amazon-chime-sdk-rails 2.0.1 → 2.2.0

data/lib/generators/templates/chime_sdk.rb

@@ -22,4 +22,9 @@ ChimeSdk.configure do |config|
 
   # Configure whether the application creates meeting in meetings#index action by HTTP GET request.
   config.create_meeting_by_get_request = false
+
+  # Configure whether the controllers verify that requested meetings were created with config.prefix + meeting_request_id.
+  # When enabled, meetings and attendees controllers respond with 404 for meetings of other resources, such as other private rooms.
+  # Default value is true. Disabling it allows any meeting in your AWS account to be accessed by its meeting id.
+  config.verify_meeting_request_id = true
 end

data/lib/generators/templates/controllers/meeting_attendees_controller.rb

@@ -23,14 +23,26 @@ class <%= @namespace %><%= @class_name_prefix %>MeetingAttendeesController < App
   #   params[:id]
   # end
 
+  # Unique meeting request id to identify meeting by Amazon Chime.
+  # Configure it depending on your application resources to identify meeting.
+  # For example, set "PrivateRoom-#{@room.id}" by Room model.
+  # Use the same value as your meetings controller since requested meetings are verified with this id.
+  # @api protected
+  # @return [String] Unique meeting request id to identify meeting by Amazon Chime
+  def meeting_request_id
+    # "PrivateRoom-#{@room.id}"
+    "<%= @default_meeting_request_id %>"
+  end
+
   # Unique attendee request id to identify attendee by Amazon Chime.
   # Configure it depending on your application resources to identify attendee.
   # For example, set "User-#{current_user.id}" by User model.
+  # Each user must have a different value, since users with the same value join meetings as the same attendee.
   # @api protected
   # @return [String] Unique attendee request id to identify attendee by Amazon Chime
   def attendee_request_id
     # "User-#{current_user.id}"
-    "default"
+    raise NotImplementedError, "Define attendee_request_id in #{self.class.name} to identify each attendee, e.g. \"User-\#{current_user.id}\""
   end
 
   # Path for meetings#index action such as meetings_path.

data/lib/generators/templates/controllers/meetings_controller.rb

@@ -28,11 +28,12 @@ class <%= @namespace %><%= @class_name_prefix %>MeetingsController < Application
   # Unique attendee request id to identify attendee by Amazon Chime.
   # Configure it depending on your application resources to identify attendee.
   # For example, set "User-#{current_user.id}" by User model.
+  # Each user must have a different value, since users with the same value join meetings as the same attendee.
   # @api protected
   # @return [String] Unique attendee request id to identify attendee by Amazon Chime
   def attendee_request_id
     # "User-#{current_user.id}"
-    "default"
+    raise NotImplementedError, "Define attendee_request_id in #{self.class.name} to identify each attendee, e.g. \"User-\#{current_user.id}\""
   end
 
   # Path for meetings#index action such as meetings_path.

data/lib/generators/templates/views/meetings/show.html.erb

@@ -38,7 +38,6 @@
 <% end %>
 
 <%= javascript_include_tag "amazon-chime-sdk.min.js" %>
-<script src="https://unpkg.com/axios/dist/axios.min.js"></script>
 
 <script defer>
   // This is a very simple script as a template view using Amazon Chime SDK.
@@ -63,9 +62,16 @@
   const configuration = new ChimeSDK.MeetingSessionConfiguration(meeting, attendee);
   const meetingSession = new ChimeSDK.DefaultMeetingSession(configuration, logger, deviceController);
 
