Elijah/drive
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: OnlyOffice edit session token expiration and add session expired modal
Some checks failed
Automated Container Build / build-and-push (push) Failing after 15s
Details

Browse source
This commit is contained in:
Elijah 2026-05-31 15:20:54 -07:00
parent 1f83d57942
commit 218fb40743
7 changed files with 130 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

21
backend/handlers/auth.go
View file

@ -210,6 +210,27 @@ func (h *AuthHandler) GetDownloadToken(c *fiber.Ctx) error {
})
}
// GetEditToken issues a 24-hour token for file editing via OnlyOffice
// GET /api/auth/edit-token
func (h *AuthHandler) GetEditToken(c *fiber.Ctx) error {
userID := c.Locals("userID")
username := c.Locals("username")
token, err := middleware.GenerateEditToken(
int(userID.(float64)),
username.(string),
h.Config.JWTSecret,
"",
)
if err != nil {
return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "failed to generate edit token"})
}
return c.JSON(fiber.Map{
"token": token,
})
}
// Enable2FA generates a TOTP secret and returns the provisioning URI.
// POST /api/auth/2fa/enable
func (h *AuthHandler) Enable2FA(c *fiber.Ctx) error {

18
backend/handlers/onlyoffice.go
View file

@ -38,8 +38,13 @@ func (h *OnlyOfficeHandler) Callback(c *fiber.Ctx) error {
return c.Status(400).SendString("path required")
}
// Validate the token to ensure the callback is authorized
if err := middleware.ValidateDownloadToken(token, h.Config.JWTSecret, "", path); err != nil {
// Validate the token to ensure the callback is authorized.
// First check if it's a long-lived edit token, fallback to short-lived download token.
err := middleware.ValidateEditToken(token, h.Config.JWTSecret, "", path)
if err != nil {
err = middleware.ValidateDownloadToken(token, h.Config.JWTSecret, "", path)
}
if err != nil {
return c.Status(401).SendString("unauthorized")
}
@ -151,8 +156,13 @@ func (h *OnlyOfficeHandler) DownloadForEditor(c *fiber.Ctx) error {
return c.Status(400).JSON(fiber.Map{"error": "path required"})
}
// Validate the download token
if err := middleware.ValidateDownloadToken(token, h.Config.JWTSecret, "", path); err != nil {
// Validate the token.
// Allow both short-lived download tokens and long-lived edit tokens.
err := middleware.ValidateEditToken(token, h.Config.JWTSecret, "", path)
if err != nil {
err = middleware.ValidateDownloadToken(token, h.Config.JWTSecret, "", path)
}
if err != nil {
return c.Status(401).JSON(fiber.Map{"error": "unauthorized"})
}