@rapidmx/meet-plugin 0.1.0

package/dist/types/util/IceServerUtils.d.ts

@@ -0,0 +1,57 @@
+/** A single ICE server entry, matching the shape the browser `RTCPeerConnection` `iceServers` constructor option
+ * expects (`RTCIceServer`), so the join response can be handed to it directly with no reshaping. */
+export interface IceServerConfig {
+    urls: string;
+    username?: string;
+    credential?: string;
+}
+/** The `mail:videoconf:turn:*` settings, exactly as configured (empty strings for anything unset). */
+export interface TurnSettings {
+    url: string;
+    username: string;
+    credential: string;
+    sharedSecret: string;
+}
+/** Always-available, free public STUN servers - discovery only, no media relay. Two independent providers, so a
+ * call still has STUN available if one of them is ever unreachable. */
+export declare const DEFAULT_STUN_SERVERS: readonly IceServerConfig[];
+/** How long a minted TURN REST credential remains valid for, in seconds. One hour comfortably covers ICE
+ * negotiation and reconnection attempts for the length of a typical call without minting a fresh credential on
+ * every join. */
+export declare const DEFAULT_TURN_CREDENTIAL_TTL_SECONDS: number;
+/**
+ * Generates a coturn-style time-limited REST API credential: `username` is `<unix-expiry-timestamp>:<userPart>`,
+ * and `credential` is `base64(HMAC-SHA1(sharedSecret, username))`. This is coturn's own documented
+ * `static-auth-secret` mechanism (the `turnserver -a -X` REST credential algorithm) - implemented here exactly,
+ * not guessed at: the TURN server derives the same HMAC independently at connection time using the timestamp
+ * embedded in the username it's handed, so no round trip to the TURN server is needed to mint one.
+ *
+ * @param sharedSecret The operator's `mail:videoconf:turn:shared_secret`.
+ * @param userPart The identity portion of the username - the configured `mail:videoconf:turn:username`, or a
+ * generated one when that's unset (see `buildIceServers()`).
+ * @param ttlSeconds How long the credential remains valid for, from `now`.
+ * @param now The time to compute the expiry from. Defaults to the real current time; a test may pass a fixed
+ * value for a deterministic assertion.
+ */
+export declare function turnRestCredential(sharedSecret: string, userPart: string, ttlSeconds?: number, now?: Date): {
+    username: string;
+    credential: string;
+};
+/**
+ * Builds the full ICE server list for a join response: the hardcoded public STUN servers, plus a TURN entry when
+ * `settings.url` is configured. When a `sharedSecret` is also configured, the TURN entry carries a fresh,
+ * time-limited credential (`turnRestCredential()`) rather than the static `username`/`credential` pair, which is
+ * used verbatim only when no shared secret is set. A TURN url with neither a shared secret nor a static
+ * credential is still included with no credentials at all - some self-hosted TURN servers are deliberately run
+ * without authentication for testing, and it costs nothing to pass the url through as configured.
+ *
+ * @param settings The `mail:videoconf:turn:*` settings, exactly as configured.
+ * @param options `ttlSeconds`/`now` are forwarded to `turnRestCredential()`. `randomUserPart` supplies the
+ * generated identity portion of a shared-secret credential's username when `settings.username` is unset -
+ * defaults to a fresh random hex string; a test may override it for a deterministic assertion.
+ */
+export declare function buildIceServers(settings: TurnSettings, options?: {
+    ttlSeconds?: number;
+    now?: Date;
+    randomUserPart?: () => string;
+}): IceServerConfig[];

package/dist/types/util/PublicUrlUtils.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Normalizes a `mail:videoconf:public_url`-shaped setting into a base URL (origin plus path, no trailing slash),
+ * or `undefined` when it's unset or unsafe to advertise - mirroring `@rapidmx/autodiscover`'s `BaseAutodiscoverRoute`
+ * private `baseUrl` getter exactly (that helper isn't exported from `@rapidmx/restapi` for reuse, so this is a
+ * small, independent copy of the same validation): the value must parse as a URL, use `https:` (plain `http:` is
+ * only tolerated for a loopback host, for local development), and carry no credentials, query string or fragment -
+ * any of which would produce a broken or insecure join link once a token is appended.
+ *
+ * @param rawUrl The configured setting value, e.g. `https://mail.example.com/meet`.
+ */
+export declare function buildBaseUrl(rawUrl: string | undefined): string | undefined;

package/dist/types/util/RouteAccessUtils.d.ts

@@ -0,0 +1,8 @@
+import { type JWTUser } from "@rapidrest/core";
+/**
+ * `user` without its trusted roles (and without its elevation), for handing to code that would otherwise treat
+ * the caller as a superuser: `ACLUtils.hasPermission()`, `RepoUtils` with `{ user }` and no `ignoreACL`. Everything
+ * else about the identity - uid, other roles, scopes - is unchanged, so an owner or delegate record still
+ * matches. Returns `user` itself when it has nothing to strip.
+ */
+export declare function stripTrustedRoles(user: JWTUser | undefined, trustedRoles: readonly string[]): JWTUser | undefined;

