From 2660add53f4248253a2c9c2af76676645c58553c Mon Sep 17 00:00:00 2001
From: Alan Castro <arcastroe@gmail.com>
Date: Fri, 19 Jan 2024 23:28:34 -0800
Subject: [PATCH] feat: only-office integration pt 2: performed server-side
 signing. addressed other comments.

---
 cmd/config.go                                 |   3 +
 files/file.go                                 |  12 +-
 fileutils/file.go                             |  13 ++
 frontend/package-lock.json                    |   8 -
 frontend/package.json                         |   1 -
 frontend/src/utils/constants.js               |   4 +-
 frontend/src/views/Files.vue                  |   4 +-
 frontend/src/views/files/OnlyOfficeEditor.vue |  95 +++--------
 go.mod                                        |   1 +
 go.sum                                        |   2 +
 http/auth.go                                  |   1 +
 http/data.go                                  |  11 +-
 http/http.go                                  |   1 +
 http/onlyoffice.go                            | 150 +++++++++++++++++-
 http/static.go                                |   2 +-
 15 files changed, 204 insertions(+), 104 deletions(-)

diff --git a/cmd/config.go b/cmd/config.go
index ed3cc772ca7..155a42b19ed 100644
--- a/cmd/config.go
+++ b/cmd/config.go
@@ -47,6 +47,9 @@ func addConfigFlags(flags *pflag.FlagSet) {
 	flags.String("branding.files", "", "path to directory with images and custom styles")
 	flags.Bool("branding.disableExternal", false, "disable external links such as GitHub links")
 	flags.Bool("branding.disableUsedPercentage", false, "disable used disk percentage graph")
+
+	flags.String("onlyoffice.url", "", "onlyoffice integration url")
+	flags.String("onlyoffice.jwtSecret", "", "onlyoffice integration secret")
 }
 
 //nolint:gocyclo
diff --git a/files/file.go b/files/file.go
index 0a579d9fbd3..246c5604585 100644
--- a/files/file.go
+++ b/files/file.go
@@ -21,6 +21,7 @@ import (
 	"github.com/spf13/afero"
 
 	"github.com/filebrowser/filebrowser/v2/errors"
+	"github.com/filebrowser/filebrowser/v2/fileutils"
 	"github.com/filebrowser/filebrowser/v2/rules"
 )
 
@@ -197,16 +198,7 @@ func (i *FileInfo) Checksum(algo string) error {
 }
 
 func (i *FileInfo) RealPath() string {
-	if realPathFs, ok := i.Fs.(interface {
-		RealPath(name string) (fPath string, err error)
-	}); ok {
-		realPath, err := realPathFs.RealPath(i.Path)
-		if err == nil {
-			return realPath
-		}
-	}
-
-	return i.Path
+	return fileutils.GetRealPath(i.Fs, i.Path)
 }
 
 // TODO: use constants
diff --git a/fileutils/file.go b/fileutils/file.go
index 81aeffeb334..14929ab9625 100644
--- a/fileutils/file.go
+++ b/fileutils/file.go
@@ -126,3 +126,16 @@ func CommonPrefix(sep byte, paths ...string) string {
 
 	return string(c)
 }
+
+func GetRealPath(fs afero.Fs, path string) string {
+	if realPathFs, ok := fs.(interface {
+		RealPath(name string) (fPath string, err error)
+	}); ok {
+		realPath, err := realPathFs.RealPath(path)
+		if err == nil {
+			return realPath
+		}
+	}
+
+	return path
+}
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 53503f25dc6..2311368c53b 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -13,7 +13,6 @@
         "core-js": "^3.32.0",
         "css-vars-ponyfill": "^2.4.8",
         "filesize": "^10.0.8",
-        "jose": "^4.13.1",
         "js-base64": "^3.7.5",
         "lodash.clonedeep": "^4.5.0",
         "lodash.throttle": "^4.1.1",
@@ -3659,13 +3658,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/jose": {
-      "version": "4.15.4",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/panva"
-      }
-    },
     "node_modules/js-base64": {
       "version": "3.7.5",
       "license": "BSD-3-Clause"
diff --git a/frontend/package.json b/frontend/package.json
index 32de85cdc38..4449a5f5afb 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -19,7 +19,6 @@
     "core-js": "^3.32.0",
     "css-vars-ponyfill": "^2.4.8",
     "filesize": "^10.0.8",
-    "jose": "^4.13.1",
     "js-base64": "^3.7.5",
     "lodash.clonedeep": "^4.5.0",
     "lodash.throttle": "^4.1.1",
diff --git a/frontend/src/utils/constants.js b/frontend/src/utils/constants.js
index f0142bb061d..bfd1b4729cc 100644
--- a/frontend/src/utils/constants.js
+++ b/frontend/src/utils/constants.js
@@ -18,7 +18,7 @@ const enableExec = window.FileBrowser.EnableExec;
 const tusSettings = window.FileBrowser.TusSettings;
 const origin = window.location.origin;
 const tusEndpoint = `/api/tus`;
-const onlyOffice = window.FileBrowser.OnlyOffice;
+const onlyOfficeUrl = window.FileBrowser.OnlyOfficeUrl;
 
