diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
new file mode 100644
index 00000000..24c5fba6
--- /dev/null
+++ b/.github/workflows/phpunit.yml
@@ -0,0 +1,202 @@
+# Based on the organization's phpunit-*.yml templates
+# (https://github.com/nextcloud/.github), merged into one workflow: the
+# integration suite needs OFFICE_TEST_BASE_URL and runs once per database.
+#
+# SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: MIT
+
+name: PHPUnit
+
+on: pull_request
+
+permissions:
+  contents: read
+
+concurrency:
+  group: phpunit-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  changes-and-matrix:
+    runs-on: ubuntu-latest-low
+    permissions:
+      contents: read
+      pull-requests: read
+
+    outputs:
+      src: ${{ steps.changes.outputs.src }}
+      php-versions: ${{ steps.versions.outputs.php-available-list }}
+      php-max: ${{ steps.versions.outputs.php-max }}
+      server-max: ${{ steps.versions.outputs.branches-max }}
+
+    steps:
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        id: changes
+        continue-on-error: true
+        with:
+          filters: |
+            src:
+              - '.github/workflows/**'
+              - 'appinfo/**'
+              - 'lib/**'
+              - 'templates/**'
+              - 'tests/**'
+              - 'vendor-bin/**'
+              - 'composer.json'
+              - 'composer.lock'
+
+      - name: Checkout app
+        if: steps.changes.outputs.src != 'false'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Get version matrix
+        if: steps.changes.outputs.src != 'false'
+        id: versions
+        uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
+
+  unit:
+    runs-on: ubuntu-latest
+
+    needs: changes-and-matrix
+    if: needs.changes-and-matrix.outputs.src != 'false'
+
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ${{ fromJson(needs.changes-and-matrix.outputs.php-versions) }}
+
+    name: Unit PHP ${{ matrix.php-versions }}
+
+    steps:
+      - name: Checkout app
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up php ${{ matrix.php-versions }}
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: ctype, json, mbstring, openssl, simplexml
+          coverage: none
+          ini-file: development
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install composer dependencies
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+
+      - name: PHPUnit
+        run: composer run test:unit
+
+  integration:
+    runs-on: ubuntu-latest
+
+    needs: changes-and-matrix
+    if: needs.changes-and-matrix.outputs.src != 'false'
+
+    strategy:
+      fail-fast: false
+      matrix:
+        database: ['sqlite', 'mysql', 'pgsql']
+
+    name: Integration ${{ matrix.database }} PHP ${{ needs.changes-and-matrix.outputs.php-max }} Nextcloud ${{ needs.changes-and-matrix.outputs.server-max }}
+
+    # Both start in every job; only the matrix database is used.
+    services:
+      mysql:
+        image: ghcr.io/nextcloud/continuous-integration-mysql-8.4:latest # zizmor: ignore[unpinned-images]
+        ports:
+          - 4444:3306/tcp
+        env:
+          MYSQL_ROOT_PASSWORD: rootpassword
+        options: --health-cmd="mysqladmin ping" --health-interval 5s --health-timeout 2s --health-retries 10
+      postgres:
+        image: ghcr.io/nextcloud/continuous-integration-postgres-16:latest # zizmor: ignore[unpinned-images]
+        ports:
+          - 4445:5432/tcp
+        env:
+          POSTGRES_USER: root
+          POSTGRES_PASSWORD: rootpassword
+          POSTGRES_DB: nextcloud
+        options: --health-cmd pg_isready --health-interval 5s --health-timeout 2s --health-retries 5
+
+    steps:
+      - name: Checkout server
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          submodules: true
+          repository: nextcloud/server
+          ref: ${{ needs.changes-and-matrix.outputs.server-max }}
+
+      - name: Checkout app
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          path: apps/office
+
+      - name: Set up php ${{ needs.changes-and-matrix.outputs.php-max }}
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: ${{ needs.changes-and-matrix.outputs.php-max }}
+          # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
+          extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite, mysql, pdo_mysql, pgsql, pdo_pgsql
+          coverage: none
+          ini-file: development
+          # Temporary workaround for missing pcntl_* in PHP 8.3
+          ini-values: disable_functions=
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install composer dependencies
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+        with:
+          working-directory: apps/office
+
+      - name: Set up Nextcloud
+        env:
+          DATABASE: ${{ matrix.database }}
+        run: |
+          case "$DATABASE" in
+            mysql) db_args=(--database-host=127.0.0.1 --database-port=4444) ;;
+            pgsql) db_args=(--database-host=127.0.0.1 --database-port=4445) ;;
+            *) db_args=() ;;
+          esac
+          mkdir data
+          ./occ maintenance:install --verbose --database="$DATABASE" --database-name=nextcloud --database-user=root --database-pass=rootpassword "${db_args[@]}" --admin-user admin --admin-pass admin
+          ./occ app:enable --force office
+
+      - name: Run Nextcloud
+        env:
+          PHP_CLI_SERVER_WORKERS: 4
+        run: php -S localhost:8080 &
+
+      - name: PHPUnit integration
+        working-directory: apps/office
+        env:
+          NEXTCLOUD_ROOT: ${{ github.workspace }}
+          OFFICE_TEST_BASE_URL: http://localhost:8080
+          # composer stops scripts after 300 s by default
+          COMPOSER_PROCESS_TIMEOUT: 0
+        run: composer run test:integration
+
+      - name: Print logs
+        if: always()
+        run: cat data/nextcloud.log
+
+  summary:
+    permissions:
+      contents: none
+    runs-on: ubuntu-latest-low
+    needs: [changes-and-matrix, unit, integration]
+
+    if: always()
+
+    name: phpunit-summary
+
+    steps:
+      - name: Summary status
+        run: if ${{ needs.changes-and-matrix.outputs.src != 'false' && (needs.unit.result != 'success' || needs.integration.result != 'success') }}; then exit 1; fi
diff --git a/README.md b/README.md
index 15f0a1ff..18b3d54c 100644
--- a/README.md
+++ b/README.md
@@ -1,19 +1,20 @@
 # Office
 
-A Nextcloud app that provides a dedicated hub for office documents. Users can browse,
-filter, search, and create Documents, Spreadsheets, Presentations, and Diagrams from
-a single page — without going through the Files app.
+A Nextcloud app that integrates Euro-Office as a WOPI host, providing a full-page
+editor and a document hub. Nextcloud acts as the WOPI host (file storage, token
+authority, lock manager); Euro-Office acts as the WOPI client (rendering, editing).
 
 ---
 
 ## Features
 
-- **Overview page** at `/apps/office` — categorised file list with sidebar navigation
-- **Filters** — All / Mine / Shared with me
-- **Search** — within the active category, with an "Open in Files" escape hatch
-- **View toggle** — Grid (thumbnail previews) or List, persisted per user
-- **Template creator** — create new files from editor-provided templates
-- **Editor integration** — opens files directly in the configured office editor
+- **Full-page editor** at `/apps/office/open?fileId=N`
+- **Document overview** — browse, filter, search, and create office documents
+- **WOPI host implementation** — see [WOPI spec compliance](#wopi-spec-compliance) below
+- **Files app integration** — DEFAULT file action for all MIME types advertised by the editor
+- **Public share support** — guest tokens for link-share access
+- **Range reads** — partial file delivery via HTTP Range for large documents
+- **Conflict-free close** — editor close returns the user to the overview via `history.back()`
 
 ---
 
@@ -22,8 +23,9 @@ a single page — without going through the Files app.
 ### Requirements
 
 - [nextcloud-docker-dev](https://github.com/juliushaertl/nextcloud-docker-dev)
-- NC ≥ 33
-- Node 24 / npm 11
+- NC ≥ 31
+- Node ≥ 24 / npm ≥ 11
+- Euro-Office server reachable from the NC container
 
 ### 1. Mount the app into the container
 
@@ -41,8 +43,14 @@ Restart the container after saving.
 ### 2. Enable the app
 
 ```bash
-docker exec -u www-data nextcloud-docker-dev-nextcloud-1 \
-  php occ app:enable office
+docker compose exec --user www-data nextcloud php occ app:enable office
+```
+
+If the Euro-Office connector app is also installed, disable it to prevent it from
+competing for the DEFAULT file action:
+
+```bash
+docker compose exec --user www-data nextcloud php occ app:disable eurooffice
 ```
 
 ### 3. Build the frontend
@@ -74,6 +82,20 @@ every component needs outside a running NC page
 stub. `src/test-utils/fixtures.ts` has `makeNode()`/`makeCreator()` factories
 for building test data. CI runs the suite on PRs via `test-unit.yml`.
 
+```bash
+composer test:unit          # PHPUnit against the OCP stubs, no server needed
+composer test:integration   # against a running Nextcloud with this app enabled
+OFFICE_IT_CONTAINER=nextcloud tests/run-integration.sh   # from the host, in the dev container
+```
+
+The integration runner takes `OFFICE_TEST_BASE_URL` (the URL the server answers on,
+default `http://localhost`) and `NEXTCLOUD_ROOT` (default `/var/www/html`). It starts
+its own stub editor, so no Euro-Office is needed. For the run it points `wopi_url` at
+the stub and clears `public_wopi_url`, `callback_url` and `wopi_allowlist`, and puts
+them back when phpunit exits; an interrupted run (Ctrl-C) leaves them changed. With
+`overwritehost` or `overwriteprotocol` set, `OFFICE_TEST_BASE_URL` must match them, or
+the signed WOPI requests get 403.
+
 ### 5. Committing changes
 
 Commit **source only** (`src/`, `lib/`, …) — do **not** commit the built
@@ -90,6 +112,73 @@ recompiled assets as a `chore(assets): Recompile assets` commit.
 
 ---
 
+## How it works
+
+### WOPI flow
+
+```
+Browser                  NC (WOPI host)                  Euro-Office (WOPI client)
+   |                          |                                   |
+   |  GET /apps/office/open   |                                   |
+   |------------------------->|                                   |
+   |                          | mint WOPI token (TokenManager)    |
+   |                          | build editor URL with wopisrc     |
+   |   editor iframe / page   |                                   |
+   |<-------------------------|                                   |
+   |                          |  GET /wopi/files/{id}?token=...  |
+   |                          |<----------------------------------|
+   |                          |  CheckFileInfo response           |
+   |                          |---------------------------------->|
+   |                          |  GET /wopi/files/{id}/contents   |
+   |                          |<----------------------------------|
+   |                          |  file bytes                       |
+   |                          |---------------------------------->|
+   |   ← editing session →    |                                   |
+   |                          |  POST /wopi/files/{id}/contents  |
+   |                          |<----------------------------------|
+   |                          |  204 No Content                   |
+   |                          |---------------------------------->|
+```
+
+### Key classes
+
+| Class | Responsibility |
+|---|---|
+| `EditorController` | Renders editor page; mints WOPI token; builds editor URL from discovery XML |
+| `WopiController` | WOPI protocol endpoint — handles all `/wopi/files/` requests |
+| `WopiAccessResolver` | Resolves a token to its file and current rights; share-link tokens through the live share |
+| `WopiProofMiddleware` / `WopiProofVerifier` | Require the editor's proof signature when discovery publishes keys |
+| `WopiAllowlistMiddleware` | Optional `wopi_allowlist` of editor addresses for the WOPI endpoints |
+| `TokenManager` | Creates and validates WOPI tokens; manages token TTL and guest vs user access |
+| `DiscoveryService` | Fetches and caches the editor's discovery XML; resolves MIME → action URL |
+| `ShareController` | Issues guest tokens for public share links |
+| `WopiMapper` / `WopiLockMapper` | Persistence for WOPI tokens and file locks |
+| `CleanupJob` | Background job — expires stale locks and tokens |
+
+---
+
+## Who may call the WOPI endpoints
+
+The WOPI routes are public: the access token authorises the request. Because the token
+is in the page of whoever opened the document, the app also checks the caller:
+
+- **Proof keys.** When the editor's discovery publishes a `<proof-key>`, every WOPI
+  request must carry a valid `X-WOPI-Proof` / `X-WOPI-ProofOld` signature and an
+  `X-WOPI-TimeStamp` no older than 20 minutes, or it gets 403. Collabora always signs;
+  Euro-Office signs when its WOPI keys are configured (its images generate them with
+  `WOPI_ENABLED=true`, the same switch that turns WOPI on). The integration tests run
+  against a stub editor that publishes a proof key and signs their requests.
+- **Allowlist.** `occ config:app:set office wopi_allowlist --value="10.0.0.0/24 192.0.2.7"`
+  restricts the WOPI endpoints to those addresses (IPs or CIDR ranges); empty leaves
+  them open.
+
+With neither, the admin page shows a warning. The keys are remembered in app config and
+rechecked hourly; a proof that doesn't verify triggers one reread (at most every 5
+minutes) to pick up regenerated keys. Verification uses the phpseclib 3 that Nextcloud
+ships.
+
+---
+
 ## Editor integration
 
 The overview opens files via NC's file shortlink (`/f/{fileid}`), which
@@ -103,7 +192,64 @@ present, navigates directly to that URL instead of `/f/{fileid}`.
 
 ---
 
-## Architecture
+## WOPI spec compliance
+
+### Operations
+
+| Operation | `X-WOPI-Override` | Status | Notes |
+|---|---|---|---|
+| CheckFileInfo | — | ✅ | `GET /wopi/files/{id}` |
+| GetFile | — | ✅ | `GET /wopi/files/{id}/contents`; HTTP Range supported |
+| PutFile | — | ✅ | `POST /wopi/files/{id}/contents`; lock-enforced, optimistic version check, quota check |
+| Lock | `LOCK` | ✅ | |
+| Unlock | `UNLOCK` | ✅ | |
+| RefreshLock | `REFRESH_LOCK` | ✅ | |
+| GetLock | `GET_LOCK` | ✅ | |
+| UnlockAndRelock | `LOCK` + `X-WOPI-OldLock` | ✅ | |
+| RenameFile | `RENAME_FILE` | ✅ | Authenticated users only; conflict returns 400 + `X-WOPI-InvalidFileNameError` |
+| PutRelativeFile | `PUT_RELATIVE_FILE` | ⏳ Phase 6 | `UserCanNotWriteRelative: true` suppresses Save As in the editor UI |
+| DeleteFile | `DELETE` | — | Deletion is handled by NC outside WOPI |
+
+### CheckFileInfo capability flags
+
+| Flag | Value | Notes |
+|---|---|---|
+| `SupportsUpdate` | `true` | PutFile is implemented |
+| `SupportsLocks` | `true` | Locks are stored by the app (`office_wopi_locks`), independent of any NC lock provider |
+| `SupportsGetLock` | `true` | GetLock is implemented |
+| `SupportsExtendedLockLength` | `true` | `lock_id` column is `VARCHAR(1024)` |
+| `SupportsRename` | per session | `true` for user tokens; `false` for share-link tokens, including logged-in users whose only access is the link |
+| `UserCanRename` | per session | `true` for user tokens; `false` for share-link tokens, including logged-in users whose only access is the link |
+| `UserCanNotWriteRelative` | `true` | PutRelativeFile deferred to Phase 6 |
+| `UserCanWrite` | per request | the token's write right, narrowed to the share's current permissions for share-link sessions |
+| `IsAnonymousUser` | per session | `true` when no Nextcloud user is behind the session (anonymous share-link visitors) |
+| `HasContentRange` | `true` | partial file reads via HTTP Range are supported |
+| `HideExportOption` | per request | the token's flag or the share's current `hide_download` |
+| `DisablePrint` | per request | the token's flag or the share's current `hide_download` |
+| `DisableExport` | per request | the token's flag or the share's current `hide_download` |
+
+---
+
+## Public share support
+
+Share link visitors (`/s/{token}`) receive a share-link WOPI token via `ShareController`,
+bound to the share. File access, locking, and `CheckFileInfo` flags (`HideExportOption`,
+`DisablePrint`, `UserCanWrite`, etc.) follow the share's current permissions and
+`hide_download` flag on every request.
+
+**Known gaps:**
+
+- **KG1** — Password-protected shares: users must authenticate at `/s/{token}` before
+  navigating to the editor.
+- **KG2** — Authenticated users arriving through share links get a user token when the
+  file is in their own folder, and otherwise a share-link token that names them (after the
+  link password, if the share has one). Versions and activity don't record them as the
+  author yet: WOPI requests set no user scope.
+- **KG3** — Federated/remote shares not tested.
+
+---
+
+## Frontend architecture
 
 ```
 /apps/office
@@ -120,3 +266,14 @@ present, navigates directly to that URL instead of `/f/{fileid}`.
                 ├── fileCategories.ts  Mime → category mapping (pure)
                 └── validateFilename.ts
 ```
+
+---
+
+## Backend architecture notes
+
+The WOPI token row (`oc_office_wopi`) stamps `canwrite` and `hideDownload` when the
+token is issued. `WopiAccessResolver` resolves each request's file and effective
+rights: user tokens through the editor's own folder; share-link tokens (with a
+`share_token`) through the live share, as richdocuments does, so deleting, expiring
+or narrowing a share takes effect on the next WOPI request rather than when the
+token expires (10 h).
diff --git a/appinfo/info.xml b/appinfo/info.xml
index 6e5846a1..47c44b2a 100644
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -5,7 +5,7 @@
 	<name>Office</name>
 	<summary>Office overview</summary>
 	<description>Office overview app for Nextcloud</description>
-	<version>2.0.0-dev.0</version>
+	<version>2.0.0-dev.1</version>
 	<licence>AGPL-3.0-or-later</licence>
 	<author mail="jus@bitgrid.net">Julius Knorr</author>
 	<namespace>Office</namespace>
@@ -14,6 +14,12 @@
 	<dependencies>
 		<nextcloud min-version="36" max-version="36"/>
 	</dependencies>
+	<background-jobs>
+		<job>OCA\Office\BackgroundJob\CleanupJob</job>
+	</background-jobs>
+	<settings>
+		<admin>OCA\Office\Settings\Admin</admin>
+	</settings>
 	<navigations>
 		<navigation>
 			<id>office</id>
diff --git a/composer.json b/composer.json
index b09b3a19..38333c86 100644
--- a/composer.json
+++ b/composer.json
@@ -13,6 +13,11 @@
 			"OCA\\Office\\": "lib/"
 		}
 	},
+	"autoload-dev": {
+		"psr-4": {
+			"OCA\\Office\\Tests\\": "tests/"
+		}
+	},
 	"scripts": {
 		"post-install-cmd": [
 			"@composer bin all install --ansi"
@@ -24,15 +29,17 @@
 		"cs:check": "php-cs-fixer fix --dry-run --diff",
 		"cs:fix": "php-cs-fixer fix",
 		"psalm": "psalm --threads=1 --no-cache",
-		"test:unit": "phpunit tests -c tests/phpunit.xml --colors=always --fail-on-warning --fail-on-risky",
+		"test:unit": "phpunit -c tests/phpunit.xml --colors=always --fail-on-warning --fail-on-risky",
+		"test:integration": "tests/run-integration.sh",
 		"openapi": "generate-spec",
 		"rector": "rector && composer cs:fix"
 	},
 	"require": {
-		"bamarni/composer-bin-plugin": "^1.8",
-		"php": "^8.3"
+		"php": "^8.3",
+		"bamarni/composer-bin-plugin": "^1.8"
 	},
 	"require-dev": {
+		"phpseclib/phpseclib": "^3.0.55",
 		"roave/security-advisories": "dev-latest"
 	},
 	"config": {
diff --git a/composer.lock b/composer.lock
index 38066726..bf0d318d 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "80d7fd270809770d111586f940b825a6",
+    "content-hash": "6740d3ca2d589c4a8d5d0a5334f14ae5",
     "packages": [
         {
             "name": "bamarni/composer-bin-plugin",
@@ -65,6 +65,235 @@
         }
     ],
     "packages-dev": [
+        {
+            "name": "paragonie/constant_time_encoding",
+            "version": "v3.1.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/paragonie/constant_time_encoding.git",
+                "reference": "d5b01a39b3415c2cd581d3bd3a3575c1ebbd8e77"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/paragonie/constant_time_encoding/zipball/d5b01a39b3415c2cd581d3bd3a3575c1ebbd8e77",
+                "reference": "d5b01a39b3415c2cd581d3bd3a3575c1ebbd8e77",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^8"
+            },
+            "require-dev": {
+                "infection/infection": "^0",
+                "nikic/php-fuzzer": "^0",
+                "phpunit/phpunit": "^9|^10|^11",
+                "vimeo/psalm": "^4|^5|^6"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "ParagonIE\\ConstantTime\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Paragon Initiative Enterprises",
+                    "email": "security@paragonie.com",
+                    "homepage": "https://paragonie.com",
+                    "role": "Maintainer"
+                },
+                {
+                    "name": "Steve 'Sc00bz' Thomas",
+                    "email": "steve@tobtu.com",
+                    "homepage": "https://www.tobtu.com",
+                    "role": "Original Developer"
+                }
+            ],
+            "description": "Constant-time Implementations of RFC 4648 Encoding (Base-64, Base-32, Base-16)",
+            "keywords": [
+                "base16",
+                "base32",
+                "base32_decode",
+                "base32_encode",
+                "base64",
+                "base64_decode",
+                "base64_encode",
+                "bin2hex",
+                "encoding",
+                "hex",
+                "hex2bin",
+                "rfc4648"
+            ],
+            "support": {
+                "email": "info@paragonie.com",
+                "issues": "https://github.com/paragonie/constant_time_encoding/issues",
+                "source": "https://github.com/paragonie/constant_time_encoding"
+            },
+            "time": "2025-09-24T15:06:41+00:00"
+        },
+        {
+            "name": "paragonie/random_compat",
+            "version": "v9.99.100",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/paragonie/random_compat.git",
+                "reference": "996434e5492cb4c3edcb9168db6fbb1359ef965a"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/paragonie/random_compat/zipball/996434e5492cb4c3edcb9168db6fbb1359ef965a",
+                "reference": "996434e5492cb4c3edcb9168db6fbb1359ef965a",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">= 7"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "4.*|5.*",
+                "vimeo/psalm": "^1"
+            },
+            "suggest": {
+                "ext-libsodium": "Provides a modern crypto API that can be used to generate random bytes."
+            },
+            "type": "library",
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Paragon Initiative Enterprises",
+                    "email": "security@paragonie.com",
+                    "homepage": "https://paragonie.com"
+                }
+            ],
+            "description": "PHP 5.x polyfill for random_bytes() and random_int() from PHP 7",
+            "keywords": [
+                "csprng",
+                "polyfill",
+                "pseudorandom",
+                "random"
+            ],
+            "support": {
+                "email": "info@paragonie.com",
+                "issues": "https://github.com/paragonie/random_compat/issues",
+                "source": "https://github.com/paragonie/random_compat"
+            },
+            "time": "2020-10-15T08:29:30+00:00"
+        },
+        {
+            "name": "phpseclib/phpseclib",
+            "version": "3.0.57",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/phpseclib/phpseclib.git",
+                "reference": "d17e0ddaeaf6f22f7e007cbb437d78792fe2a0e4"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/d17e0ddaeaf6f22f7e007cbb437d78792fe2a0e4",
+                "reference": "d17e0ddaeaf6f22f7e007cbb437d78792fe2a0e4",
+                "shasum": ""
+            },
+            "require": {
+                "paragonie/constant_time_encoding": "^1|^2|^3",
+                "paragonie/random_compat": "^1.4|^2.0|^9.99.99",
+                "php": ">=5.6.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "*"
+            },
+            "suggest": {
+                "ext-dom": "Install the DOM extension to load XML formatted public keys.",
+                "ext-gmp": "Install the GMP (GNU Multiple Precision) extension in order to speed up arbitrary precision integer arithmetic operations.",
+                "ext-libsodium": "SSH2/SFTP can make use of some algorithms provided by the libsodium-php extension.",
+                "ext-mcrypt": "Install the Mcrypt extension in order to speed up a few other cryptographic operations.",
+                "ext-openssl": "Install the OpenSSL extension in order to speed up a wide variety of cryptographic operations."
+            },
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "phpseclib/bootstrap.php"
+                ],
+                "psr-4": {
+                    "phpseclib3\\": "phpseclib/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Jim Wigginton",
+                    "email": "terrafrost@php.net",
+                    "role": "Lead Developer"
+                },
+                {
+                    "name": "Patrick Monnerat",
+                    "email": "pm@datasphere.ch",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Andreas Fischer",
+                    "email": "bantu@phpbb.com",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Hans-Jürgen Petrich",
+                    "email": "petrich@tronic-media.com",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Graham Campbell",
+                    "email": "graham@alt-three.com",
+                    "role": "Developer"
+                }
+            ],
+            "description": "PHP Secure Communications Library - Pure-PHP implementations of RSA, AES, SSH2, SFTP, X.509 etc.",
+            "homepage": "http://phpseclib.sourceforge.net",
+            "keywords": [
+                "BigInteger",
+                "aes",
+                "asn.1",
+                "asn1",
+                "blowfish",
+                "crypto",
+                "cryptography",
+                "encryption",
+                "rsa",
+                "security",
+                "sftp",
+                "signature",
+                "signing",
+                "ssh",
+                "twofish",
+                "x.509",
+                "x509"
+            ],
+            "support": {
+                "issues": "https://github.com/phpseclib/phpseclib/issues",
+                "source": "https://github.com/phpseclib/phpseclib/tree/3.0.57"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/terrafrost",
+                    "type": "github"
+                },
+                {
+                    "url": "https://www.patreon.com/phpseclib",
+                    "type": "patreon"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/phpseclib/phpseclib",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-08-26T12:13:21+00:00"
+        },
         {
             "name": "roave/security-advisories",
             "version": "dev-latest",
diff --git a/lib/AppInfo/Application.php b/lib/AppInfo/Application.php
index 68a60099..2258b46c 100644
--- a/lib/AppInfo/Application.php
+++ b/lib/AppInfo/Application.php
@@ -5,10 +5,15 @@
 namespace OCA\Office\AppInfo;
 
 use OCA\Office\Listener\AppMenuActionListener;
+use OCA\Office\Listener\LoadAdditionalScriptsListener;
+use OCA\Office\Middleware\WopiAllowlistMiddleware;
+use OCA\Office\Middleware\WopiProofMiddleware;
 use OCP\AppFramework\App;
 use OCP\AppFramework\Bootstrap\IBootContext;
 use OCP\AppFramework\Bootstrap\IBootstrap;
 use OCP\AppFramework\Bootstrap\IRegistrationContext;
+use OCP\AppFramework\Http\Events\BeforeTemplateRenderedEvent;
+use OCP\Collaboration\Resources\LoadAdditionalScriptsEvent;
 use OCP\Navigation\Events\LoadAdditionalEntriesEvent;
 
 final class Application extends App implements IBootstrap {
@@ -22,6 +27,12 @@ public function __construct() {
 	#[\Override]
 	public function register(IRegistrationContext $context): void {
 		$context->registerEventListener(LoadAdditionalEntriesEvent::class, AppMenuActionListener::class);
+		$context->registerEventListener(LoadAdditionalScriptsEvent::class, LoadAdditionalScriptsListener::class);
+		// Public share pages don't fire LoadAdditionalScriptsEvent.
+		$context->registerEventListener(BeforeTemplateRenderedEvent::class, LoadAdditionalScriptsListener::class);
+		// Cheap address check first, then the signature.
+		$context->registerMiddleware(WopiAllowlistMiddleware::class);
+		$context->registerMiddleware(WopiProofMiddleware::class);
 	}
 