package/dist/types/util/TokenUtils.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The exact shape `mintJoinToken()` produces: 32 random bytes, base64url without padding - mirroring
+ * `booking-plugin`'s `Booking.manageToken` shape/entropy exactly (see its `BaseBookingRoute.MANAGE_TOKEN_PATTERN`).
+ * Checked before any lookup, so a candidate value is always a plain literal by the time it reaches a query.
+ */
+export declare const JOIN_TOKEN_PATTERN: RegExp;
+/**
+ * The exact shape `mintPublicSlug()` produces: 8 random bytes, base64url without padding - deliberately a
+ * different length than `JOIN_TOKEN_PATTERN` (11 characters vs. 43), so the two can never collide and
+ * `BaseVideoMeetingRoute.join()` can tell which kind of value it was handed from its length alone, without
+ * ambiguity, rather than trying both lookups against a value that only matched one of them (see that method's
+ * doc comment for the disambiguation this enables).
+ */
+export declare const PUBLIC_SLUG_PATTERN: RegExp;
+/** Mints a private meeting invitee's `joinToken`: 32 random bytes, base64url. Matches `JOIN_TOKEN_PATTERN`. */
+export declare function mintJoinToken(): string;
+/**
+ * Mints a public meeting's `publicSlug`: 8 random bytes, base64url (~48 bits of entropy). Matches
+ * `PUBLIC_SLUG_PATTERN`. Random rather than name-derived (unlike `booking-plugin`'s human-authored
+ * `BookingType.slug`) since nothing about a video meeting is memorable or worth choosing by hand - it only ever
+ * appears embedded in a link.
+ */
+export declare function mintPublicSlug(): string;