-  const attendeeApi = axios.create({
-    baseURL: `${attendeeResourcesPath}/`
-  });
+  async function getAttendee(attendeeId) {
+    const response = await fetch(`${attendeeResourcesPath}/${encodeURIComponent(attendeeId)}`, {
+      headers: { 'Accept': 'application/json' },
+      credentials: 'same-origin'
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to get attendee: ${response.status}`);
+    }
+    return response.json();
+  }
 
   async function join() {
     try {
@@ -109,9 +115,9 @@
     const presentAttendeeMap = {};
     const callback = (presentAttendeeId, present) => {
       if (present) {
-        attendeeApi.get(presentAttendeeId)
-          .then(response => {
-            presentAttendeeMap[presentAttendeeId] = response.data;
+        getAttendee(presentAttendeeId)
+          .then(attendee => {
+            presentAttendeeMap[presentAttendeeId] = attendee;
             updateAttendeeStatus(presentAttendeeMap);
           })
           .catch(error => {
@@ -126,11 +132,15 @@
   }
 
   function updateAttendeeStatus(presentAttendeeMap) {
-    presentAttendees = "<strong>Present Attendees</strong><ul>";
+    // Use textContent since attendee names are user-provided values
+    const title = document.createElement('strong');
+    title.textContent = 'Present Attendees';
+    const list = document.createElement('ul');
     Object.values(presentAttendeeMap).forEach(attendee => {
-      presentAttendees = presentAttendees + `<li>${showApplicationUserName(attendee)}</li>`
+      const item = document.createElement('li');
+      item.textContent = showApplicationUserName(attendee);
+      list.appendChild(item);
     });
-    presentAttendees = presentAttendees + '</ul>'
-    document.getElementById("attendee-status").innerHTML = presentAttendees;
+    document.getElementById("attendee-status").replaceChildren(title, list);
   }
 </script>

data/spec/generators/controllers_generator_spec.rb

@@ -29,6 +29,8 @@ describe ChimeSdk::Generators::ControllersGenerator, type: :generator do
         it { is_expected.to exist }
         it { is_expected.to contain(/class MeetingAttendeesController < ApplicationController/) }
         it { is_expected.to contain(" meetings_path(params)\n") }
+        it { is_expected.to contain("  def meeting_request_id\n    # \"PrivateRoom-\#{@room.id}\"\n    \"default\"\n") }
+        it { is_expected.to contain("  def attendee_request_id\n    # \"User-\#{current_user.id}\"\n    raise NotImplementedError") }
       end
     end
 

data/spec/rails_app/app/assets/javascripts/application.js

@@ -1,3 +1 @@
-//= require rails-ujs
-//= require turbolinks
-//= require_tree .
+//= require_tree .

data/spec/rails_app/app/controllers/api/public/meeting_attendees_controller.rb

@@ -8,4 +8,10 @@ class Api::Public::MeetingAttendeesController < ApplicationController
       "User": User.find_by_id(user_id)
     }
   end
+
+  # This public API for the React Meeting Demo accepts any meeting in the AWS account by its meeting id.
+  # Do not disable this verification in your applications unless you authorize access to meetings by yourself.
+  def verify_meeting_request_id?
+    false
+  end
 end

data/spec/rails_app/app/controllers/api/public/meetings_controller.rb

@@ -12,4 +12,10 @@ class Api::Public::MeetingsController < ApplicationController
       "PrivateRoom": Room.find_by_id(room_id)
     }
   end
+
+  # This public API for the React Meeting Demo accepts any meeting in the AWS account by its meeting id.
+  # Do not disable this verification in your applications unless you authorize access to meetings by yourself.
+  def verify_meeting_request_id?
+    false
+  end
 end

data/spec/rails_app/app/controllers/meeting_attendees_controller.rb

@@ -39,6 +39,16 @@ class MeetingAttendeesController < ApplicationController
   #   params[:id]
   # end
 
+  # Unique meeting request id to identify meeting by Amazon Chime.
+  # Configure it depending on your application resources to identify meeting.
+  # For example, set "PrivateRoom-#{@room.id}" by Room model.
+  # Use the same value as your meetings controller since requested meetings are verified with this id.
+  # @api protected
+  # @return [String] Unique meeting request id to identify meeting by Amazon Chime
+  def meeting_request_id
+    "PrivateRoom-#{@room.id}"
+  end
+
   # Unique attendee request id to identify attendee by Amazon Chime.
   # Configure it depending on your application resources to identify attendee.
   # For example, set "User-#{current_user.id}" by User model.

