guidance specific to each state, including when encryption is disabled, keys need session
initialization, or a private key cannot be unlocked.

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/lib/Controller/StatusController.php | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/apps/encryption/lib/Controller/StatusController.php b/apps/encryption/lib/Controller/StatusController.php
index b221dc4b0a7ab..b6b997d4714cb 100644
--- a/apps/encryption/lib/Controller/StatusController.php
+++ b/apps/encryption/lib/Controller/StatusController.php
@@ -41,29 +41,30 @@ public function __construct(
 	#[NoAdminRequired]
 	public function getStatus() {
 		$status = 'error';
-		$message = 'no valid init status';
+		$message = $this->l->t('Encryption status could not be determined.');
+
 		switch ($this->session->getStatus()) {
 			case Session::INIT_EXECUTED:
 				$status = 'interactionNeeded';
 				$message = $this->l->t(
-					'Invalid private key for encryption app. Please update your private key password in your personal settings to recover access to your encrypted files.'
+					'Your encryption key could not be unlocked. If your login password has changed, update your private key password in Personal settings to restore access to your encrypted files.'
 				);
 				break;
 			case Session::NOT_INITIALIZED:
 				$status = 'interactionNeeded';
-				if ($this->encryptionManager->isEnabled()) {
+				if (!$this->encryptionManager->isEnabled()) {
 					$message = $this->l->t(
-						'Encryption App is enabled, but your keys are not initialized. Please log-out and log-in again.'
+						'Server-side encryption is not enabled. Please ask your administrator to enable it in the admin settings.'
 					);
 				} else {
 					$message = $this->l->t(
-						'Please enable server side encryption in the admin settings in order to use the encryption module.'
+						'Your encryption keys are not initialized for this session. Please sign out and sign back in.'
 					);
 				}
 				break;
 			case Session::INIT_SUCCESSFUL:
 				$status = 'success';
-				$message = $this->l->t('Encryption app is enabled and ready');
+				$message = $this->l->t('Encryption is enabled and ready.');
 		}
 
 		return new DataResponse(

From dde18b9f944fe700fd876cb68a406dca075ca71a Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 19:12:17 -0400
Subject: [PATCH 07/18] test(encryption): cover admin settings state variations

Verify that the admin settings page passes disabled encryption options and a non-default initialization status through to its initial state.

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/tests/Settings/AdminTest.php | 27 ++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/apps/encryption/tests/Settings/AdminTest.php b/apps/encryption/tests/Settings/AdminTest.php
index 1591b8d95c71f..cd0057b531ad9 100644
--- a/apps/encryption/tests/Settings/AdminTest.php
+++ b/apps/encryption/tests/Settings/AdminTest.php
@@ -85,6 +85,33 @@ public function testGetForm(): void {
 		$this->assertEquals($expected, $this->admin->getForm());
 	}
 
+	public function testGetFormPassesDisabledSettingsAndInitializationStatus(): void {
+		$this->appConfig
+			->method('getValueBool')
+			->willReturnMap([
+				['encryption', 'recoveryAdminEnabled', false],
+				['encryption', 'encryptHomeStorage', true, false],
+				['encryption', 'useMasterKey', true, false],
+			]);
+
+		$this->session
+			->method('get')
+			->with('encryptionInitialized')
+			->willReturn('2');
+
+		$this->initialState
+			->expects(self::once())
+			->method('provideInitialState')
+			->with('adminSettings', [
+				'recoveryEnabled' => false,
+				'initStatus' => '2',
+				'encryptHomeStorage' => false,
+				'masterKeyEnabled' => false,
+			]);
+
+		$this->admin->getForm();
+	}
+
 	public function testGetSection(): void {
 		$this->assertSame('security', $this->admin->getSection());
 	}

From 6ae86c3d21c2fca3ce2ebf0bd27d623161dd7368 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 19:48:51 -0400
Subject: [PATCH 08/18] fix(encryption): clarify private key password recovery
 guidance

Explain how to use the previous and current login passwords to unlock and update the private encryption key.

