amazon-chime-sdk-rails 2.1.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a4ee22a82debfa8f285e8516c9b6f80bc82be4cd26ed45dd65d7ea2e05170f8
-  data.tar.gz: fcf6109a79b1ca6535b10fbcf51994708a80409601daade46b2fa10cfd9a22e0
+  metadata.gz: 168cdb6149788c0f8499ae2499df0f0d2a5590dacccaf0eed854704e91f7d3e6
+  data.tar.gz: a7d0c20d4a39929afe2b60b0c0b01f74181ab0807c5c27d76f2cc98a5a1760fe
 SHA512:
-  metadata.gz: 3a153f6055287f2eb6d20e44012afb50ed0a6554be21d2563dc1a0955f943cf053e1d64b73ac086721dec83b9bdda3473dfeef51b5d817f1f347548b90c7c1c9
-  data.tar.gz: 99466f46ccd52dcce9c71dcaca1422b96af51ff68023bc41b529f3401a09c8b5368e0db93df2c05dd5ad25d8b9b87d67d19469a113017bbdc2d054b238a92942
+  metadata.gz: e1be855d627474e0382b628578a70457beeff4b2f0f3400d107f35d99dc7e8a31020163137fc6e186eb4ff67754b17b957a16d809e0f6c751ecb563e198167d0
+  data.tar.gz: 2ce6405a5317f87052777b3830c844e6e5dd5702c2fa14ce1ff425ab04de70f6c69778d624d0268dec08d356ab801f148c7c64471ae4c04d39028780769f0141

data/.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Actions are pinned to commit SHAs; this keeps the pins current.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

data/.github/workflows/build.yml

@@ -15,6 +15,9 @@ env:
   # https://nodejs.org/en/about/previous-releases
   node-version: 24.x
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -48,14 +51,14 @@ jobs:
       BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gemfile }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         with:
           ruby-version: ${{ matrix.ruby-version }}
           bundler-cache: true
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.node-version }}
       - name: Prepare test application

data/CHANGELOG.md

@@ -1,3 +1,18 @@
+## 2.2.0 / 2026-10-28
+[Full Changelog](http://github.com/simukappu/amazon-chime-sdk-rails/compare/v2.1.0...v2.2.0)
+
+Security Fixes:
+
+* Verify that requested meetings belong to the requesting resource. Meetings and attendees controllers now respond with 404 when the meeting's `ExternalMeetingId` is not `config.prefix + meeting_request_id`, so users can no longer get, delete, or join meetings of other resources (such as other private rooms) by meeting ID
+  * Attendees controllers must now define `meeting_request_id` with the same value as the meetings controller. The generated attendees controller template includes it
+  * Set `config.verify_meeting_request_id = false`, or override `verify_meeting_request_id?` in a controller, to restore the previous behavior
+* Do not return `JoinToken` from attendees `index` and `show` actions. A join token is the credential to join a meeting as that attendee, so other participants could impersonate the attendee
+* Do not create meetings or attendees by HTTP GET request parameters. `create_meeting` in meetings `index` and `create_attendee_from_meeting` in meetings `show` can now only disable the creation enabled by `config.create_meeting_by_get_request` and `config.create_attendee_from_meeting`, since GET requests are not protected from CSRF
+* Raise `NotImplementedError` from `attendee_request_id` unless it is defined in your controllers. The previous default `"default"` made every user join meetings as the same attendee with the same join token. The generated controller templates also raise it until you define `attendee_request_id`
+* Build the attendee list in the generated meeting view with `textContent` instead of `innerHTML`, so attendee names from application metadata cannot inject HTML
+* Remove the unpinned axios script loaded from unpkg in the generated meeting view and use `fetch` instead
+* Pin the aws-samples/amazon-chime-sdk commit that `rails g chime_sdk:js` clones and runs npm scripts in
+
 ## 2.1.0 / 2026-04-11
 [Full Changelog](http://github.com/simukappu/amazon-chime-sdk-rails/compare/v2.0.1...v2.1.0)
 

data/README.md

@@ -1,10 +1,10 @@
 # amazon-chime-sdk-rails
 
-[![Build Status](https://github.com/simukappu/amazon-chime-sdk-rails/actions/workflows/build.yml/badge.svg)](https://github.com/simukappu/amazon-chime-sdk-rails/actions/workflows/build.yml)
-[![Coverage Status](https://coveralls.io/repos/github/simukappu/amazon-chime-sdk-rails/badge.svg?branch=master)](https://coveralls.io/github/simukappu/amazon-chime-sdk-rails?branch=master)
 [![Gem Version](https://badge.fury.io/rb/amazon-chime-sdk-rails.svg)](https://rubygems.org/gems/amazon-chime-sdk-rails)
 [![Gem Downloads](https://img.shields.io/gem/dt/amazon-chime-sdk-rails.svg)](https://rubygems.org/gems/amazon-chime-sdk-rails)
-[![MIT License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](LICENSE)
+[![Build Status](https://github.com/simukappu/amazon-chime-sdk-rails/actions/workflows/build.yml/badge.svg)](https://github.com/simukappu/amazon-chime-sdk-rails/actions/workflows/build.yml)
+[![Coverage Status](https://coveralls.io/repos/github/simukappu/amazon-chime-sdk-rails/badge.svg?branch=master)](https://coveralls.io/github/simukappu/amazon-chime-sdk-rails?branch=master)
+[![License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](LICENSE)
 