 	#[\Override]
diff --git a/lib/BackgroundJob/CleanupJob.php b/lib/BackgroundJob/CleanupJob.php
new file mode 100644
index 00000000..03265293
--- /dev/null
+++ b/lib/BackgroundJob/CleanupJob.php
@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\BackgroundJob;
+
+use OCA\Office\Db\WopiLockMapper;
+use OCA\Office\Db\WopiMapper;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\BackgroundJob\TimedJob;
+
+final class CleanupJob extends TimedJob {
+	private const int BATCH_SIZE = 500;
+	// Bounds one run to 50 000 rows per table; anything left is picked up next hour.
+	private const int MAX_BATCHES = 100;
+
+	public function __construct(
+		ITimeFactory $time,
+		private WopiMapper $wopiMapper,
+		private WopiLockMapper $wopiLockMapper,
+	) {
+		parent::__construct($time);
+		$this->setInterval(3600); // run hourly
+	}
+
+	#[\Override]
+	protected function run(mixed $argument): void {
+		for ($i = 0; $i < self::MAX_BATCHES; $i++) {
+			$tokenIds = $this->wopiMapper->getExpiredTokenIds(self::BATCH_SIZE);
+			if ($tokenIds === []) {
+				break;
+			}
+			$this->wopiMapper->deleteByIds($tokenIds);
+		}
+
+		for ($i = 0; $i < self::MAX_BATCHES; $i++) {
+			$lockIds = $this->wopiLockMapper->getExpiredLockIds(self::BATCH_SIZE);
+			if ($lockIds === []) {
+				break;
+			}
+			$this->wopiLockMapper->deleteByIds($lockIds);
+		}
+	}
+}
diff --git a/lib/Controller/EditorController.php b/lib/Controller/EditorController.php
new file mode 100644
index 00000000..02f8df8a
--- /dev/null
+++ b/lib/Controller/EditorController.php
@@ -0,0 +1,105 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Controller;
+
+use OCA\Office\AppInfo\Application;
+use OCA\Office\Http\EditorPagePolicy;
+use OCA\Office\Service\DiscoveryService;
+use OCA\Office\TokenManager;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\Attribute\FrontpageRoute;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\Files\File;
+use OCP\Files\IRootFolder;
+use OCP\Files\NotFoundException;
+use OCP\Files\NotPermittedException;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use Psr\Log\LoggerInterface;
+
+final class EditorController extends Controller {
+	public function __construct(
+		string $appName,
+		IRequest $request,
+		private IRootFolder $rootFolder,
+		private TokenManager $tokenManager,
+		private DiscoveryService $discoveryService,
+		private IURLGenerator $urlGenerator,
+		private LoggerInterface $logger,
+		private ?string $userId,
+	) {
+		parent::__construct($appName, $request);
+	}
+
+	/**
+	 * Open a file in the WOPI editor.
+	 *
+	 * Returns an HTML page that embeds the editor in a full-screen iframe.
+	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
+	#[FrontpageRoute(verb: 'GET', url: '/open')]
+	public function open(int $fileId): TemplateResponse|JSONResponse {
+		try {
+			$userFolder = $this->rootFolder->getUserFolder((string)$this->userId);
+			$file = $userFolder->getFirstNodeById($fileId);
+
+			if (!$file instanceof File) {
+				return new JSONResponse(['error' => 'File not found'], \OCP\AppFramework\Http::STATUS_NOT_FOUND);
+			}
+
+			if (!$this->discoveryService->isAvailable()) {
+				return new JSONResponse(['error' => 'Editor server unavailable'], \OCP\AppFramework\Http::STATUS_SERVICE_UNAVAILABLE);
+			}
+
+			$extension = pathinfo($file->getName(), PATHINFO_EXTENSION);
+			$urlsrc = $this->discoveryService->getUrlSrc($extension, 'edit')
+				?? $this->discoveryService->getUrlSrc($extension, 'view');
+
+			if ($urlsrc === null) {
+				return new JSONResponse(
+					['error' => 'File type not supported by the editor'],
+					\OCP\AppFramework\Http::STATUS_UNSUPPORTED_MEDIA_TYPE
+				);
+			}
+
+			$wopi = $this->tokenManager->generateToken($fileId);
+
+			$wopiSrc = $this->urlGenerator->linkToRouteAbsolute(
+				'office.wopi.checkFileInfo',
+				['fileId' => $fileId]
+			);
+
+			$editorUrl = $this->discoveryService->buildEditorUrl($urlsrc, $wopiSrc, $wopi->getToken());
+			$policy = EditorPagePolicy::forEditorUrl($editorUrl);
+
+		} catch (NotFoundException|NotPermittedException $e) {
+			$this->logger->warning($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse(['error' => 'File not accessible'], \OCP\AppFramework\Http::STATUS_FORBIDDEN);
+		} catch (\Throwable $e) {
+			$this->logger->error($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse(['error' => 'Internal error'], \OCP\AppFramework\Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		$response = new TemplateResponse(Application::APP_ID, 'editor', [], 'base');
+		$response->setParams([
+			'editorUrl' => $editorUrl,
+			// WOPI access_token_ttl: absolute expiry in milliseconds since the epoch.
+			'accessTokenTtl' => $wopi->getExpiry() * 1000,
+			'postMessageOrigin' => $wopi->getServerHost(),
+			'fileName' => $file->getName(),
+		]);
+		$response->setContentSecurityPolicy($policy);
+		return $response;
+	}
+}
diff --git a/lib/Controller/SettingsController.php b/lib/Controller/SettingsController.php
new file mode 100644
index 00000000..a12fa39d
--- /dev/null
+++ b/lib/Controller/SettingsController.php
@@ -0,0 +1,77 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Controller;
+
+use OCA\Office\AppInfo\Application;
+use OCA\Office\Service\DiscoveryService;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\FrontpageRoute;
+use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\IAppConfig;
+use OCP\IRequest;
+
+class SettingsController extends Controller {
+	public function __construct(
+		string $appName,
+		IRequest $request,
+		private IAppConfig $appConfig,
+		private DiscoveryService $discoveryService,
+	) {
+		parent::__construct($appName, $request);
+	}
+
+	/**
+	 * Return the current admin settings.
+	 *
+	 * Both routes are admin-only (no #[NoAdminRequired]): the URLs set here decide which
+	 * server Nextcloud sends requests to and trusts as the editor.
+	 */
+	#[NoCSRFRequired]
+	#[FrontpageRoute(verb: 'GET', url: '/settings/admin')]
+	public function getAdmin(): DataResponse {
+		return new DataResponse([
+			'wopi_url' => $this->appConfig->getValueString(Application::APP_ID, 'wopi_url', ''),
+			'public_wopi_url' => $this->appConfig->getValueString(Application::APP_ID, 'public_wopi_url', ''),
+			'callback_url' => $this->appConfig->getValueString(Application::APP_ID, 'callback_url', ''),
+			'disable_certificate_verification' => $this->appConfig->getValueString(Application::APP_ID, 'disable_certificate_verification', 'no'),
+		]);
+	}
+
+	/**
+	 * Persist admin settings.
+	 */
+	#[FrontpageRoute(verb: 'POST', url: '/settings/admin')]
+	public function setAdmin(string $wopi_url, string $public_wopi_url = '', string $callback_url = '', string $disable_certificate_verification = 'no'): DataResponse {
+		foreach (['wopi_url' => $wopi_url, 'public_wopi_url' => $public_wopi_url, 'callback_url' => $callback_url] as $field => $value) {
+			if ($value !== '') {
+				$parsed = parse_url($value);
+				if ($parsed === false || !in_array($parsed['scheme'] ?? '', ['http', 'https'], true)) {
+					return new DataResponse(['error' => "$field must use the http or https scheme"], Http::STATUS_BAD_REQUEST);
+				}
+				if (isset($parsed['user']) || isset($parsed['pass'])) {
+					return new DataResponse(['error' => "$field must not contain credentials"], Http::STATUS_BAD_REQUEST);
+				}
+			}
+		}
+
+		$this->appConfig->setValueString(Application::APP_ID, 'wopi_url', rtrim($wopi_url, '/'));
+		$this->appConfig->setValueString(Application::APP_ID, 'public_wopi_url', rtrim($public_wopi_url, '/'));
+		$this->appConfig->setValueString(Application::APP_ID, 'callback_url', rtrim($callback_url, '/'));
+		$this->appConfig->setValueString(Application::APP_ID, 'disable_certificate_verification', $disable_certificate_verification === 'yes' ? 'yes' : 'no');
+
+		// The discovery document depends on wopi_url; a settings change must not
+		// serve actions cached from the previous editor server for up to CACHE_TTL.
+		$this->discoveryService->resetCache();
+
+		return new DataResponse([]);
+	}
+}
diff --git a/lib/Controller/ShareController.php b/lib/Controller/ShareController.php
new file mode 100644
index 00000000..06c2fba8
--- /dev/null
+++ b/lib/Controller/ShareController.php
@@ -0,0 +1,256 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Controller;
+
+use OCA\Office\AppInfo\Application;
+use OCA\Office\Http\EditorPagePolicy;
+use OCA\Office\Service\DiscoveryService;
+use OCA\Office\TokenManager;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\AnonRateLimit;
+use OCP\AppFramework\Http\Attribute\BruteForceProtection;
+use OCP\AppFramework\Http\Attribute\FrontpageRoute;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\Attribute\PublicPage;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\AppFramework\Http\RedirectResponse;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\Files\File;
+use OCP\Files\Folder;
+use OCP\Files\NotFoundException;
+use OCP\Files\NotPermittedException;
+use OCP\IRequest;
+use OCP\ISession;
+use OCP\IURLGenerator;
+use OCP\IUserSession;
+use OCP\Share\Exceptions\ShareNotFound;
+use OCP\Share\IManager as IShareManager;
+use OCP\Share\IShare;
+use Psr\Log\LoggerInterface;
+
+final class ShareController extends Controller {
+	public function __construct(
+		string $appName,
+		IRequest $request,
+		private IShareManager $shareManager,
+		private ISession $session,
+		private IUserSession $userSession,
+		private TokenManager $tokenManager,
+		private DiscoveryService $discoveryService,
+		private IURLGenerator $urlGenerator,
+		private LoggerInterface $logger,
+	) {
+		parent::__construct($appName, $request);
+	}
+
+	/**
+	 * Open a file in the WOPI editor via a public share link.
+	 *
+	 * For folder shares, pass either $fileId or $path to identify the target file
+	 * within the shared folder.
+	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
+	#[PublicPage]
+	// Every successful call stores a 10 h WOPI token, and the route takes a guessable-length
+	// share token: limit anonymous callers and throttle guessing like core's share pages do.
+	#[AnonRateLimit(limit: 30, period: 60)]
+	#[BruteForceProtection(action: 'officeOpenShare')]
+	#[FrontpageRoute(verb: 'GET', url: '/open/share/{shareToken}')]
+	public function openShare(
+		string $shareToken,
+		?int $fileId = null,
+		?string $path = null,
+		?string $guestName = null,
+	): TemplateResponse|JSONResponse|RedirectResponse {
+		try {
+			$share = $this->shareManager->getShareByToken($shareToken);
+		} catch (ShareNotFound $e) {
+			$this->logger->debug('Share token not found: ' . $e->getMessage());
+			$response = new JSONResponse(['error' => 'Share not found'], Http::STATUS_NOT_FOUND);
+			$response->throttle(['action' => 'officeOpenShare']);
+			return $response;
+		}
+
+		// Password-protected share: NC core sets 'public_link_authenticated' in the session
+		// once the user has entered the password at /s/{token}. Check both legacy (string)
+		// and current (array of share IDs) formats, matching richdocuments' pattern.
+		// getPassword() returns null (not '') for a share with no password at all - both
+		// must be treated as "no password", or every passwordless share incorrectly
+		// redirects unauthenticated guests away instead of letting them through.
+		// (array) turns the legacy single-ID string into a one-element list and null into [].
+		$passwordPending = $share->getPassword() !== null && $share->getPassword() !== ''
+			&& !in_array($share->getId(), (array)$this->session->get('public_link_authenticated'), true);
+
+		// Logged-in users who can reach the file through their own folder skip the password below;
+		// everyone whose only access is this link has to pass it.
+		if ($passwordPending && !$this->userSession->isLoggedIn()) {
+			return $this->passwordChallenge($shareToken);
+		}
+
+		// Below, a logged-in user may still be pending the password: until it's entered, every
+		// failure leads to the challenge, so probing ?path= or ?fileId= reveals nothing.
+		if (($share->getPermissions() & \OCP\Constants::PERMISSION_READ) === 0) {
+			return $this->refuse($passwordPending, $shareToken, new JSONResponse(['error' => 'Share is not readable'], Http::STATUS_FORBIDDEN));
+		}
+
+		try {
+			$file = $this->resolveFile($share, $fileId, $path);
+		} catch (NotFoundException $e) {
+			return $this->refuse($passwordPending, $shareToken, new JSONResponse(['error' => 'File not found'], Http::STATUS_NOT_FOUND));
+		} catch (NotPermittedException $e) {
+			return $this->refuse($passwordPending, $shareToken, new JSONResponse(['error' => 'Access denied'], Http::STATUS_FORBIDDEN));
+		}
+
+		if (!$this->discoveryService->isAvailable()) {
+			return $this->refuse($passwordPending, $shareToken, new JSONResponse(['error' => 'Editor server unavailable'], Http::STATUS_SERVICE_UNAVAILABLE));
+		}
+
+		$extension = pathinfo($file->getName(), PATHINFO_EXTENSION);
+		$urlsrc = $this->discoveryService->getUrlSrc($extension, 'edit')
+			?? $this->discoveryService->getUrlSrc($extension, 'view');
+
+		if ($urlsrc === null) {
+			return $this->refuse($passwordPending, $shareToken, new JSONResponse(
+				['error' => 'File type not supported by the editor'],
+				Http::STATUS_UNSUPPORTED_MEDIA_TYPE,
+			));
+		}
+
+		$canWrite = (bool)($share->getPermissions() & \OCP\Constants::PERMISSION_UPDATE);
+		$ownerUid = $share->getShareOwner();
+
+		try {
+			$wopi = null;
+			$user = $this->userSession->getUser();
+			if ($user !== null) {
+				// Authenticated user visiting a share link: issue a full user token via their
+				// own folder. hideDownload is intentionally not applied — the share's download
+				// restriction targets unauthenticated third parties, not collaborators with
+				// direct NC access.
+				try {
+					$wopi = $this->tokenManager->generateToken($file->getId());
+				} catch (NotPermittedException) {
+					// The file isn't in their own folder: the link is their only access, so they
+					// get the same share-scoped token as a guest, under their own name.
+				}
+			}
+
+			if ($wopi === null) {
+				if ($passwordPending) {
+					return $this->passwordChallenge($shareToken);
+				}
+
+				$hideDownload = $share->getHideDownload();
+
+				// Sanitize guestName: strip control chars, cap at 64 chars, default to 'Guest'.
+				// Authenticated user's display name overrides guestName param to prevent spoofing.
+				$guestName = trim((string)preg_replace('/[\x00-\x1f\x7f]/u', '', $guestName ?? ''));
+				$guestName = mb_substr($guestName, 0, 64);
+				$displayName = $user?->getDisplayName() ?? ($guestName !== '' ? $guestName : 'Guest');
+
+				$wopi = $this->tokenManager->generateGuestToken(
+					fileId: $file->getId(),
+					ownerUid: $ownerUid,
+					shareToken: $share->getToken(),
+					editorUid: $user?->getUID(),
+					guestName: $displayName,
+					canWrite: $canWrite,
+					hideDownload: $hideDownload,
+				);
+			}
+		} catch (NotPermittedException $e) {
+			$this->logger->warning($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse(['error' => 'File not accessible'], Http::STATUS_FORBIDDEN);
+		} catch (\Throwable $e) {
+			$this->logger->error($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse(['error' => 'Internal error'], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		$wopiSrc = $this->urlGenerator->linkToRouteAbsolute(
+			'office.wopi.checkFileInfo',
+			['fileId' => $file->getId()],
+		);
+
+		$editorUrl = $this->discoveryService->buildEditorUrl($urlsrc, $wopiSrc, $wopi->getToken());
+
+		try {
+			$policy = EditorPagePolicy::forEditorUrl($editorUrl);
+		} catch (\InvalidArgumentException $e) {
+			$this->logger->error($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse(['error' => 'Internal error'], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		$response = new TemplateResponse(Application::APP_ID, 'editor', [], 'base');
+		$response->setParams([
+			'editorUrl' => $editorUrl,
+			// WOPI access_token_ttl: absolute expiry in milliseconds since the epoch.
+			'accessTokenTtl' => $wopi->getExpiry() * 1000,
+			'postMessageOrigin' => $wopi->getServerHost(),
+			'fileName' => $file->getName(),
+		]);
+		$response->setContentSecurityPolicy($policy);
+		return $response;
+	}
+
+	/**
+	 * Send the visitor to the share page to enter the password. After authenticating
+	 * there, they reopen the file action.
+	 */
+	private function passwordChallenge(string $shareToken): RedirectResponse {
+		return new RedirectResponse($this->urlGenerator->linkToRoute(
+			'files_sharing.sharecontroller.showShare',
+			['token' => $shareToken],
+		));
+	}
+
+	private function refuse(bool $passwordPending, string $shareToken, JSONResponse $error): JSONResponse|RedirectResponse {
+		return $passwordPending ? $this->passwordChallenge($shareToken) : $error;
+	}
+
+	/**
+	 * Resolve the target file from a share.
+	 *
+	 * For file shares: returns the shared node directly.
+	 * For folder shares: resolves by $fileId or $path within the shared folder.
+	 * NC throws NotFoundException on path traversal attempts — no extra guard needed.
+	 *
+	 * @throws NotFoundException
+	 * @throws NotPermittedException
+	 */
+	private function resolveFile(IShare $share, ?int $fileId, ?string $path): File {
+		$node = $share->getNode();
+
+		if ($node instanceof File) {
+			return $node;
+		}
+
+		if (!$node instanceof Folder) {
+			throw new NotFoundException('Share points to an unsupported node type');
+		}
+
+		if ($path !== null) {
+			$resolved = $node->get($path);
+		} elseif ($fileId !== null) {
+			// getFirstNodeById scoped to $node — cannot escape the shared folder boundary.
+			$resolved = $node->getFirstNodeById($fileId);
+		} else {
+			throw new NotFoundException('Folder share requires fileId or path parameter');
+		}
+
+		if (!$resolved instanceof File) {
+			throw new NotFoundException('Resolved node is not a file');
+		}
+
+		return $resolved;
+	}
+}
diff --git a/lib/Controller/WopiController.php b/lib/Controller/WopiController.php
new file mode 100644
index 00000000..15015928
--- /dev/null
+++ b/lib/Controller/WopiController.php
@@ -0,0 +1,635 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Controller;
+
+use OCA\Office\Db\Wopi;
+use OCA\Office\Db\WopiLockMapper;
+use OCA\Office\Db\WopiMapper;
+use OCA\Office\Exception\ExpiredTokenException;
+use OCA\Office\Exception\UnknownTokenException;
+use OCA\Office\Service\WopiAccess;
+use OCA\Office\Service\WopiAccessResolver;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\FrontpageRoute;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\Attribute\PublicPage;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\AppFramework\Http\StreamResponse;
+use OCP\Files\File;
+use OCP\Files\Lock\ILockManager;
+use OCP\Files\Lock\LockContext;
+use OCP\Files\Lock\NoLockProviderException;
+use OCP\Files\Lock\OwnerLockedException;
+use OCP\Files\NotFoundException;
+use OCP\Files\NotPermittedException;
+use OCP\IRequest;
+use OCP\IUserManager;
+use OCP\Lock\LockedException;
+use OCP\PreConditionNotMetException;
+use Psr\Log\LoggerInterface;
+
+class WopiController extends Controller {
+	private const int COOL_STATUS_DOC_CHANGED = 1010;
+
+	public function __construct(
+		string $appName,
+		IRequest $request,
+		private WopiAccessResolver $accessResolver,
+		private WopiMapper $wopiMapper,
+		private WopiLockMapper $wopiLockMapper,
+		private IUserManager $userManager,
+		private ILockManager $lockManager,
+		private LoggerInterface $logger,
+	) {
+		parent::__construct($appName, $request);
+	}
+
+	/**
+	 * WOPI CheckFileInfo — returns metadata about the file.
+	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
+	#[PublicPage]
+	#[FrontpageRoute(verb: 'GET', url: 'wopi/files/{fileId}')]
+	public function checkFileInfo(
+		int $fileId,
+		#[\SensitiveParameter]
+		string $access_token,
+	): JSONResponse {
+		try {
+			$wopi = $this->wopiMapper->getWopiForToken($access_token);
+			$access = $this->accessResolver->resolve($wopi);
+			$file = $access->file;
+		} catch (UnknownTokenException $e) {
+			$this->logger->debug($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		} catch (ExpiredTokenException $e) {
+			$this->logger->debug($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_UNAUTHORIZED);
+		} catch (NotFoundException|NotPermittedException $e) {
+			$this->logger->warning($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_NOT_FOUND);
+		} catch (\Throwable $e) {
+			$this->logger->error($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		if ($wopi->getFileid() !== $fileId) {
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		}
+
+		$isAnonymous = $wopi->isAnonymous();
+		$isShareSession = $wopi->isShareSession();
+		$user = $this->userManager->get($wopi->getEditorUid() ?? '');
+		$displayName = $isAnonymous
+			? ($wopi->getGuestDisplayname() ?? 'Guest')
+			: ($user?->getDisplayName() ?? $wopi->getEditorUid() ?? '');
+
+		$canWrite = $access->canWrite;
+
+		try {
+			$locks = $this->lockManager->getLocks($wopi->getFileid());
+			foreach ($locks as $lock) {
+				if ($lock->getType() === \OCP\Files\Lock\ILock::TYPE_USER && $lock->getOwner() !== $wopi->getEditorUid()) {
+					$canWrite = false;
+					break;
+				}
+			}
+		} catch (NoLockProviderException|PreConditionNotMetException) {
+		}
+
+		$hideDownload = $access->hideDownload;
+
+		return new JSONResponse([
+			'BaseFileName' => $file->getName(),
+			'Size' => $file->getSize(),
+			'Version' => (string)$file->getMTime(),
+			'UserId' => $isAnonymous ? 'Guest-' . substr(md5($wopi->getToken()), 0, 8) : $wopi->getEditorUid(),
+			'OwnerId' => $wopi->getOwnerUid(),
+			'UserFriendlyName' => $displayName,
+			'IsAnonymousUser' => $isAnonymous,
+			'UserCanWrite' => $canWrite,
+			// PutRelativeFile (Save As) deferred to Phase 6.
+			'UserCanNotWriteRelative' => true,
+			'PostMessageOrigin' => $wopi->getServerHost(),
+			'LastModifiedTime' => $this->toISO8601($file->getMTime()),
+			'SupportsUpdate' => true,
+			// WOPI locks live in office_wopi_locks, not in an NC lock provider, and PutFile requires one
+			// on non-empty files: clients only send LOCK when this is true, so it must not depend on files_lock.
+			'SupportsLocks' => true,
+			'SupportsGetLock' => true,
+			'SupportsExtendedLockLength' => true,
+			// Share-link sessions act on someone else's file through the link: no renaming or resharing,
+			// even for a logged-in visitor.
+			'SupportsRename' => !$isShareSession,
+			'UserCanRename' => !$isShareSession,
+			'EnableInsertRemoteImage' => !$isShareSession,
+			'EnableShare' => !$isShareSession,
+			'HideExportOption' => $hideDownload,
+			'DisablePrint' => $hideDownload,
+			'DisableExport' => $hideDownload,
+			'HideUserList' => '',
+			'EnableOwnerTermination' => $canWrite && !$isShareSession,
+			'HasContentRange' => true,
+			// ServerPrivateInfo is intentionally empty — credentials must never travel via CheckFileInfo.
+			'ServerPrivateInfo' => [],
+		]);
+	}
+
+	/**
+	 * WOPI GetFile — returns the binary content of the file.
+	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
+	#[PublicPage]
+	#[FrontpageRoute(verb: 'GET', url: 'wopi/files/{fileId}/contents')]
+	public function getFile(
+		int $fileId,
+		#[\SensitiveParameter]
+		string $access_token,
+	): Http\Response {
+		try {
+			$wopi = $this->wopiMapper->getWopiForToken($access_token);
+		} catch (UnknownTokenException $e) {
+			$this->logger->debug($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		} catch (ExpiredTokenException $e) {
+			$this->logger->debug($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_UNAUTHORIZED);
+		} catch (\Throwable $e) {
+			$this->logger->error($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		if ($wopi->getFileid() !== $fileId) {
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		}
+
+		$access = $this->resolveAccess($wopi);
+		if (!$access instanceof WopiAccess) {
+			return $access;
+		}
+		$file = $access->file;
+
+		if ($file->getSize() === 0) {
+			$empty = new Http\Response();
+			$empty->addHeader('Content-Type', 'application/octet-stream');
+			return $empty;
+		}
+
+		$rangeHeader = $this->request->getHeader('Range');
+		if ($rangeHeader !== '') {
+			return $this->getFileRange($file, $rangeHeader);
+		}
+
+		$resource = $file->fopen('rb');
+		if ($resource === false) {
+			return new JSONResponse(['message' => 'Could not open file for reading'], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+		$response = new StreamResponse($resource);
+		$response->addHeader('Content-Type', 'application/octet-stream');
+		return $response;
+	}
+
+	/**
+	 * WOPI PutFile — saves binary content sent by the editor.
+	 *
+	 * Nextcloud's advisory locking is acquired around the write so other
+	 * processes see a consistent file.
+	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
+	#[PublicPage]
+	#[FrontpageRoute(verb: 'POST', url: 'wopi/files/{fileId}/contents')]
+	public function putFile(
+		int $fileId,
+		#[\SensitiveParameter]
+		string $access_token,
+	): JSONResponse {
+		try {
+			$wopi = $this->wopiMapper->getWopiForToken($access_token);
+		} catch (UnknownTokenException $e) {
+			$this->logger->debug($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		} catch (ExpiredTokenException $e) {
+			$this->logger->debug($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_UNAUTHORIZED);
+		} catch (\Throwable $e) {
+			$this->logger->error($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		if ($wopi->getFileid() !== $fileId) {
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		}
+
+		$access = $this->resolveAccess($wopi);
+		if (!$access instanceof WopiAccess) {
+			return $access;
+		}
+		if (!$access->canWrite) {
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		}
+		$file = $access->file;
+
+		// Enforce WOPI lock: if a non-expired lock exists the client must supply the matching lock ID.
+		$lockId = $this->request->getHeader('X-WOPI-Lock');
+		$existingLock = $this->wopiLockMapper->findByFileId($fileId);
+		if ($existingLock !== null && !$existingLock->isExpired()) {
+			if ($lockId !== $existingLock->getLockId()) {
+				return $this->lockConflict($existingLock->getLockId(), 'File is locked');
+			}
+		}
+
+		// Per WOPI spec §3.3.5.3: a non-empty file must be locked before it can be saved.
+		if (($existingLock === null || $existingLock->isExpired()) && $file->getSize() > 0) {
+			return $this->lockConflict('', 'A lock is required to save a non-empty file');
+		}
+
+		// Editors echo back the LastModifiedTime from CheckFileInfo or the previous PutFile; a mismatch means
+		// the file changed outside this editing session. Collabora (X-COOL-WOPI-Timestamp) answers
+		// COOLStatusCode 1010 with a "document changed" prompt, as with richdocuments. Euro-Office
+		// (X-LOOL-WOPI-Timestamp) has no handling for it and only refreshes its timestamp from a successful
+		// PutFile, so a 409 would fail every later save of the session: write anyway, the previous content
+		// stays in the file's versions, and log the overwrite.
+		$coolTimestamp = $this->request->getHeader('X-COOL-WOPI-Timestamp');
+		$loolTimestamp = $this->request->getHeader('X-LOOL-WOPI-Timestamp');
+		if ($coolTimestamp !== '' && !$this->isCurrentTimestamp($coolTimestamp, $file)) {
+			$this->logger->info('Rejected save of file {fileId}: changed outside the editing session', ['fileId' => $fileId]);
+			return new JSONResponse(['COOLStatusCode' => self::COOL_STATUS_DOC_CHANGED], Http::STATUS_CONFLICT);
+		}
+		if ($coolTimestamp === '' && $loolTimestamp !== '' && !$this->isCurrentTimestamp($loolTimestamp, $file)) {
+			$this->logger->warning('Save of file {fileId} overwrites a change made outside the editing session', [
+				'fileId' => $fileId,
+				'editorTimestamp' => $loolTimestamp,
+				'fileTimestamp' => $this->toISO8601($file->getMTime()),
+			]);
+		}
+
+		$content = $this->openRequestBody();
+		if ($content === false) {
+			// putContent(false) would store an empty file in place of the document.
+			$this->logger->error('Could not read the PutFile request body for file {fileId}', ['fileId' => $fileId]);
+			return new JSONResponse([], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		try {
+			try {
+				$freespace = $file->getStorage()->free_space($file->getInternalPath());
+				$contentLength = (int)$this->request->getHeader('Content-Length');
+				if ($freespace >= 0 && $contentLength > $freespace) {
+					return new JSONResponse(['message' => 'Not enough storage'], Http::STATUS_INSUFFICIENT_STORAGE);
+				}
+
+				$this->writeWithLock($wopi, $file, static function () use ($file, $content): void {
+					$file->putContent($content);
+				});
+			} finally {
+				// putContent() may close the stream internally; guard to avoid a warning.
+				/** @psalm-suppress RedundantConditionGivenDocblockType psalm can't see putContent() closing it */
+				if (is_resource($content)) {
+					fclose($content);
+				}
+			}
+		} catch (LockedException $e) {
+			$this->logger->warning($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse(['message' => 'File locked'], Http::STATUS_CONFLICT);
+		} catch (\Throwable $e) {
+			$this->logger->error($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		$response = new JSONResponse(['LastModifiedTime' => $this->toISO8601($file->getMTime())]);
+		$response->addHeader('X-WOPI-ItemVersion', (string)$file->getMTime());
+		return $response;
+	}
+
+	/**
+	 * WOPI lock operations — all arrive as POST wopi/files/{fileId} with
+	 * an X-WOPI-Override header selecting the operation.
+	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
+	#[PublicPage]
+	#[FrontpageRoute(verb: 'POST', url: 'wopi/files/{fileId}')]
+	public function executeOperation(
+		int $fileId,
+		#[\SensitiveParameter]
+		string $access_token,
+	): Http\Response {
+		try {
+			$wopi = $this->wopiMapper->getWopiForToken($access_token);
+		} catch (UnknownTokenException $e) {
+			$this->logger->debug($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		} catch (ExpiredTokenException $e) {
+			$this->logger->debug($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_UNAUTHORIZED);
+		} catch (\Throwable $e) {
+			$this->logger->error($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		if ($wopi->getFileid() !== $fileId) {
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		}
+
+		$access = $this->resolveAccess($wopi);
+		if (!$access instanceof WopiAccess) {
+			return $access;
+		}
+		if (!$access->canWrite) {
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		}
+
+		$override = $this->request->getHeader('X-WOPI-Override');
+		$lockId = $this->request->getHeader('X-WOPI-Lock');
+
+		return match ($override) {
+			'LOCK' => $this->handleLock($fileId, $lockId),
+			'UNLOCK' => $this->handleUnlock($fileId, $lockId),
+			'REFRESH_LOCK' => $this->handleRefreshLock($fileId, $lockId),
+			'GET_LOCK' => $this->handleGetLock($fileId),
+			'RENAME_FILE' => $this->handleRenameFile($fileId, $wopi, $access->file),
+			default => new JSONResponse(['error' => 'Unsupported WOPI operation'], Http::STATUS_NOT_IMPLEMENTED),
+		};
+	}
+
+	private function handleLock(int $fileId, string $lockId): Http\Response {
+		if ($lockId === '') {
+			return new JSONResponse(['error' => 'X-WOPI-Lock is required'], Http::STATUS_BAD_REQUEST);
+		}
+
+		$oldLockId = $this->request->getHeader('X-WOPI-OldLock');
+		$existing = $this->wopiLockMapper->findByFileId($fileId);
+
+		if ($oldLockId !== '') {
+			// UnlockAndRelock: verify the old lock first, then replace with new.
+			if ($existing === null || $existing->isExpired() || $existing->getLockId() !== $oldLockId) {
+				$current = ($existing !== null && !$existing->isExpired()) ? $existing->getLockId() : '';
+				return $this->lockConflict($current, 'Lock mismatch on UnlockAndRelock');
+			}
+			$this->wopiLockMapper->upsertLock($fileId, $lockId);
+			return $this->lockOkResponse();
+		}
+
+		if ($existing !== null && !$existing->isExpired()) {
+			if ($existing->getLockId() !== $lockId) {
+				return $this->lockConflict($existing->getLockId(), 'File is locked by another client');
+			}
+			// Idempotent re-lock with same ID — refresh the TTL.
+			$this->wopiLockMapper->upsertLock($fileId, $lockId);
+			return $this->lockOkResponse();
+		}
+
+		$this->wopiLockMapper->upsertLock($fileId, $lockId);
+		return $this->lockOkResponse();
+	}
+
+	private function handleUnlock(int $fileId, string $lockId): Http\Response {
+		if ($lockId === '') {
+			return new JSONResponse(['error' => 'X-WOPI-Lock is required'], Http::STATUS_BAD_REQUEST);
+		}
+
+		$existing = $this->wopiLockMapper->findByFileId($fileId);
+
+		if ($existing === null || $existing->isExpired() || $existing->getLockId() !== $lockId) {
+			$current = ($existing !== null && !$existing->isExpired()) ? $existing->getLockId() : '';
+			return $this->lockConflict($current, 'Lock mismatch');
+		}
+
+		$this->wopiLockMapper->delete($existing);
+		return $this->lockOkResponse();
+	}
+
+	private function handleRefreshLock(int $fileId, string $lockId): Http\Response {
+		if ($lockId === '') {
+			return new JSONResponse(['error' => 'X-WOPI-Lock is required'], Http::STATUS_BAD_REQUEST);
+		}
+
+		$existing = $this->wopiLockMapper->findByFileId($fileId);
+
+		if ($existing === null || $existing->isExpired() || $existing->getLockId() !== $lockId) {
+			$current = ($existing !== null && !$existing->isExpired()) ? $existing->getLockId() : '';
+			return $this->lockConflict($current, 'Lock mismatch on RefreshLock');
+		}
+
+		$this->wopiLockMapper->upsertLock($fileId, $lockId);
+		return $this->lockOkResponse();
+	}
+
+	private function handleGetLock(int $fileId): Http\Response {
+		$existing = $this->wopiLockMapper->findByFileId($fileId);
+		$current = ($existing !== null && !$existing->isExpired()) ? $existing->getLockId() : '';
+
+		$response = new JSONResponse([]);
+		$response->addHeader('X-WOPI-Lock', $current);
+		return $response;
+	}
+
+	private function handleRenameFile(int $fileId, Wopi $wopi, File $file): Http\Response {
+		// Renaming acts on the owner's file: not through a share link, logged in or not.
+		if ($wopi->isShareSession()) {
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		}
+
+		$requestedName = $this->request->getHeader('X-WOPI-RequestedName');
+		if ($requestedName === '') {
+			return new JSONResponse(['error' => 'X-WOPI-RequestedName is required'], Http::STATUS_BAD_REQUEST);
+		}
+
+		// X-WOPI-RequestedName is UTF-7 encoded; decode to UTF-8.
+		$newBaseName = (string)mb_convert_encoding($requestedName, 'UTF-8', 'UTF-7');
+
+		// Reject names that contain path separators or null bytes (path traversal guard).
+		// basename() only treats '/' as a separator on non-Windows PHP, so a
+		// backslash is checked explicitly too - Windows-separator names have no
+		// legitimate use in a rename, and NC storage treats '\' as an ordinary
+		// character rather than a path component.
+		if ($newBaseName === '' || $newBaseName !== basename($newBaseName) || str_contains($newBaseName, "\0") || str_contains($newBaseName, '\\')) {
+			$resp = new JSONResponse([], Http::STATUS_BAD_REQUEST);
+			$resp->addHeader('X-WOPI-InvalidFileNameError', 'File name contains invalid characters');
+			return $resp;
+		}
+
+		// Lock check: an active lock must be matched by the client's X-WOPI-Lock.
+		$lockId = $this->request->getHeader('X-WOPI-Lock');
+		$existing = $this->wopiLockMapper->findByFileId($fileId);
+		if ($existing !== null && !$existing->isExpired()) {
+			if ($lockId !== $existing->getLockId()) {
+				return $this->lockConflict($existing->getLockId(), 'File is locked');
+			}
+		}
+
+		$extension = pathinfo($file->getName(), PATHINFO_EXTENSION);
+		$newName = $extension !== '' ? $newBaseName . '.' . $extension : $newBaseName;
+
+		// Reject if a file with the requested name already exists in the same directory.
+		try {
+			$file->getParent()->get($newName);
+			$response = new JSONResponse([], Http::STATUS_BAD_REQUEST);
+			$response->addHeader('X-WOPI-InvalidFileNameError', 'A file with that name already exists');
+			return $response;
+		} catch (NotFoundException) {
+			// Target name is free — proceed with rename.
+		}
+
+		$newPath = $file->getParent()->getPath() . '/' . $newName;
+
+		try {
+			try {
+				$this->lockManager->runInScope(
+					new LockContext($file, \OCP\Files\Lock\ILock::TYPE_APP, 'office'),
+					static function () use (&$file, $newPath): void {
+						$file = $file->move($newPath);
+					},
+				);
+			} catch (NoLockProviderException|PreConditionNotMetException) {
+				$file = $file->move($newPath);
+			} catch (OwnerLockedException) {
+				return $this->lockConflict('', 'File is locked by another user');
+			}
+		} catch (\Throwable $e) {
+			$this->logger->error($e->getMessage(), ['exception' => $e]);
+			return new JSONResponse([], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		return new JSONResponse(['Name' => $file->getName()]);
+	}
+
+	private function lockOkResponse(): JSONResponse {
+		return new JSONResponse([]);
+	}
+
+	private function lockConflict(string $currentLockId, string $reason): JSONResponse {
+		$response = new JSONResponse([], Http::STATUS_CONFLICT);
+		$response->addHeader('X-WOPI-Lock', $currentLockId);
+		$response->addHeader('X-WOPI-LockFailureReason', $reason);
+		return $response;
+	}
+
+	/**
+	 * The token's file and current rights, or the response to send when the file
+	 * or the share it was opened through is gone.
+	 */
+	private function resolveAccess(Wopi $wopi): WopiAccess|JSONResponse {
+		try {
+			return $this->accessResolver->resolve($wopi);
+		} catch (NotFoundException $e) {
+			$this->logger->info($e->getMessage(), ['fileId' => $wopi->getFileid()]);
+			return new JSONResponse([], Http::STATUS_NOT_FOUND);
+		}
+	}
+
+	private function getFileRange(File $file, string $rangeHeader): Http\Response {
+		// getSize() is int|float only for sizes beyond PHP_INT_MAX on 32-bit builds.
+		$size = (int)$file->getSize();
+		if (preg_match('/bytes=(\d+)-(\d+)?/', $rangeHeader, $m)) {
+			$start = (int)$m[1];
+			$end = isset($m[2]) ? (int)$m[2] : $size - 1;
+			// Clamp end to actual file size to produce a correct Content-Range header (RFC 7233).
+			$end = min($end, $size - 1);
+
+			// RFC 7233 §4.4: return 416 if range is unsatisfiable.
+			if ($start >= $size || $start > $end) {
+				$response = new Http\Response();
+				$response->setStatus(416);
+				$response->addHeader('Content-Range', "bytes */{$size}");
+				return $response;
+			}
+
+			$length = (int)($end - $start + 1);
+
+			$fp = $file->fopen('rb');
+			if ($fp === false) {
+				$r = new Http\Response();
+				$r->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);
+				return $r;
+			}
+			try {
+				$rangeStream = fopen('php://temp', 'w+b');
+				if ($rangeStream === false) {
+					$r = new Http\Response();
+					$r->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);
+					return $r;
+				}
+				try {
+					stream_copy_to_stream($fp, $rangeStream, $length, $start);
+					fseek($rangeStream, 0);
+
+					$response = new StreamResponse($rangeStream);
+					$response->setStatus(Http::STATUS_PARTIAL_CONTENT);
+					$response->addHeader('Content-Type', 'application/octet-stream');
+					$response->addHeader('Content-Range', "bytes {$start}-{$end}/{$size}");
+					$response->addHeader('Content-Length', (string)$length);
+					$response->addHeader('Accept-Ranges', 'bytes');
+					return $response;
+				} catch (\Throwable $e) {
+					fclose($rangeStream);
+					throw $e;
+				}
+			} finally {
+				fclose($fp);
+			}
+		}
+
+		$resource = $file->fopen('rb');
+		if ($resource === false) {
+			$r = new Http\Response();
+			$r->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);
+			return $r;
+		}
+		$response = new StreamResponse($resource);
+		$response->addHeader('Content-Type', 'application/octet-stream');
+		return $response;
+	}
+
+	/**
+	 * Write file content while acquiring an advisory ILockManager lock if available.
+	 * Falls back to writing without a lock when no provider is registered.
+	 */
+	private function writeWithLock(Wopi $wopi, File $file, callable $write): void {
+		try {
+			$this->lockManager->runInScope(
+				new LockContext($file, \OCP\Files\Lock\ILock::TYPE_APP, 'office'),
+				$write,
+			);
+		} catch (NoLockProviderException|PreConditionNotMetException) {
+			$write();
+		} catch (OwnerLockedException $e) {
+			throw new LockedException($file->getPath(), $e);
+		}
+	}
+
+	/**
+	 * Compare at second resolution rather than as strings, so the check doesn't depend on the editor
+	 * echoing our exact ISO 8601 format (richdocuments emits microseconds, this app milliseconds).
+	 */
+	private function isCurrentTimestamp(string $editorTimestamp, File $file): bool {
+		try {
+			return (new \DateTimeImmutable($editorTimestamp))->getTimestamp() === $file->getMTime();
+		} catch (\Exception) {
+			return false;
+		}
+	}
+
+	/**
+	 * @return resource|false
+	 */
+	protected function openRequestBody() {
+		return fopen('php://input', 'rb');
+	}
+
+	private function toISO8601(int $timestamp): string {
+		return (new \DateTime('@' . $timestamp))->format('Y-m-d\TH:i:s.000\Z');
+	}
+}
diff --git a/lib/Db/Wopi.php b/lib/Db/Wopi.php
new file mode 100644
index 00000000..6c61bef8
--- /dev/null
+++ b/lib/Db/Wopi.php
@@ -0,0 +1,108 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Db;
+
+use OCP\AppFramework\Db\Entity;
+use OCP\DB\Types;
+
+/**
+ * @method void setOwnerUid(string $uid)
+ * @method string|null getOwnerUid()
+ * @method void setEditorUid(?string $uid)
+ * @method string|null getEditorUid()
+ * @method void setGuestDisplayname(?string $name)
+ * @method string|null getGuestDisplayname()
+ * @method void setFileid(int $fileid)
+ * @method int getFileid()
+ * @method void setVersion(string $version)
+ * @method string getVersion()
+ * @method void setCanwrite(bool $canwrite)
+ * @method bool getCanwrite()
+ * @method void setHideDownload(bool $hide)
+ * @method bool getHideDownload()
+ * @method void setServerHost(string $host)
+ * @method string getServerHost()
+ * @method void setToken(string $token)
+ * @method string getToken()
+ * @method void setExpiry(int $expiry)
+ * @method int getExpiry()
+ * @method void setShareToken(?string $shareToken)
+ * @method string|null getShareToken()
+ */
+final class Wopi extends Entity {
+	public const int TOKEN_TYPE_USER = 0;
+	public const int TOKEN_TYPE_GUEST = 1;
+
+	/** @var string|null */
+	protected $ownerUid;
+
+	/** @var string|null */
+	protected $editorUid;
+
+	/** @var string|null */
+	protected $guestDisplayname;
+
+	/** @var int */
+	protected $fileid;
+
+	/** @var string */
+	protected $version = '0';
+
+	/** @var bool */
+	protected $canwrite = false;
+
+	/** @var bool */
+	protected $hideDownload = false;
+
+	/** @var string */
+	protected $serverHost;
+
+	/** @var string */
+	protected $token;
+
+	/** @var int|null */
+	protected $expiry;
+
+	/** @var string|null */
+	protected $shareToken;
+
+	public function __construct() {
+		$this->addType('ownerUid', Types::STRING);
+		$this->addType('editorUid', Types::STRING);
+		$this->addType('guestDisplayname', Types::STRING);
+		$this->addType('fileid', Types::INTEGER);
+		$this->addType('version', Types::STRING);
+		$this->addType('canwrite', Types::BOOLEAN);
+		$this->addType('hideDownload', Types::BOOLEAN);
+		$this->addType('serverHost', Types::STRING);
+		$this->addType('token', Types::STRING);
+		$this->addType('expiry', Types::INTEGER);
+		$this->addType('shareToken', Types::STRING);
+	}
+
+	/**
+	 * Opened through a share link: file access and rights come from the share,
+	 * re-checked on every request, whether or not the visitor is logged in.
+	 */
+	public function isShareSession(): bool {
+		return $this->shareToken !== null;
+	}
+
+	/**
+	 * No Nextcloud user behind the session (an anonymous share-link visitor).
+	 */
+	public function isAnonymous(): bool {
+		return $this->editorUid === null;
+	}
+
+	public function isExpired(): bool {
+		return $this->expiry !== null && $this->expiry < time();
+	}
+}
diff --git a/lib/Db/WopiLock.php b/lib/Db/WopiLock.php
new file mode 100644
index 00000000..4cc986cd
--- /dev/null
+++ b/lib/Db/WopiLock.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Db;
+
+use OCP\AppFramework\Db\Entity;
+use OCP\DB\Types;
+
+/**
+ * @method void setFileid(int $fileid)
+ * @method int getFileid()
+ * @method void setLockId(string $lockId)
+ * @method string getLockId()
+ * @method void setExpiry(int $expiry)
+ * @method int getExpiry()
+ */
+final class WopiLock extends Entity {
+	/** @var int */
+	protected $fileid = 0;
+
+	/** @var string */
+	protected $lockId = '';
+
+	/** @var int */
+	protected $expiry = 0;
+
+	public function __construct() {
+		$this->addType('fileid', Types::INTEGER);
+		$this->addType('lockId', Types::STRING);
+		$this->addType('expiry', Types::INTEGER);
+	}
+
+	public function isExpired(): bool {
+		return $this->expiry < time();
+	}
+}
diff --git a/lib/Db/WopiLockMapper.php b/lib/Db/WopiLockMapper.php
new file mode 100644
index 00000000..b4468dc4
--- /dev/null
+++ b/lib/Db/WopiLockMapper.php
@@ -0,0 +1,112 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Db;
+
+use OCP\AppFramework\Db\QBMapper;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\IDBConnection;
+
+/** @template-extends QBMapper<WopiLock> */
+class WopiLockMapper extends QBMapper {
+	// WOPI spec: locks are valid for 30 minutes; editor must refresh before expiry.
+	public const int LOCK_TTL = 1800;
+
+	public function __construct(
+		IDBConnection $db,
+		private ITimeFactory $timeFactory,
+	) {
+		parent::__construct($db, 'office_wopi_locks', WopiLock::class);
+	}
+
+	/**
+	 * Return the current non-expired lock for a file, or null if none exists.
+	 */
+	public function findByFileId(int $fileId): ?WopiLock {
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('*')
+			->from('office_wopi_locks')
+			->where($qb->expr()->eq('fileid', $qb->createNamedParameter($fileId, IQueryBuilder::PARAM_INT)));
+
+		try {
+			$lock = $this->findEntity($qb);
+			return $lock;
+		} catch (\OCP\AppFramework\Db\DoesNotExistException) {
+			return null;
+		}
+	}
+
+	/**
+	 * Create or refresh a lock for a file.
+	 * If a lock already exists for the file it is updated in-place.
+	 */
+	public function upsertLock(int $fileId, string $lockId): void {
+		$expiry = $this->timeFactory->getTime() + self::LOCK_TTL;
+		$existing = $this->findByFileId($fileId);
+
+		if ($existing !== null) {
+			$existing->setLockId($lockId);
+			$existing->setExpiry($expiry);
+			$this->update($existing);
+			return;
+		}
+
+		$lock = new WopiLock();
+		$lock->setFileid($fileId);
+		$lock->setLockId($lockId);
+		$lock->setExpiry($expiry);
+
+		try {
+			$this->insert($lock);
+		} catch (\OCP\DB\Exception $e) {
