feat(wopi): add office document editing

common/config.go

@@ -104,6 +104,7 @@ type Config struct {
 	SignatureTTL time.Duration `yaml:"signature-ttl"`
 
 	WebDav WebDavConfig `yaml:"web-dav"`
+	WOPI   WOPIConfig   `yaml:"wopi"`
 
 	Search SearchConfig `yaml:"search"`
 
@@ -162,6 +163,12 @@ type WebDavConfig struct {
 	MaxCacheItems  int    `yaml:"max-cache-items"`
 }
 
+// WOPIConfig configures the WOPI client discovery endpoint. WOPI support is
+// disabled when DiscoveryURL is empty.
+type WOPIConfig struct {
+	DiscoveryURL string `yaml:"discovery-url"`
+}
+
 type SearchConfig struct {
 	Enabled bool     `yaml:"enabled"`
 	Type    string   `yaml:"type"`

common/registry/keys.go

@@ -22,6 +22,7 @@ var (
 	KeyThumbnail     = componentKey{k: "thumbnail"}
 	KeySearchService = componentKey{k: "searchService"}
 	KeyTokenStore    = componentKey{k: "tokenStore"}
+	KeyWOPI          = componentKey{k: "wopi"}
 
 	KeyUserDAO           = componentKey{k: "userDAO"}
 	KeySessionDAO        = componentKey{k: "sessionDAO"}

docs/config.yml

@@ -206,6 +206,10 @@ auth:
 # maximum number of files to be cached at the same time, default is 1000
 #  max-cache-items: 1000
 
+# WOPI Office document editing. WOPI is disabled when discovery-url is empty.
+#wopi:
+#  discovery-url: "https://office.example.com/hosting/discovery"
+
 # Search configuration
 search:
   enabled: false

docs/site/.vitepress/config.ts

@@ -110,6 +110,7 @@ const enSidebar = [
     items: [
       { text: 'Search', link: '/features/search' },
       { text: 'WebDAV Access', link: '/features/webdav' },
+      { text: 'Office Editing with WOPI', link: '/features/wopi' },
       { text: 'File Buckets', link: '/features/file-buckets' },
       { text: 'Site Settings', link: '/features/site-settings' },
       { text: 'Custom Themes', link: '/features/custom-themes' },
@@ -171,6 +172,7 @@ const zhSidebar = [
     items: [
       { text: '搜索与索引', link: '/zh-CN/features/search' },
       { text: 'WebDAV 访问', link: '/zh-CN/features/webdav' },
+      { text: 'WOPI Office 编辑', link: '/zh-CN/features/wopi' },
       { text: '文件桶', link: '/zh-CN/features/file-buckets' },
       { text: '站点设置', link: '/zh-CN/features/site-settings' },
       { text: '自定义主题', link: '/zh-CN/features/custom-themes' },

docs/site/configuration/index.md

@@ -63,6 +63,9 @@ auth:
 #   allow-anonymous: false
 #   max-cache-items: 1000
 
+# wopi:
+#   discovery-url: https://office.example.com/hosting/discovery
+
 search:
   enabled: false
   type: sqlite
@@ -137,11 +140,12 @@ auth:
 
 Handler types are `image`, `text`, and `shell`. Shell handlers accept `shell`, `mime-type`, `write-content`, `max-size`, `timeout`, and related settings; see [Preview and thumbnails](../features/preview-thumbnail.html). The official Docker configuration enables libvips and ffmpeg. Extract the configuration from the image to get those templates.
 
-## WebDAV, search, and cache
+## WebDAV, WOPI, search, and cache
 
 - WebDAV is disabled by default. `allow-anonymous` remains subject to path permissions; test anonymous access before public deployment.
 - The current search engine is `sqlite`; the old `bleve` setting is invalid.
 - `web-dav.max-cache-items` limits the WebDAV file-object cache.
+- WOPI is disabled when `wopi.discovery-url` is empty. The URL must point to the Office service discovery XML.
 - The global `cache` currently uses an in-memory implementation; `clean-period` controls periodic cleanup.
 
