Access controlled files can't be edited/viewed with Nextcloud Office

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Steps to reproduce

1. create a tag mytag, a group mygroup, assign a user Alice to mygroup
2. create a FAC rule as follow: When file is access AND file is tagged my mytagAND user groupmembership is not member ofmygroup` THEN block access to the file.
3. login as alice
4. create a folder
5. assign mytag to the folder, and refresh the page
6. create an Office document in the folder
7. it loads, edit the document
8. close the document
9. try to open again the document, it fails.

Expected behaviour

Alice should be able to open the document again

Actual behaviour

opening the document fails

Nextcloud log shows:

{
  "reqId": "tkLxy0we2X6ECthxIfYC",
  "level": 3,
  "time": "2026-04-14T19:53:14+00:00",
  "remoteAddr": "2a01:4f9:3a:161f::cafe",
  "user": "--",
  "app": "richdocuments",
  "method": "GET",
  "url": "/index.php/apps/richdocuments/wopi/files/1085_ocucescblmv4/contents?access_token=z98dVmVlCWhEGBR75tk4Ty6Kt1vY2LVV&access_token_ttl=0",
  "scriptName": "/index.php",
  "message": "getFile failed: Access denied by access control",
  "userAgent": "COOLWSD HTTP Agent 25.04.8.3",
  "version": "32.0.8.2",
  "exception": {
    "Exception": "OCP\\Files\\ForbiddenException",
    "Message": "Access denied by access control",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/html/custom_apps/files_accesscontrol/lib/StorageWrapper.php",
        "line": 46,
        "function": "checkFileAccess",
        "class": "OCA\\FilesAccessControl\\Operation",
        "type": "->",
        "args": [
          "Gestion du personnel/Nouveau document.docx",
          {
            "__class__": "OCA\\GroupFolders\\Mount\\GroupMountPoint"
          },
          false
        ]
      },
      {
        "file": "/var/www/html/custom_apps/files_accesscontrol/lib/StorageWrapper.php",
        "line": 235,
        "function": "checkFileAccess",
        "class": "OCA\\FilesAccessControl\\StorageWrapper",
        "type": "->",
        "args": [
          "Gestion du personnel/Nouveau document.docx",
          false
        ]
      },
      {
        "file": "/var/www/html/custom_apps/terms_of_service/lib/Filesystem/StorageWrapper.php",
        "line": 69,
        "function": "fopen",
        "class": "OCA\\FilesAccessControl\\StorageWrapper",
        "type": "->",
        "args": [
          "Gestion du personnel/Nouveau document.docx",
          "r"
        ]
      },
      {
        "file": "/var/www/html/lib/private/Files/View.php",
        "line": 1211,
        "function": "fopen",
        "class": "OCA\\TermsOfService\\Filesystem\\StorageWrapper",
        "type": "->",
        "args": [
          "Gestion du personnel/Nouveau document.docx",
          "r"
        ]
      },
      {
        "file": "/var/www/html/lib/private/Files/View.php",
        "line": 1039,
        "function": "basicOperation",
        "class": "OC\\Files\\View",
        "type": "->",
        "args": [
          "fopen",
          "/alice/files/RH/Gestion du personnel/Nouveau document.docx",
          [
            "read"
          ],
          "r"
        ]
      },
      {
        "file": "/var/www/html/lib/private/Files/Node/File.php",
        "line": 95,
        "function": "fopen",
        "class": "OC\\Files\\View",
        "type": "->",
        "args": [
          "/alice/files/RH/Gestion du personnel/Nouveau document.docx",
          "r"
        ]
      },
      {
        "file": "/var/www/html/custom_apps/richdocuments/lib/Controller/WopiController.php",
        "line": 390,
        "function": "fopen",
        "class": "OC\\Files\\Node\\File",
        "type": "->",
        "args": [
          "rb"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 204,
        "function": "getFile",
        "class": "OCA\\Richdocuments\\Controller\\WopiController",
        "type": "->",
        "args": [
          "1085",
          "z9…VV"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 118,
        "function": "executeController",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Richdocuments\\Controller\\WopiController"
          },
          "getFile"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/App.php",
        "line": 153,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Richdocuments\\Controller\\WopiController"
          },
          "getFile"
        ]
      },
      {
        "file": "/var/www/html/lib/private/Route/Router.php",
        "line": 321,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::",
        "args": [
          "OCA\\Richdocuments\\Controller\\WopiController",
          "getFile",
          {
            "__class__": "OC\\AppFramework\\DependencyInjection\\DIContainer"
          },
          {
            "_route": "richdocuments.wopi.getfile",
            "fileId": "1085_ocucescblmv4"
          }
        ]
      },
      {
        "file": "/var/www/html/lib/base.php",
        "line": 1091,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->",
        "args": [
          "/apps/richdocuments/wopi/files/1085_ocucescblmv4/contents"
        ]
      },
      {
        "file": "/var/www/html/index.php",
        "line": 25,
        "function": "handleRequest",
        "class": "OC",
        "type": "::",
        "args": []
      }
    ],
    "File": "/var/www/html/custom_apps/files_accesscontrol/lib/Operation.php",
    "Line": 81,
    "message": "getFile failed: Access denied by access control",
    "exception": [],
    "CustomMessage": "getFile failed: Access denied by access control"
  },
  "id": "69de9b3d51f47"
}

Server configuration

alptis.ltd3.nc.c

Web server: Apache/Nginx

Database: MySQL/Maria/SQLite/PostgreSQL

PHP version: 8.2/8.3/8.4

Nextcloud version: (see Nextcloud admin page)

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder

Browser

Browser name: Firefox/Chrome/Safari/…

Browser version: 124/125/…

Operating system: Windows/Ubuntu/Mac/…

Insert your browser log here, this could for example include:
a) The javascript console log
b) The network log
c) ...

Start with the reported trace in files_accesscontrol/lib/StorageWrapper.php and Operation.php, then follow the richdocuments WopiController.php getFile entry point. Reproduce the tagged-folder and group-membership steps, trace why the Office request is denied after editing, and verify that Alice can reopen the document without weakening the access-control rule.