+			if ($e->getReason() !== \OCP\DB\Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
+				throw $e;
+			}
+			// A concurrent request raced us between SELECT and INSERT; update the row they created.
+			$raced = $this->findByFileId($fileId);
+			if ($raced === null) {
+				throw $e;
+			}
+			$raced->setLockId($lockId);
+			$raced->setExpiry($expiry);
+			$this->update($raced);
+		}
+	}
+
+	/**
+	 * Return IDs of expired lock rows for the cleanup job.
+	 *
+	 * @return int[]
+	 */
+	public function getExpiredLockIds(int $limit = 500): array {
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('id')
+			->from('office_wopi_locks')
+			->where($qb->expr()->lt('expiry', $qb->createNamedParameter($this->timeFactory->getTime(), IQueryBuilder::PARAM_INT)))
+			->setMaxResults($limit);
+
+		return array_map('intval', array_column($qb->executeQuery()->fetchAll(), 'id'));
+	}
+
+	/**
+	 * Delete lock rows by their primary-key IDs.
+	 *
+	 * @param int[] $ids
+	 */
+	public function deleteByIds(array $ids): void {
+		if (empty($ids)) {
+			return;
+		}
+		$qb = $this->db->getQueryBuilder();
+		$qb->delete('office_wopi_locks')
+			->where($qb->expr()->in('id', $qb->createNamedParameter($ids, IQueryBuilder::PARAM_INT_ARRAY)));
+		$qb->executeStatement();
+	}
+}
diff --git a/lib/Db/WopiMapper.php b/lib/Db/WopiMapper.php
new file mode 100644
index 00000000..2653bef3
--- /dev/null
+++ b/lib/Db/WopiMapper.php
@@ -0,0 +1,167 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Db;
+
+use OCA\Office\Exception\ExpiredTokenException;
+use OCA\Office\Exception\UnknownTokenException;
+use OCP\AppFramework\Db\QBMapper;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\IDBConnection;
+use OCP\Security\ISecureRandom;
+use Psr\Log\LoggerInterface;
+
+/** @template-extends QBMapper<Wopi> */
+class WopiMapper extends QBMapper {
+	private const int TOKEN_TTL = 36000; // 10 hours
+
+	public function __construct(
+		IDBConnection $db,
+		private ISecureRandom $random,
+		private LoggerInterface $logger,
+		private ITimeFactory $timeFactory,
+	) {
+		parent::__construct($db, 'office_wopi', Wopi::class);
+	}
+
+	/**
+	 * Generate and persist a WOPI token for an authenticated user.
+	 */
+	public function generateFileToken(
+		int $fileId,
+		string $ownerUid,
+		string $editorUid,
+		string $version,
+		bool $canWrite,
+		bool $hideDownload,
+		string $serverHost,
+	): Wopi {
+		$token = $this->random->generate(32, ISecureRandom::CHAR_LOWER . ISecureRandom::CHAR_UPPER . ISecureRandom::CHAR_DIGITS);
+
+		$wopi = $this->insert(Wopi::fromParams([
+			'fileid' => $fileId,
+			'ownerUid' => $ownerUid,
+			'editorUid' => $editorUid,
+			'version' => $version,
+			'canwrite' => $canWrite,
+			'hideDownload' => $hideDownload,
+			'serverHost' => $serverHost,
+			'token' => $token,
+			'expiry' => $this->newExpiry(),
+		]));
+
+		return $wopi;
+	}
+
+	/**
+	 * Generate and persist a WOPI token for a share-link session, bound to the share.
+	 * $editorUid is the logged-in visitor, or null for an anonymous guest.
+	 */
+	public function generateGuestToken(
+		int $fileId,
+		string $ownerUid,
+		#[\SensitiveParameter]
+		string $shareToken,
+		?string $editorUid,
+		string $guestDisplayname,
+		string $version,
+		bool $canWrite,
+		bool $hideDownload,
+		string $serverHost,
+	): Wopi {
+		$token = $this->random->generate(32, ISecureRandom::CHAR_LOWER . ISecureRandom::CHAR_UPPER . ISecureRandom::CHAR_DIGITS);
+
+		$wopi = $this->insert(Wopi::fromParams([
+			'fileid' => $fileId,
+			'ownerUid' => $ownerUid,
+			'editorUid' => $editorUid,
+			'guestDisplayname' => $guestDisplayname,
+			'shareToken' => $shareToken,
+			'version' => $version,
+			'canwrite' => $canWrite,
+			'hideDownload' => $hideDownload,
+			'serverHost' => $serverHost,
+			'token' => $token,
+			'expiry' => $this->newExpiry(),
+		]));
+
+		return $wopi;
+	}
+
+	/**
+	 * Look up and validate a WOPI token.
+	 *
+	 * @throws UnknownTokenException
+	 * @throws ExpiredTokenException
+	 */
+	public function getWopiForToken(
+		#[\SensitiveParameter]
+		string $token,
+	): Wopi {
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('*')
+			->from('office_wopi')
+			->where($qb->expr()->eq('token', $qb->createNamedParameter($token)));
+
+		$result = $qb->executeQuery();
+		$row = $result->fetch();
+		$result->closeCursor();
+
+		if ($row === false) {
+			throw new UnknownTokenException('Could not find token.');
+		}
+
+		// Only identifiers: the row also holds the access token and the share token, both credentials.
+		$this->logger->debug('Loaded WOPI token record {id} for file {fileId}.', ['id' => $row['id'] ?? null, 'fileId' => $row['fileid'] ?? null]);
+
+		$wopi = Wopi::fromRow($row);
+
+		if ($wopi->isExpired()) {
+			throw new ExpiredTokenException('Provided token is expired.');
+		}
+
+		return $wopi;
+	}
+
+	/**
+	 * Return IDs of tokens that expired more than 60 seconds ago, for cleanup jobs.
+	 *
+	 * @return int[]
+	 */
+	public function getExpiredTokenIds(?int $limit = null, ?int $offset = null): array {
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('id')
+			->from('office_wopi')
+			->where($qb->expr()->lt('expiry', $qb->createNamedParameter(time() - 60, IQueryBuilder::PARAM_INT)))
+			->setFirstResult($offset ?? 0)
+			->setMaxResults($limit);
+
+		return array_map('intval', array_column($qb->executeQuery()->fetchAll(), 'id'));
+	}
+
+	/**
+	 * Delete WOPI rows by their primary-key IDs.
+	 *
+	 * @param int[] $ids
+	 */
+	public function deleteByIds(array $ids): void {
+		if (empty($ids)) {
+			return;
+		}
+		$qb = $this->db->getQueryBuilder();
+		$qb->delete('office_wopi')
+			->where($qb->expr()->in('id', $qb->createNamedParameter($ids, IQueryBuilder::PARAM_INT_ARRAY)));
+		$qb->executeStatement();
+	}
+
+	private function newExpiry(): int {
+		return $this->timeFactory->getTime() + self::TOKEN_TTL;
+	}
+}
diff --git a/lib/Exception/ExpiredTokenException.php b/lib/Exception/ExpiredTokenException.php
new file mode 100644
index 00000000..6242e402
--- /dev/null
+++ b/lib/Exception/ExpiredTokenException.php
@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Exception;
+
+final class ExpiredTokenException extends \Exception {
+}
diff --git a/lib/Exception/UnknownTokenException.php b/lib/Exception/UnknownTokenException.php
new file mode 100644
index 00000000..b93012b9
--- /dev/null
+++ b/lib/Exception/UnknownTokenException.php
@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Exception;
+
+final class UnknownTokenException extends \Exception {
+}
diff --git a/lib/Exception/WopiCallerNotAllowedException.php b/lib/Exception/WopiCallerNotAllowedException.php
new file mode 100644
index 00000000..f8f71c78
--- /dev/null
+++ b/lib/Exception/WopiCallerNotAllowedException.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Exception;
+
+/**
+ * A WOPI request from an address outside the configured editor allowlist.
+ */
+final class WopiCallerNotAllowedException extends \Exception {
+}
diff --git a/lib/Exception/WopiProofException.php b/lib/Exception/WopiProofException.php
new file mode 100644
index 00000000..efa43a7b
--- /dev/null
+++ b/lib/Exception/WopiProofException.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Exception;
+
+/**
+ * A WOPI request that doesn't carry a valid, current proof from the editor server.
+ */
+final class WopiProofException extends \Exception {
+}
diff --git a/lib/Http/EditorPagePolicy.php b/lib/Http/EditorPagePolicy.php
new file mode 100644
index 00000000..c58c97f0
--- /dev/null
+++ b/lib/Http/EditorPagePolicy.php
@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Http;
+
+use OCP\AppFramework\Http\ContentSecurityPolicy;
+
+final class EditorPagePolicy {
+	/**
+	 * CSP for the editor page: the page posts a hidden form into a named iframe
+	 * on the editor server, so that origin needs both frame-src and form-action.
+	 *
+	 * The origin comes from the URL the browser is actually sent to (after the
+	 * public_wopi_url rewrite), and is validated strictly because the value is
+	 * spliced into the CSP header verbatim.
+	 *
+	 * The URL carries the access token, so it is kept out of the exception
+	 * message and, via SensitiveParameter, out of logged stack traces.
+	 *
+	 * @throws \InvalidArgumentException if the URL has no usable http(s) origin.
+	 */
+	public static function forEditorUrl(#[\SensitiveParameter] string $editorUrl): ContentSecurityPolicy {
+		$origin = self::origin($editorUrl);
+
+		$policy = new ContentSecurityPolicy();
+		$policy->addAllowedFrameDomain($origin);
+		$policy->addAllowedFormActionDomain($origin);
+		return $policy;
+	}
+
+	private static function origin(#[\SensitiveParameter] string $url): string {
+		$parts = parse_url($url);
+		$scheme = is_array($parts) ? strtolower($parts['scheme'] ?? '') : '';
+		$host = is_array($parts) ? ($parts['host'] ?? '') : '';
+
+		if (!in_array($scheme, ['http', 'https'], true)
+			|| preg_match('/^(?:[a-z0-9-]+(?:\.[a-z0-9-]+)*|\[[0-9a-f:.]+\])$/i', $host) !== 1) {
+			throw new \InvalidArgumentException('Editor URL has no valid http(s) origin');
+		}
+
+		return $scheme . '://' . $host . (isset($parts['port']) ? ':' . $parts['port'] : '');
+	}
+}
diff --git a/lib/Listener/LoadAdditionalScriptsListener.php b/lib/Listener/LoadAdditionalScriptsListener.php
new file mode 100644
index 00000000..ae3ac33f
--- /dev/null
+++ b/lib/Listener/LoadAdditionalScriptsListener.php
@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Listener;
+
+use OCA\Office\AppInfo\Application;
+use OCA\Office\Service\DiscoveryService;
+use OCP\AppFramework\Http\Events\BeforeTemplateRenderedEvent;
+use OCP\AppFramework\Http\Template\PublicTemplateResponse;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\Collaboration\Resources\LoadAdditionalScriptsEvent;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\Util;
+
+/**
+ * Adds the "Open in Office" file action to the Files app, both for users and on public
+ * share pages (which Files renders as a public "files/index" page).
+ *
+ * @template-implements IEventListener<LoadAdditionalScriptsEvent|BeforeTemplateRenderedEvent>
+ */
+final class LoadAdditionalScriptsListener implements IEventListener {
+	public function __construct(
+		private DiscoveryService $discoveryService,
+		private IInitialState $initialState,
+	) {
+	}
+
+	#[\Override]
+	public function handle(Event $event): void {
+		if (!$event instanceof LoadAdditionalScriptsEvent && !$this->isPublicSharePage($event)) {
+			return;
+		}
+
+		try {
+			$mimes = $this->discoveryService->getSupportedMimeTypes();
+		} catch (\Throwable) {
+			$mimes = [];
+		}
+
+		$this->initialState->provideInitialState('supported-mimes', $mimes);
+
+		Util::addInitScript(Application::APP_ID, 'office-file-actions');
+	}
+
+	private function isPublicSharePage(Event $event): bool {
+		if (!$event instanceof BeforeTemplateRenderedEvent) {
+			return false;
+		}
+
+		$response = $event->getResponse();
+		return $response instanceof PublicTemplateResponse
+			&& $response->getApp() === 'files'
+			&& $response->getTemplateName() === 'index';
+	}
+}
diff --git a/lib/Middleware/WopiAllowlistMiddleware.php b/lib/Middleware/WopiAllowlistMiddleware.php
new file mode 100644
index 00000000..1621827b
--- /dev/null
+++ b/lib/Middleware/WopiAllowlistMiddleware.php
@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Middleware;
+
+use OCA\Office\AppInfo\Application;
+use OCA\Office\Controller\WopiController;
+use OCA\Office\Exception\WopiCallerNotAllowedException;
+use OCA\Office\Service\LogThrottle;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\AppFramework\Http\Response;
+use OCP\AppFramework\Middleware;
+use OCP\IAppConfig;
+use OCP\IRequest;
+use OCP\Security\Ip\IFactory;
+use Psr\Log\LoggerInterface;
+
+/**
+ * Optionally restrict the WOPI endpoints to the editor servers' addresses
+ * (app config wopi_allowlist: IPs or CIDR ranges separated by commas or spaces).
+ * This is the caller check for editors that don't sign their requests.
+ */
+final class WopiAllowlistMiddleware extends Middleware {
+	public function __construct(
+		private IRequest $request,
+		private IAppConfig $appConfig,
+		private IFactory $ipFactory,
+		private LoggerInterface $logger,
+		private LogThrottle $logThrottle,
+	) {
+	}
+
+	#[\Override]
+	public function beforeController($controller, $methodName): void {
+		if (!$controller instanceof WopiController) {
+			return;
+		}
+
+		$allowlist = trim($this->appConfig->getValueString(Application::APP_ID, 'wopi_allowlist', ''));
+		if ($allowlist === '') {
+			return;
+		}
+
+		$remoteAddress = $this->request->getRemoteAddress();
+		try {
+			$address = $this->ipFactory->addressFromString($remoteAddress);
+		} catch (\InvalidArgumentException) {
+			throw new WopiCallerNotAllowedException('Unparsable caller address');
+		}
+
+		$entries = preg_split('/[\s,;|]+/', $allowlist, -1, PREG_SPLIT_NO_EMPTY);
+		foreach ($entries === false ? [] : $entries as $entry) {
+			try {
+				if ($this->ipFactory->rangeFromString($entry)->contains($address)) {
+					return;
+				}
+			} catch (\InvalidArgumentException) {
+				// A typo must not open or close the allowlist silently: skip the entry and say so,
+				// once an hour rather than on every WOPI request.
+				if ($this->logThrottle->allows('wopi-allowlist-invalid', 3600)) {
+					$this->logger->warning('Ignoring invalid wopi_allowlist entry {entry}', ['entry' => $entry]);
+				}
+			}
+		}
+
+		throw new WopiCallerNotAllowedException('Caller not in wopi_allowlist');
+	}
+
+	#[\Override]
+	public function afterException($controller, $methodName, \Exception $exception): Response {
+		if (!$exception instanceof WopiCallerNotAllowedException) {
+			throw $exception;
+		}
+
+		$context = [
+			'fileId' => $this->request->getParam('fileId'),
+			'remoteAddress' => $this->request->getRemoteAddress(),
+			'reason' => $exception->getMessage(),
+		];
+		if ($this->logThrottle->allows('wopi-allowlist-rejected', 300)) {
+			$this->logger->warning('Rejected WOPI request for file {fileId} from {remoteAddress}: {reason} (repeats within 5 minutes are logged at debug level)', $context);
+		} else {
+			$this->logger->debug('Rejected WOPI request for file {fileId} from {remoteAddress}: {reason}', $context);
+		}
+		return new JSONResponse([], Http::STATUS_FORBIDDEN);
+	}
+}
diff --git a/lib/Middleware/WopiProofMiddleware.php b/lib/Middleware/WopiProofMiddleware.php
new file mode 100644
index 00000000..4d4b44c8
--- /dev/null
+++ b/lib/Middleware/WopiProofMiddleware.php
@@ -0,0 +1,114 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Middleware;
+
+use OCA\Office\Controller\WopiController;
+use OCA\Office\Exception\WopiProofException;
+use OCA\Office\Service\DiscoveryService;
+use OCA\Office\Service\LogThrottle;
+use OCA\Office\Service\WopiProofKeys;
+use OCA\Office\Service\WopiProofVerifier;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\AppFramework\Http\Response;
+use OCP\AppFramework\Middleware;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use Psr\Log\LoggerInterface;
+
+/**
+ * WOPI endpoints are public and authorised by the access token alone. When the editor
+ * publishes proof keys, also require its signature, so a token copied out of a browser
+ * (e.g. on a "hide download" share) can't be used to fetch or overwrite the file directly.
+ * Editors that don't sign are let through; the admin page warns about it.
+ */
+final class WopiProofMiddleware extends Middleware {
+	public function __construct(
+		private IRequest $request,
+		private DiscoveryService $discoveryService,
+		private WopiProofVerifier $verifier,
+		private IURLGenerator $urlGenerator,
+		private LoggerInterface $logger,
+		private LogThrottle $logThrottle,
+	) {
+	}
+
+	#[\Override]
+	public function beforeController($controller, $methodName): void {
+		if (!$controller instanceof WopiController) {
+			return;
+		}
+
+		$keys = $this->discoveryService->getProofKeys();
+		if ($keys === null && $this->request->getHeader('X-WOPI-Proof') !== '') {
+			// The editor may have started signing since the keys were last read.
+			$keys = $this->discoveryService->refreshProofKeys();
+		}
+		if ($keys === null) {
+			return;
+		}
+
+		if (!$this->verifier->isFresh($this->request->getHeader('X-WOPI-TimeStamp'))) {
+			throw new WopiProofException('Missing or expired X-WOPI-TimeStamp');
+		}
+
+		if ($this->isSignedWith($keys)) {
+			return;
+		}
+
+		// Keys regenerated on the editor (e.g. a recreated container) aren't known yet.
+		$current = $this->discoveryService->refreshProofKeys();
+		if ($current !== null && $current != $keys && $this->isSignedWith($current)) {
+			return;
+		}
+
+		throw new WopiProofException('Invalid X-WOPI-Proof');
+	}
+
+	private function isSignedWith(WopiProofKeys $keys): bool {
+		// The editor signs the URL it called: Nextcloud's own absolute URL, or the
+		// callback_url form of it when the editor reaches Nextcloud by another address.
+		$url = $this->urlGenerator->getAbsoluteURL($this->request->getRequestUri());
+		$accessToken = (string)$this->request->getParam('access_token', '');
+		foreach (array_unique([$url, $this->discoveryService->editorReachableUrl($url)]) as $signedUrl) {
+			if ($this->verifier->isValid(
+				$keys,
+				$accessToken,
+				$signedUrl,
+				$this->request->getHeader('X-WOPI-TimeStamp'),
+				$this->request->getHeader('X-WOPI-Proof'),
+				$this->request->getHeader('X-WOPI-ProofOld'),
+			)) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	#[\Override]
+	public function afterException($controller, $methodName, \Exception $exception): Response {
+		if (!$exception instanceof WopiProofException) {
+			throw $exception;
+		}
+
+		$context = [
+			'fileId' => $this->request->getParam('fileId'),
+			'reason' => $exception->getMessage(),
+			'remoteAddress' => $this->request->getRemoteAddress(),
+		];
+		if ($this->logThrottle->allows('wopi-proof-rejected', 300)) {
+			$this->logger->warning('Rejected WOPI request for file {fileId} from {remoteAddress}: {reason} (repeats within 5 minutes are logged at debug level)', $context);
+		} else {
+			$this->logger->debug('Rejected WOPI request for file {fileId} from {remoteAddress}: {reason}', $context);
+		}
+		return new JSONResponse([], Http::STATUS_FORBIDDEN);
+	}
+}
diff --git a/lib/Migration/Version1000Date20260522000000.php b/lib/Migration/Version1000Date20260522000000.php
new file mode 100644
index 00000000..f27b6d01
--- /dev/null
+++ b/lib/Migration/Version1000Date20260522000000.php
@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+final class Version1000Date20260522000000 extends SimpleMigrationStep {
+	#[\Override]
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		$schema = $schemaClosure();
+
+		if ($schema->hasTable('office_wopi')) {
+			return null;
+		}
+
+		$table = $schema->createTable('office_wopi');
+
+		$table->addColumn('id', 'bigint', [
+			'autoincrement' => true,
+			'notnull' => true,
+			'length' => 20,
+			'unsigned' => true,
+		]);
+		$table->addColumn('owner_uid', 'string', [
+			'notnull' => false,
+			'length' => 64,
+		]);
+		$table->addColumn('editor_uid', 'string', [
+			'notnull' => false,
+			'length' => 64,
+		]);
+		$table->addColumn('guest_displayname', 'string', [
+			'notnull' => false,
+			'length' => 255,
+		]);
+		$table->addColumn('fileid', 'bigint', [
+			'notnull' => true,
+			'length' => 20,
+		]);
+		$table->addColumn('version', 'string', [
+			'notnull' => false,
+			'length' => 1024,
+			'default' => '0',
+		]);
+		$table->addColumn('canwrite', 'boolean', [
+			'notnull' => false,
+			'default' => false,
+		]);
+		$table->addColumn('server_host', 'string', [
+			'notnull' => true,
+			'default' => 'localhost',
+		]);
+		$table->addColumn('token', 'string', [
+			'notnull' => false,
+			'length' => 32,
+			'default' => '',
+		]);
+		$table->addColumn('expiry', 'bigint', [
+			'notnull' => false,
+			'length' => 20,
+			'unsigned' => true,
+		]);
+
+		$table->setPrimaryKey(['id']);
+		$table->addUniqueIndex(['token'], 'office_wopi_token_idx');
+		$table->addIndex(['fileid'], 'office_wopi_fileid_idx');
+
+		return $schema;
+	}
+}
diff --git a/lib/Migration/Version1001Date20260523000000.php b/lib/Migration/Version1001Date20260523000000.php
new file mode 100644
index 00000000..ef445d90
--- /dev/null
+++ b/lib/Migration/Version1001Date20260523000000.php
@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\Types;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+final class Version1001Date20260523000000 extends SimpleMigrationStep {
+	#[\Override]
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		$schema = $schemaClosure();
+
+		if ($schema->hasTable('office_wopi_locks')) {
+			return null;
+		}
+
+		$table = $schema->createTable('office_wopi_locks');
+		$table->addColumn('id', Types::BIGINT, [
+			'autoincrement' => true,
+			'unsigned' => true,
+			'notnull' => true,
+		]);
+		// One lock per file — fileid is unique.
+		$table->addColumn('fileid', Types::BIGINT, [
+			'notnull' => true,
+		]);
+		// Opaque lock ID supplied by the WOPI client (up to 1024 chars per spec).
+		$table->addColumn('lock_id', Types::STRING, [
+			'length' => 1024,
+			'notnull' => true,
+		]);
+		// Unix timestamp when the lock expires (WOPI locks default to 30 minutes).
+		$table->addColumn('expiry', Types::BIGINT, [
+			'unsigned' => true,
+			'notnull' => true,
+		]);
+
+		$table->setPrimaryKey(['id']);
+		$table->addUniqueIndex(['fileid'], 'office_wopi_locks_fileid_idx');
+
+		return $schema;
+	}
+}
diff --git a/lib/Migration/Version1002Date20260523000000.php b/lib/Migration/Version1002Date20260523000000.php
new file mode 100644
index 00000000..64bbebec
--- /dev/null
+++ b/lib/Migration/Version1002Date20260523000000.php
@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\Types;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+final class Version1002Date20260523000000 extends SimpleMigrationStep {
+	#[\Override]
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		$schema = $schemaClosure();
+
+		if (!$schema->hasTable('office_wopi')) {
+			return null;
+		}
+
+		$table = $schema->getTable('office_wopi');
+
+		if ($table->hasColumn('hide_download')) {
+			return null;
+		}
+
+		$table->addColumn('hide_download', Types::BOOLEAN, [
+			'notnull' => false,
+			'default' => false,
+		]);
+
+		return $schema;
+	}
+}
diff --git a/lib/Migration/Version1003Date20261026000000.php b/lib/Migration/Version1003Date20261026000000.php
new file mode 100644
index 00000000..d6e01191
--- /dev/null
+++ b/lib/Migration/Version1003Date20261026000000.php
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\Types;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+/**
+ * Link the tokens of share-link sessions to their share, so every WOPI request
+ * can re-check that the share still exists and what it still allows.
+ */
+final class Version1003Date20261026000000 extends SimpleMigrationStep {
+	#[\Override]
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		$schema = $schemaClosure();
+
+		if (!$schema->hasTable('office_wopi')) {
+			return null;
+		}
+
+		$table = $schema->getTable('office_wopi');
+
+		if ($table->hasColumn('share_token')) {
+			return null;
+		}
+
+		$table->addColumn('share_token', Types::STRING, [
+			'notnull' => false,
+			'length' => 64,
+		]);
+
+		return $schema;
+	}
+}
diff --git a/lib/Migration/Version1004Date20261026000001.php b/lib/Migration/Version1004Date20261026000001.php
new file mode 100644
index 00000000..d43c3797
--- /dev/null
+++ b/lib/Migration/Version1004Date20261026000001.php
@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+/**
+ * The hourly cleanup selects expired tokens by expiry; without an index that is a
+ * full scan of a table anonymous share-link visits add to.
+ */
+final class Version1004Date20261026000001 extends SimpleMigrationStep {
+	#[\Override]
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		$schema = $schemaClosure();
+
+		if (!$schema->hasTable('office_wopi')) {
+			return null;
+		}
+
+		$table = $schema->getTable('office_wopi');
+
+		if ($table->hasIndex('office_wopi_expiry_idx')) {
+			return null;
+		}
+
+		$table->addIndex(['expiry'], 'office_wopi_expiry_idx');
+
+		return $schema;
+	}
+}
diff --git a/lib/Service/DiscoveryService.php b/lib/Service/DiscoveryService.php
new file mode 100644
index 00000000..a85376fc
--- /dev/null
+++ b/lib/Service/DiscoveryService.php
@@ -0,0 +1,338 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Service;
+
+use OCA\Office\AppInfo\Application;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\Http\Client\IClientService;
+use OCP\IAppConfig;
+use OCP\ICacheFactory;
+use Psr\Log\LoggerInterface;
+use SimpleXMLElement;
+
+class DiscoveryService {
+	private const string CACHE_KEY = 'discovery';
+	private const int CACHE_TTL = 3600;
+	// get() runs while rendering every Files page (file actions), so an unreachable editor
+	// server must not be retried, and waited on, by every page load. Kept in the local cache
+	// (memcache.local): whether the editor is reachable is per web server, and one node's
+	// failure must not hide discovery from the others. Without a local cache NC hands out a
+	// null cache and failures aren't remembered; a Redis local cache shares the marker.
+	private const string FAILURE_CACHE_KEY = 'discovery_failed';
+	private const int FAILURE_CACHE_TTL = 60;
+	// The editor's proof keys, remembered in app config rather than a memcache: WOPI requests
+	// check them on every call, which must not mean a discovery fetch per request on instances
+	// without memcache.local, and once the editor has been seen signing, a failed discovery
+	// fetch must not switch the checks off.
+	private const string PROOF_KEYS_CONFIG = 'proof_keys';
+	private const string PROOF_KEYS_CHECKED_AT_CONFIG = 'proof_keys_checked_at';
+	private const string PROOF_KEYS_REFRESHED_AT_CONFIG = 'proof_keys_refreshed_at';
+	private const int PROOF_KEYS_TTL = 3600;
+	// A proof that doesn't verify against the known keys may mean the editor's keys changed;
+	// rereading discovery for it is allowed once per period, so forged proofs can't turn every
+	// WOPI request into a discovery fetch.
+	private const int PROOF_REFRESH_PERIOD = 300;
+
+	public function __construct(
+		private IClientService $clientService,
+		private ICacheFactory $cacheFactory,
+		private IAppConfig $appConfig,
+		private LoggerInterface $logger,
+		private ITimeFactory $timeFactory,
+	) {
+	}
+
+	/**
+	 * Return cached discovery XML string, fetching from the editor server if needed.
+	 */
+	public function get(): ?string {
+		$cache = $this->cacheFactory->createDistributed('office');
+		/** @psalm-suppress MixedAssignment ICache::get() is untyped; only a string is a cached document */
+		$cached = $cache->get(self::CACHE_KEY);
+		if (is_string($cached)) {
+			return $cached;
+		}
+
+		$localCache = $this->cacheFactory->createLocal('office');
+		if ($this->getEditorUrl() === '' || $localCache->get(self::FAILURE_CACHE_KEY) !== null) {
+			return null;
+		}
+
+		try {
+			return $this->fetch();
+		} catch (\Throwable $e) {
+			$localCache->set(self::FAILURE_CACHE_KEY, true, self::FAILURE_CACHE_TTL);
+			$this->logger->error('Failed to fetch WOPI discovery: ' . $e->getMessage(), ['exception' => $e]);
+			return null;
+		}
+	}
+
+	/**
+	 * Fetch discovery XML from the editor server and cache it.
+	 *
+	 * @throws \Exception if the request fails
+	 */
+	public function fetch(): string {
+		$client = $this->clientService->newClient();
+		$url = $this->getEditorUrl() . '/hosting/discovery';
+
+		$response = $client->get($url, $this->getRequestOptions());
+		$body = (string)$response->getBody();
+
+		$cache = $this->cacheFactory->createDistributed('office');
+		$cache->set(self::CACHE_KEY, $body, self::CACHE_TTL);
+
+		return $body;
+	}
+
+	public function resetCache(): void {
+		$cache = $this->cacheFactory->createDistributed('office');
+		$cache->remove(self::CACHE_KEY);
+		// Only clears this node; other nodes retry once their marker expires.
+		$this->cacheFactory->createLocal('office')->remove(self::FAILURE_CACHE_KEY);
+		// A different editor server has different keys.
+		$this->appConfig->deleteKey(Application::APP_ID, self::PROOF_KEYS_CONFIG);
+		$this->appConfig->deleteKey(Application::APP_ID, self::PROOF_KEYS_CHECKED_AT_CONFIG);
+	}
+
+	/**
+	 * Whether discovery can be read right now, so callers can tell an unreachable or
+	 * unconfigured editor server apart from a file type it doesn't handle.
+	 */
+	public function isAvailable(): bool {
+		return $this->get() !== null;
+	}
+
+	/**
+	 * Return the urlsrc template for the given file extension and action name.
+	 *
+	 * @param string $extension e.g. 'docx'
+	 * @param string $action e.g. 'edit' or 'view'
+	 * @return string|null urlsrc template string, or null if not found
+	 */
+	public function getUrlSrc(string $extension, string $action = 'edit'): ?string {
+		// Allowlist: file extensions are plain ASCII alnum — reject anything else to prevent XPath injection.
+		if (!preg_match('/^[a-zA-Z0-9]{1,20}$/', $extension)) {
+			return null;
+		}
+
+		$xml = $this->get();
+		if ($xml === null) {
+			return null;
+		}
+
+		try {
+			// LIBXML_NONET prevents libxml from making network requests while parsing (e.g. external DTD subsets).
+			$parsed = new SimpleXMLElement($xml, LIBXML_NONET | LIBXML_NOCDATA);
+		} catch (\Exception $e) {
+			$this->logger->error('Failed to parse WOPI discovery XML: ' . $e->getMessage());
+			return null;
+		}
+
+		$actions = $parsed->xpath(
+			sprintf('//app/action[@ext="%s" and @name="%s"]', $extension, $action)
+		);
+
+		if (!is_array($actions) || $actions === []) {
+			return null;
+		}
+
+		return (string)$actions[0]['urlsrc'];
+	}
+
+	/**
+	 * Return all MIME types advertised by the editor's discovery XML.
+	 *
+	 * Returns an empty array if discovery XML is unavailable or unparseable.
+	 *
+	 * @return string[]
+	 */
+	public function getSupportedMimeTypes(): array {
+		$xml = $this->get();
+		if ($xml === null) {
+			return [];
+		}
+
+		try {
+			$parsed = new SimpleXMLElement($xml, LIBXML_NONET | LIBXML_NOCDATA);
+		} catch (\Exception $e) {
+			$this->logger->error('Failed to parse WOPI discovery XML: ' . $e->getMessage());
+			return [];
+		}
+
+		$names = $parsed->xpath('//app/@name');
+		$mimes = [];
+		foreach (is_array($names) ? $names : [] as $name) {
+			$mime = (string)$name;
+			if ($mime !== '' && str_contains($mime, '/')) {
+				$mimes[] = $mime;
+			}
+		}
+
+		return array_values(array_unique($mimes));
+	}
+
+	/**
+	 * The editor's proof keys, or null when it doesn't sign its requests.
+	 *
+	 * Rechecked against discovery once per PROOF_KEYS_TTL. While discovery can't be read,
+	 * the last known keys stay in force.
+	 */
+	public function getProofKeys(): ?WopiProofKeys {
+		$now = $this->timeFactory->getTime();
+		if ($this->appConfig->getValueInt(Application::APP_ID, self::PROOF_KEYS_CHECKED_AT_CONFIG) > $now - self::PROOF_KEYS_TTL) {
+			return $this->storedProofKeys();
+		}
+
+		$xml = $this->get();
+		if ($xml === null) {
+			return $this->storedProofKeys();
+		}
+
+		try {
+			$keys = $this->parseProofKeys($xml);
+		} catch (\Exception $e) {
+			$this->logger->error('Failed to parse WOPI discovery XML: ' . $e->getMessage());
+			return $this->storedProofKeys();
+		}
+
+		// Four base64 values, which never contain '|'.
+		$this->appConfig->setValueString(Application::APP_ID, self::PROOF_KEYS_CONFIG, $keys === null
+			? ''
+			: implode('|', [$keys->modulus, $keys->exponent, $keys->oldModulus, $keys->oldExponent]));
+		$this->appConfig->setValueInt(Application::APP_ID, self::PROOF_KEYS_CHECKED_AT_CONFIG, $now);
+
+		return $keys;
+	}
+
+	/**
+	 * Reread the proof keys from the editor now, at most once per PROOF_REFRESH_PERIOD;
+	 * otherwise return the known keys.
+	 */
+	public function refreshProofKeys(): ?WopiProofKeys {
+		$now = $this->timeFactory->getTime();
+		if ($this->appConfig->getValueInt(Application::APP_ID, self::PROOF_KEYS_REFRESHED_AT_CONFIG) <= $now - self::PROOF_REFRESH_PERIOD) {
+			$this->appConfig->setValueInt(Application::APP_ID, self::PROOF_KEYS_REFRESHED_AT_CONFIG, $now);
+			$this->appConfig->setValueInt(Application::APP_ID, self::PROOF_KEYS_CHECKED_AT_CONFIG, 0);
+			$this->cacheFactory->createDistributed('office')->remove(self::CACHE_KEY);
+		}
+
+		return $this->getProofKeys();
+	}
+
+	/**
+	 * @throws \Exception on malformed XML
+	 */
+	private function parseProofKeys(string $xml): ?WopiProofKeys {
+		$parsed = new SimpleXMLElement($xml, LIBXML_NONET | LIBXML_NOCDATA);
+
+		$elements = $parsed->xpath('//proof-key');
+		if (!is_array($elements) || $elements === []) {
+			return null;
+		}
+
+		$attributes = $elements[0]->attributes();
+		$modulus = (string)($attributes['modulus'] ?? '');
+		$exponent = (string)($attributes['exponent'] ?? '');
+		if ($modulus === '' || $exponent === '') {
+			return null;
+		}
+
+		$oldModulus = (string)($attributes['oldmodulus'] ?? '');
+		$oldExponent = (string)($attributes['oldexponent'] ?? '');
+
+		return new WopiProofKeys(
+			$modulus,
+			$exponent,
+			$oldModulus !== '' ? $oldModulus : $modulus,
+			$oldExponent !== '' ? $oldExponent : $exponent,
+		);
+	}
+
+	private function storedProofKeys(): ?WopiProofKeys {
+		$parts = explode('|', $this->appConfig->getValueString(Application::APP_ID, self::PROOF_KEYS_CONFIG));
+		if (count($parts) !== 4 || in_array('', $parts, true)) {
+			return null;
+		}
+
+		return new WopiProofKeys($parts[0], $parts[1], $parts[2], $parts[3]);
+	}
+
+	/**
+	 * Build the final editor URL by substituting the wopisrc template parameter.
+	 *
+	 * The WOPI urlsrc is a template like:
+	 *   http://editor/hosting/wopi/word/edit?<wopisrc=WOPI_SOURCE&>&
+	 * This method replaces <wopisrc=WOPI_SOURCE&> with the actual WOPISrc value.
+	 *
+	 * @param string $urlsrc Raw urlsrc from discovery XML
+	 * @param string $wopiSrc The WOPI host URL (our CheckFileInfo endpoint)
+	 * @param string $token WOPI access token
+	 */
+	public function buildEditorUrl(string $urlsrc, string $wopiSrc, string $token): string {
+		// Rewrite the internal wopi_url origin to the public_wopi_url origin so browsers can reach the editor.
+		// NC server fetches discovery via the internal Docker hostname (wopi_url); the browser must use the
+		// public hostname (public_wopi_url).  Mirrors the eurooffice DocumentServerInternalUrl/DocumentServerUrl split.
+		$internalUrl = $this->getEditorUrl();
+		$publicUrl = rtrim($this->appConfig->getValueString('office', 'public_wopi_url', ''), '/');
+		if ($publicUrl !== '' && $internalUrl !== '' && str_starts_with($urlsrc, $internalUrl)) {
+			$urlsrc = $publicUrl . substr($urlsrc, strlen($internalUrl));
+		}
+
+		$wopiSrc = $this->editorReachableUrl($wopiSrc);
+
+		// Strip WOPI template placeholders like <wopisrc=WOPI_SOURCE&> leaving bare ? and & separators.
+		$url = rtrim((string)preg_replace('/<[^>]+>/', '', $urlsrc), '?&');
+		// Preserve the ? already in the base URL if present; otherwise start the query string.
+		$separator = str_contains($url, '?') ? '&' : '?';
+		$url .= $separator . 'wopisrc=' . urlencode($wopiSrc) . '&access_token=' . urlencode($token);
+		return $url;
+	}
+
+	/**
+	 * A Nextcloud URL as the editor server reaches it: the origin swapped for callback_url
+	 * when one is configured. Nextcloud generates absolute URLs from the browser-facing
+	 * host, which may not resolve inside the editor's network. Mirrors the eurooffice
+	 * "server address for internal requests" setting.
+	 */
+	public function editorReachableUrl(string $url): string {
+		$callbackUrl = rtrim($this->appConfig->getValueString('office', 'callback_url', ''), '/');
+		if ($callbackUrl === '') {
+			return $url;
+		}
+
+		$parts = parse_url($url);
+		if (!is_array($parts) || !isset($parts['host'])) {
+			return $url;
+		}
+
+		$origin = ($parts['scheme'] ?? 'http') . '://' . $parts['host']
+			. (isset($parts['port']) ? ':' . $parts['port'] : '');
+		return $callbackUrl . substr($url, strlen($origin));
+	}
+
+	private function getEditorUrl(): string {
+		return rtrim($this->appConfig->getValueString('office', 'wopi_url', ''), '/');
+	}
+
+	private function getRequestOptions(): array {
+		$options = [
+			'connect_timeout' => 5,
+			'timeout' => 15,
+			'nextcloud' => ['allow_local_address' => true],
+		];
+
+		if ($this->appConfig->getValueString('office', 'disable_certificate_verification') === 'yes') {
+			$options['verify'] = false;
+		}
+
+		return $options;
+	}
+}
diff --git a/lib/Service/LogThrottle.php b/lib/Service/LogThrottle.php
new file mode 100644
index 00000000..b486632c
--- /dev/null
+++ b/lib/Service/LogThrottle.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Service;
+
+use OCP\ICacheFactory;
+
+/**
+ * Lets a warning through at most once per period on this node. Every log line Nextcloud
+ * writes during a WOPI request carries the request URL, access token included, so warnings
+ * that callers can trigger on every request must not repeat for each one.
+ */
+final class LogThrottle {
+	public function __construct(
+		private ICacheFactory $cacheFactory,
+	) {
+	}
+
+	public function allows(string $key, int $periodSeconds): bool {
+		$cache = $this->cacheFactory->createLocal('office-log-throttle');
+		if ($cache->get($key) !== null) {
+			return false;
+		}
+
+		$cache->set($key, true, $periodSeconds);
+		return true;
+	}
+}
diff --git a/lib/Service/WopiAccess.php b/lib/Service/WopiAccess.php
new file mode 100644
index 00000000..b089e4bc
--- /dev/null
+++ b/lib/Service/WopiAccess.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Service;
+
+use OCP\Files\File;
+
+/**
+ * What a WOPI token may do right now: the file and the effective rights.
+ */
+final class WopiAccess {
+	public function __construct(
+		public readonly File $file,
+		public readonly bool $canWrite,
+		public readonly bool $hideDownload,
+	) {
+	}
+}
diff --git a/lib/Service/WopiAccessResolver.php b/lib/Service/WopiAccessResolver.php
new file mode 100644
index 00000000..8a110126
--- /dev/null
+++ b/lib/Service/WopiAccessResolver.php
@@ -0,0 +1,96 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Service;
+
+use OCA\Office\Db\Wopi;
+use OCP\Constants;
+use OCP\Files\File;
+use OCP\Files\Folder;
+use OCP\Files\IRootFolder;
+use OCP\Files\Node;
+use OCP\Files\NotFoundException;
+use OCP\Share\Exceptions\ShareNotFound;
+use OCP\Share\IManager as IShareManager;
+
+/**
+ * Resolve a WOPI token to its file and current rights, on every request.
+ *
+ * User tokens reach the file through the editor's own folder. Share-link tokens go
+ * through the live share, so deleting it, letting it expire or narrowing it takes
+ * effect on the next request instead of when the token expires.
+ */
+final class WopiAccessResolver {
+	public function __construct(
+		private IRootFolder $rootFolder,
+		private IShareManager $shareManager,
+	) {
+	}
+
+	/**
+	 * @throws NotFoundException if the file, or the share it was opened through, is gone
+	 */
+	public function resolve(Wopi $wopi): WopiAccess {
+		if ($wopi->isShareSession()) {
+			return $this->resolveThroughShare($wopi);
+		}
+
+		$editorUid = $wopi->getEditorUid();
+		if ($editorUid === null) {
+			// Share-link token from before tokens were bound to their share.
+			throw new NotFoundException('WOPI token has neither a user nor a share');
+		}
+
+		$nodes = $this->rootFolder->getUserFolder($editorUid)->getById($wopi->getFileid());
+
+		// Prefer nodes with write permission when multiple exist (e.g. same file mounted in several places)
+		usort($nodes, static function (Node $a, Node $b): int {
+			return ($b->getPermissions() & Constants::PERMISSION_UPDATE) <=> ($a->getPermissions() & Constants::PERMISSION_UPDATE);
+		});
+
+		$file = $nodes[0] ?? null;
+		if (!$file instanceof File) {
+			throw new NotFoundException('File not found for WOPI token');
+		}
+
+		return new WopiAccess($file, $wopi->getCanwrite(), $wopi->getHideDownload());
+	}
+
+	/**
+	 * @throws NotFoundException
+	 */
+	private function resolveThroughShare(Wopi $wopi): WopiAccess {
+		try {
+			$share = $this->shareManager->getShareByToken((string)$wopi->getShareToken());
+		} catch (ShareNotFound) {
+			throw new NotFoundException('The share of this WOPI token no longer exists');
+		}
+
+		$permissions = $share->getPermissions();
+		if (($permissions & Constants::PERMISSION_READ) === 0) {
+			throw new NotFoundException('The share of this WOPI token is no longer readable');
+		}
+
+		// The share's node carries the owner's permissions; the share's own permissions decide.
+		$node = $share->getNode();
+		if ($node instanceof Folder) {
+			// Scoped to the shared folder: a token can't reach files outside it.
+			$node = $node->getFirstNodeById($wopi->getFileid());
+		}
+		if (!$node instanceof File || $node->getId() !== $wopi->getFileid()) {
+			throw new NotFoundException('The share of this WOPI token no longer contains its file');
+		}
+
+		return new WopiAccess(
+			$node,
+			$wopi->getCanwrite() && ($permissions & Constants::PERMISSION_UPDATE) !== 0,
+			$wopi->getHideDownload() || $share->getHideDownload(),
+		);
+	}
+}
diff --git a/lib/Service/WopiProofKeys.php b/lib/Service/WopiProofKeys.php
new file mode 100644
index 00000000..7beddde6
--- /dev/null
+++ b/lib/Service/WopiProofKeys.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Service;
+
+/**
+ * The editor's current and previous RSA proof keys from discovery's <proof-key>:
+ * base64 big-endian modulus and exponent.
+ */
+final class WopiProofKeys {
+	public function __construct(
+		public readonly string $modulus,
+		public readonly string $exponent,
+		public readonly string $oldModulus,
+		public readonly string $oldExponent,
+	) {
+	}
+}
diff --git a/lib/Service/WopiProofVerifier.php b/lib/Service/WopiProofVerifier.php
new file mode 100644
index 00000000..3ba172bc
--- /dev/null
+++ b/lib/Service/WopiProofVerifier.php
@@ -0,0 +1,115 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Service;
+
+use OCP\AppFramework\Utility\ITimeFactory;
+use phpseclib3\Crypt\PublicKeyLoader;
+use phpseclib3\Crypt\RSA;
+use phpseclib3\Math\BigInteger;
+
+/**
+ * Verifies MS-WOPI proof headers: the editor signs (access token, request URL, timestamp)
+ * with its private key, and publishes the public keys in discovery.
+ */
+final class WopiProofVerifier {
+	// .NET ticks (100 ns since 0001-01-01) at the Unix epoch.
+	private const int EPOCH_TICKS = 621355968000000000;
+	private const int MAX_AGE_SECONDS = 20 * 60;
+
+	public function __construct(
+		private ITimeFactory $timeFactory,
+	) {
+	}
+
+	/**
+	 * X-WOPI-TimeStamp must be no older than 20 minutes (MS-WOPI), so a captured
+	 * request can't be replayed later.
+	 */
+	public function isFresh(string $timestamp): bool {
+		if (!ctype_digit($timestamp) || strlen($timestamp) > 19) {
+			return false;
+		}
+
+		$unixSeconds = intdiv((int)$timestamp - self::EPOCH_TICKS, 10_000_000);
+		return $unixSeconds >= $this->timeFactory->getTime() - self::MAX_AGE_SECONDS;
+	}
+
+	/**
+	 * Valid if X-WOPI-Proof verifies with the current or the old key, or X-WOPI-ProofOld
+	 * with the current key: the combinations MS-WOPI allows across a key rotation.
+	 */
+	public function isValid(
+		WopiProofKeys $keys,
+		#[\SensitiveParameter]
+		string $accessToken,
+		#[\SensitiveParameter]
+		string $url,
+		string $timestamp,
+		string $proof,
+		string $proofOld,
+	): bool {
+		$signed = $this->signedData($accessToken, $url, $timestamp);
+		$current = $this->publicKey($keys->modulus, $keys->exponent);
+		$old = $this->publicKey($keys->oldModulus, $keys->oldExponent);
+
+		return $this->verify($current, $signed, $proof)
+			|| $this->verify($old, $signed, $proof)
+			|| $this->verify($current, $signed, $proofOld);
+	}
+
+	private function signedData(string $accessToken, string $url, string $timestamp): string {
+		$upperUrl = mb_strtoupper($url, 'UTF-8');
+
+		return pack('N', strlen($accessToken)) . $accessToken
+			. pack('N', strlen($upperUrl)) . $upperUrl
+			. pack('N', 8) . pack('J', (int)$timestamp);
+	}
+
+	private function publicKey(string $modulus, string $exponent): ?RSA\PublicKey {
+		$n = base64_decode($modulus, true);
+		$e = base64_decode($exponent, true);
+		if ($n === false || $e === false || $n === '' || $e === '') {
+			return null;
+		}
+
+		try {
+			$key = PublicKeyLoader::loadPublicKey([
+				'n' => new BigInteger($n, 256),
+				'e' => new BigInteger($e, 256),
+			]);
+		} catch (\Throwable) {
+			return null;
+		}
+
+		if (!$key instanceof RSA\PublicKey) {
+			return null;
+		}
+
+		// withHash() and withPadding() return a configured clone but declare no return type.
+		/** @var RSA\PublicKey $key */
+		$key = $key->withHash('sha256');
+		/** @var RSA\PublicKey $key */
+		$key = $key->withPadding(RSA::SIGNATURE_PKCS1);
+		return $key;
+	}
+
+	private function verify(?RSA\PublicKey $key, string $signed, string $proof): bool {
+		$signature = base64_decode($proof, true);
+		if ($key === null || $signature === false || $signature === '') {
+			return false;
+		}
+
+		try {
+			return $key->verify($signed, $signature);
+		} catch (\Throwable) {
+			return false;
+		}
+	}
+}
diff --git a/lib/Settings/Admin.php b/lib/Settings/Admin.php
new file mode 100644
index 00000000..b3ca9859
--- /dev/null
+++ b/lib/Settings/Admin.php
@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Settings;
+
+use OCA\Office\AppInfo\Application;
+use OCA\Office\Service\DiscoveryService;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\IAppConfig;
+use OCP\Settings\ISettings;
+
+final class Admin implements ISettings {
+	public function __construct(
+		private IAppConfig $appConfig,
+		private DiscoveryService $discoveryService,
+	) {
+	}
+
+	#[\Override]
+	public function getForm(): TemplateResponse {
+		return new TemplateResponse(Application::APP_ID, 'settings/admin', [
+			'wopi_url' => $this->appConfig->getValueString(Application::APP_ID, 'wopi_url', ''),
+			'public_wopi_url' => $this->appConfig->getValueString(Application::APP_ID, 'public_wopi_url', ''),
+			'callback_url' => $this->appConfig->getValueString(Application::APP_ID, 'callback_url', ''),
+			'disable_certificate_verification' => $this->appConfig->getValueString(Application::APP_ID, 'disable_certificate_verification', 'no'),
+			// Warn when nothing checks who calls the WOPI endpoints: the editor publishes no
+			// proof keys and no wopi_allowlist is set. Unknown (null) while discovery is unreachable.
+			'wopi_caller_unchecked' => $this->discoveryService->isAvailable()
+				? $this->discoveryService->getProofKeys() === null
+					&& trim($this->appConfig->getValueString(Application::APP_ID, 'wopi_allowlist', '')) === ''
+				: null,
+		]);
+	}
+
+	#[\Override]
+	public function getSection(): string {
+		return 'connected-accounts';
