Fix image serving in direct editing

[julien-nc]

This fixes 2 mistakes:

• Avoid passing empty shareToken when not logged in
• In the controller, use the edition session to get the user ID instead of relying on NC authentication

Image serving then works in our mobile clients (tested NC Android app).

refs #1900

[mejo-]

Mh, $userId seems to be needed in each public function of the controller. It gets injected into the constructor by DI, but in all functions but this one (getImage()), it's fetched again using $session->getUiserId(). So does this mean that $userId as injected by DI is not reliable? Then probably $this->userId should be removed from the class altogether?

Maybe a function like the following could work?

private function getUserId(int $documentId, int $sessionId, string $sessionToken): string {
        if ($this->userId === null) {
                $this->userId = $this->sessionService->getSession($documentId, $sessionId, $sessionToken)->getUserId();
        }

        return $this->userId;
}

[julien-nc]

It's the same in all methods of ImageController. Whether the user is authenticated or not, we always choose to rely on the edition session rather than the "classic" authentication. This way it works with the mobile clients which are making unauthenticated requests but our UI passes the edition session ID and token.

This was suggested by @juliushaertl in #1900 (comment)

The unused $userId attribute has been removed.

[mejo-]

Looks good to me now 😊 You could still move the logic to get $userId into a dedicated private function to lower code-duplication, but that's really just nitpicking 😉

[mejo-]

Looks good to me now 😊 You could still move the logic to get $userId into a dedicated private function to lower code-duplication, but that's really just nitpicking 😉

[julien-nc]

@mejo- I completely agree. Factorization done.

Rebased on master
Removed an unused var.

[julien-nc]

Cypress failure is unrelated. It's the "share" test.