package/package.json

@@ -0,0 +1,181 @@
+{
+    "name": "@rapidmx/meet-plugin",
+    "version": "0.1.0",
+    "description": "RapidMX plugin that provides WebRTC video conferencing, joinable from a calendar invite or a shared link.",
+    "repository": "https://github.com/RapidMX/meet-plugin.git",
+    "author": "RapidREST <rapidrests@gmail.com>",
+    "license": "MPL-2.0",
+    "contributors": [
+        "Jean-Philippe Steinmetz"
+    ],
+    "scripts": {
+        "build": "yarn lint && rimraf dist && tsc && tsc -p tsconfig.apps.json",
+        "lint": "eslint ./src ./apps ./test",
+        "local-audit": "yarn install && yarn npm audit -A -R \"$@\"",
+        "checkup": "yarn dlx @yarnpkg/doctor \"$@\"",
+        "dependency-check": "yarn dlx depcheck \"$@\"",
+        "report-coverage": "cat ./coverage/lcov.info | coveralls",
+        "test": "vitest run",
+        "test:prod": "npm run lint && vitest run --coverage",
+        "test:watch": "vitest",
+        "release": "npx @rapidrest/cli release",
+        "prepublish": "yarn build"
+    },
+    "peerDependencies": {
+        "@rapidmx/react-shared": ">=0.6.0 <1",
+        "@rapidmx/restapi": ">=0.17.0 <1",
+        "@rapidmx/web-client": ">=0.11.0 <1",
+        "@rapidrest/core": "5.x",
+        "@rapidrest/service-core": "2.x",
+        "react": "19.x",
+        "react-dom": "19.x"
+    },
+    "devDependencies": {
+        "@rapidmx/react-shared": "^0.13.0",
+        "@rapidmx/restapi": "^0.19.0",
+        "@rapidmx/web-client": "^0.13.0",
+        "@rapidrest/core": "^5.2.2",
+        "@rapidrest/service-core": "^2.1.1",
+        "@swc/core": "^1.16.2",
+        "@testing-library/dom": "^10.4.1",
+        "@testing-library/jest-dom": "^7.0.1",
+        "@testing-library/react": "^16.3.3",
+        "@testing-library/user-event": "^14.6.7",
+        "@types/nconf": "^0.10.7",
+        "@types/node": "^26.5.0",
+        "@types/react": "^19.2.18",
+        "@types/react-dom": "^19.2.7",
+        "@typescript-eslint/eslint-plugin": "^8.70.0",
+        "@typescript-eslint/parser": "^8.70.0",
+        "@vitest/coverage-v8": "^5.0.0",
+        "better-sqlite3": "^13.0.3",
+        "eslint": "^10.10.0",
+        "eslint-config-prettier": "^10.1.8",
+        "eslint-plugin-import": "^2.32.0",
+        "eslint-plugin-jsdoc": "^64.3.6",
+        "globals": "^17.12.0",
+        "jsdom": "^30.0.1",
+        "lodash-es": "^4.18.1",
+        "mongodb": "^7.6.0",
+        "mongodb-memory-server": "^11.2.0",
+        "nconf": "^0.13.0",
+        "openapi3-ts": "^4.6.1",
+        "prom-client": "^15.1.3",
+        "react": "^19.2.8",
+        "react-dom": "^19.2.8",
+        "redis": "^6.2.1",
+        "reflect-metadata": "^0.2.2",
+        "rimraf": "^6.1.3",
+        "ts-node": "^10.9.2",
+        "tsx": "^4.23.13",
+        "typeorm": "^1.1.1",
+        "typescript": "^6.0.3",
+        "unplugin-swc": "^1.6.0",
+        "uuid": "^14.0.2",
+        "vite": "^8.2.2",
+        "vitest": "^5.0.0",
+        "winston": "^3.19.0"
+    },
+    "resolutions": {
+        "@rapidmx/react-shared": "^0.11.0",
+        "@rapidmx/restapi": "^0.17.0",
+        "@rapidmx/web-client": "^0.11.0"
+    },
+    "packageManager": "yarn@4.5.3",
+    "engines": {
+        "node": ">=24.0.0"
+    },
+    "publishConfig": {
+        "registry": "https://registry.npmjs.org/"
+    },
+    "type": "module",
+    "main": "dist/lib/index.js",
+    "exports": {
+        ".": {
+            "import": "./dist/lib/index.js",
+            "types": "./dist/types/index.d.ts"
+        },
+        "./mongo": {
+            "import": "./dist/lib/mongo.js",
+            "types": "./dist/types/mongo.d.ts"
+        },
+        "./sql": {
+            "import": "./dist/lib/sql.js",
+            "types": "./dist/types/sql.d.ts"
+        }
+    },
+    "typings": "dist/types/index.d.ts",
+    "files": [
+        "apps",
+        "dist"
+    ],
+    "rapidmx": {
+        "plugin": {
+            "apiVersion": 1,
+            "displayName": "Video Conferencing",
+            "description": "Private and public WebRTC video meetings. A private meeting mints one link per invitee for a calendar invite's location and body; a public meeting shares a single link. Joining needs no account - a guest picks a name, checks their camera and microphone, and enters.",
+            "mailboxScopedData": true,
+            "settings": [
+                {
+                    "key": "mail:videoconf:public_url",
+                    "label": "Public join page URL",
+                    "type": "string",
+                    "default": "",
+                    "help": "The address of the public join pages, for example https://mail.example.com/meet. Calendar invites include a join link only when this is set."
+                },
+                {
+                    "key": "mail:videoconf:turn:url",
+                    "label": "TURN server URL",
+                    "type": "string",
+                    "default": "",
+                    "help": "A turn: or turns: URL (e.g. turns:turn.example.com:5349) relaying media for a participant behind a restrictive NAT or firewall, for whom a direct peer-to-peer connection fails. Public STUN servers are used for everyone else and need no configuration. Leave empty to serve calls with STUN only - most calls will still connect, but some participants may not."
+                },
+                {
+                    "key": "mail:videoconf:turn:username",
+                    "label": "TURN server username",
+                    "type": "string",
+                    "default": "",
+                    "help": "Used as-is unless a shared secret is also set below, in which case it is combined with a per-join expiring credential instead (coturn's time-limited REST credential mechanism) and this value is ignored."
+                },
+                {
+                    "key": "mail:videoconf:turn:credential",
+                    "label": "TURN server credential (static)",
+                    "type": "string",
+                    "default": "",
+                    "help": "The TURN server's password for the username above. Ignored when a shared secret is set below."
+                },
+                {
+                    "key": "mail:videoconf:turn:shared_secret",
+                    "label": "TURN server shared secret (for expiring credentials)",
+                    "type": "string",
+                    "default": "",
+                    "help": "coturn's static-auth-secret, if configured. When set, every join mints its own short-lived username/credential pair (an HMAC-SHA1 of a timestamp with this secret) instead of handing out one permanent password to every participant - the recommended setup. Leave empty to use the static username/credential above instead."
+                }
+            ],
+            "ui": {
+                "apps": [
+                    {
+                        "id": "meet",
+                        "host": "public",
+                        "mount": "/meet",
+                        "dir": "apps/meet"
+                    },
+                    {
+                        "id": "video-conferencing",
+                        "host": "www",
+                        "mount": "/settings/video-conferencing",
+                        "dir": "apps/settings-video-conferencing"
+                    }
+                ],
+                "settingsSections": [
+                    {
+                        "id": "video-conferencing",
+                        "label": "Video Conferencing",
+                        "href": "/settings/video-conferencing",
+                        "icon": "HiOutlineVideoCamera"
+                    }
+                ]
+            }
+        }
+    }
+}