fix(security): close publish/play auth bypass for SO and releaseStream callbacks

[cursor]

Summary

Fixes two medium-severity authorization bypasses in the built-in server relay where publish/play succeeded without on_publish_cb/on_play_cb when only specialized callbacks were configured.

Findings

1. Publish/play bypass with only on_shared_object_auth_cb (Medium)

• Location: src/session/conn.rs
• Impact: Remote peers can publish/play through the built-in relay while shared-object admission is gated separately.
• Remediation: Extend publish/play cross-gate to require explicit publish/play callbacks when on_shared_object_auth_cb is set.
• Issue: Publish/play bypass authorization when server configures only on_shared_object_auth_cb #246

2. Publish/play bypass with only on_release_stream_cb (Medium)

• Location: src/session/conn.rs
• Impact: Remote peers can publish/play and squat routes even when the integrator only wired route-teardown authorization.
• Remediation: Extend publish/play cross-gate to require explicit publish/play callbacks when on_release_stream_cb is set.
• Issue: Publish/play bypass authorization when server configures only on_release_stream_cb #247

Changes

• Add requires_explicit_publish_auth() / requires_explicit_play_auth() helpers mirroring the existing on_media_cb/on_frame_cb cross-gate pattern.
• Reject publish/play when only on_shared_object_auth_cb or on_release_stream_cb is configured.
• Add regression tests for both bypass cases.

Closes #246, closes #247.

  

---

Note

High Risk
Changes RTMP publish/play authorization in the session layer; incorrect gating could block legitimate integrators or leave relay bypasses open.

Overview
Closes authorization gaps where peers could publish or play through the built-in relay when integrators only wired on_shared_object_auth_cb or on_release_stream_cb, without on_publish_cb / on_play_cb.

Adds requires_explicit_publish_auth() and requires_explicit_play_auth() in conn.rs, extending the existing cross-gate (media/frame callbacks) to treat shared-object auth and release-stream hooks as signals that publish/play must be explicitly authorized. publish and play command handling now reject with the same “not authorized” onStatus errors when the matching callback is missing but any of those hooks is set.

Regression tests cover publish/play rejection for shared-object-auth-only and release-stream-only configurations, including relay staying disabled and a sanity check that shared-object delivery still respects auth when configured.

^{Reviewed by Cursor Bugbot for commit 37a80a0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[AlexanderWagnerDev]

@codex review

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_bf0e6230-9ec1-4819-a6a7-3f8fbd0716f7)

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 37a80a05a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".