- Shipped
- August 25, 2026 at 1:28 AM UTC
- Author
- Kamo
- Commit
- 483ac9c
/api/config and /api/branding read the organization from the hostname. On the shared meet host that is the platform organization for every tenant, so each of them got the platform's meet settings and the platform's branding — including whether a meeting requires a password. Both now resolve from the room name (which carries its organization's token, so a guest arriving on a link is identified with no session) or from an explicit ?org=, falling back to the host. A white-labelled tenant on its own meet host is unaffected. Branding is painted from the ORGANIZATION's theme host rather than the serving host, which are the same thing only when the tenant has a host of its own. Two upstream calls, deliberately: SecurityService owns which organization a reference names and where its branding lives, MediaService owns its meet settings. Asking MediaService for the theme host would be a second answer to a question SecurityService already answers everywhere else. Also collapses the earlier by-token lookup into this one resolver — both reduce to an organization reference, so keeping two was duplication waiting to drift.