data/spec/rails_app/app/views/layouts/application.html.erb

@@ -4,8 +4,8 @@
     <title>Rails Application for Amazon Chime SDK Meeting</title>
     <%= csrf_meta_tags %>
 
-    <%= stylesheet_link_tag 'application', media: 'all', 'data-turbolinks-track': 'reload' %>
-    <%= javascript_include_tag 'application', 'data-turbolinks-track': 'reload' %>
+    <%= stylesheet_link_tag 'application', media: 'all' %>
+    <%= javascript_include_tag 'application' %>
   </head>
 
   <body>

data/spec/rails_app/app/views/meetings/show.html.erb

@@ -43,7 +43,6 @@
 <% end %>
 
 <%= javascript_include_tag "amazon-chime-sdk.min.js" %>
-<script src="https://unpkg.com/axios/dist/axios.min.js"></script>
 
 <script defer>
   // This is a very simple script as a template view using Amazon Chime SDK.
@@ -75,9 +74,16 @@
   const configuration = new ChimeSDK.MeetingSessionConfiguration(meeting, attendee);
   const meetingSession = new ChimeSDK.DefaultMeetingSession(configuration, logger, deviceController);
 
-  const attendeeApi = axios.create({
-    baseURL: `${attendeeResourcesPath}/`
-  });
+  async function getAttendee(attendeeId) {
+    const response = await fetch(`${attendeeResourcesPath}/${encodeURIComponent(attendeeId)}`, {
+      headers: { 'Accept': 'application/json' },
+      credentials: 'same-origin'
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to get attendee: ${response.status}`);
+    }
+    return response.json();
+  }
 
   async function join() {
     try {
@@ -121,9 +127,9 @@
     const presentAttendeeMap = {};
     const callback = (presentAttendeeId, present) => {
       if (present) {
-        attendeeApi.get(presentAttendeeId)
-          .then(response => {
-            presentAttendeeMap[presentAttendeeId] = response.data;
+        getAttendee(presentAttendeeId)
+          .then(attendee => {
+            presentAttendeeMap[presentAttendeeId] = attendee;
             updateAttendeeStatus(presentAttendeeMap);
           })
           .catch(error => {
@@ -138,11 +144,15 @@
   }
 
   function updateAttendeeStatus(presentAttendeeMap) {
-    presentAttendees = "<strong>Present Attendees</strong><ul>";
+    // Use textContent since attendee names are user-provided values
+    const title = document.createElement('strong');
+    title.textContent = 'Present Attendees';
+    const list = document.createElement('ul');
     Object.values(presentAttendeeMap).forEach(attendee => {
-      presentAttendees = presentAttendees + `<li>${showApplicationUserName(attendee)}</li>`
+      const item = document.createElement('li');
+      item.textContent = showApplicationUserName(attendee);
+      list.appendChild(item);
     });
-    presentAttendees = presentAttendees + '</ul>'
-    document.getElementById("attendee-status").innerHTML = presentAttendees;
+    document.getElementById("attendee-status").replaceChildren(title, list);
   }
 </script>

data/spec/rails_app/app/views/rooms/show.html.erb

@@ -8,11 +8,7 @@
 <p>
   <strong>Private Meeting:</strong>
   <p><%= link_to 'Show Meetings Index', room_meetings_path(@room) %></p>
-  <p>
-    Create Meeting
-    <%= link_to 'GET', room_meetings_path(@room, create_meeting: true) %>
-    <%= link_to 'POST', room_meetings_path(@room), method: :post %>
-  </p>
+  <p><%= link_to 'Create Meeting', room_meetings_path(@room), method: :post %></p>
 </p>
 
 <p>

data/spec/rails_app/config/environments/test.rb

@@ -26,7 +26,11 @@ Rails.application.configure do
   config.cache_store = :null_store
 
   # Raise exceptions instead of rendering exception templates.
-  config.action_dispatch.show_exceptions = false
+  if Rails::VERSION::MAJOR >= 8 || (Rails::VERSION::MAJOR == 7 && Rails::VERSION::MINOR >= 1)
+    config.action_dispatch.show_exceptions = :rescuable
+  else
+    config.action_dispatch.show_exceptions = false
+  end
 
