From 10e8bca5a4e7b885a612025be33a963a5783f786 Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Tue, 7 Jul 2026 17:46:23 +0200 Subject: [PATCH] =?UTF-8?q?=E2=99=BF=EF=B8=8F(backend)=20add=20permission?= =?UTF-8?q?=20class=20checking=20the=20user=20is=20in=20the=20call?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce a new permission class that verifies the caller making a request is both authenticated and actually present in the call. It will be used to gate actions that require the user to be live in the room, for example: * allowing someone in from the waiting room * promoting another participant to a different role More generally, this covers every action where, for security reasons, we need to make sure the user is truly present in the call and that someone is not reusing their cookie as an API key. --- src/backend/core/api/permissions.py | 32 +++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/src/backend/core/api/permissions.py b/src/backend/core/api/permissions.py index 8289f1ec..c1fb21b2 100644 --- a/src/backend/core/api/permissions.py +++ b/src/backend/core/api/permissions.py @@ -6,6 +6,11 @@ from django.http import Http404 from rest_framework import permissions from ..models import RoleChoices +from ..services.participants_management import ( + ParticipantNotFoundException, + ParticipantsManagement, + ParticipantsManagementException, +) ACTION_FOR_METHOD_TO_PERMISSION = { "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"} @@ -166,3 +171,30 @@ class CanMuteParticipant(permissions.BasePermission): # LiveKit token scoped to this room return request.auth.video.room == str(obj.id) + + +class IsPresentInMeeting(permissions.BasePermission): + """Check that the requesting user is currently connected to the meeting. + + The requester must be session-authenticated (their DB identity is needed + to check privileges); presence is verified against LiveKit using their + `sub` as participant identity. Fails closed on LiveKit errors. + """ + + message = "You must be connected to the meeting to perform this action." + + def has_object_permission(self, request, view, obj): + """Verify the requester's identity is a participant of the room.""" + user = request.user + + if not user or not user.is_authenticated: + return False + + try: + return ParticipantsManagement().check_if_in_meeting( + room_name=str(obj.pk), identity=str(user.sub) + ) + except ParticipantNotFoundException: + return False + except ParticipantsManagementException: + return False