@rapidmx/meet-plugin 0.9.1 → 0.9.3

package/apps/shared/media/deviceMedia.ts

@@ -50,10 +50,28 @@ const UNSUPPORTED_ERROR: MediaAccessError = {
     message: "This browser (or this page's connection) doesn't support camera/microphone access. Try a modern browser over HTTPS.",
 };
 
+/** A "no such device" error naming exactly what was missing: just the microphone, just the camera, or - when
+ * both were asked for (or a caller doesn't say, e.g. `listDevices()`/`requestDisplayMedia()`'s own failures, which
+ * have no single "kind" to name) - both. Exported so `useLocalMedia.ts`'s `acquireBoth()` can build the same
+ * "both missing" message after finding out separately that neither device exists, rather than only being able to
+ * report whichever one it happened to ask about last. */
+export function notFoundError(wantsAudio: boolean, wantsVideo: boolean): MediaAccessError {
+    const message =
+        wantsAudio && !wantsVideo
+            ? "No microphone was found on this device."
+            : wantsVideo && !wantsAudio
+              ? "No camera was found on this device."
+              : "No camera or microphone was found on this device.";
+    return { kind: "not-found", message };
+}
+
 /** Maps a `getUserMedia()`/`getDisplayMedia()`/`enumerateDevices()` rejection to a friendly, already-complete
  * message - the handful of `DOMException` names a browser actually raises for these calls, matched by name rather
- * than `instanceof DOMException` (a test's fake rejection need not be a real `DOMException`). */
-export function classifyMediaError(err: unknown): MediaAccessError {
+ * than `instanceof DOMException` (a test's fake rejection need not be a real `DOMException`). `requested` is the
+ * constraints the failed call actually asked for, so a "not found" error can name just the camera or just the
+ * microphone rather than always blaming both - omitted (by `listDevices()`/`requestDisplayMedia()`, neither of
+ * which asks for one kind specifically) it's treated as having asked for both. */
+export function classifyMediaError(err: unknown, requested?: MediaStreamConstraints): MediaAccessError {
     const name: string = err instanceof Error ? err.name : "";
     switch (name) {
         case "NotAllowedError":
@@ -61,7 +79,7 @@ export function classifyMediaError(err: unknown): MediaAccessError {
             return { kind: "permission-denied", message: "Camera/microphone access was denied. Allow access in your browser and try again." };
         case "NotFoundError":
         case "OverconstrainedError":
-            return { kind: "not-found", message: "No camera or microphone was found on this device." };
+            return notFoundError(requested ? !!requested.audio : true, requested ? !!requested.video : true);
         default:
             return { kind: "unknown", message: "Could not access your camera or microphone. Please try again." };
     }
@@ -107,7 +125,7 @@ export async function requestUserMedia(
     try {
         return { ok: true, value: await devices.getUserMedia(constraints) };
     } catch (err) {
-        return { ok: false, error: classifyMediaError(err) };
+        return { ok: false, error: classifyMediaError(err, constraints) };
     }
 }
 

package/apps/shared/media/useLocalMedia.ts

@@ -38,6 +38,7 @@ import {
     defaultMediaDevices,
     isMediaDevicesSupported,
     listDevices,
+    notFoundError,
     requestUserMedia,
 } from "./deviceMedia.js";
 import { startLevelMeter } from "./levelMeter.js";
@@ -115,6 +116,25 @@ function statusFor(error: MediaAccessError): TrackStatus {
     }
 }
 
+/** After asking for the camera and the microphone separately (`acquireBoth()`'s fallback, one at a time rather
+ * than together), the one error to show for both attempts together - naming both devices when both are actually
+ * missing, rather than just whichever of the two happened to be asked about last (which would otherwise say "no
+ * camera" even when the microphone is *also* missing, or say nothing at all when only the microphone is missing,
+ * since the camera's own success would otherwise clear the error the microphone's failure had just set). `null`
+ * when both succeeded. */
+function combineErrors(audio: MediaAccessError | null, video: MediaAccessError | null): MediaAccessError | null {
+    if (!audio || !video) {
+        return audio ?? video;
+    }
+    if (audio.kind === "not-found" && video.kind === "not-found") {
+        return notFoundError(true, true);
+    }
+    // Different reasons - unusual (e.g. permission denied for one, missing hardware for the other). Permission is
+    // the more actionable of the two, so it's what's shown; otherwise there's no single message that honestly
+    // describes both, so this just picks one.
+    return audio.kind === "permission-denied" ? audio : video;
+}
+
 export interface LocalMediaOptions {
     /** Where the filters' models are hosted, when not on the default CDN - see `filters/mlModels.ts`. */
     effectsAssetsUrl?: string;
@@ -245,7 +265,7 @@ export function useLocalMedia({ effectsAssetsUrl }: LocalMediaOptions = {}): Loc
 
