snapshot of https://github.com/jitsi/jitsi-meet.git @ fd1749dd28f4138aa80234fc7f311b19aaffa0e7 (2026-09-15)

tests/prosody/docker/cfg/components.cfg.lua

@@ -0,0 +1,136 @@
+-- Component blocks fragment (all Components except conference.localhost).
+-- See prosody.cfg.lua for the fragment layout.
+
+Component "lobby.conference.localhost" "muc"
+    storage = "memory"
+    muc_room_cache_size = 1000
+    restrict_room_creation = true
+    muc_room_locking = false
+    muc_room_default_public_jids = true
+
+-- Breakout MUC component for mod_muc_breakout_rooms tests.
+-- Only Prosody admins (focus@auth.localhost) may create rooms here, matching
+-- real-life behaviour where Jicofo creates breakout rooms on behalf of the
+-- moderator. The on_breakout_room_pre_create hook then enforces that the UUID
+-- is registered in the main room before admitting non-admin occupants.
+Component "breakout.conference.localhost" "muc"
+    storage = "memory"
+    restrict_room_creation = true
+    muc_room_locking = false
+    muc_room_default_public_jids = true
+
+-- Internal MUC used by mod_muc_jigasi_invite: the module resolves the Jigasi
+-- brewery room from this component via process_host_module. Without this
+-- component main_muc_service would remain nil and requests that reach the
+-- invite_jigasi() path would crash instead of returning 404.
+Component "internal.auth.localhost" "muc"
+
+-- Minimal MUC component used to test mod_muc_filter_access in isolation.
+-- Only clients from whitelist.localhost are permitted to join rooms here.
+Component "conference-internal.localhost" "muc"
+    modules_enabled = {
+        "muc_filter_access";
+    }
+    muc_filter_whitelist = { "whitelist.localhost" }
+
+-- Component for mod_end_conference tests. Clients send a message stanza with
+-- an <end_conference/> child to this component; the module looks up the room
+-- from the sender's jitsi_web_query_room session field (set by mod_jitsi_session
+-- from the ?room= WebSocket URL param) and destroys it if the sender is a
+-- moderator occupant.
+Component "endconference.localhost" "end_conference"
+    muc_component = "conference.localhost"
+    muc_mapper_domain_base = "localhost"
+    muc_mapper_domain_prefix = "conference"
+
+-- MUC component for mod_muc_rate_limit integration tests.
+-- Intentionally low join/leave rates (1/s) so that 5 simultaneous clients
+-- exercise the queuing and timer logic without long waits.
+Component "rate-limited.localhost" "muc"
+    modules_enabled = { "muc_rate_limit" }
+    muc_rate_joins = 1
+    muc_rate_leaves = 1
+
+-- Metadata component for mod_room_metadata_component tests.
+Component "metadata.localhost" "room_metadata_component"
+    muc_component = "conference.localhost"
+    muc_mapper_domain_base = "localhost"
+    muc_mapper_domain_prefix = "conference"
+
+-- Component for mod_filesharing_component tests. Clients send file-sharing
+-- messages here; the component looks up the room from jitsi_web_query_room
+-- (set by mod_jitsi_session) and broadcasts add/remove notifications.
+Component "filesharing.localhost" "filesharing_component"
+    muc_component = "conference.localhost"
+    muc_mapper_domain_base = "localhost"
+    muc_mapper_domain_prefix = "conference"
+
+-- Component for mod_audio_translation_component tests. Receivers send
+-- <audio-translation> messages here; the component aggregates per-receiver
+-- subscriptions and exposes the map to jicofo via room._data.audioTranslationRequests
+-- (forwarded by mod_room_metadata_component on the metadata.localhost component).
+Component "audiotranslation.localhost" "audio_translation_component"
+    muc_component = "conference.localhost"
+    muc_mapper_domain_base = "localhost"
+    muc_mapper_domain_prefix = "conference"
+    -- Short debounce so tests don't wait long for the aggregate broadcast.
+    audio_translation_debounce_interval = 0.1
+    -- Low limit so the per-receiver cap is exercised without many subscriptions.
+    audio_translation_max_subscriptions = 3
+
+-- Component for mod_polls_component tests. The module hooks message/host for
+-- new-poll / answer-poll json-messages, keeps per-room poll state (installed on
+-- conference.localhost via process_host_module) and re-broadcasts poll updates
+-- to all occupants. The sender must be an occupant of the room, located from
+-- jitsi_web_query_room (set by mod_jitsi_session from the ?room= param).
