Scott.Idem/OSIT-AE-App-Svelte
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(idaa): check UUID against trusted/admin lists directly for Jitsi moderator

Browse Source 
$ae_loc.trusted_access is only ever upgraded, never downgraded — it sticks
across Novi impersonation even though a different UUID is in the URL. Instead,
check user_id directly against $idaa_loc.novi_admin_li / novi_trusted_li so
the moderator grant is tied to the specific UUID being used, not the inherited
session access level.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Scott Idem
2026-03-27 15:17:38 -04:00
parent d7a0857bed
commit b33c1b16f6
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/routes/idaa/(idaa)/video_conferences/+page.svelte
View File

@@ -477,12 +477,18 @@ async function fetch_novi_data() {
} }
} }
// Trusted/admin users are always moderators — the IDAA layout already verified // Trusted/admin users are always moderators. Check the UUID directly against the
// this UUID against novi_trusted_li / novi_admin_li (from site config) and set // known lists rather than $ae_loc.trusted_access — that flag is only upgraded, never
// $ae_loc.trusted_access. Re-using that result avoids a redundant API call. // downgraded, so it sticks across Novi impersonation (which does a full iframe reload
if ($ae_loc.trusted_access) { // with a different UUID but doesn't reset the inherited access level).
const admin_li: string[] = $idaa_loc.novi_admin_li ?? [];
const trusted_li: string[] = $idaa_loc.novi_trusted_li ?? [];
const is_trusted_uuid = user_id
? admin_li.includes(user_id) || trusted_li.includes(user_id)
: false;
if (is_trusted_uuid) {
is_moderator = true; is_moderator = true;
console.log(`Jitsi: User ${user_id} is moderator via trusted/admin access level.`); console.log(`Jitsi: User ${user_id} is moderator via admin/trusted UUID list.`);
} else { } else {
// For regular authenticated members, check the specific meeting group. // For regular authenticated members, check the specific meeting group.
// Prefer g_uuid from URL (per-meeting, more precise); fall back to the global // Prefer g_uuid from URL (per-meeting, more precise); fall back to the global