Security fix on the standalone endpoints

This release partially backports a security property of the Client-Server endpoints, which were introduced in 0.7.0, to the old standalone endpoints. When running lk-jwt-service as an application service and using the associated home server as the single entry in LIVEKIT_FULL_ACCESS_HOMESERVERS, the standalone endpoints /sfu/get, /get_token and /delegate_delayed_leave now also verify the requester's room membership before processing the request. We still recommend to adopt the new Client-Server endpoints as soon as feasible but while client support for them is still rolling out, this release improves security on the old standalone endpoints.

Docker image

The service is available as a Docker image from the GitHub Container Registry.

docker pull ghcr.io/element-hq/lk-jwt-service:0.9.0

Precompiled binaries

The service is available as static precompiled binaries for amd64 and arm64 on linux attached to this release below.

What's Changed

• Switch to the dedicated endpoint for scheduling delayed events by @Johennes in #249
• Verify room membership on the standalone endpoints (LIVEKIT_REQUIRE_MEMBERSHIP) by @FantasticoFox in #250

New Contributors

• @FantasticoFox made their first contribution in #250

Full Changelog: v0.8.0...v0.9.0