 *amazon-chime-sdk-rails* brings server-side implementation of [Amazon Chime SDK](https://aws.amazon.com/chime/chime-sdk) to your [Ruby on Rails](https://rubyonrails.org) application. [Amazon Chime SDK](https://aws.amazon.com/chime/chime-sdk) provides client-side implementation to build real-time communications for your application, and *amazon-chime-sdk-rails* enables you to easily add server-side implementation to your Rails application.
 

data/docs/Develop_Rails_API_Application.md

@@ -185,7 +185,7 @@ class Api::MeetingsController < ApplicationController
     "PrivateRoom-#{@room.id}"
   end
 
-  # Uncomment and update
+  # Update (replace raise NotImplementedError)
   def attendee_request_id
     "User-#{current_api_user.id}"
   end
@@ -234,7 +234,12 @@ class Api::MeetingAttendeesController < ApplicationController
     end
   end
 
-  # Uncomment and update
+  # Uncomment (use the same value as your meetings controller)
+  def meeting_request_id
+    "PrivateRoom-#{@room.id}"
+  end
+
+  # Update (replace raise NotImplementedError)
   def attendee_request_id
     "User-#{current_api_user.id}"
   end

data/docs/Develop_Rails_View_Application.md

@@ -251,7 +251,7 @@ class MeetingsController < ApplicationController
     "PrivateRoom-#{@room.id}"
   end
 
-  # Uncomment
+  # Update (replace raise NotImplementedError)
   def attendee_request_id
     "User-#{current_user.id}"
   end
@@ -299,7 +299,12 @@ class MeetingAttendeesController < ApplicationController
     end
   end
 
-  # Uncomment
+  # Uncomment (use the same value as your meetings controller)
+  def meeting_request_id
+    "PrivateRoom-#{@room.id}"
+  end
+
+  # Update (replace raise NotImplementedError)
   def attendee_request_id
     "User-#{current_user.id}"
   end

data/lib/chime_sdk/config.rb

@@ -64,6 +64,15 @@ module ChimeSdk
     #   @return [Boolean] Whether the application creates meeting in meetings#index action by HTTP GET request
     attr_accessor :create_meeting_by_get_request
 
+    # @overload verify_meeting_request_id
+    #   Return whether the controllers verify that requested meetings were created with ChimeSdk.config.prefix + meeting_request_id.
+    #   @return [Boolean] Whether the controllers verify that requested meetings were created with ChimeSdk.config.prefix + meeting_request_id
+    # @overload verify_meeting_request_id=(value)
+    #   Set whether the controllers verify that requested meetings were created with ChimeSdk.config.prefix + meeting_request_id.
+    #   @param [Boolean] verify_meeting_request_id The new verify_meeting_request_id
+    #   @return [Boolean] Whether the controllers verify that requested meetings were created with ChimeSdk.config.prefix + meeting_request_id
+    attr_accessor :verify_meeting_request_id
+
     # Initialize configuration for ChimeSdk.
     # These configuration can be overridden in initializer.
     # @return [Config] A new instance of Config
@@ -75,6 +84,7 @@ module ChimeSdk
       @create_meeting_with_attendee  = true
       @create_attendee_from_meeting  = true
       @create_meeting_by_get_request = false
+      @verify_meeting_request_id     = true
     end
   end
 end

data/lib/chime_sdk/controller/attendees.rb

@@ -12,15 +12,17 @@ module ChimeSdk
         end
     
         # GET /meetings/:meeting_id/attendees
+        # Join tokens are omitted since they are credentials of each attendee.
         def index
           list_attendees
-          render json: { attendees: @attendees }
+          render json: { attendees: @attendees.map { |attendee| without_join_token(attendee) } }
         end
 
         # GET /meetings/:meeting_id/attendees/:attendee_id
+        # The join token is omitted since it is a credential of the attendee.
         def show
           get_attendee
-          render json: @attendee
+          render json: without_join_token(@attendee)
         end
 
         # POST /meetings/:meeting_id/attendees
@@ -55,13 +57,25 @@ module ChimeSdk
           params[:id]
         end
 
+        # Unique meeting request id to identify meeting by Amazon Chime.
+        # Configure it depending on your application resources to identify meeting.
+        # For example, set "PrivateRoom-#{@room.id}" by Room model.
+        # Requested meetings are verified with this id when ChimeSdk.config.verify_meeting_request_id is enabled.
+        # @api protected
+        # @return [String] Unique meeting request id to identify meeting by Amazon Chime
+        def meeting_request_id
+          "default"
+        end
+
         # Unique attendee request id to identify attendee by Amazon Chime.
         # Configure it depending on your application resources to identify attendee.
         # For example, set "User-#{current_user.id}" by User model.
+        # Each user must have a different value, since users with the same value join meetings as the same attendee.
         # @api protected
         # @return [String] Unique attendee request id to identify attendee by Amazon Chime
+        # @raise [NotImplementedError] Unless overridden in your controllers
         def attendee_request_id
-          "default"
+          raise NotImplementedError, "Define attendee_request_id in #{self.class.name} to identify each attendee, e.g. \"User-\#{current_user.id}\""
         end
 
