- Shipped
- July 7, 2026 at 9:23 PM UTC
- Author
- Kamo
- Commit
- 3a57d44
- sidecar /api/auth/jwt: derive the member identity (id/name/email/org) from the server-side *** session, not the request body. Previously anyone could POST an arbitrary identity + moderator:true and get a valid Prosody JWT for any room — a public verified-member/moderator forge. Now returns 401 without a session cookie. - sidecar /api/config: advertise the guest anonymousdomain whenever guest access is enabled (was gated on a second, off-by-default toggle, so bare links couldn't join at all under Prosody's ENABLE_AUTH=jwt). Require a display name when the org requires it or disallows fully-anonymous guests. - sidecar /api/session: store the member-lookup OTK with the raw *** id (was double-prefixed, so the avatar/member fetch always failed). - welcome page + native prejoin: add a "Sign in with Kamo" affordance that routes through the internal /meet/join OTK redirect, so a guest can choose to join as a verified member instead (spec item 4).