mirror of
https://github.com/livekit/livekit.git
synced 2026-09-16 04:15:54 +00:00
Paul Wells
66bb61c89f
The front gated non-public routes on a bool that was true for any valid token in the project, so a roomJoin token minted for an end user reached every non-public endpoint the project's agents expose. Replace the resolver's (apiKey, authenticated) pair with an Access value and give it the agent and deployment from the URL, so the scope rules stay with the grant in protocol/auth and this package consumes only the verdict. Credentialed now separates a caller with no credential from one whose credential lacks the grant: the first is challenged with 401, the second gets 403 and no WWW-Authenticate, since a retry cannot succeed. A denied request still reaches the fallback. Another node's worker may declare the same path public, and that node is the authority.