         # Path for meetings#index action such as meetings_path.

data/lib/chime_sdk/controller/common.rb

@@ -1,6 +1,9 @@
 module ChimeSdk
   # Controllers implementation by amazon-chime-sdk-rails.
   module Controller
+    # Error raised when the requested meeting is not the meeting identified by meeting_request_id.
+    class MeetingNotFoundError < StandardError; end
+
     # Common implementation for controllers.
     module Common
       extend ActiveSupport::Concern
@@ -9,6 +12,7 @@ module ChimeSdk
         rescue_from Aws::ChimeSDKMeetings::Errors::ForbiddenException, with: :render_forbidden
         rescue_from Aws::ChimeSDKMeetings::Errors::NotFoundException, with: :render_resource_not_found
         rescue_from Aws::ChimeSDKMeetings::Errors::ValidationException, with: :render_resource_not_found
+        rescue_from ChimeSdk::Controller::MeetingNotFoundError, with: :render_resource_not_found
 
         class ::String
           # Convets to boolean.
@@ -51,7 +55,7 @@ module ChimeSdk
       # @api protected
       # @return [Hash] Meeting
       def get_meeting
-        @meeting = ChimeSdk::MeetingCoordinator.get_meeting(meeting_id)
+        @meeting = verify_meeting(ChimeSdk::MeetingCoordinator.get_meeting(meeting_id))
         @meeting = merge_application_meeting_metadata(@meeting)
       end
 
@@ -59,13 +63,43 @@ module ChimeSdk
       # @api protected
       # @return [void]
       def delete_meeting
+        verify_meeting_id
         ChimeSdk::MeetingCoordinator.delete_meeting(meeting_id)
       end
 
+      # Whether to verify that requested meetings were created with ChimeSdk.config.prefix + meeting_request_id.
+      # Override it to change the behavior for each controller.
+      # @api protected
+      # @return [Boolean] Whether to verify requested meetings
+      def verify_meeting_request_id?
+        ChimeSdk.config.verify_meeting_request_id
+      end
+
+      # Verify that the meeting was created with ChimeSdk.config.prefix + meeting_request_id.
+      # @api protected
+      # @param [Hash] meeting Meeting JSON object as hash
+      # @return [Hash] Verified meeting
+      # @raise [ChimeSdk::Controller::MeetingNotFoundError] When the meeting is not the meeting identified by meeting_request_id
+      def verify_meeting(meeting)
+        if verify_meeting_request_id? && meeting.dig(:Meeting, :ExternalMeetingId) != ChimeSdk.config.prefix + meeting_request_id
+          raise ChimeSdk::Controller::MeetingNotFoundError, "Meeting not found"
+        end
+        meeting
+      end
+
+      # Verify the requested meeting by meeting id unless it has already been verified.
+      # @api protected
+      # @return [void]
+      # @raise [ChimeSdk::Controller::MeetingNotFoundError] When the meeting is not the meeting identified by meeting_request_id
+      def verify_meeting_id
+        verify_meeting(ChimeSdk::MeetingCoordinator.get_meeting(meeting_id)) if @meeting.nil? && verify_meeting_request_id?
+      end
+
       # List attendees by MeetingCoordinator.
       # @api protected
       # @return [Array<Hash>] Attendee list
       def list_attendees
+        verify_meeting_id
         @attendees = ChimeSdk::MeetingCoordinator.list_attendees(meeting_id)
         @attendees = @attendees.map { |attendee| merge_application_attendee_metadata(attendee) }
       end
@@ -74,6 +108,7 @@ module ChimeSdk
       # @api protected
       # @return [Hash] Created attendee
       def create_attendee
+        verify_meeting_id
         @attendee = ChimeSdk::MeetingCoordinator.create_attendee(meeting_id, attendee_request_id)
         @attendee = merge_application_attendee_metadata(@attendee)
       end
@@ -82,6 +117,7 @@ module ChimeSdk
       # @api protected
       # @return [Hash] Attendee
       def get_attendee
+        verify_meeting_id
         @attendee = ChimeSdk::MeetingCoordinator.get_attendee(meeting_id, attendee_id)
         @attendee = merge_application_attendee_metadata(@attendee)
       end
@@ -90,6 +126,7 @@ module ChimeSdk
       # @api protected
       # @return [void]
       def delete_attendee
+        verify_meeting_id
         ChimeSdk::MeetingCoordinator.delete_attendee(meeting_id, attendee_id)
       end
 
@@ -154,6 +191,15 @@ module ChimeSdk
         attendee
       end
 
+      # Return attendee without its join token.
+      # Join token is a credential to join the meeting as the attendee and must not be returned to other users.
+      # @api protected
+      # @param [Hash] attendee Attendee JSON object as hash
+      # @return [Hash] Attendee without join token
+      def without_join_token(attendee)
+        attendee.merge(Attendee: attendee[:Attendee].except(:JoinToken))
+      end
+
       # Returns error response as Hash
       # @api protected
       # @return [Hash] Error message