     /** Asks for one kind on its own - a specific device when `deviceId` is given, else the one used last time. */
     const acquire = useCallback(
-        async (kind: MediaKind, deviceId?: string): Promise<boolean> => {
+        async (kind: MediaKind, deviceId?: string): Promise<MediaAccessError | null> => {
             const base = kind === "audio" ? AUDIO_CONSTRAINTS : VIDEO_CONSTRAINTS;
             const prefs = ensurePrefs();
             const constraint: MediaTrackConstraints = deviceId
@@ -257,13 +277,13 @@ export function useLocalMedia({ effectsAssetsUrl }: LocalMediaOptions = {}): Loc
                     setError(result.error);
                     setStatus((prev) => ({ ...prev, [kind]: statusFor(result.error) }));
                 }
-                return false;
+                return result.error;
             }
             adoptStream(result.value);
             if (mountedRef.current) {
                 setError(null);
             }
-            return true;
+            return null;
         },
         [adoptStream, ensurePrefs],
     );
@@ -292,9 +312,13 @@ export function useLocalMedia({ effectsAssetsUrl }: LocalMediaOptions = {}): Loc
             }
         } else {
             // No camera, no microphone, or the two together couldn't be satisfied: ask for each on its own, so one
-            // missing device doesn't cost the participant the other.
-            await acquire("audio");
-            await acquire("video");
+            // missing device doesn't cost the participant the other - then combine what each found into one
+            // message (see `combineErrors()`) rather than showing whichever of the two ran last.
+            const audioError = await acquire("audio");
+            const videoError = await acquire("video");
+            if (mountedRef.current) {
+                setError(combineErrors(audioError, videoError));
+            }
         }
     }, [acquire, adoptStream, ensurePrefs]);
 
@@ -359,7 +383,7 @@ export function useLocalMedia({ effectsAssetsUrl }: LocalMediaOptions = {}): Loc
                     setTracks(tracksRef.current);
                 }
             }
-            if (await acquire(kind, deviceId)) {
+            if ((await acquire(kind, deviceId)) === null) {
                 remember(kind === "audio" ? { microphoneId: deviceId } : { cameraId: deviceId });
             }
             await refreshDevices();

package/apps/shared/push/GuestSignalingClient.ts

@@ -40,9 +40,11 @@
  * request carries no `Authorization` header at all and instead relies on `fetch()`'s own default same-origin
  * credentials mode, which already attaches the browser's real `jwt` cookie to a same-origin request with zero
  * extra code - `JWTStrategy.getAuthToken()`'s cookie fallback authenticates it exactly as it would any other
- * same-origin authenticated call. Fire-and-forget either way, matching every other push publish in this codebase -
- * a failed send is logged, never thrown, since a caller (`MeshConnectionManager`) has no meaningful per-message
- * retry of its own.
+ * same-origin authenticated call. Either way `send()` also attaches the CSRF double-submit header
+ * (`withCsrfHeader()`) - required server-side only for the cookie case, but harmless to send for the bearer one
+ * too - see `send()`'s own doc comment. Fire-and-forget either way, matching every other push publish in this
+ * codebase - a failed send is logged, never thrown, since a caller (`MeshConnectionManager`) has no meaningful
+ * per-message retry of its own.
  * - An incoming meeting message arrives wrapped `{ type: "MESSAGE", channel, data: <the posted body> }` - this
  * client unwraps it and delivers `data` (expected to be a `SignalMessage`) to `onMessage()` listeners.
  *
@@ -63,7 +65,7 @@
  * absent, as described above - the browser's real cookie was always going to win that write anyway, so the
  * correct behavior is to not fight it and let it authenticate normally instead.
  */
-import { apiOrigin } from "@rapidmx/web-client/lib/util/api.js";
+import { apiOrigin, withCsrfHeader } from "@rapidmx/web-client/lib/util/api.js";
 import { pushUrl } from "@rapidmx/web-client/lib/mail/pushClient.js";
 import type { SignalMessage, SignalingChannel } from "../webrtc/types.js";
 
@@ -174,7 +176,16 @@ export class GuestSignalingClient implements SignalingChannel {
 