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 .../src/components/SettingsPersonalChangePrivateKey.vue     | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/encryption/src/components/SettingsPersonalChangePrivateKey.vue b/apps/encryption/src/components/SettingsPersonalChangePrivateKey.vue
index c5c5270d678dc..9a8548c186c8d 100644
--- a/apps/encryption/src/components/SettingsPersonalChangePrivateKey.vue
+++ b/apps/encryption/src/components/SettingsPersonalChangePrivateKey.vue
@@ -62,7 +62,7 @@ async function onSubmit() {
 	<form ref="form" @submit.prevent="onSubmit">
 		<NcFormGroup
 			:label="t('encryption', 'Update private key password')"
-			:description="t('encryption', 'Your private key password no longer matches your log-in password. Set your old private key password to your current log-in password.')">
+			:description="t('encryption', 'Your private encryption key could not be unlocked. If your login password has changed, try entering your previous login password to unlock your key, then your current password to update your key and restore access.')">
 			<NcNoteCard v-if="recoveryEnabledForUser">
 				{{ t('encryption', 'If you do not remember your old password you can ask your administrator to recover your files.') }}
 			</NcNoteCard>
@@ -71,12 +71,12 @@ async function onSubmit() {
 				v-model="oldPrivateKeyPassword"
 				required
 				name="oldPassword"
-				:label="t('encryption', 'Old log-in password')" />
+				:label="t('encryption', 'Previous login password')" />
 			<NcPasswordField
 				v-model="newPrivateKeyPassword"
 				required
 				name="newPassword"
-				:label="t('encryption', 'Current log-in password')" />
+				:label="t('encryption', 'Current login password')" />
 
 			<NcButton
 				type="submit"

From 26f0c2df50d7a6a1773e488276df5c40d59a2f76 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 19:59:07 -0400
Subject: [PATCH 09/18] fix(encryption): pass encryption status in admin
 initial state

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/lib/Settings/Admin.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/apps/encryption/lib/Settings/Admin.php b/apps/encryption/lib/Settings/Admin.php
index 045dfa7c69876..d4ef63df0fb31 100644
--- a/apps/encryption/lib/Settings/Admin.php
+++ b/apps/encryption/lib/Settings/Admin.php
@@ -37,6 +37,7 @@ public function __construct(
 		private IInitialState $initialState,
 		private IAppConfig $appConfig,
 		private IUserConfig $userConfig,
+		private IManager $encryptionManager,
 	) {
 	}
 
@@ -70,6 +71,7 @@ public function getForm() {
 			'initStatus' => $session->getStatus(),
 			'encryptHomeStorage' => $encryptHomeStorage,
 			'masterKeyEnabled' => $util->isMasterKeyEnabled(),
+			'serverSideEncryptionEnabled' => $this->encryptionManager->isEnabled(),
 		]);
 
 		\OCP\Util::addStyle(Application::APP_ID, 'settings_admin');

From 68cda9dc1a1e60e4250ba4528eaaa330b76c3a34 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 20:01:57 -0400
Subject: [PATCH 10/18] fix(encryption): distinguish disabled encryption from
 uninitialized keys

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/src/views/SettingsAdmin.vue | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/encryption/src/views/SettingsAdmin.vue b/apps/encryption/src/views/SettingsAdmin.vue
index f346d23e952cb..af71a95b6d291 100644
--- a/apps/encryption/src/views/SettingsAdmin.vue
+++ b/apps/encryption/src/views/SettingsAdmin.vue
@@ -27,7 +27,9 @@ const recoveryEnabled = ref(adminSettings.recoveryEnabled!)
 <template>
 	<NcSettingsSection :name="t('encryption', 'Default encryption module')">
 		<NcNoteCard v-if="adminSettings.initStatus === InitStatus.NotInitialized && !adminSettings.masterKeyEnabled" type="warning">
-			{{ t('encryption', 'Your encryption keys are not initialized for this session. Please sign out and sign back in.') }}
+			{{ adminSettings.serverSideEncryptionEnabled
+				? t('encryption', 'Your encryption keys are not initialized for this session. Please sign out and sign back in.')
+				: t('encryption', 'Server-side encryption is disabled. Enable it in the admin settings to use the encryption module.') }}
 		</NcNoteCard>
 
 		<template v-else>

From f3f41c923f3433d99cfd730efaa8c2a7f4675179 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 20:13:35 -0400
Subject: [PATCH 11/18] fix(encryption): make INIT_EXECUTED message depend on
 master-key mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In per-user-key mode, direct users to the personal settings recovery flow; in master-key mode, avoid suggesting they change their personal key password and direct them to their administrator instead (since in master-key mode, initialization uses the system master key rather than the user’s private-key password).

