From 150adf5a27db78dbded615bb8210021a5d4aa61a Mon Sep 17 00:00:00 2001
From: Bernd Rodler <brvncde@gmail.com>
Date: Mon, 31 Aug 2026 01:24:54 +0200
Subject: [PATCH] fix(jitsi): read session from stalwart auth context, not
 basic-auth session cookie

In OAuth/OIDC-only mode the webmail never sets the basic-auth session cookie
(sessionCookieName(0)); the login stores auth in the jmap_stalwart_ctx cookie
via /api/auth/stalwart-context. The route was 401-ing for every real user.
---
 app/api/jitsi/token/route.ts | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/app/api/jitsi/token/route.ts b/app/api/jitsi/token/route.ts
index 05f56de9..bd688f31 100644
--- a/app/api/jitsi/token/route.ts
+++ b/app/api/jitsi/token/route.ts
@@ -1,8 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
 import { createHmac } from 'node:crypto';
-import { decryptSession } from '@/lib/auth/crypto';
-import { sessionCookieName } from '@/lib/auth/session-cookie';
+import { readStalwartAuthContext } from '@/lib/stalwart/auth-context';
 import { logger } from '@/lib/logger';
 
 const JITSI_URL = (process.env.JITSI_URL || 'https://meet.src-advisory.com').replace(/\/+$/, '');
@@ -23,16 +21,14 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: 'Jitsi is not configured' }, { status: 503 });
     }
 
-    const cookieStore = await cookies();
-    const sessionToken = cookieStore.get(sessionCookieName(0))?.value;
-    if (!sessionToken) {
+    // In OAuth/OIDC mode the session lives in the `jmap_stalwart_ctx` cookie
+    // (written by /api/auth/stalwart-context), not the basic-auth session
+    // cookie. The username there is the primary identity email.
+    const ctx = await readStalwartAuthContext(0);
+    const email = ctx?.username;
+    if (!email) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
     }
-    const session = decryptSession(sessionToken);
-    if (!session) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-    }
-    const email = session.username;
 
     const body = await request.json().catch(() => ({}));
     const room = typeof body.room === 'string' ? body.room.trim() : '';