Block access to pad when wopi webhook responds with HTTP 400 or 500 about ep_sciencemesh HOT 1 OPEN

Thoughts from etherpad discord community (etherpad maintainers):

deleteSession is only usable when using group pads, but iirc group pads don't have a notion of r/w - always writeable.
A ugly "hack" would be to dynamically block access to /p/.* with the exception of /p/r\..* and redirect your users to the readonly pad. If you are using authentication plugins at the moment, then you can make use of the authorize hook. If not, I'd try out plugin ep_guest - afaik the users section in settings.json can be changed at runtime, enable requireAuthentication (but not requireAuthorization) and configure ep_guest so that all users can write in a pad (readOnly: false). Then, if you want to make all pads readonly, dynamically set this to true.
Sorry in case it does not work because users is populated at start up, but iirc I successfully changed this during runtime some time ago.

Ref - https://www.npmjs.com/package/ep_guest

from ep_sciencemesh.