- Ya
- 24 Agosti 2026, 22:02 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 3300da2
Room isolation was the HOST. A member of org B could not present a *** cookie on meet.<org-A-domain>, so knowing org A's room name got them nowhere. Serving organizations without a domain of their own from one shared meet host ends that: every member's cookie is valid there, the room name becomes the only boundary, and /api/auth/jwt mints a MODERATOR token for whatever room is asked for. Knowing a room name would have been enough to join someone else's meeting and run it. Rooms now carry an org token derived from the session's org id, and a member is only issued a token for a room carrying their own. Derived from the ID because it is the one tenant key the session actually holds -- `session.orgAlias` does not exist in ***, so the old expression always fell through to the host, which on the shared host is one value for every organization. That is why context.group grouped nothing there. A per-organization meet host keeps its previous behaviour exactly: the host is still the boundary, and enforcing a prefix would break every room made before this existed. The guest path had the same shape of bug from the other side. It read requirePassword by HOSTNAME, which on the shared host resolves to the platform organization -- so a tenant that requires a meeting password would have had that quietly dropped for every guest. A guest has no session, so the org now comes from the room token, and context.group with it rather than from a caller-supplied orgAlias. kamo-internal computes the same token (base36 of the org id) and a test pins the values literally across both implementations, since they are in different languages and would otherwise drift silently.