     /** Publishes over `POST /push/:id`, with `token` as a bearer credential when present - see this module's doc
      * comment on why this, unlike subscribing, needs no cookie workaround at all, and on the omitted-`token` case
-     * (an already-authenticated real caller), which relies on the browser's own real `jwt` cookie instead.
+     * (an already-authenticated real caller), which relies on the browser's own real `jwt` cookie instead - and,
+     * because that's a *cookie*-authenticated request, also needs the matching CSRF header
+     * (`@rapidmx/web-client`'s `withCsrfHeader()`, the same double-submit echo `apiFetch()` applies to every other
+     * mutating call this server answers): without it, `RouteUtils.checkCsrf()` refuses the request with 403
+     * `"This request is missing a valid CSRF token."` before it ever reaches `BasePushRoute.send()`'s own ACL
+     * check - every `hello`/offer/answer/ICE candidate/`bye` a participant on that path sends 403s and is
+     * silently dropped (`send()` is fire-and-forget), which looks exactly like "stuck connecting, then no audio or
+     * video" from everyone else's side. `withCsrfHeader()` is harmless to also add on the bearer-token (guest)
+     * branch - the server only enforces the check for `req.auth.source === "cookie"` - so it's applied
+     * unconditionally here rather than only for the cookie case.
      * Fire-and-forget: a failure is swallowed (there is nothing a signaling message's own sender can usefully do
      * about a dropped publish beyond what the mesh's own `hello` re-announcement/renegotiation already tolerates -
      * see `MeshConnectionManager`'s doc comment on fire-and-forget delivery). */
@@ -190,7 +201,7 @@ export class GuestSignalingClient implements SignalingChannel {
         }
         void fetchImpl(`${origin}/push/${encodeURIComponent(this.options.channel)}`, {
             method: "POST",
-            headers,
+            headers: withCsrfHeader(headers, "POST"),
             body: JSON.stringify(message),
             // Only a `bye` needs to survive the page unloading - every other message is sent while the page (and
             // the rest of this call's signaling) is very much alive. `keepalive` is a real-world liability to set

package/apps/shared/relay/AudioPlayer.ts

@@ -16,6 +16,10 @@ export const JITTER_BUFFER_SECONDS = 0.08;
 export const MAX_AHEAD_SECONDS = 0.4;
 /** Skip a packet instead of queueing it when the decoder is this far behind. */
 export const AUDIO_MAX_DECODE_QUEUE = 16;
+/** The length of the fade-in `play()` gives a block that doesn't pick up exactly where the last one left off (the
+ * first block, or the one after a gap) - long enough to mask the click such a discontinuity would otherwise
+ * produce, short enough that it is never heard as an actual fade. */
+export const DISCONTINUITY_FADE_SECONDS = 0.004;
 
 /**
  * Decodes one sender's Opus packets and schedules them for playback into a `MediaStreamAudioDestinationNode`.
@@ -23,8 +27,16 @@ export const AUDIO_MAX_DECODE_QUEUE = 16;
  * Each decoded block is copied into an `AudioBuffer` and started on its own `AudioBufferSourceNode` at
  * `max(currentTime + jitter, nextTime)`, where `nextTime` is when the previous block ends - so consecutive blocks
  * join seamlessly, and after a gap in the stream playback restarts with the jitter buffer's worth of headroom.
- * Opus packets are independently decodable, so a lost packet costs only its own 20 ms and needs no recovery step;
- * the decoder is created lazily and discarded on any error, and replaced by the next packet.
+ * Opus packets are independently decodable, so a lost packet costs only its own 20 ms and needs no recovery step
+ * *in terms of content* - but the shared decoder (reused across packets so it keeps its normal state between them,
+ * not recreated per packet) is never told a packet was skipped, so its internal prediction state no longer matches
+ * what it decodes next. Audibly this can be a click right at that seam, not just silence where the lost packet
+ * would have been - the same is true of the very first block (nothing at all came before it) and of the block
+ * after a stall long enough to need the jitter buffer's full headroom again. `play()` gives exactly those blocks a
+ * few milliseconds' fade-in (`DISCONTINUITY_FADE_SECONDS`) through a `GainNode` to mask it; an ordinary block that
+ * picks up exactly where the last one ended gets none - fading *every* block would itself be audible, a faint
+ * tremolo at the packet rate. The decoder is created lazily and discarded on any error, and replaced by the next
+ * packet.
  */
 export class AudioPlayer {
     private decoder: DecoderLike | undefined;
@@ -97,9 +109,23 @@ export class AudioPlayer {
             buffer.copyToChannel(pcm, 0);
             const source = this.ctx.createBufferSource();
             source.buffer = buffer;
-            source.connect(this.destination);
-            source.onended = () => source.disconnect();
             const start = Math.max(now + JITTER_BUFFER_SECONDS, this.nextTime);
+            if (start > this.nextTime) {
+                // A gap, not a continuation - the decoder's state no longer matches what it's about to decode (see
+                // this class's doc comment), so fade this block in rather than let it start abruptly.
+                const gain = this.ctx.createGain();
+                gain.gain.setValueAtTime(0, start);
+                gain.gain.linearRampToValueAtTime(1, start + DISCONTINUITY_FADE_SECONDS);
+                source.connect(gain);
+                gain.connect(this.destination);
+                source.onended = () => {
+                    source.disconnect();
+                    gain.disconnect();
+                };
+            } else {
+                source.connect(this.destination);
+                source.onended = () => source.disconnect();
+            }
             source.start(start);
             this.nextTime = start + buffer.duration;
         } catch {

