Comparing f488cc7d07..df723e6a0e - meet - Grace Solutions

gsadmin/meet

mirror of https://github.com/suitenumerique/meet.git synced 2026-11-05 18:56:31 +00:00

Author	SHA1	Message	Date
briquet	df723e6a0e	🔒️(agents) upgrade python to 3.14.10 to fix CVE-2026-109518 The python:3.14.8-slim base image ships apt 3.0.3, which is affected by CVE-2026-109518.	2026-11-05 18:30:51 +01:00
briquet	900ebd3edd	👷(ci) ignore zlib CVE-2026-76844 in trivy Debian hasn't provided a fix yet	2026-11-05 18:30:51 +01:00
briquet	c4fbfdd302	🔒️(backend) refuse unregistered rooms whose slug is a UUID A registered room's LiveKit room is named after its id, and a room slug can never be a UUID. A lookup such as "<id>!" does not parse as a UUID, so it was searched as a slug, found nothing and was treated as an unregistered room. Its slug, normalized back to the bare id, then got a token for the registered room without going through the lobby, whenever unregistered rooms are allowed. Unregistered rooms whose slug is a UUID now return a 404.	2026-11-05 18:30:51 +01:00
briquet	6f1b9ddba7	🐛(frontend) show join errors instead of silently waiting in the lobby When joining failed with anything but a 404/410, the lobby started waiting as if entry had to be requested. Requesting entry now fails uniformly.	2026-11-05 18:30:51 +01:00
briquet	e412dec76f	🔥(backend) drop is_administrable from unregistered room payloads Registered rooms stopped returning is_administrable in v1.25.0, and nothing reads it for unregistered rooms either: administrable rooms are detected from their accesses. The frontend ApiRoom type drops is_administrable as well, which the API no longer returns.	2026-11-05 18:30:51 +01:00
briquet	6af43ebf1d	🔒️(frontend) send the display name in the join request body The room query joins the room, creating it first when missing, and keeps the response, LiveKit credentials included, in the room cache entry. It joins again to renew the token once its data is 6 hours old. Conference and Lobby component were simplified by regrouping custom hooks, states/refs, memo/callback and mutations.	2026-11-05 18:30:51 +01:00
briquet	4e953da226	🔒️(backend) issue room access tokens via a POST join endpoint Room access tokens were returned by GET /rooms/{id}/, with the LiveKit display name passed as a query parameter. We want to leverage Django's CSRF checks and avoid displaying usernames in access logs. Tokens are now only minted by POST /rooms/{id}/join/, which reads the display name from the request body and the livekit information have been removed where they were not required. Joining an unregistered room now builds its livekit block with generate_livekit_config, which mints the same token as the dict it replaces. The serializer and the lobby now share LobbyService.can_bypass_lobby to decide who may enter directly to centralize the logic.	2026-11-05 18:30:51 +01:00

Diff Content Not Available