amazon-chime-sdk-rails 2.0.1 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 982f4cee3f1622b75fb753bcabe86e43553cbff6d4c764ce5495ea08f33d785f
-  data.tar.gz: 4fac1f0d404bc0e4e076b3b84c3f6ca76a5fed8c87d7720373395d609cc06f2e
+  metadata.gz: 168cdb6149788c0f8499ae2499df0f0d2a5590dacccaf0eed854704e91f7d3e6
+  data.tar.gz: a7d0c20d4a39929afe2b60b0c0b01f74181ab0807c5c27d76f2cc98a5a1760fe
 SHA512:
-  metadata.gz: 2e14565b2fb066cb3ce8c70170676a23c48de88693542e2fd7c0521eda86939f7233a416aa8810b1624d3abb7410a4acce910ffb34983afc1c0db2fb8983c84e
-  data.tar.gz: 3642b130eb688d8b1966a8ead22a2e9c55ff40a44d1f9ded2c688f435c94777e2159bda00cbe900ec2012a0a88dab26556b7685b21d87ee061f386ec041031f3
+  metadata.gz: e1be855d627474e0382b628578a70457beeff4b2f0f3400d107f35d99dc7e8a31020163137fc6e186eb4ff67754b17b957a16d809e0f6c751ecb563e198167d0
+  data.tar.gz: 2ce6405a5317f87052777b3830c844e6e5dd5702c2fa14ce1ff425ab04de70f6c69778d624d0268dec08d356ab801f148c7c64471ae4c04d39028780769f0141

data/.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Actions are pinned to commit SHAs; this keeps the pins current.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

data/.github/workflows/build.yml

@@ -13,7 +13,10 @@ on:
 env:
   # https://nodejs.org/en/download/current
   # https://nodejs.org/en/about/previous-releases
-  node-version: 23.6.0
+  node-version: 24.x
+
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -26,16 +29,19 @@ jobs:
           - gemfiles/Gemfile.rails-7.1
           - gemfiles/Gemfile.rails-7.2
           - gemfiles/Gemfile.rails-8.0
+          - gemfiles/Gemfile.rails-8.1
         include:
           # https://www.ruby-lang.org/en/downloads
           - gemfile: gemfiles/Gemfile.rails-7.0
-            ruby-version: 3.1.6
+            ruby-version: 3.2.9
           - gemfile: gemfiles/Gemfile.rails-7.1
-            ruby-version: 3.2.6
+            ruby-version: 3.2.9
           - gemfile: gemfiles/Gemfile.rails-7.2
-            ruby-version: 3.3.6
+            ruby-version: 3.3.10
           - gemfile: gemfiles/Gemfile.rails-8.0
-            ruby-version: 3.3.6
+            ruby-version: 3.4.8
+          - gemfile: gemfiles/Gemfile.rails-8.1
+            ruby-version: 4.0.0
           - gemfile: Gemfile
             ruby-version: head
             allow_failures: 'true'
@@ -45,14 +51,14 @@ jobs:
       BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gemfile }}
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         with:
           ruby-version: ${{ matrix.ruby-version }}
           bundler-cache: true
       - name: Set up Node.js
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.node-version }}
       - name: Prepare test application