package/apps/shared/relay/relayEnv.ts

@@ -74,7 +74,14 @@ export interface ScriptProcessorLike extends AudioNodeLike {
 }
 
 export interface GainLike extends AudioNodeLike {
-    gain: { value: number };
+    gain: {
+        value: number;
+        /** `AudioParam.setValueAtTime()` - used to schedule a fade (`AudioPlayer`'s discontinuity fade-in), not
+         * needed for `AudioSender`'s own static, unscheduled mute (a plain `.value = 0` assignment). */
+        setValueAtTime(value: number, startTime: number): unknown;
+        /** `AudioParam.linearRampToValueAtTime()`. */
+        linearRampToValueAtTime(value: number, endTime: number): unknown;
+    };
 }
 
 export interface AudioBufferLike {

package/dist/apps/shared/media/deviceMedia.d.ts

@@ -36,10 +36,19 @@ export type MediaResult<T> = {
 export declare function defaultMediaDevices(): MediaDevicesLike | undefined;
 /** Whether `devices.getUserMedia` is actually callable - the one capability every caller here needs at minimum. */
 export declare function isMediaDevicesSupported(devices?: MediaDevicesLike | undefined): boolean;
+/** A "no such device" error naming exactly what was missing: just the microphone, just the camera, or - when
+ * both were asked for (or a caller doesn't say, e.g. `listDevices()`/`requestDisplayMedia()`'s own failures, which
+ * have no single "kind" to name) - both. Exported so `useLocalMedia.ts`'s `acquireBoth()` can build the same
+ * "both missing" message after finding out separately that neither device exists, rather than only being able to
+ * report whichever one it happened to ask about last. */
+export declare function notFoundError(wantsAudio: boolean, wantsVideo: boolean): MediaAccessError;
 /** Maps a `getUserMedia()`/`getDisplayMedia()`/`enumerateDevices()` rejection to a friendly, already-complete
  * message - the handful of `DOMException` names a browser actually raises for these calls, matched by name rather
- * than `instanceof DOMException` (a test's fake rejection need not be a real `DOMException`). */
-export declare function classifyMediaError(err: unknown): MediaAccessError;
+ * than `instanceof DOMException` (a test's fake rejection need not be a real `DOMException`). `requested` is the
+ * constraints the failed call actually asked for, so a "not found" error can name just the camera or just the
+ * microphone rather than always blaming both - omitted (by `listDevices()`/`requestDisplayMedia()`, neither of
+ * which asks for one kind specifically) it's treated as having asked for both. */
+export declare function classifyMediaError(err: unknown, requested?: MediaStreamConstraints): MediaAccessError;
 export interface DeviceLists {
     cameras: MediaDeviceInfo[];
     microphones: MediaDeviceInfo[];

