# drift WOPI Bridge — Install Guide

Bridges Collabora Online ↔ CommuniGate Pro so drift-all Desktop can open Office documents (`.docx`, `.xlsx`, `.pptx`, …) in-browser via WOPI.

**Runs on the same machine as your CGP server.** Listens on `127.0.0.1:8200` (loopback only — never exposed to the public internet) and talks XIMSS to CGP on `127.0.0.1:8100`.

Self-contained: no Node.js runtime required, single binary per platform.

---

## Windows

1. **Download** `wopi-bridge-3.3.1-win-x64.exe` and rename it to `wopi-bridge.exe`.
2. **Download** `install-service.ps1` into the same folder.
3. Open **PowerShell as Administrator**, `cd` to that folder, run:
   ```powershell
   powershell -ExecutionPolicy Bypass -File install-service.ps1
   ```
   Optional flags: `-CgpHost 10.0.0.5 -CgpPort 8100` if CGP isn't on localhost:8100.
4. **Verify** — the script prints the service status. Or manually:
   ```powershell
   Get-Service DriftWopiBridge
   curl.exe http://127.0.0.1:8200/validate?token=x     # expect HTTP 401
   ```
5. **Manage**:
   ```powershell
   Restart-Service DriftWopiBridge
   Stop-Service DriftWopiBridge
   sc.exe delete DriftWopiBridge                       # uninstall
   ```

The service auto-starts at boot and auto-restarts on crash (SCM failure actions: 5 s / 5 s / 10 s).

### Run without installing as a service (test / dev)

```powershell
.\wopi-bridge-3.3.1-win-x64.exe
```

Ctrl-C to stop.

---

## Linux

Prebuilt for x86_64 (Debian/Ubuntu/RHEL/Fedora/Arch — glibc ≥ 2.17).

1. **Download** `wopi-bridge-3.3.1-linux-x64` and `wopi-bridge.service`.
2. Install as system service:
   ```bash
   # Install the binary
   sudo install -m 0755 wopi-bridge-3.3.1-linux-x64 /usr/local/bin/wopi-bridge

   # Create the service account (no shell, no home)
   sudo useradd --system --no-create-home --shell /usr/sbin/nologin drift-wopi

   # Log target
   sudo touch /var/log/drift-wopi-bridge.log
   sudo chown drift-wopi:drift-wopi /var/log/drift-wopi-bridge.log

   # Install the unit
   sudo install -m 0644 wopi-bridge.service /etc/systemd/system/wopi-bridge.service
   sudo systemctl daemon-reload
   sudo systemctl enable --now wopi-bridge
   ```
3. **Verify**:
   ```bash
   systemctl status wopi-bridge
   curl -i "http://127.0.0.1:8200/validate?token=x"     # expect HTTP 401
   sudo tail -f /var/log/drift-wopi-bridge.log
   ```
4. **Manage**:
   ```bash
   sudo systemctl restart wopi-bridge
   sudo systemctl stop wopi-bridge
   sudo systemctl disable --now wopi-bridge             # uninstall (leaves files)
   ```

Adjust CGP host/port in `/etc/systemd/system/wopi-bridge.service` (`Environment=CGP_HOST=…`) and `systemctl daemon-reload && systemctl restart wopi-bridge`.

### Run without installing as a service (test / dev)

```bash
chmod +x wopi-bridge-3.3.1-linux-x64
./wopi-bridge-3.3.1-linux-x64
```

Ctrl-C to stop. Set `CGP_HOST` / `CGP_PORT` in the environment to override the defaults.

---

## What the bridge does

| Endpoint | Called by | Purpose |
|---|---|---|
| `POST /register` | drift (via CGP `retrieveURL`) at login | Registers user credentials, returns an opaque token |
| `GET /validate?token=X` | drift, before each Collabora open | Silently confirms the token still resolves; drift re-registers if not |
| `POST /unregister` | drift on logout | Drops the token |
| `GET /<filepath>?access_token=X` | Collabora | WOPI CheckFileInfo |
| `GET /<filepath>/contents?…` | Collabora | WOPI GetFile |
| `POST /<filepath>/contents?…` | Collabora | WOPI PutFile |
| `POST /convert-to-pdf` | drift | HTML → PDF via Collabora (used by "Save as PDF") |

## Security notes

- Binds to `0.0.0.0:8200` — **firewall it to loopback** if the machine has a public interface. On the Linux service unit the sandbox flags block outside access from other users; on Windows do the equivalent with Windows Defender Firewall (block inbound 8200 from non-loopback).
- Tokens are opaque UUIDs held in RAM only. They live for the entire drift session; drift silently re-registers on bridge restart (since 3.3.1).
- CGP credentials never appear in any URL — they're used server-side by the bridge to issue an XIMSS session per user, cached for 10 min.

## Version

**3.3.1 — 2026-08-19** — matches drift-all-bar 3.3.1. Sliding token TTL removed; `/validate` endpoint added.