data/CHANGELOG.md

@@ -1,3 +1,31 @@
+## 2.2.0 / 2026-10-28
+[Full Changelog](http://github.com/simukappu/amazon-chime-sdk-rails/compare/v2.1.0...v2.2.0)
+
+Security Fixes:
+
+* Verify that requested meetings belong to the requesting resource. Meetings and attendees controllers now respond with 404 when the meeting's `ExternalMeetingId` is not `config.prefix + meeting_request_id`, so users can no longer get, delete, or join meetings of other resources (such as other private rooms) by meeting ID
+  * Attendees controllers must now define `meeting_request_id` with the same value as the meetings controller. The generated attendees controller template includes it
+  * Set `config.verify_meeting_request_id = false`, or override `verify_meeting_request_id?` in a controller, to restore the previous behavior
+* Do not return `JoinToken` from attendees `index` and `show` actions. A join token is the credential to join a meeting as that attendee, so other participants could impersonate the attendee
+* Do not create meetings or attendees by HTTP GET request parameters. `create_meeting` in meetings `index` and `create_attendee_from_meeting` in meetings `show` can now only disable the creation enabled by `config.create_meeting_by_get_request` and `config.create_attendee_from_meeting`, since GET requests are not protected from CSRF
+* Raise `NotImplementedError` from `attendee_request_id` unless it is defined in your controllers. The previous default `"default"` made every user join meetings as the same attendee with the same join token. The generated controller templates also raise it until you define `attendee_request_id`
+* Build the attendee list in the generated meeting view with `textContent` instead of `innerHTML`, so attendee names from application metadata cannot inject HTML
+* Remove the unpinned axios script loaded from unpkg in the generated meeting view and use `fetch` instead
+* Pin the aws-samples/amazon-chime-sdk commit that `rails g chime_sdk:js` clones and runs npm scripts in
+
+## 2.1.0 / 2026-04-11
+[Full Changelog](http://github.com/simukappu/amazon-chime-sdk-rails/compare/v2.0.1...v2.1.0)
+
+Enhancements:
+
+* Support Rails 8.1
+* Update CI configuration and documentation
+
+Dependencies:
+
+* Require Ruby 3.1+ and Rails 7.0+
+* Update development dependencies
+
 ## 2.0.1 / 2025-01-14
 [Full Changelog](http://github.com/simukappu/amazon-chime-sdk-rails/compare/v2.0.0...v2.0.1)
 

data/Dockerfile

@@ -1,4 +1,4 @@
-FROM ruby:3.4.1
+FROM ruby:4.0.0
 RUN apt-get update -qq && apt-get install -y build-essential libpq-dev nodejs npm
 ENV ROOT="/amazon-chime-sdk-rails"
 WORKDIR ${ROOT}

data/Gemfile

@@ -3,27 +3,23 @@ source 'https://rubygems.org'
 gemspec
 
 # Bundle Rails
-gem 'rails', '~> 7.1.0'
-# https://github.com/lynndylanhurley/devise_token_auth/pull/1606
+gem 'rails', '~> 8.1.0'
+# https://github.com/lynndylanhurley/devise_token_auth/pull/1639
 gem 'devise_token_auth', git: 'https://github.com/lynndylanhurley/devise_token_auth.git'
 
 gem 'sqlite3'
 gem 'puma'
 gem 'sass-rails'
-gem 'turbolinks'
 gem 'jbuilder'
 
 group :development do
   gem 'web-console'
   gem 'listen'
-  gem 'spring'
-  gem 'spring-watcher-listen'
 end
 
 group :test do
-  # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
 end
 
 gem 'rack-cors', groups: [:production, :development]
-gem 'dotenv-rails', groups: [:production, :development]
+gem 'dotenv-rails', groups: [:production, :development]