+	}
+
+	#[\Override]
+	public function getPriority(): int {
+		return 50;
+	}
+}
diff --git a/lib/TokenManager.php b/lib/TokenManager.php
new file mode 100644
index 00000000..6923b160
--- /dev/null
+++ b/lib/TokenManager.php
@@ -0,0 +1,141 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office;
+
+use OCA\Office\Db\Wopi;
+use OCA\Office\Db\WopiMapper;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\Files\Events\Node\BeforeNodeReadEvent;
+use OCP\Files\File;
+use OCP\Files\IRootFolder;
+use OCP\Files\Node;
+use OCP\Files\NotFoundException;
+use OCP\Files\NotPermittedException;
+use OCP\Files\Storage\ISharedStorage;
+use OCP\IURLGenerator;
+
+class TokenManager {
+	public function __construct(
+		private IRootFolder $rootFolder,
+		private WopiMapper $wopiMapper,
+		private IURLGenerator $urlGenerator,
+		private IEventDispatcher $eventDispatcher,
+		private ?string $userId,
+	) {
+	}
+
+	/**
+	 * Generate a WOPI token for an authenticated user opening a file.
+	 *
+	 * @param int $fileId NC file ID
+	 * @throws NotPermittedException if the file is unreadable or the user has no access
+	 * @throws \OCP\Files\NotFoundException if the file does not exist
+	 */
+	public function generateToken(int $fileId): Wopi {
+		$userFolder = $this->rootFolder->getUserFolder((string)$this->userId);
+
+		$file = $userFolder->getFirstNodeById($fileId);
+
+		if (!$file instanceof File || !$file->isReadable()) {
+			throw new NotPermittedException();
+		}
+
+		$canWrite = $file->isUpdateable();
+		$hideDownload = $this->isDownloadDisabled($userFolder->getById($fileId));
+
+		$owner = $file->getOwner();
+		$ownerUid = $owner !== null ? $owner->getUID() : (string)$this->userId;
+
+		// Fire the read event so audit logging picks it up.
+		$this->eventDispatcher->dispatchTyped(new BeforeNodeReadEvent($file));
+
+		$serverHost = $this->urlGenerator->getAbsoluteURL('/');
+		$version = (string)$file->getMtime();
+
+		return $this->wopiMapper->generateFileToken(
+			fileId: $fileId,
+			ownerUid: $ownerUid,
+			editorUid: (string)$this->userId,
+			version: $version,
+			canWrite: $canWrite,
+			hideDownload: $hideDownload,
+			serverHost: $serverHost,
+		);
+	}
+
+	/**
+	 * Whether a share the user received the file through forbids downloading it. The same
+	 * file can reach a user along several paths; one that forbids it is enough.
+	 *
+	 * @param Node[] $nodes
+	 */
+	private function isDownloadDisabled(array $nodes): bool {
+		foreach ($nodes as $node) {
+			try {
+				$storage = $node->getStorage();
+			} catch (NotFoundException) {
+				continue;
+			}
+			if (!$storage->instanceOfStorage(ISharedStorage::class)) {
+				continue;
+			}
+			if ($storage->getShare()->getAttributes()?->getAttribute('permissions', 'download') === false) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Generate a WOPI token for a guest opening a file via a share link.
+	 *
+	 * @param int $fileId NC file ID (must be reachable via $ownerUid)
+	 * @param string $ownerUid File owner whose storage is used for I/O
+	 * @param string $shareToken The share the session is opened through; access is re-checked against it
+	 * @param string|null $editorUid The logged-in visitor, or null for an anonymous guest
+	 * @param string $guestName Display name shown in the editor
+	 * @param bool $canWrite Whether the share allows editing
+	 */
+	public function generateGuestToken(
+		int $fileId,
+		string $ownerUid,
+		#[\SensitiveParameter]
+		string $shareToken,
+		?string $editorUid,
+		string $guestName,
+		bool $canWrite,
+		bool $hideDownload,
+	): Wopi {
+		$ownerFolder = $this->rootFolder->getUserFolder($ownerUid);
+		$file = $ownerFolder->getFirstNodeById($fileId);
+
+		if (!$file instanceof File || !$file->isReadable()) {
+			throw new NotPermittedException();
+		}
+
+		$this->eventDispatcher->dispatchTyped(new BeforeNodeReadEvent($file));
+
+		$serverHost = $this->urlGenerator->getAbsoluteURL('/');
+		$version = (string)$file->getMtime();
+
+		return $this->wopiMapper->generateGuestToken(
+			fileId: $fileId,
+			ownerUid: $ownerUid,
+			shareToken: $shareToken,
+			editorUid: $editorUid,
+			guestDisplayname: $guestName,
+			version: $version,
+			canWrite: $canWrite,
+			hideDownload: $hideDownload,
+			serverHost: $serverHost,
+		);
+	}
+}
diff --git a/package-lock.json b/package-lock.json
index e62532df..0ec60de6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "office",
-  "version": "2.0.0-dev.0",
+  "version": "2.0.0-dev.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "office",
-      "version": "2.0.0-dev.0",
+      "version": "2.0.0-dev.1",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "@mdi/js": "^7.4.47",
@@ -16,6 +16,7 @@
         "@nextcloud/initial-state": "^3.0.0",
         "@nextcloud/l10n": "^3.4.1",
         "@nextcloud/router": "^3.1.0",
+        "@nextcloud/sharing": "^0.4.0",
         "@nextcloud/vue": "^9.13.1",
         "vue": "^3.5.43",
         "vue-router": "^5.3.1"
diff --git a/package.json b/package.json
index 2126f6e1..397512b2 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "office",
-  "version": "2.0.0-dev.0",
+  "version": "2.0.0-dev.1",
   "license": "AGPL-3.0-or-later",
   "type": "module",
   "scripts": {
@@ -24,6 +24,7 @@
     "@nextcloud/initial-state": "^3.0.0",
     "@nextcloud/l10n": "^3.4.1",
     "@nextcloud/router": "^3.1.0",
+    "@nextcloud/sharing": "^0.4.0",
     "@nextcloud/vue": "^9.13.1",
     "vue": "^3.5.43",
     "vue-router": "^5.3.1"
diff --git a/psalm.xml b/psalm.xml
index 36e7a873..9f2aec0f 100644
--- a/psalm.xml
+++ b/psalm.xml
@@ -16,6 +16,50 @@
 			<directory name="vendor-bin" />
 		</ignoreFiles>
 	</projectFiles>
+	<issueHandlers>
+		<!-- Nextcloud wires these by name (info.xml, DI container, routing attributes, the migration runner),
+		     which psalm can't see. Real unused code elsewhere is still reported. -->
+		<UnusedClass>
+			<errorLevel type="suppress">
+				<directory name="lib/AppInfo" />
+				<directory name="lib/BackgroundJob" />
+				<directory name="lib/Controller" />
+				<directory name="lib/Listener" />
+				<directory name="lib/Migration" />
+				<directory name="lib/Settings" />
+			</errorLevel>
+		</UnusedClass>
+		<PossiblyUnusedMethod>
+			<errorLevel type="suppress">
+				<referencedMethod name="*::__construct" />
+				<!-- Route methods are called by the framework's router. -->
+				<directory name="lib/Controller" />
+			</errorLevel>
+		</PossiblyUnusedMethod>
+		<!-- Entity columns are read and written through Entity's magic accessors, and set by
+		     Entity::fromRow()/fromParams() rather than a constructor. -->
+		<PossiblyUnusedProperty>
+			<errorLevel type="suppress">
+				<directory name="lib/Db" />
+			</errorLevel>
+		</PossiblyUnusedProperty>
+		<PropertyNotSetInConstructor>
+			<errorLevel type="suppress">
+				<directory name="lib/Db" />
+			</errorLevel>
+		</PropertyNotSetInConstructor>
+		<!-- Unit tests mock these, which PHPUnit can't do for final classes. -->
+		<ClassMustBeFinal>
+			<errorLevel type="suppress">
+				<file name="lib/Controller/SettingsController.php" />
+				<file name="lib/Controller/WopiController.php" />
+				<file name="lib/Db/WopiLockMapper.php" />
+				<file name="lib/Db/WopiMapper.php" />
+				<file name="lib/Service/DiscoveryService.php" />
+				<file name="lib/TokenManager.php" />
+			</errorLevel>
+		</ClassMustBeFinal>
+	</issueHandlers>
 	<extraFiles>
 		<directory name="vendor"/>
 		<directory name="vendor-bin/nextcloud-ocp/vendor"/>
diff --git a/src/editor.ts b/src/editor.ts
new file mode 100644
index 00000000..4adefb6c
--- /dev/null
+++ b/src/editor.ts
@@ -0,0 +1,5 @@
+import { createApp } from 'vue'
+import Editor from './views/Editor.vue'
+
+const app = createApp(Editor)
+app.mount('#office-editor')
diff --git a/src/file-actions.ts b/src/file-actions.ts
new file mode 100644
index 00000000..422991cb
--- /dev/null
+++ b/src/file-actions.ts
@@ -0,0 +1,56 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { DefaultType, Permission, registerFileAction } from '@nextcloud/files'
+import { loadState } from '@nextcloud/initial-state'
+import { generateUrl } from '@nextcloud/router'
+import { getSharingToken, isPublicShare } from '@nextcloud/sharing/public'
+
+const supportedMimes: string[] = loadState('office', 'supported-mimes', [])
+
+registerFileAction({
+	id: 'office-open',
+
+	displayName: () => 'Open in Office',
+
+	iconSvgInline: () => '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill="currentColor" d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8zm4 18H6V4h7v5h5z"/></svg>',
+
+	default: DefaultType.DEFAULT,
+
+	order: 10,
+
+	enabled: ({ nodes }) => {
+		if (nodes.length !== 1) {
+			return false
+		}
+		const node = nodes[0]
+		if ((node.permissions & Permission.READ) === 0) {
+			return false
+		}
+		return supportedMimes.includes(node.mime ?? '')
+	},
+
+	exec: async ({ nodes }) => {
+		const node = nodes[0]
+		const fileId = node.fileid
+
+		if (fileId === undefined) {
+			return false
+		}
+
+		if (isPublicShare()) {
+			const token = getSharingToken()
+			if (!token) {
+				return false
+			}
+			window.location.href = generateUrl('/apps/office/open/share/{token}', { token })
+				+ '?fileId=' + encodeURIComponent(String(fileId))
+		} else {
+			window.location.href = generateUrl('/apps/office/open') + '?fileId=' + encodeURIComponent(String(fileId))
+		}
+
+		return true
+	},
+})
diff --git a/src/settings-admin.ts b/src/settings-admin.ts
new file mode 100644
index 00000000..2aaaf303
--- /dev/null
+++ b/src/settings-admin.ts
@@ -0,0 +1,5 @@
+import { createApp } from 'vue'
+import AdminSettings from './settings/AdminSettings.vue'
+
+const app = createApp(AdminSettings)
+app.mount('#office-settings-admin')
diff --git a/src/settings/AdminSettings.spec.ts b/src/settings/AdminSettings.spec.ts
new file mode 100644
index 00000000..f7474732
--- /dev/null
+++ b/src/settings/AdminSettings.spec.ts
@@ -0,0 +1,96 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { flushPromises, mount } from '@vue/test-utils'
+import NcButton from '@nextcloud/vue/components/NcButton'
+import { generateUrl } from '@nextcloud/router'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import AdminSettings from './AdminSettings.vue'
+
+const { postMock } = vi.hoisted(() => ({ postMock: vi.fn() }))
+
+vi.mock('@nextcloud/axios', () => ({
+	default: { post: postMock },
+	isAxiosError: (e: unknown) => (e as { isAxiosError?: boolean })?.isAxiosError === true,
+}))
+
+function setAdminData(data: Record<string, string | boolean | null>) {
+	const el = document.createElement('script')
+	el.id = 'office-admin-data'
+	el.type = 'application/json'
+	el.textContent = JSON.stringify(data)
+	document.body.appendChild(el)
+}
+
+describe('AdminSettings', () => {
+	beforeEach(() => {
+		document.body.innerHTML = ''
+		postMock.mockReset()
+		setAdminData({
+			wopi_url: 'http://eo-internal',
+			public_wopi_url: 'https://office.example.com',
+			callback_url: '',
+			disable_certificate_verification: 'no',
+		})
+	})
+
+	it('renders the form with the stored settings', () => {
+		const wrapper = mount(AdminSettings)
+
+		expect(wrapper.find('h2').text()).toBe('Office')
+		const values = wrapper.findAll('input[type="url"]').map((input) => (input.element as HTMLInputElement).value)
+		expect(values).toEqual(['http://eo-internal', 'https://office.example.com', ''])
+	})
+
+	it.each([
+		[true, true],
+		[false, false],
+		[null, false],
+	])('warns about unchecked WOPI callers only when the server reports them (%s)', (unchecked, shown) => {
+		document.body.innerHTML = ''
+		setAdminData({ wopi_url: 'http://eo-internal', public_wopi_url: '', callback_url: '', disable_certificate_verification: 'no', wopi_caller_unchecked: unchecked })
+
+		const wrapper = mount(AdminSettings)
+
+		expect(wrapper.text().includes('does not sign its requests')).toBe(shown)
+	})
+
+	it('styles the save button as the primary action', () => {
+		const button = mount(AdminSettings).findComponent(NcButton)
+
+		expect(button.props('variant')).toBe('primary')
+	})
+
+	it('saves through the router-generated URL so subdirectory installs work', async () => {
+		postMock.mockResolvedValue({ data: {} })
+		const wrapper = mount(AdminSettings)
+
+		await wrapper.findComponent(NcButton).trigger('click')
+		await flushPromises()
+
+		expect(generateUrl).toHaveBeenCalledWith('/apps/office/settings/admin')
+		expect(postMock).toHaveBeenCalledWith('/apps/office/settings/admin', {
+			wopi_url: 'http://eo-internal',
+			public_wopi_url: 'https://office.example.com',
+			callback_url: '',
+			disable_certificate_verification: 'no',
+		})
+		expect(wrapper.text()).toContain('Settings saved')
+	})
+
+	it('shows the server\'s validation message when saving is rejected', async () => {
+		postMock.mockRejectedValue({
+			isAxiosError: true,
+			message: 'Request failed with status code 400',
+			response: { data: { error: 'wopi_url must use the http or https scheme' } },
+		})
+		const wrapper = mount(AdminSettings)
+
+		await wrapper.findComponent(NcButton).trigger('click')
+		await flushPromises()
+
+		expect(wrapper.text()).toContain('wopi_url must use the http or https scheme')
+	})
+})
diff --git a/src/settings/AdminSettings.vue b/src/settings/AdminSettings.vue
new file mode 100644
index 00000000..0d5047f2
--- /dev/null
+++ b/src/settings/AdminSettings.vue
@@ -0,0 +1,111 @@
+<script setup lang="ts">
+import axios, { isAxiosError } from '@nextcloud/axios'
+import { translate as t } from '@nextcloud/l10n'
+import { generateUrl } from '@nextcloud/router'
+import { ref } from 'vue'
+import NcButton from '@nextcloud/vue/components/NcButton'
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+import NcInputField from '@nextcloud/vue/components/NcInputField'
+import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
+
+interface AdminData {
+	wopi_url: string
+	public_wopi_url: string
+	callback_url: string
+	disable_certificate_verification: string
+	wopi_caller_unchecked: boolean | null
+}
+
+const initial: AdminData = JSON.parse(
+	document.getElementById('office-admin-data')?.textContent ?? '{}',
+)
+
+const wopiUrl = ref(initial.wopi_url ?? '')
+const publicWopiUrl = ref(initial.public_wopi_url ?? '')
+const callbackUrl = ref(initial.callback_url ?? '')
+const disableCertVerification = ref(initial.disable_certificate_verification === 'yes')
+const saving = ref(false)
+const error = ref('')
+const success = ref(false)
+
+async function save(): Promise<void> {
+	saving.value = true
+	error.value = ''
+	success.value = false
+
+	try {
+		await axios.post(generateUrl('/apps/office/settings/admin'), {
+			wopi_url: wopiUrl.value,
+			public_wopi_url: publicWopiUrl.value,
+			callback_url: callbackUrl.value,
+			disable_certificate_verification: disableCertVerification.value ? 'yes' : 'no',
+		})
+
+		success.value = true
+	} catch (e) {
+		error.value = isAxiosError(e) && typeof e.response?.data?.error === 'string'
+			? e.response.data.error
+			: (e as Error).message
+	} finally {
+		saving.value = false
+	}
+}
+</script>
+
+<template>
+	<div class="office-admin-settings">
+		<h2>{{ t('office', 'Office') }}</h2>
+
+		<NcNoteCard v-if="initial.wopi_caller_unchecked === true" type="warning">
+			{{ t('office', 'The editor server does not sign its requests, so Nextcloud cannot tell it apart from anyone else holding a document\'s access token. Configure the editor\'s WOPI proof keys, or restrict access to the editor\'s addresses with "occ config:app:set office wopi_allowlist".') }}
+		</NcNoteCard>
+
+		<NcNoteCard v-if="error" type="error">
+			{{ error }}
+		</NcNoteCard>
+		<NcNoteCard v-if="success" type="success">
+			{{ t('office', 'Settings saved') }}
+		</NcNoteCard>
+
+		<NcInputField
+			v-model="wopiUrl"
+			:label="t('office', 'Editor server URL')"
+			:placeholder="t('office', 'https://editor.example.com')"
+			:helper-text="t('office', 'Address Nextcloud uses to reach the editor server')"
+			type="url" />
+
+		<NcInputField
+			v-model="publicWopiUrl"
+			:label="t('office', 'Editor server URL for browsers')"
+			:placeholder="t('office', 'https://editor.example.com')"
+			:helper-text="t('office', 'Only needed if browsers reach the editor at a different address than Nextcloud does')"
+			type="url" />
+
+		<NcInputField
+			v-model="callbackUrl"
+			:label="t('office', 'Nextcloud URL for editor callbacks')"
+			:placeholder="t('office', 'https://cloud.example.com')"
+			:helper-text="t('office', 'Only needed if the editor server reaches Nextcloud at a different address than browsers do')"
+			type="url" />
+
+		<NcCheckboxRadioSwitch v-model="disableCertVerification">
+			{{ t('office', 'Disable TLS certificate verification (development only)') }}
+		</NcCheckboxRadioSwitch>
+
+		<NcButton
+			:disabled="saving"
+			variant="primary"
+			@click="save">
+			{{ t('office', 'Save') }}
+		</NcButton>
+	</div>
+</template>
+
+<style scoped>
+.office-admin-settings {
+	display: flex;
+	flex-direction: column;
+	gap: 16px;
+	max-width: 480px;
+}
+</style>
diff --git a/src/views/Editor.spec.ts b/src/views/Editor.spec.ts
new file mode 100644
index 00000000..b74aecf0
--- /dev/null
+++ b/src/views/Editor.spec.ts
@@ -0,0 +1,67 @@
+import { mount } from '@vue/test-utils'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import Editor from './Editor.vue'
+
+function setEditorData(data: Record<string, unknown>) {
+	const el = document.createElement('script')
+	el.id = 'office-editor-data'
+	el.type = 'application/json'
+	el.textContent = JSON.stringify(data)
+	document.body.appendChild(el)
+}
+
+describe('Editor', () => {
+	beforeEach(() => {
+		document.body.innerHTML = ''
+	})
+
+	it('submits a hidden POST form instead of a GET iframe src, and keeps wopisrc in the URL while moving access_token to a form field', () => {
+		// EO's WOPI editor route only registers a POST handler, so an
+		// `<iframe src>` (always GET) 404s. EO also reads wopisrc from
+		// req.query but access_token from req.body only, so the split here
+		// isn't arbitrary - getting it backwards breaks EO's own routing.
+		setEditorData({
+			editorUrl: 'http://eo/hosting/wopi/word/edit?wopisrc=http%3A%2F%2Fnc%2Fwopi%2Ffiles%2F76&access_token=secret-token',
+			postMessageOrigin: 'http://nc',
+			fileName: 'test.docx',
+		})
+
+		const submit = vi.spyOn(HTMLFormElement.prototype, 'submit').mockImplementation(() => {})
+		const wrapper = mount(Editor)
+
+		const form = wrapper.get('form')
+		const actionUrl = new URL(form.attributes('action')!)
+
+		expect(actionUrl.searchParams.get('wopisrc')).toBe('http://nc/wopi/files/76')
+		expect(actionUrl.searchParams.has('access_token')).toBe(false)
+
+		const tokenInput = wrapper.get('input[name="access_token"]')
+		expect(tokenInput.attributes('value')).toBe('secret-token')
+
+		expect(form.attributes('method')).toBe('post')
+		expect(form.attributes('target')).toBe(wrapper.get('iframe').attributes('name'))
+		expect(submit).toHaveBeenCalledOnce()
+
+		wrapper.unmount()
+	})
+
+	it('posts the token expiry as access_token_ttl so the editor can warn before saves start failing', () => {
+		setEditorData({
+			editorUrl: 'http://eo/hosting/wopi/word/edit?wopisrc=x&access_token=secret-token',
+			accessTokenTtl: 1700036000000,
+			postMessageOrigin: 'http://nc',
+			fileName: 'test.docx',
+		})
+		vi.spyOn(HTMLFormElement.prototype, 'submit').mockImplementation(() => {})
+
+		const wrapper = mount(Editor)
+
+		expect(wrapper.get('input[name="access_token_ttl"]').attributes('value')).toBe('1700036000000')
+
+		wrapper.unmount()
+	})
+
+	afterEach(() => {
+		vi.restoreAllMocks()
+	})
+})
diff --git a/src/views/Editor.vue b/src/views/Editor.vue
new file mode 100644
index 00000000..367e4563
--- /dev/null
+++ b/src/views/Editor.vue
@@ -0,0 +1,106 @@
+<script setup lang="ts">
+import { onMounted, onUnmounted, ref } from 'vue'
+import { generateUrl } from '@nextcloud/router'
+
+interface EditorData {
+	editorUrl: string
+	accessTokenTtl: number
+	postMessageOrigin: string
+	fileName: string
+}
+
+const data: EditorData = JSON.parse(
+	document.getElementById('office-editor-data')?.textContent ?? '{}',
+)
+
+const iframeRef = ref<HTMLIFrameElement | null>(null)
+const formRef = ref<HTMLFormElement | null>(null)
+const iframeName = 'office-editor-frame'
+
+// WOPI editors load via POST, not GET - EO's own /hosting/wopi/:documentType/:mode
+// only registers a POST handler, so `<iframe src="...">` (always a GET) 404s.
+// A hidden auto-submitting form targeting the iframe by name is the standard
+// WOPI embedding pattern (also how the WOPI JS sample and richdocuments do it).
+// The split is deliberate, not arbitrary: EO's handler reads `wopisrc` from
+// req.query but `access_token` from req.body only (wopiClient.js - `req.query
+// ['wopisrc']` vs `req.body['access_token']`) - the standard WOPI convention of
+// keeping the bearer credential out of the URL (Referer/history/proxy logs)
+// while wopisrc, being just a resource locator, stays part of the action URL.
+const editorUrlObject = new URL(data.editorUrl)
+const accessToken = editorUrlObject.searchParams.get('access_token') ?? ''
+editorUrlObject.searchParams.delete('access_token')
+const editorAction = editorUrlObject.toString()
+
+function handleMessage(event: MessageEvent): void {
+	// Reject messages from any origin other than the editor server.
+	if (event.origin !== new URL(data.editorUrl).origin) {
+		return
+	}
+
+	let msg: Record<string, unknown>
+	try {
+		msg = typeof event.data === 'string' ? JSON.parse(event.data) : event.data
+	} catch {
+		return
+	}
+
+	const id = msg.MessageId as string | undefined
+
+	if (id === 'App_LoadingStatus' && msg.Values) {
+		const status = (msg.Values as Record<string, string>).Status
+		if (status === 'Document_Loaded') {
+			document.title = data.fileName
+		}
+	}
+
+	if (id === 'UI_Close') {
+		// window.close() only works for popup windows; full-page navigation
+		// requires history traversal. Fall back to the office overview if there
+		// is no history entry to go back to (e.g. direct URL access).
+		if (window.history.length > 1) {
+			window.history.back()
+		} else {
+			window.location.href = generateUrl('/apps/office')
+		}
+	}
+}
+
+onMounted(() => {
+	window.addEventListener('message', handleMessage)
+	formRef.value?.submit()
+})
+
+onUnmounted(() => {
+	window.removeEventListener('message', handleMessage)
+})
+</script>
+
+<template>
+	<div>
+		<form
+			ref="formRef"
+			:action="editorAction"
+			:target="iframeName"
+			method="post"
+			hidden>
+			<input type="hidden" name="access_token" :value="accessToken">
+			<input type="hidden" name="access_token_ttl" :value="data.accessTokenTtl">
+		</form>
+		<iframe
+			ref="iframeRef"
+			:name="iframeName"
+			:title="data.fileName"
+			allow="clipboard-read; clipboard-write"
+			allowfullscreen />
+	</div>
+</template>
+
+<style scoped>
+iframe {
+	position: fixed;
+	inset: 0;
+	width: 100%;
+	height: 100%;
+	border: none;
+}
+</style>
diff --git a/templates/editor.php b/templates/editor.php
new file mode 100644
index 00000000..0eec6806
--- /dev/null
+++ b/templates/editor.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+use OCA\Office\AppInfo\Application;
+use OCP\Util;
+
+/**
+ * @var array $_ Template variables:
+ *            - editorUrl       string  Full editor URL with wopisrc and access_token substituted
+ *            - accessTokenTtl  int     Token expiry in ms since the epoch, posted to the editor as access_token_ttl
+ *            - postMessageOrigin string NC server host used to validate inbound postMessages
+ *            - fileName        string  Human-readable file name shown in the page title
+ */
+
+Util::addScript(Application::APP_ID, Application::APP_ID . '-editor');
+
+?>
+<script id="office-editor-data" type="application/json">
+<?php echo json_encode([
+	'editorUrl' => $_['editorUrl'],
+	'accessTokenTtl' => $_['accessTokenTtl'],
+	'postMessageOrigin' => $_['postMessageOrigin'],
+	'fileName' => $_['fileName'],
+], JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT); ?>
+</script>
+<div id="office-editor"></div>
diff --git a/templates/settings/admin.php b/templates/settings/admin.php
new file mode 100644
index 00000000..404f7f1d
--- /dev/null
+++ b/templates/settings/admin.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+use OCA\Office\AppInfo\Application;
+use OCP\Util;
+
+/**
+ * @var array $_ Template variables:
+ *            - wopi_url                      string  Editor server base URL (internal, used server-side)
+ *            - public_wopi_url               string  Editor server URL reachable by browsers (optional)
+ *            - callback_url                  string  Nextcloud URL reachable by the editor server (optional)
+ *            - disable_certificate_verification string  'yes' or 'no'
+ */
+
+Util::addScript(Application::APP_ID, Application::APP_ID . '-settings-admin');
+
+?>
+<script id="office-admin-data" type="application/json">
+<?php echo json_encode([
+	'wopi_url' => $_['wopi_url'],
+	'public_wopi_url' => $_['public_wopi_url'],
+	'callback_url' => $_['callback_url'],
+	'disable_certificate_verification' => $_['disable_certificate_verification'],
+	'wopi_caller_unchecked' => $_['wopi_caller_unchecked'],
+], JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT); ?>
+</script>
+<div id="office-settings-admin"></div>
diff --git a/tests/bootstrap-integration.php b/tests/bootstrap-integration.php
new file mode 100644
index 00000000..0c180593
--- /dev/null
+++ b/tests/bootstrap-integration.php
@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * __DIR__-relative paths do NOT work here: in this docker-dev setup,
+ * apps-extra/office is bind-mounted separately from the rest of the server
+ * tree, so PHP's realpath() resolution for __DIR__ inside this directory
+ * reports the host-side bind-mount source, not /var/www/html/... - three
+ * levels up from there lands outside the container filesystem entirely and
+ * the require fails. The NC server root is reliably /var/www/html inside
+ * this container regardless of where this app happens to be mounted from;
+ * override via NEXTCLOUD_ROOT for other setups.
+ */
+$nextcloudRoot = getenv('NEXTCLOUD_ROOT') ?: '/var/www/html';
+
+// The server's test bootstrap otherwise loads every app in apps/, enabled or not, and a
+// disabled app's providers then query tables that were never created (files_external's
+// oc_external_mounts). Load what the web server loads: the enabled apps.
+putenv('TEST_DONT_LOAD_APPS=1');
+require_once $nextcloudRoot . '/tests/bootstrap.php';
+\OC_App::loadApps();
+
+/**
+ * Deliberately NOT requiring this app's own vendor/autoload.php here.
+ *
+ * Verified by reproduction: with the real server bootstrap loaded first,
+ * additionally requiring vendor/autoload.php still causes OCP\IUser (and
+ * presumably other OCP\* classes) to resolve to the composer-dev-only
+ * `vendor/nextcloud/ocp` STUB package instead of the real server's
+ * lib/public/*.php - this app's ClassLoader wins the autoload race for
+ * classes the real server's classmap-based loader hasn't already loaded,
+ * shadowing the real interfaces with the (possibly differently-versioned)
+ * stub ones. That surfaced as a hard fatal:
+ *   Declaration of OC\User\User::setEnabled(bool $enabled = true) must be
+ *   compatible with OCP\IUser::setEnabled(bool $enabled = true): void
+ * The stub OCP\ mapping exists ONLY in tests/bootstrap-unit.php, where no
+ * real OCP exists to shadow.
+ *
+ * OCA\Office\ itself doesn't need autoloading here either -
+ * \OC_App::loadApp() below registers it via the real server's own
+ * app-loading mechanism. The only things left unresolved are the shared
+ * IntegrationTestCase base class and the StubEditor it uses: PHPUnit's own
+ * <directory suffix="Test.php"> discovery requires each *Test.php file itself
+ * (that's what actually defines those classes), but it never touches
+ * IntegrationTestCase.php or StubEditor.php since those filenames don't
+ * match the suffix pattern - require them explicitly so
+ * `extends IntegrationTestCase` resolves. (Tried eagerly require_once-ing
+ * every file in tests/integration/ here instead; that silently broke
+ * PHPUnit's own discovery for 2 of the 6 classes - it appears to use a
+ * before/after get_declared_classes() diff per file to identify which class
+ * a file defines, and finds nothing new for a file this bootstrap already
+ * loaded. Explicit requires for just the non-Test.php files avoid
+ * that entirely. Also: no PSR-4 autoload rule is used for this namespace -
+ * the "Integration" segment (PascalCase, by convention) doesn't match the
+ * "integration" directory (lowercase, per the plan) and would silently fail
+ * to resolve on this container's case-sensitive filesystem.)
+ */
+require_once __DIR__ . '/integration/StubEditor.php';
+require_once __DIR__ . '/integration/IntegrationTestCase.php';
+
+\OC_App::loadApp(OCA\Office\AppInfo\Application::APP_ID);
+OC_Hook::clear();
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
new file mode 100644
index 00000000..e1dc9340
--- /dev/null
+++ b/tests/bootstrap-unit.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+/** @var \Composer\Autoload\ClassLoader $loader */
+$loader = require_once __DIR__ . '/../vendor/autoload.php';
+
+// The OCP and PSR stubs are mapped here, for unit tests only. In composer.json's autoload-dev
+// they would be in vendor/autoload.php for anything that loads it, and shadow a real
+// server's OCP classes.
+$stubs = __DIR__ . '/../vendor-bin/nextcloud-ocp/vendor';
+$loader->addPsr4('OCP\\', $stubs . '/nextcloud/ocp/OCP/');
+$loader->addPsr4('Psr\\EventDispatcher\\', $stubs . '/psr/event-dispatcher/src/');
+$loader->addPsr4('Psr\\Http\\Message\\', $stubs . '/psr/http-message/src/');
+$loader->addPsr4('Psr\\Http\\Client\\', $stubs . '/psr/http-client/src/');
+$loader->addPsr4('Psr\\Container\\', $stubs . '/psr/container/src/');
+$loader->addPsr4('Psr\\Log\\', $stubs . '/psr/log/src/');
+$loader->addPsr4('Psr\\Clock\\', $stubs . '/psr/clock/src/');
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
deleted file mode 100644
index 64a83fd1..00000000
--- a/tests/bootstrap.php
+++ /dev/null
@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-require_once __DIR__ . '/../../../tests/bootstrap.php';
-require_once __DIR__ . '/../vendor/autoload.php';
-
-\OC_App::loadApp(OCA\Office\AppInfo\Application::APP_ID);
-OC_Hook::clear();
diff --git a/tests/fixtures/discovery-collabora.xml b/tests/fixtures/discovery-collabora.xml
new file mode 100644
index 00000000..1de0d928
--- /dev/null
+++ b/tests/fixtures/discovery-collabora.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+	Representative Collabora-style WOPI discovery document. App names are MIME
+	types, not product names - this is the shape DiscoveryService::getSupportedMimeTypes()
+	was written against, in contrast to discovery-onlyoffice.xml.
+-->
+<wopi-discovery>
+	<net-zone name="external-http">
+		<app name="application/vnd.openxmlformats-officedocument.wordprocessingml.document">
+			<action name="edit" ext="docx" default="true" urlsrc="https://collabora/browser/dist/cool.html?WOPISrc=&lt;WOPI_SOURCE&amp;&gt;"/>
+			<action name="view" ext="docx" urlsrc="https://collabora/browser/dist/cool.html?WOPISrc=&lt;WOPI_SOURCE&amp;&gt;"/>
+		</app>
+		<app name="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet">
+			<action name="edit" ext="xlsx" default="true" urlsrc="https://collabora/browser/dist/cool.html?WOPISrc=&lt;WOPI_SOURCE&amp;&gt;"/>
+		</app>
+	</net-zone>
+</wopi-discovery>
diff --git a/tests/fixtures/discovery-onlyoffice.xml b/tests/fixtures/discovery-onlyoffice.xml
new file mode 100644
index 00000000..e52d14cd
--- /dev/null
+++ b/tests/fixtures/discovery-onlyoffice.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+	Representative OnlyOffice/Euro-Office WOPI discovery document.
+	EO currently advertises zero editor actions in this dev setup (wopi.enable=false
+	server-side), so this fixture is hand-built from the OnlyOffice WOPI docs
+	(https://api.onlyoffice.com/docs/docs-api/using-wopi/overview/) rather than
+	captured output. App names are product names ("Word", "Excel", ...), NOT MIME
+	types - this is what makes DiscoveryService::getSupportedMimeTypes() return []
+	against this fixture (see DiscoveryServiceTest::testGetSupportedMimeTypesReturnsEmptyArrayForOnlyOfficeStyleDiscovery).
+-->
+<wopi-discovery>
+	<net-zone name="external-http">
+		<app name="Word" favIconUrl="http://eo/web-apps/apps/documenteditor/main/resources/img/favicon.ico">
+			<action name="edit" ext="docx" default="true" urlsrc="http://eo/hosting/wopi/word/edit?&lt;rs=DC_LLCC&amp;&gt;&lt;dchat=DISABLE_CHAT&amp;&gt;"/>
+			<action name="view" ext="docx" urlsrc="http://eo/hosting/wopi/word/view?&lt;rs=DC_LLCC&amp;&gt;"/>
+		</app>
+		<app name="Excel" favIconUrl="http://eo/web-apps/apps/spreadsheeteditor/main/resources/img/favicon.ico">
+			<action name="edit" ext="xlsx" default="true" urlsrc="http://eo/hosting/wopi/cell/edit?&lt;rs=DC_LLCC&amp;&gt;"/>
+		</app>
+		<app name="PowerPoint" favIconUrl="http://eo/web-apps/apps/presentationeditor/main/resources/img/favicon.ico">
+			<action name="view" ext="pptx" urlsrc="http://eo/hosting/wopi/slide/view?&lt;rs=DC_LLCC&amp;&gt;"/>
+		</app>
+		<app name="Pdf" favIconUrl="http://eo/web-apps/apps/pdfeditor/main/resources/img/favicon.ico">
+			<action name="view" ext="pdf" urlsrc="http://eo/hosting/wopi/word/view?&lt;rs=DC_LLCC&amp;&gt;"/>
+		</app>
+	</net-zone>
+</wopi-discovery>
diff --git a/tests/fixtures/wopi-proof-euro-office.json b/tests/fixtures/wopi-proof-euro-office.json
new file mode 100644
index 00000000..533d8f69
--- /dev/null
+++ b/tests/fixtures/wopi-proof-euro-office.json
@@ -0,0 +1,17 @@
+{
+  "generatedBy": "Euro-Office wopiUtils.js proof signing (generateProofBuffer + RSA-SHA256)",
+  "discovery": {
+    "value": "unused",
+    "modulus": "r95gtZ7kWC+tADj2s+46RcuBuYXSTTQhzQlU+orH8gxxCjR4YYg9Gjdv7wBJ306c4SQeyRuRjKB0LTRAqlsS1V0I6UZQns8mqGTS08Rj6i5GRwFULZNWYSbZeGu285vZH/c9QTdt25T58WJf3DczgAk3Clb7Y6mPeqoJiEbeASGU6LbSopaRVIrAFOeK/qdxFiksgMrLhZUnGCp4dkAx/HiGINtBiXdDQU4WL0+Jhx0z2Kbj1/TgLBO587eo07YY02YPunMCjoWWktNdl0NXPUje3F1FLcX2+7+Vx8KDqZvuX9etY0Mf2n/TU9jUZTZ1ebsbdvari7xR9b4jzs9wqQ==",
+    "exponent": "AQAB",
+    "oldvalue": "unused",
+    "oldmodulus": "uSGcAn0BAkdkQoO19imTRGIRAjx4/uR2BQTZKhbeuQ6kzCYiI0W+lLID83rUa6AcGgM4mG/urCVCrPBte5YLvS8AM09Jqko3rUY7NKKNDVKnqlx8oO5QPsr0R7C4GXBtUnTM9rvoAudMmUlgVhk6ymx9u1BRcdHcNPRPK/YsdaW0U7Z6jtZNf7j20x5bcPQh/BLo5kfnSNguQE9CvQgAJP4fSs4ve/ybGRUaHLUQBzxeVUDfLqIa3TTIUsnAiVRP+jyYQCNEyyGqxGhKuMmDAhimsm+nAxnkEJaF6wL8RZZ+dj2xwaofNLgFM02xBC6wE9ct4G/VhqjAS7psuLOSCw==",
+    "oldexponent": "AQAB"
+  },
+  "accessToken": "Tok3nWithMixedCase0123456789abcd",
+  "url": "http://nextcloud-internal:8080/index.php/apps/office/wopi/files/82/contents?access_token=Tok3nWithMixedCase0123456789abcd",
+  "timestamp": "639286128000000000",
+  "proofCurrentKey": "Ke13nk7lGPoqXbe8lFJ2HyNNb5tJCeLc63cixdmKj8xo7lE2qOMz5CaHQVHmxMzgGDy2sAFTmuOaZO0cqufKeL04GQ7/6vnWBpLiaJtmcs+KV2/kKU6oAuk73tn5BcrdSGnFXIdV93JsG08Ba09Re3lwzZEsWGmnnTrUY4ZRLOF/BtVVQW58+iVYWqXB6Nemzq9SSSNNSUiGF5WFj9OvEpc1eqqt0Kx1op/6QCzZ14OI9/jUouQg3Zx5JsB+VJrJa/qbSv2WSBYsHvUJyjtB51Nuw2wXz9RQCZsj3mV0LcTQkedXkbXucDQf07/SLelQAemRmHoPVnVSSyza97mRRA==",
+  "proofOldKey": "N5ts1DprwaDz9WsJ3yS62WcM1mt4bobwWtPAw86VosopRFchcAKiMmY6PTxMBFogOmJAA3z6M+rnMIXIsmrvTwUPiydhEShIsHxOFTh1G8APLdxglR6p1N/CH1QwzqtnPD4V5YdkvyAFqBADla5Hij2NOuqFMRW0HpZw+j3oXDXdPo8drdap2J97naviQYW/GZXSlF4fmOD3FvkgGpPo2DozJj9NE9pJeHu1Zg+pZOqtzzF6Nfhz9Hi2WpZ0fWkAiOI9UnqE3q8gDLaHI+/8Fmh3mMTTWI2S00dWbXeXtW+nCK3FkRKjzk1Wv0o988tqyLKrZ7L0xwZ4iZsVjTa8WQ==",
+  "proofOtherKey": "ljtm3mD+7K0W4a0QuXS+RaR1GHc6y9j8Kshi8I2uEDaXbO+fPxPdd1WhiZcjE1i9765Rxd1S4SrewN+VlE1Kejt4xTW5cW5YtzYhehBAHHaamIJ8H2aAveoMbdsN29vWkTnOzZ99sGmZBNMFx9Cm7Ah66J+uO8IC/wm8nR36lIkYP76MsKhpO33wcr8MpM/QjqMCzKijUDavAnLvUA5FI7iEfa8VKAKrWsLp3J38jY75QtGcXoEXxhDm6JUIxTrdqGbAC15/ZQoyBZRqwFNIaymsNRTMeJZ9NS2ZNc2BmXCYcYqkTOrXuV6JcFhu5yLfErhqf1wixvVUId4Mk1b0Dw=="
+}
diff --git a/tests/integration/AdminSettingsTest.php b/tests/integration/AdminSettingsTest.php
new file mode 100644
index 00000000..f41cfdcd
--- /dev/null
+++ b/tests/integration/AdminSettingsTest.php
@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Ports WOPI_TEST_RESULTS.md rows 19-20. Note the route itself changed since
+ * that file was written: rows 19/20 documented /ocs/v2.php/apps/office/... but
+ * commit eebb6aa moved admin settings to FrontpageRoute
+ * (/index.php/apps/office/settings/admin) - see "Known pitfalls" #1 in the
+ * plan. Tests here hit the CURRENT route.
+ */
+
+namespace OCA\Office\Tests\Integration;
+
+class AdminSettingsTest extends IntegrationTestCase {
+	private const ADMIN_URL = '/index.php/apps/office/settings/admin';
+
+	public function testGetAdminSettingsReturnsConfigForAdmin(): void {
+		$response = static::$http->get(self::ADMIN_URL, ['auth' => ['admin', 'admin']]);
+
+		$this->assertSame(200, $response->getStatusCode());
+		$body = json_decode((string)$response->getBody(), true);
+		$this->assertArrayHasKey('wopi_url', $body);
+	}
+
+	public function testGetAdminSettingsReturns401WithoutAuth(): void {
+		$response = static::$http->get(self::ADMIN_URL);
+
+		$this->assertSame(401, $response->getStatusCode());
+	}
+
+	public function testGetAdminSettingsReturns403ForNonAdminUser(): void {
+		$response = static::$http->get(self::ADMIN_URL, [
+			'auth' => [static::TEST_USER, static::TEST_PASSWORD],
+		]);
+
+		$this->assertSame(403, $response->getStatusCode());
+	}
+
+	public function testPostAdminSettingsRejectsInvalidScheme(): void {
+		$response = static::$http->post(self::ADMIN_URL, [
+			'auth' => ['admin', 'admin'],
+			'headers' => ['OCS-APIREQUEST' => 'true'],
+			'form_params' => ['wopi_url' => 'file:///etc/passwd'],
+		]);
+
+		$this->assertSame(400, $response->getStatusCode());
+	}
+
+	public function testPostAdminSettingsRejectsCredentialsInUrl(): void {
+		$response = static::$http->post(self::ADMIN_URL, [
+			'auth' => ['admin', 'admin'],
+			'headers' => ['OCS-APIREQUEST' => 'true'],
+			'form_params' => ['wopi_url' => 'http://user:pass@eo'],
+		]);
+
+		$this->assertSame(400, $response->getStatusCode());
+	}
+}
diff --git a/tests/integration/CleanupJobTest.php b/tests/integration/CleanupJobTest.php
new file mode 100644
index 00000000..9ce1d8d8
--- /dev/null
+++ b/tests/integration/CleanupJobTest.php
@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Token expiry behavior and CleanupJob, invoked directly (not through cron/
+ * IJobList::start(), which would depend on this job's last-run timestamp in
+ * the live job table - reflection on the protected run() method is the
+ * direct, deterministic way to exercise it, per the plan).
+ */
+
+namespace OCA\Office\Tests\Integration;
+
+use OCA\Office\BackgroundJob\CleanupJob;
+use OCA\Office\Db\WopiLockMapper;
+use OCA\Office\Db\WopiMapper;
+use OCA\Office\Exception\UnknownTokenException;
+use OCP\BackgroundJob\IJobList;
+use OCP\Server;
+
+class CleanupJobTest extends IntegrationTestCase {
+	private function runCleanupJob(): void {
+		$job = Server::get(CleanupJob::class);
+		(new \ReflectionMethod($job, 'run'))->invoke($job, null);
+	}
+
+	public function testCheckFileInfoReturns401ForExpiredToken(): void {
+		$file = $this->createTestFile('expired-token.docx');
+		$wopiMapper = Server::get(WopiMapper::class);
+		$wopi = $this->generateToken($file);
+		$wopi->setExpiry(time() - 60);
+		$wopiMapper->update($wopi);
+
+		$response = static::$http->get($this->wopiFilesUrl($file->getId(), $wopi->getToken()));
+
+		$this->assertSame(401, $response->getStatusCode());
+	}
+
+	public function testCleanupJobPurgesExpiredToken(): void {
+		$file = $this->createTestFile('cleanup-token.docx');
+		$wopiMapper = Server::get(WopiMapper::class);
+		$wopi = $this->generateToken($file);
+		$wopi->setExpiry(time() - 3700); // past getExpiredTokenIds()'s 60s grace window too
+		$wopiMapper->update($wopi);
+
+		$this->runCleanupJob();
+
+		$this->expectException(UnknownTokenException::class);
+		$wopiMapper->getWopiForToken($wopi->getToken());
+	}
+
+	public function testCleanupJobPurgesExpiredLock(): void {
+		$file = $this->createTestFile('cleanup-lock.docx');
+		$wopiLockMapper = Server::get(WopiLockMapper::class);
+		$wopiLockMapper->upsertLock($file->getId(), 'expiring-lock');
+		$lock = $wopiLockMapper->findByFileId($file->getId());
+		$this->assertNotNull($lock);
+		$lock->setExpiry(time() - 60);
+		$wopiLockMapper->update($lock);
+
+		$this->runCleanupJob();
+
+		$this->assertNull($wopiLockMapper->findByFileId($file->getId()));
+	}
+
+	public function testCleanupJobLeavesUnexpiredTokensAndLocksAlone(): void {
+		$file = $this->createTestFile('cleanup-keep.docx');
+		$wopiMapper = Server::get(WopiMapper::class);
+		$wopiLockMapper = Server::get(WopiLockMapper::class);
+		$wopi = $this->generateToken($file);
+		$wopiLockMapper->upsertLock($file->getId(), 'still-active');
+
+		$this->runCleanupJob();
+
+		// Neither throws nor returns null - both survive.
+		$survivingWopi = $wopiMapper->getWopiForToken($wopi->getToken());
+		$this->assertSame($file->getId(), $survivingWopi->getFileid());
+		$this->assertNotNull($wopiLockMapper->findByFileId($file->getId()));
+	}
+
+	public function testCleanupJobIsRegisteredInJobList(): void {
+		$jobList = Server::get(IJobList::class);
+
+		$this->assertTrue($jobList->has(CleanupJob::class, null));
+	}
+}
diff --git a/tests/integration/EditorControllerTest.php b/tests/integration/EditorControllerTest.php
new file mode 100644
index 00000000..bf61f2d0
--- /dev/null
+++ b/tests/integration/EditorControllerTest.php
@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Ports WOPI_TEST_RESULTS.md row 21. Discovery comes from the StubEditor, which
+ * advertises an edit action for docx only.
+ */
+
+namespace OCA\Office\Tests\Integration;
+
+class EditorControllerTest extends IntegrationTestCase {
+	public function testOpenReturns401WithoutAuth(): void {
+		$response = static::$http->get('/index.php/apps/office/open?fileId=1');
+
+		$this->assertSame(401, $response->getStatusCode());
+	}
+
+	public function testOpenReturns404ForNonexistentFile(): void {
+		$response = static::$http->get('/index.php/apps/office/open?fileId=999999999', [
+			'auth' => [static::TEST_USER, static::TEST_PASSWORD],
+		]);
+
+		$this->assertSame(404, $response->getStatusCode());
+	}
+
+	public function testOpenHandsTheEditorAUrlItCanOpenTheFileWith(): void {
+		$file = $this->createTestFile('editor-open.docx');
+
+		$response = static::$http->get('/index.php/apps/office/open?fileId=' . $file->getId(), [
+			'auth' => [static::TEST_USER, static::TEST_PASSWORD],
+		]);
+
+		$this->assertSame(200, $response->getStatusCode());
+		$editorUrl = $this->editorUrlFrom($response);
+		$this->assertStringStartsWith(static::$editor->url . '/hosting/wopi/word/edit?wopisrc=', $editorUrl);
+		$this->assertStringContainsString(static::$editor->url, $response->getHeaderLine('Content-Security-Policy'));
+
+		$checkFileInfo = $this->checkFileInfoFromEditorUrl($editorUrl);
+		$this->assertSame(200, $checkFileInfo->getStatusCode());
+		$body = json_decode((string)$checkFileInfo->getBody(), true);
+		$this->assertSame('editor-open.docx', $body['BaseFileName']);
+		$this->assertSame(static::TEST_USER, $body['UserId']);
+	}
+
+	public function testOpenReturns415ForAFileTypeTheEditorDoesNotHandle(): void {
+		$file = $this->createTestFile('editor-open.txt');
+
+		$response = static::$http->get('/index.php/apps/office/open?fileId=' . $file->getId(), [
+			'auth' => [static::TEST_USER, static::TEST_PASSWORD],
+		]);
+
+		$this->assertSame(415, $response->getStatusCode());
+	}
+}
diff --git a/tests/integration/IntegrationTestCase.php b/tests/integration/IntegrationTestCase.php
new file mode 100644
index 00000000..c5fc379a
--- /dev/null
+++ b/tests/integration/IntegrationTestCase.php
@@ -0,0 +1,173 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Shared fixture handling for the WOPI integration suite. Runs against a live
+ * Nextcloud server (see tests/run-integration.sh) - this is NOT a mocked unit
+ * test, every HTTP call hits the real WopiController. A StubEditor plays the
+ * editor server: the app reads its discovery, and static::$http signs WOPI
+ * requests with its proof key.
+ */
+
+namespace OCA\Office\Tests\Integration;
+
+use GuzzleHttp\Client;
+use GuzzleHttp\HandlerStack;
+use OCA\Office\AppInfo\Application;
+use OCA\Office\Db\Wopi;
+use OCA\Office\Db\WopiMapper;
+use OCA\Office\Service\DiscoveryService;
+use OCP\Files\File;
+use OCP\Files\Folder;
+use OCP\Files\IRootFolder;
+use OCP\IAppConfig;
+use OCP\IConfig;
+use OCP\IUserManager;
+use OCP\Server;
+use PHPUnit\Framework\TestCase;
+use Psr\Http\Message\ResponseInterface;
+
+abstract class IntegrationTestCase extends TestCase {
+	protected const TEST_USER = 'wopi_it_user';
+	protected const TEST_PASSWORD = 'wopiIntegrationTest#2026!';
+	// Settings that would point the app away from the stub editor or block the test client.
+	private const EDITOR_SETTINGS = ['wopi_url', 'public_wopi_url', 'callback_url', 'wopi_allowlist'];
+
+	protected static Client $http;
+	protected static StubEditor $editor;
+	protected static Folder $userFolder;
+	private static ?StubEditor $runningEditor = null;
+
+	public static function setUpBeforeClass(): void {
+		static::$editor = self::stubEditor();
+		$handler = HandlerStack::create();
+		$handler->push(static::$editor->signingMiddleware());
+		static::$http = new Client([
+			'base_uri' => self::baseUrl(),
+			'http_errors' => false,
+			'handler' => $handler,
+		]);
+
+		$userManager = Server::get(IUserManager::class);
+		if (!$userManager->userExists(static::TEST_USER)) {
+			$userManager->createUser(static::TEST_USER, static::TEST_PASSWORD);
+		}
+
+		static::$userFolder = Server::get(IRootFolder::class)->getUserFolder(static::TEST_USER);
+	}
+
+	public static function tearDownAfterClass(): void {
+		// Deleting the user removes its home storage (and every file created
+		// against static::$userFolder) - no separate per-file cleanup needed.
+		Server::get(IUserManager::class)->get(static::TEST_USER)?->delete();
+	}
+
+	/**
+	 * One stub editor per process, set as the app's editor server; the settings it replaces
+	 * are put back when the process ends.
+	 */
+	private static function stubEditor(): StubEditor {
+		if (self::$runningEditor !== null) {
+			return self::$runningEditor;
+		}
+
+		$editor = StubEditor::start();
+		$appConfig = Server::get(IAppConfig::class);
+		$saved = [];
+		foreach (self::EDITOR_SETTINGS as $key) {
+			$saved[$key] = $appConfig->hasKey(Application::APP_ID, $key) ? $appConfig->getValueString(Application::APP_ID, $key) : null;