data/lib/chime_sdk/controller/meetings.rb

@@ -16,9 +16,9 @@ module ChimeSdk
         # GET /meetings.json
         # @overload index(params)
         #   @param [Hash] params Request parameter options
-        #   @option params [String] :create_meeting (ChimeSdk.config.create_meeting_by_get_request) Whether the application creates meeting in this meetings#index action by HTTP GET request
+        #   @option params [String] :create_meeting (ChimeSdk.config.create_meeting_by_get_request) Whether the application creates meeting in this meetings#index action by HTTP GET request. This parameter can only disable it since GET requests are not protected from CSRF.
         def index
-          if params[:create_meeting].to_s.to_boolean(false) || ChimeSdk.config.create_meeting_by_get_request && params[:create_meeting].to_s.to_boolean(true)
+          if ChimeSdk.config.create_meeting_by_get_request && params[:create_meeting].to_s.to_boolean(true)
             create
           else
             @meeting_request_id = ChimeSdk.config.prefix + meeting_request_id
@@ -34,10 +34,10 @@ module ChimeSdk
         # GET /meetings/:meeting_id.json
         # @overload show(params)
         #   @param [Hash] params Request parameter options
-        #   @option params [String] :create_attendee_from_meeting (ChimeSdk.config.create_attendee_from_meeting) Whether the application creates attendee from meeting in meetings#show action
+        #   @option params [String] :create_attendee_from_meeting (ChimeSdk.config.create_attendee_from_meeting) Whether the application creates attendee from meeting in meetings#show action. This parameter can only disable it since GET requests are not protected from CSRF.
         def show
           get_meeting
-          if params[:create_attendee_from_meeting].to_s.to_boolean(false) || ChimeSdk.config.create_attendee_from_meeting && params[:create_attendee_from_meeting].to_s.to_boolean(true)
+          if ChimeSdk.config.create_attendee_from_meeting && params[:create_attendee_from_meeting].to_s.to_boolean(true)
             create_attendee_from_meeting
           end
           respond_to do |format|
@@ -97,10 +97,12 @@ module ChimeSdk
         # Unique attendee request id to identify attendee by Amazon Chime.
         # Configure it depending on your application resources to identify attendee.
         # For example, set "User-#{current_user.id}" by User model.
+        # Each user must have a different value, since users with the same value join meetings as the same attendee.
         # @api protected
         # @return [String] Unique attendee request id to identify attendee by Amazon Chime
+        # @raise [NotImplementedError] Unless overridden in your controllers
         def attendee_request_id
-          "default"
+          raise NotImplementedError, "Define attendee_request_id in #{self.class.name} to identify each attendee, e.g. \"User-\#{current_user.id}\""
         end
 
         # Path for meetings#index action such as meetings_path.

data/lib/chime_sdk/version.rb

@@ -1,4 +1,4 @@
 module ChimeSdk
   # Gem version of amazon-chime-sdk-rails
-  VERSION = "2.1.0"
+  VERSION = "2.2.0"
 end

data/lib/generators/chime_sdk/js_generator.rb

@@ -4,13 +4,17 @@ module ChimeSdk
   module Generators
     # Amazon Chime SDK single .js file generator.
     # Bundle Amazon Chime SDK into single amazon-chime-sdk.min.js file and copy it to app/assets/javascripts directory.
-    # @example Run Amazon Chime SDK single .js file generator with the latest version from master branch
+    # @example Run Amazon Chime SDK single .js file generator with the version in the pinned singlejs package.json
     #   rails generate chime_sdk:js
     # @example Run Amazon Chime SDK single .js file generator with specified version
     #   rails generate chime_sdk:js 2.24.0
     # @see https://github.com/aws-samples/amazon-chime-sdk/tree/main/utils/singlejs
     # @see https://www.npmjs.com/package/amazon-chime-sdk-js
     class JsGenerator < Rails::Generators::Base
+      # Commit of aws-samples/amazon-chime-sdk repository to build the single .js file from.
+      # Pinned since the generator runs npm scripts in the cloned repository.
+      SINGLEJS_REPOSITORY_COMMIT = "6abe76a732c1fce4cce9d2dbbf28946482ac203e"
+
       desc <<-DESC.strip_heredoc
         Bundle Amazon Chime SDK into single amazon-chime-sdk.min.js file and copy it to app/assets/javascripts directory.
 
@@ -76,6 +80,7 @@ module ChimeSdk
         system "mkdir -p tmp"
         puts "Cloning into 'amazon-chime-sdk-js' git repository in tmp directory ..."
         system "cd tmp; git clone https://github.com/aws-samples/amazon-chime-sdk.git > /dev/null 2>&1"
+        system "cd tmp/amazon-chime-sdk; git -c advice.detachedHead=false checkout #{SINGLEJS_REPOSITORY_COMMIT} > /dev/null 2>&1"
         repository_path = "tmp/amazon-chime-sdk"
         singlejs_path = "#{repository_path}/utils/singlejs"
         package_json_path = "#{singlejs_path}/package.json"

data/lib/generators/templates/chime_sdk.rb

@@ -22,4 +22,9 @@ ChimeSdk.configure do |config|
 
   # Configure whether the application creates meeting in meetings#index action by HTTP GET request.
   config.create_meeting_by_get_request = false
+
+  # Configure whether the controllers verify that requested meetings were created with config.prefix + meeting_request_id.
+  # When enabled, meetings and attendees controllers respond with 404 for meetings of other resources, such as other private rooms.
+  # Default value is true. Disabling it allows any meeting in your AWS account to be accessed by its meeting id.
+  config.verify_meeting_request_id = true
 end

data/lib/generators/templates/controllers/meeting_attendees_controller.rb

@@ -23,14 +23,26 @@ class <%= @namespace %><%= @class_name_prefix %>MeetingAttendeesController < App
   #   params[:id]
   # end
 
