always let through audio forwarding

server/src/services/videoAuthService/httpRoute.js

@@ -34,10 +34,14 @@ function registerVideoAuthRoute(deps) {
 
     const isRtspProtocol = protocol === 'rtsp' || protocol.startsWith('rtsp');
     const isLoopback = ip === '127.0.0.1' || ip === '::1';
+    const isRoverForwardAudioRead = action === 'read'
+      && isRtspProtocol
+      && streamInfo?.id?.endsWith('-fwd');
     // Replay and snapshot workers read MediaMTX through loopback RTSP. They do
-    // not represent a browser session, while non-loopback RTSP readers remain
-    // subject to the normal session authorization below.
-    if (action === 'read' && isRtspProtocol && isLoopback) {
+    // not represent a browser session. Rovers likewise read their dedicated
+    // -fwd speaker feed without browser credentials; every other non-loopback
+    // RTSP read remains subject to normal session authorization below.
+    if ((action === 'read' && isRtspProtocol && isLoopback) || isRoverForwardAudioRead) {
       return res.status(200).end();
     }
     /*

server/src/services/videoAuthService/httpRoute.test.js

@@ -52,6 +52,11 @@ test('continues rejecting an unauthenticated remote RTSP reader', () => {
   assert.equal(request({ protocol: 'rtsp', action: 'read', path: 'rover-one' }), 401);
 });
 
+test('allows a rover to read its RTSP speaker-forward stream without a browser session', () => {
+  const { request } = createHarness({ requestIp: '192.0.2.10' });
+  assert.equal(request({ protocol: 'rtsp', action: 'read', path: 'rover-one-fwd' }), 200);
+});
+
 test('continues rejecting an unauthenticated WebRTC read', () => {
   const { request } = createHarness();
   assert.equal(request({ protocol: 'webrtc', action: 'read', path: 'rover-one' }), 401);