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/lib/Controller/StatusController.php | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/apps/encryption/lib/Controller/StatusController.php b/apps/encryption/lib/Controller/StatusController.php
index b6b997d4714cb..09d30474baf66 100644
--- a/apps/encryption/lib/Controller/StatusController.php
+++ b/apps/encryption/lib/Controller/StatusController.php
@@ -13,6 +13,7 @@
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\Encryption\IManager;
+use OCP\IAppConfig;
 use OCP\IL10N;
 use OCP\IRequest;
 
@@ -46,9 +47,15 @@ public function getStatus() {
 		switch ($this->session->getStatus()) {
 			case Session::INIT_EXECUTED:
 				$status = 'interactionNeeded';
-				$message = $this->l->t(
-					'Your encryption key could not be unlocked. If your login password has changed, update your private key password in Personal settings to restore access to your encrypted files.'
-				);
+				if ($this->appConfig->getValueBool('encryption', 'useMasterKey', true)) {
+					$message = $this->l->t(
+						'Server-side encryption could not be initialized. Please contact your administrator for guidance.'
+					);
+				} else {
+					$message = $this->l->t(
+						'Your private encryption key could not be unlocked. If your login password has changed, update your private key password in Personal settings to restore access to your encrypted files.'
+					);
+				}
 				break;
 			case Session::NOT_INITIALIZED:
 				$status = 'interactionNeeded';

From 4b863869e5ceca8b27fde7935aab5d8c4dedf6b5 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 20:17:52 -0400
Subject: [PATCH 12/18] test(encryption): verify serverSideEncryptionEnabled is
 passed

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/tests/Settings/AdminTest.php | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/apps/encryption/tests/Settings/AdminTest.php b/apps/encryption/tests/Settings/AdminTest.php
index cd0057b531ad9..a4dcf7bd869b3 100644
--- a/apps/encryption/tests/Settings/AdminTest.php
+++ b/apps/encryption/tests/Settings/AdminTest.php
@@ -13,6 +13,7 @@
 use OCP\AppFramework\Http\TemplateResponse;
 use OCP\AppFramework\Services\IInitialState;
 use OCP\Config\IUserConfig;
+use OCP\Encryption\IManager;
 use OCP\IAppConfig;
 use OCP\IConfig;
 use OCP\IL10N;
@@ -36,6 +37,7 @@ class AdminTest extends TestCase {
 	protected IInitialState&MockObject $initialState;
 	protected IAppConfig&MockObject $appConfig;
 	protected IUserConfig&MockObject $userConfig;
+	protected IManager&MockObject $encryptionManager;
 
 	protected function setUp(): void {
 		parent::setUp();
@@ -49,6 +51,7 @@ protected function setUp(): void {
 		$this->initialState = $this->createMock(IInitialState::class);
 		$this->appConfig = $this->createMock(IAppConfig::class);
 		$this->userConfig = $this->createMock(IUserConfig::class);
+		$this->encryptionManager = $this->createMock(IManager::class);
 
 		$this->admin = new Admin(
 			$this->l,
@@ -60,10 +63,16 @@ protected function setUp(): void {
 			$this->initialState,
 			$this->appConfig,
 			$this->userConfig,
+			$this->encryptionManager,
 		);
 	}
 
 	public function testGetForm(): void {
+		$this->encryptionManager
+			->expects(self::once())
+			->method('isEnabled')
+			->willReturn(true);
+
 		$this->appConfig
 			->method('getValueBool')
 			->willReturnMap([
@@ -79,13 +88,19 @@ public function testGetForm(): void {
 				'recoveryEnabled' => true,
 				'initStatus' => '0',
 				'encryptHomeStorage' => true,
-				'masterKeyEnabled' => true
+				'masterKeyEnabled' => true,
+				'serverSideEncryptionEnabled' => true,
 			]);
 		$expected = new TemplateResponse('encryption', 'settings', renderAs: '');
 		$this->assertEquals($expected, $this->admin->getForm());
 	}
 
 	public function testGetFormPassesDisabledSettingsAndInitializationStatus(): void {
+		$this->encryptionManager
+			->expects(self::once())
+			->method('isEnabled')
+			->willReturn(false);
+
 		$this->appConfig
 			->method('getValueBool')
 			->willReturnMap([
@@ -107,6 +122,7 @@ public function testGetFormPassesDisabledSettingsAndInitializationStatus(): void
 				'initStatus' => '2',
 				'encryptHomeStorage' => false,
 				'masterKeyEnabled' => false,
+				'serverSideEncryptionEnabled' => false,
 			]);
 
