Authentication
MeetCast uses Argon2id passwords, database sessions in httpOnly cookies, optional Resend mail, and signed guest cookies for public rooms.
Registration and login
Register creates a user on the Free plan, hashes the password with Argon2id, and creates a session. After register you land on /register/done. Login always works even if email is not verified.
Session token is opaque; only a SHA-256 hash is stored in sessions. Cookie name: meetcast_session (httpOnly, SameSite=Lax, Secure in production).
Email verification (soft)
MeetCast can send a confirmation link via Resend when RESEND_API_KEY is set. Verification sets emailVerifiedAt. It does not block sign-in or room use. If Resend is unset, registration still succeeds and the UI explains that mail was not sent.
Password reset
/forgot-password creates a one-time token (hash stored in auth_tokens, type password_reset). The email contains a link to /reset-password. Tokens expire (about one hour for reset; verify tokens last longer). Used tokens cannot be reused.
Settings
- Profile name
- Password change (rate-limited)
- Active sessions list + revoke
- Accent palette
- Account delete (rate-limited)
Guests
Guests join public rooms via invite code. MeetCast sets an HMAC-signed meetcast_guest cookie scoped to the room and capped by the meeting end time. Guests have no users row. Private rooms reject guest join — login with an allowlisted account email is required.
Public room + invite → guest cookie → LiveKit token (guest:{roomId}:{guestId})
Private room → must be logged in → session email on allowlist → LiveKit token (user:{uuid})What is not built
- OAuth / social login
- Mandatory verified-email gate
- Invitation emails or in-app notification inbox