 export {
   name,
@@ -40,5 +40,5 @@ export {
   tusSettings,
   origin,
   tusEndpoint,
-  onlyOffice,
+  onlyOfficeUrl,
 };
diff --git a/frontend/src/views/Files.vue b/frontend/src/views/Files.vue
index 25aa7aa0cd6..48f821e0b5f 100644
--- a/frontend/src/views/Files.vue
+++ b/frontend/src/views/Files.vue
@@ -22,7 +22,7 @@
 <script>
 import { files as api } from "@/api";
 import { mapState, mapMutations } from "vuex";
-import { onlyOffice } from "@/utils/constants";
+import { onlyOfficeUrl } from "@/utils/constants";
 
 import HeaderBar from "@/components/header/HeaderBar.vue";
 import Breadcrumbs from "@/components/Breadcrumbs.vue";
@@ -65,7 +65,7 @@ export default {
         this.req.type === "textImmutable"
       ) {
         return "editor";
-      } else if (this.req.type === "officedocument" && onlyOffice !== "") {
+      } else if (this.req.type === "officedocument" && onlyOfficeUrl) {
         return "OnlyOfficeEditor";
       } else {
         return "preview";
diff --git a/frontend/src/views/files/OnlyOfficeEditor.vue b/frontend/src/views/files/OnlyOfficeEditor.vue
index bb76dce826c..9d1fffd7758 100644
--- a/frontend/src/views/files/OnlyOfficeEditor.vue
+++ b/frontend/src/views/files/OnlyOfficeEditor.vue
@@ -4,29 +4,24 @@
       <action icon="close" :label="$t('buttons.close')" @action="close()" />
       <title>{{ req.name }}</title>
     </header-bar>
-
     <breadcrumbs base="/files" noLink />
-
-    <div id="editor"></div>
+    <errors v-if="error" :errorCode="error.status" />
+    <div id="editor">
+      <div id="onlyoffice-editor"></div>
+    </div>
   </div>
 </template>
 
-<style scoped>
-#editor-container {
-  height: 100vh;
-  width: 100vw;
-}
-</style>
-
 <script>
 import { mapState } from "vuex";
 import url from "@/utils/url";
-import { baseURL, onlyOffice } from "@/utils/constants";
-import * as jose from "jose";
+import { onlyOfficeUrl } from "@/utils/constants";
 
 import HeaderBar from "@/components/header/HeaderBar.vue";
 import Action from "@/components/header/Action.vue";
 import Breadcrumbs from "@/components/Breadcrumbs.vue";
+import Errors from "@/views/Errors.vue";
+import { fetchJSON } from "@/api/utils";
 
 export default {
   name: "onlyofficeeditor",
@@ -34,9 +29,13 @@ export default {
     HeaderBar,
     Action,
     Breadcrumbs,
+    Errors,
   },
   data: function () {
-    return {};
+    return {
+      error: null,
+      clientConfig: null
+    };
   },
   computed: {
     ...mapState(["req", "user", "jwt"]),
@@ -71,6 +70,8 @@ export default {
     },
   },
   created() {
+    const isMobile = window.innerWidth <= 736;
+    this.clientConfigPromise = fetchJSON(`/api/onlyoffice/client-config${this.req.path}?isMobile=${isMobile}`);
     window.addEventListener("keydown", this.keyEvent);
   },
   beforeDestroy() {
@@ -78,69 +79,19 @@ export default {
     this.editor.destroyEditor();
   },
   mounted: function () {
-    let onlyofficeScript = document.createElement("script");
-    onlyofficeScript.setAttribute(
-      "src",
-      `${onlyOffice.url}/web-apps/apps/api/documents/api.js`
-    );
+    const scriptUrl = `${onlyOfficeUrl}/web-apps/apps/api/documents/api.js`;
+    const onlyofficeScript = document.createElement("script");
+    onlyofficeScript.setAttribute("src", scriptUrl);
     document.head.appendChild(onlyofficeScript);
 
