Linus Rath 204cd09951 fix: end office editor sessions when the user signs out ...

A WOPI token carries the user's credentials to the editor server and
stayed valid for its whole six-hour lifetime, so an editor opened
before signing out could still read and save the document afterwards.

Each token now records the browser (a random id in an HttpOnly cookie,
hashed) and account slot that opened it. Signing out records a
revocation time for that browser and slot, or for every slot on a full
sign-out, and WOPI calls with a token minted before it are refused.
Signing out on another device leaves this browser's editors alone.
Revocations live in the state directory, so they survive a restart and
reach replicas sharing the state volume, and are dropped once the
tokens they cover have expired.

2026-09-26 16:40:46 +02:00

..

discovery.ts

feat: WOPI office document editing in Files (Collabora/OnlyOffice/EuroOffice) #425

2026-08-31 23:16:19 +02:00

files.ts

fix: stop office attachment launch hanging while checking the blob #1047

2026-09-23 19:03:37 +02:00

request.ts

fix: end office editor sessions when the user signs out

2026-09-26 16:40:46 +02:00

revocation.ts

fix: end office editor sessions when the user signs out

2026-09-26 16:40:46 +02:00

token.ts

fix: end office editor sessions when the user signs out

2026-09-26 16:40:46 +02:00