fix(server-sdk): keep canPublishSources intact when encoding a token

.changeset/access-token-reencode.md

@@ -0,0 +1,5 @@
+---
+'livekit-server-sdk': patch
+---
+
+Fix `AccessToken.toJwt()` throwing on its second call when the token has `canPublishSources`. Converting the grants to JWT claims no longer replaces the token's `TrackSource` values with strings.

packages/livekit-server-sdk/src/AccessToken.test.ts

@@ -6,6 +6,7 @@ import {
   RoomCompositeEgressRequest,
   RoomConfiguration,
   RoomEgress,
+  TrackSource,
 } from '@livekit/protocol';
 import * as jose from 'jose';
 import { describe, expect, it } from 'vitest';
@@ -161,3 +162,23 @@ describe('room configuration with agents and egress', () => {
     expect(decoded.roomConfig?.egress?.room?.roomName).toEqual('test-room');
   });
 });
+
+describe('a token can be encoded more than once', () => {
+  it('keeps canPublishSources when toJwt is called twice', async () => {
+    const t = new AccessToken(testApiKey, testSecret, { identity: 'me' });
+    t.addGrant({
+      roomJoin: true,
+      room: 'myroom',
+      canPublishSources: [TrackSource.CAMERA, TrackSource.MICROPHONE],
+    });
+
+    const first = await t.toJwt();
+    const second = await t.toJwt();
+
+    const v = new TokenVerifier(testApiKey, testSecret);
+    for (const jwt of [first, second]) {
+      const decoded = await v.verify(jwt);
+      expect(decoded.video?.canPublishSources).toEqual(['camera', 'microphone']);
+    }
+  });
+});

packages/livekit-server-sdk/src/grants.test.ts

@@ -40,4 +40,15 @@ describe('ClaimGrants are parsed correctly', () => {
     expect(jwtPayload.observability).toBeTypeOf('object');
     expect((jwtPayload.observability as ObservabilityGrant)?.write).toBe(true);
   });
+
+  it('does not modify the grants it converts', () => {
+    const claim: ClaimGrants = {
+      video: { canPublishSources: [TrackSource.CAMERA, TrackSource.MICROPHONE] },
+    };
+
+    claimsToJwtPayload(claim);
+
+    expect(claim.video?.canPublishSources).toEqual([TrackSource.CAMERA, TrackSource.MICROPHONE]);
+    expect(() => claimsToJwtPayload(claim)).not.toThrow();
+  });
 });

packages/livekit-server-sdk/src/grants.ts

@@ -27,7 +27,11 @@ export function claimsToJwtPayload(
   const claim: Record<string, any> = { ...grant };
   // eslint-disable-next-line no-restricted-syntax
   if (Array.isArray(claim.video?.canPublishSources)) {
-    claim.video.canPublishSources = claim.video.canPublishSources.map(trackSourceToString);
+    // copy the video grant so the caller's grants keep their TrackSource enum values
+    claim.video = {
+      ...claim.video,
+      canPublishSources: claim.video.canPublishSources.map(trackSourceToString),
+    };
   }
   return claim;
 }