Session is not dropped/closed when document is updated through other mean than OnlyOffice causing split sessions and potentiel data loss

[unteem]

We managed to end up in situations where sessions on a document are splitted. Users end up editing the same document but not seeing each others. It can cause some data loss, one version of the document wins at the end.

To replicate: UserA opens a document in onlyoffice. UserB uploads a document with same name in nextcloud UserC opens document in onlyoffice

UserA can still edit document in onlyoffice but is not on the same session than UserC. Both can edit the document without seeing each other. One version of the document will end up being saved.

(it can also happens with client sync, if i'm editing the document locally and force save it while my sync client is activated)

We manages to identify where it could be fixed. When document updated/deleted/version restored, the line in onlyoffice_filekey mapping the fileid with an onlyoffice key is dropped. When document is opened by another user a new line is created, the initial user ends up being in a kind of ghost session. Solution would be to drop the session in the hooks https://github.com/ONLYOFFICE/onlyoffice-nextcloud/blob/master/lib/hooks.php#L110-L200

We are not sure though what should be the best approach to fix it. We tried to use the drop session api but in our tests session is dropped, user cannot edit for a few seconds but ends up still being able to edit afterwards and still not being on the same session. Is there a way to completely disconnect the user and force to reload the page ? Like when my connection is dropped, onlyoffice/nextcloud is down and reconnects ? In those situations we get a warning and are forced to reload the page. Is there an api call in onlyoffice to do that and that we could call in the hooks ?

One alternative is to use the file_locks app that is now implemented in this app for NC24. When versioning is enabled we can still find edits from both users but its not ideal, there are 2 different versions that need to be merged afterwards.

Nevertheless we think that closing the session in the hooks should be done anyway and would avoid this kind of situation, it seems to be a good practice.

If you can point us to the right direction we would be happy to provide a PR.

Thanks for your help