fix(DirectEditing): cleanup tokens on user deletion

... and for disabled users

Signed-off-by: Max <max@nextcloud.com>

Author: max-nextcloud

core/Application.php

@@ -20,6 +20,8 @@
 use OC\Core\Listener\BeforeTemplateRenderedListener;
 use OC\Core\Listener\PasswordUpdatedListener;
 use OC\Core\Notification\CoreNotifier;
+use OC\DirectEditing\Listeners\UserDeletedTokenCleanupListener as UserDeletedDirectEditingTokenCleanupListener;
+use OC\DirectEditing\Listeners\UserDisabledTokenCleanupListener as UserDisabledDirectEditingTokenCleanupListener;
 use OC\TagManager;
 use OCP\AppFramework\App;
 use OCP\AppFramework\Http\Events\BeforeLoginTemplateRenderedEvent;
@@ -30,6 +32,7 @@
 use OCP\Notification\IManager as INotificationManager;
 use OCP\User\Events\BeforeUserDeletedEvent;
 use OCP\User\Events\PasswordUpdatedEvent;
+use OCP\User\Events\UserChangedEvent;
 use OCP\User\Events\UserDeletedEvent;
 use OCP\Util;
 
@@ -302,5 +305,9 @@ public function __construct() {
 
 		// Tags
 		$eventDispatcher->addServiceListener(UserDeletedEvent::class, TagManager::class);
+
+		// Direct Editing
+		$eventDispatcher->addServiceListener(UserDeletedEvent::class, UserDeletedDirectEditingTokenCleanupListener::class);
+		$eventDispatcher->addServiceListener(UserChangedEvent::class, UserDisabledDirectEditingTokenCleanupListener::class);
 	}
 }

lib/private/DirectEditing/Listeners/UserDeletedTokenCleanupListener.php

@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\DirectEditing\Listeners;
+
+use OC\DirectEditing\Manager;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\User\Events\UserDeletedEvent;
+use Psr\Log\LoggerInterface;
+use Throwable;
+
+/**
+ * @template-implements IEventListener<UserDeletedEvent>
+ */
+class UserDeletedTokenCleanupListener implements IEventListener {
+	public function __construct(
+		private Manager $manager,
+		private LoggerInterface $logger,
+	) {
+	}
+
+	#[\Override]
+	public function handle(Event $event): void {
+		if (!($event instanceof UserDeletedEvent)) {
+			// Unrelated
+			return;
+		}
+
+		/**
+		 * Catch any exception during this process as any failure here shouldn't block the
+		 * user deletion.
+		 */
+		try {
+			$uid = $event->getUser()->getUID();
+			$this->manager->invalidateTokensForUser($uid);
+		} catch (Throwable $e) {
+			$this->logger->error('Could not clean up direct editing tokens after user deletion: ' . $e->getMessage(), [
+				'exception' => $e,
+			]);
+		}
+	}
+}

lib/private/DirectEditing/Listeners/UserDisabledTokenCleanupListener.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\DirectEditing\Listeners;
+
+use OC\DirectEditing\Manager;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\User\Events\UserChangedEvent;
+use Psr\Log\LoggerInterface;
+use Throwable;
+
+/**
+ * @template-implements IEventListener<UserChangedEvent>
+ */
+class UserDisabledTokenCleanupListener implements IEventListener {
+	public function __construct(
+		private Manager $manager,
+		private LoggerInterface $logger,
+	) {
+	}
+
+	#[\Override]
+	public function handle(Event $event): void {
+		if (!($event instanceof UserChangedEvent)) {
+			// Unrelated
+			return;
+		}
+
+		if ($event->getFeature() !== 'enabled' || $event->getValue()) {
+			// not disabled
+			return;
+		}
+
+		/**
+		 * Catch any exception during this process
+		 * as any failure here shouldn't block the disabling the user.
+		 */
+		try {
+			$uid = $event->getUser()->getUID();
+			$this->manager->invalidateTokensForUser($uid);
+		} catch (Throwable $e) {
+			$this->logger->error('Could not clean up direct editing tokens when disabling user: ' . $e->getMessage(), [
+				'exception' => $e,
+			]);
+		}
+	}
+}

lib/private/DirectEditing/Manager.php

@@ -224,6 +224,13 @@ public function cleanup(): int {
 		return $query->execute();
 	}
 
+	public function invalidateTokensForUser(string $uid): int {
+		$query = $this->connection->getQueryBuilder();
+		$query->delete(self::TABLE_TOKENS)
+			->where($query->expr()->eq('user_id', $query->createNamedParameter($uid)));
+		return $query->executeStatement();
+	}
+
 	public function refreshToken(string $token): bool {
 		$query = $this->connection->getQueryBuilder();
 		$query->update(self::TABLE_TOKENS)