amazon-chime-sdk-rails 2.2.0 → 2.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 168cdb6149788c0f8499ae2499df0f0d2a5590dacccaf0eed854704e91f7d3e6
-  data.tar.gz: a7d0c20d4a39929afe2b60b0c0b01f74181ab0807c5c27d76f2cc98a5a1760fe
+  metadata.gz: 3d5ebcc29d74104d1eec93c7ac094be54b52083edc4bf835a0ad7196a8dc0dfd
+  data.tar.gz: b28f4fdcef7a52500fdfa32f7dfafb83455ae2827f3691627bc1423bfa0ec33e
 SHA512:
-  metadata.gz: e1be855d627474e0382b628578a70457beeff4b2f0f3400d107f35d99dc7e8a31020163137fc6e186eb4ff67754b17b957a16d809e0f6c751ecb563e198167d0
-  data.tar.gz: 2ce6405a5317f87052777b3830c844e6e5dd5702c2fa14ce1ff425ab04de70f6c69778d624d0268dec08d356ab801f148c7c64471ae4c04d39028780769f0141
+  metadata.gz: 859941de7300fca365390ec91df87b96a5ef4e8b573b282516d596715e39f4e22966f0146f090632dce3b36e446ab0ba93b974f0d3b9be9c512aef42402b7cd2
+  data.tar.gz: 745c35af2bd1bd43f082caed8867724246f6b2b8c119c99a57866ed73243252efded8249c4ccdfe2f53ad1425571e5b32ff05381a1292facfd92b43f73b05665

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 2.2.1 / 2026-10-28
+[Full Changelog](http://github.com/simukappu/amazon-chime-sdk-rails/compare/v2.2.0...v2.2.1)
+
+Security Fixes:
+
+* Return only `id` and `name` of users and rooms in the application metadata examples of the generated controller templates and the docs, instead of serializing whole records such as email addresses to all meeting participants
+* Resolve user and room IDs in the application metadata examples by removing `config.prefix` from `ExternalUserId` and `ExternalMeetingId`, instead of `split('-')[3]`. Attendees and meetings created with other prefixes, such as other applications or environments, are no longer resolved to local records
+
 ## 2.2.0 / 2026-10-28
 [Full Changelog](http://github.com/simukappu/amazon-chime-sdk-rails/compare/v2.1.0...v2.2.0)
 

data/docs/Develop_Rails_API_Application.md

@@ -194,16 +194,16 @@ class Api::MeetingsController < ApplicationController
   def application_meeting_metadata(meeting)
     {
       "MeetingType": "PrivateRoom",
-      "PrivateRoom": @room
+      "PrivateRoom": @room.slice(:id, :name)
     }
   end
 
   # Uncomment
   def application_attendee_metadata(attendee)
-    user_id = attendee[:Attendee][:ExternalUserId].split('-')[3]
+    user_id = attendee[:Attendee][:ExternalUserId].delete_prefix(ChimeSdk.config.prefix)[/\AUser-(\d+)\z/, 1]
     {
       "AttendeeType": "User",
-      "User": User.find_by_id(user_id)
+      "User": User.find_by_id(user_id)&.slice(:id, :name)
     }
   end
 end
@@ -246,10 +246,10 @@ class Api::MeetingAttendeesController < ApplicationController
 