+Component "polls.localhost" "polls_component"
+    muc_mapper_domain_base = "localhost"
+    muc_mapper_domain_prefix = "conference"
+
+-- Plain MUC for mod_presence_identity tests. No token verification and no
+-- muc_meeting_id lock so any client can join freely without focus.
+Component "conference-identity.localhost" "muc"
+
+-- Isolated MUC component for mod_muc_wait_for_host tests.
+-- No muc_meeting_id, so no jicofo lock — a JWT-authenticated client can join
+-- directly as host without focus unlocking the room first.
+-- muc_mapper_domain_base is set to "conference.localhost" so that:
+--   lobby_muc_component_config = "lobby." .. "conference.localhost"
+--                              = "lobby.conference.localhost"   (already configured above)
+-- This means the existing lobby component is reused for the lobby rooms created
+-- by this component, and no additional lobby MUC component is needed.
+Component "conference-waitforhost.localhost" "muc"
+    storage = "memory"
+    modules_enabled = {
+        "muc_wait_for_host";
+    }
+    muc_mapper_domain_base = "conference.localhost"
+    muc_mapper_domain_prefix = "conference"
+
+-- Isolated MUC component for mod_muc_allowners tests.
+-- No muc_meeting_id (no jicofo lock) and no token_verification, so anonymous
+-- clients can join freely. In non-moderated rooms every occupant is promoted
+-- to owner on join and muc#admin set stanzas revoking affiliations are
+-- rejected. Room names listed in allowners_moderated_rooms are moderated:
+-- only JWT-authenticated users with a matching room claim are promoted and
+-- the revoke filtering is skipped.
+Component "conference-allowners.localhost" "muc"
+    storage = "memory"
+    modules_enabled = {
+        "muc_allowners";
+    }
+    muc_mapper_domain_base = "localhost"
+    muc_mapper_domain_prefix = "conference"
+    allowners_moderated_rooms = { "moderated-room-1"; "moderated-room-2" }
+
+-- MUC component paired with VirtualHost "noregex.test". Its parent host
+-- (derived from the component name by mod_token_verification) sets
+-- token_regex_enabled = false, so a join whose token carries a room-claim
+-- pattern is refused with <invalid-regex/>.
+Component "conference.noregex.test" "muc"
+    storage = "memory"
+    modules_enabled = {
+        "token_verification";
+    }
+    muc_mapper_domain_base = "noregex.test"
+    muc_mapper_domain_prefix = "conference"

tests/prosody/docker/cfg/conference.cfg.lua

@@ -0,0 +1,79 @@
+-- conference.localhost fragment. See prosody.cfg.lua for the fragment layout.
+--
+-- Kept in its own fragment so that extending environments (e.g. the
+-- jitsi-meet-branding private plugins) can skip this Include and re-declare
+-- the component with extra modules appended. Keep this block self-contained:
+-- everything conference.localhost needs must live in this file.
+
+Component "conference.localhost" "muc"
+    -- Module order follows prod (conference.8x8.vc) so that same-priority hook
+    -- execution order matches production. Test-only modules are inserted at
+    -- sensible positions relative to the shared modules they interact with.
+    modules_enabled = {
+        "muc_hide_all";
+        "token_verification";      -- prod pos 2: gate check runs before meeting-id / password logic
+        "muc_max_occupants";
+        "muc_resource_validate";   -- test-only: occupant gate, alongside muc_max_occupants
+        "muc_password_whitelist";
+        "token_affiliation";       -- test-only: reads auth_token set by token_verification above
+        "muc_meeting_id";          -- prod pos 9: after gate checks
+        "muc_flip";
+        "test_observer";           -- test-only
+        "filter_messages";
+        "muc_displayname";         -- prod pos 21: after filter_messages
+        -- mod_muc_limit_messages registers its message/bare hook at priority -1
+        -- (below the default 0 used by filter_messages), so filter_messages
+        -- always fires first. Messages it blocks (return true) never reach
+        -- muc_limit_messages and do not count toward the per-room cap.
+        "muc_limit_messages";
+        -- Destroys a room after a short timeout when only Jibri/transcriber remain.
