Let nginx through only-office's lib directory, so it can serve the converted files the document service writes there instead of answering 403 (issue 1837)

modules/only-office/manifest_test.go

@@ -1,6 +1,7 @@
 package office
 
 import (
+	"encoding/json"
 	"os"
 	"strings"
 	"testing"
@@ -93,3 +94,34 @@ func TestSecureLinkSecretIsPinned(t *testing.T) {
 		t.Errorf("files/server.env does not set SECURE_LINK_SECRET=${secret:secure-link}:\n%s", env)
 	}
 }
+
+// 1837/AC3 (unit: manifest check)
+// Given the catalogue, when only-office's manifest is read, then the lib directory (mounted at
+// /var/lib/onlyoffice, where the document service writes the converted files nginx serves) lets
+// other users pass through it (mode 0711): the image makes it the document service's own, and nginx
+// runs as another user, so a mode of 0700 makes nginx answer 403 "Permission denied" on Editor.bin.
+func TestLibDirectoryLetsNginxThrough(t *testing.T) {
+	raw, err := os.ReadFile("module.json")
+	if err != nil {
+		t.Fatalf("reading module.json: %v", err)
+	}
+	var m struct {
+		Resources []struct {
+			ID   string `json:"id"`
+			Type string `json:"type"`
+			Mode string `json:"mode"`
+		} `json:"resources"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatalf("parsing module.json: %v", err)
+	}
+	for _, r := range m.Resources {
+		if r.ID == "lib" && r.Type == "directory" {
+			if r.Mode != "0711" {
+				t.Errorf("lib directory mode = %q, want 0711 so nginx can reach the document service's cache", r.Mode)
+			}
+			return
+		}
+	}
+	t.Fatal("manifest declares no lib directory")
+}

modules/only-office/module.json

@@ -176,7 +176,7 @@
     {
       "id": "lib",
       "type": "directory",
-      "mode": "0700",
+      "mode": "0711",
       "unknown": "program"
     },
     {