package/dist/apps/shared/media/deviceMedia.js

@@ -29,10 +29,26 @@ const UNSUPPORTED_ERROR = {
     kind: "unsupported",
     message: "This browser (or this page's connection) doesn't support camera/microphone access. Try a modern browser over HTTPS.",
 };
+/** A "no such device" error naming exactly what was missing: just the microphone, just the camera, or - when
+ * both were asked for (or a caller doesn't say, e.g. `listDevices()`/`requestDisplayMedia()`'s own failures, which
+ * have no single "kind" to name) - both. Exported so `useLocalMedia.ts`'s `acquireBoth()` can build the same
+ * "both missing" message after finding out separately that neither device exists, rather than only being able to
+ * report whichever one it happened to ask about last. */
+export function notFoundError(wantsAudio, wantsVideo) {
+    const message = wantsAudio && !wantsVideo
+        ? "No microphone was found on this device."
+        : wantsVideo && !wantsAudio
+            ? "No camera was found on this device."
+            : "No camera or microphone was found on this device.";
+    return { kind: "not-found", message };
+}
 /** Maps a `getUserMedia()`/`getDisplayMedia()`/`enumerateDevices()` rejection to a friendly, already-complete
  * message - the handful of `DOMException` names a browser actually raises for these calls, matched by name rather
- * than `instanceof DOMException` (a test's fake rejection need not be a real `DOMException`). */
-export function classifyMediaError(err) {
+ * than `instanceof DOMException` (a test's fake rejection need not be a real `DOMException`). `requested` is the
+ * constraints the failed call actually asked for, so a "not found" error can name just the camera or just the
+ * microphone rather than always blaming both - omitted (by `listDevices()`/`requestDisplayMedia()`, neither of
+ * which asks for one kind specifically) it's treated as having asked for both. */
+export function classifyMediaError(err, requested) {
     const name = err instanceof Error ? err.name : "";
     switch (name) {
         case "NotAllowedError":
@@ -40,7 +56,7 @@ export function classifyMediaError(err) {
             return { kind: "permission-denied", message: "Camera/microphone access was denied. Allow access in your browser and try again." };
         case "NotFoundError":
         case "OverconstrainedError":
-            return { kind: "not-found", message: "No camera or microphone was found on this device." };
+            return notFoundError(requested ? !!requested.audio : true, requested ? !!requested.video : true);
         default:
             return { kind: "unknown", message: "Could not access your camera or microphone. Please try again." };
     }
@@ -78,7 +94,7 @@ export async function requestUserMedia(constraints, devices = defaultMediaDevice
         return { ok: true, value: await devices.getUserMedia(constraints) };
     }
     catch (err) {
-        return { ok: false, error: classifyMediaError(err) };
+        return { ok: false, error: classifyMediaError(err, constraints) };
     }
 }
 /** Requests a screen/window/tab share via the browser's own picker. Audio is never requested (this design shares

package/dist/apps/shared/media/useLocalMedia.js

@@ -32,7 +32,7 @@
  * Nothing here runs during SSR: browser APIs are only touched from effects and event handlers.
  */
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
-import { defaultMediaDevices, isMediaDevicesSupported, listDevices, requestUserMedia, } from "./deviceMedia.js";
+import { defaultMediaDevices, isMediaDevicesSupported, listDevices, notFoundError, requestUserMedia, } from "./deviceMedia.js";
 import { startLevelMeter } from "./levelMeter.js";
 import { loadPicture, prepareBackgroundImage } from "./filters/backgroundImage.js";
 import { NO_FILTERS, filtersActive } from "./filters/filterTypes.js";
@@ -55,6 +55,24 @@ function statusFor(error) {
             return "error";
     }
 }
+/** After asking for the camera and the microphone separately (`acquireBoth()`'s fallback, one at a time rather
+ * than together), the one error to show for both attempts together - naming both devices when both are actually
+ * missing, rather than just whichever of the two happened to be asked about last (which would otherwise say "no
+ * camera" even when the microphone is *also* missing, or say nothing at all when only the microphone is missing,
+ * since the camera's own success would otherwise clear the error the microphone's failure had just set). `null`
+ * when both succeeded. */
+function combineErrors(audio, video) {
+    if (!audio || !video) {
+        return audio ?? video;
+    }
+    if (audio.kind === "not-found" && video.kind === "not-found") {
+        return notFoundError(true, true);
+    }
+    // Different reasons - unusual (e.g. permission denied for one, missing hardware for the other). Permission is
+    // the more actionable of the two, so it's what's shown; otherwise there's no single message that honestly
+    // describes both, so this just picks one.
+    return audio.kind === "permission-denied" ? audio : video;
+}
 /** `base`, asking for `preferredId` (the device used last time) when there is one - as a preference, not a demand. */
 function preferring(base, preferredId) {
     return preferredId ? { ...base, deviceId: { ideal: preferredId } } : base;
@@ -172,13 +190,13 @@ export function useLocalMedia({ effectsAssetsUrl } = {}) {
                 setError(result.error);
                 setStatus((prev) => ({ ...prev, [kind]: statusFor(result.error) }));
             }
-            return false;
+            return result.error;
         }
         adoptStream(result.value);
         if (mountedRef.current) {
             setError(null);
         }
-        return true;
+        return null;
     }, [adoptStream, ensurePrefs]);
     /** Asks for the camera and the microphone in a single prompt. */
     const acquireBoth = useCallback(async () => {
@@ -206,9 +224,13 @@ export function useLocalMedia({ effectsAssetsUrl } = {}) {
         }
         else {
             // No camera, no microphone, or the two together couldn't be satisfied: ask for each on its own, so one
-            // missing device doesn't cost the participant the other.
-            await acquire("audio");
-            await acquire("video");
+            // missing device doesn't cost the participant the other - then combine what each found into one
+            // message (see `combineErrors()`) rather than showing whichever of the two ran last.
+            const audioError = await acquire("audio");
+            const videoError = await acquire("video");
+            if (mountedRef.current) {
+                setError(combineErrors(audioError, videoError));
+            }
         }
     }, [acquire, adoptStream, ensurePrefs]);
     const requestAccess = useCallback(async (kind) => {
@@ -265,7 +287,7 @@ export function useLocalMedia({ effectsAssetsUrl } = {}) {
                 setTracks(tracksRef.current);
             }
         }
-        if (await acquire(kind, deviceId)) {
+        if ((await acquire(kind, deviceId)) === null) {
             remember(kind === "audio" ? { microphoneId: deviceId } : { cameraId: deviceId });
         }
         await refreshDevices();