data/README.md

@@ -1,19 +1,24 @@
 # amazon-chime-sdk-rails
 
-[![Build Status](https://github.com/simukappu/amazon-chime-sdk-rails/actions/workflows/build.yml/badge.svg)](https://github.com/simukappu/amazon-chime-sdk-rails/actions/workflows/build.yml)
-[![Coverage Status](https://coveralls.io/repos/github/simukappu/amazon-chime-sdk-rails/badge.svg?branch=master)](https://coveralls.io/github/simukappu/amazon-chime-sdk-rails?branch=master)
-[![Dependency](https://img.shields.io/depfu/simukappu/amazon-chime-sdk-rails.svg)](https://depfu.com/repos/simukappu/amazon-chime-sdk-rails)
-[![Inline Docs](http://inch-ci.org/github/simukappu/amazon-chime-sdk-rails.svg?branch=master)](http://inch-ci.org/github/simukappu/amazon-chime-sdk-rails)
 [![Gem Version](https://badge.fury.io/rb/amazon-chime-sdk-rails.svg)](https://rubygems.org/gems/amazon-chime-sdk-rails)
 [![Gem Downloads](https://img.shields.io/gem/dt/amazon-chime-sdk-rails.svg)](https://rubygems.org/gems/amazon-chime-sdk-rails)
-[![MIT License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](LICENSE)
+[![Build Status](https://github.com/simukappu/amazon-chime-sdk-rails/actions/workflows/build.yml/badge.svg)](https://github.com/simukappu/amazon-chime-sdk-rails/actions/workflows/build.yml)
+[![Coverage Status](https://coveralls.io/repos/github/simukappu/amazon-chime-sdk-rails/badge.svg?branch=master)](https://coveralls.io/github/simukappu/amazon-chime-sdk-rails?branch=master)
+[![License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](LICENSE)
 
 *amazon-chime-sdk-rails* brings server-side implementation of [Amazon Chime SDK](https://aws.amazon.com/chime/chime-sdk) to your [Ruby on Rails](https://rubyonrails.org) application. [Amazon Chime SDK](https://aws.amazon.com/chime/chime-sdk) provides client-side implementation to build real-time communications for your application, and *amazon-chime-sdk-rails* enables you to easily add server-side implementation to your Rails application.
 
+## Supported Versions
+
+* Ruby 3.1+
+* Rails 7.0+
+
+Tested with Rails 7.0, 7.1, 7.2, 8.0 and 8.1.
+
 <kbd>![cloud-react-meeting-demo-joined-image](https://raw.githubusercontent.com/simukappu/amazon-chime-sdk-rails/images/cloud_react_meeting_demo_joined.png)</kbd>
 
 *amazon-chime-sdk-rails* supports both of [Rails API Application](https://guides.rubyonrails.org/api_app.html) and [Rails Application with Action View](https://guides.rubyonrails.org/action_view_overview.html). The gem provides following functions:
-* *Meeting Coordinator* - Wrapper client module of [AWS SDK for Ruby](https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/Chime/Client.html), which simulates [AWS SDK for JavaScript](https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Chime.html) to communicate with Amazon Chime SDK client implementation by JSON format.
+* *Meeting Coordinator* - Wrapper client module of [AWS SDK for Ruby](https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/ChimeSDKMeetings/Client.html), which simulates [AWS SDK for JavaScript](https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/ChimeSDKMeetings.html) to communicate with Amazon Chime SDK client implementation by JSON format.
 * *Controller Templates* - Mixin module implementation for meetings and attendees controllers.
 * *Rails Generators*
   * *Controller Generator* - Generator to create customizable meetings and attendees controllers in your Rails application.
@@ -139,8 +144,7 @@ Push "Continue" and go to the private meeting room!
 
 ### Deploy application to your AWS environment
 
-At first, [install the latest version of AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html), [set up AWS credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) and [](Installing the AWS SAM CLI) in your local environment.
-At first, [install the latest version of AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html), [set up AWS credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) and [installing the AWS SAM CLI](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html) in your local environment.
+At first, [install the latest version of AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html), [set up AWS credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) and [install the AWS SAM CLI](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html) in your local environment.
 
