116 lines
4.4 KiB
TypeScript
116 lines
4.4 KiB
TypeScript
import { timingSafeEqual } from "node:crypto";
|
|
import { NextResponse } from "next/server";
|
|
import { getPayload } from "payload";
|
|
import config from "@payload-config";
|
|
import { createMeetingToken } from "@/lib/meeting/token";
|
|
import { authorizeMeeting } from "@/lib/meeting/access";
|
|
import { checkRateLimit, getClientIp } from "@/lib/auth/rateLimit";
|
|
import { createLiveKitToken, getLiveKitClientUrl } from "@/lib/meeting/livekit";
|
|
import { isMeetingParticipantKicked } from "@/lib/meeting/kicks";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
function safeEqual(a: string, b: string): boolean {
|
|
const bufA = Buffer.from(a);
|
|
const bufB = Buffer.from(b);
|
|
if (bufA.length !== bufB.length) return false;
|
|
return timingSafeEqual(bufA, bufB);
|
|
}
|
|
|
|
type Args = { params: Promise<{ slug: string }> };
|
|
|
|
export async function POST(request: Request, { params }: Args) {
|
|
const { slug } = await params;
|
|
if (!checkRateLimit(`meeting-join:${getClientIp(request)}`, { max: 30, windowMs: 60000 })) {
|
|
return NextResponse.json({ error: "Zu viele Beitrittsversuche." }, { status: 429 });
|
|
}
|
|
|
|
let body: { name?: unknown; password?: unknown; clientId?: unknown };
|
|
try {
|
|
body = await request.json();
|
|
if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Invalid body");
|
|
} catch {
|
|
return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 400 });
|
|
}
|
|
|
|
const name = typeof body.name === "string" ? body.name.trim() : "";
|
|
const password = typeof body.password === "string" ? body.password.trim() : "";
|
|
const clientId = typeof body.clientId === "string" ? body.clientId.trim() : undefined;
|
|
if (!name || name.length > 120) {
|
|
return NextResponse.json({ error: "Bitte gib deinen Namen ein." }, { status: 400 });
|
|
}
|
|
if (password.length > 200) {
|
|
return NextResponse.json({ error: "Das Meeting-Passwort ist ungültig." }, { status: 400 });
|
|
}
|
|
|
|
try {
|
|
const payload = await getPayload({ config });
|
|
|
|
const { docs } = await payload.find({
|
|
collection: "events",
|
|
where: { slug: { equals: slug } },
|
|
limit: 1,
|
|
});
|
|
const event = docs[0];
|
|
if (!event || !event.isOnline) {
|
|
return NextResponse.json({ error: "Dieser Online-Termin wurde nicht gefunden." }, { status: 404 });
|
|
}
|
|
|
|
const { user } = await payload.auth({ headers: request.headers });
|
|
// Must check the collection, not just presence — a logged-in customer
|
|
// (collection "customers") must never be treated as host.
|
|
const isHost = user?.collection === "users" && user.role === "admin";
|
|
|
|
if (!isHost) {
|
|
if (!password) {
|
|
return NextResponse.json({ error: "Bitte gib das Meeting-Passwort ein." }, { status: 400 });
|
|
}
|
|
if (!event.meetingPassword || !safeEqual(password, event.meetingPassword)) {
|
|
return NextResponse.json({ error: "Das Meeting-Passwort ist nicht korrekt." }, { status: 401 });
|
|
}
|
|
}
|
|
|
|
const access = await authorizeMeeting(payload, event, isHost ? "host" : "participant");
|
|
if (!access) {
|
|
return NextResponse.json({ error: "Dieser Termin ist nicht offen oder wurde storniert." }, { status: 403 });
|
|
}
|
|
|
|
const { token, participantId } = createMeetingToken({
|
|
eventSlug: slug,
|
|
name,
|
|
role: isHost ? "host" : "participant",
|
|
accessVersion: access.accessVersion,
|
|
ttlMs: Math.min(6 * 3600000, access.expiresAt - Date.now()),
|
|
// Only meaningful for participants — a host authenticates via a real
|
|
// session already, so there's no need to anchor a kick to it (and
|
|
// hosts can't be kicked in the first place.
|
|
clientId: isHost ? undefined : clientId,
|
|
});
|
|
|
|
if (!isHost && isMeetingParticipantKicked(slug, participantId, clientId)) {
|
|
return NextResponse.json({ error: "Du wurdest aus diesem Meeting entfernt." }, { status: 403 });
|
|
}
|
|
const participantToken = await createLiveKitToken({
|
|
eventSlug: slug,
|
|
accessVersion: access.accessVersion,
|
|
expiresAt: access.expiresAt,
|
|
participantId,
|
|
name,
|
|
role: isHost ? "host" : "participant",
|
|
clientId: isHost ? undefined : clientId,
|
|
});
|
|
|
|
return NextResponse.json({
|
|
token,
|
|
participantId,
|
|
role: isHost ? "host" : "participant",
|
|
eventTitle: event.title,
|
|
participantToken,
|
|
serverUrl: getLiveKitClientUrl(),
|
|
});
|
|
} catch (error) {
|
|
console.error("meeting join failed", error);
|
|
return NextResponse.json({ error: "Der Beitritt ist gerade nicht möglich. Bitte versuche es später erneut." }, { status: 500 });
|
|
}
|
|
}
|