+  # Unique meeting request id to identify meeting by Amazon Chime.
+  # Configure it depending on your application resources to identify meeting.
+  # For example, set "PrivateRoom-#{@room.id}" by Room model.
+  # Use the same value as your meetings controller since requested meetings are verified with this id.
+  # @api protected
+  # @return [String] Unique meeting request id to identify meeting by Amazon Chime
+  def meeting_request_id
+    # "PrivateRoom-#{@room.id}"
+    "<%= @default_meeting_request_id %>"
+  end
+
   # Unique attendee request id to identify attendee by Amazon Chime.
   # Configure it depending on your application resources to identify attendee.
   # For example, set "User-#{current_user.id}" by User model.
+  # Each user must have a different value, since users with the same value join meetings as the same attendee.
   # @api protected
   # @return [String] Unique attendee request id to identify attendee by Amazon Chime
   def attendee_request_id
     # "User-#{current_user.id}"
-    "default"
+    raise NotImplementedError, "Define attendee_request_id in #{self.class.name} to identify each attendee, e.g. \"User-\#{current_user.id}\""
   end
 
   # Path for meetings#index action such as meetings_path.

data/lib/generators/templates/controllers/meetings_controller.rb

@@ -28,11 +28,12 @@ class <%= @namespace %><%= @class_name_prefix %>MeetingsController < Application
   # Unique attendee request id to identify attendee by Amazon Chime.
   # Configure it depending on your application resources to identify attendee.
   # For example, set "User-#{current_user.id}" by User model.
+  # Each user must have a different value, since users with the same value join meetings as the same attendee.
   # @api protected
   # @return [String] Unique attendee request id to identify attendee by Amazon Chime
   def attendee_request_id
     # "User-#{current_user.id}"
-    "default"
+    raise NotImplementedError, "Define attendee_request_id in #{self.class.name} to identify each attendee, e.g. \"User-\#{current_user.id}\""
   end
 
   # Path for meetings#index action such as meetings_path.

data/lib/generators/templates/views/meetings/show.html.erb

@@ -38,7 +38,6 @@
 <% end %>
 
 <%= javascript_include_tag "amazon-chime-sdk.min.js" %>
-<script src="https://unpkg.com/axios/dist/axios.min.js"></script>
 
 <script defer>
   // This is a very simple script as a template view using Amazon Chime SDK.
@@ -63,9 +62,16 @@
   const configuration = new ChimeSDK.MeetingSessionConfiguration(meeting, attendee);
   const meetingSession = new ChimeSDK.DefaultMeetingSession(configuration, logger, deviceController);
 
-  const attendeeApi = axios.create({
-    baseURL: `${attendeeResourcesPath}/`
-  });
+  async function getAttendee(attendeeId) {
+    const response = await fetch(`${attendeeResourcesPath}/${encodeURIComponent(attendeeId)}`, {
+      headers: { 'Accept': 'application/json' },
+      credentials: 'same-origin'
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to get attendee: ${response.status}`);
+    }
+    return response.json();
+  }
 
   async function join() {
     try {
@@ -109,9 +115,9 @@
     const presentAttendeeMap = {};
     const callback = (presentAttendeeId, present) => {
       if (present) {
-        attendeeApi.get(presentAttendeeId)
-          .then(response => {
-            presentAttendeeMap[presentAttendeeId] = response.data;
+        getAttendee(presentAttendeeId)
+          .then(attendee => {
+            presentAttendeeMap[presentAttendeeId] = attendee;
             updateAttendeeStatus(presentAttendeeMap);
           })
           .catch(error => {
@@ -126,11 +132,15 @@
   }
 
   function updateAttendeeStatus(presentAttendeeMap) {
-    presentAttendees = "<strong>Present Attendees</strong><ul>";
+    // Use textContent since attendee names are user-provided values
+    const title = document.createElement('strong');
+    title.textContent = 'Present Attendees';
+    const list = document.createElement('ul');
     Object.values(presentAttendeeMap).forEach(attendee => {
-      presentAttendees = presentAttendees + `<li>${showApplicationUserName(attendee)}</li>`
+      const item = document.createElement('li');
+      item.textContent = showApplicationUserName(attendee);
+      list.appendChild(item);
     });
-    presentAttendees = presentAttendees + '</ul>'
-    document.getElementById("attendee-status").innerHTML = presentAttendees;
+    document.getElementById("attendee-status").replaceChildren(title, list);
   }
 </script>

data/spec/generators/controllers_generator_spec.rb

@@ -29,6 +29,8 @@ describe ChimeSdk::Generators::ControllersGenerator, type: :generator do
         it { is_expected.to exist }
         it { is_expected.to contain(/class MeetingAttendeesController < ApplicationController/) }
         it { is_expected.to contain(" meetings_path(params)\n") }
+        it { is_expected.to contain("  def meeting_request_id\n    # \"PrivateRoom-\#{@room.id}\"\n    \"default\"\n") }
+        it { is_expected.to contain("  def attendee_request_id\n    # \"User-\#{current_user.id}\"\n    raise NotImplementedError") }
       end
     end
 

data/spec/rails_app/app/controllers/api/public/meeting_attendees_controller.rb

@@ -8,4 +8,10 @@ class Api::Public::MeetingAttendeesController < ApplicationController
       "User": User.find_by_id(user_id)
     }
   end
+
+  # This public API for the React Meeting Demo accepts any meeting in the AWS account by its meeting id.
+  # Do not disable this verification in your applications unless you authorize access to meetings by yourself.
+  def verify_meeting_request_id?
+    false
+  end
 end

data/spec/rails_app/app/controllers/api/public/meetings_controller.rb

@@ -12,4 +12,10 @@ class Api::Public::MeetingsController < ApplicationController
       "PrivateRoom": Room.find_by_id(room_id)
     }
   end
+
+  # This public API for the React Meeting Demo accepts any meeting in the AWS account by its meeting id.
+  # Do not disable this verification in your applications unless you authorize access to meetings by yourself.
+  def verify_meeting_request_id?
+    false
+  end
 end

data/spec/rails_app/app/controllers/meeting_attendees_controller.rb

@@ -39,6 +39,16 @@ class MeetingAttendeesController < ApplicationController
   #   params[:id]
   # end
 
