App link grants moderator rights to anyone

Hi,

it seems that the internal link to the conference grants moderator rights to users that are not even logged into NextCloud. Is this intended behavior? Given that there is no JWT token in the URL it seems that this lowers the security for moderator connections? An additional issue is that anyone knowing about this can "upgrade" their internal User link to a Moderator link..

The internal links from Jitsi yield user rights, which is what IMO the links from the Nextcloud-Jitsi plugin should do as well..?

NextCloud Link (No Token!)
https://<my-cloud.com>/apps/jitsi/rooms/XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/RoomName
-> Moderator rights (No NextCloud login needed!)

Jitsi Link (No Token)
https://<my-jitsi.com>/XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
-> User rights

Jitsi Link + Token
https://<my-jitsi.com>/XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX?jwt=XXXXXXXXXXXXXX..
-> Moderator rights

Thanks for this plugin & the attention!

Edit: Note that I have "guest" access enabled in Jitsi via JWT_ALLOW_EMPTY=1 and ENABLE_GUESTS=1 to allow user level access.

Edit2: Running on NextCloud 24, PHP-FPM Docker version

Reproduce the Nextcloud and Jitsi links with JWT_ALLOW_EMPTY=1 and ENABLE_GUESTS=1, then trace the plugin's room-link and token handling. Done means internal links provide user rights, while moderator rights require a JWT token, without allowing unauthenticated users to upgrade their access.