- Ya
- 24 Agosti 2026, 22:03 UTC
- Mwandishi
- kamo
- Ahadi ya
- d7a0780
getOrgToken() took the first label of the current host, and its own comment said why: "so identically-named rooms cannot collide across orgs". On the shared host that yields "kamocrm" for every organization without a domain, so it separates nothing -- while the meet sidecar hands out moderator tokens for whatever room is asked for. The token now comes from the session's org id, which the sidecar computes identically and enforces: a member is only issued a token for a room carrying their own organization's prefix. The id stays a string throughout. These ids are past 2^53 and one routed through a JS number produces a token for a different organization, silently. The pinned values in the test are written out literally rather than recomputed. The two implementations live in different languages and different repos, so a test that derived the token the same way the code does would keep passing while the two sides drifted apart. 2873 tests pass.