+  # Unique meeting request id to identify meeting by Amazon Chime.
+  # Configure it depending on your application resources to identify meeting.
+  # For example, set "PrivateRoom-#{@room.id}" by Room model.
+  # Use the same value as your meetings controller since requested meetings are verified with this id.
+  # @api protected
+  # @return [String] Unique meeting request id to identify meeting by Amazon Chime
+  def meeting_request_id
+    "PrivateRoom-#{@room.id}"
+  end
+
   # Unique attendee request id to identify attendee by Amazon Chime.
   # Configure it depending on your application resources to identify attendee.
   # For example, set "User-#{current_user.id}" by User model.

data/spec/rails_app/app/views/meetings/show.html.erb

@@ -43,7 +43,6 @@
 <% end %>
 
 <%= javascript_include_tag "amazon-chime-sdk.min.js" %>
-<script src="https://unpkg.com/axios/dist/axios.min.js"></script>
 
 <script defer>
   // This is a very simple script as a template view using Amazon Chime SDK.
@@ -75,9 +74,16 @@
   const configuration = new ChimeSDK.MeetingSessionConfiguration(meeting, attendee);
   const meetingSession = new ChimeSDK.DefaultMeetingSession(configuration, logger, deviceController);
 
-  const attendeeApi = axios.create({
-    baseURL: `${attendeeResourcesPath}/`
-  });
+  async function getAttendee(attendeeId) {
+    const response = await fetch(`${attendeeResourcesPath}/${encodeURIComponent(attendeeId)}`, {
+      headers: { 'Accept': 'application/json' },
+      credentials: 'same-origin'
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to get attendee: ${response.status}`);
+    }
+    return response.json();
+  }
 
   async function join() {
     try {
@@ -121,9 +127,9 @@
     const presentAttendeeMap = {};
     const callback = (presentAttendeeId, present) => {
       if (present) {
-        attendeeApi.get(presentAttendeeId)
-          .then(response => {
-            presentAttendeeMap[presentAttendeeId] = response.data;
+        getAttendee(presentAttendeeId)
+          .then(attendee => {
+            presentAttendeeMap[presentAttendeeId] = attendee;
             updateAttendeeStatus(presentAttendeeMap);
           })
           .catch(error => {
@@ -138,11 +144,15 @@
   }
 
   function updateAttendeeStatus(presentAttendeeMap) {
-    presentAttendees = "<strong>Present Attendees</strong><ul>";
+    // Use textContent since attendee names are user-provided values
+    const title = document.createElement('strong');
+    title.textContent = 'Present Attendees';
+    const list = document.createElement('ul');
     Object.values(presentAttendeeMap).forEach(attendee => {
-      presentAttendees = presentAttendees + `<li>${showApplicationUserName(attendee)}</li>`
+      const item = document.createElement('li');
+      item.textContent = showApplicationUserName(attendee);
+      list.appendChild(item);
     });
-    presentAttendees = presentAttendees + '</ul>'
-    document.getElementById("attendee-status").innerHTML = presentAttendees;
+    document.getElementById("attendee-status").replaceChildren(title, list);
   }
 </script>

data/spec/rails_app/app/views/rooms/show.html.erb

@@ -8,11 +8,7 @@
 <p>
   <strong>Private Meeting:</strong>
   <p><%= link_to 'Show Meetings Index', room_meetings_path(@room) %></p>
-  <p>
-    Create Meeting
-    <%= link_to 'GET', room_meetings_path(@room, create_meeting: true) %>
-    <%= link_to 'POST', room_meetings_path(@room), method: :post %>
-  </p>
+  <p><%= link_to 'Create Meeting', room_meetings_path(@room), method: :post %></p>
 </p>
 
 <p>

data/spec/requests/atendees_spec.rb

@@ -4,8 +4,10 @@ describe ChimeSdk::Controller::Attendees, type: :request do
     @attendee_id       = "76543210-ba98-fedc-jihg-vutsrqponmlk"
     @dummy_meeting_id  = "91234567-89ab-cdef-ghij-klmnopqrstuv"
     @dummy_attendee_id = "96543210-ba98-fedc-jihg-vutsrqponmlk"
+    @other_meeting_id  = "81234567-89ab-cdef-ghij-klmnopqrstuv"
 
     @room = create(:room)
+    @other_room = create(:room)
     @attendee_user = create(:user)
     @room.add_member(@attendee_user)
     test_attendee = {
@@ -29,8 +31,24 @@ describe ChimeSdk::Controller::Attendees, type: :request do
       }
     }
 