   # Uncomment
   def application_attendee_metadata(attendee)
-    user_id = attendee[:Attendee][:ExternalUserId].split('-')[3]
+    user_id = attendee[:Attendee][:ExternalUserId].delete_prefix(ChimeSdk.config.prefix)[/\AUser-(\d+)\z/, 1]
     {
       "AttendeeType": "User",
-      "User": User.find_by_id(user_id)
+      "User": User.find_by_id(user_id)&.slice(:id, :name)
     }
   end
 end
@@ -360,37 +360,9 @@ $ curl localhost:3000/api/v1/rooms/1/meetings -X POST -H "content-type:applicati
     "MediaRegion": "us-east-1",
     "ApplicationMetadata": {
       "MeetingType": "PrivateRoom",
-      "Room": {
+      "PrivateRoom": {
         "id": 1,
-        "name": "PrivateRoom-1",
-        "created_at": "2020-10-16T11:15:56.223Z",
-        "updated_at": "2020-10-16T11:15:56.223Z",
-        "members": [
-          {
-            "id": 1,
-            "provider": "email",
-            "uid": "ichiro@example.com",
-            "allow_password_change": false,
-            "name": "ichiro",
-            "nickname": null,
-            "image": null,
-            "email": "ichiro@example.com",
-            "created_at": "2020-10-16T11:14:48.731Z",
-            "updated_at": "2020-10-16T11:16:56.927Z"
-          },
-          {
-            "id": 2,
-            "provider": "email",
-            "uid": "stephen@example.com",
-            "allow_password_change": false,
-            "name": "stephen",
-            "nickname": null,
-            "image": null,
-            "email": "stephen@example.com",
-            "created_at": "2020-10-16T11:15:33.226Z",
-            "updated_at": "2020-10-16T11:15:33.314Z"
-          }
-        ]
+        "name": "PrivateRoom-1"
       }
     }
   },
@@ -402,15 +374,7 @@ $ curl localhost:3000/api/v1/rooms/1/meetings -X POST -H "content-type:applicati
       "AttendeeType": "User",
       "User": {
         "id": 1,
-        "provider": "email",
-        "uid": "ichiro@example.com",
-        "allow_password_change": false,
-        "name": "ichiro",
-        "nickname": null,
-        "image": null,
-        "email": "ichiro@example.com",
-        "created_at": "2020-10-16T11:14:48.731Z",
-        "updated_at": "2020-10-16T11:16:56.927Z"
+        "name": "ichiro"
       }
     }
   }
@@ -428,20 +392,11 @@ $ curl localhost:3000/api/v1/rooms/1/meetings/${MEETING_ID}/attendees -H "conten
       "Attendee": {
         "ExternalUserId": "ChimeSdkRailsApp-development-User-1",
         "AttendeeId": "b581c46d-661f-92bb-d80e-XXXXXXXXXXXX",
-        "JoinToken": "YjU4MWM0NmQtNjYxZi05MmJiLWQ4MGUtZjRiMTU3ZDk1ZmU5OjgyZmM2NTMxLTIwMjctNGMxMS04OTE0LTQwZjXXXXXXXXXXXX",
         "ApplicationMetadata": {
           "AttendeeType": "User",
           "User": {
             "id": 1,
-            "provider": "email",
-            "uid": "ichiro@example.com",
-            "allow_password_change": false,
-            "name": "ichiro",
-            "nickname": null,
-            "image": null,
-            "email": "ichiro@example.com",
-            "created_at": "2020-10-16T11:14:48.731Z",
-            "updated_at": "2020-10-16T11:16:56.927Z"
+            "name": "ichiro"
           }
         }
       }
@@ -457,20 +412,11 @@ $ curl localhost:3000/api/v1/rooms/1/meetings/${MEETING_ID}/attendees/${ATTENDEE
   "Attendee": {
     "ExternalUserId": "ChimeSdkRailsApp-development-User-1",
     "AttendeeId": "b581c46d-661f-92bb-d80e-XXXXXXXXXXXX",
-    "JoinToken": "YjU4MWM0NmQtNjYxZi05MmJiLWQ4MGUtZjRiMTU3ZDk1ZmU5OjgyZmM2NTMxLTIwMjctNGMxMS04OTE0LTQwZjXXXXXXXXXXXX",
     "ApplicationMetadata": {
       "AttendeeType": "User",
       "User": {
         "id": 1,
-        "provider": "email",
-        "uid": "ichiro@example.com",
-        "allow_password_change": false,
-        "name": "ichiro",
-        "nickname": null,
-        "image": null,
-        "email": "ichiro@example.com",
-        "created_at": "2020-10-16T11:14:48.731Z",
-        "updated_at": "2020-10-16T11:16:56.927Z"
+        "name": "ichiro"
       }
     }
   }
@@ -506,37 +452,9 @@ $ curl localhost:3000/api/v1/rooms/1/meetings -X POST -H "content-type:applicati
     "MediaRegion": "us-east-1",
     "ApplicationMetadata": {
       "MeetingType": "PrivateRoom",
-      "Room": {
+      "PrivateRoom": {
         "id": 1,
-        "name": "PrivateRoom-1",
-        "created_at": "2020-10-16T11:15:56.223Z",
-        "updated_at": "2020-10-16T11:15:56.223Z",
-        "members": [
-          {
-            "id": 1,
-            "provider": "email",
-            "uid": "ichiro@example.com",
-            "allow_password_change": false,
-            "name": "ichiro",
-            "nickname": null,
-            "image": null,
-            "email": "ichiro@example.com",
-            "created_at": "2020-10-16T11:14:48.731Z",
-            "updated_at": "2020-10-16T11:16:56.927Z"
-          },
-          {
-            "id": 2,
-            "provider": "email",
-            "uid": "stephen@example.com",
-            "allow_password_change": false,
-            "name": "stephen",
-            "nickname": null,
-            "image": null,
-            "email": "stephen@example.com",
-            "created_at": "2020-10-16T11:15:33.226Z",
-            "updated_at": "2020-10-16T11:21:46.011Z"
-          }
-        ]
+        "name": "PrivateRoom-1"
       }
     }
   },
@@ -548,15 +466,7 @@ $ curl localhost:3000/api/v1/rooms/1/meetings -X POST -H "content-type:applicati
       "AttendeeType": "User",
       "User": {
         "id": 2,
-        "provider": "email",
-        "uid": "stephen@example.com",
-        "allow_password_change": false,
-        "name": "stephen",
-        "nickname": null,
-        "image": null,
-        "email": "stephen@example.com",
-        "created_at": "2020-10-16T11:15:33.226Z",
-        "updated_at": "2020-10-16T11:21:46.011Z"
+        "name": "stephen"
       }
     }
   }

