Internal and external auth cache 5 minutes.

The mediapreview error-handling refactor dropped the outer
asyncio.wait_for around preview generation. Pool-internal timeouts only
bound individual stages (idle-worker wait, worker request, OO HTTP
calls); queueing on top of them let requests run far past 10s and
eventually return 200 instead of 503. Wrap both generate paths in
wait_for(PREVIEW_TIMEOUT) again — cancellation propagates correctly:
the pool dispatcher drops cancelled futures, and the OnlyOffice manager
cancels orphaned conversion tasks.

cista/__main__.py

@@ -1,5 +1,6 @@
 import os
 import sys
+from importlib.metadata import version as pkg_version
 from pathlib import Path
 
 from docopt import docopt
@@ -30,7 +31,7 @@ def create_startup_box(
     *, folder, url, unix=None, dev=False, paskia_url=None, public=False
 ):
     """Create a framed startup box with server information."""
-    title = f"Cista {cista.__version__}"
+    title = f"Cista {cista.__version__} (mediapreview {pkg_version('mediapreview')})"
     listen = unix or url
     location = f"{folder} @ {listen}"
     lines = [title, location]

cista/auth.py

@@ -226,7 +226,7 @@ def hydrate_request_auth_context(request, *, source: str) -> None:
 
 
 _AUTH_REALM = "cista"
-_AUTH_CACHE_TTL = 10
+_AUTH_CACHE_TTL = 300
 _auth_cache: dict[str, tuple[float, config.User]] = {}
 _WINDOWS_UA_HINTS = (
     "windows",

cista/onlyoffice.py

@@ -21,7 +21,7 @@ def configure() -> None:
     )
 
 
-def setup_docker(confdir: Path | None = None) -> str:
+def setup_docker(confdir: Path | None = None) -> int:
     """Build and run the patched OnlyOffice Docker image (via mediapreview)."""
     if confdir is not None:
         os.environ["CISTA_HOME"] = confdir.as_posix()
@@ -38,10 +38,11 @@ def setup_docker(confdir: Path | None = None) -> str:
         )
     configure()
     try:
-        return mediapreview.office.setup_docker()
+        mediapreview.office.setup_docker()
     finally:
         # Print regardless of build outcome: the secret is deterministic
         # (derived from the config).
         sys.stdout.write(
             f"ONLYOFFICE_JWT_SECRET={os.environ['ONLYOFFICE_JWT_SECRET']}\n"
         )
+    return 0

cista/preview.py

@@ -18,7 +18,9 @@ from mediapreview.exceptions import (
     PreviewError,
 )
 from mediapreview.formats import OFFICE_PREVIEW_SUFFIXES
+from mediapreview.formats import expected_backend as _expected_preview_backend
 from mediapreview.pool import (
+    PREVIEW_TIMEOUT,
     generate_office_preview,
     run_preview,
 )
@@ -80,14 +82,23 @@ async def preview(req, path):
         logger.debug(f"Preview cache hit: {rel}")
         return raw(cached.body, headers=cached.headers)
 
-    # Generate preview
+    # Generate preview. The outer deadline is strict: pool internals have
+    # their own timeouts, but queueing (workers, the OnlyOffice semaphore)
+    # must not let a request exceed PREVIEW_TIMEOUT.
     try:
         if filepath.suffix.lower() in OFFICE_PREVIEW_SUFFIXES:
-            img, preview_resp = await generate_office_preview(
-                filepath, quality, maxsize, maxzoom
+            img, preview_resp = await asyncio.wait_for(
+                generate_office_preview(filepath, quality, maxsize, maxzoom),
+                timeout=PREVIEW_TIMEOUT,
             )
         else:
-            img, preview_resp = await run_preview(filepath, quality, maxsize, maxzoom)
+            img, preview_resp = await asyncio.wait_for(
+                run_preview(filepath, quality, maxsize, maxzoom),
+                timeout=PREVIEW_TIMEOUT,
+            )
+    except TimeoutError:
+        req.ctx.log_extra = f"{_expected_preview_backend(filepath)} timeout"
+        return empty(503)
     except PreviewError as e:
         # mediapreview is responsible for backend-specific diagnostics; cista only
         # needs the backend name, a short access-log reason, and a response status.

cista/sso.py

@@ -68,7 +68,7 @@ async def close_client():
 # Keyed by (credential hash, validation URL) so that entries for different
 # perms/renew flags coexist and all entries for a credential can be purged
 # on logout.
-_VALIDATE_CACHE_TTL = 10
+_VALIDATE_CACHE_TTL = 300
 _validate_cache: dict[tuple[str, str], tuple[float, dict]] = {}
 
 

pyproject.toml

@@ -33,7 +33,7 @@ dependencies = [
     "html5tagger>=1.3.0",
     "httpx>=0.28.0",
     "inotify>=0.2.12",
-    "mediapreview[standard]>=0.2.2",
+    "mediapreview[standard]>=0.2.3",
     "msgspec>=0.19.0",
     "natsort>=8.4.0",
     "numpy>=2.3.2",