修复了一些问题

internal/api/call_handler.go

@@ -103,6 +103,17 @@ type RoomInfoResponse struct {
 
 // ========== API 处理函数 ==========
 
+// currentCallUserID 从 JWT 上下文获取当前登录用户ID。
+// 通话相关接口必须以此为准，忽略请求体里的 user_id，防止冒充他人进房/推流/信令。
+func currentCallUserID(c *gin.Context) string {
+	if uid, ok := c.Get("user_id"); ok {
+		if s, ok2 := uid.(string); ok2 {
+			return s
+		}
+	}
+	return ""
+}
+
 // CreateCallRoomHandler 创建通话房间
 // POST /api/call/room
 func CreateCallRoomHandler(c *gin.Context) {
@@ -139,6 +150,14 @@ func JoinCallRoomHandler(c *gin.Context) {
 		return
 	}
 
+	// 身份以 JWT 为准，忽略请求体中的 user_id，防止冒充他人加入通话
+	if uid := currentCallUserID(c); uid != "" {
+		req.UserID = uid
+	} else {
+		utils.Unauthorized(c, "未认证")
+		return
+	}
+
 	ms := mediaserver.GetServer()
 	if ms.GetConfig() == nil || !ms.GetConfig().Enabled {
 		utils.Error(c, 503, "媒体服务未启用")
@@ -281,6 +300,14 @@ func LeaveCallRoomHandler(c *gin.Context) {
 		return
 	}
 
+	// 身份以 JWT 为准，防止冒充他人离开通话房间
+	if uid := currentCallUserID(c); uid != "" {
+		req.UserID = uid
+	} else {
+		utils.Unauthorized(c, "未认证")
+		return
+	}
+
 	ms := mediaserver.GetServer()
 	room := ms.GetRoom(req.RoomID)
 	if room == nil {
@@ -359,6 +386,14 @@ func WebRTCOfferHandler(c *gin.Context) {
 		return
 	}
 
+	// 身份以 JWT 为准，防止冒充他人提交 SDP Offer
+	if uid := currentCallUserID(c); uid != "" {
+		req.UserID = uid
+	} else {
+		utils.Unauthorized(c, "未认证")
+		return
+	}
+
 	ms := mediaserver.GetServer()
 	sfu := ms.GetSFU()
 	if sfu == nil {
@@ -387,6 +422,14 @@ func WebRTCICEHandler(c *gin.Context) {
 		return
 	}
 
+	// 身份以 JWT 为准，防止冒充他人提交 ICE 候选
+	if uid := currentCallUserID(c); uid != "" {
+		req.UserID = uid
+	} else {
+		utils.Unauthorized(c, "未认证")
+		return
+	}
+
 	ms := mediaserver.GetServer()
 	sfu := ms.GetSFU()
 	if sfu == nil {
@@ -406,9 +449,11 @@ func WebRTCICEHandler(c *gin.Context) {
 // GetICEServersHandler 获取 ICE 服务器配置
 // GET /api/call/ice-servers
 func GetICEServersHandler(c *gin.Context) {
-	userID := c.Query("user_id")
+	// 凭证绑定当前登录用户，取自 JWT，避免为任意 user_id 签发 TURN 凭证被滥用
+	userID := currentCallUserID(c)
 	if userID == "" {
-		userID = "anonymous"
+		utils.Unauthorized(c, "未认证")
+		return
 	}
 
 	servers := getICEServers(userID)