In T410560, the meeting and chat URLs have been removed from the "GET event" endpoint because we weren't applying proper permission checks to them. Now that the immediate leak has been addressed, this task tracks the follow-up work of restoring those fields in the response with proper permission checks.

Acceptance criteria

• Meeting and chat URL in the "GET event" endpoint response should be subject to the same permission checks as the UI (user must not be blocked and either organizer or participant; and the event should be on the current wiki):
  • When there is no URL, the value shall always be null regardless of permissions
  • When there is an URL, the field shall be set in the response iff the user has the necessary permissions
• The endpoint documentation should be updated.