- Shipped
- October 27, 2026 at 4:33 AM UTC
- Author
- Kamo
- Commit
- 604e547
TPMEETAUTH (owner order 2026-10-26): the SI's ear reads who each endpoint is from its presence identity. The stock presence_identity strips a client's own <identity> only for token sessions, so an anonymous guest.meet.Meet or a Jigasi leg could present a forged one. This MUC module strips every client identity and writes only the session's JWT context (the sidecar signs it from the member's own ***; guests carry guest-<hex>). Unit-tested in the Prosody pod (forged identity removed, token identity written). Applied 2026-10-27 04:32Z with no live conference (jicofo stats: 0 conferences, 0 participants); Jicofo and Jigasi reconnected, guests get tokens.