- Ya
- 7 Julai 2026, 23:41 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 47f2fde
When an org enables requirePassword, anonymous link visitors must enter the room password; authenticated members are never prompted. - sidecar: no anonymousdomain when requirePassword, so guests can't join anonymously — they must obtain a guest JWT via /api/auth/guest-jwt, which now validates the room password (deterministic HMAC of the app secret, timing-safe compare). New GET /api/meet/room-password returns the password only to an authenticated member so a moderator can share it. - overrides.js: guests see a name+password gate that exchanges the password for a guest JWT and joins; moderators get a small banner showing the password to share. "Sign in with Kamo" remains available as an alternative.