data/docs/Develop_Rails_View_Application.md

@@ -260,16 +260,16 @@ class MeetingsController < ApplicationController
   def application_meeting_metadata(meeting)
     {
       "MeetingType": "PrivateRoom",
-      "PrivateRoom": @room
+      "PrivateRoom": @room.slice(:id, :name)
     }
   end
 
   # Uncomment
   def application_attendee_metadata(attendee)
-    user_id = attendee[:Attendee][:ExternalUserId].split('-')[3]
+    user_id = attendee[:Attendee][:ExternalUserId].delete_prefix(ChimeSdk.config.prefix)[/\AUser-(\d+)\z/, 1]
     {
       "AttendeeType": "User",
-      "User": User.find_by_id(user_id)
+      "User": User.find_by_id(user_id)&.slice(:id, :name)
     }
   end
 end
@@ -311,10 +311,10 @@ class MeetingAttendeesController < ApplicationController
 
   # Uncomment
   def application_attendee_metadata(attendee)
-    user_id = attendee[:Attendee][:ExternalUserId].split('-')[3]
+    user_id = attendee[:Attendee][:ExternalUserId].delete_prefix(ChimeSdk.config.prefix)[/\AUser-(\d+)\z/, 1]
     {
       "AttendeeType": "User",
-      "User": User.find_by_id(user_id)
+      "User": User.find_by_id(user_id)&.slice(:id, :name)
     }
   end
 end

data/lib/chime_sdk/version.rb

@@ -1,4 +1,4 @@
 module ChimeSdk
   # Gem version of amazon-chime-sdk-rails
-  VERSION = "2.2.0"
+  VERSION = "2.2.1"
 end

data/lib/generators/templates/controllers/meeting_attendees_controller.rb

@@ -109,10 +109,10 @@ class <%= @namespace %><%= @class_name_prefix %>MeetingAttendeesController < App
   # @param [Hash] meeting Attendee JSON object as hash
   # @return [Hash] Appication metadata for attendees
   # def application_attendee_metadata(attendee)
-  #   user_id = attendee[:Attendee][:ExternalUserId].split('-')[3]
+  #   user_id = attendee[:Attendee][:ExternalUserId].delete_prefix(ChimeSdk.config.prefix)[/\AUser-(\d+)\z/, 1]
   #   {
   #     "AttendeeType": "User",
-  #     "User": User.find_by_id(user_id)
+  #     "User": User.find_by_id(user_id)&.slice(:id, :name)
   #   }
   # end
 end