 Deploy customized React Meeting Demo to your AWS environment:
 

data/amazon-chime-sdk-rails.gemspec

@@ -16,14 +16,14 @@ Gem::Specification.new do |s|
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- spec/*`.split("\n")
   s.require_paths = ["lib"]
-  s.required_ruby_version = '>= 2.2.2'
+  s.required_ruby_version = '>= 3.1.0'
 
-  s.add_dependency 'railties', '>= 5.0.0'
+  s.add_dependency 'railties', '>= 7.0.0'
   s.add_dependency 'aws-sdk-chimesdkmeetings', '>= 1.0.0'
 
-  s.add_development_dependency 'rspec-rails', '>= 4.0.1'
-  s.add_development_dependency 'factory_bot_rails', '>= 6.1.0'
-  s.add_development_dependency 'ammeter', '>= 1.1.4'
-  s.add_development_dependency 'yard', '>= 0.9.25'
-  s.add_development_dependency 'devise_token_auth', '>= 1.1.4'
+  s.add_development_dependency 'rspec-rails', '>= 6.0.0'
+  s.add_development_dependency 'factory_bot_rails', '>= 6.2.0'
+  s.add_development_dependency 'ammeter', '>= 1.1.5'
+  s.add_development_dependency 'yard', '>= 0.9.36'
+  s.add_development_dependency 'devise_token_auth', '>= 1.2.2'
 end

data/docs/Develop_Rails_API_Application.md

@@ -185,7 +185,7 @@ class Api::MeetingsController < ApplicationController
     "PrivateRoom-#{@room.id}"
   end
 
-  # Uncomment and update
+  # Update (replace raise NotImplementedError)
   def attendee_request_id
     "User-#{current_api_user.id}"
   end
@@ -234,7 +234,12 @@ class Api::MeetingAttendeesController < ApplicationController
     end
   end
 
-  # Uncomment and update
+  # Uncomment (use the same value as your meetings controller)
+  def meeting_request_id
+    "PrivateRoom-#{@room.id}"
+  end
+
+  # Update (replace raise NotImplementedError)
   def attendee_request_id
     "User-#{current_api_user.id}"
   end
@@ -284,6 +289,8 @@ Now ready to take off!
 
 Created Rails API works like this:
 
+Note: The API response examples below are simplified for readability. Actual responses may include additional fields such as `MeetingFeatures`, `MeetingArn`, `TenantIds`, `PrimaryMeetingId` and `Capabilities` depending on the Amazon Chime SDK version.
+
 ```bash
 # Sign up users
 

data/docs/Develop_Rails_View_Application.md

@@ -106,9 +106,8 @@ Add login header to your application. Create new `app/views/layouts/_header.html
     <%= csrf_meta_tags %>
     <%= csp_meta_tag %>
 
-    <%= stylesheet_link_tag 'application', media: 'all', 'data-turbolinks-track': 'reload' %>
-    <%= yield(:javascript_pack_tag) %>
-    <%= javascript_pack_tag 'application', 'data-turbolinks-track': 'reload' %>
+    <%= stylesheet_link_tag 'application', media: 'all' %>
+    <%= javascript_include_tag 'application' %>
   </head>
 
   <body>
@@ -252,7 +251,7 @@ class MeetingsController < ApplicationController
     "PrivateRoom-#{@room.id}"
   end
 
-  # Uncomment
+  # Update (replace raise NotImplementedError)
   def attendee_request_id
     "User-#{current_user.id}"
   end
@@ -273,15 +272,6 @@ class MeetingsController < ApplicationController
       "User": User.find_by_id(user_id)
     }
   end
-
-  # Uncomment
-  def application_attendee_metadata(attendee)
-    user_id = attendee[:Attendee][:ExternalUserId].split('-')[3]
-    {
-      "AttendeeType": "User",
-      "User": User.find_by_id(user_id)
-    }
-  end
 end
 ```
 
@@ -309,7 +299,12 @@ class MeetingAttendeesController < ApplicationController
     end
   end
 
-  # Uncomment
+  # Uncomment (use the same value as your meetings controller)
+  def meeting_request_id
+    "PrivateRoom-#{@room.id}"
+  end
+
+  # Update (replace raise NotImplementedError)
   def attendee_request_id
     "User-#{current_user.id}"
   end

data/gemfiles/Gemfile.rails-7.0

@@ -5,7 +5,7 @@ gemspec path: '../'
 # Bundle Rails
 gem 'rails', '~> 7.0.0'
 