+        "muc_cleanup_backend_services";
+    }
+
+    anonymous_strict = true
+
+    -- Same as prod: only Prosody admins (jicofo, i.e. focus@auth.localhost) may
+    -- create a room. Regular clients (anonymous or JWT) can only join a room
+    -- that focus has already created.
+    restrict_room_creation = true
+
+    -- Used by mod_muc_max_occupants tests (2 occupants max).
+    muc_max_occupants = 2
+
+    -- Clients on whitelist.localhost bypass the occupant limit.
+    -- Clients on auth.localhost are the focus (jicofo) admin; they also bypass
+    -- the limit and are not counted against it.
+    -- Clients on recorder.localhost are Jibri/transcriber accounts; they bypass
+    -- token_verification (is_jibri / is_transcriber JID prefix checks still apply).
+    muc_access_whitelist = { "whitelist.localhost", "auth.localhost", "recorder.localhost" }
+
+    -- Used by mod_muc_password_whitelist tests: clients from whitelist.localhost
+    -- are injected with the room password and bypass the password check.
+    muc_password_whitelist = { "whitelist.localhost" }
+
+    -- Required by util.lib.lua domain-mapping helpers and mod_jitsi_permissions.
+    muc_mapper_domain_base = "localhost"
+    muc_mapper_domain_prefix = "conference"
+
+    -- focus@auth.localhost is a Prosody admin and is therefore exempt from
+    -- token_verification on both muc-room-pre-create and muc-occupant-pre-join,
+    -- mirroring production where jicofo is a Prosody admin.
+
+    -- mod_muc_cleanup_backend_services: short timeout so tests don't wait 20 s.
+    services_empty_meeting_timeout = 1
+
+    -- mod_time_restricted (loaded on demand by mod_time_restricted_spec, not in
+    -- modules_enabled, so it does not destroy other tests' rooms): a fractional
+    -- limit keeps the test fast — 0.125 min = 7.5 s to the limit, plus a 3 s
+    -- wrap-up grace before the room is actually destroyed.
+    conference_max_minutes = 0.125
+    conference_grace_seconds = 3
+
+    -- mod_muc_limit_messages: cap per room and honour auth tokens.
+    muc_limit_messages_count = 3
+    muc_limit_messages_check_token = true
+
+    -- Blocks unauthenticated users from sending room-owner config IQs
+    -- (muc#owner queries), which is how moderator status is granted to other
+    -- participants and how room configuration is changed.
+    token_verification_require_token_for_moderation = true

tests/prosody/docker/cfg/global.cfg.lua

@@ -0,0 +1,58 @@
+-- Global settings fragment. See prosody.cfg.lua for the fragment layout.
+--
+-- Minimal Prosody config for integration testing.
+-- No TLS: tests connect plaintext over loopback.
+
+data_path = "/var/lib/prosody"
+pid_file = "/var/run/prosody/prosody.pid"
+
+plugin_paths = { "/usr/lib/prosody/modules", "/opt/prosody-jitsi-plugins" }
+
+log = {
+    { levels = { min = "debug" }, to = "console" };
+}
+
+-- No TLS module means no STARTTLS offered, so clients connect plaintext.
+modules_enabled = {
+    "saslauth";
+    "disco";
+    "ping";
+    "admin_shell";
+    "http";
+    "websocket";
+    "smacks";
+    -- Global HTTP API modules.
+    "muc_end_meeting";
+    -- Sets jitsi_web_query_room on sessions from the ?room= WebSocket URL param;
+    -- required by mod_end_conference to locate the target MUC room.
+    "jitsi_session";
+}
+
+-- Required by mod_muc_end_meeting (global module) to locate the MUC component
+-- and to attach its HTTP handler to the correct VirtualHost.
+muc_mapper_domain_base = "localhost"
+muc_mapper_domain_prefix = "conference"
+
+-- System token key server for mod_muc_end_meeting and similar HTTP API modules.
+-- These tokens are signed with a separate key pair from login tokens, providing
+-- key-level separation between user-facing and system-facing authentication.
+-- The endpoint is served by mod_test_observer_http at /test-observer/system-asap-keys/.
+prosody_password_public_key_repo_url = "http://localhost:5280/test-observer/system-asap-keys"
+
+-- Allow WebSocket connections without TLS (tests run over loopback).
+consider_websocket_secure = true
+
+c2s_require_encryption = false
+s2s_require_encryption = false
+allow_unencrypted_plain_auth = true
+
+-- HTTP server for mod_test_observer_http endpoints.
