Integrate LiveKit SFU and harden booking workflow

lib/meeting/token.ts

@@ -61,7 +61,8 @@ export function createMeetingToken(args: {
 }
 
 /** Verifies signature + expiry. Returns null if invalid/expired/tampered. */
-export function verifyMeetingToken(token: string): MeetingTokenPayload | null {
+export function verifyMeetingToken(token: unknown): MeetingTokenPayload | null {
+  if (typeof token !== "string" || token.length > 4096) return null;
   const parts = token.split(".");
   if (parts.length !== 2) return null;
   const [body, signature] = parts;
@@ -73,8 +74,17 @@ export function verifyMeetingToken(token: string): MeetingTokenPayload | null {
 
   try {
     const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8")) as MeetingTokenPayload;
-    if (typeof payload.exp !== "number" || payload.exp < Date.now()) return null;
-    if (!payload.eventSlug || !payload.participantId || !payload.name || !payload.role) return null;
+    if (
+      !Number.isFinite(payload.exp) ||
+      payload.exp < Date.now() ||
+      typeof payload.eventSlug !== "string" ||
+      payload.eventSlug.length > 200 ||
+      typeof payload.participantId !== "string" ||
+      payload.participantId.length > 100 ||
+      typeof payload.name !== "string" ||
+      payload.name.length > 120 ||
+      (payload.role !== "host" && payload.role !== "participant")
+    ) return null;
     return payload;
   } catch {
     return null;