-gem 'sqlite3', "~> 1.4"
+gem 'sqlite3', '~> 1.4'
 gem 'puma'
 gem 'sass-rails'
 gem 'turbolinks'
@@ -14,11 +14,8 @@ gem 'jbuilder'
 group :development do
   gem 'web-console'
   gem 'listen'
-  gem 'spring'
-  gem 'spring-watcher-listen'
 end
 
 group :test do
-  # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
-end
+end

data/gemfiles/Gemfile.rails-7.1

@@ -14,11 +14,8 @@ gem 'jbuilder'
 group :development do
   gem 'web-console'
   gem 'listen'
-  gem 'spring'
-  gem 'spring-watcher-listen'
 end
 
 group :test do
-  # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
-end
+end

data/gemfiles/Gemfile.rails-7.2

@@ -14,11 +14,8 @@ gem 'jbuilder'
 group :development do
   gem 'web-console'
   gem 'listen'
-  gem 'spring'
-  gem 'spring-watcher-listen'
 end
 
 group :test do
-  # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
-end
+end

data/gemfiles/Gemfile.rails-8.0

@@ -10,17 +10,12 @@ gem 'devise_token_auth', git: 'https://github.com/lynndylanhurley/devise_token_a
 gem 'sqlite3'
 gem 'puma'
 gem 'sass-rails'
-gem 'turbolinks'
 gem 'jbuilder'
 
 group :development do
   gem 'web-console'
-  gem 'listen'
-  gem 'spring'
-  gem 'spring-watcher-listen'
 end
 
 group :test do
-  # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
-end
+end

data/gemfiles/Gemfile.rails-8.1

@@ -0,0 +1,21 @@
+source 'https://rubygems.org'
+
+gemspec path: '../'
+
+# Bundle Rails
+gem 'rails', '~> 8.1.0'
+# https://github.com/lynndylanhurley/devise_token_auth/pull/1639
+gem 'devise_token_auth', git: 'https://github.com/lynndylanhurley/devise_token_auth.git'
+
+gem 'sqlite3'
+gem 'puma'
+gem 'sass-rails'
+gem 'jbuilder'
+
+group :development do
+  gem 'web-console'
+end
+
+group :test do
+  gem 'coveralls_reborn', require: false
+end

data/lib/chime_sdk/config.rb

@@ -64,6 +64,15 @@ module ChimeSdk
     #   @return [Boolean] Whether the application creates meeting in meetings#index action by HTTP GET request
     attr_accessor :create_meeting_by_get_request
 
+    # @overload verify_meeting_request_id
+    #   Return whether the controllers verify that requested meetings were created with ChimeSdk.config.prefix + meeting_request_id.
+    #   @return [Boolean] Whether the controllers verify that requested meetings were created with ChimeSdk.config.prefix + meeting_request_id
+    # @overload verify_meeting_request_id=(value)
+    #   Set whether the controllers verify that requested meetings were created with ChimeSdk.config.prefix + meeting_request_id.
+    #   @param [Boolean] verify_meeting_request_id The new verify_meeting_request_id
+    #   @return [Boolean] Whether the controllers verify that requested meetings were created with ChimeSdk.config.prefix + meeting_request_id
+    attr_accessor :verify_meeting_request_id
+
     # Initialize configuration for ChimeSdk.
     # These configuration can be overridden in initializer.
     # @return [Config] A new instance of Config
@@ -75,6 +84,7 @@ module ChimeSdk
       @create_meeting_with_attendee  = true
       @create_attendee_from_meeting  = true
       @create_meeting_by_get_request = false
+      @verify_meeting_request_id     = true
     end
   end
 end

data/lib/chime_sdk/controller/attendees.rb

@@ -12,15 +12,17 @@ module ChimeSdk
         end
     
         # GET /meetings/:meeting_id/attendees
+        # Join tokens are omitted since they are credentials of each attendee.
         def index
           list_attendees
-          render json: { attendees: @attendees }
+          render json: { attendees: @attendees.map { |attendee| without_join_token(attendee) } }
         end
 