 		$this->admin->getForm();

From eb38efa4dab574250b1d43ea461508a3850054bf Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 20:21:53 -0400
Subject: [PATCH 13/18] test(encryption): check INIT_EXECUTED response messages

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 .../tests/Controller/StatusControllerTest.php | 35 ++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/apps/encryption/tests/Controller/StatusControllerTest.php b/apps/encryption/tests/Controller/StatusControllerTest.php
index 2202e76d9f666..b2364faf331d1 100644
--- a/apps/encryption/tests/Controller/StatusControllerTest.php
+++ b/apps/encryption/tests/Controller/StatusControllerTest.php
@@ -13,6 +13,7 @@
 use OCA\Encryption\Controller\StatusController;
 use OCA\Encryption\Session;
 use OCP\Encryption\IManager;
+use OCP\IAppConfig;
 use OCP\IL10N;
 use OCP\IRequest;
 use PHPUnit\Framework\MockObject\MockObject;
@@ -24,6 +25,7 @@ class StatusControllerTest extends TestCase {
 	protected IL10N&MockObject $l10nMock;
 	protected Session&MockObject $sessionMock;
 	protected IManager&MockObject $encryptionManagerMock;
+	protected IAppConfig&MockObject $appConfigMock;
 
 	protected StatusController $controller;
 
@@ -42,12 +44,14 @@ protected function setUp(): void {
 				return $message;
 			});
 		$this->encryptionManagerMock = $this->createMock(IManager::class);
+		$this->appConfigMock = $this->createMock(IAppConfig::class);
 
 		$this->controller = new StatusController('encryptionTest',
 			$this->requestMock,
 			$this->l10nMock,
 			$this->sessionMock,
-			$this->encryptionManagerMock);
+			$this->encryptionManagerMock,
+			$this->appConfigMock);
 	}
 
 	/**
@@ -72,4 +76,33 @@ public static function dataTestGetStatus(): array {
 			['unknown', 'error'],
 		];
 	}
+
+	#[\PHPUnit\Framework\Attributes\DataProvider(methodName: 'dataTestGetStatusInitExecutedMessage')]
+	public function testGetStatusInitExecutedMessage(bool $masterKeyEnabled, string $expectedMessage): void {
+		$this->sessionMock->expects($this->atLeastOnce())
+			->method('getStatus')
+			->willReturn(Session::INIT_EXECUTED);
+
+		$this->appConfigMock->expects(self::once())
+			->method('getValueBool')
+			->with('encryption', 'useMasterKey', true)
+			->willReturn($masterKeyEnabled);
+
+		$data = $this->controller->getStatus()->getData();
+
+		$this->assertSame($expectedMessage, $data['data']['message']);
+	}
+
+	public static function dataTestGetStatusInitExecutedMessage(): array {
+		return [
+			'master key enabled' => [
+				true,
+				'Server-side encryption could not be initialized. Please contact your administrator.',
+			],
+			'per-user key enabled' => [
+				false,
+				'Your private encryption key could not be unlocked. If your login password has changed, update your private key password in Personal settings to restore access to your encrypted files.',
+			],
+		];
+	}
 }

From ac02e8b6b9beb0eb2bb7ee10aa19a2caf4365af2 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 20:28:02 -0400
Subject: [PATCH 14/18] chore(encryption): inject IAppConfig into
 StatusController

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/lib/Controller/StatusController.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/encryption/lib/Controller/StatusController.php b/apps/encryption/lib/Controller/StatusController.php
index 09d30474baf66..5c5507d97e99b 100644
--- a/apps/encryption/lib/Controller/StatusController.php
+++ b/apps/encryption/lib/Controller/StatusController.php
@@ -32,6 +32,7 @@ public function __construct(
 		private IL10N $l,
 		private Session $session,
 		private IManager $encryptionManager,
+		private IAppConfig $appConfig,
 	) {
 		parent::__construct($appName, $request);
 	}

From e8c94b3eb95f65c36629467ef78522fe119b464d Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 20:30:59 -0400
Subject: [PATCH 15/18] chore(encryption): add serverSideEncryptionEnabled to
 admin initial state

The template reads this property, and Admin.php now provides it.

