[For reference] Use new CS api endpoint

src/livekit/SFUConfig.ts

@@ -0,0 +1,79 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE in the repository root for full details.
+*/
+
+/**
+ * Configuration and access tokens provided by the SFU on successful authentication.
+ */
+export interface SFUConfig {
+  /**
+   * The WebSocket URL of the LiveKit SFU. This is what we connect the LiveKit
+   * room to. Note that this is NOT the JWT service URL
+   * (`livekit_service_url`): the legacy JWT service returns this URL as part of
+   * its response, while the CS-Api based flow requires us to know it upfront.
+   */
+  url: string;
+  jwt: string;
+  livekitAlias: string;
+  // NOTE: Currently unused.
+  livekitIdentity: string;
+}
+
+/**
+ * Decoded details from the JWT.
+ */
+interface SFUJWTPayload {
+  /**
+   * Expiration time for the JWT.
+   * Note: This value is in seconds since Unix epoch.
+   */
+  exp: number;
+  /**
+   * Name of the instance which authored the JWT
+   */
+  iss: string;
+  /**
+   * Time at which the JWT can start to be used.
+   * Note: This value is in seconds since Unix epoch.
+   */
+  nbf: number;
+  /**
+   * Subject. The Livekit alias in this context.
+   */
+  sub: string;
+  /**
+   * The set of permissions for the user.
+   */
+  video: {
+    canPublish: boolean;
+    canSubscribe: boolean;
+    room: string;
+    roomJoin: boolean;
+  };
+}
+
+/**
+ * Complements the SFU websocket url and the JWT with the information encoded in
+ * the JWT payload itself.
+ * @param sfuConfig The SFU websocket url and the JWT to connect with.
+ * @returns The full SFU config, including the LiveKit alias and identity.
+ */
+export function extractFullConfigFromToken(sfuConfig: {
+  url: string;
+  jwt: string;
+}): SFUConfig {
+  const [, payloadStr] = sfuConfig.jwt.split(".");
+  const payload = JSON.parse(global.atob(payloadStr)) as SFUJWTPayload;
+  return {
+    jwt: sfuConfig.jwt,
+    url: sfuConfig.url,
+    livekitAlias: payload.video.room,
+    // NOTE: Currently unused.
+    // Probably also not helpful since we now compute the backendIdentity on joining the call so we can use it for the encryption manager.
+    // The only reason for us to know it locally is to connect the right users with the lk world. (and to set our own keys)
+    livekitIdentity: payload.sub,
+  };
+}

src/livekit/openIDSFU.test.ts → src/livekit/openIDSFULegacy.test.ts

@@ -17,7 +17,7 @@ import {
 import fetchMock from "fetch-mock";
 import { MatrixError } from "matrix-js-sdk";
 
-import { getSFUConfigWithOpenID, type OpenIDClientParts } from "./openIDSFU";
+import { getSFUConfigLegacyWithOpenID, type OpenIDClientParts } from "./openIDSFULegacy";
 import { testJWTToken } from "../utils/test-fixtures";
 import { ownMemberMock } from "../utils/test";
 import { FailToGetOpenIdToken } from "../utils/errors";
@@ -45,7 +45,7 @@ describe("getSFUConfigWithOpenID", () => {
         body: { url: sfuUrl, jwt: testJWTToken },
       };
     });
-    const config = await getSFUConfigWithOpenID(
+    const config = await getSFUConfigLegacyWithOpenID(
       matrixClient,
       ownMemberMock,
       "https://sfu.example.org",
@@ -71,7 +71,7 @@ describe("getSFUConfigWithOpenID", () => {
       };
     });
     try {
-      await getSFUConfigWithOpenID(
+      await getSFUConfigLegacyWithOpenID(
         matrixClient,
         ownMemberMock,
         "https://sfu.example.org",
@@ -123,7 +123,7 @@ describe("getSFUConfigWithOpenID", () => {
     );
 
     // Note: Assuming getSFUConfigWithOpenID eventually calls getLiveKitJWT
-    const config = await getSFUConfigWithOpenID(
+    const config = await getSFUConfigLegacyWithOpenID(
       matrixClient,
       ownMemberMock,
       "https://sfu.example.org",
@@ -164,7 +164,7 @@ describe("getSFUConfigWithOpenID", () => {
       { overwriteRoutes: true },
     );
 