 See also:
@@ -150,3 +154,4 @@ See also:
 - [Security guide](./security.html)
 - [Search and indexing](../features/search.html)
 - [WebDAV](../features/webdav.html)
+- [Office editing with WOPI](../features/wopi.html)

docs/site/features/wopi.md

@@ -0,0 +1,59 @@
+---
+title: Office Editing with WOPI
+description: Connect go-drive to a self-hosted Collabora Online service for browser-based Office document viewing and editing.
+lang: en
+translation_key: wopi
+---
+
+# Office Editing with WOPI
+
+go-drive implements the WOPI host endpoints needed to view and edit documents with a discovery-compatible Office service. The initial supported deployment target is self-hosted Collabora Online.
+
+## Enable WOPI
+
+Configure the discovery document exposed by the Office service:
+
+```yaml
+wopi:
+  discovery-url: https://office.example.com/hosting/discovery
+```
+
+Restart go-drive. The Web UI obtains supported file extensions and `view`/`edit` actions from discovery and displays **Open in Office** for matching files. Missing or empty `discovery-url` disables WOPI.
+
+The discovery endpoint must be reachable from the go-drive process. Conversely, the Office service must be able to reach every public go-drive domain used to open documents.
+
+## Reverse proxy and multiple domains
+
+go-drive creates a WOPISrc from the browser's current `Origin`, so one instance can be opened through more than one domain without a fixed public URL setting. For every public domain:
+
+- Use HTTPS in production.
+- Preserve the original `Host` header when proxying to go-drive.
+- Route `api-path/wopi/*` to the same go-drive instance.
+- Allow that host or alias in the Collabora `alias_groups` configuration.
+
+The browser `Origin` must match the request `Host`. A proxy that rewrites `Host` to an internal service name will cause session creation to fail.
+
+For a subpath deployment, configure `api-path` normally. For example, `api-path: /drive` produces WOPI endpoints below `/drive/wopi/`.
+
+## Authentication and permissions
+
+Only signed-in users can open the Office handler. A separate random WOPI token is issued for one user and one file; the normal go-drive login token is not sent to the Office service. Each WOPI callback reloads the user and passes through the normal user/group root, path-permission, and path-metadata wrappers.
+
+WOPI sessions expire after 10 hours. Tokens and locks are process-local, so restarting go-drive invalidates open editors and requires users to reopen the document.
+
+## Lock scope and external changes
+
+WOPI locks coordinate WOPI clients only. They do not block:
+
+- WebDAV writes;
+- normal Web UI uploads or text editing;
+- automated jobs; or
+- direct changes in an underlying third-party storage service.
+
+When a WOPI lock is created, go-drive records a version derived from the underlying entry's path, modification time, and size. If those values change before a WOPI save, `PutFile` returns a conflict instead of silently overwriting the external change. This is best-effort: a backend that doesn't report reliable modification times cannot provide complete conflict detection.
+
+Locks expire after 30 minutes unless refreshed. Sessions and locks are not shared between multiple go-drive processes; use one application instance when WOPI editing is enabled.
+
+## Compatibility boundary
+
+The implementation includes CheckFileInfo, GetFile, PutFile, PutRelativeFile, Lock, GetLock, RefreshLock, Unlock, and UnlockAndRelock. It doesn't currently validate Microsoft proof keys. Microsoft 365 for the web also requires Cloud Storage Partner Program onboarding, registered domains, and stricter global conflict handling; use Collabora Online as the supported deployment target for this version.

docs/site/zh-CN/configuration/index.md

@@ -3,7 +3,7 @@ title: 配置文件参考
 description: 查阅 go-drive 的网络、数据库、存储、搜索、WebDAV、缩略图、自动任务和安全配置选项。
 lang: zh-CN
 translation_key: configuration
-source_hash: 507e3efd917833d29527a148c1209165a1c9fb98ed3aafbe81cdd0cb6d79af89
+source_hash: e5d11df81b2fa48741c917e58e1f5ea7b4d6df4c221e17c2e3e08408a2dc5474
 ---
 
 # 配置文件参考
@@ -64,6 +64,9 @@ auth:
 #   allow-anonymous: false
 #   max-cache-items: 1000
 
+# wopi:
+#   discovery-url: https://office.example.com/hosting/discovery
+
 search:
   enabled: false
   type: sqlite
@@ -138,11 +141,12 @@ auth:
 
 处理器类型为 `image`、`text` 或 `shell`。Shell 处理器支持 `shell`、`mime-type`、`write-content`、`max-size` 和 `timeout` 等配置，详见[预览与缩略图](../features/preview-thumbnail.html)。官方 Docker 镜像中的配置会启用 libvips/ffmpeg；从镜像提取配置可以获得对应模板。
 
