Office preview with Local Storage loses temporaryAccessToken after redirect and requires public legacy storage

Describe the bug

Microsoft Office Online Preview does not work with protected Local Storage unless LEGACY_LOCAL_STORAGE_PUBLIC_ACCESS=true is enabled.

When Office Online Viewer requests a NocoBase stable file URL containing a valid temporaryAccessToken, NocoBase successfully accepts the request and returns an HTTP 302 redirect.

However, after the redirect to the underlying Local Storage URL, the authorization context from the temporaryAccessToken is no longer available. Access to the legacy local-storage path then triggers auth:checkLegacyFileAccess, which returns 401 EMPTY_TOKEN because Microsoft Office Online Viewer does not have the user's NocoBase session cookie or Authorization header.

As a result, Office Preview only works if:

LEGACY_LOCAL_STORAGE_PUBLIC_ACCESS=true

is enabled.

This appears inconsistent with the purpose of temporaryAccessToken, which already provides short-lived, file-scoped access specifically for external services such as Microsoft Office Online Viewer.

Enabling LEGACY_LOCAL_STORAGE_PUBLIC_ACCESS=true is not an equivalent authorization mechanism because it makes the entire legacy Local Storage path anonymously accessible instead of granting temporary access only to the requested file.

Environment

• NocoBase version: v2.2.12

• Database type and version: PostgreSQL 18.6

• OS: Linux

• Deployment Methods: Docker Compose

• Docker image version: 2.2.12

• NodeJS version: v22.23.2

How To Reproduce

1. Deploy NocoBase using Docker with Local Storage.
2. Keep legacy Local Storage protected:

LEGACY_LOCAL_STORAGE_PUBLIC_ACCESS=false

or leave the setting unset so that the default protected behavior is used.

1. Upload an .xlsx file to an attachment field.
2. Enable/use Microsoft Office Online Preview.
3. Open the Office preview.
4. NocoBase generates a stable file URL similar to:

https://example.com/files/main/main/attachments/2610.xlsx?temporaryAccessToken=<token>

1. Microsoft Office Online Viewer requests the URL successfully.

The NocoBase server receives:

GET /files/main/main/attachments/2610.xlsx?temporaryAccessToken=<token>

and responds with:

302

1. The redirected Local Storage request then triggers:

GET /api/auth:checkLegacyFileAccess

which responds with:

401 EMPTY_TOKEN
Unauthenticated. Please sign in to continue.

1. Office Online Viewer fails to load the document.
2. Set:

LEGACY_LOCAL_STORAGE_PUBLIC_ACCESS=true

and restart NocoBase.

1. The same document can now be previewed successfully in Microsoft Office Online Viewer.

This confirms that the initial temporaryAccessToken request succeeds, but access fails after the redirect reaches the protected Local Storage endpoint.

Expected behavior

A valid temporaryAccessToken should allow Microsoft Office Online Viewer to retrieve only the file authorized by that token without requiring the entire Local Storage directory to be anonymously accessible.

Screenshots

N/A

Logs

The initial request containing the temporary access token succeeds and returns 302:

{"level":"info","message":"request GET /files/main/main/attachments/2610.xlsx?temporaryAccessToken=<redacted>","method":"GET","path":"/files/main/main/attachments/2610.xlsx?temporaryAccessToken=<redacted>","app":"main","timestamp":"2026-09-15 15:34:29"}
{"level":"info","message":"response /files/main/main/attachments/2610.xlsx?temporaryAccessToken=<redacted>","method":"GET","path":"/files/main/main/attachments/2610.xlsx?temporaryAccessToken=<redacted>","res":{"status":302},"action":{"actionName":"getFile","resourceName":"attachments","params":{"filterByTk":"2610","temporaryAccessToken":"<redacted>"}},"status":302,"app":"main","timestamp":"2026-09-15 15:34:29"}

Immediately afterward, Local Storage authorization fails because no NocoBase login token is available:

{"level":"info","message":"request GET /api/auth:checkLegacyFileAccess","method":"GET","path":"/api/auth:checkLegacyFileAccess","app":"main","timestamp":"2026-09-15 15:34:30"}
{"level":"warn","message":"response /api/auth:checkLegacyFileAccess","method":"GET","path":"/api/auth:checkLegacyFileAccess","res":[{"message":"Unauthenticated. Please sign in to continue.","code":"EMPTY_TOKEN"}],"status":401,"app":"main","timestamp":"2026-09-15 15:34:30"}

Workaround

The following configuration makes Office Preview work:

LEGACY_LOCAL_STORAGE_PUBLIC_ACCESS=true

However, this weakens the authorization model because anonymous access is enabled for the legacy Local Storage path globally rather than only for the individual file authorized by the short-lived temporaryAccessToken.

The temporaryAccessToken appears to be validated correctly on the /files/... request, but its authorization scope does not survive the redirect to the underlying Local Storage resource.