data/lib/generators/templates/controllers/meetings_controller.rb

@@ -118,7 +118,7 @@ class <%= @namespace %><%= @class_name_prefix %>MeetingsController < Application
   # def application_meeting_metadata(meeting)
   #   {
   #     "MeetingType": "PrivateRoom",
-  #     "PrivateRoom": @room
+  #     "PrivateRoom": @room.slice(:id, :name)
   #   }
   # end
 
@@ -128,10 +128,10 @@ class <%= @namespace %><%= @class_name_prefix %>MeetingsController < Application
   # @param [Hash] meeting Attendee JSON object as hash
   # @return [Hash] Appication metadata for attendees
   # def application_attendee_metadata(attendee)
-  #   user_id = attendee[:Attendee][:ExternalUserId].split('-')[3]
+  #   user_id = attendee[:Attendee][:ExternalUserId].delete_prefix(ChimeSdk.config.prefix)[/\AUser-(\d+)\z/, 1]
   #   {
   #     "AttendeeType": "User",
-  #     "User": User.find_by_id(user_id)
+  #     "User": User.find_by_id(user_id)&.slice(:id, :name)
   #   }
   # end
 

data/spec/rails_app/app/controllers/api/public/meeting_attendees_controller.rb

@@ -2,10 +2,10 @@ class Api::Public::MeetingAttendeesController < ApplicationController
   include ChimeSdk::Controller::Attendees::Mixin
 
   def application_attendee_metadata(attendee)
-    user_id = attendee[:Attendee][:ExternalUserId].split('-')[3]
+    user_id = attendee[:Attendee][:ExternalUserId].delete_prefix(ChimeSdk.config.prefix)[/\AUser-(\d+)\z/, 1]
     {
       "AttendeeType": "User",
-      "User": User.find_by_id(user_id)
+      "User": User.find_by_id(user_id)&.slice(:id, :name)
     }
   end
 

data/spec/rails_app/app/controllers/api/public/meetings_controller.rb

@@ -6,10 +6,10 @@ class Api::Public::MeetingsController < ApplicationController
   end
 
   def application_meeting_metadata(meeting)
-    room_id = meeting[:Meeting][:ExternalMeetingId].split('-')[3]
+    room_id = meeting[:Meeting][:ExternalMeetingId].delete_prefix(ChimeSdk.config.prefix)[/\APrivateRoom-(\d+)\z/, 1]
     {
       "MeetingType": "PrivateRoom",
-      "PrivateRoom": Room.find_by_id(room_id)
+      "PrivateRoom": Room.find_by_id(room_id)&.slice(:id, :name)
     }
   end
 

data/spec/rails_app/app/controllers/meeting_attendees_controller.rb

@@ -122,10 +122,10 @@ class MeetingAttendeesController < ApplicationController
   # @param [Hash] meeting Attendee JSON object as hash
   # @return [Hash] Appication metadata for attendees
   def application_attendee_metadata(attendee)
-    user_id = attendee[:Attendee][:ExternalUserId].split('-')[3]
+    user_id = attendee[:Attendee][:ExternalUserId].delete_prefix(ChimeSdk.config.prefix)[/\AUser-(\d+)\z/, 1]
     {
       "AttendeeType": "User",
-      "User": User.find_by_id(user_id)
+      "User": User.find_by_id(user_id)&.slice(:id, :name)
     }
   end
 end

data/spec/rails_app/app/controllers/meetings_controller.rb

@@ -134,7 +134,7 @@ class MeetingsController < ApplicationController
   def application_meeting_metadata(meeting)
     {
       "MeetingType": "PrivateRoom",
-      "PrivateRoom": @room
+      "PrivateRoom": @room.slice(:id, :name)
     }
   end
 
