From bdaf82b1a73b2cac20c680ee13617b6593cf5d12 Mon Sep 17 00:00:00 2001
From: neuronori <sexygirl31337@gmail.com>
Date: Tue, 30 Jun 2026 19:34:25 +0000
Subject: [PATCH] feat(wbstream): surface guest access token for reuse via
 auth.token

---
 docs/settings.md                   |  2 +-
 internal/auth/wbstream/api_test.go | 36 ++++++++++++++++++++++++++++++
 internal/auth/wbstream/wbstream.go |  2 ++
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/docs/settings.md b/docs/settings.md
index 9d80f0d..fa9ae72 100644
--- a/docs/settings.md
+++ b/docs/settings.md
@@ -61,7 +61,7 @@ Speed in descending order: `datachannel` > `vp8channel` > `seichannel` > `videoc
 | YAML field | Description |
 |-----------|----------|
 | `debug` | `true` for verbose connection logs |
-| `auth.token` | Pre-issued account token for `wbstream`. When set, the session joins as that account instead of an anonymous guest; empty uses the guest flow |
+| `auth.token` | Pre-issued account token for `wbstream`. When set, the session joins as that account instead of an anonymous guest; empty uses the guest flow. In the guest flow the obtained token is logged once so it can be copied back into this field to keep the same identity |
 | `profiles` | List of failover profiles for `srv`/`cnc` |
 | `failover.retry_delay` | Pause before the next profile, e.g. `2s` |
 | `failover.max_cycles` | How many full passes over the profiles to make; `0` = unlimited |
diff --git a/internal/auth/wbstream/api_test.go b/internal/auth/wbstream/api_test.go
index 61dd3e4..90e67a7 100644
--- a/internal/auth/wbstream/api_test.go
+++ b/internal/auth/wbstream/api_test.go
@@ -1,14 +1,18 @@
 package wbstream
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
+	"log"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/openlibrecommunity/olcrtc/internal/auth"
+	"github.com/openlibrecommunity/olcrtc/internal/logger"
 )
 
 const (
@@ -147,6 +151,38 @@ func TestWBStreamIssueUsesSuppliedToken(t *testing.T) {
 	}
 }
 
+func TestWBStreamIssueSurfacesGuestToken(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /auth/api/v1/auth/user/guest-register", func(w http.ResponseWriter, _ *http.Request) {
+		_ = json.NewEncoder(w).Encode(guestRegisterResponse{AccessToken: testAccessToken}) //nolint:gosec
+	})
+	mux.HandleFunc("POST /api-room/api/v1/room/{id}/join", func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+	mux.HandleFunc("GET /api-room-manager/v2/room/{id}/connection-details", func(w http.ResponseWriter, _ *http.Request) {
+		_ = json.NewEncoder(w).Encode(tokenResponse{RoomToken: testToken})
+	})
+
+	withWBAPIServer(t, mux)
+
+	var buf bytes.Buffer
+	old := log.Writer()
+	log.SetOutput(&buf)
+	logger.SetVerbose(false)
+	t.Cleanup(func() { log.SetOutput(old) })
+
+	_, err := Provider{}.Issue(context.Background(), auth.Config{
+		RoomURL: testRoomID,
+		Name:    testPeerName,
+	})
+	if err != nil {
+		t.Fatalf("Issue() error = %v", err)
+	}
+	if !strings.Contains(buf.String(), testAccessToken) {
+		t.Fatalf("guest access token not surfaced in logs: %q", buf.String())
+	}
+}
+
 func TestWBStreamIssueRequiresRoom(t *testing.T) {
 	p := Provider{}
 	for _, roomURL := range []string{"", "any"} {
diff --git a/internal/auth/wbstream/wbstream.go b/internal/auth/wbstream/wbstream.go
index 7f43e7d..a35595f 100644
--- a/internal/auth/wbstream/wbstream.go
+++ b/internal/auth/wbstream/wbstream.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 
 	"github.com/openlibrecommunity/olcrtc/internal/auth"
+	"github.com/openlibrecommunity/olcrtc/internal/logger"
 )
 
 // Provider produces LiveKit credentials for the WB Stream service.
@@ -34,6 +35,7 @@ func (Provider) Issue(ctx context.Context, cfg auth.Config) (auth.Credentials, e
 			return auth.Credentials{}, fmt.Errorf("register guest: %w", err)
 		}
 		accessToken = guest
+		logger.Infof("wbstream: obtained guest access token, reuse it via auth.token to keep this identity: %s", accessToken)
 	}
 
 	roomID := cfg.RoomURL