[GH-3074] Fix issues with media permissions on Linux and Jitsi Meet in embedded mode on all platforms

[j0794]

Summary

• Fixes persistence of microphone and camera access on Linux by checking the platform before calling systemPreferences.getMediaAccessStatus, which is only implemented on Windows and macOS (https://www.electronjs.org/docs/latest/api/system-preferences#systempreferencesgetmediaaccessstatusmediatype-windows-macos)
• Allows an application to propagate the microphone and camera access setting for requests whose second-level domain matches the second-level domain of the server. For example, media permissions for the server mattermost.example.com will also propagate to Jitsi Meet jitsi.example.com in embedded mode, or any other service with the address *.example.com

Ticket Link

Fixes #3074
https://mattermost.atlassian.net/browse/MM-60965

Checklist

• Added or updated unit tests (required for all new features)
• Has UI changes
• read and understood our Contributing Guidelines
• completed Mattermost Contributor Agreement
• executed npm run lint:js for proper code formatting
• Run E2E tests by adding label Run Desktop E2E Tests

Device Information

This PR was tested on: Ubuntu 22.04

Release Note

NONE

[mattermost-build]

Hello @j0794,

Thanks for your pull request! A Core Committer will review your pull request soon. For code contributions, you can learn more about the review process here.

Per the Mattermost Contribution Guide, we need to add you to the list of approved contributors for the Mattermost project.

Please help complete the Mattermost contribution license agreement?
Once you have signed the CLA, please comment with /check-cla and confirm that the CLA check is green.

This is a standard procedure for many open source projects.

Please let us know if you have any questions.

We are very happy to have you join our growing community! If you're not yet a member, please consider joining our Contributors community channel to meet other contributors and discuss new opportunities with the core team.

[devinbinnie]

Code looks okay to me, will defer to @enzowritescode for security review.
Thanks @j0794!

[enzowritescode]

@j0794 can you break out the permissions.media stuff into a separate PR? That looks good to me.

The other code allows for any subdomain to be arbitrarily trusted. In MM-60965 I outlined the security requirements to ensure there wouldn't be any issues with subdomain takeovers. The security requirements that I outlined will definitely take some work, but we don't want to sacrifice on security here.

[enzowritescode]

Does not meet ticket requirements

[mattermost-build]

This PR has been automatically labelled "stale" because it hasn't had recent activity.
A core team member will check in on the status of the PR to help with questions.
Thank you for your contribution!

[devinbinnie]

@j0794 Do you still intend to finish this up?

[mkeida]

Hello! Please, when will be fix ready? 🥹

[core3750x]

Mattermost Desktop: embedded Jitsi media configuration

This configuration allows the embedded Jitsi instance to reuse camera and microphone permissions granted to the corresponding Mattermost server.

Upstream implementation:

• Mattermost Desktop PR: mattermost/desktop#3873 — Allow trusted embedded media origins
• The change was merged on 2026-07-08 and released in Mattermost Desktop 6.3.0.

Requirements:

• Mattermost Desktop 6.3.0 or newer.
• Mattermost origin (set your mattermost URL): https://mattermost-hostname
• Embedded JWT Jitsi origin(set your jitsi URL): https://jitsi-hostname
• Use your mattermost and jitsi URL instead of https://mattermost-hostname and https://jitsi-hostname in the files below
• Use your name of jitsi instead of some-jitsi

Origins must be exact and must not contain a trailing slash, URL path, query parameters, or fragments.

macOS

Create the managed preferences file:

/Library/Managed Preferences/Mattermost.Desktop.plist

Use the following contents:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>TrustedEmbeddedMediaOrigins</key>
    <array>
        <dict>
            <key>serverOrigin</key>
            <string>https://mattermost-hostname</string>
            <key>embeddedOrigin</key>
            <string>https://jitsi-hostname</string>
        </dict>
    </array>
</dict>
</plist>

