feat(web-app-jitsi-conference): jitsi-admin video call launcher + Space/file recipient calling

[dj4oC]

Summary

Phase 0 archaeology + Phase 1–3 implementation of a jitsi-admin (H2-invent) video-conferencing launcher, per sign-off in this PR's discussion.

• ARCHAEOLOGY.md / DECISIONS.md — cited research on jitsi-admin's REST API, OIDC/Keycloak auth model, iframe/framing behavior, and self-hosting requirements, plus this repo's web-app-draw-io / web-app-external-sites precedents.
• packages/web-app-jitsi-conference — a "Start video call" app-menu entry (opens jitsi-admin in a new tab), plus a "Video call" sidebar panel that appears on both Spaces and regular files/folders.
• packages/jitsi-admin-proxy — the sidecar that provisions rooms and invites participants, holding the jitsi-admin Server.apiKey service credential.

Key design decisions (see DECISIONS.md)

• D1 (framing): jitsi-admin embeds Jitsi Meet/LiveKit itself, so wrapping it in our own iframe would nest the live call two layers deep. Resolved by construction: open jitsi-admin top-level (web-app-external-sites' target: external convention), never in an iframe.
• D2 (identity): relies entirely on jitsi-admin's own OIDC login against the same Keycloak instance as oCIS.
• D3 (sidecar boundary): jitsi-admin's /api/v1/* room API needs a static per-server API key, not a forwarded user token — hence the sidecar, used by Phase 2/3, not Phase 1.
• D4 (data sovereignty): manifest.json ships with no default url.

Phase 2 — "Call all Space members"

• Verified (not assumed) that the Spaces overview's context menu isn't third-party extensible at all; global.files.sidebar is the one extensible point that reaches a Space, so this ships as a sidebarPanel, not an action.
• Members resolved from SpaceResource.members (already present, no extra Graph call); only individual user grants are invited — group grants are skipped.
• jitsi-admin sends the invitation emails itself (confirmed in Phase 0 archaeology) — no oCIS notification API is touched at all.

Phase 3 — "Call all recipients of a file/folder"

• Reuses the same global.files.sidebar extension point and the same sidecar — no new API surface, just a second panel gated by !isSpaceResource instead of isProjectSpaceResource.
• Recipients resolved via GraphPermissions.listPermissions, scoped to direct same-instance individual-user shares (ShareTypes.user) only — group shares, public links, guest shares, and federated/OCM shares (ShareTypes.remote) are all skipped, per the brief's own guidance to flag OCM as a follow-up.
• Shared room-provisioning logic extracted into useJitsiCall, with useSpaceCall/useFileCall as thin wrappers; useSpaceCall's existing tests were re-run unchanged to confirm the extraction stayed behavior-preserving.

Known limitations (stated plainly, not papered over)

• jitsi-admin's exact /api/v1/room//api/v1/user request/response field names are a best-effort reconstruction from source-reading — not exercised against a live instance (none was available in this environment).
• No Playwright e2e tests yet for either new package; neither is in the CI test matrix yet since that job runs test:e2e unconditionally.

Not in this PR

Phase 4 (Collabora-plus-call layout) remains out of scope, per the original brief.

Test plan

• pnpm --filter jitsi-conference build / check:types / test:unit (18 tests)
• pnpm --filter jitsi-admin-proxy test:unit (16 tests)
• pnpm lint and pnpm check:types (repo-wide, no new errors)
• Playwright e2e — intentionally deferred, per the brief

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[dj4oC]

test (web-app-progress-bars) failed on a webkit e2e test (progressBar.spec.ts:16 › select NyanCat progressBarOption on the account page) — this PR doesn't touch that package. The most recent main run (2026-08-14, run 31777392728) has that same job passing, so this looks like an unrelated flake rather than something introduced here. Attempted to re-run just the failed job, but the workflow run was still in progress as a whole at the time; will re-run once it completes if it's still red.

---

Generated by Claude Code

[dj4oC]

@mscholz-h2-invent look at this little fellow

[dj4oC]

Added a complete, self-contained deployment example: packages/web-app-jitsi-conference/full-stack-example/.

It's a standalone Docker Compose stack (oCIS + Keycloak + jitsi-admin + LiveKit + LiveKit Meet + Mailpit), separate from the repo root docker-compose.yml since that file's oCIS service uses basic auth on a single host with path-prefix routing, and jitsi-admin needs its own vhost + Keycloak/OIDC — those don't fit the shared dev compose without changing it for every other package and CI.

All secrets in .env.example are blank placeholders with generation commands - nothing real is committed. The README documents five non-obvious deployment bugs found while getting this running end to end for the first time (root-owned log file from CRON_USER_1, league/oauth2-client's verify-requires-proxy gate, cross-realm Keycloak credential ID collisions, apps.yaml's shallow config templating, and Docker Desktop's docker-proxy blowup on large UDP port ranges).

Verified against a live stack: Keycloak realm import (both oCIS and jitsiadmin), oCIS login, jitsi-admin OAuth login, the extension's manifest/config resolution via apps.yaml, and jitsi-admin-proxy's routing/auth gating. Not yet verified: the actual room-provisioning flow through jitsi-admin's /api/v1/room API, since that needs a jitsi-admin Server registered by hand (documented as a manual step in the README - can't be automated from a compose file).

🤖 Generated with Claude Code

[dj4oC]

How to use it:

1. create a space
2. invite members to a space
3. open the space - ensure that the right side bar opens, if not, click on the top right symbol next to the user name initials
4. click on "video call"
5. click on "call all members"

[LukasHirt]

Needs to be rebased to resolve lockfile conflict.