+			$appConfig->deleteKey(Application::APP_ID, $key);
+		}
+		$appConfig->setValueString(Application::APP_ID, 'wopi_url', $editor->url);
+		Server::get(DiscoveryService::class)->resetCache();
+		self::waitForWebServerConfig();
+
+		register_shutdown_function(static function () use ($editor, $saved): void {
+			$appConfig = Server::get(IAppConfig::class);
+			foreach ($saved as $key => $value) {
+				if ($value === null) {
+					$appConfig->deleteKey(Application::APP_ID, $key);
+				} else {
+					$appConfig->setValueString(Application::APP_ID, $key, $value);
+				}
+			}
+			Server::get(DiscoveryService::class)->resetCache();
+			$editor->stop();
+		});
+
+		return self::$runningEditor = $editor;
+	}
+
+	/**
+	 * With memcache.local the web server caches app config for up to 3 seconds
+	 * (OC\AppConfig::LOCAL_CACHE_TTL), and this process can't clear that cache.
+	 */
+	private static function waitForWebServerConfig(): void {
+		if (Server::get(IConfig::class)->getSystemValueString('memcache.local') !== '') {
+			sleep(4);
+		}
+	}
+
+	protected static function baseUrl(): string {
+		$env = getenv('OFFICE_TEST_BASE_URL');
+
+		return $env !== false && $env !== '' ? $env : 'http://localhost';
+	}
+
+	protected function createTestFile(string $name, string $content = "WOPI integration test content.\n"): File {
+		if (static::$userFolder->nodeExists($name)) {
+			static::$userFolder->get($name)->delete();
+		}
+
+		return static::$userFolder->newFile($name, $content);
+	}
+
+	protected function generateToken(File $file, bool $canWrite = true): Wopi {
+		$wopiMapper = Server::get(WopiMapper::class);
+
+		return $wopiMapper->generateFileToken(
+			fileId: $file->getId(),
+			ownerUid: static::TEST_USER,
+			editorUid: static::TEST_USER,
+			version: (string)$file->getMTime(),
+			canWrite: $canWrite,
+			hideDownload: false,
+			serverHost: self::baseUrl(),
+		);
+	}
+
+	/**
+	 * The editor URL an /open response hands the browser.
+	 */
+	protected function editorUrlFrom(ResponseInterface $response): string {
+		$this->assertSame(1, preg_match('#<script id="office-editor-data" type="application/json">\s*(.*?)\s*</script>#s', (string)$response->getBody(), $match));
+		$data = json_decode($match[1], true);
+		$this->assertIsArray($data);
+		$this->assertIsString($data['editorUrl']);
+
+		return $data['editorUrl'];
+	}
+
+	/**
+	 * What the editor does with that URL first: CheckFileInfo on its wopisrc, with its token.
+	 */
+	protected function checkFileInfoFromEditorUrl(string $editorUrl): ResponseInterface {
+		parse_str((string)parse_url($editorUrl, PHP_URL_QUERY), $query);
+		$this->assertIsString($query['wopisrc'] ?? null);
+		$this->assertIsString($query['access_token'] ?? null);
+
+		return static::$http->get($query['wopisrc'] . '?access_token=' . urlencode($query['access_token']));
+	}
+
+	protected function wopiFilesUrl(int $fileId, string $token): string {
+		return '/index.php/apps/office/wopi/files/' . $fileId . '?access_token=' . urlencode($token);
+	}
+
+	protected function wopiContentsUrl(int $fileId, string $token): string {
+		return '/index.php/apps/office/wopi/files/' . $fileId . '/contents?access_token=' . urlencode($token);
+	}
+}
diff --git a/tests/integration/RouteTest.php b/tests/integration/RouteTest.php
new file mode 100644
index 00000000..29a23de2
--- /dev/null
+++ b/tests/integration/RouteTest.php
@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Ports WOPI_TEST_RESULTS.md's unnumbered "Route / CleanupJob Verification"
+ * check for the /index.php/ prefix (the CleanupJob registration half of that
+ * section lives in CleanupJobTest::testCleanupJobIsRegisteredInJobList).
+ */
+
+namespace OCA\Office\Tests\Integration;
+
+use OCP\IURLGenerator;
+use OCP\Server;
+
+class RouteTest extends IntegrationTestCase {
+	public function testWopiRouteIncludesIndexPhpPrefix(): void {
+		$urlGenerator = Server::get(IURLGenerator::class);
+
+		$path = $urlGenerator->linkToRoute('office.wopi.checkFileInfo', ['fileId' => 1]);
+
+		$this->assertStringStartsWith('/index.php/apps/office/wopi/files/', $path);
+	}
+
+	public function testGeneratedRouteIsReachableOverHttp(): void {
+		$file = $this->createTestFile('route-check.docx');
+		$wopi = $this->generateToken($file);
+		$urlGenerator = Server::get(IURLGenerator::class);
+
+		$path = $urlGenerator->linkToRoute('office.wopi.checkFileInfo', ['fileId' => $file->getId()]);
+		$response = static::$http->get($path . '?access_token=' . urlencode($wopi->getToken()));
+
+		$this->assertSame(200, $response->getStatusCode());
+	}
+}
diff --git a/tests/integration/ShareGuestTokenTest.php b/tests/integration/ShareGuestTokenTest.php
new file mode 100644
index 00000000..5f9bde2e
--- /dev/null
+++ b/tests/integration/ShareGuestTokenTest.php
@@ -0,0 +1,185 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Share/guest token flow (ShareController::openShare + TokenManager::generateGuestToken).
+ *
+ * FIXED (validator-authorized follow-up, see wopi-test-suite-FEEDBACK.md Task A):
+ * ShareController::openShare() used to guard the password challenge with
+ * `$share->getPassword() !== ''`. OCP\Share\IShare::getPassword() is
+ * documented (and verified live here) to return `string|null`, and a share
+ * with NO password set returns null, not ''. `null !== ''` is true, so the
+ * guard fired for password-LESS shares too: any unauthenticated guest hitting
+ * a share link that was never password-protected got redirected to the
+ * generic Nextcloud share page instead of ever reaching the WOPI editor - and
+ * it masked every branch after it for unauthenticated requests, including the
+ * READ-permission check. Fixed in ShareController.php:79 to treat null and ''
+ * both as "no password". See wopi-spec-matrix.php row
+ * SHARE-guest-blocked-by-password-check-bug (now `tested`, renamed) and
+ * wopi-test-suite-RESULTS.md.
+ */
+
+namespace OCA\Office\Tests\Integration;
+
+use OCA\Office\TokenManager;
+use OCP\Constants;
+use OCP\Server;
+use OCP\Share\IManager;
+use OCP\Share\IShare;
+
+class ShareGuestTokenTest extends IntegrationTestCase {
+	private function createLinkShare(\OCP\Files\File $file, int $permissions, ?string $password = null): IShare {
+		$shareManager = Server::get(IManager::class);
+		$share = $shareManager->newShare();
+		$share->setNode($file);
+		$share->setShareType(IShare::TYPE_LINK);
+		$share->setPermissions($permissions);
+		if ($password !== null) {
+			$share->setPassword($password);
+		}
+		$share->setSharedBy(static::TEST_USER);
+		$share->setShareOwner(static::TEST_USER);
+
+		return $shareManager->createShare($share);
+	}
+
+	public function testOpenShareReturns404ForUnknownToken(): void {
+		$response = static::$http->get('/index.php/apps/office/open/share/this-token-does-not-exist', [
+			'allow_redirects' => false,
+		]);
+
+		$this->assertSame(404, $response->getStatusCode());
+	}
+
+	public function testOpenShareLetsUnauthenticatedGuestProceedWithoutPassword(): void {
+		$file = $this->createTestFile('share-no-password.docx');
+		$share = $this->createLinkShare($file, Constants::PERMISSION_READ | Constants::PERMISSION_UPDATE);
+		$this->assertNull($share->getPassword(), 'precondition: share must have no password to exercise the fixed guard');
+
+		$response = static::$http->get('/index.php/apps/office/open/share/' . $share->getToken() . '?guestName=Probe', [
+			'allow_redirects' => false,
+		]);
+
+		// An unauthenticated guest on a passwordless share is not redirected (it was 303
+		// before the fix): it gets the editor, under the name it gave.
+		$this->assertSame(200, $response->getStatusCode());
+		$checkFileInfo = $this->checkFileInfoFromEditorUrl($this->editorUrlFrom($response));
+		$this->assertSame(200, $checkFileInfo->getStatusCode());
+		$body = json_decode((string)$checkFileInfo->getBody(), true);
+		$this->assertTrue($body['IsAnonymousUser']);
+		$this->assertSame('Probe', $body['UserFriendlyName']);
+		$this->assertTrue($body['UserCanWrite']);
+	}
+
+	public function testOpenShareLetsLoggedInUserWithoutOwnAccessThroughTheLink(): void {
+		$file = $this->createTestFile('share-authenticated-visit.docx');
+		$share = $this->createLinkShare($file, Constants::PERMISSION_READ | Constants::PERMISSION_UPDATE);
+
+		// admin can't reach the test user's file through their own folder, so the link
+		// is their only access: they get the share-scoped token instead of a 403, saved
+		// under their own name.
+		$response = static::$http->get('/index.php/apps/office/open/share/' . $share->getToken(), [
+			'auth' => ['admin', 'admin'],
+			'allow_redirects' => false,
+		]);
+
+		$this->assertSame(200, $response->getStatusCode());
+		$checkFileInfo = $this->checkFileInfoFromEditorUrl($this->editorUrlFrom($response));
+		$this->assertSame(200, $checkFileInfo->getStatusCode());
+		$body = json_decode((string)$checkFileInfo->getBody(), true);
+		$this->assertFalse($body['IsAnonymousUser']);
+		$this->assertSame('admin', $body['UserId']);
+	}
+
+	public function testOpenShareSendsLoggedInUserWithoutOwnAccessToThePasswordPage(): void {
+		$file = $this->createTestFile('share-authenticated-password.docx');
+		$share = $this->createLinkShare($file, Constants::PERMISSION_READ, 'Link-password#2026');
+
+		// Being logged in doesn't stand in for the link password when the link is
+		// the visitor's only access to the file.
+		$response = static::$http->get('/index.php/apps/office/open/share/' . $share->getToken(), [
+			'auth' => ['admin', 'admin'],
+			'allow_redirects' => false,
+		]);
+
+		$this->assertSame(303, $response->getStatusCode());
+	}
+
+	public function testOpenShareReturns403ForUnreadableShareAsUnauthenticatedGuest(): void {
+		$file = $this->createTestFile('share-no-read.docx');
+		// A share with neither READ nor UPDATE is nonsensical but the controller
+		// guards it explicitly - exercise that guard.
+		$share = $this->createLinkShare($file, Constants::PERMISSION_UPDATE);
+		// Some share backends silently add READ back; only assert the guard's
+		// effect if this environment actually produced a read-less share.
+		if (($share->getPermissions() & Constants::PERMISSION_READ) !== 0) {
+			$this->markTestSkipped('This Nextcloud version always includes PERMISSION_READ on link shares.');
+		}
+
+		// Before the password-guard fix, this branch was unreachable for an
+		// unauthenticated guest on a passwordless share (the buggy guard fired
+		// first and returned 303). Now that it's fixed, an unauthenticated
+		// guest reaches the READ-permission check directly - no auth needed.
+		$response = static::$http->get('/index.php/apps/office/open/share/' . $share->getToken(), [
+			'allow_redirects' => false,
+		]);
+
+		$this->assertSame(403, $response->getStatusCode());
+	}
+
+	/**
+	 * Exercises the guest-token WOPI mechanics directly (TokenManager::generateGuestToken(),
+	 * matching how WOPI_TEST_RESULTS.md's own Phase 1/2 methodology issued tokens
+	 * directly via the mapper) so the underlying token/CheckFileInfo behavior for
+	 * guests is verified over real HTTP, independent of the ShareController entry point.
+	 */
+	public function testGuestTokenGrantsAnonymousWopiAccess(): void {
+		$file = $this->createTestFile('guest-token.docx', 'guest-accessible content');
+		$share = $this->createLinkShare($file, Constants::PERMISSION_READ);
+
+		$tokenManager = Server::get(TokenManager::class);
+		$wopi = $tokenManager->generateGuestToken(
+			fileId: $file->getId(),
+			ownerUid: static::TEST_USER,
+			shareToken: $share->getToken(),
+			editorUid: null,
+			guestName: 'Integration Guest',
+			canWrite: false,
+			hideDownload: true,
+		);
+
+		$response = static::$http->get($this->wopiFilesUrl($file->getId(), $wopi->getToken()));
+
+		$this->assertSame(200, $response->getStatusCode());
+		$body = json_decode((string)$response->getBody(), true);
+		$this->assertTrue($body['IsAnonymousUser']);
+		$this->assertSame('Integration Guest', $body['UserFriendlyName']);
+		$this->assertFalse($body['UserCanWrite']);
+		$this->assertTrue($body['HideExportOption']);
+		$this->assertTrue($body['DisablePrint']);
+	}
+
+	public function testDeletingTheShareEndsTheGuestsWopiAccess(): void {
+		$file = $this->createTestFile('guest-revoked.docx', 'revocable content');
+		$share = $this->createLinkShare($file, Constants::PERMISSION_READ | Constants::PERMISSION_UPDATE);
+		$wopi = Server::get(TokenManager::class)->generateGuestToken(
+			fileId: $file->getId(),
+			ownerUid: static::TEST_USER,
+			shareToken: $share->getToken(),
+			editorUid: null,
+			guestName: 'Integration Guest',
+			canWrite: true,
+			hideDownload: false,
+		);
+		$this->assertSame(200, static::$http->get($this->wopiFilesUrl($file->getId(), $wopi->getToken()))->getStatusCode());
+
+		Server::get(IManager::class)->deleteShare($share);
+
+		// The token itself is still within its TTL; only the share is gone.
+		$this->assertSame(404, static::$http->get($this->wopiFilesUrl($file->getId(), $wopi->getToken()))->getStatusCode());
+	}
+}
diff --git a/tests/integration/StubEditor.php b/tests/integration/StubEditor.php
new file mode 100644
index 00000000..f9a717f9
--- /dev/null
+++ b/tests/integration/StubEditor.php
@@ -0,0 +1,164 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Integration;
+
+use GuzzleHttp\Middleware;
+use Psr\Http\Message\RequestInterface;
+
+/**
+ * Stands in for the editor server: serves a discovery document with edit actions and a
+ * proof key (php -S on a free local port), and signs WOPI requests with that key as an
+ * editor does. Keys and signatures use ext-openssl only, so the signing side shares no
+ * code with the app's verifier; tests/fixtures/wopi-proof-euro-office.json pins the
+ * signed-data layout against Euro-Office's own.
+ */
+final class StubEditor {
+	// .NET ticks (100 ns since 0001-01-01) at the Unix epoch.
+	private const int EPOCH_TICKS = 621355968000000000;
+
+	/** @param resource $process */
+	private function __construct(
+		public readonly string $url,
+		private \OpenSSLAsymmetricKey $key,
+		private $process,
+		private string $root,
+	) {
+	}
+
+	public static function start(): self {
+		$key = self::newKey();
+		$port = self::freePort();
+		$url = 'http://127.0.0.1:' . $port;
+
+		$root = sys_get_temp_dir() . '/office-stub-editor-' . bin2hex(random_bytes(6));
+		mkdir($root . '/hosting', 0700, true);
+		file_put_contents($root . '/hosting/discovery', self::discovery($url, $key));
+
+		$process = proc_open(
+			[PHP_BINARY, '-S', '127.0.0.1:' . $port, '-t', $root],
+			[0 => ['file', '/dev/null', 'r'], 1 => ['file', '/dev/null', 'w'], 2 => ['file', '/dev/null', 'w']],
+			$pipes,
+		);
+		if (!is_resource($process)) {
+			throw new \RuntimeException('Could not start the stub editor');
+		}
+
+		$editor = new self($url, $key, $process, $root);
+		for ($attempt = 0; $attempt < 50; $attempt++) {
+			$socket = @fsockopen('127.0.0.1', $port, $errno, $errstr, 0.1);
+			if ($socket !== false) {
+				fclose($socket);
+				return $editor;
+			}
+			usleep(100_000);
+		}
+
+		$editor->stop();
+		throw new \RuntimeException('The stub editor did not start listening on port ' . $port);
+	}
+
+	public function stop(): void {
+		proc_terminate($this->process);
+		proc_close($this->process);
+		@unlink($this->root . '/hosting/discovery');
+		@rmdir($this->root . '/hosting');
+		@rmdir($this->root);
+	}
+
+	public static function newKey(): \OpenSSLAsymmetricKey {
+		$key = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
+		if ($key === false) {
+			throw new \RuntimeException('Could not generate an RSA key: ' . openssl_error_string());
+		}
+
+		return $key;
+	}
+
+	/**
+	 * X-WOPI-TimeStamp and X-WOPI-Proof for a request to $url, signed with this editor's
+	 * key unless another is given.
+	 *
+	 * @return array{X-WOPI-TimeStamp: string, X-WOPI-Proof: string}
+	 */
+	public function proofHeaders(string $accessToken, string $url, ?int $unixTime = null, ?\OpenSSLAsymmetricKey $key = null): array {
+		$ticks = ($unixTime ?? time()) * 10_000_000 + self::EPOCH_TICKS;
+		if (!openssl_sign(self::proofInput($accessToken, $url, $ticks), $signature, $key ?? $this->key, OPENSSL_ALGO_SHA256)) {
+			throw new \RuntimeException('Could not sign: ' . openssl_error_string());
+		}
+
+		return [
+			'X-WOPI-TimeStamp' => (string)$ticks,
+			'X-WOPI-Proof' => base64_encode($signature),
+		];
+	}
+
+	/**
+	 * Guzzle middleware that signs every request to the WOPI endpoints, as the editor does.
+	 */
+	public function signingMiddleware(): callable {
+		return Middleware::mapRequest(function (RequestInterface $request): RequestInterface {
+			if (!str_contains($request->getUri()->getPath(), '/apps/office/wopi/')) {
+				return $request;
+			}
+
+			parse_str($request->getUri()->getQuery(), $query);
+			$accessToken = is_string($query['access_token'] ?? null) ? $query['access_token'] : '';
+			foreach ($this->proofHeaders($accessToken, (string)$request->getUri()) as $name => $value) {
+				$request = $request->withHeader($name, $value);
+			}
+
+			return $request;
+		});
+	}
+
+	/**
+	 * MS-WOPI proof data: length-prefixed access token, upper-cased URL and timestamp.
+	 */
+	public static function proofInput(string $accessToken, string $url, int $ticks): string {
+		$url = strtoupper($url);
+
+		return pack('N', strlen($accessToken)) . $accessToken
+			. pack('N', strlen($url)) . $url
+			. pack('N', 8) . pack('J', $ticks);
+	}
+
+	private static function discovery(string $url, \OpenSSLAsymmetricKey $key): string {
+		$details = openssl_pkey_get_details($key);
+		if ($details === false || !isset($details['rsa']['n'], $details['rsa']['e'])) {
+			throw new \RuntimeException('Could not read the RSA key');
+		}
+		$modulus = base64_encode($details['rsa']['n']);
+		$exponent = base64_encode($details['rsa']['e']);
+		$urlsrc = htmlspecialchars($url . '/hosting/wopi/word/edit?<wopisrc=WOPI_SOURCE&>', ENT_XML1);
+
+		return <<<XML
+			<?xml version="1.0" encoding="utf-8"?>
+			<wopi-discovery>
+				<net-zone name="external-http">
+					<app name="application/vnd.openxmlformats-officedocument.wordprocessingml.document">
+						<action name="edit" ext="docx" urlsrc="{$urlsrc}"/>
+					</app>
+				</net-zone>
+				<proof-key value="" modulus="{$modulus}" exponent="{$exponent}" oldvalue="" oldmodulus="{$modulus}" oldexponent="{$exponent}"/>
+			</wopi-discovery>
+			XML;
+	}
+
+	private static function freePort(): int {
+		$server = stream_socket_server('tcp://127.0.0.1:0', $errno, $errstr);
+		if ($server === false) {
+			throw new \RuntimeException('No free port: ' . $errstr);
+		}
+		$name = (string)stream_socket_get_name($server, false);
+		fclose($server);
+
+		return (int)substr($name, strrpos($name, ':') + 1);
+	}
+}
diff --git a/tests/integration/StubEditorTest.php b/tests/integration/StubEditorTest.php
new file mode 100644
index 00000000..a85c3afd
--- /dev/null
+++ b/tests/integration/StubEditorTest.php
@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Integration;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * The stub editor's signatures are only worth testing against if it signs what a real
+ * editor signs: check its signed data against a request signed by Euro-Office's own code.
+ */
+class StubEditorTest extends TestCase {
+	public function testSignsTheSameDataAsEuroOffice(): void {
+		$fixture = json_decode((string)file_get_contents(__DIR__ . '/../fixtures/wopi-proof-euro-office.json'), true);
+		$data = StubEditor::proofInput($fixture['accessToken'], $fixture['url'], (int)$fixture['timestamp']);
+		$key = self::publicKeyPem($fixture['discovery']['modulus'], $fixture['discovery']['exponent']);
+
+		$this->assertSame(1, openssl_verify($data, base64_decode($fixture['proofCurrentKey']), $key, OPENSSL_ALGO_SHA256));
+		$this->assertSame(0, openssl_verify($data, base64_decode($fixture['proofOtherKey']), $key, OPENSSL_ALGO_SHA256));
+	}
+
+	/**
+	 * ext-openssl can't build a public key from modulus and exponent, so encode the
+	 * SubjectPublicKeyInfo (RFC 8017 A.1.1) by hand.
+	 */
+	private static function publicKeyPem(string $modulus, string $exponent): string {
+		$integer = static function (string $bytes): string {
+			$bytes = ltrim($bytes, "\0");
+			if (ord($bytes[0]) & 0x80) {
+				$bytes = "\0" . $bytes;
+			}
+			return "\x02" . self::derLength(strlen($bytes)) . $bytes;
+		};
+		$rsaKey = $integer(base64_decode($modulus)) . $integer(base64_decode($exponent));
+		$rsaKey = "\x30" . self::derLength(strlen($rsaKey)) . $rsaKey;
+		$bitString = "\x00" . $rsaKey;
+		// SEQUENCE { OID rsaEncryption, NULL }
+		$algorithm = hex2bin('300d06092a864886f70d0101010500');
+		$spki = $algorithm . "\x03" . self::derLength(strlen($bitString)) . $bitString;
+		$spki = "\x30" . self::derLength(strlen($spki)) . $spki;
+
+		return "-----BEGIN PUBLIC KEY-----\n" . chunk_split(base64_encode($spki), 64, "\n") . "-----END PUBLIC KEY-----\n";
+	}
+
+	private static function derLength(int $length): string {
+		if ($length < 0x80) {
+			return chr($length);
+		}
+		$bytes = ltrim(pack('N', $length), "\0");
+		return chr(0x80 | strlen($bytes)) . $bytes;
+	}
+}
diff --git a/tests/integration/WopiProofTest.php b/tests/integration/WopiProofTest.php
new file mode 100644
index 00000000..ca3e092e
--- /dev/null
+++ b/tests/integration/WopiProofTest.php
@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * The editor publishes a proof key (the StubEditor does), so the WOPI endpoints
+ * take only requests it signed. Every other test signs through static::$http;
+ * these send their own headers.
+ */
+
+namespace OCA\Office\Tests\Integration;
+
+use GuzzleHttp\Client;
+
+class WopiProofTest extends IntegrationTestCase {
+	private Client $unsigned;
+
+	protected function setUp(): void {
+		$this->unsigned = new Client(['base_uri' => self::baseUrl(), 'http_errors' => false]);
+	}
+
+	/**
+	 * @return array{0: string, 1: string} token and request path
+	 */
+	private function tokenForNewFile(string $name): array {
+		$file = $this->createTestFile($name);
+		$token = $this->generateToken($file)->getToken();
+
+		return [$token, $this->wopiFilesUrl($file->getId(), $token)];
+	}
+
+	public function testSignedRequestIsAccepted(): void {
+		[$token, $path] = $this->tokenForNewFile('proof-signed.docx');
+
+		$response = $this->unsigned->get($path, [
+			'headers' => static::$editor->proofHeaders($token, self::baseUrl() . $path),
+		]);
+
+		$this->assertSame(200, $response->getStatusCode());
+	}
+
+	public function testUnsignedRequestIsRejected(): void {
+		[, $path] = $this->tokenForNewFile('proof-unsigned.docx');
+
+		$this->assertSame(403, $this->unsigned->get($path)->getStatusCode());
+	}
+
+	public function testRequestSignedWithAnotherKeyIsRejected(): void {
+		[$token, $path] = $this->tokenForNewFile('proof-other-key.docx');
+
+		$response = $this->unsigned->get($path, [
+			'headers' => static::$editor->proofHeaders($token, self::baseUrl() . $path, key: StubEditor::newKey()),
+		]);
+
+		$this->assertSame(403, $response->getStatusCode());
+	}
+
+	public function testProofOlderThan20MinutesIsRejected(): void {
+		[$token, $path] = $this->tokenForNewFile('proof-stale.docx');
+
+		$response = $this->unsigned->get($path, [
+			'headers' => static::$editor->proofHeaders($token, self::baseUrl() . $path, unixTime: time() - 21 * 60),
+		]);
+
+		$this->assertSame(403, $response->getStatusCode());
+	}
+
+	public function testProofForOneFileDoesNotOpenAnother(): void {
+		[$token, $path] = $this->tokenForNewFile('proof-signed-for.docx');
+		[$otherToken, $otherPath] = $this->tokenForNewFile('proof-replayed-to.docx');
+
+		$response = $this->unsigned->get($otherPath, [
+			'headers' => static::$editor->proofHeaders($token, self::baseUrl() . $path),
+		]);
+
+		$this->assertNotSame($token, $otherToken);
+		$this->assertSame(403, $response->getStatusCode());
+	}
+}
diff --git a/tests/integration/WopiProtocolTest.php b/tests/integration/WopiProtocolTest.php
new file mode 100644
index 00000000..4ac88e6a
--- /dev/null
+++ b/tests/integration/WopiProtocolTest.php
@@ -0,0 +1,288 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Ports WOPI_TEST_RESULTS.md rows 1-18 (CheckFileInfo, GetFile, PutFile, the
+ * lock protocol) plus RenameFile, which had no coverage anywhere before this
+ * suite. Every request goes over real HTTP to a running Nextcloud + this app.
+ */
+
+namespace OCA\Office\Tests\Integration;
+
+class WopiProtocolTest extends IntegrationTestCase {
+	public function testCheckFileInfoReturnsMetadataForValidToken(): void {
+		$file = $this->createTestFile('checkfileinfo.docx');
+		$wopi = $this->generateToken($file);
+
+		$response = static::$http->get($this->wopiFilesUrl($file->getId(), $wopi->getToken()));
+
+		$this->assertSame(200, $response->getStatusCode());
+		$body = json_decode((string)$response->getBody(), true);
+		$this->assertSame('checkfileinfo.docx', $body['BaseFileName']);
+		$this->assertSame(static::TEST_USER, $body['UserId']);
+		$this->assertTrue($body['UserCanWrite']);
+		$this->assertFalse($body['IsAnonymousUser']);
+	}
+
+	public function testCheckFileInfoReturns403ForUnknownToken(): void {
+		$file = $this->createTestFile('checkfileinfo-unknown.docx');
+
+		$response = static::$http->get($this->wopiFilesUrl($file->getId(), 'not-a-real-token'));
+
+		$this->assertSame(403, $response->getStatusCode());
+	}
+
+	public function testGetFileReturnsBinaryBody(): void {
+		$file = $this->createTestFile('getfile.docx', 'exact file content for GetFile');
+		$wopi = $this->generateToken($file);
+
+		$response = static::$http->get($this->wopiContentsUrl($file->getId(), $wopi->getToken()));
+
+		$this->assertSame(200, $response->getStatusCode());
+		$this->assertSame('exact file content for GetFile', (string)$response->getBody());
+		$this->assertSame('application/octet-stream', $response->getHeaderLine('Content-Type'));
+	}
+
+	public function testGetFileRangeReturnsPartialContent(): void {
+		$content = str_repeat('0123456789', 20); // 200 bytes
+		$file = $this->createTestFile('getfile-range.docx', $content);
+		$wopi = $this->generateToken($file);
+
+		$response = static::$http->get($this->wopiContentsUrl($file->getId(), $wopi->getToken()), [
+			'headers' => ['Range' => 'bytes=0-99'],
+		]);
+
+		$this->assertSame(206, $response->getStatusCode());
+		$this->assertSame('bytes 0-99/200', $response->getHeaderLine('Content-Range'));
+		$this->assertSame(substr($content, 0, 100), (string)$response->getBody());
+	}
+
+	public function testGetFileRangeBeyondEofReturns416(): void {
+		$content = str_repeat('a', 50);
+		$file = $this->createTestFile('getfile-416.docx', $content);
+		$wopi = $this->generateToken($file);
+
+		$response = static::$http->get($this->wopiContentsUrl($file->getId(), $wopi->getToken()), [
+			'headers' => ['Range' => 'bytes=99999-'],
+		]);
+
+		$this->assertSame(416, $response->getStatusCode());
+		$this->assertSame('bytes */50', $response->getHeaderLine('Content-Range'));
+	}
+
+	/**
+	 * WOPI_TEST_RESULTS.md row 5 documented "PutFile, no lock held -> 200"
+	 * without noting file size. Verified live in this environment: that only
+	 * holds for an EMPTY file - see testPutFileOnNonEmptyFileWithNoLockReturns409
+	 * below for the H-3 fix (commit 71e4f08) that now requires a lock for any
+	 * non-empty save.
+	 */
+	public function testPutFileOnEmptyFileWithNoLockSucceeds(): void {
+		$file = $this->createTestFile('putfile-empty.docx', '');
+		$wopi = $this->generateToken($file);
+
+		$response = static::$http->post($this->wopiContentsUrl($file->getId(), $wopi->getToken()), [
+			'body' => 'first content, file was empty',
+		]);
+
+		$this->assertSame(200, $response->getStatusCode());
+	}
+
+	public function testPutFileOnNonEmptyFileWithNoLockReturns409(): void {
+		$file = $this->createTestFile('putfile-nonempty.docx', 'not empty');
+		$wopi = $this->generateToken($file);
+
+		$response = static::$http->post($this->wopiContentsUrl($file->getId(), $wopi->getToken()), [
+			'body' => 'attempted overwrite without a lock',
+		]);
+
+		$this->assertSame(409, $response->getStatusCode());
+		$this->assertSame('', $response->getHeaderLine('X-WOPI-Lock'));
+		$this->assertNotEmpty($response->getHeaderLine('X-WOPI-LockFailureReason'));
+	}
+
+	public function testPutFileWithCorrectLockSucceeds(): void {
+		$file = $this->createTestFile('putfile-locked.docx', 'not empty');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		$lockResponse = static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'put-lock']]);
+		$this->assertSame(200, $lockResponse->getStatusCode());
+
+		$response = static::$http->post($this->wopiContentsUrl($file->getId(), $wopi->getToken()), [
+			'headers' => ['X-WOPI-Lock' => 'put-lock'],
+			'body' => 'new content, correctly locked',
+		]);
+
+		$this->assertSame(200, $response->getStatusCode());
+		$body = json_decode((string)$response->getBody(), true);
+		$this->assertArrayHasKey('LastModifiedTime', $body);
+	}
+
+	public function testPutFileWithoutMatchingLockReturns409(): void {
+		$file = $this->createTestFile('putfile-wronglock.docx', 'not empty');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'holder-lock']]);
+
+		$response = static::$http->post($this->wopiContentsUrl($file->getId(), $wopi->getToken()), [
+			'headers' => ['X-WOPI-Lock' => 'wrong-lock'],
+			'body' => 'should be rejected',
+		]);
+
+		$this->assertSame(409, $response->getStatusCode());
+		$this->assertSame('holder-lock', $response->getHeaderLine('X-WOPI-Lock'));
+	}
+
+	public function testPutFileWithStaleTimestampReturns409(): void {
+		$file = $this->createTestFile('putfile-timestamp.docx', 'not empty');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'version-lock']]);
+
+		$response = static::$http->post($this->wopiContentsUrl($file->getId(), $wopi->getToken()), [
+			'headers' => ['X-WOPI-Lock' => 'version-lock', 'X-COOL-WOPI-Timestamp' => '2000-01-01T00:00:00.000Z'],
+			'body' => 'stale version write attempt',
+		]);
+
+		$this->assertSame(409, $response->getStatusCode());
+		$this->assertSame(['COOLStatusCode' => 1010], json_decode((string)$response->getBody(), true));
+	}
+
+	public function testLockNewFileReturns200(): void {
+		$file = $this->createTestFile('lock-new.docx');
+		$wopi = $this->generateToken($file);
+
+		$response = static::$http->post($this->wopiFilesUrl($file->getId(), $wopi->getToken()), [
+			'headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'lock-1'],
+		]);
+
+		$this->assertSame(200, $response->getStatusCode());
+	}
+
+	public function testGetLockReturnsLockId(): void {
+		$file = $this->createTestFile('get-lock.docx');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'lock-2']]);
+		$response = static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'GET_LOCK']]);
+
+		$this->assertSame(200, $response->getStatusCode());
+		$this->assertSame('lock-2', $response->getHeaderLine('X-WOPI-Lock'));
+	}
+
+	public function testLockDifferentIdReturns409(): void {
+		$file = $this->createTestFile('lock-conflict.docx');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'holder']]);
+		$response = static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'challenger']]);
+
+		$this->assertSame(409, $response->getStatusCode());
+		$this->assertSame('holder', $response->getHeaderLine('X-WOPI-Lock'));
+		$this->assertNotEmpty($response->getHeaderLine('X-WOPI-LockFailureReason'));
+	}
+
+	public function testLockSameIdIsIdempotent(): void {
+		$file = $this->createTestFile('lock-idempotent.docx');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'same-id']]);
+		$response = static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'same-id']]);
+
+		$this->assertSame(200, $response->getStatusCode());
+	}
+
+	public function testRefreshLockReturns200(): void {
+		$file = $this->createTestFile('refresh-lock.docx');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'refresh-me']]);
+		$response = static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'REFRESH_LOCK', 'X-WOPI-Lock' => 'refresh-me']]);
+
+		$this->assertSame(200, $response->getStatusCode());
+	}
+
+	public function testUnlockReturns200(): void {
+		$file = $this->createTestFile('unlock.docx');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'to-unlock']]);
+		$response = static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'UNLOCK', 'X-WOPI-Lock' => 'to-unlock']]);
+
+		$this->assertSame(200, $response->getStatusCode());
+	}
+
+	public function testGetLockAfterUnlockReturnsEmptyHeader(): void {
+		$file = $this->createTestFile('get-lock-after-unlock.docx');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'temp']]);
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'UNLOCK', 'X-WOPI-Lock' => 'temp']]);
+		$response = static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'GET_LOCK']]);
+
+		$this->assertSame(200, $response->getStatusCode());
+		$this->assertSame('', $response->getHeaderLine('X-WOPI-Lock'));
+	}
+
+	public function testUnlockAndRelockValid(): void {
+		$file = $this->createTestFile('unlockandrelock.docx');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'old']]);
+		$response = static::$http->post($filesUrl, [
+			'headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'new', 'X-WOPI-OldLock' => 'old'],
+		]);
+
+		$this->assertSame(200, $response->getStatusCode());
+
+		$getLock = static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'GET_LOCK']]);
+		$this->assertSame('new', $getLock->getHeaderLine('X-WOPI-Lock'));
+	}
+
+	public function testUnlockAndRelockWrongOldReturns409(): void {
+		$file = $this->createTestFile('unlockandrelock-wrong.docx');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'actual-old']]);
+		$response = static::$http->post($filesUrl, [
+			'headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'new', 'X-WOPI-OldLock' => 'wrong-old'],
+		]);
+
+		$this->assertSame(409, $response->getStatusCode());
+		$this->assertSame('actual-old', $response->getHeaderLine('X-WOPI-Lock'));
+	}
+
+	public function testRenameFileSucceeds(): void {
+		$file = $this->createTestFile('rename-me.docx');
+		$wopi = $this->generateToken($file);
+		$filesUrl = $this->wopiFilesUrl($file->getId(), $wopi->getToken());
+
+		static::$http->post($filesUrl, ['headers' => ['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'rename-lock']]);
+		$response = static::$http->post($filesUrl, [
+			'headers' => [
+				'X-WOPI-Override' => 'RENAME_FILE',
+				'X-WOPI-RequestedName' => 'renamed-integration-file',
+				'X-WOPI-Lock' => 'rename-lock',
+			],
+		]);
+
+		$this->assertSame(200, $response->getStatusCode());
+		$body = json_decode((string)$response->getBody(), true);
+		$this->assertSame('renamed-integration-file.docx', $body['Name']);
+	}
+}
diff --git a/tests/phpunit.integration.xml b/tests/phpunit.integration.xml
new file mode 100644
index 00000000..08b4ce1a
--- /dev/null
+++ b/tests/phpunit.integration.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" bootstrap="bootstrap-integration.php" timeoutForSmallTests="900" timeoutForMediumTests="900" timeoutForLargeTests="900" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.4/phpunit.xsd" cacheDirectory=".phpunit.cache">
+	<testsuite name="Office Integration Tests">
+		<directory suffix="Test.php">integration</directory>
+	</testsuite>
+	<source>
+		<include>
+			<directory suffix=".php">../appinfo</directory>
+			<directory suffix=".php">../lib</directory>
+		</include>
+	</source>
+</phpunit>
diff --git a/tests/phpunit.xml b/tests/phpunit.xml
index 2d656963..fb5b941a 100644
--- a/tests/phpunit.xml
+++ b/tests/phpunit.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
-<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" bootstrap="bootstrap.php" timeoutForSmallTests="900" timeoutForMediumTests="900" timeoutForLargeTests="900" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.4/phpunit.xsd" cacheDirectory=".phpunit.cache">
-	<testsuite name="Office Tests">
-		<directory suffix="Test.php">.</directory>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" bootstrap="bootstrap-unit.php" timeoutForSmallTests="900" timeoutForMediumTests="900" timeoutForLargeTests="900" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.4/phpunit.xsd" cacheDirectory=".phpunit.cache">
+	<testsuite name="Office Unit Tests">
+		<directory suffix="Test.php">unit</directory>
 	</testsuite>
 	<source>
 		<include>
diff --git a/tests/run-integration.sh b/tests/run-integration.sh
new file mode 100755
index 00000000..8e166b3c
--- /dev/null
+++ b/tests/run-integration.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Runs the WOPI integration suite against a running Nextcloud with this app
+# enabled. Runs here by default (CI, or a shell inside the server container).
+# Environment:
+#   OFFICE_IT_CONTAINER   run inside this container instead, with the app at
+#                         /var/www/html/apps-extra/office (the dev setup: nextcloud)
+#   OFFICE_TEST_BASE_URL  the URL the server answers on (default http://localhost)
+#   NEXTCLOUD_ROOT        the server checkout (default /var/www/html)
+#
+# Runs each *Test.php class as its OWN phpunit process rather than one
+# combined run. Verified by reproduction: running the full suite in a single
+# process works fine through the first two or three classes, then every
+# subsequent class's IntegrationTestCase::createTestFile() starts throwing
+# OCP\Files\NotPermittedException ("Could not create path") for the rest of
+# the run - while every one of those same classes passes cleanly when run
+# alone. Each class's setUpBeforeClass()/tearDownAfterClass() creates and
+# deletes a same-named test user (wopi_it_user); most likely a NC
+# LazyFolder/SetupManager mount-cache entry (or a SQLite-specific caching
+# quirk) doesn't get invalidated across a same-process delete+recreate of the
+# same uid, corrupting filesystem resolution for the rest of that process.
+# One process per class sidesteps it entirely at a small time cost.
+#
+# Usage: tests/run-integration.sh [phpunit args...]
+# Example: OFFICE_IT_CONTAINER=nextcloud tests/run-integration.sh --filter WopiProtocolTest
+#          (runs against whichever class(es) --filter matches, each still in its own process per file)
+
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+phpunit() {
+	if [ -z "${OFFICE_IT_CONTAINER:-}" ]; then
+		php vendor/bin/phpunit "$@"
+		return
+	fi
+
+	local env=()
+	for name in OFFICE_TEST_BASE_URL NEXTCLOUD_ROOT; do
+		if [ -n "${!name:-}" ]; then
+			env+=(-e "$name=${!name}")
+		fi
+	done
+	docker exec -u www-data -w /var/www/html/apps-extra/office ${env[@]+"${env[@]}"} "$OFFICE_IT_CONTAINER" \
+		php vendor/bin/phpunit "$@"
+}
+
+exit_code=0
+for test_file in tests/integration/*Test.php; do
+	class_name="$(basename "$test_file" .php)"
+	echo "=== $class_name ==="
+	if ! phpunit "$test_file" -c tests/phpunit.integration.xml --colors=always "$@"; then
+		exit_code=1
+	fi
+	echo
+done
+
+exit $exit_code
diff --git a/tests/spec-coverage.php b/tests/spec-coverage.php
new file mode 100644
index 00000000..5cd714ef
--- /dev/null
+++ b/tests/spec-coverage.php
@@ -0,0 +1,84 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Prints WOPI spec coverage per operation and overall, from tests/wopi-spec-matrix.php.
+ * Usage: php tests/spec-coverage.php
+ */
+
+$rows = require __DIR__ . '/wopi-spec-matrix.php';
+
+$byOp = [];
+foreach ($rows as $row) {
+	$byOp[$row['op']][] = $row;
+}
+
+$statusOrder = ['tested', 'implemented-untested', 'not-implemented', 'n-a'];
+$statusLabel = ['tested' => 'tested', 'implemented-untested' => 'untested', 'not-implemented' => 'no-impl', 'n-a' => 'n/a'];
+
+$colOp = 28;
+$colNum = 10;
+
+printf("%-{$colOp}s", 'Operation');
+foreach ($statusOrder as $status) {
+	printf("%{$colNum}s", $statusLabel[$status]);
+}
+printf("%{$colNum}s\n", 'total');
+echo str_repeat('-', $colOp + $colNum * (count($statusOrder) + 1)) . "\n";
+
+$totals = array_fill_keys($statusOrder, 0);
+
+ksort($byOp);
+foreach ($byOp as $op => $opRows) {
+	$counts = array_fill_keys($statusOrder, 0);
+	foreach ($opRows as $row) {
+		$counts[$row['status']]++;
+		$totals[$row['status']]++;
+	}
+
+	printf("%-{$colOp}s", $op);
+	foreach ($statusOrder as $status) {
+		printf("%{$colNum}s", $counts[$status] ?: '.');
+	}
+	printf("%{$colNum}s\n", count($opRows));
+}
+
+echo str_repeat('-', $colOp + $colNum * (count($statusOrder) + 1)) . "\n";
+$totalRows = count($rows);
+printf("%-{$colOp}s", 'TOTAL');
+foreach ($statusOrder as $status) {
+	printf("%{$colNum}s", $totals[$status]);
+}
+printf("%{$colNum}s\n", $totalRows);
+
+echo "\n";
+$tested = $totals['tested'];
+$implementedUntested = $totals['implemented-untested'];
+$notImplemented = $totals['not-implemented'];
+$implemented = $tested + $implementedUntested;
+
+printf("Rows in matrix:            %d\n", $totalRows);
+printf("Implemented (tested + untested): %d (%.1f%%)\n", $implemented, $totalRows > 0 ? $implemented / $totalRows * 100 : 0);
+printf("  of which tested:         %d (%.1f%% of implemented, %.1f%% of total)\n",
+	$tested,
+	$implemented > 0 ? $tested / $implemented * 100 : 0,
+	$totalRows > 0 ? $tested / $totalRows * 100 : 0,
+);
+printf("Not implemented:           %d (%.1f%%)\n", $notImplemented, $totalRows > 0 ? $notImplemented / $totalRows * 100 : 0);
+
+$dishonest = [];
+foreach ($rows as $row) {
+	if ($row['status'] === 'tested' && empty($row['test'])) {
+		$dishonest[] = $row['id'];
+	}
+}
+if ($dishonest !== []) {
+	fwrite(STDERR, "\nERROR: rows marked 'tested' with no named test: " . implode(', ', $dishonest) . "\n");
+	exit(1);
+}
+
+exit(0);
diff --git a/tests/unit/BackgroundJob/CleanupJobTest.php b/tests/unit/BackgroundJob/CleanupJobTest.php
new file mode 100644
index 00000000..21ea6d51
--- /dev/null
+++ b/tests/unit/BackgroundJob/CleanupJobTest.php
@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\BackgroundJob;
+
+use OCA\Office\BackgroundJob\CleanupJob;
+use OCA\Office\Db\WopiLockMapper;
+use OCA\Office\Db\WopiMapper;
+use OCP\AppFramework\Utility\ITimeFactory;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+final class CleanupJobTest extends TestCase {
+	private WopiMapper&MockObject $wopiMapper;
+	private WopiLockMapper&MockObject $wopiLockMapper;
+
+	protected function setUp(): void {
+		$this->wopiMapper = $this->createMock(WopiMapper::class);
+		$this->wopiLockMapper = $this->createMock(WopiLockMapper::class);
+		$this->wopiLockMapper->method('getExpiredLockIds')->willReturn([]);
+	}
+
+	private function runJob(): void {
+		$job = new CleanupJob($this->createMock(ITimeFactory::class), $this->wopiMapper, $this->wopiLockMapper);
+		(new \ReflectionMethod($job, 'run'))->invoke($job, null);
+	}
+
+	public function testDeletesExpiredTokensUntilNoneAreLeft(): void {
+		$this->wopiMapper->method('getExpiredTokenIds')
+			->willReturnOnConsecutiveCalls(range(1, 500), range(501, 1000), [1001], []);
+		$this->wopiMapper->expects($this->exactly(3))->method('deleteByIds');
+
+		$this->runJob();
+	}
+
+	public function testOneRunIsBounded(): void {
+		$this->wopiMapper->method('getExpiredTokenIds')->willReturn(range(1, 500));
+		$this->wopiMapper->expects($this->exactly(100))->method('deleteByIds');
+
+		$this->runJob();
+	}
+
+	public function testDeletesExpiredLocksUntilNoneAreLeft(): void {
+		$this->wopiMapper->method('getExpiredTokenIds')->willReturn([]);
+		$lockMapper = $this->createMock(WopiLockMapper::class);
+		$lockMapper->method('getExpiredLockIds')->willReturnOnConsecutiveCalls([7, 8], [9], []);
+		$lockMapper->expects($this->exactly(2))->method('deleteByIds');
+		$this->wopiLockMapper = $lockMapper;
+
+		$this->runJob();
+	}
+}
diff --git a/tests/unit/Controller/EditorControllerTest.php b/tests/unit/Controller/EditorControllerTest.php
new file mode 100644
index 00000000..8958a808
--- /dev/null
+++ b/tests/unit/Controller/EditorControllerTest.php
@@ -0,0 +1,99 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Controller;
+
+use OCA\Office\Controller\EditorController;
+use OCA\Office\Db\Wopi;
+use OCA\Office\Service\DiscoveryService;
+use OCA\Office\TokenManager;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\Files\File;
+use OCP\Files\Folder;
+use OCP\Files\IRootFolder;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+
+final class EditorControllerTest extends TestCase {
+	private DiscoveryService&MockObject $discoveryService;
+	private bool $discoveryAvailable = true;
+	private EditorController $controller;
+
+	protected function setUp(): void {
+		$file = $this->createMock(File::class);
+		$file->method('getName')->willReturn('report.docx');
+
+		$userFolder = $this->createMock(Folder::class);
+		$userFolder->method('getFirstNodeById')->with(82)->willReturn($file);
+
+		$rootFolder = $this->createMock(IRootFolder::class);
+		$rootFolder->method('getUserFolder')->with('alice')->willReturn($userFolder);
+
+		$wopi = new Wopi();
+		$wopi->setToken('tok123');
+		$wopi->setServerHost('http://nc.local/');
+		$wopi->setExpiry(1700036000);
+
+		$tokenManager = $this->createMock(TokenManager::class);
+		$tokenManager->method('generateToken')->with(82)->willReturn($wopi);
+
+		$urlGenerator = $this->createMock(IURLGenerator::class);
+		$urlGenerator->method('linkToRouteAbsolute')->willReturn('http://nc.local/index.php/apps/office/wopi/files/82');
+
+		$this->discoveryService = $this->createMock(DiscoveryService::class);
+		$this->discoveryService->method('isAvailable')->willReturnCallback(fn (): bool => $this->discoveryAvailable);
+		$this->discoveryService->method('getUrlSrc')->willReturn('http://eo-internal/hosting/wopi/word/edit?<rs=DC_LLCC&>');
+
+		$this->controller = new EditorController(
+			'office',
+			$this->createMock(IRequest::class),
+			$rootFolder,
+			$tokenManager,
+			$this->discoveryService,
+			$urlGenerator,
+			$this->createMock(LoggerInterface::class),
+			'alice',
+		);
+	}
+
+	public function testEditorPageAllowsTheEditorUrlOrigin(): void {
+		// Deliberately not the urlsrc host: the browser is sent to the rewritten public URL.
+		$this->discoveryService->method('buildEditorUrl')
+			->willReturn('https://office.example.com:8443/hosting/wopi/word/edit?wopisrc=x&access_token=tok123');
+
+		$response = $this->controller->open(82);
+
+		$this->assertInstanceOf(TemplateResponse::class, $response);
+		$policy = $response->getContentSecurityPolicy()->buildPolicy();
+		$this->assertMatchesRegularExpression('#frame-src [^;]*https://office\.example\.com:8443(;| |$)#', $policy);
+		$this->assertMatchesRegularExpression('#form-action [^;]*https://office\.example\.com:8443(;| |$)#', $policy);
+		$this->assertSame(1700036000000, $response->getParams()['accessTokenTtl']);
+		$this->assertStringNotContainsString('eo-internal', $policy);
+	}
+
