Fix anonymous guests inheriting the host participant record.

Guest joins without email were matching any active participant, overwriting the host row and granting host controls; header now always shows room host. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-01 12:13:09 +00:00
parent ba77acdb9d
commit c651e2bcd4
4 changed files with 104 additions and 7 deletions
@@ -91,12 +91,7 @@ class SessionService
        ?string $email = null,
    ): Participant {
        $userRef = $user?->ownerRef();
-
-        $existing = $session->participants()
-            ->when($userRef, fn ($q) => $q->where('user_ref', $userRef))
-            ->when(! $userRef && $email, fn ($q) => $q->where('email', $email))
-            ->whereIn('status', ['invited', 'waiting', 'joined'])
-            ->first();
+        $existing = $this->findExistingParticipant($session, $userRef, $email);

        if ($existing) {
            $existing->update([
@@ -136,6 +131,37 @@ class SessionService
        return $participant;
    }

+    protected function findExistingParticipant(Session $session, ?string $userRef, ?string $email): ?Participant
+    {
+        $active = fn ($q) => $q->whereIn('status', ['invited', 'waiting', 'joined']);
+
+        if ($userRef) {
+            return $session->participants()
+                ->where('user_ref', $userRef)
+                ->where($active)
+                ->first();
+        }
+
+        if ($email) {
+            return $session->participants()
+                ->whereNull('user_ref')
+                ->where('email', $email)
+                ->where($active)
+                ->first();
+        }
+
+        $guestUuid = (string) request()?->session()?->get("meet.participant.{$session->uuid}", '');
+        if ($guestUuid === '') {
+            return null;
+        }
+
+        return $session->participants()
+            ->where('uuid', $guestUuid)
+            ->whereNull('user_ref')
+            ->where($active)
+            ->first();
+    }
+
    public function rememberParticipantSession(Request $request, Participant $participant, ?Session $session = null): void
    {
        $session ??= $participant->session;