Skip to content

replay: sign replay requests with the roomRecord grant #1053

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
milos-lk wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

replay: sign replay requests with the roomRecord grant #1053

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions cmd/lk/replay.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,10 +287,10 @@ type replayServiceClient struct {
}

func (c *replayServiceClient) withAuth(ctx context.Context) (context.Context, error) {
// The replay service only checks the token's project. The grant is for the
// Public API, which won't issue a session token without one; the session
// hook (withDefaultClientOpts) swaps this token for that one.
at := auth.NewAccessToken(c.apiKey, c.apiSecret).SetVideoGrant(&auth.VideoGrant{RoomAdmin: true})
// The replay service requires roomRecord. For a session project, the session
// hook (withDefaultClientOpts) swaps this token for one the Public API mints
// with the same grants.
at := auth.NewAccessToken(c.apiKey, c.apiSecret).SetVideoGrant(&auth.VideoGrant{RoomRecord: true})

@boks1971 boks1971 Oct 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think replay might have to create a room if it does not exist. Might need the admin grant for that. Don't remember exactly though.

@milos-lk milos-lk Oct 17, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

export should be fine but playback might indeed need it - @frostbyte73 could you weight in here? 馃檹

@frostbyte73 frostbyte73 Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just RoomRecord should be fine, it'd be a bit awkward to make just one RPC take a different permission.

token, err := at.ToJWT()
if err != nil {
return nil, err
Expand Down
Loading