fix(lotus): soundboard says "not permitted" in audio-only rooms instead of failing silently (#47)

Clips publish as an Unknown-source track. In audio-only rooms the guard
signs a microphone-only token, LiveKit refuses the publish, and since
the fork had already replied {} the host never heard. Check the grants
up front and reply { played: false, reason: "not_permitted" }.

Refs #47

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

embedded/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotusguild/element-call-embedded",
-  "version": "0.25.0-lotus.22",
+  "version": "0.25.0-lotus.24",
   "files": [
     "README.md",
     "LICENSE-AGPL-3.0",

src/lotus/lotusAudioInject.test.ts

@@ -11,6 +11,7 @@ import { of } from "rxjs";
 
 import { type CallViewModel } from "../state/CallViewModel/CallViewModel";
 import {
+  canPublishSoundboard,
   MAX_INJECT_BYTES,
   parseInjectSource,
   startLotusAudioInject,
@@ -258,3 +259,17 @@ test("parseInjectSource rejects oversized or non-buffer audio", () => {
   expect(parseInjectSource({ audio: "not bytes" })).toBeNull();
   expect(parseInjectSource({ audio: new Uint8Array(4) })).toBeNull();
 });
+
+test("canPublishSoundboard: refused by a microphone-only grant (EC #47)", () => {
+  expect(canPublishSoundboard(undefined)).toBe(true);
+  expect(
+    canPublishSoundboard({ canPublish: true, canPublishSources: [] }),
+  ).toBe(true);
+  expect(
+    canPublishSoundboard({ canPublish: true, canPublishSources: [2] }),
+  ).toBe(false);
+  expect(
+    canPublishSoundboard({ canPublish: true, canPublishSources: [2, 0] }),
+  ).toBe(true);
+  expect(canPublishSoundboard({ canPublish: false })).toBe(false);
+});

src/lotus/lotusAudioInject.ts

@@ -60,6 +60,22 @@ function acquireSharedAudio(): {
  * No effect unless the host sends the action. Returns a teardown function that
  * also aborts any clip still playing.
  */
+/**
+ * Pure: whether these LiveKit permissions allow publishing the soundboard's
+ * Unknown-source track (EC #47). No permissions or an empty source list
+ * means unrestricted; otherwise UNKNOWN (TrackSource 0) must be allowed.
+ */
+export function canPublishSoundboard(
+  perm:
+    | { canPublish?: boolean; canPublishSources?: readonly number[] }
+    | undefined,
+): boolean {
+  if (!perm) return true;
+  if (perm.canPublish === false) return false;
+  const sources = perm.canPublishSources ?? [];
+  return sources.length === 0 || sources.includes(0);
+}
+
 export function startLotusAudioInject(vm: CallViewModel): () => void {
   const w = widget;
   if (!w) return () => undefined;
@@ -116,6 +132,19 @@ export function startLotusAudioInject(vm: CallViewModel): () => void {
       return;
     }
 
+    // [EC #47] Clips publish as an Unknown-source track. Audio-only rooms get
+    // a token limited to the microphone source, where LiveKit refuses that
+    // publish *after* we replied; say so up front instead of failing silently.
+    if (
+      rooms.some((r) => !canPublishSoundboard(r.localParticipant.permissions))
+    ) {
+      w.api.transport.reply(ev.detail, {
+        played: false,
+        reason: "not_permitted",
+      });
+      return;
+    }
+
     w.api.transport.reply(ev.detail, {});
     void playInjectedClip(clip, volume, rooms, activeClips).catch((e) =>
       logger.warn("[lotus] inject_audio failed", e),

src/lotus/lotusAudioOutput.test.ts

@@ -0,0 +1,24 @@
+/*
+Copyright 2026 Lotus Guild
+
+SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE in the repository root for full details.
+*/
+
+import { expect, test } from "vitest";
+
+import { audioOutputList } from "./lotusAudioOutput";
+import { type AudioOutputDeviceLabel } from "../state/MediaDevices";
+
+test("audioOutputList labels every kind of output (cinny #310)", () => {
+  const m = new Map<string, AudioOutputDeviceLabel>([
+    ["", { type: "default", name: "Speakers" }],
+    ["a1", { type: "name", name: "Headset" }],
+    ["a2", { type: "number", number: 3 }],
+  ]);
+  expect(audioOutputList(m)).toEqual([
+    { id: "", label: "Default (Speakers)" },
+    { id: "a1", label: "Headset" },
+    { id: "a2", label: "Output 3" },
+  ]);
+});

src/lotus/lotusAudioOutput.ts

@@ -8,7 +8,12 @@ Please see LICENSE in the repository root for full details.
 import { type IWidgetApiRequest } from "matrix-widget-api";
 import { logger } from "matrix-js-sdk/lib/logger";
 
-import { type MediaDevices } from "../state/MediaDevices";
+import { combineLatest } from "rxjs";
+
+import {
+  type AudioOutputDeviceLabel,
+  type MediaDevices,
+} from "../state/MediaDevices";
 import { widget } from "../widget";
 import { LotusWidgetActions } from "./lotusActions";
 import { lotusSendToHost } from "./lotusWidget";
@@ -19,6 +24,10 @@ import { lotusSendToHost } from "./lotusWidget";
  * selects the output; the fork answers each change (and the initial state)
  * with `io.lotus.audio_output_state { deviceId, available: [{id,label}] }`.
  * No effect unless the host sends the action. Returns a teardown function.
+ *
+ * [cinny #310] Browsers hash deviceIds per frame/origin, so the host can't
+ * use ids from its own enumerateDevices(); it builds its menu from
+ * `available` here, whose ids are valid in this frame.
  */
 export function startLotusAudioOutput(mediaDevices: MediaDevices): () => void {
   const w = widget;
@@ -33,9 +42,13 @@ export function startLotusAudioOutput(mediaDevices: MediaDevices): () => void {
   };
   w.lazyActions.on(LotusWidgetActions.SetAudioOutput, handler);
 
-  const sub = mediaDevices.audioOutput.selected$.subscribe((selected) => {
+  const sub = combineLatest([
+    mediaDevices.audioOutput.available$,
+    mediaDevices.audioOutput.selected$,
+  ]).subscribe(([available, selected]) => {
     lotusSendToHost(LotusWidgetActions.AudioOutputState, {
       deviceId: selected?.id ?? null,
+      available: audioOutputList(available),
     });
   });
 
@@ -44,3 +57,29 @@ export function startLotusAudioOutput(mediaDevices: MediaDevices): () => void {
     w.lazyActions.off(LotusWidgetActions.SetAudioOutput, handler);
   };
 }
+
+/** The output list as `{id, label}` for the host's menu (#310). */
+export function audioOutputList(
+  available: Map<string, AudioOutputDeviceLabel>,
+): { id: string; label: string }[] {
+  return [...available].map(([id, l]) => {
+    let label: string;
+    switch (l.type) {
+      case "name":
+        label = l.name;
+        break;
+      case "number":
+        label = `Output ${l.number}`;
+        break;
+      case "default":
+        label = l.name ? `Default (${l.name})` : "Default";
+        break;
+      case "speaker":
+        label = "Speaker";
+        break;
+      default:
+        label = "Earpiece";
+    }
+    return { id, label };
+  });
+}