   # Disable request forgery protection in test environment.
   config.action_controller.allow_forgery_protection = false
@@ -44,6 +48,9 @@ Rails.application.configure do
   # Print deprecation notices to the stderr.
   config.active_support.deprecation = :stderr
 
+  # Do not check if assets exist before linking to them.
+  config.assets.check_precompiled_asset = false if config.respond_to?(:assets) && config.assets.respond_to?(:check_precompiled_asset=)
+
   # Raises error for missing translations.
   # config.action_view.raise_on_missing_translations = true
 end

data/spec/requests/atendees_spec.rb

@@ -4,8 +4,10 @@ describe ChimeSdk::Controller::Attendees, type: :request do
     @attendee_id       = "76543210-ba98-fedc-jihg-vutsrqponmlk"
     @dummy_meeting_id  = "91234567-89ab-cdef-ghij-klmnopqrstuv"
     @dummy_attendee_id = "96543210-ba98-fedc-jihg-vutsrqponmlk"
+    @other_meeting_id  = "81234567-89ab-cdef-ghij-klmnopqrstuv"
 
     @room = create(:room)
+    @other_room = create(:room)
     @attendee_user = create(:user)
     @room.add_member(@attendee_user)
     test_attendee = {
@@ -29,8 +31,24 @@ describe ChimeSdk::Controller::Attendees, type: :request do
       }
     }
 
+    meeting_of = -> (meeting_id, room) {
+      {
+        meeting_id: meeting_id,
+        external_meeting_id: "ChimeSdkRailsApp-test-PrivateRoom-#{room.id}",
+        media_region: "us-east-1",
+        media_placement: { audio_host_url: "dummy" }
+      }
+    }
+
     # Use stubs for the AWS SDK for Ruby
     client = Aws::ChimeSDKMeetings::Client.new(stub_responses: true)
+    client.stub_responses(:get_meeting, -> (context) {
+      case context.params[:meeting_id]
+      when @meeting_id then { meeting: meeting_of.(@meeting_id, @room) }
+      when @other_meeting_id then { meeting: meeting_of.(@other_meeting_id, @other_room) }
+      else 'ForbiddenException'
+      end
+    })
     client.stub_responses(:list_attendees, {
       attendees: [ test_attendee, dummy_attendee ]
     })
@@ -109,6 +127,12 @@ describe ChimeSdk::Controller::Attendees, type: :request do
           it "returns valid attendee in the list" do
             expect(JSON.parse(response.body)["attendees"][0]["Attendee"]["AttendeeId"]).to eq(@attendee_id)
           end
+
+          it "does not return join tokens of attendees in the list" do
+            JSON.parse(response.body)["attendees"].each do |attendee|
+              expect(attendee["Attendee"]).not_to have_key("JoinToken")
+            end
+          end
         end
 
         describe "GET /meetings/:meeting_id/attendees/:attendee_id" do
@@ -125,6 +149,10 @@ describe ChimeSdk::Controller::Attendees, type: :request do
               expect(JSON.parse(response.body)["Attendee"]["AttendeeId"]).to eq(@attendee_id)
             end
 
+            it "does not return join token of the attendee" do
+              expect(JSON.parse(response.body)["Attendee"]).not_to have_key("JoinToken")
+            end
+
             it "returns application metadata in the attendee" do
               expect(JSON.parse(response.body)["Attendee"]["ApplicationMetadata"]["User"]["id"]).to eq(@attendee_user.id)
             end
@@ -165,6 +193,34 @@ describe ChimeSdk::Controller::Attendees, type: :request do
           end
         end
 
