feat: sabre webdav server implementation to replace external webdav a…

[fibble]

…pache server to support legacy MSword RTF edit journey

Description

Implements just enough webdav server in app/internal application to support the caseworkers document editing in MSWord journey to continue, abstracted from the underlying file-store. All Document reads/writes in this new flow are handled via CQRS to the API, and as such are agnostic to the ultimate file storage backend.

Related issue: VOL-6960

Before submitting (or marking as "ready for review")

• Does the pull request title follow the conventional commit specification?
• Have you performed a self-review of the code
• Have you have added tests that prove the fix or feature is effective and working
• Did you make sure to update any documentation relating to this change?

[Copilot]

Pull request overview

Implements an internal (sabre/dav-based) WebDAV endpoint in the internal app to support the legacy MS Word RTF editing journey, removing dependency on the external Apache WebDAV service and proxying document reads/writes through CQRS/API.

Changes:

• Add /internal-dav/ nginx routing and a dedicated webdav.php front controller to handle MS Word WebDAV requests.
• Introduce WebDAV services (JWT verification, virtual DAV nodes, Redis locking/cache) and wire controllers to generate internal WebDAV links behind a feature toggle.
• Extend the API/document-store integration to support overwriting document contents (OverwriteContent + DocumentStoreInterface::update) and add related validation.

Reviewed changes

Copilot reviewed 45 out of 48 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
infra/docker/internal/internal.conf	Routes /internal-dav/ to webdav.php and adds DAV-compliance headers on / for MS Word
app/internal/public/webdav.php	New WebDAV entrypoint: validates JWT, restores session tokens from Redis, runs sabre/dav server
app/internal/module/Olcs/src/Service/WebDav/*	Redis factory + DAV virtual filesystem + Redis lock backend + JWT verification service/factory
app/internal/module/Olcs/src/Service/Helper/WebDavJsonWebTokenGenerationService*	Adds internal WebDAV URL pattern + extra JWT claims to support the integrated flow
app/internal/module//Controller/	Uses WebDavSessionTrait to generate internal/legacy DAV links and cache tokens when enabled
app/api/module/Api/src/Domain/CommandHandler/Document/OverwriteContent.php	Adds API command handler to overwrite stored document content (toggle-gated)
app/api/module/DocumentShare/src/Service/WebDavClient.php + DocumentStoreInterface.php	Adds update()/updateStream() support for overwriting remote-stored files
app/internal/test/* + app/api/test/*	Adds/updates tests for the new WebDAV components and API validation/handler logic
docs/app/features/webdav.md	Documents the new internal WebDAV architecture and key components

Comments suppressed due to low confidence (3)

app/internal/module/Olcs/src/Service/WebDav/VirtualFile.php:118

• getLastModified() falls back to time() whenever no cached value exists, so the same document can appear to have a different last-modified timestamp on every request/PROPFIND. This can confuse WebDAV clients (including MS Office) and break caching/conflict detection. Consider sourcing this from document metadata (or keeping a stable value for the lifetime of the WebDAV session) instead of using the current time.
  app/internal/test/Olcs/src/Service/WebDav/WebDavRedisFactoryTest.php:59
• invokeUsesDefaultsWhenConfigMissing() is non-deterministic and can slow/flap in CI because it attempts a real connection to localhost:6379 (and may wait up to the 5s timeout). Prefer making this test deterministic (e.g. configure an invalid host/port and assert null, or refactor the factory to allow injecting/mocking the Redis client).
  app/internal/public/webdav.php:143
• The JWT doc claim is treated as a file extension ($extension = $documentPath) and concatenated into $filename without any sanitization. If this claim ever contains unexpected values (e.g. including /, .., or multiple dots), it could create surprising paths/nodes in the DAV tree. Consider renaming $documentPath to $extension and validating against an allowlist like {rtf,doc,docx} (or at least stripping non-alphanumerics) before building the filename.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.