From bb73a8130ac9241ceb46ad43940a67f8e3178190 Mon Sep 17 00:00:00 2001
From: Stefan Hacker <duffy@debian-linux-terminal.local>
Date: Sat, 11 Apr 2026 22:41:35 +0200
Subject: [PATCH] fix: Doppelter Route-Dekorator auf oo_download entfernt

Der @api_bp.route('/files/onlyoffice-callback') Dekorator war
versehentlich auf oo_download statt onlyoffice_callback gelandet.
Flask routete dadurch alle Callback-POSTs an oo_download, die dann
mit 'missing access_key argument' crashte (500 Error).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 backend/app/api/office.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/backend/app/api/office.py b/backend/app/api/office.py
index db43ec3..f2e02a1 100644
--- a/backend/app/api/office.py
+++ b/backend/app/api/office.py
@@ -391,7 +391,6 @@ def onlyoffice_config(file_id):
     return jsonify(config), 200
 
 
-@api_bp.route('/files/onlyoffice-callback', methods=['POST'])
 @api_bp.route('/files/oo-download/<access_key>', methods=['GET'])
 def oo_download(access_key):
     """Dedicated download endpoint for OnlyOffice - no JWT auth, uses one-time key."""