+    meeting_of = -> (meeting_id, room) {
+      {
+        meeting_id: meeting_id,
+        external_meeting_id: "ChimeSdkRailsApp-test-PrivateRoom-#{room.id}",
+        media_region: "us-east-1",
+        media_placement: { audio_host_url: "dummy" }
+      }
+    }
+
     # Use stubs for the AWS SDK for Ruby
     client = Aws::ChimeSDKMeetings::Client.new(stub_responses: true)
+    client.stub_responses(:get_meeting, -> (context) {
+      case context.params[:meeting_id]
+      when @meeting_id then { meeting: meeting_of.(@meeting_id, @room) }
+      when @other_meeting_id then { meeting: meeting_of.(@other_meeting_id, @other_room) }
+      else 'ForbiddenException'
+      end
+    })
     client.stub_responses(:list_attendees, {
       attendees: [ test_attendee, dummy_attendee ]
     })
@@ -109,6 +127,12 @@ describe ChimeSdk::Controller::Attendees, type: :request do
           it "returns valid attendee in the list" do
             expect(JSON.parse(response.body)["attendees"][0]["Attendee"]["AttendeeId"]).to eq(@attendee_id)
           end
+
+          it "does not return join tokens of attendees in the list" do
+            JSON.parse(response.body)["attendees"].each do |attendee|
+              expect(attendee["Attendee"]).not_to have_key("JoinToken")
+            end
+          end
         end
 
         describe "GET /meetings/:meeting_id/attendees/:attendee_id" do
@@ -125,6 +149,10 @@ describe ChimeSdk::Controller::Attendees, type: :request do
               expect(JSON.parse(response.body)["Attendee"]["AttendeeId"]).to eq(@attendee_id)
             end
 
+            it "does not return join token of the attendee" do
+              expect(JSON.parse(response.body)["Attendee"]).not_to have_key("JoinToken")
+            end
+
             it "returns application metadata in the attendee" do
               expect(JSON.parse(response.body)["Attendee"]["ApplicationMetadata"]["User"]["id"]).to eq(@attendee_user.id)
             end
@@ -165,6 +193,34 @@ describe ChimeSdk::Controller::Attendees, type: :request do
           end
         end
 
+        context "when the meeting belongs to another private room" do
+          let(:other_meeting_path) { "#{api_path}/meetings/#{@other_meeting_id}" }
+
+          it "returns response with 404 status to GET /meetings/:meeting_id/attendees" do
+            expect(ChimeSdk::MeetingCoordinator).not_to receive(:list_attendees)
+            get "#{other_meeting_path}/attendees", headers: @auth_headers
+            expect(response).to have_http_status(404)
+          end
+
+          it "returns response with 404 status to GET /meetings/:meeting_id/attendees/:attendee_id" do
+            expect(ChimeSdk::MeetingCoordinator).not_to receive(:get_attendee)
+            get "#{other_meeting_path}/attendees/#{@attendee_id}", headers: @auth_headers
+            expect(response).to have_http_status(404)
+          end
+
+          it "returns response with 404 status to POST /meetings/:meeting_id/attendees" do
+            expect(ChimeSdk::MeetingCoordinator).not_to receive(:create_attendee)
+            post "#{other_meeting_path}/attendees", headers: @auth_headers
+            expect(response).to have_http_status(404)
+          end
+
+          it "returns response with 404 status to DELETE /meetings/:meeting_id/attendees/:attendee_id" do
+            expect(ChimeSdk::MeetingCoordinator).not_to receive(:delete_attendee)
+            delete "#{other_meeting_path}/attendees/#{@attendee_id}", headers: @auth_headers
+            expect(response).to have_http_status(404)
+          end
+        end
+
         describe "DELETE /meetings/:meeting_id/attendees/:attendee_id" do
           context "when the attendee is found" do
             before do

data/spec/requests/meetings_spec.rb

@@ -3,8 +3,10 @@ describe ChimeSdk::Controller::Meetings, type: :request do
     @meeting_id       = "01234567-89ab-cdef-ghij-klmnopqrstuv"
     @attendee_id      = "76543210-ba98-fedc-jihg-vutsrqponmlk"
     @dummy_meeting_id = "91234567-89ab-cdef-ghij-klmnopqrstuv"
+    @other_meeting_id = "81234567-89ab-cdef-ghij-klmnopqrstuv"
 
     @room = create(:room)
+    @other_room = create(:room)
     dummy_media_placement = {
       audio_host_url: "dummy",
       audio_fallback_url: "dummy",
@@ -51,10 +53,19 @@ describe ChimeSdk::Controller::Meetings, type: :request do
       meeting_arn: "arn:aws:chime:us-east-1:000000000000:meeting/#{@meeting_id}"
     }
 
+    other_room_meeting = test_meeting.merge(
+      meeting_id: @other_meeting_id,
+      external_meeting_id: "ChimeSdkRailsApp-test-PrivateRoom-#{@other_room.id}"
+    )
+
     # Use stubs for the AWS SDK for Ruby
     client = Aws::ChimeSDKMeetings::Client.new(stub_responses: true)
     client.stub_responses(:get_meeting, -> (context) {
-      context.params[:meeting_id] == @meeting_id ? { meeting: test_meeting } : 'NotFoundException'
+      case context.params[:meeting_id]
+      when @meeting_id then { meeting: test_meeting }
+      when @other_meeting_id then { meeting: other_room_meeting }
+      else 'NotFoundException'
+      end
     })
     client.stub_responses(:create_meeting, {
       meeting: test_meeting
@@ -131,18 +142,37 @@ describe ChimeSdk::Controller::Meetings, type: :request do
             end
           end
 
