fix(auth): only request single-scene specific perms when rendering scene

arenaxr · Aug 28, 2024 · 43d80fe · 43d80fe
1 parent 4e9e801
commit 43d80fe
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/build/arena-account.js b/build/arena-account.js
@@ -101,7 +101,8 @@ export default class ARENAUserAccount {
         let params = `username=${mqttUsername}`;
         params += `&id_auth=${authType}`;
         params += `&realm=${ARENADefaults ? ARENADefaults.realm : 'realm'}`;
-        params += `&scene=${namespacedScene}`;
+        // only request single-scene specific perms when rendering scene
+        // pages /scenes and /build should have general permissions for the user's scene objects
         const result = await ARENAUserAccount._makeRequest(
             'POST',
             `/user/mqtt_auth`,

diff --git a/static/auth.js b/static/auth.js
@@ -214,9 +214,9 @@ window.ARENAAUTH = {
             authParams.realm = ARENA.params.realm;
         }
 
-        if (ARENA.params.scene) {
-            authParams.scene = decodeURIComponent(ARENA.params.scene);
-        } else if (!this.nonScenePaths.includes(window.location.pathname)) {
+        // only request single-scene specific perms when rendering scene
+        // pages /scenes and /build should have general permissions for the user's scene objects
+        if (!this.nonScenePaths.includes(window.location.pathname)) {
             // handle full ARENA scene
             if (ARENA.sceneName) {
                 authParams.scene = ARENA.namespacedScene;