"Invalid password" when opening Office documents via public link on Nextcloud 32.0.2 (Office Online integration 3.1.0)

Steps to reproduce

1. Run Nextcloud 32.0.2.2 with the Office Online integration app enabled.
2. Configure Microsoft Office Online Server (WOPI). Editing Excel files (.xlsx) from the Files app as a logged-in user works fine.
3. In Files, share an existing .xlsx or .docx file via a public link (no password set on the share).
4. Open the public share URL in a browser (Chrome on macOS in my case).
5. Click on the Excel file so it attempts to open via Office Online.

Expected behavior

The Office document (Excel or Word) should open in Office Online for the public link recipient.

Actual behavior

Instead of opening the file, Office Online fails on the Nextcloud side:

• Opening the same file as a logged-in user from the Files app works as expected.
• Opening the file via a public link fails with Invalid password.

The browser shows an error page instead of the editor.

Environment

• Nextcloud Server version: 32.0.2.2
• Office Online integration app version: 3.1.0
• PHP version: PHP 8.3.28 (cli) (NTS)
• Database: PostgreSQL 16.9
• Web server: nginx 1.20.1
• OS: Rocky Linux 9.6 (Blue Onyx)
• Reverse proxy: (none / built-in nginx on the same host)

There are currently no local modifications in the apps/officeonline code (I reverted any previous patches and installed the app as shipped).

Office Online Server appears to work correctly because editing the same Office documents from the Files app as a logged-in user is fine.

Additional information:

• There is no password set on the public share itself.
• The Excel and Word files are not password-protected and open fine locally in Microsoft Office.
• The problem occurs only when opening the file via a public link, not for authenticated users.
• This started after upgrading to Nextcloud 32.0.2 (it was working before the upgrade).
• This looks related to earlier issues with public shares and Office Online:
• The behavior is identical for .xlsx and .docx files.

#626 – public link failing to open office documents
#633 – fix for public share links
#707 – PHP compatibility / UserScopeService (I am currently on PHP 8.3.28, not 8.4)

Logs

Relevant log entry from nextcloud.log when trying to open the file via public link:

{
  "reqId": "5NgEYUSHeTK4uoIhp4eU",
  "level": 3,
  "time": "2025-11-24T12:43:01+00:00",
  "remoteAddr": "0.0.0.0",
  "user": "Nextcloud_user",
  "app": "officeonline",
  "method": "GET",
  "url": "/apps/officeonline/public?shareToken=***redacted***&fileName=***redacted***&requesttoken=***redacted***&fileId=2424941&path=***redacted***",
  "message": "Invalid password",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
  "version": "32.0.2.2",
  "exception": {
    "Exception": "Exception",
    "Message": "Invalid password",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 204,
        "function": "publicPage",
        "class": "OCA\\Officeonline\\Controller\\DocumentController",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 118,
        "function": "executeController",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/App.php",
        "line": 153,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/Route/Router.php",
        "line": 321,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::"
      },
      {
        "file": "/var/www/nextcloud/lib/base.php",
        "line": 1061,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/index.php",
        "line": 25,
        "function": "handleRequest",
        "class": "OC",
        "type": "::"
      }
    ],
    "File": "/var/www/nextcloud/apps/officeonline/lib/Controller/DocumentController.php",
    "Line": 346,
    "message": "Invalid password",
    "exception": [],
    "CustomMessage": "Invalid password"
  }
}

Read apps/officeonline/lib/Controller/DocumentController.php around line 346 and follow the public route shown in the log. Compare the behavior with issues #626 and #633, then verify the fix by opening both .xlsx and .docx files through an unprotected public link; authenticated access should remain working.