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/src/views/SettingsAdmin.vue | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/apps/encryption/src/views/SettingsAdmin.vue b/apps/encryption/src/views/SettingsAdmin.vue
index af71a95b6d291..c78251c938d3d 100644
--- a/apps/encryption/src/views/SettingsAdmin.vue
+++ b/apps/encryption/src/views/SettingsAdmin.vue
@@ -15,9 +15,10 @@ import { InitStatus } from '../utils/types.ts'
 
 const adminSettings = loadState<{
 	recoveryEnabled: boolean
-	masterKeyEnabled: boolean
-	encryptHomeStorage: boolean
 	initStatus: typeof InitStatus[keyof typeof InitStatus]
+	encryptHomeStorage: boolean
+	masterKeyEnabled: boolean
+	serverSideEncryptionEnabled: boolean
 }>('encryption', 'adminSettings')
 
 const encryptHomeStorage = ref(adminSettings.encryptHomeStorage!)

From cfb3c4f99f1fa5aae9cda989657ccec589af0922 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 20:39:08 -0400
Subject: [PATCH 16/18] fix(encryption): clarify how to enable server-side
 encryption

Point administrators to the Security settings section where they can enable server-side encryption.

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/src/views/SettingsAdmin.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/encryption/src/views/SettingsAdmin.vue b/apps/encryption/src/views/SettingsAdmin.vue
index c78251c938d3d..86cf0eacc9705 100644
--- a/apps/encryption/src/views/SettingsAdmin.vue
+++ b/apps/encryption/src/views/SettingsAdmin.vue
@@ -30,7 +30,7 @@ const recoveryEnabled = ref(adminSettings.recoveryEnabled!)
 		<NcNoteCard v-if="adminSettings.initStatus === InitStatus.NotInitialized && !adminSettings.masterKeyEnabled" type="warning">
 			{{ adminSettings.serverSideEncryptionEnabled
 				? t('encryption', 'Your encryption keys are not initialized for this session. Please sign out and sign back in.')
-				: t('encryption', 'Server-side encryption is disabled. Enable it in the admin settings to use the encryption module.') }}
+				: t('encryption', 'Server-side encryption is disabled. To enable it, open Administration settings, select Security, and turn on Server-side encryption.') }}
 		</NcNoteCard>
 
 		<template v-else>

From 441a68b4c36d6af4ccfc29f15066186433b329dd Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 20:41:45 -0400
Subject: [PATCH 17/18] chore(encryption): add missing IManager import in
 Admin.php

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/lib/Settings/Admin.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/encryption/lib/Settings/Admin.php b/apps/encryption/lib/Settings/Admin.php
index d4ef63df0fb31..80ac80e20d2a4 100644
--- a/apps/encryption/lib/Settings/Admin.php
+++ b/apps/encryption/lib/Settings/Admin.php
@@ -12,6 +12,7 @@
 use OC\Files\View;
 use OCA\Encryption\AppInfo\Application;
 use OCA\Encryption\Crypto\Crypt;
+use OCP\Encryption\IManager;
 use OCA\Encryption\Session;
 use OCA\Encryption\Util;
 use OCP\AppFramework\Http\TemplateResponse;

From 246ddc485d9cb3613b24ede15e4c6cfb23494fb1 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Sat, 26 Sep 2026 20:43:15 -0400
Subject: [PATCH 18/18] test(encryption): update master-key status expected
 string

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 apps/encryption/tests/Controller/StatusControllerTest.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/encryption/tests/Controller/StatusControllerTest.php b/apps/encryption/tests/Controller/StatusControllerTest.php
index b2364faf331d1..070964bf32990 100644
--- a/apps/encryption/tests/Controller/StatusControllerTest.php
+++ b/apps/encryption/tests/Controller/StatusControllerTest.php
@@ -97,7 +97,7 @@ public static function dataTestGetStatusInitExecutedMessage(): array {
 		return [
 			'master key enabled' => [
 				true,
-				'Server-side encryption could not be initialized. Please contact your administrator.',
+				'Server-side encryption could not be initialized. Please contact your administrator for guidance.',
 			],
 			'per-user key enabled' => [
 				false,