Integrate LiveKit SFU and harden booking workflow

app/(payload)/api/meetings/[slug]/join/route.ts

@@ -4,7 +4,8 @@ import { getPayload } from "payload";
 import config from "@payload-config";
 import { createMeetingToken } from "@/lib/meeting/token";
 import { canJoinMeeting, combineDateAndTime, getMeetingStatus } from "@/lib/meeting/status";
-import { getIceServers } from "@/lib/meeting/iceServers";
+import { createLiveKitToken, getLiveKitClientUrl } from "@/lib/meeting/livekit";
+import { isMeetingParticipantKicked } from "@/lib/meeting/kicks";
 
 export const dynamic = "force-dynamic";
 
@@ -30,9 +31,12 @@ export async function POST(request: Request, { params }: Args) {
   const name = typeof body.name === "string" ? body.name.trim() : "";
   const password = typeof body.password === "string" ? body.password.trim() : "";
   const clientId = typeof body.clientId === "string" ? body.clientId.trim() : undefined;
-  if (!name) {
+  if (!name || name.length > 120) {
     return NextResponse.json({ error: "Bitte gib deinen Namen ein." }, { status: 400 });
   }
+  if (password.length > 200) {
+    return NextResponse.json({ error: "Das Meeting-Passwort ist ungültig." }, { status: 400 });
+  }
 
   try {
     const payload = await getPayload({ config });
@@ -50,7 +54,7 @@ export async function POST(request: Request, { params }: Args) {
     const { user } = await payload.auth({ headers: request.headers });
     // Must check the collection, not just presence — a logged-in customer
     // (collection "customers") must never be treated as host.
-    const isHost = user?.collection === "users";
+    const isHost = user?.collection === "users" && user.role === "admin";
 
     if (!isHost) {
       if (!password) {
@@ -88,7 +92,18 @@ export async function POST(request: Request, { params }: Args) {
       role: isHost ? "host" : "participant",
       // Only meaningful for participants — a host authenticates via a real
       // session already, so there's no need to anchor a kick to it (and
-      // hosts can't be kicked in the first place, see signalingServer.ts).
+      // hosts can't be kicked in the first place.
+      clientId: isHost ? undefined : clientId,
+    });
+
+    if (!isHost && isMeetingParticipantKicked(slug, participantId, clientId)) {
+      return NextResponse.json({ error: "Du wurdest aus diesem Meeting entfernt." }, { status: 403 });
+    }
+    const participantToken = await createLiveKitToken({
+      eventSlug: slug,
+      participantId,
+      name,
+      role: isHost ? "host" : "participant",
       clientId: isHost ? undefined : clientId,
     });
 
@@ -97,7 +112,8 @@ export async function POST(request: Request, { params }: Args) {
       participantId,
       role: isHost ? "host" : "participant",
       eventTitle: event.title,
-      iceServers: getIceServers(),
+      participantToken,
+      serverUrl: getLiveKitClientUrl(),
     });
   } catch (error) {
     console.error("meeting join failed", error);