         # GET /meetings/:meeting_id/attendees/:attendee_id
+        # The join token is omitted since it is a credential of the attendee.
         def show
           get_attendee
-          render json: @attendee
+          render json: without_join_token(@attendee)
         end
 
         # POST /meetings/:meeting_id/attendees
@@ -55,13 +57,25 @@ module ChimeSdk
           params[:id]
         end
 
+        # Unique meeting request id to identify meeting by Amazon Chime.
+        # Configure it depending on your application resources to identify meeting.
+        # For example, set "PrivateRoom-#{@room.id}" by Room model.
+        # Requested meetings are verified with this id when ChimeSdk.config.verify_meeting_request_id is enabled.
+        # @api protected
+        # @return [String] Unique meeting request id to identify meeting by Amazon Chime
+        def meeting_request_id
+          "default"
+        end
+
         # Unique attendee request id to identify attendee by Amazon Chime.
         # Configure it depending on your application resources to identify attendee.
         # For example, set "User-#{current_user.id}" by User model.
+        # Each user must have a different value, since users with the same value join meetings as the same attendee.
         # @api protected
         # @return [String] Unique attendee request id to identify attendee by Amazon Chime
+        # @raise [NotImplementedError] Unless overridden in your controllers
         def attendee_request_id
-          "default"
+          raise NotImplementedError, "Define attendee_request_id in #{self.class.name} to identify each attendee, e.g. \"User-\#{current_user.id}\""
         end
 
         # Path for meetings#index action such as meetings_path.

data/lib/chime_sdk/controller/common.rb

@@ -1,6 +1,9 @@
 module ChimeSdk
   # Controllers implementation by amazon-chime-sdk-rails.
   module Controller
+    # Error raised when the requested meeting is not the meeting identified by meeting_request_id.
+    class MeetingNotFoundError < StandardError; end
+
     # Common implementation for controllers.
     module Common
       extend ActiveSupport::Concern
@@ -9,6 +12,7 @@ module ChimeSdk
         rescue_from Aws::ChimeSDKMeetings::Errors::ForbiddenException, with: :render_forbidden
         rescue_from Aws::ChimeSDKMeetings::Errors::NotFoundException, with: :render_resource_not_found
         rescue_from Aws::ChimeSDKMeetings::Errors::ValidationException, with: :render_resource_not_found
+        rescue_from ChimeSdk::Controller::MeetingNotFoundError, with: :render_resource_not_found
 
         class ::String
           # Convets to boolean.
@@ -51,7 +55,7 @@ module ChimeSdk
       # @api protected
       # @return [Hash] Meeting
       def get_meeting
-        @meeting = ChimeSdk::MeetingCoordinator.get_meeting(meeting_id)
+        @meeting = verify_meeting(ChimeSdk::MeetingCoordinator.get_meeting(meeting_id))
         @meeting = merge_application_meeting_metadata(@meeting)
       end
 
@@ -59,13 +63,43 @@ module ChimeSdk
       # @api protected
       # @return [void]
       def delete_meeting
+        verify_meeting_id
         ChimeSdk::MeetingCoordinator.delete_meeting(meeting_id)
       end
 
