Check DestinationRoom of VideoGrant for participant forwarding (#3599)

pkg/service/auth.go

@@ -219,6 +219,19 @@ func EnsureSIPCallPermission(ctx context.Context) error {
 	return nil
 }
 
+func EnsureForwardPermission(ctx context.Context, source livekit.RoomName, destination livekit.RoomName) error {
+	claims := GetGrants(ctx)
+	if claims == nil || claims.Video == nil {
+		return ErrPermissionDenied
+	}
+
+	if !claims.Video.RoomAdmin || source != livekit.RoomName(claims.Video.Room) || destination != livekit.RoomName(claims.Video.DestinationRoom) {
+		return ErrPermissionDenied
+	}
+
+	return nil
+}
+
 // wraps authentication errors around Twirp
 func twirpAuthError(err error) error {
 	return twirp.NewError(twirp.Unauthenticated, err.Error())

pkg/service/roomservice.go

@@ -321,7 +321,7 @@ func (s *RoomService) ForwardParticipant(ctx context.Context, req *livekit.Forwa
 
 	roomName := livekit.RoomName(req.Room)
 	AppendLogFields(ctx, "room", roomName, "participant", req.Identity)
-	if err := EnsureAdminPermission(ctx, roomName); err != nil {
+	if err := EnsureForwardPermission(ctx, roomName, livekit.RoomName(req.DestinationRoom)); err != nil {
 		return nil, twirpAuthError(err)
 	}