package/dist/apps/shared/push/GuestSignalingClient.d.ts

@@ -60,7 +60,16 @@ export declare class GuestSignalingClient implements SignalingChannel {
     onMessage(handler: (message: SignalMessage) => void): () => void;
     /** Publishes over `POST /push/:id`, with `token` as a bearer credential when present - see this module's doc
      * comment on why this, unlike subscribing, needs no cookie workaround at all, and on the omitted-`token` case
-     * (an already-authenticated real caller), which relies on the browser's own real `jwt` cookie instead.
+     * (an already-authenticated real caller), which relies on the browser's own real `jwt` cookie instead - and,
+     * because that's a *cookie*-authenticated request, also needs the matching CSRF header
+     * (`@rapidmx/web-client`'s `withCsrfHeader()`, the same double-submit echo `apiFetch()` applies to every other
+     * mutating call this server answers): without it, `RouteUtils.checkCsrf()` refuses the request with 403
+     * `"This request is missing a valid CSRF token."` before it ever reaches `BasePushRoute.send()`'s own ACL
+     * check - every `hello`/offer/answer/ICE candidate/`bye` a participant on that path sends 403s and is
+     * silently dropped (`send()` is fire-and-forget), which looks exactly like "stuck connecting, then no audio or
+     * video" from everyone else's side. `withCsrfHeader()` is harmless to also add on the bearer-token (guest)
+     * branch - the server only enforces the check for `req.auth.source === "cookie"` - so it's applied
+     * unconditionally here rather than only for the cookie case.
      * Fire-and-forget: a failure is swallowed (there is nothing a signaling message's own sender can usefully do
      * about a dropped publish beyond what the mesh's own `hello` re-announcement/renegotiation already tolerates -
      * see `MeshConnectionManager`'s doc comment on fire-and-forget delivery). */

