From c1987306cbabbda2325d6edf43c4148e4e1bbdef Mon Sep 17 00:00:00 2001 From: Milos Pesic Date: Sat, 17 Oct 2026 15:31:28 +0200 Subject: [PATCH] replay: sign replay requests with the roomRecord grant Co-Authored-By: Claude Opus 5.5 --- cmd/lk/replay.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cmd/lk/replay.go b/cmd/lk/replay.go index dc4835b2d..3e7fcd3c6 100644 --- a/cmd/lk/replay.go +++ b/cmd/lk/replay.go @@ -287,10 +287,10 @@ type replayServiceClient struct { } func (c *replayServiceClient) withAuth(ctx context.Context) (context.Context, error) { - // The replay service only checks the token's project. The grant is for the - // Public API, which won't issue a session token without one; the session - // hook (withDefaultClientOpts) swaps this token for that one. - at := auth.NewAccessToken(c.apiKey, c.apiSecret).SetVideoGrant(&auth.VideoGrant{RoomAdmin: true}) + // The replay service requires roomRecord. For a session project, the session + // hook (withDefaultClientOpts) swaps this token for one the Public API mints + // with the same grants. + at := auth.NewAccessToken(c.apiKey, c.apiSecret).SetVideoGrant(&auth.VideoGrant{RoomRecord: true}) token, err := at.ToJWT() if err != nil { return nil, err