From d3ebaf72eb943dda302ca8139e2f2c01064f1623 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@novox.be>
Date: Thu, 22 Oct 2026 11:27:49 +0200
Subject: [PATCH] Require only-office's document server and carry its address
 and secret into nextcloud's config (issue 1830)

---
 modules/nextcloud/files/config.json     |  7 ++++-
 modules/nextcloud/module.json           | 10 ++++---
 modules/nextcloud/test/manifest.test.ts | 35 +++++++++++++++++++++++++
 3 files changed, 48 insertions(+), 4 deletions(-)
 create mode 100644 modules/nextcloud/test/manifest.test.ts

diff --git a/modules/nextcloud/files/config.json b/modules/nextcloud/files/config.json
index 0967ef42..fe032343 100644
--- a/modules/nextcloud/files/config.json
+++ b/modules/nextcloud/files/config.json
@@ -1 +1,6 @@
-{}
+{
+  "onlyofficeUrl": "${bound:document-server:public-root}",
+  "onlyofficeInternalUrl": "http://${bound:document-server:at}:${bound:document-server:port}/",
+  "onlyofficeStorageUrl": "https://${bound:route:name}/",
+  "onlyofficeSecret": "${secret:document-server}"
+}
diff --git a/modules/nextcloud/module.json b/modules/nextcloud/module.json
index 2854a160..dd28417f 100644
--- a/modules/nextcloud/module.json
+++ b/modules/nextcloud/module.json
@@ -5,7 +5,8 @@
   "requires": [
     "postgres-database",
     "s3-bucket",
-    "route"
+    "route",
+    "document-server"
   ],
   "contributes": {
     "postgres-database": {
@@ -19,11 +20,13 @@
   "binds": {
     "postgres-database": "${dir:state}/database.json",
     "s3-bucket": "${dir:state}/store.json",
-    "route": "${dir:state}/route.json"
+    "route": "${dir:state}/route.json",
+    "document-server": "${dir:state}/document-server.json"
   },
   "secrets": {
     "postgres-database": "${dir:state}/database.secret",
-    "s3-bucket": "${dir:state}/store.secret"
+    "s3-bucket": "${dir:state}/store.secret",
+    "document-server": "${dir:state}/document-server.secret"
   },
   "emits": [
     "user.created",
@@ -134,6 +137,7 @@
       "mode": "0600",
       "template": "files/config.json",
       "takes-config": ["container", "url", "user"],
+      "protected": ["onlyofficeSecret"],
       "merge": "json"
     }
   ],
diff --git a/modules/nextcloud/test/manifest.test.ts b/modules/nextcloud/test/manifest.test.ts
new file mode 100644
index 00000000..55a2f60b
--- /dev/null
+++ b/modules/nextcloud/test/manifest.test.ts
@@ -0,0 +1,35 @@
+// 1830/AC2 (unit: manifest checks)
+// Given the catalogue, when nextcloud's manifest is parsed, then it requires document-server,
+// binds it and receives its secret, and its config.json template carries the document server's
+// public address, bound address and port, its own route name and the shared secret.
+// Run against the manifest and its templates directly — no build needed, they are read as data.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const moduleDir = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+function readJson(path: string): any {
+  return JSON.parse(readFileSync(join(moduleDir, path), "utf8"));
+}
+
+test("the manifest requires document-server, and binds and receives its secret", () => {
+  const manifest = readJson("module.json");
+  assert.ok(
+    Array.isArray(manifest.requires) && manifest.requires.includes("document-server"),
+    "requires names document-server",
+  );
+  assert.equal(manifest.binds?.["document-server"], "${dir:state}/document-server.json");
+  assert.equal(manifest.secrets?.["document-server"], "${dir:state}/document-server.secret");
+});
+
+test("config.json carries the document server's public address, bound address, port, route name and secret", () => {
+  const config = readJson("files/config.json");
+  assert.equal(config.onlyofficeUrl, "${bound:document-server:public-root}");
+  assert.equal(config.onlyofficeInternalUrl, "http://${bound:document-server:at}:${bound:document-server:port}/");
+  assert.equal(config.onlyofficeStorageUrl, "https://${bound:route:name}/");
+  assert.equal(config.onlyofficeSecret, "${secret:document-server}");
+});