-    /*eslint-disable */
-    onlyofficeScript.onload = () => {
-      let fileUrl = `${window.location.protocol}//${window.location.host}${baseURL}/api/raw${url.encodePath(
-        this.req.path
-      )}?auth=${this.jwt}`;
-
-      // create a key from the last modified timestamp and the reversed file path (most specific part first)
-      // replace all special characters (only these symbols are supported: 0-9, a-z, A-Z, -._=)
-      // and truncate it (max length is 20 characters)
-      const key = (
-        Date.parse(this.req.modified).valueOf()
-        + url
-          .encodePath(this.req.path.split('/').reverse().join(''))
-          .replaceAll(/[!~[\]*'()/,;:\-%+. ]/g, "")
-      ).substring(0, 20);
-
-      const config = {
-        document: {
-          fileType: this.req.extension.substring(1),
-          key: key,
-          title: this.req.name,
-          url: fileUrl,
-          permissions: {
-            edit: this.user.perm.modify,
-            download: this.user.perm.download,
-            print: this.user.perm.download
-          }
-        },
-        editorConfig: {
-          callbackUrl: `${window.location.protocol}//${window.location.host}${baseURL}/api/onlyoffice/callback?auth=${this.jwt}&save=${encodeURIComponent(this.req.path)}`,
-          user: {
-            id: this.user.id,
-            name: `User ${this.user.id}`
-          },
-          customization: {
-            autosave: true,
-            forcesave: true
-          },
-          lang: this.user.locale,
-          mode: this.user.perm.modify ? "edit" : "view"
-        }
-      };
-
-      if(onlyOffice.jwtSecret != "") {
-        const alg = 'HS256';
-        new jose.SignJWT(config)
-          .setProtectedHeader({ alg })
-          .sign(new TextEncoder().encode(onlyOffice.jwtSecret)).then((jwt) => {
-            config.token = jwt;
-            this.editor = new DocsAPI.DocEditor("editor", config);
-          })
-      } else {
-        this.editor = new DocsAPI.DocEditor("editor", config);
+    onlyofficeScript.onload = async () => {
+      try {
+        const clientConfig = await this.clientConfigPromise
+        this.editor = new DocsAPI.DocEditor("onlyoffice-editor", clientConfig);
+      } catch(e) {
+        this.error = e;
       }
     };
-    /*eslint-enable */
   },
   methods: {
     back() {
diff --git a/go.mod b/go.mod
index 03560f1915a..dca8d37ba1b 100644
--- a/go.mod
+++ b/go.mod
@@ -31,6 +31,7 @@ require (
 )
 
 require (
+	github.com/allegro/bigcache v1.2.1 // indirect
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
diff --git a/go.sum b/go.sum
index 34ba7f3145a..d0ff9d56110 100644
--- a/go.sum
+++ b/go.sum
@@ -42,6 +42,8 @@ github.com/DataDog/zstd v1.4.1 h1:3oxKN3wbHibqx897utPC2LTQU4J+IHWWJO+glkAkpFM=
 github.com/DataDog/zstd v1.4.1/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
 github.com/Sereal/Sereal v0.0.0-20190618215532-0b8ac451a863 h1:BRrxwOZBolJN4gIwvZMJY1tzqBvQgpaZiQRuIDD40jM=
 github.com/Sereal/Sereal v0.0.0-20190618215532-0b8ac451a863/go.mod h1:D0JMgToj/WdxCgd30Kc1UcA9E+WdZoJqeVOuYW7iTBM=
+github.com/allegro/bigcache v1.2.1 h1:hg1sY1raCwic3Vnsvje6TT7/pnZba83LeFck5NrFKSc=
+github.com/allegro/bigcache v1.2.1/go.mod h1:Cb/ax3seSYIx7SuZdm2G2xzfwmv3TPSk2ucNfQESPXM=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
 github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
diff --git a/http/auth.go b/http/auth.go
index 69bc7dfb1e2..e6d3736fb24 100644
--- a/http/auth.go
+++ b/http/auth.go
@@ -83,6 +83,7 @@ func withUser(fn handleFunc) handleFunc {
 			w.Header().Add("X-Renew-Token", "true")
 		}
 
+		d.authToken = token.Raw
 		d.user, err = d.store.Users.Get(d.server.Root, tk.User.ID)
 		if err != nil {
 			return http.StatusInternalServerError, err
diff --git a/http/data.go b/http/data.go
index 5ba87313b41..2c86fa465a1 100644
--- a/http/data.go
+++ b/http/data.go
@@ -18,11 +18,12 @@ type handleFunc func(w http.ResponseWriter, r *http.Request, d *data) (int, erro
 
 type data struct {
 	*runner.Runner
-	settings *settings.Settings
-	server   *settings.Server
-	store    *storage.Storage
-	user     *users.User
-	raw      interface{}
+	authToken string
+	settings  *settings.Settings
+	server    *settings.Server
+	store     *storage.Storage
+	user      *users.User
+	raw       interface{}
 }
 