+        context "when the meeting belongs to another private room" do
+          let(:other_meeting_path) { "#{api_path}/meetings/#{@other_meeting_id}" }
+
+          it "returns response with 404 status to GET /meetings/:meeting_id/attendees" do
+            expect(ChimeSdk::MeetingCoordinator).not_to receive(:list_attendees)
+            get "#{other_meeting_path}/attendees", headers: @auth_headers
+            expect(response).to have_http_status(404)
+          end
+
+          it "returns response with 404 status to GET /meetings/:meeting_id/attendees/:attendee_id" do
+            expect(ChimeSdk::MeetingCoordinator).not_to receive(:get_attendee)
+            get "#{other_meeting_path}/attendees/#{@attendee_id}", headers: @auth_headers
+            expect(response).to have_http_status(404)
+          end
+
+          it "returns response with 404 status to POST /meetings/:meeting_id/attendees" do
+            expect(ChimeSdk::MeetingCoordinator).not_to receive(:create_attendee)
+            post "#{other_meeting_path}/attendees", headers: @auth_headers
+            expect(response).to have_http_status(404)
+          end
+
+          it "returns response with 404 status to DELETE /meetings/:meeting_id/attendees/:attendee_id" do
+            expect(ChimeSdk::MeetingCoordinator).not_to receive(:delete_attendee)
+            delete "#{other_meeting_path}/attendees/#{@attendee_id}", headers: @auth_headers
+            expect(response).to have_http_status(404)
+          end
+        end
+
         describe "DELETE /meetings/:meeting_id/attendees/:attendee_id" do
           context "when the attendee is found" do
             before do

data/spec/requests/meetings_spec.rb

@@ -3,8 +3,10 @@ describe ChimeSdk::Controller::Meetings, type: :request do
     @meeting_id       = "01234567-89ab-cdef-ghij-klmnopqrstuv"
     @attendee_id      = "76543210-ba98-fedc-jihg-vutsrqponmlk"
     @dummy_meeting_id = "91234567-89ab-cdef-ghij-klmnopqrstuv"
+    @other_meeting_id = "81234567-89ab-cdef-ghij-klmnopqrstuv"
 
     @room = create(:room)
+    @other_room = create(:room)
     dummy_media_placement = {
       audio_host_url: "dummy",
       audio_fallback_url: "dummy",
@@ -51,10 +53,19 @@ describe ChimeSdk::Controller::Meetings, type: :request do
       meeting_arn: "arn:aws:chime:us-east-1:000000000000:meeting/#{@meeting_id}"
     }
 
+    other_room_meeting = test_meeting.merge(
+      meeting_id: @other_meeting_id,
+      external_meeting_id: "ChimeSdkRailsApp-test-PrivateRoom-#{@other_room.id}"
+    )
+
     # Use stubs for the AWS SDK for Ruby
     client = Aws::ChimeSDKMeetings::Client.new(stub_responses: true)
     client.stub_responses(:get_meeting, -> (context) {
-      context.params[:meeting_id] == @meeting_id ? { meeting: test_meeting } : 'NotFoundException'
+      case context.params[:meeting_id]
+      when @meeting_id then { meeting: test_meeting }
+      when @other_meeting_id then { meeting: other_room_meeting }
+      else 'NotFoundException'
+      end
     })
     client.stub_responses(:create_meeting, {
       meeting: test_meeting
@@ -131,18 +142,37 @@ describe ChimeSdk::Controller::Meetings, type: :request do
             end
           end
 
-          context "with true as create_meeting parameter" do
+          context "with true as create_meeting parameter and ChimeSdk.config.create_meeting_by_get_request is disabled" do
             before do
               get "#{api_path}/meetings", headers: @auth_headers, params: { create_meeting: true }
             end
 
-            it "returns response with 201 status" do
-              expect(response).to have_http_status(201)
+            it "does not create meeting" do
+              expect(response).to have_http_status(200)
+              expect(JSON.parse(response.body)["Meeting"]).to be_nil
             end
+          end
 
