- Shipped
- July 7, 2026 at 9:21 PM UTC
- Author
- Kamo
- Commit
- 4d04d5f
- createMeeting: invited members are numeric snowflake IDs, not UUID strings — route them through longToUUID like the creator. Previously UUID.fromString threw for every invitee so none were ever recorded as participants. - MeetConfigController: require MANAGE_MEET_SETTINGS on all writes (config PUT, background upload/delete/reorder). Reads stay open to org members; writes were previously mutable by any authenticated member. - Tighten background upload to a PNG/JPEG/WebP whitelist. - Remove the dead /api/meet/invite endpoint and the backend invite senders (chat STOMP + email). Invite delivery is owned by kamo-internal, which builds per-recipient authenticated join links; the backend path double-delivered and used a broken (JSON vs multipart) EmailService contract.