Fix anonymous guests inheriting the host participant record.

Guest joins without email were matching any active participant, overwriting the host row and granting host controls; header now always shows room host. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-01 12:13:09 +00:00
parent ba77acdb9d
commit c651e2bcd4
4 changed files with 104 additions and 7 deletions
@@ -152,6 +152,50 @@ class MeetWebTest extends TestCase
            ->assertSee('data-display-name="Guest User"', false);
    }

+    public function test_anonymous_guest_does_not_take_over_host_participant(): void
+    {
+        $room = $this->createRoom([
+            'settings' => array_merge(config('meet.default_settings'), [
+                'join_before_host' => true,
+            ]),
+        ]);
+        $session = Session::create([
+            'owner_ref' => $this->user->public_id,
+            'room_id' => $room->id,
+            'media_room_name' => 'room-'.$room->uuid,
+            'status' => 'live',
+            'started_at' => now(),
+        ]);
+        $room->update(['status' => 'live']);
+
+        $hostParticipant = \App\Models\Participant::create([
+            'owner_ref' => $this->user->public_id,
+            'session_id' => $session->id,
+            'user_ref' => $this->user->public_id,
+            'display_name' => $this->user->name,
+            'role' => 'host',
+            'status' => 'joined',
+            'joined_at' => now(),
+        ]);
+
+        $this->post('/r/'.$room->uuid.'/enter', [
+            'display_name' => 'Guest User',
+        ])->assertRedirect(route('meet.room', $session));
+
+        $hostParticipant->refresh();
+        $this->assertSame('host', $hostParticipant->role);
+        $this->assertSame($this->user->name, $hostParticipant->display_name);
+
+        $guest = \App\Models\Participant::query()
+            ->where('session_id', $session->id)
+            ->where('display_name', 'Guest User')
+            ->first();
+
+        $this->assertNotNull($guest);
+        $this->assertSame('guest', $guest->role);
+        $this->assertNotSame($hostParticipant->uuid, $guest->uuid);
+    }
+
    public function test_authenticated_user_can_join_live_meeting_without_display_name(): void
    {
        $room = $this->createRoom();