-          context "with true as create_meeting parameter" do
+          context "with true as create_meeting parameter and ChimeSdk.config.create_meeting_by_get_request is disabled" do
             before do
               get "#{api_path}/meetings", headers: @auth_headers, params: { create_meeting: true }
             end
 
-            it "returns response with 201 status" do
-              expect(response).to have_http_status(201)
+            it "does not create meeting" do
+              expect(response).to have_http_status(200)
+              expect(JSON.parse(response.body)["Meeting"]).to be_nil
             end
+          end
 
-            it "returns created meeting" do
+          context "when ChimeSdk.config.create_meeting_by_get_request is enabled" do
+            before do
+              ChimeSdk.config.create_meeting_by_get_request = true
+            end
+
+            after do
+              ChimeSdk.config.create_meeting_by_get_request = false
+            end
+
+            it "returns created meeting with 201 status" do
+              get "#{api_path}/meetings", headers: @auth_headers
+              expect(response).to have_http_status(201)
               expect(JSON.parse(response.body)["Meeting"]["MeetingId"]).to eq(@meeting_id)
             end
+
+            it "does not create meeting with false as create_meeting parameter" do
+              get "#{api_path}/meetings", headers: @auth_headers, params: { create_meeting: false }
+              expect(response).to have_http_status(200)
+              expect(JSON.parse(response.body)["Meeting"]).to be_nil
+            end
           end
         end
 
@@ -178,6 +208,52 @@ describe ChimeSdk::Controller::Meetings, type: :request do
               expect(response).to have_http_status(404)
             end
           end
+
+          context "with true as create_attendee_from_meeting parameter and ChimeSdk.config.create_attendee_from_meeting is disabled" do
+            before do
+              ChimeSdk.config.create_attendee_from_meeting = false
+              get "#{api_path}/meetings/#{@meeting_id}", params: { create_attendee_from_meeting: true }, headers: @auth_headers
+            end
+
+            after do
+              ChimeSdk.config.create_attendee_from_meeting = true
+            end
+
+            it "does not create attendee" do
+              expect(response).to have_http_status(200)
+              expect(JSON.parse(response.body)["Attendee"]).to be_nil
+            end
+          end
+
+          context "when the meeting belongs to another private room" do
+            before do
+              get "#{api_path}/meetings/#{@other_meeting_id}", headers: @auth_headers
+            end
+
+            it "returns response with 404 status" do
+              expect(response).to have_http_status(404)
+            end
+
+            it "does not return the meeting" do
+              expect(JSON.parse(response.body)["Meeting"]).to be_nil
+            end
+          end
+
+          context "when the meeting belongs to another private room and ChimeSdk.config.verify_meeting_request_id is disabled" do
+            before do
+              ChimeSdk.config.verify_meeting_request_id = false
+              get "#{api_path}/meetings/#{@other_meeting_id}", params: { create_attendee_from_meeting: false }, headers: @auth_headers
+            end
+
+            after do
+              ChimeSdk.config.verify_meeting_request_id = true
+            end
+
+            it "returns the meeting" do
+              expect(response).to have_http_status(200)
+              expect(JSON.parse(response.body)["Meeting"]["MeetingId"]).to eq(@other_meeting_id)
+            end
+          end
         end
 
         describe "POST /meetings" do
@@ -243,6 +319,14 @@ describe ChimeSdk::Controller::Meetings, type: :request do
               expect(response).to have_http_status(404)
             end
           end
+
+          context "when the meeting belongs to another private room" do
+            it "returns response with 404 status without deleting the meeting" do
+              expect(ChimeSdk::MeetingCoordinator).not_to receive(:delete_meeting)
+              delete "#{api_path}/meetings/#{@other_meeting_id}", headers: @auth_headers
+              expect(response).to have_http_status(404)
+            end
+          end
         end
       end
     end
@@ -310,16 +394,29 @@ describe ChimeSdk::Controller::Meetings, type: :request do
             end
           end
 
-          context "with true as create_meeting parameter" do
+          context "with true as create_meeting parameter and ChimeSdk.config.create_meeting_by_get_request is disabled" do
             before do
               get "#{api_path}/meetings", params: { create_meeting: true }
             end
 
-            it "returns response with 302 status" do
-              expect(response).to have_http_status(302)
+            it "does not create meeting" do
+              expect(response).to have_http_status(200)
+              expect(response.body).to include("Meetings by Amazon Chime SDK")
+            end
+          end
+
+          context "when ChimeSdk.config.create_meeting_by_get_request is enabled" do
+            before do
+              ChimeSdk.config.create_meeting_by_get_request = true
+              get "#{api_path}/meetings"
+            end
+
+            after do
+              ChimeSdk.config.create_meeting_by_get_request = false
             end
 
             it "redirects to created meeting path" do
+              expect(response).to have_http_status(302)
               expect(response.body).to redirect_to("#{api_path}/meetings/#{@meeting_id}")
             end
           end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: amazon-chime-sdk-rails
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.2.0
 platform: ruby
 authors:
 - Shota Yamazaki
@@ -116,6 +116,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/dependabot.yml"
 - ".github/workflows/build.yml"
 - ".gitignore"
 - ".rspec"