package/dist/apps/shared/push/GuestSignalingClient.js

@@ -40,9 +40,11 @@
  * request carries no `Authorization` header at all and instead relies on `fetch()`'s own default same-origin
  * credentials mode, which already attaches the browser's real `jwt` cookie to a same-origin request with zero
  * extra code - `JWTStrategy.getAuthToken()`'s cookie fallback authenticates it exactly as it would any other
- * same-origin authenticated call. Fire-and-forget either way, matching every other push publish in this codebase -
- * a failed send is logged, never thrown, since a caller (`MeshConnectionManager`) has no meaningful per-message
- * retry of its own.
+ * same-origin authenticated call. Either way `send()` also attaches the CSRF double-submit header
+ * (`withCsrfHeader()`) - required server-side only for the cookie case, but harmless to send for the bearer one
+ * too - see `send()`'s own doc comment. Fire-and-forget either way, matching every other push publish in this
+ * codebase - a failed send is logged, never thrown, since a caller (`MeshConnectionManager`) has no meaningful
+ * per-message retry of its own.
  * - An incoming meeting message arrives wrapped `{ type: "MESSAGE", channel, data: <the posted body> }` - this
  * client unwraps it and delivers `data` (expected to be a `SignalMessage`) to `onMessage()` listeners.
  *
@@ -63,7 +65,7 @@
  * absent, as described above - the browser's real cookie was always going to win that write anyway, so the
  * correct behavior is to not fight it and let it authenticate normally instead.
  */
-import { apiOrigin } from "@rapidmx/web-client/lib/util/api.js";
+import { apiOrigin, withCsrfHeader } from "@rapidmx/web-client/lib/util/api.js";
 import { pushUrl } from "@rapidmx/web-client/lib/mail/pushClient.js";
 const SOCKET_OPEN = 1;
 function defaultSocketFactory() {
@@ -132,7 +134,16 @@ export class GuestSignalingClient {
     }
     /** Publishes over `POST /push/:id`, with `token` as a bearer credential when present - see this module's doc
      * comment on why this, unlike subscribing, needs no cookie workaround at all, and on the omitted-`token` case
-     * (an already-authenticated real caller), which relies on the browser's own real `jwt` cookie instead.
+     * (an already-authenticated real caller), which relies on the browser's own real `jwt` cookie instead - and,
+     * because that's a *cookie*-authenticated request, also needs the matching CSRF header
+     * (`@rapidmx/web-client`'s `withCsrfHeader()`, the same double-submit echo `apiFetch()` applies to every other
+     * mutating call this server answers): without it, `RouteUtils.checkCsrf()` refuses the request with 403
+     * `"This request is missing a valid CSRF token."` before it ever reaches `BasePushRoute.send()`'s own ACL
+     * check - every `hello`/offer/answer/ICE candidate/`bye` a participant on that path sends 403s and is
+     * silently dropped (`send()` is fire-and-forget), which looks exactly like "stuck connecting, then no audio or
+     * video" from everyone else's side. `withCsrfHeader()` is harmless to also add on the bearer-token (guest)
+     * branch - the server only enforces the check for `req.auth.source === "cookie"` - so it's applied
+     * unconditionally here rather than only for the cookie case.
      * Fire-and-forget: a failure is swallowed (there is nothing a signaling message's own sender can usefully do
      * about a dropped publish beyond what the mesh's own `hello` re-announcement/renegotiation already tolerates -
      * see `MeshConnectionManager`'s doc comment on fire-and-forget delivery). */
@@ -148,7 +159,7 @@ export class GuestSignalingClient {
         }
         void fetchImpl(`${origin}/push/${encodeURIComponent(this.options.channel)}`, {
             method: "POST",
-            headers,
+            headers: withCsrfHeader(headers, "POST"),
             body: JSON.stringify(message),
             // Only a `bye` needs to survive the page unloading - every other message is sent while the page (and
             // the rest of this call's signaling) is very much alive. `keepalive` is a real-world liability to set

package/dist/apps/shared/relay/AudioPlayer.d.ts

@@ -10,14 +10,26 @@ export declare const JITTER_BUFFER_SECONDS = 0.08;
 export declare const MAX_AHEAD_SECONDS = 0.4;
 /** Skip a packet instead of queueing it when the decoder is this far behind. */
 export declare const AUDIO_MAX_DECODE_QUEUE = 16;
+/** The length of the fade-in `play()` gives a block that doesn't pick up exactly where the last one left off (the
+ * first block, or the one after a gap) - long enough to mask the click such a discontinuity would otherwise
+ * produce, short enough that it is never heard as an actual fade. */
+export declare const DISCONTINUITY_FADE_SECONDS = 0.004;
 /**
  * Decodes one sender's Opus packets and schedules them for playback into a `MediaStreamAudioDestinationNode`.
  *
  * Each decoded block is copied into an `AudioBuffer` and started on its own `AudioBufferSourceNode` at
  * `max(currentTime + jitter, nextTime)`, where `nextTime` is when the previous block ends - so consecutive blocks
  * join seamlessly, and after a gap in the stream playback restarts with the jitter buffer's worth of headroom.
- * Opus packets are independently decodable, so a lost packet costs only its own 20 ms and needs no recovery step;
- * the decoder is created lazily and discarded on any error, and replaced by the next packet.
+ * Opus packets are independently decodable, so a lost packet costs only its own 20 ms and needs no recovery step
+ * *in terms of content* - but the shared decoder (reused across packets so it keeps its normal state between them,
+ * not recreated per packet) is never told a packet was skipped, so its internal prediction state no longer matches
+ * what it decodes next. Audibly this can be a click right at that seam, not just silence where the lost packet
+ * would have been - the same is true of the very first block (nothing at all came before it) and of the block
+ * after a stall long enough to need the jitter buffer's full headroom again. `play()` gives exactly those blocks a
+ * few milliseconds' fade-in (`DISCONTINUITY_FADE_SECONDS`) through a `GainNode` to mask it; an ordinary block that
+ * picks up exactly where the last one ended gets none - fading *every* block would itself be audible, a faint
+ * tremolo at the packet rate. The decoder is created lazily and discarded on any error, and replaced by the next
+ * packet.
  */
 export declare class AudioPlayer {
     private readonly env;

