feat(api)!: remove deprecated password-based join in favor of role - #19
Open
antobinary wants to merge 1 commit into
Open
feat(api)!: remove deprecated password-based join in favor of role#19antobinary wants to merge 1 commit into
antobinary wants to merge 1 commit into
Conversation
The `password` parameter on /join derived the user's role by matching the meeting's moderator/attendee password. It was deprecated in BigBlueButton 3.0 (2025-02) in favor of the `role` parameter, which has existed since 2.4 (2021) and is what the HTML5 client already uses. This removes it entirely and makes `role` the sole join mechanism. - bbb-web /join: resolve the role exclusively from `role` (MODERATOR/VIEWER); remove the password-matching branches and the now-unused ApiParams.PASSWORD - breakout rooms: build the internal join URL with `role=` instead of `password=` (BreakoutApp2x.joinParams / BreakoutHdlrHelpers) - validation: drop the dead JoinPassword/JoinPasswordConstraint/ JoinPasswordValidator scaffold and the `password` field on the JoinMeeting model (the shared @PasswordConstraint is kept for create/end) - tests: join via `role` (bbb-web ApiControllerSpec, Playwright helpers, BreakoutRoomsUtilSpec) - docs: remove the join `password` parameter, note the 4.0 removal, use `role` Create-side `attendeePW`/`moderatorPW` and their response echo are left untouched (separate, response-contract change) and can be removed in a follow-up. BREAKING CHANGE: the `password` parameter is no longer accepted on /join. API consumers must pass `role=MODERATOR|VIEWER`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
🚨 Automated tests failed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Title: feat(api)!: remove deprecated
passwordjoin parameter in favor ofroleWhat & why
The
/joinpasswordparameter derived a user's role by matching the meeting'smoderatorPW/attendeePW. It was deprecated in BigBlueButton 3.0 (2025-02-05, docs commit1c0457e6, shipped inv3.0.0-rc.3) in favor of theroleparameter, which has existed since 2.4 (2021-10-27, commit7ea48706) and is already what the HTML5 client sends. After ~17 months of public deprecation across the entire 3.0 line, this removes it for 4.0 and makesrolethe sole join mechanism.Reference for reviewers:
join.tsxalready carrieddeprecated: trueforpassword; the HTML5 client contains nopassword=on join.Changes
/join— role is resolved exclusively from theroleparameter (MODERATOR/VIEWER); the password-matching branches are removed and a single "valid role required" error replaces the old password error paths. Removed the unusedApiParams.PASSWORDconstant.role=instead ofpassword=(BreakoutApp2x.joinParams,BreakoutHdlrHelpers). Therolevalue was already in scope, so no new plumbing.BreakoutRoomsUtilSpecbase string + checksum updated accordingly.JoinPassword/JoinPasswordConstraint/JoinPasswordValidatorscaffold (the validator was a no-opreturn true) and thepasswordfield from theJoinMeetingrequest model. The shared@PasswordConstraintis kept — it's still used bycreateandend.ApiControllerSpecand the PlaywrightgetJoinURLhelper now join viarole.passwordparameter, updated theroledescription, and added a 4.0 "Removed" changelog entry inapi.md.Migration for API consumers
Replace
password=<meeting password>on join URLs withrole=MODERATORorrole=VIEWER(case-insensitive). Theroleparameter has been available since 2.4, so integrations can adopt it before upgrading to 4.0.Before:
/api/join?fullName=Alice&meetingID=abc&password=<moderatorPW>&checksum=…After:
/api/join?fullName=Alice&meetingID=abc&role=MODERATOR&checksum=…Explicitly out of scope
attendeePW/moderatorPWparameters and their echo increate/getMeetingInfo/getMeetingsresponses are left untouched — removing them is a response-contract change best done in a separate PR./endendpoint'spassword(moderator password) parameter is a distinct parameter and is not affected.Breaking change
BREAKING CHANGE:thepasswordparameter is no longer accepted on/join; callers must passrole. Deprecated since 3.0.Testing
role(bbb-web spec, Playwright helper, breakout util spec).role=MODERATORandrole=VIEWER, and verify breakout auto-join still assigns the correct role.