+-- Disable HTTPS so all HTTP routes land on port 5280 (not 5281).
+http_ports = { 5280 }
+http_interfaces = { "*" }
+https_ports = {}
+
+-- The focus (jicofo) test helper authenticates as focus@auth.localhost.
+-- Prosody admins are exempt from token_verification checks and are used as
+-- room owners, mirroring production where jicofo is a Prosody admin.
+admins = { "focus@auth.localhost" }

tests/prosody/docker/cfg/virtualhosts.cfg.lua

@@ -0,0 +1,161 @@
+-- VirtualHost blocks fragment. See prosody.cfg.lua for the fragment layout.
+
+VirtualHost "localhost"
+    authentication = "token"
+    app_id = "jitsi"
+    asap_key_server = "http://localhost:5280/test-observer/asap-keys"
+    signature_algorithm = "RS256"
+    allow_empty_token = true
+
+    -- Serve test_observer HTTP endpoints here so plain HTTP on port 5280 is
+    -- reachable. Component HTTP routes end up on HTTPS 5281 due to Prosody's
+    -- virtual-host routing, which does not match Host: localhost on port 5280.
+    modules_enabled = {
+        -- test-only: HTTP endpoints and census helpers
+        "test_observer_http";
+        "muc_size";
+        "muc_census";
+        -- Module order below follows prod (conference.8x8.vc VirtualHost) so that
+        -- same-priority hook execution order matches production.
+        -- Handles 'jitsi-add-identity' so components (room_metadata,
+        -- audio_translation, ...) can advertise a disco identity on this host.
+        "features_identity";
+        "conference_duration";
+        "filter_iq_rayo";    -- priority 1 on pre-iq/full; listed before filter_iq_jibri (matches prod)
+        "filter_iq_jibri";
+        "muc_lobby_rooms";
+        "jiconop";
+        "muc_kick_participant";
+        "muc_jigasi_invite";
+        -- Loaded here so that the global jitsi-access-ban-check event handler
+        -- is registered and mod_auth_token can fire it for token-authenticated
+        -- sessions. muc_prosody_jitsi_access_manager_url points at the mock
+        -- access manager served by mod_test_observer_http on the same host.
+        "muc_auth_ban";
+        -- test-only
+        "turncredentials_http";
+        -- Rewrites MUC JIDs between external subdomain form
+        -- (room@conference.sub.localhost) and internal bracket form
+        -- ([sub]room@conference.localhost) for all sessions on all hosts.
+        "muc_domain_mapper";
+        "persistent_lobby";
+        "system_chat_message";
+        -- test-only
+        "muc_password_check";
+        "muc_breakout_rooms";
+    }
+
+    -- mod_muc_password_check: verify Bearer tokens with the login ASAP key server.
+    enable_password_token_verification = true
+
+    shard_name = "test-shard"
+    region_name = "test-region"
+    release_number = "test-release"
+
+    -- mod_turncredentials_http (HTTP via external_services): port 3479.
+    external_services = {
+        { type = "stun", host = "127.0.0.1", port = 3479 };
+        { type = "turn", host = "127.0.0.1", port = 3479, secret = "http-turn-secret" };
+    }
+
+    -- Required by mod_muc_auth_ban: URL of the access manager to call.
+    -- Points at the mock endpoint served by mod_test_observer_http.
+    muc_prosody_jitsi_access_manager_url = "http://localhost:5280/test-observer/access-manager"
+
+    -- Required by mod_test_observer_http to locate the shared MUC data.
+    muc_mapper_domain_base = "localhost"
+    muc_mapper_domain_prefix = "conference"
+
+    -- Required by mod_conference_duration to find the MUC component.
+    -- Required by mod_muc_lobby_rooms.
+    -- Required by mod_muc_breakout_rooms.
+    main_muc = "conference.localhost"
+    lobby_muc = "lobby.conference.localhost"
+    breakout_rooms_muc = "breakout.conference.localhost"
+
+    -- Clients on whitelist.localhost bypass the lobby.
+    muc_lobby_whitelist = { "whitelist.localhost" }
+
+-- VirtualHost for the focus (jicofo) test helper.
+-- Clients authenticate with username "focus" and password "focussecret".
+-- The account is pre-created in the Docker image (see Dockerfile).
+-- focus@auth.localhost is listed in the global admins table, so it is exempt
+-- from token_verification and can act as room owner on all MUC components.