-            it "returns created meeting" do
+          context "when ChimeSdk.config.create_meeting_by_get_request is enabled" do
+            before do
+              ChimeSdk.config.create_meeting_by_get_request = true
+            end
+
+            after do
+              ChimeSdk.config.create_meeting_by_get_request = false
+            end
+
+            it "returns created meeting with 201 status" do
+              get "#{api_path}/meetings", headers: @auth_headers
+              expect(response).to have_http_status(201)
               expect(JSON.parse(response.body)["Meeting"]["MeetingId"]).to eq(@meeting_id)
             end
+
+            it "does not create meeting with false as create_meeting parameter" do
+              get "#{api_path}/meetings", headers: @auth_headers, params: { create_meeting: false }
+              expect(response).to have_http_status(200)
+              expect(JSON.parse(response.body)["Meeting"]).to be_nil
+            end
           end
         end
 
@@ -178,6 +208,52 @@ describe ChimeSdk::Controller::Meetings, type: :request do
               expect(response).to have_http_status(404)
             end
           end
+
+          context "with true as create_attendee_from_meeting parameter and ChimeSdk.config.create_attendee_from_meeting is disabled" do
+            before do
+              ChimeSdk.config.create_attendee_from_meeting = false
+              get "#{api_path}/meetings/#{@meeting_id}", params: { create_attendee_from_meeting: true }, headers: @auth_headers
+            end
+
+            after do
+              ChimeSdk.config.create_attendee_from_meeting = true
+            end
+
+            it "does not create attendee" do
+              expect(response).to have_http_status(200)
+              expect(JSON.parse(response.body)["Attendee"]).to be_nil
+            end
+          end
+
+          context "when the meeting belongs to another private room" do
+            before do
+              get "#{api_path}/meetings/#{@other_meeting_id}", headers: @auth_headers
+            end
+
+            it "returns response with 404 status" do
+              expect(response).to have_http_status(404)
+            end
+
+            it "does not return the meeting" do
+              expect(JSON.parse(response.body)["Meeting"]).to be_nil
+            end
+          end
+
+          context "when the meeting belongs to another private room and ChimeSdk.config.verify_meeting_request_id is disabled" do
+            before do
+              ChimeSdk.config.verify_meeting_request_id = false
+              get "#{api_path}/meetings/#{@other_meeting_id}", params: { create_attendee_from_meeting: false }, headers: @auth_headers
+            end
+
+            after do
+              ChimeSdk.config.verify_meeting_request_id = true
+            end
+
+            it "returns the meeting" do
+              expect(response).to have_http_status(200)
+              expect(JSON.parse(response.body)["Meeting"]["MeetingId"]).to eq(@other_meeting_id)
+            end
+          end
         end
 
         describe "POST /meetings" do
@@ -243,6 +319,14 @@ describe ChimeSdk::Controller::Meetings, type: :request do
               expect(response).to have_http_status(404)
             end
           end
+
+          context "when the meeting belongs to another private room" do
+            it "returns response with 404 status without deleting the meeting" do
+              expect(ChimeSdk::MeetingCoordinator).not_to receive(:delete_meeting)
+              delete "#{api_path}/meetings/#{@other_meeting_id}", headers: @auth_headers
+              expect(response).to have_http_status(404)
+            end
+          end
         end
       end
     end
@@ -310,16 +394,29 @@ describe ChimeSdk::Controller::Meetings, type: :request do
             end
           end
 
-          context "with true as create_meeting parameter" do
+          context "with true as create_meeting parameter and ChimeSdk.config.create_meeting_by_get_request is disabled" do
             before do
               get "#{api_path}/meetings", params: { create_meeting: true }
             end
 
-            it "returns response with 302 status" do
-              expect(response).to have_http_status(302)
+            it "does not create meeting" do
+              expect(response).to have_http_status(200)
+              expect(response.body).to include("Meetings by Amazon Chime SDK")
+            end
+          end
+
+          context "when ChimeSdk.config.create_meeting_by_get_request is enabled" do
+            before do
+              ChimeSdk.config.create_meeting_by_get_request = true
+              get "#{api_path}/meetings"
+            end
+
+            after do
+              ChimeSdk.config.create_meeting_by_get_request = false
             end
 
             it "redirects to created meeting path" do
+              expect(response).to have_http_status(302)
               expect(response.body).to redirect_to("#{api_path}/meetings/#{@meeting_id}")
             end
           end