Merge pull request 'Pin only-office's secure-link secret, so OnlyOffice's signed download links verify across restarts (issue 1837)' (#440) from fix/1837-secure-link into main

modules/only-office/files/server.env

@@ -2,4 +2,5 @@ JWT_ENABLED=true
 JWT_SECRET=${secret:jwt}
 JWT_HEADER=Authorization
 JWT_IN_BODY=true
+SECURE_LINK_SECRET=${secret:secure-link}
 ALLOW_PRIVATE_IP_ADDRESS=true

modules/only-office/manifest_test.go

@@ -2,6 +2,7 @@ package office
 
 import (
 	"os"
+	"strings"
 	"testing"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
@@ -61,3 +62,34 @@ func TestManifestOffersDocumentServer(t *testing.T) {
 		t.Errorf("serves.document-server.public-root = %q, want https://${bound:route:name}/", root)
 	}
 }
+
+// 1837/AC1 (unit: manifest check)
+// Given the catalogue, when only-office's manifest and its server.env template are read, then the
+// document server's secure-link secret is an own secret taken at start, and server.env hands it to
+// the container as SECURE_LINK_SECRET, so its document service and its nginx sign and check
+// Editor.bin links with one value across every restart.
+func TestSecureLinkSecretIsPinned(t *testing.T) {
+	raw, err := os.ReadFile("module.json")
+	if err != nil {
+		t.Fatalf("reading module.json: %v", err)
+	}
+	m, err := catalogue.ParseManifest(raw)
+	if err != nil {
+		t.Fatalf("parsing module.json: %v", err)
+	}
+	own, ok := m.OwnSecrets["secure-link"]
+	if !ok {
+		t.Fatal("manifest declares no own-secret secure-link")
+	}
+	if own.Taken != catalogue.TakenAtStart {
+		t.Errorf("own-secrets.secure-link.taken = %q, want %q", own.Taken, catalogue.TakenAtStart)
+	}
+
+	env, err := os.ReadFile("files/server.env")
+	if err != nil {
+		t.Fatalf("reading files/server.env: %v", err)
+	}
+	if !strings.Contains(string(env), "\nSECURE_LINK_SECRET=${secret:secure-link}\n") {
+		t.Errorf("files/server.env does not set SECURE_LINK_SECRET=${secret:secure-link}:\n%s", env)
+	}
+}

modules/only-office/module.json

@@ -76,6 +76,10 @@
       "owner": "only-office-converter",
       "taken": "at-start"
     },
+    "secure-link": {
+      "path": "${dir:state}/secure-link.secret",
+      "taken": "at-start"
+    },
     "broker-converter": {
       "path": "${dir:state}/broker-converter.secret",
       "owner": "only-office-converter"
@@ -225,7 +229,7 @@
         "${dir:redis}:/var/lib/redis",
         "${dir:fonts}:/usr/share/fonts/truetype/custom"
       ],
-      "secrets-in-environment": "run-document-server.sh regenerates JWT_SECRET from the environment on every start and overwrites local.json; not convertible"
+      "secrets-in-environment": "run-document-server.sh regenerates JWT_SECRET and SECURE_LINK_SECRET from the environment on every start and overwrites local.json and nginx's ds.conf; not convertible"
     },
     {
       "id": "converter",