-## WebDAV、搜索和缓存
+## WebDAV、WOPI、搜索和缓存
 
 - WebDAV 默认关闭。`allow-anonymous` 仍受路径权限约束；公开启用前务必测试匿名权限。
 - 搜索器当前为 `sqlite`，旧的 `bleve` 配置已经无效。
 - `web-dav.max-cache-items` 控制 WebDAV 文件对象缓存上限。
+- `wopi.discovery-url` 为空时关闭 WOPI；该 URL 必须指向 Office 服务的 discovery XML。
 - 全局 `cache` 当前使用内存实现，`clean-period` 控制定期清理周期。
 
 更多内容：
@@ -151,3 +155,4 @@ auth:
 - [安全指南](./security.html)
 - [搜索与索引](../features/search.html)
 - [WebDAV](../features/webdav.html)
+- [通过 WOPI 编辑 Office 文档](../features/wopi.html)

docs/site/zh-CN/features/wopi.md

@@ -0,0 +1,60 @@
+---
+title: 通过 WOPI 编辑 Office 文档
+description: 将 go-drive 连接到自托管 Collabora Online，在浏览器中查看和编辑 Office 文档。
+lang: zh-CN
+translation_key: wopi
+source_hash: 344670fca042f98d0a129647b1889e67bbbb9ab09f7be82f5d19a392bf0591da
+---
+
+# 通过 WOPI 编辑 Office 文档
+
+go-drive 实现了查看和编辑文档所需的 WOPI Host 接口，可连接提供标准 discovery 的 Office 服务。当前首个受支持的部署目标是自托管 Collabora Online。
+
+## 启用 WOPI
+
+配置 Office 服务暴露的 discovery 文档：
+
+```yaml
+wopi:
+  discovery-url: https://office.example.com/hosting/discovery
+```
+
+重启 go-drive。Web 界面会从 discovery 获取支持的扩展名和 `view`/`edit` action，并为匹配文件显示“使用 Office 打开”。未配置或留空 `discovery-url` 时关闭 WOPI。
+
+go-drive 进程必须能访问 discovery 地址；反过来，Office 服务也必须能访问用户打开文档时使用的每个 go-drive 公网域名。
+
+## 反向代理和多域名
+
+go-drive 根据浏览器当前 `Origin` 生成 WOPISrc，因此同一实例可以通过多个域名访问，不需要固定的公网 URL 配置。每个公网域名都需要：
+
+- 生产环境使用 HTTPS；
+- 反向代理保留原始 `Host` 请求头；
+- 将 `api-path/wopi/*` 转发到同一个 go-drive 实例；
+- 在 Collabora 的 `alias_groups` 中允许对应 host 或 alias。
+
+浏览器 `Origin` 必须与请求 `Host` 一致。如果代理把 `Host` 改写成内部服务名，创建编辑会话会失败。
+
+子路径部署仍按正常方式配置 `api-path`。例如 `api-path: /drive` 会把 WOPI 接口放在 `/drive/wopi/` 下。
+
+## 身份认证和权限
+
+只有已登录用户才能打开 Office Handler。go-drive 会针对单个用户和单个文件签发独立的随机 WOPI token，普通登录 token 不会发送给 Office 服务。每次 WOPI 回调都会重新加载用户，并经过正常的用户/组根路径、路径权限和路径属性包装层。
+
+WOPI 会话在 10 小时后过期。token 和锁只保存在当前进程中；重启 go-drive 会使已打开的编辑器失效，用户需要重新打开文档。
+
+## 锁范围和外部修改
+
+WOPI 锁只协调 WOPI 客户端，不会阻止：
+
+- WebDAV 写入；
+- 普通 Web UI 上传或文本编辑；
+- 自动任务；
+- 直接修改底层第三方存储中的文件。
+
+创建 WOPI 锁时，go-drive 会根据底层条目的路径、修改时间和大小记录一个版本。WOPI 保存前如果这些值发生变化，`PutFile` 会返回冲突，而不是静默覆盖外部修改。这只是尽力检测：如果后端不能提供可靠的修改时间，就无法完整发现冲突。
+
+锁在 30 分钟内没有刷新就会过期。多个 go-drive 进程之间不会共享会话和锁；启用 WOPI 编辑时应使用单个应用实例。
+
+## 兼容性边界
+
+当前实现包括 CheckFileInfo、GetFile、PutFile、PutRelativeFile、Lock、GetLock、RefreshLock、Unlock 和 UnlockAndRelock，暂未校验 Microsoft proof key。Microsoft 365 for the web 还要求加入 Cloud Storage Partner Program、登记域名并提供更严格的全局冲突处理；此版本应使用 Collabora Online 作为受支持的部署目标。