 // Check implements rules.Checker.
diff --git a/http/http.go b/http/http.go
index 1d7093fce77..748b438676c 100644
--- a/http/http.go
+++ b/http/http.go
@@ -60,6 +60,7 @@ func NewHandler(
 	users.Handle("/{id:[0-9]+}", monkey(userGetHandler, "")).Methods("GET")
 	users.Handle("/{id:[0-9]+}", monkey(userDeleteHandler, "")).Methods("DELETE")
 
+	api.PathPrefix("/onlyoffice").Handler(monkey(onlyofficeClientConfigGetHandler, "/api/onlyoffice/client-config")).Methods("GET")
 	api.PathPrefix("/onlyoffice").Handler(monkey(onlyofficeCallbackHandler, "/api/onlyoffice/callback")).Methods("POST")
 
 	api.PathPrefix("/resources").Handler(monkey(resourceGetHandler, "/api/resources")).Methods("GET")
diff --git a/http/onlyoffice.go b/http/onlyoffice.go
index 55d6416e30f..b52ea90c441 100644
--- a/http/onlyoffice.go
+++ b/http/onlyoffice.go
@@ -1,21 +1,119 @@
 package http
 
 import (
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"io"
 	"net/http"
+	"net/url"
+	"strconv"
+	"time"
+
+	"github.com/allegro/bigcache"
+	"github.com/filebrowser/filebrowser/v2/files"
+	"github.com/filebrowser/filebrowser/v2/fileutils"
+	"github.com/golang-jwt/jwt/v4"
+)
+
+const (
+	onlyOfficeStatusReadyForSaving              = 2
+	onlyOfficeStatusEditingButCurrentStateSaved = 6
+)
+
+var (
+	// Refer to only-office documentation on co-editing
+	// https://api.onlyoffice.com/editors/coedit
+	//
+	// a 48 hour TTL here is not required, because the document server will notify
+	// us when keys should be evicted. However, it is added defensively in order to
+	// prevent potential memory leaks.
+	coeditingDocumentKeys, _ = bigcache.NewBigCache(bigcache.DefaultConfig(48 * time.Hour))
 )
 
 type OnlyOfficeCallback struct {
 	ChangesURL string   `json:"changesurl,omitempty"`
-	Key        string   `json:"key"`
-	Status     int      `json:"status"`
+	Key        string   `json:"key,omitempty"`
+	Status     int      `json:"status,omitempty"`
 	URL        string   `json:"url,omitempty"`
 	Users      []string `json:"users,omitempty"`
 	UserData   string   `json:"userdata,omitempty"`
 }
 
+var onlyofficeClientConfigGetHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	if d.settings.OnlyOffice.JWTSecret == "" {
+		return http.StatusInternalServerError, errors.New("only-office integration must be configured in settings")
+	}
+
+	if !d.user.Perm.Modify || !d.Check(r.URL.Path) {
+		return http.StatusForbidden, nil
+	}
+
+	referrer, err := getReferer(r)
+	if err != nil {
+		return http.StatusInternalServerError, errors.Join(errors.New("could not determine request referrer"), err)
+	}
+
+	file, err := files.NewFileInfo(files.FileOptions{
+		Fs:         d.user.Fs,
+		Path:       r.URL.Path,
+		Modify:     d.user.Perm.Modify,
+		Expand:     false,
+		ReadHeader: d.server.TypeDetectionByHeader,
+		Checker:    d,
+	})
+
+	if err != nil {
+		return errToStatus(err), err
+	}
+
+	clientConfig := map[string]interface{}{
+		"document": map[string]interface{}{
+			"fileType": file.Extension[1:],
+			"key":      getDocumentKey(file.RealPath()),
+			"title":    file.Name,
+			"url": (&url.URL{
+				Scheme:   referrer.Scheme,
+				Host:     referrer.Host,
+				RawQuery: "auth=" + url.QueryEscape(d.authToken),
+			}).JoinPath(d.server.BaseURL, "/api/raw", file.Path).String(),
+			"permissions": map[string]interface{}{
+				"edit":     d.user.Perm.Modify,
+				"download": d.user.Perm.Download,
+				"print":    d.user.Perm.Download,
+			},
+		},
+		"editorConfig": map[string]interface{}{
+			"callbackUrl": (&url.URL{
+				Scheme:   referrer.Scheme,
+				Host:     referrer.Host,
+				RawQuery: "auth=" + url.QueryEscape(d.authToken) + "&save=" + url.QueryEscape(file.Path),
+			}).JoinPath(d.server.BaseURL, "/api/onlyoffice/callback").String(),
+			"user": map[string]interface{}{
+				"id":   strconv.FormatUint(uint64(d.user.ID), 10),
+				"name": d.user.Username,
+			},
+			"customization": map[string]interface{}{
+				"autosave":  true,
+				"forcesave": true,
+				"uiTheme":   ternary(d.Branding.Theme == "dark", "default-dark", "default-light"),
+			},
+			"lang": d.user.Locale,
+			"mode": ternary(d.user.Perm.Modify, "edit", "view"),
+		},
+		"type": ternary(r.URL.Query().Get("isMobile") == "true", "mobile", "desktop"),
+	}
+
+	signature, err := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims(clientConfig)).SignedString([]byte(d.OnlyOffice.JWTSecret))
+	if err != nil {
+		return http.StatusInternalServerError, errors.Join(errors.New("could not sign only-office client-config"), err)
+	}
+	clientConfig["token"] = signature
+
+	return renderJSON(w, r, clientConfig)
+})
+
 var onlyofficeCallbackHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
 	body, err := io.ReadAll(r.Body)
 	if err != nil {
@@ -28,12 +126,21 @@ var onlyofficeCallbackHandler = withUser(func(w http.ResponseWriter, r *http.Req
 		return http.StatusInternalServerError, err
 	}
 
-	if data.Status == 2 || data.Status == 6 {
+	if data.Status == onlyOfficeStatusReadyForSaving || data.Status == onlyOfficeStatusEditingButCurrentStateSaved {
 		docPath := r.URL.Query().Get("save")
 		if docPath == "" {
 			return http.StatusInternalServerError, errors.New("unable to get file save path")
 		}
 
+		if data.Status == onlyOfficeStatusReadyForSaving {
+			// Refer to only-office documentation on co-editing
+			// https://api.onlyoffice.com/editors/coedit
+			//
+			// On this status, the document key should no longer be re-used.
+			realPath := fileutils.GetRealPath(d.user.Fs, docPath)
+			coeditingDocumentKeys.Delete(realPath)
+		}
+
 		if !d.user.Perm.Modify || !d.Check(docPath) {
 			return http.StatusForbidden, nil
 		}
@@ -62,3 +169,40 @@ var onlyofficeCallbackHandler = withUser(func(w http.ResponseWriter, r *http.Req
 	}
 	return renderJSON(w, r, resp)
 })
+
+func getReferer(r *http.Request) (*url.URL, error) {
+	if len(r.Header["Referer"]) != 1 {
+		return nil, errors.New("expected exactly one Referer header")
+	}
+
+	return url.ParseRequestURI(r.Header["Referer"][0])
+}
+
+func getDocumentKey(realPath string) string {
+	cachedDocumentKey, err := coeditingDocumentKeys.Get(realPath)
+	if err != nil {
+		// error is intentionally ignored in order treat errors
+		// the same as a cache-miss
+	}
+
+	if cachedDocumentKey != nil {
+		return string(cachedDocumentKey)
+	} else {
+		timestamp := strconv.FormatInt(time.Now().UnixMilli(), 10)
+		documentKey := hashSHA256(realPath + timestamp)
+		coeditingDocumentKeys.Set(realPath, []byte(documentKey))
+		return documentKey
+	}
+}
+
+func hashSHA256(data string) string {
+	bytes := sha256.Sum256([]byte(data))
+	return hex.EncodeToString(bytes[:])
+}
+
+func ternary(condition bool, trueValue string, falseValue string) string {
+	if condition {
+		return trueValue
+	}
+	return falseValue
+}
diff --git a/http/static.go b/http/static.go
index f46c24b5a6b..2d2aa40ad43 100644
--- a/http/static.go
+++ b/http/static.go
@@ -45,7 +45,7 @@ func handleWithStaticData(w http.ResponseWriter, _ *http.Request, d *data, fSys
 		"ResizePreview":         d.server.ResizePreview,
 		"EnableExec":            d.server.EnableExec,
 		"TusSettings":           d.settings.Tus,
-		"OnlyOffice":            d.settings.OnlyOffice,
+		"OnlyOfficeUrl":         d.settings.OnlyOffice.URL,
 	}
 
 	if d.settings.Branding.Files != "" {