mirror of
https://github.com/suitenumerique/meet.git
synced 2026-07-27 20:29:09 +00:00
lebaudantoine
f48dd5cea1
Allow any user, anonymous or authenticated, to start subtitling in a room only if they are an active participant of it. Subtitling a room consists of starting the multi-user transcriber agent. This agent forwards all participants' audio to an STT server and returns transcription segments for any active voice to the room. User roles in the backend room system cannot be used to determine subtitle permissions. The transcriber agent can be triggered multiple times but will only join a room once. Unicity is managed by the agent itself. Any user with a valid LiveKit token can initiate subtitles. Feature flag logic is implemented on the frontend. The frontend ensures the "start subtitle" action is only available to users who should see it. The backend does not enforce feature flags in this version. Authentication in our system does not imply access to a room. The only valid proof of access is the LiveKit API token issued by the backend. Security consideration: A LiveKit API token is valid for 6 hours and cannot be revoked at the end of a meeting. It is important to verify that the token was issued for the correct room. Calls to the agent dispatch endpoint must be server-initiated. The backend proxies these calls, as clients cannot securely contact the agent dispatch endpoint directly (per LiveKit documentation). Room ID is passed as a query parameter. There is currently no validation ensuring that the room exists prior to agent dispatch. TODO: implement validation or error handling for non-existent rooms. The backend does not forward LiveKit tokens to the agent. Default API rate limiting is applied to prevent abuse.
43 lines
1.3 KiB
Python
43 lines
1.3 KiB
Python
"""Authentication using LiveKit token for the Meet core app."""
|
|
|
|
from django.conf import settings
|
|
from django.contrib.auth import get_user_model
|
|
from django.contrib.auth.models import AnonymousUser
|
|
|
|
from livekit.api import TokenVerifier
|
|
from rest_framework import authentication, exceptions
|
|
|
|
UserModel = get_user_model()
|
|
|
|
|
|
class LiveKitTokenAuthentication(authentication.BaseAuthentication):
|
|
"""Authenticate using LiveKit token and load the associated Django user."""
|
|
|
|
def authenticate(self, request):
|
|
token = request.data.get("token")
|
|
if not token:
|
|
return None # No authentication attempted
|
|
|
|
try:
|
|
verifier = TokenVerifier(
|
|
api_key=settings.LIVEKIT_CONFIGURATION["api_key"],
|
|
api_secret=settings.LIVEKIT_CONFIGURATION["api_secret"],
|
|
)
|
|
claims = verifier.verify(token)
|
|
|
|
user_id = claims.identity
|
|
if not user_id:
|
|
raise exceptions.AuthenticationFailed("Token missing user identity")
|
|
|
|
try:
|
|
user = UserModel.objects.get(id=user_id)
|
|
except UserModel.DoesNotExist:
|
|
user = AnonymousUser()
|
|
|
|
return (user, claims)
|
|
|
|
except Exception as e:
|
|
raise exceptions.AuthenticationFailed(
|
|
f"Invalid LiveKit token: {str(e)}"
|
|
) from e
|