Reject room image and deprecated egress secrets in CheckCredentials

auth/grants.go

@@ -91,6 +91,26 @@ func (c *RoomConfiguration) CheckCredentials() error {
 			// do not leak stream key
 			return ErrSensitiveCredentials
 		}
+		// Deprecated singular output oneof. Still accepted by the API, so a
+		// secret here must fail the same way as the repeated fields.
+		switch output := c.Egress.Room.Output.(type) {
+		case *livekit.RoomCompositeEgressRequest_File:
+			if output.File != nil {
+				if err := checkOutputForCredentials(output.File.Output); err != nil {
+					return err
+				}
+			}
+		case *livekit.RoomCompositeEgressRequest_Segments:
+			if output.Segments != nil {
+				if err := checkOutputForCredentials(output.Segments.Output); err != nil {
+					return err
+				}
+			}
+		case *livekit.RoomCompositeEgressRequest_Stream:
+			if output.Stream != nil {
+				return ErrSensitiveCredentials
+			}
+		}
 	}
 	if c.Egress.Tracks != nil {
 		if err := checkOutputForCredentials(c.Egress.Tracks.Output); err != nil {
@@ -154,6 +174,22 @@ func checkOutputForCredentials(output any) error {
 		if msg.AliOSS.Secret != "" {
 			return ErrSensitiveCredentials
 		}
+	case *livekit.ImageOutput_S3:
+		if msg.S3.Secret != "" {
+			return ErrSensitiveCredentials
+		}
+	case *livekit.ImageOutput_Gcp:
+		if msg.Gcp.Credentials != "" {
+			return ErrSensitiveCredentials
+		}
+	case *livekit.ImageOutput_Azure:
+		if msg.Azure.AccountKey != "" {
+			return ErrSensitiveCredentials
+		}
+	case *livekit.ImageOutput_AliOSS:
+		if msg.AliOSS.Secret != "" {
+			return ErrSensitiveCredentials
+		}
 	}
 	return nil
 }

auth/grants_test.go

@@ -348,6 +348,49 @@ func TestRoomConfiguration_CheckCredentials(t *testing.T) {
 		require.NoError(t, config.CheckCredentials())
 	})
 
+	t.Run("room image output with S3 secret fails", func(t *testing.T) {
+		config := &RoomConfiguration{
+			Egress: &livekit.RoomEgress{
+				Room: &livekit.RoomCompositeEgressRequest{
+					ImageOutputs: []*livekit.ImageOutput{
+						{
+							CaptureInterval: 5,
+							Output: &livekit.ImageOutput_S3{
+								S3: &livekit.S3Upload{
+									AccessKey: "access",
+									Secret:    "secret",
+									Bucket:    "bucket",
+								},
+							},
+						},
+					},
+				},
+			},
+		}
+		require.ErrorIs(t, config.CheckCredentials(), ErrSensitiveCredentials)
+	})
+
+	t.Run("deprecated room file output with S3 secret fails", func(t *testing.T) {
+		config := &RoomConfiguration{
+			Egress: &livekit.RoomEgress{
+				Room: &livekit.RoomCompositeEgressRequest{
+					Output: &livekit.RoomCompositeEgressRequest_File{
+						File: &livekit.EncodedFileOutput{
+							Output: &livekit.EncodedFileOutput_S3{
+								S3: &livekit.S3Upload{
+									AccessKey: "access",
+									Secret:    "secret",
+									Bucket:    "bucket",
+								},
+							},
+						},
+					},
+				},
+			},
+		}
+		require.ErrorIs(t, config.CheckCredentials(), ErrSensitiveCredentials)
+	})
+
 	t.Run("room stream outputs always fail", func(t *testing.T) {
 		config := &RoomConfiguration{
 			Egress: &livekit.RoomEgress{