+	public function testUnusableEditorUrlFailsInsteadOfRenderingABlockedPage(): void {
+		$this->discoveryService->method('buildEditorUrl')->willReturn('/hosting/wopi/word/edit?access_token=tok123');
+
+		$response = $this->controller->open(82);
+
+		$this->assertSame(Http::STATUS_INTERNAL_SERVER_ERROR, $response->getStatus());
+	}
+
+	public function testUnreachableEditorServerIs503NotUnsupportedType(): void {
+		$this->discoveryAvailable = false;
+
+		$response = $this->controller->open(82);
+
+		$this->assertSame(Http::STATUS_SERVICE_UNAVAILABLE, $response->getStatus());
+	}
+}
diff --git a/tests/unit/Controller/SettingsControllerTest.php b/tests/unit/Controller/SettingsControllerTest.php
new file mode 100644
index 00000000..cec8145b
--- /dev/null
+++ b/tests/unit/Controller/SettingsControllerTest.php
@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Controller;
+
+use OCA\Office\Controller\SettingsController;
+use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\PublicPage;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+final class SettingsControllerTest extends TestCase {
+	/** @return array<string, array{string}> */
+	public static function routes(): array {
+		return ['read' => ['getAdmin'], 'write' => ['setAdmin']];
+	}
+
+	#[DataProvider('routes')]
+	public function testSettingsRoutesAreForAdminsOnly(string $method): void {
+		$reflection = new \ReflectionMethod(SettingsController::class, $method);
+
+		foreach ([NoAdminRequired::class, PublicPage::class, AuthorizedAdminSetting::class] as $opener) {
+			$this->assertSame([], $reflection->getAttributes($opener), "$method must not carry " . $opener);
+		}
+	}
+}
diff --git a/tests/unit/Controller/ShareControllerTest.php b/tests/unit/Controller/ShareControllerTest.php
new file mode 100644
index 00000000..e8d5655e
--- /dev/null
+++ b/tests/unit/Controller/ShareControllerTest.php
@@ -0,0 +1,296 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Controller;
+
+use OCA\Office\Controller\ShareController;
+use OCA\Office\Db\Wopi;
+use OCA\Office\Service\DiscoveryService;
+use OCA\Office\TokenManager;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\RedirectResponse;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\Constants;
+use OCP\Files\File;
+use OCP\Files\Folder;
+use OCP\Files\Node;
+use OCP\Files\NotFoundException;
+use OCP\Files\NotPermittedException;
+use OCP\IRequest;
+use OCP\ISession;
+use OCP\IURLGenerator;
+use OCP\IUser;
+use OCP\IUserSession;
+use OCP\Share\IManager as IShareManager;
+use OCP\Share\IShare;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+
+final class ShareControllerTest extends TestCase {
+	private IShare&MockObject $share;
+	private Node $node;
+	private ?string $urlsrc = 'http://eo-internal/hosting/wopi/word/edit?<rs=DC_LLCC&>';
+	private bool $discoveryAvailable = true;
+	private int $permissions = Constants::PERMISSION_READ;
+	private ISession&MockObject $session;
+	private IUserSession&MockObject $userSession;
+	private TokenManager&MockObject $tokenManager;
+	private DiscoveryService&MockObject $discoveryService;
+	private ShareController $controller;
+
+	protected function setUp(): void {
+		$file = $this->createMock(File::class);
+		$file->method('getId')->willReturn(82);
+		$file->method('getName')->willReturn('report.docx');
+		$this->node = $file;
+
+		$this->share = $this->createMock(IShare::class);
+		$this->share->method('getId')->willReturn('7');
+		$this->share->method('getToken')->willReturn('shareTok');
+		$this->share->method('getPermissions')->willReturnCallback(fn (): int => $this->permissions);
+		$this->share->method('getShareOwner')->willReturn('alice');
+		$this->share->method('getNode')->willReturnCallback(fn (): Node => $this->node);
+
+		$shareManager = $this->createMock(IShareManager::class);
+		$shareManager->method('getShareByToken')->willReturnCallback(function (string $token): IShare {
+			if ($token !== 'shareTok') {
+				throw new \OCP\Share\Exceptions\ShareNotFound();
+			}
+			return $this->share;
+		});
+
+		$this->session = $this->createMock(ISession::class);
+		$this->userSession = $this->createMock(IUserSession::class);
+		$this->tokenManager = $this->createMock(TokenManager::class);
+
+		$urlGenerator = $this->createMock(IURLGenerator::class);
+		$urlGenerator->method('linkToRouteAbsolute')->willReturn('http://nc.local/index.php/apps/office/wopi/files/82');
+		$urlGenerator->method('linkToRoute')->willReturn('/index.php/s/shareTok');
+
+		$this->discoveryService = $this->createMock(DiscoveryService::class);
+		$this->discoveryService->method('isAvailable')->willReturnCallback(fn (): bool => $this->discoveryAvailable);
+		$this->discoveryService->method('getUrlSrc')->willReturnCallback(fn (): ?string => $this->urlsrc);
+
+		$this->controller = new ShareController(
+			'office',
+			$this->createMock(IRequest::class),
+			$shareManager,
+			$this->session,
+			$this->userSession,
+			$this->tokenManager,
+			$this->discoveryService,
+			$urlGenerator,
+			$this->createMock(LoggerInterface::class),
+		);
+	}
+
+	private function wopi(): Wopi {
+		$wopi = new Wopi();
+		$wopi->setToken('tok123');
+		$wopi->setServerHost('http://nc.local/');
+		$wopi->setExpiry(1700036000);
+
+		return $wopi;
+	}
+
+	private function editorUrlResolves(): void {
+		$this->discoveryService->method('buildEditorUrl')
+			->willReturn('https://office.example.com:8443/hosting/wopi/word/edit?wopisrc=x&access_token=tok123');
+	}
+
+	private function loggedInAs(string $displayName): void {
+		$user = $this->createMock(IUser::class);
+		$user->method('getDisplayName')->willReturn($displayName);
+		$user->method('getUID')->willReturn(strtolower($displayName));
+		$this->userSession->method('isLoggedIn')->willReturn(true);
+		$this->userSession->method('getUser')->willReturn($user);
+	}
+
+	private function passwordProtected(): void {
+		$this->share->method('getPassword')->willReturn('hashed-password');
+		$this->session->method('get')->with('public_link_authenticated')->willReturn(null);
+	}
+
+	public function testSharedEditorPageAllowsTheEditorUrlOrigin(): void {
+		$this->tokenManager->method('generateGuestToken')->willReturn($this->wopi());
+		$this->editorUrlResolves();
+
+		$response = $this->controller->openShare('shareTok');
+
+		$this->assertInstanceOf(TemplateResponse::class, $response);
+		$policy = $response->getContentSecurityPolicy()->buildPolicy();
+		$this->assertMatchesRegularExpression('#frame-src [^;]*https://office\.example\.com:8443(;| |$)#', $policy);
+		$this->assertMatchesRegularExpression('#form-action [^;]*https://office\.example\.com:8443(;| |$)#', $policy);
+		$this->assertSame(1700036000000, $response->getParams()['accessTokenTtl']);
+	}
+
+	public function testUnusableEditorUrlFailsInsteadOfRenderingABlockedPage(): void {
+		$this->tokenManager->method('generateGuestToken')->willReturn($this->wopi());
+		$this->discoveryService->method('buildEditorUrl')->willReturn('/hosting/wopi/word/edit?access_token=tok123');
+
+		$response = $this->controller->openShare('shareTok');
+
+		$this->assertSame(Http::STATUS_INTERNAL_SERVER_ERROR, $response->getStatus());
+	}
+
+	public function testLoggedInUserWithOwnAccessGetsTheirOwnToken(): void {
+		$this->loggedInAs('Bob');
+		$this->tokenManager->expects($this->once())->method('generateToken')->with(82)->willReturn($this->wopi());
+		$this->tokenManager->expects($this->never())->method('generateGuestToken');
+		$this->editorUrlResolves();
+
+		$this->assertInstanceOf(TemplateResponse::class, $this->controller->openShare('shareTok'));
+	}
+
+	public function testLoggedInUserWithoutOwnAccessOpensThroughTheLinkUnderTheirName(): void {
+		$this->loggedInAs('Bob');
+		$this->tokenManager->method('generateToken')->willThrowException(new NotPermittedException());
+		$this->tokenManager->expects($this->once())->method('generateGuestToken')
+			->with(82, 'alice', 'shareTok', 'bob', 'Bob', false, false)
+			->willReturn($this->wopi());
+		$this->editorUrlResolves();
+
+		$this->assertInstanceOf(TemplateResponse::class, $this->controller->openShare('shareTok', guestName: 'Someone Else'));
+	}
+
+	public function testLoggedInUserWithoutOwnAccessKeepsTheLinksDownloadRestriction(): void {
+		$this->loggedInAs('Bob');
+		$this->share->method('getHideDownload')->willReturn(true);
+		$this->tokenManager->method('generateToken')->willThrowException(new NotPermittedException());
+		$this->tokenManager->expects($this->once())->method('generateGuestToken')
+			->with(82, 'alice', 'shareTok', 'bob', 'Bob', false, true)
+			->willReturn($this->wopi());
+		$this->editorUrlResolves();
+
+		$this->assertInstanceOf(TemplateResponse::class, $this->controller->openShare('shareTok'));
+	}
+
+	public function testLoggedInUserWithoutOwnAccessStillNeedsTheLinkPassword(): void {
+		$this->loggedInAs('Bob');
+		$this->passwordProtected();
+		$this->tokenManager->method('generateToken')->willThrowException(new NotPermittedException());
+		$this->tokenManager->expects($this->never())->method('generateGuestToken');
+
+		$this->assertInstanceOf(RedirectResponse::class, $this->controller->openShare('shareTok'));
+	}
+
+	public function testPendingPasswordHidesWhetherAPathExistsInAFolderShare(): void {
+		$this->loggedInAs('Bob');
+		$this->passwordProtected();
+		$folder = $this->createMock(Folder::class);
+		$folder->method('get')->willThrowException(new NotFoundException());
+		$this->node = $folder;
+
+		$this->assertInstanceOf(RedirectResponse::class, $this->controller->openShare('shareTok', path: 'secret-plans.docx'));
+	}
+
+	public function testPendingPasswordHidesThatTheShareIsUnreadable(): void {
+		$this->loggedInAs('Bob');
+		$this->passwordProtected();
+		$this->permissions = 0;
+
+		$this->assertInstanceOf(RedirectResponse::class, $this->controller->openShare('shareTok'));
+	}
+
+	public function testPendingPasswordHidesThatAPathIsNotPermitted(): void {
+		$this->loggedInAs('Bob');
+		$this->passwordProtected();
+		$folder = $this->createMock(Folder::class);
+		$folder->method('get')->willThrowException(new NotPermittedException());
+		$this->node = $folder;
+
+		$this->assertInstanceOf(RedirectResponse::class, $this->controller->openShare('shareTok', path: 'locked.docx'));
+	}
+
+	public function testPendingPasswordHidesTheFileType(): void {
+		$this->loggedInAs('Bob');
+		$this->passwordProtected();
+		$this->urlsrc = null;
+
+		$this->assertInstanceOf(RedirectResponse::class, $this->controller->openShare('shareTok'));
+	}
+
+	public function testUnreachableEditorServerIs503NotUnsupportedType(): void {
+		$this->discoveryAvailable = false;
+
+		$this->assertSame(Http::STATUS_SERVICE_UNAVAILABLE, $this->controller->openShare('shareTok')->getStatus());
+	}
+
+	public function testPendingPasswordHidesThatTheEditorIsUnreachable(): void {
+		$this->loggedInAs('Bob');
+		$this->passwordProtected();
+		$this->discoveryAvailable = false;
+
+		$this->assertInstanceOf(RedirectResponse::class, $this->controller->openShare('shareTok'));
+	}
+
+	public function testMissingPathInAnOpenFolderShareIs404(): void {
+		$folder = $this->createMock(Folder::class);
+		$folder->method('get')->willThrowException(new NotFoundException());
+		$this->node = $folder;
+
+		$this->assertSame(Http::STATUS_NOT_FOUND, $this->controller->openShare('shareTok', path: 'missing.docx')->getStatus());
+	}
+
+	public function testLoggedInUserWithOwnAccessSkipsTheLinkPassword(): void {
+		$this->loggedInAs('Bob');
+		$this->passwordProtected();
+		$this->tokenManager->method('generateToken')->willReturn($this->wopi());
+		$this->editorUrlResolves();
+
+		$this->assertInstanceOf(TemplateResponse::class, $this->controller->openShare('shareTok'));
+	}
+
+	/** @return array<string, array{mixed}> */
+	public static function enteredPasswordSessions(): array {
+		return [
+			'list of share IDs' => [['3', '7']],
+			'legacy single share ID' => ['7'],
+		];
+	}
+
+	#[\PHPUnit\Framework\Attributes\DataProvider('enteredPasswordSessions')]
+	public function testAnonymousVisitorWhoEnteredTheLinkPasswordGetsIn(mixed $sessionValue): void {
+		$this->userSession->method('isLoggedIn')->willReturn(false);
+		$this->share->method('getPassword')->willReturn('hashed-password');
+		$this->session->method('get')->with('public_link_authenticated')->willReturn($sessionValue);
+		$this->tokenManager->method('generateGuestToken')->willReturn($this->wopi());
+		$this->editorUrlResolves();
+
+		$this->assertInstanceOf(TemplateResponse::class, $this->controller->openShare('shareTok'));
+	}
+
+	public function testAnonymousVisitorNeedsTheLinkPassword(): void {
+		$this->userSession->method('isLoggedIn')->willReturn(false);
+		$this->passwordProtected();
+		$this->tokenManager->expects($this->never())->method('generateGuestToken');
+
+		$this->assertInstanceOf(RedirectResponse::class, $this->controller->openShare('shareTok'));
+	}
+
+	public function testUnknownShareTokenCountsAsAGuess(): void {
+		$response = $this->controller->openShare('guessed');
+
+		$this->assertSame(Http::STATUS_NOT_FOUND, $response->getStatus());
+		$this->assertTrue($response->isThrottled());
+		$this->assertSame(['action' => 'officeOpenShare'], $response->getThrottleMetadata());
+	}
+
+	public function testOpenShareIsRateLimitedAndBruteForceProtected(): void {
+		$method = new \ReflectionMethod(ShareController::class, 'openShare');
+
+		$rateLimit = $method->getAttributes(\OCP\AppFramework\Http\Attribute\AnonRateLimit::class)[0]->newInstance();
+		$this->assertSame(30, $rateLimit->getLimit());
+		$this->assertSame(60, $rateLimit->getPeriod());
+
+		$bruteForce = $method->getAttributes(\OCP\AppFramework\Http\Attribute\BruteForceProtection::class)[0]->newInstance();
+		$this->assertSame('officeOpenShare', $bruteForce->getAction());
+	}
+}
diff --git a/tests/unit/Controller/WopiControllerLockTest.php b/tests/unit/Controller/WopiControllerLockTest.php
new file mode 100644
index 00000000..deb39387
--- /dev/null
+++ b/tests/unit/Controller/WopiControllerLockTest.php
@@ -0,0 +1,793 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Controller;
+
+use OCA\Office\Controller\WopiController;
+use OCA\Office\Db\Wopi;
+use OCA\Office\Db\WopiLock;
+use OCA\Office\Db\WopiLockMapper;
+use OCA\Office\Db\WopiMapper;
+use OCA\Office\Exception\ExpiredTokenException;
+use OCA\Office\Exception\UnknownTokenException;
+use OCA\Office\Service\WopiAccessResolver;
+use OCP\AppFramework\Http;
+use OCP\Constants;
+use OCP\Files\File;
+use OCP\Files\Folder;
+use OCP\Files\IRootFolder;
+use OCP\Files\Lock\ILockManager;
+use OCP\Files\NotFoundException;
+use OCP\Files\Storage\IStorage;
+use OCP\IRequest;
+use OCP\IUserManager;
+use OCP\Share\IManager as IShareManager;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+
+final class WopiControllerLockTest extends TestCase {
+	private IRootFolder&MockObject $rootFolder;
+	private WopiMapper&MockObject $wopiMapper;
+	private WopiLockMapper&MockObject $wopiLockMapper;
+	private IUserManager&MockObject $userManager;
+	private ILockManager&MockObject $lockManager;
+	private LoggerInterface&MockObject $logger;
+	private IShareManager&MockObject $shareManager;
+	/** @var list<File> What the editor's user folder returns for the token's file id. */
+	private array $userFolderNodes = [];
+	private ?string $lookedUpUid = null;
+
+	protected function setUp(): void {
+		$this->rootFolder = $this->createMock(IRootFolder::class);
+		$this->wopiMapper = $this->createMock(WopiMapper::class);
+		$this->wopiLockMapper = $this->createMock(WopiLockMapper::class);
+		$this->userManager = $this->createMock(IUserManager::class);
+		$this->lockManager = $this->createMock(ILockManager::class);
+		$this->logger = $this->createMock(LoggerInterface::class);
+		$this->shareManager = $this->createMock(IShareManager::class);
+
+		// Every user token resolves through the editor's folder; by default it holds an ordinary file.
+		$this->userFolderNodes = [$this->fileForRename('report.docx')];
+		$userFolder = $this->createMock(Folder::class);
+		$userFolder->method('getById')->willReturnCallback(fn (int $id): array => $id === 82 ? $this->userFolderNodes : []);
+		$this->rootFolder->method('getUserFolder')->willReturnCallback(function (string $uid) use ($userFolder): Folder {
+			$this->lookedUpUid = $uid;
+			return $userFolder;
+		});
+
+		// Default: simulate a lock provider that just runs the callback (as if
+		// the app-level advisory lock was acquired without contention).
+		$this->lockManager->method('runInScope')->willReturnCallback(
+			static function ($lockContext, callable $callback): void {
+				$callback();
+			}
+		);
+	}
+
+	/** @param array<string, string> $headers */
+	private function controller(array $headers): WopiController {
+		$request = $this->createMock(IRequest::class);
+		$request->method('getHeader')->willReturnCallback(
+			static fn (string $name): string => $headers[$name] ?? ''
+		);
+
+		return new WopiController(
+			'office',
+			$request,
+			new WopiAccessResolver($this->rootFolder, $this->shareManager),
+			$this->wopiMapper,
+			$this->wopiLockMapper,
+			$this->userManager,
+			$this->lockManager,
+			$this->logger,
+		);
+	}
+
+	/** @param array<string, mixed> $overrides */
+	private function wopi(array $overrides = []): Wopi {
+		$wopi = new Wopi();
+		$wopi->setFileid($overrides['fileid'] ?? 82);
+		$wopi->setCanwrite($overrides['canwrite'] ?? true);
+		$wopi->setOwnerUid($overrides['ownerUid'] ?? 'admin');
+		$wopi->setEditorUid(array_key_exists('editorUid', $overrides) ? $overrides['editorUid'] : 'admin');
+		$wopi->setGuestDisplayname(array_key_exists('guestDisplayname', $overrides) ? $overrides['guestDisplayname'] : null);
+		$wopi->setServerHost($overrides['serverHost'] ?? 'http://nc.local/');
+		$wopi->setToken($overrides['token'] ?? 'tok123');
+		$wopi->setHideDownload($overrides['hideDownload'] ?? false);
+
+		return $wopi;
+	}
+
+	private function lock(string $lockId): WopiLock {
+		$lock = new WopiLock();
+		$lock->setFileid(82);
+		$lock->setLockId($lockId);
+		$lock->setExpiry(time() + 1800);
+
+		return $lock;
+	}
+
+	private function expiredLock(string $lockId): WopiLock {
+		$lock = new WopiLock();
+		$lock->setFileid(82);
+		$lock->setLockId($lockId);
+		$lock->setExpiry(time() - 100);
+
+		return $lock;
+	}
+
+	private function fileForRename(string $name): File&MockObject {
+		$file = $this->createMock(File::class);
+		$file->method('getName')->willReturn($name);
+		$file->method('getPermissions')->willReturn(Constants::PERMISSION_ALL);
+
+		return $file;
+	}
+
+	private function mockFileLookup(File $file): void {
+		$this->userFolderNodes = [$file];
+	}
+
+	private function linkShare(int $permissions, bool $hideDownload = false, ?\OCP\Files\Node $node = null): \OCP\Share\IShare&MockObject {
+		$share = $this->createMock(\OCP\Share\IShare::class);
+		$share->method('getPermissions')->willReturn($permissions);
+		$share->method('getHideDownload')->willReturn($hideDownload);
+		$share->method('getNode')->willReturn($node ?? $this->sharedFile());
+
+		return $share;
+	}
+
+	private function sharedFile(int $id = 82): File&MockObject {
+		$file = $this->fileForRename('report.docx');
+		$file->method('getId')->willReturn($id);
+		$file->method('getMTime')->willReturn(1700000000);
+
+		return $file;
+	}
+
+	/**
+	 * Response::getHeaders() merges in framework defaults (request ID, CSP, the
+	 * current user via \OCP\Server::get()), which needs a running Nextcloud
+	 * server and isn't available standalone. Read the headers WopiController
+	 * itself set via addHeader() directly off the private property instead.
+	 */
+	private function header(Http\Response $response, string $name): ?string {
+		$headers = (new \ReflectionProperty(Http\Response::class, 'headers'))->getValue($response);
+
+		return $headers[$name] ?? null;
+	}
+
+	// --- CheckFileInfo lock capability ---
+
+	public function testCheckFileInfoAdvertisesLocksWithoutAnNcLockProvider(): void {
+		$this->lockManager->method('isLockProviderAvailable')->willReturn(false);
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$file = $this->fileForRename('report.docx');
+		$file->method('getSize')->willReturn(1024);
+		$file->method('getMTime')->willReturn(1700000000);
+		$this->mockFileLookup($file);
+
+		$response = $this->controller([])->checkFileInfo(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertTrue($response->getData()['SupportsLocks']);
+	}
+
+	// --- PutFile out-of-band change detection ---
+
+	private const int MTIME = 1700000000;
+	private const string MTIME_ISO = '2023-11-14T22:13:20.000Z';
+	private const string STALE_ISO = '2023-11-14T22:00:00.000Z';
+	private const int SAVED_MTIME = 1700000060;
+
+	/** The mock's mtime moves to SAVED_MTIME once putContent() runs, like a real write. */
+	private function lockedFileForPut(bool $expectWrite): File&MockObject {
+		$storage = $this->createMock(IStorage::class);
+		$storage->method('free_space')->willReturn(-1);
+
+		$mtime = self::MTIME;
+		$file = $this->createMock(File::class);
+		$file->method('getSize')->willReturn(1024);
+		$file->method('getMTime')->willReturnCallback(static function () use (&$mtime): int {
+			return $mtime;
+		});
+		$file->method('getStorage')->willReturn($storage);
+		$file->method('getInternalPath')->willReturn('files/report.docx');
+		$file->method('getPermissions')->willReturn(Constants::PERMISSION_ALL);
+		$file->expects($expectWrite ? $this->once() : $this->never())
+			->method('putContent')
+			->willReturnCallback(static function () use (&$mtime): void {
+				$mtime = self::SAVED_MTIME;
+			});
+
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->lock('eo-lock'));
+		$this->mockFileLookup($file);
+
+		return $file;
+	}
+
+	/** @param array<string, string> $headers */
+	private function putFile(array $headers): Http\Response {
+		return $this->controller(['X-WOPI-Lock' => 'eo-lock'] + $headers)->putFile(82, 'tok123');
+	}
+
+	public function testPutFileRejectsStaleCollaboraTimestamp(): void {
+		$this->lockedFileForPut(expectWrite: false);
+
+		$response = $this->putFile(['X-COOL-WOPI-Timestamp' => self::STALE_ISO]);
+
+		$this->assertSame(Http::STATUS_CONFLICT, $response->getStatus());
+		$this->assertSame(['COOLStatusCode' => 1010], $response->getData());
+	}
+
+	public function testPutFileWritesStaleEuroOfficeSaveAndLogsTheOverwrite(): void {
+		// Euro-Office can't recover from a 409 here: it would fail every later save of the session.
+		$this->lockedFileForPut(expectWrite: true);
+		$this->logger->expects($this->once())->method('warning');
+
+		$response = $this->putFile(['X-LOOL-WOPI-Timestamp' => self::STALE_ISO]);
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testCollaboraTimestampDecidesWhenBothAreSent(): void {
+		$this->lockedFileForPut(expectWrite: false);
+
+		$response = $this->putFile(['X-COOL-WOPI-Timestamp' => self::STALE_ISO, 'X-LOOL-WOPI-Timestamp' => self::MTIME_ISO]);
+
+		$this->assertSame(Http::STATUS_CONFLICT, $response->getStatus());
+	}
+
+	/** @return array<string, array{string, string}> */
+	public static function currentTimestamps(): array {
+		return [
+			'Euro-Office' => ['X-LOOL-WOPI-Timestamp', self::MTIME_ISO],
+			'Collabora' => ['X-COOL-WOPI-Timestamp', self::MTIME_ISO],
+			'Collabora, microsecond format' => ['X-COOL-WOPI-Timestamp', '2023-11-14T22:13:20.000000Z'],
+		];
+	}
+
+	#[\PHPUnit\Framework\Attributes\DataProvider('currentTimestamps')]
+	public function testPutFileWritesWhenEditorTimestampIsCurrent(string $header, string $timestamp): void {
+		$this->lockedFileForPut(expectWrite: true);
+		$this->logger->expects($this->never())->method('warning');
+
+		$response = $this->putFile([$header => $timestamp]);
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testPutFileReturnsTheTimestampOfTheNewContent(): void {
+		// Editors take their next X-*-WOPI-Timestamp from this response; returning the pre-write mtime
+		// would make the next save look stale.
+		$this->lockedFileForPut(expectWrite: true);
+
+		$response = $this->putFile(['X-LOOL-WOPI-Timestamp' => self::MTIME_ISO]);
+
+		$this->assertSame(['LastModifiedTime' => '2023-11-14T22:14:20.000Z'], $response->getData());
+		$this->assertSame((string)self::SAVED_MTIME, $this->header($response, 'X-WOPI-ItemVersion'));
+	}
+
+	public function testUnreadableRequestBodyLeavesTheDocumentAlone(): void {
+		$this->lockedFileForPut(expectWrite: false);
+		$request = $this->createMock(IRequest::class);
+		$request->method('getHeader')->willReturnCallback(static fn (string $name): string => $name === 'X-WOPI-Lock' ? 'eo-lock' : '');
+		$controller = new class('office', $request, new WopiAccessResolver($this->rootFolder, $this->shareManager), $this->wopiMapper, $this->wopiLockMapper, $this->userManager, $this->lockManager, $this->logger) extends WopiController {
+			#[\Override]
+			protected function openRequestBody() {
+				return false;
+			}
+		};
+
+		$this->assertSame(Http::STATUS_INTERNAL_SERVER_ERROR, $controller->putFile(82, 'tok123')->getStatus());
+	}
+
+	public function testPutFileWithoutTimestampHeaderStillWrites(): void {
+		$this->lockedFileForPut(expectWrite: true);
+
+		$this->assertSame(Http::STATUS_OK, $this->putFile([])->getStatus());
+	}
+
+	// --- Share-link sessions: access follows the live share ---
+
+	private function linkSession(?string $editorUid = null): Wopi {
+		$wopi = $this->wopi(['editorUid' => $editorUid, 'guestDisplayname' => 'Visitor']);
+		$wopi->setShareToken('shareTok');
+		$this->wopiMapper->method('getWopiForToken')->willReturn($wopi);
+
+		return $wopi;
+	}
+
+	private function shareIsGone(): void {
+		$this->shareManager->method('getShareByToken')->willThrowException(new \OCP\Share\Exceptions\ShareNotFound());
+	}
+
+	public function testRevokedShareEndsCheckFileInfo(): void {
+		$this->linkSession();
+		$this->shareIsGone();
+
+		$this->assertSame(Http::STATUS_NOT_FOUND, $this->controller([])->checkFileInfo(82, 'tok123')->getStatus());
+	}
+
+	public function testRevokedShareEndsGetFile(): void {
+		$this->linkSession();
+		$this->shareIsGone();
+
+		$this->assertSame(Http::STATUS_NOT_FOUND, $this->controller([])->getFile(82, 'tok123')->getStatus());
+	}
+
+	public function testRevokedShareEndsPutFile(): void {
+		$this->linkSession();
+		$this->shareIsGone();
+
+		$this->assertSame(Http::STATUS_NOT_FOUND, $this->controller(['X-WOPI-Lock' => 'eo-lock'])->putFile(82, 'tok123')->getStatus());
+	}
+
+	public function testRevokedShareEndsLockOperations(): void {
+		$this->linkSession();
+		$this->shareIsGone();
+
+		$response = $this->controller(['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'eo-lock'])->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_NOT_FOUND, $response->getStatus());
+	}
+
+	public function testShareNarrowedToReadOnlyBlocksPutFile(): void {
+		$this->linkSession();
+		$this->shareManager->method('getShareByToken')->willReturn($this->linkShare(Constants::PERMISSION_READ));
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $this->controller(['X-WOPI-Lock' => 'eo-lock'])->putFile(82, 'tok123')->getStatus());
+	}
+
+	public function testShareNarrowedToReadOnlyBlocksLockOperations(): void {
+		$this->linkSession();
+		$this->shareManager->method('getShareByToken')->willReturn($this->linkShare(Constants::PERMISSION_READ));
+
+		$response = $this->controller(['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'eo-lock'])->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus());
+	}
+
+	public function testShareNarrowedToReadOnlyShowsAsReadOnlyInCheckFileInfo(): void {
+		$this->linkSession();
+		$this->shareManager->method('getShareByToken')->willReturn($this->linkShare(Constants::PERMISSION_READ, hideDownload: true));
+
+		$data = $this->controller([])->checkFileInfo(82, 'tok123')->getData();
+
+		$this->assertFalse($data['UserCanWrite']);
+		$this->assertTrue($data['DisableExport']);
+	}
+
+	public function testLoggedInLinkVisitorIsNamedButCannotRenameOrReshare(): void {
+		$this->linkSession('bob');
+		$this->shareManager->method('getShareByToken')->willReturn($this->linkShare(Constants::PERMISSION_READ | Constants::PERMISSION_UPDATE));
+
+		$data = $this->controller([])->checkFileInfo(82, 'tok123')->getData();
+
+		$this->assertSame('bob', $data['UserId']);
+		$this->assertFalse($data['IsAnonymousUser']);
+		$this->assertFalse($data['SupportsRename']);
+		$this->assertFalse($data['UserCanRename']);
+		$this->assertFalse($data['EnableShare']);
+		$this->assertNull($this->lookedUpUid, 'a link session must not resolve through the visitor\'s own folder');
+	}
+
+	public function testLoggedInLinkVisitorCannotRenameTheFile(): void {
+		$this->linkSession('bob');
+		$this->shareManager->method('getShareByToken')->willReturn($this->linkShare(Constants::PERMISSION_READ | Constants::PERMISSION_UPDATE));
+
+		$response = $this->controller(['X-WOPI-Override' => 'RENAME_FILE', 'X-WOPI-RequestedName' => 'Renamed'])->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus());
+	}
+
+	public function testAnonymousLinkVisitorIsAnonymous(): void {
+		$this->linkSession();
+		$this->shareManager->method('getShareByToken')->willReturn($this->linkShare(Constants::PERMISSION_READ));
+
+		$data = $this->controller([])->checkFileInfo(82, 'tok123')->getData();
+
+		$this->assertTrue($data['IsAnonymousUser']);
+		$this->assertSame('Visitor', $data['UserFriendlyName']);
+		$this->assertStringStartsWith('Guest-', $data['UserId']);
+	}
+
+	// --- executeOperation() dispatch guard ---
+
+	public function testAllOverridesReturn403WhenTokenCannotWrite(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi(['canwrite' => false]));
+
+		foreach (['LOCK', 'UNLOCK', 'REFRESH_LOCK', 'GET_LOCK', 'RENAME_FILE'] as $override) {
+			$controller = $this->controller(['X-WOPI-Override' => $override, 'X-WOPI-Lock' => 'abc']);
+			$response = $controller->executeOperation(82, 'tok123');
+			$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus(), "override $override should be 403");
+		}
+	}
+
+	public function testUnknownOverrideReturns501(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+
+		$controller = $this->controller(['X-WOPI-Override' => 'SOMETHING_ELSE']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_NOT_IMPLEMENTED, $response->getStatus());
+	}
+
+	public function testExecuteOperationReturns403WhenFileIdMismatch(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi(['fileid' => 82]));
+
+		$controller = $this->controller(['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'abc']);
+		$response = $controller->executeOperation(999, 'tok123');
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus());
+	}
+
+	public function testExecuteOperationReturns401WhenTokenExpired(): void {
+		$this->wopiMapper->method('getWopiForToken')->willThrowException(new ExpiredTokenException('expired'));
+
+		$controller = $this->controller(['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'abc']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_UNAUTHORIZED, $response->getStatus());
+	}
+
+	public function testExecuteOperationReturns403WhenTokenUnknown(): void {
+		$this->wopiMapper->method('getWopiForToken')->willThrowException(new UnknownTokenException('unknown'));
+
+		$controller = $this->controller(['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'abc']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus());
+	}
+
+	// --- LOCK ---
+
+	public function testLockEmptyIdReturns400(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn(null);
+
+		$controller = $this->controller(['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => '']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+	}
+
+	public function testLockFreshReturns200(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn(null);
+		$this->wopiLockMapper->expects($this->once())->method('upsertLock')->with(82, 'lock-1');
+
+		$controller = $this->controller(['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'lock-1']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testLockSameIdIsIdempotent(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->lock('lock-1'));
+		$this->wopiLockMapper->expects($this->once())->method('upsertLock')->with(82, 'lock-1');
+
+		$controller = $this->controller(['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'lock-1']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testLockDifferentIdReturns409WithBothHeaders(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->lock('lock-1'));
+
+		$controller = $this->controller(['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'lock-2']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_CONFLICT, $response->getStatus());
+		$this->assertSame('lock-1', $this->header($response, 'X-WOPI-Lock'));
+		$this->assertNotEmpty($this->header($response, 'X-WOPI-LockFailureReason'));
+	}
+
+	public function testUnlockAndRelockValidReturns200(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->lock('old-lock'));
+		$this->wopiLockMapper->expects($this->once())->method('upsertLock')->with(82, 'new-lock');
+
+		$controller = $this->controller([
+			'X-WOPI-Override' => 'LOCK',
+			'X-WOPI-Lock' => 'new-lock',
+			'X-WOPI-OldLock' => 'old-lock',
+		]);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testUnlockAndRelockWrongOldReturns409(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->lock('old-lock'));
+
+		$controller = $this->controller([
+			'X-WOPI-Override' => 'LOCK',
+			'X-WOPI-Lock' => 'new-lock',
+			'X-WOPI-OldLock' => 'wrong-old-lock',
+		]);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_CONFLICT, $response->getStatus());
+		$this->assertSame('old-lock', $this->header($response, 'X-WOPI-Lock'));
+	}
+
+	public function testUnlockAndRelockWithNoExistingLockReturns409(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn(null);
+
+		$controller = $this->controller([
+			'X-WOPI-Override' => 'LOCK',
+			'X-WOPI-Lock' => 'new-lock',
+			'X-WOPI-OldLock' => 'old-lock',
+		]);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_CONFLICT, $response->getStatus());
+		$this->assertSame('', $this->header($response, 'X-WOPI-Lock'));
+	}
+
+	public function testExpiredExistingLockTreatedAsAbsentOnLock(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->expiredLock('stale-lock'));
+		$this->wopiLockMapper->expects($this->once())->method('upsertLock')->with(82, 'fresh-lock');
+
+		$controller = $this->controller(['X-WOPI-Override' => 'LOCK', 'X-WOPI-Lock' => 'fresh-lock']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	// --- UNLOCK ---
+
+	public function testUnlockOkReturns200(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$lock = $this->lock('lock-1');
+		$this->wopiLockMapper->method('findByFileId')->willReturn($lock);
+		$this->wopiLockMapper->expects($this->once())->method('delete')->with($lock);
+
+		$controller = $this->controller(['X-WOPI-Override' => 'UNLOCK', 'X-WOPI-Lock' => 'lock-1']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testUnlockEmptyIdReturns400(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+
+		$controller = $this->controller(['X-WOPI-Override' => 'UNLOCK', 'X-WOPI-Lock' => '']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+	}
+
+	public function testUnlockWrongIdReturns409(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->lock('lock-1'));
+
+		$controller = $this->controller(['X-WOPI-Override' => 'UNLOCK', 'X-WOPI-Lock' => 'lock-2']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_CONFLICT, $response->getStatus());
+		$this->assertSame('lock-1', $this->header($response, 'X-WOPI-Lock'));
+	}
+
+	public function testUnlockWithNoExistingLockReturns409(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn(null);
+
+		$controller = $this->controller(['X-WOPI-Override' => 'UNLOCK', 'X-WOPI-Lock' => 'lock-1']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_CONFLICT, $response->getStatus());
+		$this->assertSame('', $this->header($response, 'X-WOPI-Lock'));
+	}
+
+	// --- REFRESH_LOCK ---
+
+	public function testRefreshLockOkReturns200(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->lock('lock-1'));
+		$this->wopiLockMapper->expects($this->once())->method('upsertLock')->with(82, 'lock-1');
+
+		$controller = $this->controller(['X-WOPI-Override' => 'REFRESH_LOCK', 'X-WOPI-Lock' => 'lock-1']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testRefreshLockEmptyIdReturns400(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+
+		$controller = $this->controller(['X-WOPI-Override' => 'REFRESH_LOCK', 'X-WOPI-Lock' => '']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+	}
+
+	public function testRefreshLockMismatchReturns409(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->lock('lock-1'));
+
+		$controller = $this->controller(['X-WOPI-Override' => 'REFRESH_LOCK', 'X-WOPI-Lock' => 'lock-2']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_CONFLICT, $response->getStatus());
+	}
+
+	// --- GET_LOCK ---
+
+	public function testGetLockWithLockReturnsLockHeader(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->lock('lock-1'));
+
+		$controller = $this->controller(['X-WOPI-Override' => 'GET_LOCK']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame('lock-1', $this->header($response, 'X-WOPI-Lock'));
+	}
+
+	public function testGetLockWithoutLockReturnsEmptyHeader(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn(null);
+
+		$controller = $this->controller(['X-WOPI-Override' => 'GET_LOCK']);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame('', $this->header($response, 'X-WOPI-Lock'));
+	}
+
+	// --- RENAME_FILE ---
+
+	public function testRenameFileSuccessReturns200WithName(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn(null);
+
+		$originalFile = $this->fileForRename('Original.docx');
+		$renamedFile = $this->fileForRename('Renamed.docx');
+		$originalFile->method('move')->willReturn($renamedFile);
+
+		$parent = $this->createMock(Folder::class);
+		$parent->method('get')->with('Renamed.docx')->willThrowException(new NotFoundException());
+		$parent->method('getPath')->willReturn('/admin/files');
+		$originalFile->method('getParent')->willReturn($parent);
+
+		$this->mockFileLookup($originalFile);
+
+		$controller = $this->controller([
+			'X-WOPI-Override' => 'RENAME_FILE',
+			'X-WOPI-RequestedName' => 'Renamed',
+		]);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame('Renamed.docx', $response->getData()['Name']);
+	}
+
+	public function testRenameFileThroughShareLinkReturns403(): void {
+		$wopi = $this->wopi(['editorUid' => null, 'guestDisplayname' => 'Guest User']);
+		$wopi->setShareToken('shareTok');
+		$this->wopiMapper->method('getWopiForToken')->willReturn($wopi);
+		$this->shareManager->method('getShareByToken')->willReturn($this->linkShare(Constants::PERMISSION_READ | Constants::PERMISSION_UPDATE));
+
+		$controller = $this->controller([
+			'X-WOPI-Override' => 'RENAME_FILE',
+			'X-WOPI-RequestedName' => 'Renamed',
+		]);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus());
+	}
+
+	public function testRenameFileEmptyRequestedNameReturns400(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+
+		$controller = $this->controller([
+			'X-WOPI-Override' => 'RENAME_FILE',
+			'X-WOPI-RequestedName' => '',
+		]);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+	}
+
+	public function testRenameFileRejectsPathTraversalSlashOrNullByte(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+
+		foreach (['evil/name', "evil\0name"] as $maliciousName) {
+			$controller = $this->controller([
+				'X-WOPI-Override' => 'RENAME_FILE',
+				'X-WOPI-RequestedName' => $maliciousName,
+			]);
+			$response = $controller->executeOperation(82, 'tok123');
+
+			$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus(), "should reject: $maliciousName");
+			$this->assertNotEmpty($this->header($response, 'X-WOPI-InvalidFileNameError'));
+		}
+	}
+
+	public function testRenameFileRejectsBackslashTraversal(): void {
+		// Fixed (was testRenameFileDoesNotRejectBackslashTraversal, documenting
+		// a gap): basename() only treats '/' as a path separator on non-Windows
+		// PHP builds, so a backslash-based name used to slip past the guard.
+		// WopiController now checks str_contains($newBaseName, '\\') explicitly
+		// alongside the slash/null-byte checks - see
+		// wopi-spec-matrix.php row RENAME-backslash-not-rejected-by-basename-guard.
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+
+		$controller = $this->controller([
+			'X-WOPI-Override' => 'RENAME_FILE',
+			'X-WOPI-RequestedName' => '..\\..\\evil',
+		]);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+		$this->assertNotEmpty($this->header($response, 'X-WOPI-InvalidFileNameError'));
+	}
+
+	public function testRenameFileNameCollisionReturns400(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn(null);
+
+		$originalFile = $this->fileForRename('Original.docx');
+		$existing = $this->fileForRename('Renamed.docx');
+		$parent = $this->createMock(Folder::class);
+		$parent->method('get')->with('Renamed.docx')->willReturn($existing);
+		$originalFile->method('getParent')->willReturn($parent);
+
+		$this->mockFileLookup($originalFile);
+
+		$controller = $this->controller([
+			'X-WOPI-Override' => 'RENAME_FILE',
+			'X-WOPI-RequestedName' => 'Renamed',
+		]);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+		$this->assertNotEmpty($this->header($response, 'X-WOPI-InvalidFileNameError'));
+	}
+
+	public function testRenameFileLockMismatchReturns409(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn($this->lock('lock-1'));
+
+		$controller = $this->controller([
+			'X-WOPI-Override' => 'RENAME_FILE',
+			'X-WOPI-RequestedName' => 'Renamed',
+			'X-WOPI-Lock' => 'lock-2',
+		]);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_CONFLICT, $response->getStatus());
+		$this->assertSame('lock-1', $this->header($response, 'X-WOPI-Lock'));
+	}
+
+	public function testRenameFileFileNotFoundReturns404(): void {
+		$this->wopiMapper->method('getWopiForToken')->willReturn($this->wopi());
+		$this->wopiLockMapper->method('findByFileId')->willReturn(null);
+
+		$this->userFolderNodes = [];
+
+		$controller = $this->controller([
+			'X-WOPI-Override' => 'RENAME_FILE',
+			'X-WOPI-RequestedName' => 'Renamed',
+		]);
+		$response = $controller->executeOperation(82, 'tok123');
+
+		$this->assertSame(Http::STATUS_NOT_FOUND, $response->getStatus());
+	}
+}
diff --git a/tests/unit/Http/EditorPagePolicyTest.php b/tests/unit/Http/EditorPagePolicyTest.php
new file mode 100644
index 00000000..2aa7efb4
--- /dev/null
+++ b/tests/unit/Http/EditorPagePolicyTest.php
@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Http;
+
+use OCA\Office\Http\EditorPagePolicy;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+final class EditorPagePolicyTest extends TestCase {
+	/** @return array<string, array{string, string}> */
+	public static function validUrls(): array {
+		return [
+			'default port' => ['https://office.example.com/hosting/wopi/word/edit?wopisrc=x&access_token=secret', 'https://office.example.com'],
+			'explicit port' => ['http://eo:8080/hosting/wopi/word/edit', 'http://eo:8080'],
+			'ipv6 host' => ['http://[::1]:9980/x', 'http://[::1]:9980'],
+			'uppercase scheme' => ['HTTPS://office.example.com/x', 'https://office.example.com'],
+		];
+	}
+
+	#[DataProvider('validUrls')]
+	public function testAllowsEditorOriginForFrameAndFormAction(string $editorUrl, string $origin): void {
+		$policy = EditorPagePolicy::forEditorUrl($editorUrl)->buildPolicy();
+
+		$this->assertMatchesRegularExpression('#frame-src [^;]*' . preg_quote($origin, '#') . '(;| |$)#', $policy);
+		$this->assertMatchesRegularExpression('#form-action [^;]*' . preg_quote($origin, '#') . '(;| |$)#', $policy);
+	}
+
+	public function testOnlyTheOriginReachesThePolicy(): void {
+		$policy = EditorPagePolicy::forEditorUrl('https://office.example.com/hosting/wopi?access_token=secret')->buildPolicy();
+
+		$this->assertStringNotContainsString('secret', $policy);
+		$this->assertStringNotContainsString('/hosting', $policy);
+	}
+
+	/** @return array<string, array{string}> */
+	public static function invalidUrls(): array {
+		return [
+			'empty' => [''],
+			'relative' => ['/hosting/wopi/word/edit'],
+			'non-http scheme' => ['javascript://office.example.com/x'],
+			'directive separator in host' => ['https://a;b/x'],
+			'whitespace in host' => ['https://a b;script-src */x'],
+		];
+	}
+
+	#[DataProvider('invalidUrls')]
+	public function testRejectsUrlWithoutUsableOrigin(string $editorUrl): void {
+		$this->expectException(\InvalidArgumentException::class);
+		EditorPagePolicy::forEditorUrl($editorUrl);
+	}
+
+	public function testRejectionKeepsTheTokenOutOfMessageAndTrace(): void {
+		// Off is PHP's default and what the stock Nextcloud images run with.
+		$previous = ini_set('zend.exception_ignore_args', '0');
+		try {
+			EditorPagePolicy::forEditorUrl('/hosting/wopi/word/edit?access_token=tok123');
+			$this->fail('Expected InvalidArgumentException');
+		} catch (\InvalidArgumentException $e) {
+			$this->assertStringNotContainsString('tok123', $e->getMessage());
+			foreach ($e->getTrace() as $frame) {
+				foreach ($frame['args'] ?? [] as $arg) {
+					$this->assertFalse(is_string($arg) && str_contains($arg, 'tok123'), 'Token leaked into ' . $frame['function'] . '() trace args');
+				}
+			}
+		} finally {
+			ini_set('zend.exception_ignore_args', (string)$previous);
+		}
+	}
+}
diff --git a/tests/unit/Listener/LoadAdditionalScriptsListenerTest.php b/tests/unit/Listener/LoadAdditionalScriptsListenerTest.php
new file mode 100644
index 00000000..88eaa1a7
--- /dev/null
+++ b/tests/unit/Listener/LoadAdditionalScriptsListenerTest.php
@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Listener;
+
+use OCA\Office\Listener\LoadAdditionalScriptsListener;
+use OCA\Office\Service\DiscoveryService;
+use OCP\AppFramework\Http\Events\BeforeTemplateRenderedEvent;
+use OCP\AppFramework\Http\Template\PublicTemplateResponse;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\Collaboration\Resources\LoadAdditionalScriptsEvent;
+use OCP\EventDispatcher\Event;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Whether the listener loads the file action is observed through the initial state it
+ * provides first; Util::addInitScript() needs a running server and isn't reached here.
+ */
+final class LoadAdditionalScriptsListenerTest extends TestCase {
+	private function loadsFileAction(Event $event): bool {
+		$initialState = $this->createMock(IInitialState::class);
+		$loaded = false;
+		$initialState->method('provideInitialState')->willReturnCallback(static function () use (&$loaded): void {
+			$loaded = true;
+		});
+		$discovery = $this->createMock(DiscoveryService::class);
+		$discovery->method('getSupportedMimeTypes')->willReturn([]);
+
+		try {
+			(new LoadAdditionalScriptsListener($discovery, $initialState))->handle($event);