+VirtualHost "auth.localhost"
+    authentication = "internal_hashed"
+    -- @xmpp/sasl (v0.13) does not await async SASL responses; the SCRAM-SHA-1
+    -- mechanism in sasl-scram-sha-1 1.4+ is async, so the client sends an
+    -- empty client-final message which Prosody rejects as malformed-request.
+    -- Disable SCRAM and force PLAIN (safe on loopback in the test environment).
+    disable_sasl_mechanisms = { "SCRAM-SHA-1", "SCRAM-SHA-1-PLUS", "SCRAM-SHA-256", "SCRAM-SHA-256-PLUS" }
+
+-- VirtualHost for Jibri (recorder) and transcriber accounts used by
+-- mod_muc_cleanup_backend_services tests. Accounts on this domain get JIDs whose
+-- bare form starts with 'recorder@recorder.' or 'transcriber@recorder.', satisfying
+-- is_jibri() and is_transcriber() respectively.
+-- recorder.localhost is added to muc_access_whitelist on the MUC component so
+-- these clients bypass token_verification without needing JWT tokens.
+VirtualHost "recorder.localhost"
+    authentication = "internal_hashed"
+    disable_sasl_mechanisms = { "SCRAM-SHA-1", "SCRAM-SHA-1-PLUS", "SCRAM-SHA-256", "SCRAM-SHA-256-PLUS" }
+
+-- VirtualHost for HS256 (shared-secret) token auth tests and mod_presence_identity tests.
+VirtualHost "hs256.localhost"
+    authentication = "token"
+    app_id = "jitsi"
+    app_secret = "testsecret"
+    signature_algorithm = "HS256"
+    allow_empty_token = false
+    modules_enabled = { "presence_identity" }
+
+-- Second VirtualHost whose domain is listed in muc_access_whitelist on the
+-- MUC component below. Clients connecting here get JIDs like
+-- <random>@whitelist.localhost and are treated as whitelisted.
+-- VirtualHost with room-claim patterns turned off (token_regex_enabled), used
+-- to test that a token flagged with context.room.regex is refused rather than
+-- matched. mod_token_verification reads token options from the PARENT host of
+-- the MUC component, so the option must live here and not on the component.
+-- muc_mapper_domain_base is set so that verify_room builds the MUC domain of
+-- the paired component below, and not the global conference.localhost.
+-- The host deliberately sits outside .localhost: mod_muc_domain_mapper is
+-- enabled for every host and would read "conference.noregex.localhost" as the
+-- multidomain form of "[noregex]room@conference.localhost", moving the room
+-- off this component entirely.
+VirtualHost "noregex.test"
+    authentication = "token"
+    app_id = "jitsi"
+    asap_key_server = "http://localhost:5280/test-observer/asap-keys"
+    signature_algorithm = "RS256"
+    allow_empty_token = true
+    token_regex_enabled = false
+    muc_mapper_domain_base = "noregex.test"
+
+-- VirtualHost used by mod_auth_jitsi-anonymous tests.
+VirtualHost "jitsi-anonymous.localhost"
+    authentication = "jitsi-anonymous"
+
+-- VirtualHost used by mod_auth_jitsi-shared-secret tests.
+VirtualHost "shared-secret.localhost"
+    authentication = "jitsi-shared-secret"
+    shared_secret = "topsecret"
+    shared_secret_prev = "oldsecret"
+    -- Disable SCRAM so Prosody only offers PLAIN. SCRAM requires per-user key
+    -- derivation which is incompatible with a shared-secret auth provider.
+    disable_sasl_mechanisms = { "SCRAM-SHA-1", "SCRAM-SHA-1-PLUS" }
+
+VirtualHost "whitelist.localhost"
+    authentication = "anonymous"
+
+-- VirtualHost for mod_trace tests, with otlp_endpoint configured so the
+-- module is active. Points at the mock OTLP receiver served by
+-- mod_test_observer_http on the main VirtualHost.
+VirtualHost "trace.localhost"
+    authentication = "anonymous"
+    modules_enabled = { "trace" }
+    otlp_endpoint = "http://localhost:5280/test-observer/otlp-traces"
+
+-- VirtualHost for mod_trace tests with otlp_endpoint left unset: the module
+-- must log a warning and no-op rather than hook anything.
+VirtualHost "trace-disabled.localhost"
+    authentication = "anonymous"
+    modules_enabled = { "trace" }