@@ -144,10 +144,10 @@ class MeetingsController < ApplicationController
   # @param [Hash] meeting Attendee JSON object as hash
   # @return [Hash] Appication metadata for attendees
   def application_attendee_metadata(attendee)
-    user_id = attendee[:Attendee][:ExternalUserId].split('-')[3]
+    user_id = attendee[:Attendee][:ExternalUserId].delete_prefix(ChimeSdk.config.prefix)[/\AUser-(\d+)\z/, 1]
     {
       "AttendeeType": "User",
-      "User": User.find_by_id(user_id)
+      "User": User.find_by_id(user_id)&.slice(:id, :name)
     }
   end
 

data/spec/requests/atendees_spec.rb

@@ -5,6 +5,7 @@ describe ChimeSdk::Controller::Attendees, type: :request do
     @dummy_meeting_id  = "91234567-89ab-cdef-ghij-klmnopqrstuv"
     @dummy_attendee_id = "96543210-ba98-fedc-jihg-vutsrqponmlk"
     @other_meeting_id  = "81234567-89ab-cdef-ghij-klmnopqrstuv"
+    @other_app_attendee_id = "86543210-ba98-fedc-jihg-vutsrqponmlk"
 
     @room = create(:room)
     @other_room = create(:room)
@@ -40,6 +41,11 @@ describe ChimeSdk::Controller::Attendees, type: :request do
       }
     }
 
+    other_app_attendee = test_attendee.merge(
+      external_user_id: "OtherApp-test-User-#{@attendee_user.id}",
+      attendee_id: @other_app_attendee_id
+    )
+
     # Use stubs for the AWS SDK for Ruby
     client = Aws::ChimeSDKMeetings::Client.new(stub_responses: true)
     client.stub_responses(:get_meeting, -> (context) {
@@ -54,7 +60,11 @@ describe ChimeSdk::Controller::Attendees, type: :request do
     })
     client.stub_responses(:get_attendee, -> (context) {
       context.params[:meeting_id] == @meeting_id ?
-        (context.params[:attendee_id] == @attendee_id ? { attendee: test_attendee } : 'NotFoundException') :
+        (case context.params[:attendee_id]
+         when @attendee_id then { attendee: test_attendee }
+         when @other_app_attendee_id then { attendee: other_app_attendee }
+         else 'NotFoundException'
+         end) :
         'ForbiddenException'
     })
     client.stub_responses(:create_attendee, -> (context) {
@@ -156,6 +166,21 @@ describe ChimeSdk::Controller::Attendees, type: :request do
             it "returns application metadata in the attendee" do
               expect(JSON.parse(response.body)["Attendee"]["ApplicationMetadata"]["User"]["id"]).to eq(@attendee_user.id)
             end
+
+            it "returns only id and name of the user in application metadata" do
+              expect(JSON.parse(response.body)["Attendee"]["ApplicationMetadata"]["User"].keys).to match_array(["id", "name"])
+            end
+          end
+
+          context "when the attendee is created by another application" do
+            before do
+              get "#{api_meetings_path}/attendees/#{@other_app_attendee_id}", headers: @auth_headers
+            end
+
+            it "does not resolve the user from external user id" do
+              expect(response).to have_http_status(200)
+              expect(JSON.parse(response.body)["Attendee"]["ApplicationMetadata"]["User"]).to be_nil
+            end
           end
 
           context "when the attendee is not found" do

data/spec/requests/meetings_spec.rb

@@ -194,6 +194,10 @@ describe ChimeSdk::Controller::Meetings, type: :request do
               expect(JSON.parse(response.body)["Meeting"]["ApplicationMetadata"]["PrivateRoom"]["id"]).to eq(@room.id)
             end
 
+            it "returns only id and name of the room in application metadata" do
+              expect(JSON.parse(response.body)["Meeting"]["ApplicationMetadata"]["PrivateRoom"].keys).to match_array(["id", "name"])
+            end
+
             it "returns created attendee since ChimeSdk.config.create_attendee_from_meeting is enabled" do
               expect(JSON.parse(response.body)["Attendee"]["AttendeeId"]).to eq(@attendee_id)
             end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: amazon-chime-sdk-rails
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.2.1
 platform: ruby
 authors:
 - Shota Yamazaki