From c3605dfa6c549f6b4580ceefe8dfe640c6d81dfa Mon Sep 17 00:00:00 2001 From: Paul Wells Date: Wed, 28 Oct 2026 04:52:48 -0700 Subject: [PATCH] Sign refresh tokens with the join token's API key (#5088) Refresh tokens were signed with the first configured key pair, which is an arbitrary map entry when several keys are configured. Keep the join token's API key on the participant and sign with it when its secret is still configured, falling back to the first key pair otherwise. --- pkg/rtc/participant.go | 5 ++ pkg/rtc/types/interfaces.go | 1 + .../typesfakes/fake_local_participant.go | 62 +++++++++++++++++++ pkg/service/roommanager.go | 11 +++- pkg/service/roommanager_token_test.go | 58 +++++++++++++++++ 5 files changed, 136 insertions(+), 1 deletion(-) create mode 100644 pkg/service/roommanager_token_test.go diff --git a/pkg/rtc/participant.go b/pkg/rtc/participant.go index 7f81f0c89..d0b2d8089 100644 --- a/pkg/rtc/participant.go +++ b/pkg/rtc/participant.go @@ -197,6 +197,7 @@ type ParticipantParams struct { SimTracks map[uint32]interceptor.SimulcastTrackInfo Grants *auth.ClaimGrants TokenExpiresAt time.Time + APIKey string InitialVersion uint32 ClientConf *livekit.ClientConfiguration ClientInfo ClientInfo @@ -859,6 +860,10 @@ func (p *ParticipantImpl) TokenExpiresAt() time.Time { return p.params.TokenExpiresAt } +func (p *ParticipantImpl) APIKey() string { + return p.params.APIKey +} + func (p *ParticipantImpl) SetPermission(permission *livekit.ParticipantPermission) bool { if permission == nil { return false diff --git a/pkg/rtc/types/interfaces.go b/pkg/rtc/types/interfaces.go index 1d7734f1d..7f2f4b9c3 100644 --- a/pkg/rtc/types/interfaces.go +++ b/pkg/rtc/types/interfaces.go @@ -525,6 +525,7 @@ type LocalParticipant interface { // permissions ClaimGrants() *auth.ClaimGrants TokenExpiresAt() time.Time + APIKey() string SetPermission(permission *livekit.ParticipantPermission) bool CanPublish() bool CanPublishSource(source livekit.TrackSource) bool diff --git a/pkg/rtc/types/typesfakes/fake_local_participant.go b/pkg/rtc/types/typesfakes/fake_local_participant.go index 6c11e6bf6..e9c0aea0c 100644 --- a/pkg/rtc/types/typesfakes/fake_local_participant.go +++ b/pkg/rtc/types/typesfakes/fake_local_participant.go @@ -23,6 +23,16 @@ import ( ) type FakeLocalParticipant struct { + APIKeyStub func() string + aPIKeyMutex sync.RWMutex + aPIKeyArgsForCall []struct { + } + aPIKeyReturns struct { + result1 string + } + aPIKeyReturnsOnCall map[int]struct { + result1 string + } ActiveAtStub func() time.Time activeAtMutex sync.RWMutex activeAtArgsForCall []struct { @@ -1655,6 +1665,58 @@ type FakeLocalParticipant struct { invocationsMutex sync.RWMutex } +func (fake *FakeLocalParticipant) APIKey() string { + fake.aPIKeyMutex.Lock() + ret, specificReturn := fake.aPIKeyReturnsOnCall[len(fake.aPIKeyArgsForCall)] + fake.aPIKeyArgsForCall = append(fake.aPIKeyArgsForCall, struct { + }{}) + stub := fake.APIKeyStub + fakeReturns := fake.aPIKeyReturns + fake.recordInvocation("APIKey", []interface{}{}) + fake.aPIKeyMutex.Unlock() + if stub != nil { + return stub() + } + if specificReturn { + return ret.result1 + } + return fakeReturns.result1 +} + +func (fake *FakeLocalParticipant) APIKeyCallCount() int { + fake.aPIKeyMutex.RLock() + defer fake.aPIKeyMutex.RUnlock() + return len(fake.aPIKeyArgsForCall) +} + +func (fake *FakeLocalParticipant) APIKeyCalls(stub func() string) { + fake.aPIKeyMutex.Lock() + defer fake.aPIKeyMutex.Unlock() + fake.APIKeyStub = stub +} + +func (fake *FakeLocalParticipant) APIKeyReturns(result1 string) { + fake.aPIKeyMutex.Lock() + defer