Install the file and set its ownership and permissions:

sudo mkdir -p "/Library/Managed Preferences"
sudo cp Mattermost.Desktop.plist \
  "/Library/Managed Preferences/Mattermost.Desktop.plist"
sudo chown root:wheel \
  "/Library/Managed Preferences/Mattermost.Desktop.plist"
sudo chmod 644 \
  "/Library/Managed Preferences/Mattermost.Desktop.plist"
plutil -lint \
  "/Library/Managed Preferences/Mattermost.Desktop.plist"

Verify that macOS can read the policy:

defaults read \
  "/Library/Managed Preferences/Mattermost.Desktop" \
  TrustedEmbeddedMediaOrigins

For managed fleets, distribute the same setting through MDM as a managed preference for Mattermost Desktop.

After installing or changing the policy, fully quit Mattermost with Cmd+Q and start it again. Closing only the window is not sufficient.

Also verify that Mattermost is allowed under:

System Settings -> Privacy & Security -> Camera
System Settings -> Privacy & Security -> Microphone

Windows: Registry

Run Command Prompt or PowerShell as Administrator:

reg add "HKLM\SOFTWARE\Policies\Mattermost\TrustedEmbeddedMediaOrigins" /f
reg add "HKLM\SOFTWARE\Policies\Mattermost\TrustedEmbeddedMediaOrigins" /v "some-jitsii" /t REG_SZ /d "{\"serverOrigin\":\"https://mattermost-hostname\",\"embeddedOrigin\":\"https://jitsi-hostname\"}" /f

The resulting registry entry must be:

HKLM\SOFTWARE\Policies\Mattermost\TrustedEmbeddedMediaOrigins
└── some-jitsi = {"serverOrigin":"https://mattermost-hostname","embeddedOrigin":"https://jitsi-hostname"}

The value name, such as some-jitsi, may be chosen freely but must be unique. The value type must be REG_SZ, and its data must be a JSON object containing serverOrigin and embeddedOrigin.

Verify the policy:

reg query "HKLM\SOFTWARE\Policies\Mattermost\TrustedEmbeddedMediaOrigins"

If machine-wide administrative access is unavailable, Mattermost also reads the equivalent per-user location:

reg add "HKCU\SOFTWARE\Policies\Mattermost\TrustedEmbeddedMediaOrigins" /v "some-jitsi" /t REG_SZ /d "{\"serverOrigin\":\"https://mattermost-hostname\",\"embeddedOrigin\":\"https://jitsi-hostname\"}" /f

After installing or changing the policy, completely exit Mattermost from the system tray and start it again.

Windows: Group Policy

For domain deployment:

1. Copy mattermost.admx to C:\Windows\PolicyDefinitions\ or the domain Central Store.
2. Copy mattermost.adml to the corresponding language directory, such as C:\Windows\PolicyDefinitions\en-US\.
3. Enable the Mattermost policy TrustedEmbeddedMediaOrigins.
4. Add an entry with a unique value name such as some-jitsi.
5. Set the entry value to:

{"serverOrigin":"https://mattermost-hostname","embeddedOrigin":"https://jitsi-hostname"}

Apply the policy:

gpupdate /force

Then completely exit and restart Mattermost Desktop.

Validation

1. In Mattermost, run /jitsi start test.
2. Click JOIN MEETING in the generated post.
3. Confirm that the meeting opens inside Mattermost Desktop.
4. Allow Mattermost to use the camera and microphone if the operating system prompts for permission.
5. Confirm that the microphone can be unmuted and the camera can be enabled.

If JOIN MEETING does nothing, verify that the Jitsi API script is available:

curl -I https://mattermost-hostname/external_api.js
curl -I https://jitsi-hostname/plugins/jitsi/jitsi_meet_external_api.js

Both requests should return HTTP 200 with a JavaScript content type. The TLS certificate on jitsi-hostname must also be valid. After fixing the endpoint or certificate, fully restart Mattermost Desktop so the Jitsi API script is loaded again.