-    const config = await getSFUConfigWithOpenID(
+    const config = await getSFUConfigLegacyWithOpenID(
       matrixClient,
       ownMemberMock,
       "https://sfu.example.org",
@@ -204,7 +204,7 @@ describe("getSFUConfigWithOpenID", () => {
       };
     });
     try {
-      await getSFUConfigWithOpenID(
+      await getSFUConfigLegacyWithOpenID(
         matrixClient,
         ownMemberMock,
         "https://sfu.example.org",
@@ -261,7 +261,7 @@ describe("getSFUConfigWithOpenID", () => {
       };
     });
     try {
-      await getSFUConfigWithOpenID(
+      await getSFUConfigLegacyWithOpenID(
         matrixClient,
         ownMemberMock,
         "https://sfu.example.org",
@@ -312,7 +312,7 @@ describe("getSFUConfigWithOpenID", () => {
         body: { url: sfuUrl, jwt: testJWTToken },
       };
     });
-    const config = await getSFUConfigWithOpenID(
+    const config = await getSFUConfigLegacyWithOpenID(
       matrixClient,
       ownMemberMock,
       "https://sfu.example.org",

src/livekit/openIDSFU.ts → src/livekit/openIDSFULegacy.ts

@@ -20,55 +20,19 @@ import {
 import { doNetworkOperationWithRetry } from "../utils/matrix";
 import { Config } from "../config/Config";
 import { JwtEndpointVersion } from "../state/CallViewModel/localMember/LocalTransport";
+import { extractFullConfigFromToken, type SFUConfig } from "./SFUConfig.ts";
 
-/**
- * Configuration and access tokens provided by the SFU on successful authentication.
- */
-export interface SFUConfig {
-  url: string;
-  jwt: string;
-  livekitAlias: string;
-  // NOTE: Currently unused.
-  livekitIdentity: string;
-}
-
-/**
- * Decoded details from the JWT.
- */
-interface SFUJWTPayload {
-  /**
-   * Expiration time for the JWT.
-   * Note: This value is in seconds since Unix epoch.
-   */
-  exp: number;
-  /**
-   * Name of the instance which authored the JWT
-   */
-  iss: string;
-  /**
-   * Time at which the JWT can start to be used.
-   * Note: This value is in seconds since Unix epoch.
-   */
-  nbf: number;
-  /**
-   * Subject. The Livekit alias in this context.
-   */
-  sub: string;
-  /**
-   * The set of permissions for the user.
-   */
-  video: {
-    canPublish: boolean;
-    canSubscribe: boolean;
-    room: string;
-    roomJoin: boolean;
-  };
-}
+// Re-exported for the many existing consumers that import `SFUConfig` from
+// here. New code should import it from `./SFUConfig.ts` directly.
+export type { SFUConfig };
 
 // The bits we need from MatrixClient
 export type OpenIDClientParts = Pick<
   MatrixClient,
-  "getOpenIdToken" | "getDeviceId"
+  | "getOpenIdToken"
+  | "getDeviceId"
+  | "_unstable_getLivekitToken"
+  | "_unstable_delegateDelayedLeave"
 >;
 
 /**
@@ -91,7 +55,7 @@ export type OpenIDClientParts = Pick<
  * @returns Object containing the token information
  * @throws FailToGetOpenIdToken
  */
-export async function getSFUConfigWithOpenID(
+export async function getSFUConfigLegacyWithOpenID(
   client: OpenIDClientParts,
   membership: CallMembershipIdentityParts,
   serviceUrl: string,
@@ -171,23 +135,6 @@ export async function getSFUConfigWithOpenID(
   }
 }
 
-function extractFullConfigFromToken(sfuConfig: {
-  url: string;
-  jwt: string;
-}): SFUConfig {
-  const [, payloadStr] = sfuConfig.jwt.split(".");
-  const payload = JSON.parse(global.atob(payloadStr)) as SFUJWTPayload;
-  return {
-    jwt: sfuConfig.jwt,
-    url: sfuConfig.url,
-    livekitAlias: payload.video.room,
-    // NOTE: Currently unused.
-    // Probably also not helpful since we now compute the backendIdentity on joining the call so we can use it for the encryption manager.
-    // The only reason for us to know it locally is to connect the right users with the lk world. (and to set our own keys)
-    livekitIdentity: payload.sub,
-  };
-}
-
 async function getLiveKitJWT(
   deviceId: string,
   livekitServiceURL: string,
@@ -264,7 +211,7 @@ class NotSupportedError extends Error {
   }
 }
 
-export async function getLiveKitJWTWithDelayDelegation(
+async function getLiveKitJWTWithDelayDelegation(
   membership: CallMembershipIdentityParts,
   livekitServiceURL: string,
   matrixRoomId: string,