fix(direct editing): cleanup tokens on user deletion

... and for disabled users

Signed-off-by: Max <max@nextcloud.com>

Author: max-nextcloud

core/AppInfo/Application.php

@@ -38,6 +38,8 @@
 use OC\Core\Sharing\Recipient\TeamShareRecipientType;
 use OC\Core\Sharing\Recipient\TokenShareRecipientType;
 use OC\Core\Sharing\Recipient\UserShareRecipientType;
+use OC\DirectEditing\Listeners\UserDeletedTokenCleanupListener as UserDeletedDirectEditingTokenCleanupListener;
+use OC\DirectEditing\Listeners\UserDisabledTokenCleanupListener as UserDisabledDirectEditingTokenCleanupListener;
 use OC\OCM\OCMDiscoveryHandler;
 use OC\OCM\OCMJwksHandler;
 use OC\TagManager;
@@ -55,6 +57,7 @@
 use OCP\Server;
 use OCP\User\Events\BeforeUserDeletedEvent;
 use OCP\User\Events\PasswordUpdatedEvent;
+use OCP\User\Events\UserChangedEvent;
 use OCP\User\Events\UserDeletedEvent;
 use OCP\Util;
 
@@ -115,6 +118,10 @@ public function register(IRegistrationContext $context): void {
 
 		$context->registerEventListener(RestrictInteractionEvent::class, RestrictInteractionListener::class);
 
+		// Direct Editing
+		$context->registerEventListener(UserDeletedEvent::class, UserDeletedDirectEditingTokenCleanupListener::class);
+		$context->registerEventListener(UserChangedEvent::class, UserDisabledDirectEditingTokenCleanupListener::class);
+
 		$registry = Server::get(ISharingRegistry::class);
 
 		$registry->registerRecipientType(Server::get(EmailShareRecipientType::class));

lib/private/DirectEditing/Listeners/UserDeletedTokenCleanupListener.php

@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\DirectEditing\Listeners;
+
+use OC\DirectEditing\Manager;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\User\Events\UserDeletedEvent;
+use Psr\Log\LoggerInterface;
+use Throwable;
+
+/**
+ * @template-implements IEventListener<UserDeletedEvent>
+ */
+class UserDeletedTokenCleanupListener implements IEventListener {
+	public function __construct(
+		private Manager $manager,
+		private LoggerInterface $logger,
+	) {
+	}
+
+	#[\Override]
+	public function handle(Event $event): void {
+		if (!($event instanceof UserDeletedEvent)) {
+			// Unrelated
+			return;
+		}
+
+		/**
+		 * Catch any exception during this process as any failure here shouldn't block the
+		 * user deletion.
+		 */
+		try {
+			$uid = $event->getUser()->getUID();
+			$this->manager->invalidateTokensForUser($uid);
+		} catch (Throwable $e) {
+			$this->logger->error('Could not clean up direct editing tokens after user deletion: ' . $e->getMessage(), [
+				'exception' => $e,
+			]);
+		}
+	}
+}

lib/private/DirectEditing/Listeners/UserDisabledTokenCleanupListener.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\DirectEditing\Listeners;
+
+use OC\DirectEditing\Manager;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\User\Events\UserChangedEvent;
+use Psr\Log\LoggerInterface;
+use Throwable;
+
+/**
+ * @template-implements IEventListener<UserChangedEvent>
+ */
+class UserDisabledTokenCleanupListener implements IEventListener {
+	public function __construct(
+		private Manager $manager,
+		private LoggerInterface $logger,
+	) {
+	}
+
+	#[\Override]
+	public function handle(Event $event): void {
+		if (!($event instanceof UserChangedEvent)) {
+			// Unrelated
+			return;
+		}
+
+		if ($event->getFeature() !== 'enabled' || $event->getValue()) {
+			// not disabled
+			return;
+		}
+
+		/**
+		 * Catch any exception during this process
+		 * as any failure here shouldn't block the disabling the user.
+		 */
+		try {
+			$uid = $event->getUser()->getUID();
+			$this->manager->invalidateTokensForUser($uid);
+		} catch (Throwable $e) {
+			$this->logger->error('Could not clean up direct editing tokens when disabling user: ' . $e->getMessage(), [
+				'exception' => $e,
+			]);
+		}
+	}
+}

lib/private/DirectEditing/Manager.php

@@ -218,6 +218,13 @@ public function cleanup(): int {
 		return $query->executeStatement();
 	}
 
+	public function invalidateTokensForUser(string $uid): int {
+		$query = $this->connection->getQueryBuilder();
+		$query->delete(self::TABLE_TOKENS)
+			->where($query->expr()->eq('user_id', $query->createNamedParameter($uid)));
+		return $query->executeStatement();
+	}
+
 	public function refreshToken(string $token): bool {
 		$query = $this->connection->getQueryBuilder();
 		$query->update(self::TABLE_TOKENS)