LotusGuild/matrix
3
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity
188 Commits 1 Branch 0 Tags
ee5f78b71e08e7a2c8204403f5ca1730ad1095eb
Commit Graph
2 Commits
Author SHA1 Message Date
jaredandClaude Opus 5 ee5f78b71e voice-limit-guard: live revoke never fired — LiveKit's JSON uses snake_case permissions
Lint / Shell (shellcheck) (push) Successful in 9s
Details
Lint / JS (eslint) (push) Successful in 6s
Details
Lint / Python (ruff) (push) Successful in 5s
Details
Lint / Python deps (pip-audit) (push) Successful in 1m13s
Details
Lint / Secret scan (gitleaks) (push) Successful in 5s
Details 
livekit-server (verified on 1.13.7) serialises ParticipantPermission as
can_publish / can_publish_sources; the reconciler read canPublish /
canPublishSources, saw 'publishes nothing' for everyone and never called
UpdateParticipant, so turning Allow Screen Sharing off did not stop an
in-progress share. Normalise the permission keys before deciding.
Verified on a local Synapse + LiveKit + guard stack: share track gone
from the SFU 2 s after the policy flip. Tests added (44 pass).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
 2026-09-18 22:10:14 -04:00
jaredandClaude Opus 4.8 a06f2c662a feat(livekit-guard): enforce per-room call permissions (screenshare/camera) 
Extend voice-limit-guard to enforce a per-room publish-source policy
(io.lotus.room_quality allow_screenshare/allow_camera) for ALL Matrix clients,
alongside the existing participant limit.

- At token issue, re-sign the LiveKit JWT's canPublishSources to drop forbidden
  sources (microphone always kept). Verifies our own secret signed the token
  first and fails open on mismatch, so a secret drift can never mint a token the
  SFU rejects. Limit check and source policy are independent (one's outage can't
  skip the other).
- Live (mid-call) enforcement: a background reconcile loop calls LiveKit
  UpdateParticipant to revoke a forbidden source from participants who joined
  before the policy changed -- which unpublishes their in-progress
  screenshare/camera server-side within ~3s and blocks re-publish. Only removes
  sources (never grants), preserves other permission flags, fails open, and runs
  as a daemon thread that cannot crash or block token issuance.
- Endpoint-specific room-id extraction (/get_token->room_id, /sfu/get->room) so
  a client sending both keys can't get a different room's policy applied.
- Auto-deploy the guard on LXC 151 (py_compile-gated, backup + rollback).
- Unit tests: JWT re-sign/verify + tamper, secret-mismatch, source narrowing,
  reconcile (never-grant / preserve-flags / disable-on-empty), fail-open.

Numeric bitrate/fps caps are NOT server-enforceable on an SFU (LiveKit forwards,
never transcodes) and remain a Lotus-client-cooperative setting; the
screenshare/camera permission is the hard cross-client lever.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-30 22:34:34 -04:00