+		} catch (\Error) {
+			// Util::addInitScript() without a server: the decision was already made.
+		}
+
+		return $loaded;
+	}
+
+	// PublicTemplateResponse's constructor needs a running server, so it is mocked.
+	private function publicPage(string $app, string $template): BeforeTemplateRenderedEvent {
+		$response = $this->createMock(PublicTemplateResponse::class);
+		$response->method('getApp')->willReturn($app);
+		$response->method('getTemplateName')->willReturn($template);
+
+		return new BeforeTemplateRenderedEvent(false, $response);
+	}
+
+	public function testFilesApp(): void {
+		$this->assertTrue($this->loadsFileAction(new LoadAdditionalScriptsEvent()));
+	}
+
+	public function testPublicSharePage(): void {
+		$this->assertTrue($this->loadsFileAction($this->publicPage('files', 'index')));
+	}
+
+	public function testNotOnOtherPublicPages(): void {
+		$this->assertFalse($this->loadsFileAction($this->publicPage('files_sharing', 'authenticate')));
+		$this->assertFalse($this->loadsFileAction($this->publicPage('files', 'other')));
+		$this->assertFalse($this->loadsFileAction($this->publicPage('other_app', 'index')));
+	}
+
+	public function testNotTwiceOnTheLoggedInFilesPage(): void {
+		// The logged-in Files page already gets it through LoadAdditionalScriptsEvent.
+		$this->assertFalse($this->loadsFileAction(new BeforeTemplateRenderedEvent(true, new TemplateResponse('files', 'index'))));
+	}
+
+	public function testNotOnUnrelatedEvents(): void {
+		$this->assertFalse($this->loadsFileAction(new Event()));
+	}
+}
diff --git a/tests/unit/Middleware/WopiAllowlistMiddlewareTest.php b/tests/unit/Middleware/WopiAllowlistMiddlewareTest.php
new file mode 100644
index 00000000..305ee1c1
--- /dev/null
+++ b/tests/unit/Middleware/WopiAllowlistMiddlewareTest.php
@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Middleware;
+
+use OCA\Office\Controller\SettingsController;
+use OCA\Office\Controller\WopiController;
+use OCA\Office\Exception\WopiCallerNotAllowedException;
+use OCA\Office\Middleware\WopiAllowlistMiddleware;
+use OCA\Office\Service\LogThrottle;
+use OCA\Office\Tests\Unit\Support\MemoryCache;
+use OCP\AppFramework\Http;
+use OCP\IAppConfig;
+use OCP\IRequest;
+use OCP\Security\Ip\IAddress;
+use OCP\Security\Ip\IFactory;
+use OCP\Security\Ip\IRange;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+
+final class WopiAllowlistMiddlewareTest extends TestCase {
+	private string $allowlist = '';
+	private string $remoteAddress = '10.0.0.5';
+	private LoggerInterface&MockObject $logger;
+	private WopiAllowlistMiddleware $middleware;
+
+	protected function setUp(): void {
+		$request = $this->createMock(IRequest::class);
+		$request->method('getRemoteAddress')->willReturnCallback(fn (): string => $this->remoteAddress);
+
+		$appConfig = $this->createMock(IAppConfig::class);
+		$appConfig->method('getValueString')->willReturnCallback(fn (string $app, string $key): string => $key === 'wopi_allowlist' ? $this->allowlist : '');
+
+		$this->logger = $this->createMock(LoggerInterface::class);
+		$this->middleware = new WopiAllowlistMiddleware($request, $appConfig, $this->ipFactory(), $this->logger, new LogThrottle($this->throttleCache()));
+	}
+
+	/**
+	 * Stands in for core's implementation with exact-address ranges and one "/24"
+	 * form, enough to exercise the middleware's own logic.
+	 */
+	private function ipFactory(): IFactory {
+		$factory = $this->createMock(IFactory::class);
+		$factory->method('addressFromString')->willReturnCallback(function (string $ip): IAddress {
+			if (filter_var($ip, FILTER_VALIDATE_IP) === false) {
+				throw new \InvalidArgumentException();
+			}
+			$address = $this->createMock(IAddress::class);
+			$address->method('__toString')->willReturn($ip);
+			return $address;
+		});
+		$factory->method('rangeFromString')->willReturnCallback(function (string $range): IRange {
+			$prefix = str_ends_with($range, '.0/24') ? substr($range, 0, -4) : null;
+			if ($prefix === null && filter_var($range, FILTER_VALIDATE_IP) === false) {
+				throw new \InvalidArgumentException();
+			}
+			$mock = $this->createMock(IRange::class);
+			$mock->method('contains')->willReturnCallback(
+				static fn (IAddress $a): bool => $prefix !== null ? str_starts_with((string)$a, $prefix) : (string)$a === $range,
+			);
+			return $mock;
+		});
+		return $factory;
+	}
+
+	private function check(): void {
+		$this->middleware->beforeController($this->createMock(WopiController::class), 'getFile');
+	}
+
+	public function testEmptyAllowlistAllowsEveryone(): void {
+		$this->check();
+		$this->addToAssertionCount(1);
+	}
+
+	public function testCallerInARangeIsAllowed(): void {
+		$this->allowlist = '192.168.1.10, 10.0.0.0/24';
+		$this->check();
+		$this->addToAssertionCount(1);
+	}
+
+	public function testCallerOutsideEveryRangeIsRejected(): void {
+		$this->allowlist = '192.168.1.10 10.1.0.0/24';
+
+		$this->expectException(WopiCallerNotAllowedException::class);
+		$this->check();
+	}
+
+	public function testOnlyInvalidEntriesRejectEveryoneAndAreLogged(): void {
+		$this->allowlist = 'editor.example.com';
+		$this->logger->expects($this->once())->method('warning');
+
+		$this->expectException(WopiCallerNotAllowedException::class);
+		$this->check();
+	}
+
+	public function testAnInvalidEntryIsReportedOnceNotOnEveryRequest(): void {
+		$this->allowlist = 'editor.example.com 10.0.0.5';
+		$this->logger->expects($this->once())->method('warning');
+
+		for ($i = 0; $i < 3; $i++) {
+			$this->check();
+		}
+	}
+
+	public function testUnparsableCallerAddressIsRejected(): void {
+		$this->allowlist = '10.0.0.5';
+		$this->remoteAddress = 'not-an-ip';
+
+		$this->expectException(WopiCallerNotAllowedException::class);
+		$this->check();
+	}
+
+	public function testOtherControllersAreNotRestricted(): void {
+		$this->allowlist = '192.168.1.10';
+		$this->middleware->beforeController($this->createMock(SettingsController::class), 'getAdmin');
+		$this->addToAssertionCount(1);
+	}
+
+	public function testRejectionIs403(): void {
+		$response = $this->middleware->afterException($this->createMock(WopiController::class), 'getFile', new WopiCallerNotAllowedException('x'));
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus());
+	}
+
+	private function throttleCache(): \OCP\ICacheFactory {
+		$factory = $this->createMock(\OCP\ICacheFactory::class);
+		$factory->method('createLocal')->willReturn(new MemoryCache());
+
+		return $factory;
+	}
+}
diff --git a/tests/unit/Middleware/WopiProofMiddlewareTest.php b/tests/unit/Middleware/WopiProofMiddlewareTest.php
new file mode 100644
index 00000000..c152e209
--- /dev/null
+++ b/tests/unit/Middleware/WopiProofMiddlewareTest.php
@@ -0,0 +1,193 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Middleware;
+
+use OCA\Office\Controller\SettingsController;
+use OCA\Office\Controller\WopiController;
+use OCA\Office\Exception\WopiProofException;
+use OCA\Office\Middleware\WopiProofMiddleware;
+use OCA\Office\Service\DiscoveryService;
+use OCA\Office\Service\LogThrottle;
+use OCA\Office\Service\WopiProofKeys;
+use OCA\Office\Service\WopiProofVerifier;
+use OCA\Office\Tests\Unit\Support\MemoryCache;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+
+/**
+ * Runs the real verifier against a request signed by Euro-Office's own proof code
+ * (tests/fixtures/wopi-proof-euro-office.json). The editor called Nextcloud at
+ * http://nextcloud-internal:8080 (callback_url) while Nextcloud's own absolute URL is
+ * https://cloud.example.com.
+ */
+final class WopiProofMiddlewareTest extends TestCase {
+	private const string NC_BASE = 'https://cloud.example.com';
+	private const string CALLBACK_BASE = 'http://nextcloud-internal:8080';
+
+	/** @var array<string, mixed> */
+	private array $fixture;
+	/** @var array<string, string> */
+	private array $headers = [];
+	private ?WopiProofKeys $keys;
+	private int $now = 1793016000 + 60;
+	private DiscoveryService&MockObject $discoveryService;
+	private LoggerInterface&MockObject $logger;
+	private WopiProofMiddleware $middleware;
+
+	protected function setUp(): void {
+		$this->fixture = json_decode((string)file_get_contents(__DIR__ . '/../../fixtures/wopi-proof-euro-office.json'), true);
+		$d = $this->fixture['discovery'];
+		$this->keys = new WopiProofKeys($d['modulus'], $d['exponent'], $d['oldmodulus'], $d['oldexponent']);
+		$this->headers = [
+			'X-WOPI-Proof' => $this->fixture['proofCurrentKey'],
+			'X-WOPI-ProofOld' => $this->fixture['proofOldKey'],
+			'X-WOPI-TimeStamp' => $this->fixture['timestamp'],
+		];
+
+		$requestUri = substr($this->fixture['url'], strlen(self::CALLBACK_BASE));
+		$request = $this->createMock(IRequest::class);
+		$request->method('getHeader')->willReturnCallback(fn (string $name): string => $this->headers[$name] ?? '');
+		$request->method('getRequestUri')->willReturn($requestUri);
+		$request->method('getParam')->willReturnCallback(fn (string $name, mixed $default = null): mixed => match ($name) {
+			'access_token' => $this->fixture['accessToken'],
+			'fileId' => '82',
+			default => $default,
+		});
+
+		$this->discoveryService = $this->createMock(DiscoveryService::class);
+		$this->discoveryService->method('getProofKeys')->willReturnCallback(fn (): ?WopiProofKeys => $this->keys);
+		$this->discoveryService->method('editorReachableUrl')->willReturnCallback(
+			static fn (string $url): string => str_replace(self::NC_BASE, self::CALLBACK_BASE, $url),
+		);
+
+		$urlGenerator = $this->createMock(IURLGenerator::class);
+		$urlGenerator->method('getAbsoluteURL')->willReturnCallback(static fn (string $url): string => self::NC_BASE . $url);
+
+		$time = $this->createMock(ITimeFactory::class);
+		$time->method('getTime')->willReturnCallback(fn (): int => $this->now);
+
+		$this->logger = $this->createMock(LoggerInterface::class);
+		$this->middleware = new WopiProofMiddleware($request, $this->discoveryService, new WopiProofVerifier($time), $urlGenerator, $this->logger, new LogThrottle($this->throttleCache()));
+	}
+
+	private function wopiController(): WopiController {
+		return $this->createMock(WopiController::class);
+	}
+
+	public function testAcceptsTheEditorsSignatureOverTheUrlItCalled(): void {
+		$this->middleware->beforeController($this->wopiController(), 'getFile');
+		$this->addToAssertionCount(1);
+	}
+
+	public function testRejectsAForgedProof(): void {
+		$this->headers['X-WOPI-Proof'] = $this->fixture['proofOtherKey'];
+		$this->headers['X-WOPI-ProofOld'] = $this->fixture['proofOtherKey'];
+
+		$this->expectException(WopiProofException::class);
+		$this->middleware->beforeController($this->wopiController(), 'getFile');
+	}
+
+	public function testRejectsAnUnsignedRequestWhenTheEditorPublishesKeys(): void {
+		$this->headers = ['X-WOPI-TimeStamp' => $this->fixture['timestamp']];
+
+		$this->expectException(WopiProofException::class);
+		$this->middleware->beforeController($this->wopiController(), 'getFile');
+	}
+
+	public function testRejectsAReplayedRequestAfterTwentyMinutes(): void {
+		// The genuine signed request, replayed 25 minutes later.
+		$this->now = 1793016000 + 25 * 60;
+
+		$this->expectException(WopiProofException::class);
+		$this->middleware->beforeController($this->wopiController(), 'getFile');
+	}
+
+	public function testLetsRequestsThroughWhenTheEditorDoesNotSign(): void {
+		$this->keys = null;
+		$this->headers = [];
+		$this->discoveryService->expects($this->never())->method('refreshProofKeys');
+
+		$this->middleware->beforeController($this->wopiController(), 'getFile');
+	}
+
+	public function testRefreshesDiscoveryWhenAProofArrivesWithoutACachedKey(): void {
+		$keys = $this->keys;
+		$this->keys = null;
+		$this->discoveryService->expects($this->once())->method('refreshProofKeys')->willReturn($keys);
+
+		$this->middleware->beforeController($this->wopiController(), 'getFile');
+	}
+
+	public function testIgnoresOtherControllers(): void {
+		$this->headers = [];
+		$this->discoveryService->expects($this->never())->method('getProofKeys');
+
+		$this->middleware->beforeController($this->createMock(SettingsController::class), 'getAdmin');
+	}
+
+	public function testRejectionIs403WithoutTheTokenInTheContext(): void {
+		$this->logger->expects($this->once())->method('warning')->with(
+			$this->anything(),
+			$this->callback(fn (array $context): bool => !str_contains(json_encode($context), $this->fixture['accessToken'])),
+		);
+
+		$response = $this->middleware->afterException($this->wopiController(), 'getFile', new WopiProofException('Invalid X-WOPI-Proof'));
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus());
+	}
+
+	public function testRepeatedRejectionsAreNotEachAWarning(): void {
+		// Core adds the request URL, access token included, to every log line.
+		$this->logger->expects($this->once())->method('warning');
+		$this->logger->expects($this->exactly(2))->method('debug');
+
+		for ($i = 0; $i < 3; $i++) {
+			$this->middleware->afterException($this->wopiController(), 'getFile', new WopiProofException('Invalid X-WOPI-Proof'));
+		}
+	}
+
+	public function testPicksUpKeysTheEditorRegenerated(): void {
+		// Cached keys from before the editor's container was recreated with a new key.
+		$d = $this->fixture['discovery'];
+		$current = $this->keys;
+		$this->keys = new WopiProofKeys($d['oldmodulus'], $d['oldexponent'], $d['oldmodulus'], $d['oldexponent']);
+		$this->headers['X-WOPI-ProofOld'] = '';
+		$this->discoveryService->expects($this->once())->method('refreshProofKeys')->willReturn($current);
+
+		$this->middleware->beforeController($this->wopiController(), 'getFile');
+	}
+
+	public function testRefreshThatFindsTheSameKeysStillRejects(): void {
+		$this->headers['X-WOPI-Proof'] = $this->fixture['proofOtherKey'];
+		$this->headers['X-WOPI-ProofOld'] = '';
+		$keys = $this->keys;
+		$this->discoveryService->method('refreshProofKeys')->willReturn($keys);
+
+		$this->expectException(WopiProofException::class);
+		$this->middleware->beforeController($this->wopiController(), 'getFile');
+	}
+
+	public function testOtherExceptionsPassThrough(): void {
+		$this->expectException(\RuntimeException::class);
+		$this->middleware->afterException($this->wopiController(), 'getFile', new \RuntimeException('boom'));
+	}
+
+	private function throttleCache(): \OCP\ICacheFactory {
+		$factory = $this->createMock(\OCP\ICacheFactory::class);
+		$factory->method('createLocal')->willReturn(new MemoryCache());
+
+		return $factory;
+	}
+}
diff --git a/tests/unit/Service/DiscoveryServiceTest.php b/tests/unit/Service/DiscoveryServiceTest.php
new file mode 100644
index 00000000..b71a4852
--- /dev/null
+++ b/tests/unit/Service/DiscoveryServiceTest.php
@@ -0,0 +1,610 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Service;
+
+use OCA\Office\Service\DiscoveryService;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\Http\Client\IClient;
+use OCP\Http\Client\IClientService;
+use OCP\Http\Client\IResponse;
+use OCP\IAppConfig;
+use OCP\ICache;
+use OCP\ICacheFactory;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+
+final class DiscoveryServiceTest extends TestCase {
+	private IClientService&MockObject $clientService;
+	private ICacheFactory&MockObject $cacheFactory;
+	private IAppConfig&MockObject $appConfig;
+	private LoggerInterface&MockObject $logger;
+	private ICache&MockObject $cache;
+	private ICache&MockObject $localCache;
+	private DiscoveryService $service;
+	/** @var array<string, string|int> In-memory app config. */
+	private array $config = [];
+	private int $now = 1793016000;
+
+	protected function setUp(): void {
+		$this->clientService = $this->createMock(IClientService::class);
+		$this->cacheFactory = $this->createMock(ICacheFactory::class);
+		$this->appConfig = $this->createMock(IAppConfig::class);
+		$this->appConfig->method('getValueString')->willReturnCallback(
+			fn (string $app, string $key, string $default = ''): string => (string)($this->config[$key] ?? $default),
+		);
+		$this->appConfig->method('getValueInt')->willReturnCallback(
+			fn (string $app, string $key, int $default = 0): int => (int)($this->config[$key] ?? $default),
+		);
+		$this->appConfig->method('setValueString')->willReturnCallback(function (string $app, string $key, string $value): bool {
+			$this->config[$key] = $value;
+			return true;
+		});
+		$this->appConfig->method('setValueInt')->willReturnCallback(function (string $app, string $key, int $value): bool {
+			$this->config[$key] = $value;
+			return true;
+		});
+		$this->appConfig->method('deleteKey')->willReturnCallback(function (string $app, string $key): void {
+			unset($this->config[$key]);
+		});
+		$this->logger = $this->createMock(LoggerInterface::class);
+		$this->cache = $this->createMock(ICache::class);
+		$this->localCache = $this->createMock(ICache::class);
+
+		$time = $this->createMock(ITimeFactory::class);
+		$time->method('getTime')->willReturnCallback(fn (): int => $this->now);
+
+		$this->cacheFactory->method('createDistributed')
+			->with('office')
+			->willReturn($this->cache);
+		$this->cacheFactory->method('createLocal')
+			->with('office')
+			->willReturn($this->localCache);
+
+		$this->service = new DiscoveryService(
+			$this->clientService,
+			$this->cacheFactory,
+			$this->appConfig,
+			$this->logger,
+			$time,
+		);
+	}
+
+	private function fixture(string $name): string {
+		return (string)file_get_contents(__DIR__ . '/../../fixtures/' . $name);
+	}
+
+	/** @param array<string, string> $values */
+	private function mockAppConfig(array $values): void {
+		$this->config = $values;
+	}
+
+	private function withDiscoveryXml(string $xml): void {
+		$this->cache->method('get')->with('discovery')->willReturn($xml);
+	}
+
+	private function mockFetchReturns(string $body): void {
+		$response = $this->createMock(IResponse::class);
+		$response->method('getBody')->willReturn($body);
+
+		$client = $this->createMock(IClient::class);
+		$client->method('get')->willReturn($response);
+
+		$this->clientService->method('newClient')->willReturn($client);
+	}
+
+	// --- get() / fetch() / resetCache() ---
+
+	public function testGetReturnsCachedValueWithoutFetching(): void {
+		$this->cache->method('get')->with('discovery')->willReturn('<cached/>');
+		$this->clientService->expects($this->never())->method('newClient');
+
+		$this->assertSame('<cached/>', $this->service->get());
+	}
+
+	public function testGetFetchesAndCachesOnCacheMiss(): void {
+		$this->cache->method('get')->willReturn(null);
+		$this->mockAppConfig(['wopi_url' => 'http://eo']);
+		$this->mockFetchReturns('<fresh/>');
+
+		$this->cache->expects($this->once())
+			->method('set')
+			->with('discovery', '<fresh/>', 3600);
+
+		$this->assertSame('<fresh/>', $this->service->get());
+	}
+
+	public function testGetReturnsNullAndLogsWhenFetchThrows(): void {
+		$this->cache->method('get')->willReturn(null);
+		$this->mockAppConfig(['wopi_url' => 'http://eo']);
+
+		$client = $this->createMock(IClient::class);
+		$client->method('get')->willThrowException(new \Exception('connection refused'));
+		$this->clientService->method('newClient')->willReturn($client);
+
+		$this->logger->expects($this->once())->method('error');
+
+		$this->assertNull($this->service->get());
+	}
+
+	public function testFetchRequestsDiscoveryUrlWithOptions(): void {
+		$this->mockAppConfig(['wopi_url' => 'http://eo']);
+
+		$response = $this->createMock(IResponse::class);
+		$response->method('getBody')->willReturn('<discovery/>');
+
+		$client = $this->createMock(IClient::class);
+		$client->expects($this->once())
+			->method('get')
+			->with(
+				'http://eo/hosting/discovery',
+				$this->callback(static function (array $options): bool {
+					return $options['timeout'] === 15
+						&& $options['connect_timeout'] === 5
+						&& $options['nextcloud']['allow_local_address'] === true
+						&& !isset($options['verify']);
+				})
+			)
+			->willReturn($response);
+		$this->clientService->method('newClient')->willReturn($client);
+
+		$this->assertSame('<discovery/>', $this->service->fetch());
+	}
+
+	public function testFetchDisablesCertificateVerificationWhenConfigured(): void {
+		$this->mockAppConfig([
+			'wopi_url' => 'http://eo',
+			'disable_certificate_verification' => 'yes',
+		]);
+
+		$response = $this->createMock(IResponse::class);
+		$response->method('getBody')->willReturn('<discovery/>');
+
+		$client = $this->createMock(IClient::class);
+		$client->expects($this->once())
+			->method('get')
+			->with(
+				$this->anything(),
+				$this->callback(static fn (array $options): bool => ($options['verify'] ?? null) === false)
+			)
+			->willReturn($response);
+		$this->clientService->method('newClient')->willReturn($client);
+
+		$this->service->fetch();
+	}
+
+	public function testResetCacheRemovesDiscoveryAndThisNodesFailureMarker(): void {
+		$this->cache->expects($this->once())->method('remove')->with('discovery');
+		$this->localCache->expects($this->once())->method('remove')->with('discovery_failed');
+
+		$this->service->resetCache();
+	}
+
+	public function testGetDoesNotFetchWhenEditorUrlIsNotConfigured(): void {
+		$this->cache->method('get')->willReturn(null);
+		$this->mockAppConfig([]);
+		$this->clientService->expects($this->never())->method('newClient');
+		$this->logger->expects($this->never())->method('error');
+
+		$this->assertNull($this->service->get());
+	}
+
+	public function testGetRemembersAFailedFetchBriefly(): void {
+		$this->cache->method('get')->willReturn(null);
+		$this->mockAppConfig(['wopi_url' => 'http://eo']);
+
+		$client = $this->createMock(IClient::class);
+		$client->method('get')->willThrowException(new \Exception('connection timed out'));
+		$this->clientService->method('newClient')->willReturn($client);
+
+		$this->cache->expects($this->never())->method('set');
+		$this->localCache->expects($this->once())->method('set')->with('discovery_failed', true, 60);
+
+		$this->assertNull($this->service->get());
+	}
+
+	public function testGetDoesNotRetryWhileAFailureIsRemembered(): void {
+		$this->cache->method('get')->willReturn(null);
+		$this->localCache->method('get')->with('discovery_failed')->willReturn(true);
+		$this->mockAppConfig(['wopi_url' => 'http://eo']);
+		$this->clientService->expects($this->never())->method('newClient');
+
+		$this->assertNull($this->service->get());
+	}
+
+	public function testIsAvailableReflectsWhetherDiscoveryCanBeRead(): void {
+		$this->cache->method('get')->willReturn(null);
+		$this->mockAppConfig([]);
+
+		$this->assertFalse($this->service->isAvailable());
+	}
+
+	public function testIsAvailableWithCachedDiscovery(): void {
+		$this->withDiscoveryXml('<wopi-discovery/>');
+
+		$this->assertTrue($this->service->isAvailable());
+	}
+
+	// --- getUrlSrc() ---
+
+	public function testGetUrlSrcRejectsNonAlnumExtension(): void {
+		$this->clientService->expects($this->never())->method('newClient');
+		$this->assertNull($this->service->getUrlSrc('docx" or "1"="1'));
+	}
+
+	public function testGetUrlSrcRejectsExtensionLongerThan20Chars(): void {
+		$this->assertNull($this->service->getUrlSrc(str_repeat('a', 21)));
+	}
+
+	public function testGetUrlSrcRejectsEmptyExtension(): void {
+		$this->assertNull($this->service->getUrlSrc(''));
+	}
+
+	public function testGetUrlSrcReturnsUrlsrcForMatchingExtensionAndAction(): void {
+		$this->withDiscoveryXml($this->fixture('discovery-onlyoffice.xml'));
+		$urlsrc = $this->service->getUrlSrc('docx', 'edit');
+		$this->assertStringContainsString('hosting/wopi/word/edit', (string)$urlsrc);
+	}
+
+	public function testGetUrlSrcDefaultsToEditAction(): void {
+		$this->withDiscoveryXml($this->fixture('discovery-onlyoffice.xml'));
+		$urlsrc = $this->service->getUrlSrc('docx');
+		$this->assertStringContainsString('hosting/wopi/word/edit', (string)$urlsrc);
+	}
+
+	public function testGetUrlSrcFindsViewAction(): void {
+		$this->withDiscoveryXml($this->fixture('discovery-onlyoffice.xml'));
+		$urlsrc = $this->service->getUrlSrc('docx', 'view');
+		$this->assertStringContainsString('hosting/wopi/word/view', (string)$urlsrc);
+	}
+
+	public function testGetUrlSrcReturnsNullWhenActionNotFoundForExtension(): void {
+		$this->withDiscoveryXml($this->fixture('discovery-onlyoffice.xml'));
+		// pdf only has a "view" action in the fixture, not "edit".
+		$this->assertNull($this->service->getUrlSrc('pdf', 'edit'));
+	}
+
+	public function testGetUrlSrcReturnsNullWhenExtensionNotInDiscovery(): void {
+		$this->withDiscoveryXml($this->fixture('discovery-onlyoffice.xml'));
+		$this->assertNull($this->service->getUrlSrc('odt', 'edit'));
+	}
+
+	public function testGetUrlSrcReturnsNullWhenDiscoveryFetchFails(): void {
+		$this->cache->method('get')->willReturn(null);
+		$this->mockAppConfig(['wopi_url' => 'http://eo']);
+
+		$client = $this->createMock(IClient::class);
+		$client->method('get')->willThrowException(new \Exception('timeout'));
+		$this->clientService->method('newClient')->willReturn($client);
+
+		$this->assertNull($this->service->getUrlSrc('docx'));
+	}
+
+	public function testGetUrlSrcReturnsNullAndLogsOnMalformedXml(): void {
+		$this->withDiscoveryXml('<not valid xml');
+		$this->logger->expects($this->once())->method('error');
+		$this->assertNull(@$this->service->getUrlSrc('docx'));
+	}
+
+	// --- getSupportedMimeTypes() ---
+
+	public function testGetSupportedMimeTypesReturnsEmptyArrayForOnlyOfficeStyleDiscovery(): void {
+		// KNOWN BUG (documented, not fixed): getSupportedMimeTypes() assumes app
+		// name === MIME type (Collabora-style). OnlyOffice/Euro-Office discovery
+		// names apps "Word"/"Excel"/etc, so this always returns [] against it.
+		$this->withDiscoveryXml($this->fixture('discovery-onlyoffice.xml'));
+		$this->assertSame([], $this->service->getSupportedMimeTypes());
+	}
+
+	public function testGetSupportedMimeTypesReturnsMimeTypesForCollaboraStyleDiscovery(): void {
+		$this->withDiscoveryXml($this->fixture('discovery-collabora.xml'));
+		$mimes = $this->service->getSupportedMimeTypes();
+
+		$this->assertContains('application/vnd.openxmlformats-officedocument.wordprocessingml.document', $mimes);
+		$this->assertContains('application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', $mimes);
+	}
+
+	public function testGetSupportedMimeTypesDeduplicatesRepeatedMimeTypes(): void {
+		// discovery-collabora.xml has two <app name="...wordprocessingml.document">
+		// entries (edit action's app matches itself once, but the XPath selects
+		// //app/@name so a MIME type appearing on more than one <app> must not
+		// be duplicated in the result).
+		$this->withDiscoveryXml($this->fixture('discovery-collabora.xml'));
+		$mimes = $this->service->getSupportedMimeTypes();
+
+		$this->assertSame(array_values(array_unique($mimes)), $mimes);
+	}
+
+	public function testGetSupportedMimeTypesReturnsEmptyArrayWhenDiscoveryUnavailable(): void {
+		$this->cache->method('get')->willReturn(null);
+		$this->mockAppConfig(['wopi_url' => 'http://eo']);
+
+		$client = $this->createMock(IClient::class);
+		$client->method('get')->willThrowException(new \Exception('timeout'));
+		$this->clientService->method('newClient')->willReturn($client);
+
+		$this->assertSame([], $this->service->getSupportedMimeTypes());
+	}
+
+	public function testGetSupportedMimeTypesReturnsEmptyArrayAndLogsOnMalformedXml(): void {
+		$this->withDiscoveryXml('<not valid xml');
+		$this->logger->expects($this->once())->method('error');
+		$this->assertSame([], @$this->service->getSupportedMimeTypes());
+	}
+
+	// --- buildEditorUrl() ---
+
+	public function testBuildEditorUrlStripsPlaceholdersAndAppendsWopiSrcAndToken(): void {
+		$this->mockAppConfig([]);
+
+		$url = $this->service->buildEditorUrl(
+			'http://eo/hosting/wopi/word/edit?<rs=DC_LLCC&>',
+			'http://nc.local/index.php/apps/office/wopi/files/82',
+			'tok123',
+		);
+
+		$this->assertSame(
+			'http://eo/hosting/wopi/word/edit?wopisrc=' . urlencode('http://nc.local/index.php/apps/office/wopi/files/82') . '&access_token=tok123',
+			$url,
+		);
+	}
+
+	public function testBuildEditorUrlUsesAmpersandSeparatorWhenQueryStringRemains(): void {
+		$this->mockAppConfig([]);
+
+		$url = $this->service->buildEditorUrl(
+			'http://eo/x?foo=bar&<rs=DC_LLCC&>',
+			'http://nc.local/wopi',
+			'tok',
+		);
+
+		$this->assertStringStartsWith('http://eo/x?foo=bar&wopisrc=', $url);
+	}
+
+	public function testBuildEditorUrlStripsMultiplePlaceholders(): void {
+		$this->mockAppConfig([]);
+
+		$url = $this->service->buildEditorUrl(
+			'http://eo/hosting/wopi/word/edit?<rs=DC_LLCC&><dchat=DISABLE_CHAT&>',
+			'http://nc.local/wopi',
+			'tok',
+		);
+
+		$this->assertStringNotContainsString('<', $url);
+		$this->assertStringNotContainsString('>', $url);
+		$this->assertStringStartsWith('http://eo/hosting/wopi/word/edit?wopisrc=', $url);
+	}
+
+	public function testBuildEditorUrlSwapsToPublicWopiUrlWhenUrlsrcMatchesInternal(): void {
+		$this->mockAppConfig([
+			'wopi_url' => 'http://eo',
+			'public_wopi_url' => 'https://eo.public.example.com',
+		]);
+
+		$url = $this->service->buildEditorUrl(
+			'http://eo/hosting/wopi/word/edit?<rs=DC_LLCC&>',
+			'http://nc.local/wopi',
+			'tok',
+		);
+
+		$this->assertStringStartsWith('https://eo.public.example.com/hosting/wopi/word/edit?wopisrc=', $url);
+	}
+
+	public function testBuildEditorUrlLeavesUrlsrcUnchangedWhenNotMatchingInternalPrefix(): void {
+		$this->mockAppConfig([
+			'wopi_url' => 'http://eo',
+			'public_wopi_url' => 'https://eo.public.example.com',
+		]);
+
+		$url = $this->service->buildEditorUrl(
+			'http://other-host/hosting/wopi/word/edit?<rs=DC_LLCC&>',
+			'http://nc.local/wopi',
+			'tok',
+		);
+
+		$this->assertStringStartsWith('http://other-host/hosting/wopi/word/edit?wopisrc=', $url);
+	}
+
+	public function testBuildEditorUrlIsNoOpWhenPublicWopiUrlNotConfigured(): void {
+		$this->mockAppConfig(['wopi_url' => 'http://eo']);
+
+		$url = $this->service->buildEditorUrl(
+			'http://eo/hosting/wopi/word/edit?<rs=DC_LLCC&>',
+			'http://nc.local/wopi',
+			'tok',
+		);
+
+		$this->assertStringStartsWith('http://eo/hosting/wopi/word/edit?wopisrc=', $url);
+	}
+
+	public function testBuildEditorUrlSwapsWopiSrcOriginToCallbackUrl(): void {
+		$this->mockAppConfig(['callback_url' => 'http://nc-internal:8080']);
+
+		$url = $this->service->buildEditorUrl(
+			'http://eo/hosting/wopi/word/edit?<rs=DC_LLCC&>',
+			'https://nc.public.example.com:443/index.php/apps/office/wopi/files/82',
+			'tok',
+		);
+
+		$expectedWopiSrc = 'http://nc-internal:8080/index.php/apps/office/wopi/files/82';
+		$this->assertStringContainsString('wopisrc=' . urlencode($expectedWopiSrc), $url);
+	}
+
+	public function testBuildEditorUrlSwapsWopiSrcWithHttpsPortAndNoPath(): void {
+		$this->mockAppConfig(['callback_url' => 'http://nc-internal:8080']);
+
+		$url = $this->service->buildEditorUrl(
+			'http://eo/hosting/wopi/word/edit?<rs=DC_LLCC&>',
+			'https://nc.public.example.com:8443',
+			'tok',
+		);
+
+		$this->assertStringContainsString('wopisrc=' . urlencode('http://nc-internal:8080'), $url);
+	}
+
+	public function testBuildEditorUrlLeavesWopiSrcUnchangedWhenUnparsable(): void {
+		$this->mockAppConfig(['callback_url' => 'http://nc-internal:8080']);
+
+		$url = $this->service->buildEditorUrl(
+			'http://eo/hosting/wopi/word/edit?<rs=DC_LLCC&>',
+			'not-a-url',
+			'tok',
+		);
+
+		$this->assertStringContainsString('wopisrc=' . urlencode('not-a-url'), $url);
+	}
+
+	public function testBuildEditorUrlAppliesBothPublicWopiUrlAndCallbackUrlTransformations(): void {
+		$this->mockAppConfig([
+			'wopi_url' => 'http://eo',
+			'public_wopi_url' => 'https://eo.public.example.com',
+			'callback_url' => 'http://nc-internal:8080',
+		]);
+
+		$url = $this->service->buildEditorUrl(
+			'http://eo/hosting/wopi/word/edit?<rs=DC_LLCC&>',
+			'https://nc.public.example.com/index.php/apps/office/wopi/files/82',
+			'tok',
+		);
+
+		$this->assertStringStartsWith('https://eo.public.example.com/hosting/wopi/word/edit?wopisrc=', $url);
+		$this->assertStringContainsString(
+			urlencode('http://nc-internal:8080/index.php/apps/office/wopi/files/82'),
+			$url,
+		);
+	}
+
+	public function testBuildEditorUrlUrlEncodesTokenAndWopiSrc(): void {
+		$this->mockAppConfig([]);
+
+		$url = $this->service->buildEditorUrl(
+			'http://eo/hosting/wopi/word/edit',
+			'http://nc.local/wopi?a=b',
+			'tok en/2',
+		);
+
+		$this->assertStringContainsString('access_token=' . urlencode('tok en/2'), $url);
+		$this->assertStringContainsString('wopisrc=' . urlencode('http://nc.local/wopi?a=b'), $url);
+	}
+
+	// --- editorReachableUrl() ---
+
+	public function testEditorReachableUrlSwapsTheOriginForCallbackUrl(): void {
+		$this->mockAppConfig(['callback_url' => 'http://nextcloud-internal:8080/']);
+
+		$this->assertSame(
+			'http://nextcloud-internal:8080/index.php/apps/office/wopi/files/82?access_token=tok',
+			$this->service->editorReachableUrl('https://cloud.example.com/index.php/apps/office/wopi/files/82?access_token=tok'),
+		);
+	}
+
+	public function testEditorReachableUrlIsUnchangedWithoutCallbackUrl(): void {
+		$this->mockAppConfig([]);
+
+		$this->assertSame('https://cloud.example.com/x', $this->service->editorReachableUrl('https://cloud.example.com/x'));
+	}
+
+	// --- getProofKeys() / refreshProofKeys() ---
+
+	public function testGetProofKeysReadsCurrentAndOldKey(): void {
+		$this->withDiscoveryXml('<wopi-discovery><net-zone/><proof-key oldvalue="x" oldmodulus="T2xk" oldexponent="AQAB" value="y" modulus="Q3Vy" exponent="AQAB"/></wopi-discovery>');
+
+		$keys = $this->service->getProofKeys();
+
+		$this->assertNotNull($keys);
+		$this->assertSame('Q3Vy', $keys->modulus);
+		$this->assertSame('AQAB', $keys->exponent);
+		$this->assertSame('T2xk', $keys->oldModulus);
+	}
+
+	public function testGetProofKeysFallsBackToTheCurrentKeyWithoutAnOldOne(): void {
+		$this->withDiscoveryXml('<wopi-discovery><proof-key modulus="Q3Vy" exponent="AQAB"/></wopi-discovery>');
+
+		$this->assertSame('Q3Vy', $this->service->getProofKeys()?->oldModulus);
+	}
+
+	public function testGetProofKeysIsNullWhenTheEditorDoesNotSign(): void {
+		$this->withDiscoveryXml($this->fixture('discovery-onlyoffice.xml'));
+
+		$this->assertNull($this->service->getProofKeys());
+	}
+
+	private const string SIGNING = '<wopi-discovery><proof-key modulus="Q3Vy" exponent="AQAB" oldmodulus="T2xk" oldexponent="AQAB"/></wopi-discovery>';
+	private const string ROTATED = '<wopi-discovery><proof-key modulus="TmV3" exponent="AQAB" oldmodulus="Q3Vy" oldexponent="AQAB"/></wopi-discovery>';
+
+	/** @param list<?string> $documents what successive discovery reads return (null: unavailable) */
+	private function discoveryReturns(array $documents): void {
+		$this->cache->method('get')->willReturnCallback(static function () use (&$documents): ?string {
+			return count($documents) > 1 ? array_shift($documents) : $documents[0];
+		});
+	}
+
+	public function testKnownKeysAreReusedWithoutRereadingDiscoveryForAnHour(): void {
+		$this->discoveryReturns([self::SIGNING, self::ROTATED]);
+		$this->service->getProofKeys();
+
+		$this->now += 3599;
+		$this->assertSame('Q3Vy', $this->service->getProofKeys()?->modulus);
+
+		$this->now += 1;
+		$this->assertSame('TmV3', $this->service->getProofKeys()?->modulus);
+	}
+
+	public function testLastKnownKeysStayInForceWhileDiscoveryIsUnreadable(): void {
+		// Not cached any more, and the editor can't be reached for a fresh copy.
+		$this->discoveryReturns([self::SIGNING, null]);
+		$this->config['wopi_url'] = 'http://eo';
+		$client = $this->createMock(IClient::class);
+		$client->method('get')->willThrowException(new \Exception('connection refused'));
+		$this->clientService->method('newClient')->willReturn($client);
+		$this->service->getProofKeys();
+
+		$this->now += 7200;
+
+		$this->assertSame('Q3Vy', $this->service->getProofKeys()?->modulus);
+	}
+
+	public function testAnEditorThatStopsSigningIsSeenAfterTheNextCheck(): void {
+		$this->discoveryReturns([self::SIGNING, '<wopi-discovery/>']);
+		$this->service->getProofKeys();
+
+		$this->now += 3600;
+
+		$this->assertNull($this->service->getProofKeys());
+	}
+
+	public function testRefreshPicksUpRotatedKeysAtOncePerPeriod(): void {
+		$this->discoveryReturns([self::SIGNING, self::ROTATED]);
+		$this->service->getProofKeys();
+		$this->cache->expects($this->once())->method('remove')->with('discovery');
+
+		$this->assertSame('TmV3', $this->service->refreshProofKeys()?->modulus);
+		$this->now += 60;
+		$this->service->refreshProofKeys();
+	}
+
+	public function testRefreshIsAllowedAgainAfterThePeriod(): void {
+		$this->discoveryReturns([self::SIGNING]);
+		$this->cache->expects($this->exactly(2))->method('remove')->with('discovery');
+
+		$this->service->refreshProofKeys();
+		$this->now += 300;
+		$this->service->refreshProofKeys();
+	}
+
+	public function testResetCacheForgetsTheKeysOfThePreviousEditor(): void {
+		$this->discoveryReturns([self::SIGNING, '<wopi-discovery/>']);
+		$this->service->getProofKeys();
+
+		$this->service->resetCache();
+
+		$this->assertNull($this->service->getProofKeys());
+	}
+}
diff --git a/tests/unit/Service/WopiAccessResolverTest.php b/tests/unit/Service/WopiAccessResolverTest.php
new file mode 100644
index 00000000..8d98d70a
--- /dev/null
+++ b/tests/unit/Service/WopiAccessResolverTest.php
@@ -0,0 +1,153 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Service;
+
+use OCA\Office\Db\Wopi;
+use OCA\Office\Service\WopiAccessResolver;
+use OCP\Constants;
+use OCP\Files\File;
+use OCP\Files\Folder;
+use OCP\Files\IRootFolder;
+use OCP\Files\Node;
+use OCP\Files\NotFoundException;
+use OCP\Share\Exceptions\ShareNotFound;
+use OCP\Share\IManager as IShareManager;
+use OCP\Share\IShare;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+final class WopiAccessResolverTest extends TestCase {
+	private IRootFolder&MockObject $rootFolder;
+	private IShareManager&MockObject $shareManager;
+	private WopiAccessResolver $resolver;
+
+	protected function setUp(): void {
+		$this->rootFolder = $this->createMock(IRootFolder::class);
+		$this->shareManager = $this->createMock(IShareManager::class);
+		$this->resolver = new WopiAccessResolver($this->rootFolder, $this->shareManager);
+	}
+
+	private function file(int $id = 82): File&MockObject {
+		$file = $this->createMock(File::class);
+		$file->method('getId')->willReturn($id);
+		$file->method('getPermissions')->willReturn(Constants::PERMISSION_ALL);
+
+		return $file;
+	}
+
+	private function token(?string $shareToken, ?string $editorUid, bool $canWrite = true, bool $hideDownload = false): Wopi {
+		$wopi = new Wopi();
+		$wopi->setFileid(82);
+		$wopi->setOwnerUid('alice');
+		$wopi->setEditorUid($editorUid);
+		$wopi->setShareToken($shareToken);
+		$wopi->setCanwrite($canWrite);
+		$wopi->setHideDownload($hideDownload);
+
+		return $wopi;
+	}
+
+	private function shareReturns(int $permissions, Node $node, bool $hideDownload = false): void {
+		$share = $this->createMock(IShare::class);
+		$share->method('getPermissions')->willReturn($permissions);
+		$share->method('getNode')->willReturn($node);
+		$share->method('getHideDownload')->willReturn($hideDownload);
+		$this->shareManager->method('getShareByToken')->with('shareTok')->willReturn($share);
+	}
+
+	public function testUserTokenResolvesThroughTheEditorsFolderWithTheTokensRights(): void {
+		$file = $this->file();
+		$folder = $this->createMock(Folder::class);
+		$folder->method('getById')->with(82)->willReturn([$file]);
+		$this->rootFolder->method('getUserFolder')->with('bob')->willReturn($folder);
+		$this->shareManager->expects($this->never())->method('getShareByToken');
+
+		$access = $this->resolver->resolve($this->token(null, 'bob', canWrite: true, hideDownload: true));
+
+		$this->assertSame($file, $access->file);
+		$this->assertTrue($access->canWrite);
+		$this->assertTrue($access->hideDownload);
+	}
+
+	public function testTokenWithNeitherUserNorShareIsRejected(): void {
+		$this->expectException(NotFoundException::class);
+		$this->resolver->resolve($this->token(null, null));
+	}
+
+	public function testShareSessionNeverUsesTheVisitorsOwnFolder(): void {
+		$this->shareReturns(Constants::PERMISSION_READ, $this->file());
+		$this->rootFolder->expects($this->never())->method('getUserFolder');
+
+		$this->resolver->resolve($this->token('shareTok', 'bob'));
+	}
+
+	public function testDeletedOrExpiredShareEndsAccess(): void {
+		$this->shareManager->method('getShareByToken')->willThrowException(new ShareNotFound());
+
+		$this->expectException(NotFoundException::class);
+		$this->resolver->resolve($this->token('shareTok', null));
+	}
+
+	public function testShareThatIsNoLongerReadableEndsAccess(): void {
+		$this->shareReturns(0, $this->file());
+
+		$this->expectException(NotFoundException::class);
+		$this->resolver->resolve($this->token('shareTok', null));
+	}
+
+	public function testShareNarrowedToReadOnlyRevokesWrite(): void {
+		$this->shareReturns(Constants::PERMISSION_READ, $this->file());
+
+		$this->assertFalse($this->resolver->resolve($this->token('shareTok', null, canWrite: true))->canWrite);
+	}
+
+	public function testWritableShareKeepsAReadOnlyTokenReadOnly(): void {
+		$this->shareReturns(Constants::PERMISSION_READ | Constants::PERMISSION_UPDATE, $this->file());
+
+		$this->assertFalse($this->resolver->resolve($this->token('shareTok', null, canWrite: false))->canWrite);
+	}
+
+	public function testWritableShareAllowsWrite(): void {
+		$this->shareReturns(Constants::PERMISSION_READ | Constants::PERMISSION_UPDATE, $this->file());
+
+		$this->assertTrue($this->resolver->resolve($this->token('shareTok', null, canWrite: true))->canWrite);
+	}
+
+	public function testDownloadRestrictionAddedToTheShareApplies(): void {
+		$this->shareReturns(Constants::PERMISSION_READ, $this->file(), hideDownload: true);
+
+		$this->assertTrue($this->resolver->resolve($this->token('shareTok', null, hideDownload: false))->hideDownload);
+	}
+
+	public function testFolderShareResolvesTheFileInsideTheFolder(): void {
+		$file = $this->file();
+		$folder = $this->createMock(Folder::class);
+		$folder->method('getFirstNodeById')->with(82)->willReturn($file);
+		$this->shareReturns(Constants::PERMISSION_READ, $folder);
+
+		$this->assertSame($file, $this->resolver->resolve($this->token('shareTok', null))->file);
+	}
+
+	public function testFolderShareCannotReachAFileOutsideIt(): void {
+		$folder = $this->createMock(Folder::class);
+		$folder->method('getFirstNodeById')->with(82)->willReturn(null);
+		$this->shareReturns(Constants::PERMISSION_READ, $folder);
+
+		$this->expectException(NotFoundException::class);
+		$this->resolver->resolve($this->token('shareTok', null));
+	}
+
+	public function testFileShareOfAnotherFileIsRejected(): void {
+		$this->shareReturns(Constants::PERMISSION_READ, $this->file(99));
+
+		$this->expectException(NotFoundException::class);
+		$this->resolver->resolve($this->token('shareTok', null));
+	}
+}
diff --git a/tests/unit/Service/WopiProofVerifierTest.php b/tests/unit/Service/WopiProofVerifierTest.php
new file mode 100644
index 00000000..1d60fbf9
--- /dev/null
+++ b/tests/unit/Service/WopiProofVerifierTest.php
@@ -0,0 +1,109 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Service;
+
+use OCA\Office\Service\WopiProofKeys;
+use OCA\Office\Service\WopiProofVerifier;
+use OCP\AppFramework\Utility\ITimeFactory;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * The fixture was signed with Euro-Office's own proof code (wopiUtils.js generateProofBuffer
+ * + RSA-SHA256, 2048-bit keys), so these tests check the verifier against what the editor
+ * actually sends rather than against this app's reading of the spec.
+ */
+final class WopiProofVerifierTest extends TestCase {
+	// 2026-10-26T12:00:00Z, the fixture's X-WOPI-TimeStamp.
+	private const int SIGNED_AT = 1793016000;
+
+	/** @var array<string, mixed> */
+	private array $fixture;
+	private WopiProofKeys $keys;
+	private int $now = self::SIGNED_AT;
+	private WopiProofVerifier $verifier;
+
+	protected function setUp(): void {
+		$this->fixture = json_decode((string)file_get_contents(__DIR__ . '/../../fixtures/wopi-proof-euro-office.json'), true);
+		$d = $this->fixture['discovery'];
+		$this->keys = new WopiProofKeys($d['modulus'], $d['exponent'], $d['oldmodulus'], $d['oldexponent']);
+
+		$time = $this->createMock(ITimeFactory::class);
+		$time->method('getTime')->willReturnCallback(fn (): int => $this->now);
+		$this->verifier = new WopiProofVerifier($time);
+	}
+
+	private function isValid(string $proof, string $proofOld = '', ?string $url = null, ?string $token = null, ?string $timestamp = null): bool {
+		return $this->verifier->isValid(
+			$this->keys,
+			$token ?? $this->fixture['accessToken'],
+			$url ?? $this->fixture['url'],
+			$timestamp ?? $this->fixture['timestamp'],
+			$proof,
+			$proofOld,
+		);
+	}
+
+	public function testAcceptsAProofFromTheCurrentKey(): void {
+		$this->assertTrue($this->isValid($this->fixture['proofCurrentKey']));
+	}
+
+	public function testAcceptsAProofFromTheOldKeyDuringRotation(): void {
+		$this->assertTrue($this->isValid($this->fixture['proofOldKey']));
+	}
+
+	public function testAcceptsProofOldFromTheCurrentKeyDuringRotation(): void {
+		$this->assertTrue($this->isValid('', $this->fixture['proofCurrentKey']));
+	}
+
+	public function testRejectsAProofFromAnotherKey(): void {
+		$this->assertFalse($this->isValid($this->fixture['proofOtherKey'], $this->fixture['proofOtherKey']));
+	}
+
+	public function testRejectsAProofForAnotherUrl(): void {
+		$this->assertFalse($this->isValid($this->fixture['proofCurrentKey'], url: str_replace('/82/', '/83/', $this->fixture['url'])));
+	}
+
+	public function testRejectsAProofForAnotherToken(): void {
+		$this->assertFalse($this->isValid($this->fixture['proofCurrentKey'], token: 'another-token'));
+	}
+
+	public function testRejectsAProofForAnotherTimestamp(): void {
+		$this->assertFalse($this->isValid($this->fixture['proofCurrentKey'], timestamp: (string)((int)$this->fixture['timestamp'] + 1)));
+	}
+
+	public function testUrlCaseDoesNotMatterBecauseTheEditorSignsItUppercased(): void {
+		$this->assertTrue($this->isValid($this->fixture['proofCurrentKey'], url: strtoupper($this->fixture['url'])));
+	}
+
+	public function testRejectsGarbageAndMissingProofs(): void {
+		$this->assertFalse($this->isValid('', ''));
+		$this->assertFalse($this->isValid('not base64 !!', ''));
+	}
+
+	public function testRejectsUnusableKeys(): void {
+		$keys = new WopiProofKeys('!!!', 'AQAB', '', '');
+
+		$this->assertFalse($this->verifier->isValid($keys, $this->fixture['accessToken'], $this->fixture['url'], $this->fixture['timestamp'], $this->fixture['proofCurrentKey'], ''));
+	}
+
+	public function testTimestampIsFreshForTwentyMinutes(): void {
