document editing web UI, hardening, and CODE 26.04

[cyberb]

Covers points 2, 3 and 4 from the review of #4, plus the CODE 26.04 migration that #4 had to drop.

CI: build 105 green on amd64 (22/22) and arm64 (16/16), including the full upgrade chain.

Why a WOPI host at all

Collabora Online has no storage of its own, so the app is currently only usable through Nextcloud Office. Upstream cannot help: its built-in WOPI host and documents.html picker are compiled out of release builds —

// wsd/FileServer.cpp
#if ENABLE_DEBUG
    if (relPath.starts_with("/wopi/files"))     { handleWopiRequest(...);      return true; }
    if (relPath.starts_with("/wopi/documents")) { handleDocumentsRequest(...); return true; }
#endif

— and local filesystem storage is gated the same way (ENABLE_LOCAL_FILESYSTEM is 0 unless MOBILEAPP || ENABLE_DEBUG, config.h.in), which also means the storage.filesystem entry we already shipped never did anything. So the app becomes the WOPI host.

Security model

Surface	Listener	Authorised by
SPA, /api/*, /oidc/*	unix socket -> nginx	Authelia OIDC session cookie
/wopi/files/*	127.0.0.1:9981	HMAC token binding file id + user + expiry
/browser, /hosting/*, /cool/*	via nginx	unauthenticated, unchanged for Nextcloud
/browser/dist/admin, /cool/adminws	via nginx	Authelia auth_request, unchanged
/wopi/ through the public proxy	nginx	explicit return 404

Separate muxes, so WOPI is unreachable from outside. 07-security.spec.ts asserts all of it, including that 9980/9981 are loopback-IPv4 only and that the real WOPI host rejects a forged token.

WOPISrc points at a loopback port because coolwsd is the one dialling: devices often cannot resolve their own subdomains (NAT loopback) and coolwsd will not trust the platform CA. coolwsd has no unix-socket support.

Hardening (point 2)

• net.listen: any -> loopback + net.proto: all -> IPv4. coolwsd bound 0.0.0.0:9980 with the admin console at admin/admin, reachable from the LAN bypassing nginx and Authelia. The password is now generated at install. (proto=IPv4 is required: with all+loopback coolwsd binds [::1] only, which upstream warns about in a comment directly above the setting — it caused a 502 in build 96.)
• alias_groups first -> groups. ⚠️ first pins whichever WOPI host connects first, which breaks with two hosts in play. Groups now allow our loopback host and any host on this device's domain — an off-device Nextcloud is no longer accepted by default.
• home_mode.enable = true. ⚠️ Suppresses the first-run Welcome dialog and feedback popups (it was covering the document and blocking editing), at the cost of capping concurrent connections at 20 and open documents at 10. Traced to upstream configure.ac; CODE is built --with-welcome-url, which makes home_mode the applicable switch.
• Mutable state moved out of $SNAP_COMMON into $SNAP_DATA, leaving only the platform-contract web.socket.
• always_save_on_exit = true, so closing the editor flushes through the WOPI host rather than waiting on idle/auto-save.

CODE 26.04 (why #4 could not ship it)

collabora/code:26.04.x is a Nix-built distroless image with no /bin/sh — Drone cannot use it as a step image (build 92: exec: "/bin/sh": ... no such file or directory). Its /usr and /lib are a symlink farm into absolute /nix/store paths that dangle anywhere else. app/Dockerfile resolves them in a debian stage with /nix mounted at the same path; app/build.sh extracts over dind. Launchers gained a shared loader.sh because the amd64 loader moved to /lib64.

Guide gaps (point 3)

• every step calls a committed script (cli/build.sh, cli/test.sh, ci/test.sh, web/build.sh); redundant top-level build.sh removed
• nginx test and cli test on bookworm and buster
• snap.yaml: dropped confinement/plugs, added restart-delay: 10s, cli entry, backup/restore hooks
• package.sh uses apt.sh
• test/upgrade.py had its whole body commented out and ended in pass — the green step asserted nothing. Replaced with a real test-upgrade-prev -> e2e-before-upgrade -> test-upgrade -> e2e-after-upgrade chain, all passing.
• added a coolwsd readiness gate; the old check raced a slow first boot on arm64+buster

Review notes

• samples/blank.{docx,xlsx,pptx} are binary blanks copied from the onlyoffice app repo, needed to create documents from templates. Verified valid OOXML.
• No secrets committed: config/backend.env is all {{ }} placeholders; OIDC secret, WOPI key and admin password are generated at install into $SNAP_DATA/secret/.
• The pre-upgrade spec seeds over ssh because the currently released collabora has no SPA to drive. Once this ships, switch 08-pre-upgrade.spec.ts to the UI path.
• Screenshots for every screen (desktop + mobile) land in artifact/e2e*/playwright/<project>/screenshot/.