+      # Whether to verify that requested meetings were created with ChimeSdk.config.prefix + meeting_request_id.
+      # Override it to change the behavior for each controller.
+      # @api protected
+      # @return [Boolean] Whether to verify requested meetings
+      def verify_meeting_request_id?
+        ChimeSdk.config.verify_meeting_request_id
+      end
+
+      # Verify that the meeting was created with ChimeSdk.config.prefix + meeting_request_id.
+      # @api protected
+      # @param [Hash] meeting Meeting JSON object as hash
+      # @return [Hash] Verified meeting
+      # @raise [ChimeSdk::Controller::MeetingNotFoundError] When the meeting is not the meeting identified by meeting_request_id
+      def verify_meeting(meeting)
+        if verify_meeting_request_id? && meeting.dig(:Meeting, :ExternalMeetingId) != ChimeSdk.config.prefix + meeting_request_id
+          raise ChimeSdk::Controller::MeetingNotFoundError, "Meeting not found"
+        end
+        meeting
+      end
+
+      # Verify the requested meeting by meeting id unless it has already been verified.
+      # @api protected
+      # @return [void]
+      # @raise [ChimeSdk::Controller::MeetingNotFoundError] When the meeting is not the meeting identified by meeting_request_id
+      def verify_meeting_id
+        verify_meeting(ChimeSdk::MeetingCoordinator.get_meeting(meeting_id)) if @meeting.nil? && verify_meeting_request_id?
+      end
+
       # List attendees by MeetingCoordinator.
       # @api protected
       # @return [Array<Hash>] Attendee list
       def list_attendees
+        verify_meeting_id
         @attendees = ChimeSdk::MeetingCoordinator.list_attendees(meeting_id)
         @attendees = @attendees.map { |attendee| merge_application_attendee_metadata(attendee) }
       end
@@ -74,6 +108,7 @@ module ChimeSdk
       # @api protected
       # @return [Hash] Created attendee
       def create_attendee
+        verify_meeting_id
         @attendee = ChimeSdk::MeetingCoordinator.create_attendee(meeting_id, attendee_request_id)
         @attendee = merge_application_attendee_metadata(@attendee)
       end
@@ -82,6 +117,7 @@ module ChimeSdk
       # @api protected
       # @return [Hash] Attendee
       def get_attendee
+        verify_meeting_id
         @attendee = ChimeSdk::MeetingCoordinator.get_attendee(meeting_id, attendee_id)
         @attendee = merge_application_attendee_metadata(@attendee)
       end
@@ -90,6 +126,7 @@ module ChimeSdk
       # @api protected
       # @return [void]
       def delete_attendee
+        verify_meeting_id
         ChimeSdk::MeetingCoordinator.delete_attendee(meeting_id, attendee_id)
       end
 
@@ -154,6 +191,15 @@ module ChimeSdk
         attendee
       end
 
+      # Return attendee without its join token.
+      # Join token is a credential to join the meeting as the attendee and must not be returned to other users.
+      # @api protected
+      # @param [Hash] attendee Attendee JSON object as hash
+      # @return [Hash] Attendee without join token
+      def without_join_token(attendee)
+        attendee.merge(Attendee: attendee[:Attendee].except(:JoinToken))
+      end
+
       # Returns error response as Hash
       # @api protected
       # @return [Hash] Error message

