WOPI token expiry

[juliushaertl]

• [x] WOPI tokens should have an expiry set and stored in the richdocuments_wopi table
• [ ] Expiry should be configurable by an app config value
• [x] A background job should clean up expired tokens
• [x] On every WOPI operation it should validate that the token is not expired https://github.com/nextcloud/richdocuments/blob/9ecf2aafc64f8e366c7bae5a73c37da8452bb604/lib/Db/WopiMapper.php#L155
• [x] Hand over access_token_ttl in
  • https://github.com/nextcloud/richdocuments/blob/master/src/document.js#L186
  • https://github.com/nextcloud/richdocuments/blob/master/src/document.js#L241
• [x] Verify how expiry is handled in Collabora
• [x] File upstream issue about expired token handling to possibly block further editing or trigger session renewal

From the WOPI spec:

• Access tokens should expire (become invalid) automatically after a period of time. Hosts can use the access_token_ttl property to specify when an access token expires
• access_token_ttl: The access_token_ttl property tells a WOPI client when an access token expires, represented as the number of milliseconds since January 1, 1970 UTC (the date epoch in JavaScript). Despite its misleading name, it does not represent a duration of time for which the access token is valid. The access_token_ttl is never used by itself; it is always attached to a specific access token.

Collabora should properly handle the access_token_ttl, but needs some validation that it works as expected with a low one (e.g. 60 seconds)

[Raudius]

WOPI tokens should have an expiry set and stored in the richdocuments_wopi table

:heavy_check_mark: This is already the case!

Hand over access_token_ttl in

Should be handled in this PR: https://github.com/nextcloud/richdocuments/pull/2149

Verify how expiry is handled in Collabora

:heavy_check_mark: Could not find any information regarding the TTL in the docs, but dug into their server code a bit and verified through testing: a warning is given to the user 15 minutes prior to the expiry of the token. A message is also shown once the token is expired.

From what I can tell Collabora does not enforce the TTL in any way, they just use it for displaying warnings etc. I think this is in line with what the WOPI spec describes.

[Raudius]

On every WOPI operation it should validate that the token is not expired

Implemented in: #2150

[juliushaertl]

Moved the renewal topic to a separate issue https://github.com/nextcloud/richdocuments/issues/2170