+		$this->now = self::SIGNED_AT + 20 * 60;
+		$this->assertTrue($this->verifier->isFresh($this->fixture['timestamp']));
+
+		$this->now = self::SIGNED_AT + 20 * 60 + 1;
+		$this->assertFalse($this->verifier->isFresh($this->fixture['timestamp']));
+	}
+
+	public function testMissingOrMalformedTimestampIsNotFresh(): void {
+		$this->assertFalse($this->verifier->isFresh(''));
+		$this->assertFalse($this->verifier->isFresh('12ab'));
+		$this->assertFalse($this->verifier->isFresh('99999999999999999999'));
+	}
+}
diff --git a/tests/unit/Settings/AdminTest.php b/tests/unit/Settings/AdminTest.php
new file mode 100644
index 00000000..996ab0c2
--- /dev/null
+++ b/tests/unit/Settings/AdminTest.php
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Settings;
+
+use OCA\Office\Service\DiscoveryService;
+use OCA\Office\Service\WopiProofKeys;
+use OCA\Office\Settings\Admin;
+use OCP\IAppConfig;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+final class AdminTest extends TestCase {
+	/** @return array<string, array{bool, bool, string, ?bool}> */
+	public static function callerChecks(): array {
+		return [
+			'unsigned, no allowlist' => [true, false, '', true],
+			'unsigned, allowlist set' => [true, false, '10.0.0.0/24', false],
+			'signed' => [true, true, '', false],
+			'discovery unreachable' => [false, false, '', null],
+		];
+	}
+
+	#[DataProvider('callerChecks')]
+	public function testReportsWhetherWopiCallersGoUnchecked(bool $available, bool $signs, string $allowlist, ?bool $expected): void {
+		$appConfig = $this->createMock(IAppConfig::class);
+		$appConfig->method('getValueString')->willReturnCallback(
+			static fn (string $app, string $key, string $default = ''): string => $key === 'wopi_allowlist' ? $allowlist : $default,
+		);
+		$discovery = $this->createMock(DiscoveryService::class);
+		$discovery->method('isAvailable')->willReturn($available);
+		$discovery->method('getProofKeys')->willReturn($signs ? new WopiProofKeys('Q3Vy', 'AQAB', 'Q3Vy', 'AQAB') : null);
+
+		$params = (new Admin($appConfig, $discovery))->getForm()->getParams();
+
+		$this->assertSame($expected, $params['wopi_caller_unchecked']);
+	}
+}
diff --git a/tests/unit/Support/MemoryCache.php b/tests/unit/Support/MemoryCache.php
new file mode 100644
index 00000000..88fd212a
--- /dev/null
+++ b/tests/unit/Support/MemoryCache.php
@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Office\Tests\Unit\Support;
+
+use OCP\ICache;
+
+/**
+ * An in-memory ICache that behaves like a real memcache; TTLs are ignored.
+ */
+final class MemoryCache implements ICache {
+	/** @var array<string, mixed> */
+	private array $values = [];
+
+	public function get(string $key) {
+		return $this->values[$key] ?? null;
+	}
+
+	public function set(string $key, $value, int $ttl = 0) {
+		$this->values[$key] = $value;
+		return true;
+	}
+
+	public function hasKey(string $key) {
+		return array_key_exists($key, $this->values);
+	}
+
+	public function remove(string $key) {
+		unset($this->values[$key]);
+		return true;
+	}
+
+	public function clear(string $prefix = '') {
+		$this->values = array_filter($this->values, static fn (string $key): bool => !str_starts_with($key, $prefix), ARRAY_FILTER_USE_KEY);
+		return true;
+	}
+
+	public static function isAvailable(): bool {
+		return true;
+	}
+}
diff --git a/tests/unit/TokenManagerTest.php b/tests/unit/TokenManagerTest.php
new file mode 100644
index 00000000..b59292ee
--- /dev/null
+++ b/tests/unit/TokenManagerTest.php
@@ -0,0 +1,286 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Scope note: the plan for this file also asked for "token randomness/length"
+ * and "expiry value sanity" tests. Those don't belong here - TokenManager never
+ * touches token generation or expiry at all. Both are entirely
+ * WopiMapper::generateFileToken()/generateGuestToken()'s responsibility
+ * (ISecureRandom::generate() and TOKEN_TTL live there, not in this class).
+ * With WopiMapper mocked, as the plan itself directs, there is nothing of
+ * theirs left to exercise through TokenManager. See wopi-test-suite-RESULTS.md
+ * Task 5 section.
+ */
+
+namespace OCA\Office\Tests\Unit;
+
+use OCA\Office\Db\Wopi;
+use OCA\Office\Db\WopiMapper;
+use OCA\Office\TokenManager;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\Files\Events\Node\BeforeNodeReadEvent;
+use OCP\Files\File;
+use OCP\Files\Folder;
+use OCP\Files\IRootFolder;
+use OCP\Files\NotPermittedException;
+use OCP\IURLGenerator;
+use OCP\IUser;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+final class TokenManagerTest extends TestCase {
+	private IRootFolder&MockObject $rootFolder;
+	private WopiMapper&MockObject $wopiMapper;
+	private IURLGenerator&MockObject $urlGenerator;
+	private IEventDispatcher&MockObject $eventDispatcher;
+
+	protected function setUp(): void {
+		$this->rootFolder = $this->createMock(IRootFolder::class);
+		$this->wopiMapper = $this->createMock(WopiMapper::class);
+		$this->urlGenerator = $this->createMock(IURLGenerator::class);
+		$this->eventDispatcher = $this->createMock(IEventDispatcher::class);
+	}
+
+	private function manager(?string $userId = 'admin'): TokenManager {
+		return new TokenManager(
+			$this->rootFolder,
+			$this->wopiMapper,
+			$this->urlGenerator,
+			$this->eventDispatcher,
+			$userId,
+		);
+	}
+
+	/** @param array{readable?: bool, updateable?: bool, mtime?: int, owner?: ?IUser} $overrides */
+	private function fileMock(array $overrides = []): File&MockObject {
+		$file = $this->createMock(File::class);
+		$file->method('isReadable')->willReturn($overrides['readable'] ?? true);
+		$file->method('isUpdateable')->willReturn($overrides['updateable'] ?? true);
+		$file->method('getMTime')->willReturn($overrides['mtime'] ?? 1700000000);
+		$file->method('getOwner')->willReturn($overrides['owner'] ?? null);
+		$file->method('getStorage')->willReturn($this->createMock(\OCP\Files\Storage\IStorage::class));
+
+		return $file;
+	}
+
+	/** @param list<File> $otherPaths further nodes of the same file, e.g. received through shares */
+	private function userFolderReturning(?File $file, string $expectedUid = 'admin', array $otherPaths = []): void {
+		$folder = $this->createMock(Folder::class);
+		$folder->method('getFirstNodeById')->willReturn($file);
+		$folder->method('getById')->willReturn($file === null ? [] : [$file, ...$otherPaths]);
+		$this->rootFolder->method('getUserFolder')->with($expectedUid)->willReturn($folder);
+	}
+
+	private function nodeReceivedThroughShare(?bool $download): File&MockObject {
+		$attributes = $this->createMock(\OCP\Share\IAttributes::class);
+		$attributes->method('getAttribute')->willReturnCallback(
+			static fn (string $scope, string $key): mixed => $scope === 'permissions' && $key === 'download' ? $download : null,
+		);
+		$share = $this->createMock(\OCP\Share\IShare::class);
+		$share->method('getAttributes')->willReturn($attributes);
+
+		$storage = $this->createMock(\OCP\Files\Storage\ISharedStorage::class);
+		$storage->method('instanceOfStorage')->willReturnCallback(static fn (string $class): bool => $class === \OCP\Files\Storage\ISharedStorage::class);
+		$storage->method('getShare')->willReturn($share);
+
+		$node = $this->createMock(File::class);
+		$node->method('getStorage')->willReturn($storage);
+
+		return $node;
+	}
+
+	/** @return array<string, array{list<?bool>, bool}> */
+	public static function downloadAttributes(): array {
+		return [
+			'own file only' => [[], false],
+			'received share allows download' => [[true], false],
+			'received share without the attribute' => [[null], false],
+			'received share forbids download' => [[false], true],
+			'one of two paths forbids download' => [[true, false], true],
+		];
+	}
+
+	/** @param list<?bool> $shares */
+	#[\PHPUnit\Framework\Attributes\DataProvider('downloadAttributes')]
+	public function testGenerateTokenHidesDownloadWhenAShareForbidsIt(array $shares, bool $expected): void {
+		$this->userFolderReturning($this->fileMock(), 'admin', array_map(fn (?bool $d): File => $this->nodeReceivedThroughShare($d), $shares));
+
+		$this->wopiMapper->expects($this->once())
+			->method('generateFileToken')
+			->with($this->anything(), $this->anything(), $this->anything(), $this->anything(), $this->anything(), $expected, $this->anything())
+			->willReturn(new Wopi());
+
+		$this->manager()->generateToken(82);
+	}
+
+	// --- generateToken() (authenticated user) ---
+
+	public function testGenerateTokenCapturesServerHostFromUrlGenerator(): void {
+		$this->userFolderReturning($this->fileMock());
+		$this->urlGenerator->method('getAbsoluteURL')->with('/')->willReturn('https://nc.example.com/');
+
+		$this->wopiMapper->expects($this->once())
+			->method('generateFileToken')
+			->with($this->anything(), $this->anything(), $this->anything(), $this->anything(), $this->anything(), $this->anything(), 'https://nc.example.com/')
+			->willReturn(new Wopi());
+
+		$this->manager()->generateToken(82);
+	}
+
+	public function testGenerateTokenPassesFileIdOwnerEditorVersionAndCanWrite(): void {
+		$owner = $this->createMock(IUser::class);
+		$owner->method('getUID')->willReturn('owner-uid');
+		$this->userFolderReturning($this->fileMock(['owner' => $owner, 'updateable' => true, 'mtime' => 1700000000]));
+
+		$this->wopiMapper->expects($this->once())
+			->method('generateFileToken')
+			->with(82, 'owner-uid', 'admin', '1700000000', true, false, $this->anything())
+			->willReturn(new Wopi());
+
+		$this->manager('admin')->generateToken(82);
+	}
+
+	public function testGenerateTokenCanWriteFalseWhenFileNotUpdateable(): void {
+		$this->userFolderReturning($this->fileMock(['updateable' => false]));
+
+		$this->wopiMapper->expects($this->once())
+			->method('generateFileToken')
+			->with($this->anything(), $this->anything(), $this->anything(), $this->anything(), false, $this->anything(), $this->anything())
+			->willReturn(new Wopi());
+
+		$this->manager()->generateToken(82);
+	}
+
+	public function testGenerateTokenFallsBackToUserIdWhenFileHasNoOwner(): void {
+		$this->userFolderReturning($this->fileMock(['owner' => null]));
+
+		$this->wopiMapper->expects($this->once())
+			->method('generateFileToken')
+			->with($this->anything(), 'admin', $this->anything(), $this->anything(), $this->anything(), $this->anything())
+			->willReturn(new Wopi());
+
+		$this->manager('admin')->generateToken(82);
+	}
+
+	public function testGenerateTokenDispatchesBeforeNodeReadEvent(): void {
+		$this->userFolderReturning($this->fileMock());
+		$this->wopiMapper->method('generateFileToken')->willReturn(new Wopi());
+
+		$this->eventDispatcher->expects($this->once())
+			->method('dispatchTyped')
+			->with($this->isInstanceOf(BeforeNodeReadEvent::class));
+
+		$this->manager()->generateToken(82);
+	}
+
+	public function testGenerateTokenThrowsWhenFileNotReadable(): void {
+		$this->userFolderReturning($this->fileMock(['readable' => false]));
+
+		$this->expectException(NotPermittedException::class);
+		$this->manager()->generateToken(82);
+	}
+
+	public function testGenerateTokenThrowsWhenFileNotFound(): void {
+		$this->userFolderReturning(null);
+
+		$this->expectException(NotPermittedException::class);
+		$this->manager()->generateToken(82);
+	}
+
+	public function testGenerateTokenReturnsWopiEntityFromMapper(): void {
+		$this->userFolderReturning($this->fileMock());
+		$expected = new Wopi();
+		$this->wopiMapper->method('generateFileToken')->willReturn($expected);
+
+		$result = $this->manager()->generateToken(82);
+
+		$this->assertSame($expected, $result);
+	}
+
+	// --- generateGuestToken() (share-link guest) ---
+
+	public function testGenerateGuestTokenPropagatesGuestNameCanWriteAndHideDownload(): void {
+		$this->userFolderReturning($this->fileMock(), 'owner-uid');
+
+		$this->wopiMapper->expects($this->once())
+			->method('generateGuestToken')
+			->with(82, 'owner-uid', 'shareTok', null, 'Guest Name', $this->anything(), true, true, $this->anything())
+			->willReturn(new Wopi());
+
+		$this->manager()->generateGuestToken(82, 'owner-uid', 'shareTok', null, 'Guest Name', true, true);
+	}
+
+	public function testGenerateGuestTokenBindsTheShareAndTheLoggedInVisitor(): void {
+		$this->userFolderReturning($this->fileMock(), 'owner-uid');
+
+		$this->wopiMapper->expects($this->once())
+			->method('generateGuestToken')
+			->with(82, 'owner-uid', 'shareTok', 'bob', 'Bob', $this->anything(), false, false, $this->anything())
+			->willReturn(new Wopi());
+
+		$this->manager()->generateGuestToken(82, 'owner-uid', 'shareTok', 'bob', 'Bob', false, false);
+	}
+
+	public function testGenerateGuestTokenResolvesFileViaOwnerFolderNotCurrentUser(): void {
+		$folder = $this->createMock(Folder::class);
+		$folder->method('getFirstNodeById')->willReturn($this->fileMock());
+		$this->rootFolder->expects($this->once())->method('getUserFolder')->with('owner-uid')->willReturn($folder);
+		$this->wopiMapper->method('generateGuestToken')->willReturn(new Wopi());
+
+		// TokenManager's own userId ('current-user') must play no part in a guest
+		// token - the file is resolved via the file OWNER's folder, since guests
+		// have no folder of their own.
+		$this->manager('current-user')->generateGuestToken(82, 'owner-uid', 'shareTok', null, 'Guest', true, false);
+	}
+
+	public function testGenerateGuestTokenCapturesServerHostFromUrlGenerator(): void {
+		$this->userFolderReturning($this->fileMock(), 'owner-uid');
+		$this->urlGenerator->method('getAbsoluteURL')->with('/')->willReturn('https://nc.example.com/');
+
+		$this->wopiMapper->expects($this->once())
+			->method('generateGuestToken')
+			->with($this->anything(), $this->anything(), $this->anything(), $this->anything(), $this->anything(), $this->anything(), $this->anything(), $this->anything(), 'https://nc.example.com/')
+			->willReturn(new Wopi());
+
+		$this->manager()->generateGuestToken(82, 'owner-uid', 'shareTok', null, 'Guest', true, false);
+	}
+
+	public function testGenerateGuestTokenDispatchesBeforeNodeReadEvent(): void {
+		$this->userFolderReturning($this->fileMock(), 'owner-uid');
+		$this->wopiMapper->method('generateGuestToken')->willReturn(new Wopi());
+
+		$this->eventDispatcher->expects($this->once())
+			->method('dispatchTyped')
+			->with($this->isInstanceOf(BeforeNodeReadEvent::class));
+
+		$this->manager()->generateGuestToken(82, 'owner-uid', 'shareTok', null, 'Guest', true, false);
+	}
+
+	public function testGenerateGuestTokenThrowsWhenFileNotReadable(): void {
+		$this->userFolderReturning($this->fileMock(['readable' => false]), 'owner-uid');
+
+		$this->expectException(NotPermittedException::class);
+		$this->manager()->generateGuestToken(82, 'owner-uid', 'shareTok', null, 'Guest', true, false);
+	}
+
+	public function testGenerateGuestTokenThrowsWhenFileNotFound(): void {
+		$this->userFolderReturning(null, 'owner-uid');
+
+		$this->expectException(NotPermittedException::class);
+		$this->manager()->generateGuestToken(82, 'owner-uid', 'shareTok', null, 'Guest', true, false);
+	}
+
+	public function testGenerateGuestTokenReturnsWopiEntityFromMapper(): void {
+		$this->userFolderReturning($this->fileMock(), 'owner-uid');
+		$expected = new Wopi();
+		$this->wopiMapper->method('generateGuestToken')->willReturn($expected);
+
+		$result = $this->manager()->generateGuestToken(82, 'owner-uid', 'shareTok', null, 'Guest', true, false);
+
+		$this->assertSame($expected, $result);
+	}
+}
diff --git a/tests/wopi-spec-matrix.php b/tests/wopi-spec-matrix.php
new file mode 100644
index 00000000..753efaf5
--- /dev/null
+++ b/tests/wopi-spec-matrix.php
@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * WOPI host coverage matrix. Not a test file - read by tests/spec-coverage.php.
+ *
+ * status: tested | implemented-untested | not-implemented | n-a
+ *   - tested: a named, existing automated test covers this row. The 'test' field
+ *     must point at a real test method or this row is lying.
+ *   - implemented-untested: the behavior exists in lib/ (manually verified via curl
+ *     in WOPI_TEST_RESULTS.md, 2026-05-23, or confirmed by direct code reading) but
+ *     no automated test covers it yet.
+ *   - not-implemented: this app does not implement this MS-WOPI operation/feature at all.
+ *   - n-a: not a WOPI-spec requirement (app-specific plumbing seeded from
+ *     WOPI_TEST_RESULTS.md anyway, per plan).
+ *
+ * Seeded from WOPI_TEST_RESULTS.md (21 numbered rows + 2 unnumbered checks, verified
+ * count - see wopi-test-suite.md Environment facts) plus direct reading of
+ * lib/Controller/WopiController.php, lib/Service/DiscoveryService.php,
+ * lib/BackgroundJob/CleanupJob.php for code paths the manual curl pass didn't hit.
+ */
+
+return [
+	// --- CheckFileInfo ---
+	['id' => 'CFI-200-metadata', 'op' => 'CheckFileInfo', 'requirement' => 'GET /wopi/files/{id} with a valid token returns 200 + metadata JSON', 'spec' => 'MS-WOPI CheckFileInfo', 'status' => 'tested', 'test' => 'integration/WopiProtocolTest::testCheckFileInfoReturnsMetadataForValidToken', 'notes' => 'WOPI_TEST_RESULTS.md row 1'],
+	['id' => 'CFI-401-expired-token', 'op' => 'CheckFileInfo', 'requirement' => 'CheckFileInfo with an expired token returns 401', 'spec' => 'MS-WOPI CheckFileInfo', 'status' => 'tested', 'test' => 'integration/CleanupJobTest::testCheckFileInfoReturns401ForExpiredToken', 'notes' => 'WOPI_TEST_RESULTS.md row 6 (combined 401/403, tested via mapper only, not HTTP-level)'],
+	['id' => 'CFI-403-unknown-token', 'op' => 'CheckFileInfo', 'requirement' => 'CheckFileInfo with an unknown token returns 403', 'spec' => 'MS-WOPI CheckFileInfo', 'status' => 'tested', 'test' => 'integration/WopiProtocolTest::testCheckFileInfoReturns403ForUnknownToken', 'notes' => 'WOPI_TEST_RESULTS.md row 6 (combined 401/403, tested via mapper only, not HTTP-level)'],
+	['id' => 'CFI-403-fileid-mismatch', 'op' => 'CheckFileInfo', 'requirement' => 'CheckFileInfo returns 403 when the token\'s fileId does not match the requested {fileId}', 'spec' => 'MS-WOPI CheckFileInfo', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived, WopiController::checkFileInfo'],
+	['id' => 'CFI-404-file-not-found', 'op' => 'CheckFileInfo', 'requirement' => 'CheckFileInfo returns 404 when the underlying file cannot be resolved', 'spec' => 'MS-WOPI CheckFileInfo', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'CFI-500-unexpected-error', 'op' => 'CheckFileInfo', 'requirement' => 'CheckFileInfo returns 500 on unexpected exceptions', 'spec' => 'MS-WOPI CheckFileInfo', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'CFI-guest-display-name', 'op' => 'CheckFileInfo', 'requirement' => 'Guest tokens show a display name and IsAnonymousUser=true', 'spec' => 'MS-WOPI CheckFileInfo', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'CFI-canwrite-false-on-foreign-lock', 'op' => 'CheckFileInfo', 'requirement' => 'UserCanWrite is forced false when an ILockManager file lock is held by a different owner', 'spec' => 'MS-WOPI CheckFileInfo', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'CFI-postmessageorigin', 'op' => 'CheckFileInfo', 'requirement' => 'PostMessageOrigin reflects the serverHost captured at token creation', 'spec' => 'MS-WOPI CheckFileInfo', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'CFI-hidedownload-flags', 'op' => 'CheckFileInfo', 'requirement' => 'HideExportOption/DisablePrint/DisableExport all follow hideDownload', 'spec' => 'MS-WOPI CheckFileInfo', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'commit d7ff5c6'],
+
+	// --- GetFile ---
+	['id' => 'GF-200-binary-body', 'op' => 'GetFile', 'requirement' => 'GET /wopi/files/{id}/contents with a valid token returns 200 + binary body', 'spec' => 'MS-WOPI GetFile', 'status' => 'tested', 'test' => 'integration/WopiProtocolTest::testGetFileReturnsBinaryBody', 'notes' => 'WOPI_TEST_RESULTS.md row 2'],
+	['id' => 'GF-206-range', 'op' => 'GetFile', 'requirement' => 'Range: bytes=0-99 returns 206 with correct Content-Range', 'spec' => 'MS-WOPI GetFile', 'status' => 'tested', 'test' => 'integration/WopiProtocolTest::testGetFileRangeReturnsPartialContent', 'notes' => 'WOPI_TEST_RESULTS.md row 3'],
+	['id' => 'GF-416-range-beyond-eof', 'op' => 'GetFile', 'requirement' => 'A Range beyond EOF returns 416 + Content-Range: bytes */{size}', 'spec' => 'MS-WOPI GetFile', 'status' => 'tested', 'test' => 'integration/WopiProtocolTest::testGetFileRangeBeyondEofReturns416', 'notes' => 'WOPI_TEST_RESULTS.md row 4'],
+	['id' => 'GF-206-range-open-ended', 'op' => 'GetFile', 'requirement' => 'Range: bytes=N- (no explicit end) returns 206 through EOF', 'spec' => 'MS-WOPI GetFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'GF-401-expired-token', 'op' => 'GetFile', 'requirement' => 'GetFile with an expired token returns 401', 'spec' => 'MS-WOPI GetFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'GF-403-unknown-token', 'op' => 'GetFile', 'requirement' => 'GetFile with an unknown token returns 403', 'spec' => 'MS-WOPI GetFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'GF-403-fileid-mismatch', 'op' => 'GetFile', 'requirement' => 'GetFile returns 403 when the token\'s fileId does not match {fileId}', 'spec' => 'MS-WOPI GetFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'GF-404-file-not-found', 'op' => 'GetFile', 'requirement' => 'GetFile returns 404 when the underlying file cannot be resolved', 'spec' => 'MS-WOPI GetFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'GF-empty-file-200', 'op' => 'GetFile', 'requirement' => 'GetFile on a zero-byte file returns 200 with an empty body, skipping range handling', 'spec' => 'MS-WOPI GetFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+
+	// --- PutFile ---
+	['id' => 'PF-200-with-correct-lock', 'op' => 'PutFile', 'requirement' => 'PutFile with the correct X-WOPI-Lock returns 200 + LastModifiedTime', 'spec' => 'MS-WOPI PutFile', 'status' => 'tested', 'test' => 'integration/WopiProtocolTest::testPutFileWithCorrectLockSucceeds', 'notes' => 'WOPI_TEST_RESULTS.md row 15'],
+	['id' => 'PF-409-wrong-lock', 'op' => 'PutFile', 'requirement' => 'PutFile without the matching X-WOPI-Lock on a locked file returns 409 + X-WOPI-Lock + X-WOPI-LockFailureReason', 'spec' => 'MS-WOPI PutFile', 'status' => 'tested', 'test' => 'integration/WopiProtocolTest::testPutFileWithoutMatchingLockReturns409', 'notes' => 'WOPI_TEST_RESULTS.md row 14'],
+	['id' => 'PF-409-timestamp-mismatch', 'op' => 'PutFile', 'requirement' => 'PutFile with a stale X-COOL-WOPI-Timestamp returns 409 + COOLStatusCode 1010; a stale X-LOOL-WOPI-Timestamp is written and logged', 'spec' => 'Collabora/Euro-Office WOPI extension (as richdocuments)', 'status' => 'tested', 'test' => 'integration/WopiProtocolTest::testPutFileWithStaleTimestampReturns409', 'notes' => 'The integration test covers the Collabora 409; the Euro-Office write-through and warning are unit-tested (WopiControllerLockTest). Euro-Office has no COOLStatusCode handling and would fail every later save after a 409. X-WOPI-ItemVersion is not a PutFile request header in MS-WOPI and no editor sends it'],
+	['id' => 'PF-200-empty-file-no-lock-required', 'op' => 'PutFile', 'requirement' => 'PutFile on an empty file with no lock held returns 200', 'spec' => 'MS-WOPI PutFile §3.3.5.3', 'status' => 'tested', 'test' => 'integration/WopiProtocolTest::testPutFileOnEmptyFileWithNoLockSucceeds', 'notes' => 'RESOLVED (was flagged as possibly stale in Task 3): WOPI_TEST_RESULTS.md row 5 predates the H-3 lock-required fix (commit 71e4f08) by 2 days. Verified live in Task 6: row 5 only holds for an EMPTY file - a non-empty file with no lock now returns 409 (see PF-409-lock-required-for-nonempty-save), confirmed by both a live curl probe and testPutFileOnNonEmptyFileWithNoLockReturns409.'],
+	['id' => 'PF-409-lock-required-for-nonempty-save', 'op' => 'PutFile', 'requirement' => 'PutFile on a non-empty file with no active lock returns 409 (a lock is required before saving non-empty content)', 'spec' => 'MS-WOPI PutFile §3.3.5.3', 'status' => 'tested', 'test' => 'integration/WopiProtocolTest::testPutFileOnNonEmptyFileWithNoLockReturns409', 'notes' => 'H-3 fix, commit 71e4f08'],
+	['id' => 'PF-403-readonly-token', 'op' => 'PutFile', 'requirement' => 'PutFile with a read-only (canwrite=false) token returns 403', 'spec' => 'MS-WOPI PutFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'PF-403-fileid-mismatch', 'op' => 'PutFile', 'requirement' => 'PutFile returns 403 when the token\'s fileId does not match {fileId}', 'spec' => 'MS-WOPI PutFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'PF-401-expired-token', 'op' => 'PutFile', 'requirement' => 'PutFile with an expired token returns 401', 'spec' => 'MS-WOPI PutFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'PF-403-unknown-token', 'op' => 'PutFile', 'requirement' => 'PutFile with an unknown token returns 403', 'spec' => 'MS-WOPI PutFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'PF-404-file-not-found', 'op' => 'PutFile', 'requirement' => 'PutFile returns 404 when the underlying file cannot be resolved', 'spec' => 'MS-WOPI PutFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'PF-507-insufficient-storage', 'op' => 'PutFile', 'requirement' => 'PutFile returns 507 when Content-Length exceeds available free space', 'spec' => 'MS-WOPI PutFile', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived'],
+	['id' => 'PF-fclose-guard', 'op' => 'PutFile', 'requirement' => 'fclose() on php://input is guarded with is_resource() since putContent() may close it internally', 'spec' => 'N/A - regression guard', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'NC35 compatibility fix, WOPI_TEST_RESULTS.md Compatibility Fixes table'],
+
+	// --- Lock-operation dispatch (executeOperation) ---
+	['id' => 'EXECOP-403-readonly-all-overrides', 'op' => 'Lock dispatch', 'requirement' => 'Any X-WOPI-Override on a read-only (canwrite=false) token returns 403 before dispatch, for all five overrides', 'spec' => 'MS-WOPI Lock/Unlock/RefreshLock/GetLock/RenameFile', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testAllOverridesReturn403WhenTokenCannotWrite', 'notes' => 'security fix 51e4fc5'],
+	['id' => 'EXECOP-501-unknown-override', 'op' => 'Lock dispatch', 'requirement' => 'An unrecognized X-WOPI-Override returns 501 "Unsupported WOPI operation"', 'spec' => 'MS-WOPI', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testUnknownOverrideReturns501', 'notes' => 'code-derived'],
+	['id' => 'EXECOP-403-fileid-mismatch', 'op' => 'Lock dispatch', 'requirement' => 'executeOperation returns 403 when the token\'s fileId does not match {fileId}', 'spec' => 'MS-WOPI', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testExecuteOperationReturns403WhenFileIdMismatch', 'notes' => 'code-derived'],
+	['id' => 'EXECOP-401-expired-token', 'op' => 'Lock dispatch', 'requirement' => 'executeOperation with an expired token returns 401', 'spec' => 'MS-WOPI', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testExecuteOperationReturns401WhenTokenExpired', 'notes' => 'code-derived'],
+	['id' => 'EXECOP-403-unknown-token', 'op' => 'Lock dispatch', 'requirement' => 'executeOperation with an unknown token returns 403', 'spec' => 'MS-WOPI', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testExecuteOperationReturns403WhenTokenUnknown', 'notes' => 'code-derived'],
+
+	// --- LOCK ---
+	['id' => 'LOCK-200-new', 'op' => 'Lock', 'requirement' => 'LOCK on an unlocked file returns 200', 'spec' => 'MS-WOPI Lock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testLockFreshReturns200', 'notes' => 'WOPI_TEST_RESULTS.md row 7'],
+	['id' => 'LOCK-400-empty-lockid', 'op' => 'Lock', 'requirement' => 'LOCK with an empty X-WOPI-Lock header returns 400', 'spec' => 'MS-WOPI Lock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testLockEmptyIdReturns400', 'notes' => 'code-derived'],
+	['id' => 'LOCK-200-relock-same-id-idempotent', 'op' => 'Lock', 'requirement' => 'LOCK with the same lock ID as the existing lock is idempotent (200), refreshing the TTL', 'spec' => 'MS-WOPI Lock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testLockSameIdIsIdempotent', 'notes' => 'WOPI_TEST_RESULTS.md row 10'],
+	['id' => 'LOCK-409-different-id', 'op' => 'Lock', 'requirement' => 'LOCK with a different lock ID on an already-locked file returns 409 + X-WOPI-Lock + X-WOPI-LockFailureReason', 'spec' => 'MS-WOPI Lock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testLockDifferentIdReturns409WithBothHeaders', 'notes' => 'WOPI_TEST_RESULTS.md row 9'],
+	['id' => 'LOCK-200-unlockandrelock-valid', 'op' => 'Lock (UnlockAndRelock)', 'requirement' => 'LOCK + X-WOPI-OldLock matching the current lock replaces it with the new lock ID, 200', 'spec' => 'MS-WOPI UnlockAndRelock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testUnlockAndRelockValidReturns200', 'notes' => 'WOPI_TEST_RESULTS.md row 17'],
+	['id' => 'LOCK-409-unlockandrelock-wrong-old', 'op' => 'Lock (UnlockAndRelock)', 'requirement' => 'LOCK + X-WOPI-OldLock not matching the current lock returns 409 + current lock + X-WOPI-LockFailureReason', 'spec' => 'MS-WOPI UnlockAndRelock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testUnlockAndRelockWrongOldReturns409', 'notes' => 'WOPI_TEST_RESULTS.md row 18'],
+	['id' => 'LOCK-409-unlockandrelock-no-existing-lock', 'op' => 'Lock (UnlockAndRelock)', 'requirement' => 'LOCK + X-WOPI-OldLock when no lock currently exists returns 409', 'spec' => 'MS-WOPI UnlockAndRelock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testUnlockAndRelockWithNoExistingLockReturns409', 'notes' => 'code-derived'],
+	['id' => 'LOCK-expired-treated-as-absent', 'op' => 'Lock', 'requirement' => 'An expired existing lock is treated as absent, so a fresh LOCK succeeds (200) instead of 409', 'spec' => 'MS-WOPI Lock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testExpiredExistingLockTreatedAsAbsentOnLock', 'notes' => 'code-derived'],
+
+	// --- UNLOCK ---
+	['id' => 'UNLOCK-200', 'op' => 'Unlock', 'requirement' => 'UNLOCK with the matching lock ID returns 200', 'spec' => 'MS-WOPI Unlock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testUnlockOkReturns200', 'notes' => 'WOPI_TEST_RESULTS.md row 12'],
+	['id' => 'UNLOCK-400-empty-lockid', 'op' => 'Unlock', 'requirement' => 'UNLOCK with an empty X-WOPI-Lock header returns 400', 'spec' => 'MS-WOPI Unlock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testUnlockEmptyIdReturns400', 'notes' => 'code-derived'],
+	['id' => 'UNLOCK-409-wrong-id', 'op' => 'Unlock', 'requirement' => 'UNLOCK with a non-matching lock ID returns 409 + current lock + X-WOPI-LockFailureReason', 'spec' => 'MS-WOPI Unlock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testUnlockWrongIdReturns409', 'notes' => 'code-derived'],
+	['id' => 'UNLOCK-409-no-existing-lock', 'op' => 'Unlock', 'requirement' => 'UNLOCK when no lock currently exists returns 409 with an empty X-WOPI-Lock', 'spec' => 'MS-WOPI Unlock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testUnlockWithNoExistingLockReturns409', 'notes' => 'code-derived'],
+
+	// --- REFRESH_LOCK ---
+	['id' => 'REFRESH-200', 'op' => 'RefreshLock', 'requirement' => 'REFRESH_LOCK with the matching lock ID returns 200, extending the TTL', 'spec' => 'MS-WOPI RefreshLock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRefreshLockOkReturns200', 'notes' => 'WOPI_TEST_RESULTS.md row 11'],
+	['id' => 'REFRESH-400-empty-lockid', 'op' => 'RefreshLock', 'requirement' => 'REFRESH_LOCK with an empty X-WOPI-Lock header returns 400', 'spec' => 'MS-WOPI RefreshLock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRefreshLockEmptyIdReturns400', 'notes' => 'code-derived'],
+	['id' => 'REFRESH-409-mismatch', 'op' => 'RefreshLock', 'requirement' => 'REFRESH_LOCK with a non-matching lock ID returns 409 + current lock + X-WOPI-LockFailureReason', 'spec' => 'MS-WOPI RefreshLock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRefreshLockMismatchReturns409', 'notes' => 'code-derived'],
+
+	// --- GET_LOCK ---
+	['id' => 'GETLOCK-200-with-lock', 'op' => 'GetLock', 'requirement' => 'GET_LOCK on a locked file returns 200 + X-WOPI-Lock: <id>', 'spec' => 'MS-WOPI GetLock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testGetLockWithLockReturnsLockHeader', 'notes' => 'WOPI_TEST_RESULTS.md row 8'],
+	['id' => 'GETLOCK-200-empty-when-unlocked', 'op' => 'GetLock', 'requirement' => 'GET_LOCK on an unlocked file returns 200 + X-WOPI-Lock: "" (empty, per spec, not 404/409)', 'spec' => 'MS-WOPI GetLock', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testGetLockWithoutLockReturnsEmptyHeader', 'notes' => 'WOPI_TEST_RESULTS.md row 13'],
+
+	// --- RenameFile ---
+	['id' => 'RENAME-200-success', 'op' => 'RenameFile', 'requirement' => 'RENAME_FILE with a valid, non-colliding name returns 200 + Name', 'spec' => 'MS-WOPI RenameFile', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRenameFileSuccessReturns200WithName', 'notes' => 'code-derived; zero coverage in WOPI_TEST_RESULTS.md, added explicitly for Task 4'],
+	['id' => 'RENAME-403-guest', 'op' => 'RenameFile', 'requirement' => 'RENAME_FILE from a guest token returns 403', 'spec' => 'MS-WOPI RenameFile', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRenameFileGuestReturns403', 'notes' => 'code-derived'],
+	['id' => 'RENAME-400-empty-requested-name', 'op' => 'RenameFile', 'requirement' => 'RENAME_FILE with an empty X-WOPI-RequestedName returns 400', 'spec' => 'MS-WOPI RenameFile', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRenameFileEmptyRequestedNameReturns400', 'notes' => 'code-derived'],
+	['id' => 'RENAME-400-path-traversal-slash-or-null', 'op' => 'RenameFile', 'requirement' => 'A UTF-7-decoded name containing "/" or a null byte is rejected with 400 + X-WOPI-InvalidFileNameError', 'spec' => 'MS-WOPI RenameFile', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRenameFileRejectsPathTraversalSlashOrNullByte', 'notes' => 'C-1 path-traversal fix, commit 71e4f08'],
+	['id' => 'RENAME-backslash-not-rejected-by-basename-guard', 'op' => 'RenameFile', 'requirement' => 'A UTF-7-decoded name containing "\\" (e.g. "..\\..\\evil") is rejected with 400 + X-WOPI-InvalidFileNameError, same as "/" and null bytes', 'spec' => 'MS-WOPI RenameFile', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRenameFileRejectsBackslashTraversal', 'notes' => 'FIXED (validator-authorized follow-up, wopi-test-suite-FEEDBACK.md Task B): basename() only treats "/" as a separator on non-Windows PHP, so a backslash-based name used to slip past the guard. WopiController::handleRenameFile() now checks str_contains($newBaseName, \'\\\\\') explicitly alongside the slash/null-byte checks.'],
+	['id' => 'RENAME-400-name-collision', 'op' => 'RenameFile', 'requirement' => 'A requested name that already exists in the same folder returns 400 + X-WOPI-InvalidFileNameError', 'spec' => 'MS-WOPI RenameFile', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRenameFileNameCollisionReturns400', 'notes' => 'code-derived'],
+	['id' => 'RENAME-409-lock-mismatch', 'op' => 'RenameFile', 'requirement' => 'RENAME_FILE on a locked file with a non-matching X-WOPI-Lock returns 409', 'spec' => 'MS-WOPI RenameFile', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRenameFileLockMismatchReturns409', 'notes' => 'code-derived'],
+	['id' => 'RENAME-404-file-not-found', 'op' => 'RenameFile', 'requirement' => 'RENAME_FILE returns 404 when the underlying file cannot be resolved', 'spec' => 'MS-WOPI RenameFile', 'status' => 'tested', 'test' => 'unit/Controller/WopiControllerLockTest::testRenameFileFileNotFoundReturns404', 'notes' => 'code-derived'],
+
+	// --- Admin Settings (app-specific, seeded from WOPI_TEST_RESULTS.md anyway) ---
+	['id' => 'SETTINGS-200-get-admin', 'op' => 'Admin Settings', 'requirement' => 'GET admin settings returns 200 + wopi_url for an authenticated admin', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/AdminSettingsTest::testGetAdminSettingsReturnsConfigForAdmin', 'notes' => 'WOPI_TEST_RESULTS.md row 19'],
+	['id' => 'SETTINGS-400-invalid-scheme', 'op' => 'Admin Settings', 'requirement' => 'POST admin settings with an invalid URL scheme (e.g. file://) returns 400', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/AdminSettingsTest::testPostAdminSettingsRejectsInvalidScheme', 'notes' => 'WOPI_TEST_RESULTS.md row 20'],
+	['id' => 'SETTINGS-post-valid-resets-discovery-cache', 'op' => 'Admin Settings', 'requirement' => 'Saving valid admin settings calls DiscoveryService::resetCache() so a changed wopi_url is not masked by the cached discovery document', 'spec' => 'N/A - app-specific', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'code-derived, SettingsController.php:73; DiscoveryService::resetCache() itself has a passing unit test (DiscoveryServiceTest::testResetCacheRemovesCacheKey) but the controller call site does not'],
+
+	// --- EditorController (app-specific) ---
+	['id' => 'EDITOR-200-open-url', 'op' => 'EditorController', 'requirement' => 'GET /apps/office/open?fileId={id} for an authenticated session returns 200 + editorUrl containing wopisrc and access_token', 'spec' => 'N/A - app-specific', 'status' => 'implemented-untested', 'test' => null, 'notes' => 'WOPI_TEST_RESULTS.md row 21 - NOT reproducible in this environment (verified live in Task 6): EO currently advertises zero editor actions, so getUrlSrc() always returns null and /open always answers 415, never 200. See integration/EditorControllerTest.php docblock. Only the 401/404 branches are integration-tested here (testOpenReturns401WithoutAuth, testOpenReturns404ForNonexistentFile); the 415-given-current-EO-state branch is tested by testOpenReturns415GivenEosCurrentZeroActionDiscovery. The 200 happy path is covered at the unit level instead via DiscoveryServiceTest fixtures.'],
+	['id' => 'EDITOR-401-no-auth', 'op' => 'EditorController', 'requirement' => 'GET /open without authentication returns 401', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/EditorControllerTest::testOpenReturns401WithoutAuth', 'notes' => 'code-derived'],
+	['id' => 'EDITOR-404-file-not-found', 'op' => 'EditorController', 'requirement' => 'GET /open?fileId={id} for a nonexistent file returns 404', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/EditorControllerTest::testOpenReturns404ForNonexistentFile', 'notes' => 'code-derived'],
+
+	// --- Share/guest token flow (ShareController + TokenManager::generateGuestToken) ---
+	['id' => 'SHARE-404-unknown-token', 'op' => 'ShareController', 'requirement' => 'GET /open/share/{token} with an unknown share token returns 404', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/ShareGuestTokenTest::testOpenShareReturns404ForUnknownToken', 'notes' => 'code-derived'],
+	['id' => 'SHARE-guest-proceeds-without-password', 'op' => 'ShareController', 'requirement' => 'An unauthenticated guest visiting a share link that has NO password proceeds past the password guard (does not get redirected to the generic share page)', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/ShareGuestTokenTest::testOpenShareLetsUnauthenticatedGuestProceedWithoutPassword', 'notes' => 'FIXED (was SHARE-guest-blocked-by-password-check-bug): ShareController::openShare() used to guard with `$share->getPassword() !== \'\'`. IShare::getPassword() returns string|null and is null (not \'\') for a passwordless share, and `null !== \'\'` is true in PHP, so the guard fired for password-LESS shares too - any unauthenticated guest on a share that was never password-protected got redirected to the generic NC share page (303) instead of ever reaching the editor, and it silently masked every branch after it for unauthenticated requests too (see SHARE-403-unreadable-share). Fixed in ShareController.php:79 to treat null and \'\' both as "no password". Observable result in this environment is 415 (EO advertises zero editor actions), not the historical 200 - see EDITOR-200-open-url.'],
+	['id' => 'SHARE-logged-in-without-own-access-uses-link', 'op' => 'ShareController', 'requirement' => 'A logged-in visitor who cannot reach the file through their own folder gets the share-scoped token (not 403), named after them, with the link\'s download restriction', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/ShareGuestTokenTest::testOpenShareLetsLoggedInUserWithoutOwnAccessThroughTheLink', 'notes' => 'Same EO-zero-actions environment limitation as EDITOR-200-open-url - resolves to 415, not 200, in this environment. Display name and hideDownload are unit-tested (ShareControllerTest)'],
+	['id' => 'SHARE-logged-in-link-only-needs-password', 'op' => 'ShareController', 'requirement' => 'A logged-in visitor whose only access is a password-protected link is sent to the password page (303); only visitors with their own access to the file skip the link password', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/ShareGuestTokenTest::testOpenShareSendsLoggedInUserWithoutOwnAccessToThePasswordPage', 'notes' => 'The own-access skip and the challenge-on-every-failure rule are unit-tested (ShareControllerTest)'],
+	['id' => 'SHARE-403-unreadable-share', 'op' => 'ShareController', 'requirement' => 'A share with no READ permission returns 403', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/ShareGuestTokenTest::testOpenShareReturns403ForUnreadableShareAsUnauthenticatedGuest', 'notes' => 'Was only reachable via an AUTHENTICATED request before the SHARE-guest-proceeds-without-password fix - an unauthenticated guest used to hit the password-check bug first (303) and never reach this guard. Now tested directly as an unauthenticated guest, matching the fixed behavior.'],
+	['id' => 'SHARE-guest-token-grants-anonymous-wopi-access', 'op' => 'TokenManager (guest)', 'requirement' => 'A guest token issued via TokenManager::generateGuestToken() grants working, read-scoped, download-hidden WOPI access (IsAnonymousUser, UserFriendlyName, UserCanWrite, HideExportOption/DisablePrint)', 'spec' => 'MS-WOPI CheckFileInfo (guest)', 'status' => 'tested', 'test' => 'integration/ShareGuestTokenTest::testGuestTokenGrantsAnonymousWopiAccess', 'notes' => 'Issues the token directly (as WOPI_TEST_RESULTS.md\'s own Phase 1/2 methodology did) rather than via the currently-broken ShareController HTTP entry point above - this verifies the underlying guest-token WOPI mechanics work correctly, independent of that bug'],
+	['id' => 'SHARE-revoked-share-ends-access', 'op' => 'WopiAccessResolver', 'requirement' => 'Share-link tokens are re-checked against the live share on every WOPI request: deleting or expiring the share ends access, and narrowing it narrows write and download rights', 'spec' => 'N/A - app-specific (richdocuments parity)', 'status' => 'tested', 'test' => 'integration/ShareGuestTokenTest::testDeletingTheShareEndsTheGuestsWopiAccess', 'notes' => 'Narrowing, folder scoping and every WOPI entry point are unit-tested (WopiAccessResolverTest, WopiControllerLockTest)'],
+
+	// --- Routing / background jobs (app-specific) ---
+	['id' => 'ROUTE-index-php-prefix', 'op' => 'Routing', 'requirement' => 'linkToRouteAbsolute() for WOPI routes includes the /index.php/ prefix in this dev setup', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/RouteTest::testWopiRouteIncludesIndexPhpPrefix', 'notes' => 'WOPI_TEST_RESULTS.md unnumbered Route check'],
+	['id' => 'CLEANUPJOB-registered', 'op' => 'CleanupJob', 'requirement' => 'OCA\\Office\\BackgroundJob\\CleanupJob is registered and appears in occ background-job:list', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/CleanupJobTest::testCleanupJobIsRegisteredInJobList', 'notes' => 'WOPI_TEST_RESULTS.md unnumbered CleanupJob check'],
+	['id' => 'CLEANUPJOB-purges-expired-tokens-and-locks', 'op' => 'CleanupJob', 'requirement' => 'Invoking CleanupJob::run() deletes expired WOPI tokens (WopiMapper::getExpiredTokenIds/deleteByIds) and expired locks (WopiLockMapper::getExpiredLockIds/deleteByIds), batched at 500', 'spec' => 'N/A - app-specific', 'status' => 'tested', 'test' => 'integration/CleanupJobTest::testCleanupJobPurgesExpiredToken', 'notes' => 'code-derived, lib/BackgroundJob/CleanupJob.php - not exercised by the occ list check above, which only confirms registration'],
+
+	// --- Explicitly not implemented (visibility on the gap, per plan) ---
+	['id' => 'SPEC-putrelativefile-not-implemented', 'op' => 'PutRelativeFile', 'requirement' => 'Save As / relative-file creation from the editor', 'spec' => 'MS-WOPI PutRelativeFile', 'status' => 'not-implemented', 'test' => null, 'notes' => 'CheckFileInfo already advertises UserCanNotWriteRelative=true; deferred to Phase 6 per WopiController.php comment'],
+	['id' => 'SPEC-deletefile-not-implemented', 'op' => 'DeleteFile', 'requirement' => 'Delete the file being edited, from the editor', 'spec' => 'MS-WOPI DeleteFile', 'status' => 'not-implemented', 'test' => null, 'notes' => null],
+	['id' => 'SPEC-putuserinfo-not-implemented', 'op' => 'PutUserInfo', 'requirement' => 'Persist arbitrary per-user editor state via the host', 'spec' => 'MS-WOPI PutUserInfo', 'status' => 'not-implemented', 'test' => null, 'notes' => null],
+	['id' => 'SPEC-proofkey-validation-not-implemented', 'op' => 'Proof Keys', 'requirement' => 'Validate X-WOPI-Proof / X-WOPI-ProofOld headers to authenticate that a request genuinely came from the editor server', 'spec' => 'MS-WOPI Proof Keys', 'status' => 'not-implemented', 'test' => null, 'notes' => 'Any caller holding a valid access_token is trusted; no proof-key check anywhere in WopiController'],
+	['id' => 'SPEC-itemversion-completeness-not-implemented', 'op' => 'ItemVersion', 'requirement' => 'X-WOPI-ItemVersion returned consistently across Lock/Unlock/RefreshLock/GetLock responses, not just PutFile', 'spec' => 'MS-WOPI ItemVersion (optional)', 'status' => 'not-implemented', 'test' => null, 'notes' => 'Optional per spec, but currently only PutFile ever sets X-WOPI-ItemVersion'],
+	['id' => 'SPEC-access-token-form-post-not-implemented', 'op' => 'Access Token Delivery', 'requirement' => 'Accept access_token via an application/x-www-form-urlencoded POST body, as an alternative to the ?access_token= query parameter', 'spec' => 'MS-WOPI Access Tokens', 'status' => 'not-implemented', 'test' => null, 'notes' => 'Every WopiController action reads access_token as a route/query parameter only'],
+];
diff --git a/vite.config.ts b/vite.config.ts
index 7a51e7e2..ed9d89dd 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -3,7 +3,10 @@ import { join, resolve } from 'path'
 
 export default createAppConfig(
 	{
-		main: resolve(join('src', 'main.js')),
+		main: resolve(join('src', 'main.ts')),
+		editor: resolve(join('src', 'editor.ts')),
+		'settings-admin': resolve(join('src', 'settings-admin.ts')),
+		'file-actions': resolve(join('src', 'file-actions.ts')),
 	},
 	{
 		createEmptyCSSEntryPoints: true,