- Shipped
- September 17, 2026 at 4:28 PM UTC
- Author
- Kamo
- Commit
- f8ba4be
Demo requests from the marketing site come from visitors with no account. That path already needed none: the attendee row is the name and email the form collected, the lead is written from them, and the presenter's and visitor's letters go to addresses, not members. It stays exactly that way. Two things around it were wrong. 1. Every visitor's address was public. **************** /schedule and /scheduled/{id}/join returned the internal ScheduledWebinarDTO whole — the full roster with each attendee's name and email, the presenter's email and the meeting room name. Anyone could open the upcoming-demos list and collect everyone who had booked. (No sessions exist yet, so nothing has been exposed.) They now return PublicScheduledWebinar, an allow-list of what the page shows: id, title, start/end, length, presenter name, attendee count. Its field names are the demo page's own. DemoClient reads title and presenterName, which the old DTO did not have (webinarTypeTitle, assignedPresenterName), so upcoming demos rendered with no title and no host, and the confirmation always said "Kamo Team". Both are right now with no marketing change. 2. The organization was ignored. APIService stamps X-Public-Chat-Org-Id from the site's public API key, and only /types and /demo-request read it: any key could list times, list sessions and book against any organization's webinar by UUID. Slots, scheduled, schedule and join now require the type to be an active type of that organization; anything else answers "not found", like a type that does not exist. The marketing site's key resolves to KamoCRM, whose types it books, so the demo page is unaffected. The token-keyed cancel routes (kamo-marketing, kamo-meet) are unchanged. Tests: PublicWebinarVisitorBookingTest books as a visitor with no member (attendee has no member, lead written, presenter emailed, presenterDateViewed null so the Support badge counts it) and refuses another org's key; **************** checks the wire body carries no address, roster or room. Full suite 975/975.