data/lib/chime_sdk/controller/meetings.rb

@@ -16,9 +16,9 @@ module ChimeSdk
         # GET /meetings.json
         # @overload index(params)
         #   @param [Hash] params Request parameter options
-        #   @option params [String] :create_meeting (ChimeSdk.config.create_meeting_by_get_request) Whether the application creates meeting in this meetings#index action by HTTP GET request
+        #   @option params [String] :create_meeting (ChimeSdk.config.create_meeting_by_get_request) Whether the application creates meeting in this meetings#index action by HTTP GET request. This parameter can only disable it since GET requests are not protected from CSRF.
         def index
-          if params[:create_meeting].to_s.to_boolean(false) || ChimeSdk.config.create_meeting_by_get_request && params[:create_meeting].to_s.to_boolean(true)
+          if ChimeSdk.config.create_meeting_by_get_request && params[:create_meeting].to_s.to_boolean(true)
             create
           else
             @meeting_request_id = ChimeSdk.config.prefix + meeting_request_id
@@ -34,10 +34,10 @@ module ChimeSdk
         # GET /meetings/:meeting_id.json
         # @overload show(params)
         #   @param [Hash] params Request parameter options
-        #   @option params [String] :create_attendee_from_meeting (ChimeSdk.config.create_attendee_from_meeting) Whether the application creates attendee from meeting in meetings#show action
+        #   @option params [String] :create_attendee_from_meeting (ChimeSdk.config.create_attendee_from_meeting) Whether the application creates attendee from meeting in meetings#show action. This parameter can only disable it since GET requests are not protected from CSRF.
         def show
           get_meeting
-          if params[:create_attendee_from_meeting].to_s.to_boolean(false) || ChimeSdk.config.create_attendee_from_meeting && params[:create_attendee_from_meeting].to_s.to_boolean(true)
+          if ChimeSdk.config.create_attendee_from_meeting && params[:create_attendee_from_meeting].to_s.to_boolean(true)
             create_attendee_from_meeting
           end
           respond_to do |format|
@@ -97,10 +97,12 @@ module ChimeSdk
         # Unique attendee request id to identify attendee by Amazon Chime.
         # Configure it depending on your application resources to identify attendee.
         # For example, set "User-#{current_user.id}" by User model.
+        # Each user must have a different value, since users with the same value join meetings as the same attendee.
         # @api protected
         # @return [String] Unique attendee request id to identify attendee by Amazon Chime
+        # @raise [NotImplementedError] Unless overridden in your controllers
         def attendee_request_id
-          "default"
+          raise NotImplementedError, "Define attendee_request_id in #{self.class.name} to identify each attendee, e.g. \"User-\#{current_user.id}\""
         end
 
         # Path for meetings#index action such as meetings_path.

data/lib/chime_sdk/version.rb

@@ -1,4 +1,4 @@
 module ChimeSdk
   # Gem version of amazon-chime-sdk-rails
-  VERSION = "2.0.1"
+  VERSION = "2.2.0"
 end

data/lib/generators/chime_sdk/js_generator.rb

@@ -4,13 +4,17 @@ module ChimeSdk
   module Generators
     # Amazon Chime SDK single .js file generator.
     # Bundle Amazon Chime SDK into single amazon-chime-sdk.min.js file and copy it to app/assets/javascripts directory.
-    # @example Run Amazon Chime SDK single .js file generator with the latest version from master branch
+    # @example Run Amazon Chime SDK single .js file generator with the version in the pinned singlejs package.json
     #   rails generate chime_sdk:js
     # @example Run Amazon Chime SDK single .js file generator with specified version
     #   rails generate chime_sdk:js 2.24.0
     # @see https://github.com/aws-samples/amazon-chime-sdk/tree/main/utils/singlejs
     # @see https://www.npmjs.com/package/amazon-chime-sdk-js
     class JsGenerator < Rails::Generators::Base
+      # Commit of aws-samples/amazon-chime-sdk repository to build the single .js file from.
+      # Pinned since the generator runs npm scripts in the cloned repository.
+      SINGLEJS_REPOSITORY_COMMIT = "6abe76a732c1fce4cce9d2dbbf28946482ac203e"
+
       desc <<-DESC.strip_heredoc
         Bundle Amazon Chime SDK into single amazon-chime-sdk.min.js file and copy it to app/assets/javascripts directory.
 
@@ -76,6 +80,7 @@ module ChimeSdk
         system "mkdir -p tmp"
         puts "Cloning into 'amazon-chime-sdk-js' git repository in tmp directory ..."
         system "cd tmp; git clone https://github.com/aws-samples/amazon-chime-sdk.git > /dev/null 2>&1"
+        system "cd tmp/amazon-chime-sdk; git -c advice.detachedHead=false checkout #{SINGLEJS_REPOSITORY_COMMIT} > /dev/null 2>&1"
         repository_path = "tmp/amazon-chime-sdk"
         singlejs_path = "#{repository_path}/utils/singlejs"
         package_json_path = "#{singlejs_path}/package.json"