package/dist/apps/shared/relay/AudioPlayer.js

@@ -14,14 +14,26 @@ export const JITTER_BUFFER_SECONDS = 0.08;
 export const MAX_AHEAD_SECONDS = 0.4;
 /** Skip a packet instead of queueing it when the decoder is this far behind. */
 export const AUDIO_MAX_DECODE_QUEUE = 16;
+/** The length of the fade-in `play()` gives a block that doesn't pick up exactly where the last one left off (the
+ * first block, or the one after a gap) - long enough to mask the click such a discontinuity would otherwise
+ * produce, short enough that it is never heard as an actual fade. */
+export const DISCONTINUITY_FADE_SECONDS = 0.004;
 /**
  * Decodes one sender's Opus packets and schedules them for playback into a `MediaStreamAudioDestinationNode`.
  *
  * Each decoded block is copied into an `AudioBuffer` and started on its own `AudioBufferSourceNode` at
  * `max(currentTime + jitter, nextTime)`, where `nextTime` is when the previous block ends - so consecutive blocks
  * join seamlessly, and after a gap in the stream playback restarts with the jitter buffer's worth of headroom.
- * Opus packets are independently decodable, so a lost packet costs only its own 20 ms and needs no recovery step;
- * the decoder is created lazily and discarded on any error, and replaced by the next packet.
+ * Opus packets are independently decodable, so a lost packet costs only its own 20 ms and needs no recovery step
+ * *in terms of content* - but the shared decoder (reused across packets so it keeps its normal state between them,
+ * not recreated per packet) is never told a packet was skipped, so its internal prediction state no longer matches
+ * what it decodes next. Audibly this can be a click right at that seam, not just silence where the lost packet
+ * would have been - the same is true of the very first block (nothing at all came before it) and of the block
+ * after a stall long enough to need the jitter buffer's full headroom again. `play()` gives exactly those blocks a
+ * few milliseconds' fade-in (`DISCONTINUITY_FADE_SECONDS`) through a `GainNode` to mask it; an ordinary block that
+ * picks up exactly where the last one ended gets none - fading *every* block would itself be audible, a faint
+ * tremolo at the packet rate. The decoder is created lazily and discarded on any error, and replaced by the next
+ * packet.
  */
 export class AudioPlayer {
     /** `destination` is the node whose stream the peer's `MediaStream` carries. */
@@ -87,9 +99,24 @@ export class AudioPlayer {
             buffer.copyToChannel(pcm, 0);
             const source = this.ctx.createBufferSource();
             source.buffer = buffer;
-            source.connect(this.destination);
-            source.onended = () => source.disconnect();
             const start = Math.max(now + JITTER_BUFFER_SECONDS, this.nextTime);
+            if (start > this.nextTime) {
+                // A gap, not a continuation - the decoder's state no longer matches what it's about to decode (see
+                // this class's doc comment), so fade this block in rather than let it start abruptly.
+                const gain = this.ctx.createGain();
+                gain.gain.setValueAtTime(0, start);
+                gain.gain.linearRampToValueAtTime(1, start + DISCONTINUITY_FADE_SECONDS);
+                source.connect(gain);
+                gain.connect(this.destination);
+                source.onended = () => {
+                    source.disconnect();
+                    gain.disconnect();
+                };
+            }
+            else {
+                source.connect(this.destination);
+                source.onended = () => source.disconnect();
+            }
             source.start(start);
             this.nextTime = start + buffer.duration;
         }

package/dist/apps/shared/relay/relayEnv.d.ts

@@ -69,6 +69,11 @@ export interface ScriptProcessorLike extends AudioNodeLike {
 export interface GainLike extends AudioNodeLike {
     gain: {
         value: number;
+        /** `AudioParam.setValueAtTime()` - used to schedule a fade (`AudioPlayer`'s discontinuity fade-in), not
+         * needed for `AudioSender`'s own static, unscheduled mute (a plain `.value = 0` assignment). */
+        setValueAtTime(value: number, startTime: number): unknown;
+        /** `AudioParam.linearRampToValueAtTime()`. */
+        linearRampToValueAtTime(value: number, endTime: number): unknown;
     };
 }
 export interface AudioBufferLike {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rapidmx/meet-plugin",
-    "version": "0.9.1",
+    "version": "0.9.3",
     "description": "RapidMX plugin that provides WebRTC video conferencing, joinable from a calendar invite or a shared link.",
     "repository": "https://github.com/rapidmx/meet-plugin.git",
     "author": "RapidREST <rapidrests@gmail.com>",