fake.aPIKeyMutex.Unlock() + fake.APIKeyStub = nil + fake.aPIKeyReturns = struct { + result1 string + }{result1} +} + +func (fake *FakeLocalParticipant) APIKeyReturnsOnCall(i int, result1 string) { + fake.aPIKeyMutex.Lock() + defer fake.aPIKeyMutex.Unlock() + fake.APIKeyStub = nil + if fake.aPIKeyReturnsOnCall == nil { + fake.aPIKeyReturnsOnCall = make(map[int]struct { + result1 string + }) + } + fake.aPIKeyReturnsOnCall[i] = struct { + result1 string + }{result1} +} func (fake *FakeLocalParticipant) ActiveAt() time.Time { fake.activeAtMutex.Lock() ret, specificReturn := fake.activeAtReturnsOnCall[len(fake.activeAtArgsForCall)] diff --git a/pkg/service/roommanager.go b/pkg/service/roommanager.go index f36829f36..ee49eaea2 100644 --- a/pkg/service/roommanager.go +++ b/pkg/service/roommanager.go @@ -506,6 +506,7 @@ func (r *RoomManager) StartSession( SubscribeEnabledCodecs: enabledCodecs, Grants: pi.Grants, TokenExpiresAt: pi.TokenExpiresAt, + APIKey: pi.APIKey, Reconnect: pi.Reconnect, Logger: pLogger, Reporter: roomobs.NewNoopParticipantSessionReporter(), @@ -1156,7 +1157,7 @@ func (r *RoomManager) iceServersForParticipant(apiKey string, participant types. } func (r *RoomManager) refreshToken(participant types.LocalParticipant) error { - key, secret, err := r.getFirstKeyPair() + key, secret, err := r.getSigningKeyPair(participant.APIKey()) if err != nil { return err } @@ -1202,6 +1203,14 @@ func (r *RoomManager) getIceConfig(roomName livekit.RoomName, participant types. return r.iceConfigCache.Get(iceConfigCacheKey{roomName, participant.Identity()}) } +// getSigningKeyPair prefers the key that signed the join token so refreshed tokens stay valid when other keys are rotated. +func (r *RoomManager) getSigningKeyPair(apiKey string) (string, string, error) { + if secret := r.config.Keys[apiKey]; apiKey != "" && secret != "" { + return apiKey, secret, nil + } + return r.getFirstKeyPair() +} + func (r *RoomManager) getFirstKeyPair() (string, string, error) { for key, secret := range r.config.Keys { return key, secret, nil diff --git a/pkg/service/roommanager_token_test.go b/pkg/service/roommanager_token_test.go new file mode 100644 index 000000000..9598e568e --- /dev/null +++ b/pkg/service/roommanager_token_test.go @@ -0,0 +1,58 @@ +// Copyright 2026 LiveKit, Inc. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package service + +import ( + "testing" + + "github.com/stretchr/testify/require" + + "github.com/livekit/protocol/auth" + + "github.com/livekit/livekit-server/pkg/config" + "github.com/livekit/livekit-server/pkg/rtc/types/typesfakes" +) + +func TestRefreshTokenSigningKey(t *testing.T) { + keys := map[string]string{ + "key1": "secret1-secret1-secret1-secret1-secret1", + "key2": "secret2-secret2-secret2-secret2-secret2", + } + r := &RoomManager{config: &config.Config{Keys: keys}} + + refresh := func(t *testing.T, apiKey string) *auth.APIKeyTokenVerifier { + p := &typesfakes.FakeLocalParticipant{} + p.APIKeyReturns(apiKey) + p.ClaimGrantsReturns(&auth.ClaimGrants{Video: &auth.VideoGrant{RoomJoin: true}}) + require.NoError(t, r.refreshToken(p)) + require.Equal(t, 1, p.SendRefreshTokenCallCount()) + + v, err := auth.ParseAPIToken(p.SendRefreshTokenArgsForCall(0)) + require.NoError(t, err) + _, _, err = v.Verify(keys[v.APIKey()]) + require.NoError(t, err) + return v + } + + t.Run("join key", func(t *testing.T) { + for apiKey := range keys { + require.Equal(t, apiKey, refresh(t, apiKey).APIKey()) + } + }) + + t.Run("unknown key falls back", func(t *testing.T) { + require.Contains(t, keys, refresh(t, "unknown").APIKey()) + }) +}