feat(auth): add support for user-based auth, public-api-server

Makefile

@@ -1,32 +1,31 @@
-# `make` builds the lk binary — the same cgo artifact as `go build ./cmd/lk`
-# (see the README), with a submodule init so it also works from a fresh clone.
-# It doubles as the build system CodeQL's C/C++ autobuild detects and traces to
-# extract the vendored C/C++ (PortAudio + WebRTC APM).
+# Build system shim.
 #
-# `make install` puts it on $GOBIN with a `livekit-cli` alias for the legacy
-# binary name. Releases use .goreleaser.yaml, not this file.
-
-ifeq (,$(shell go env GOBIN))
-GOBIN := $(shell go env GOPATH)/bin
-else
-GOBIN := $(shell go env GOBIN)
-endif
-
-ifeq ($(OS),Windows_NT)
-EXE := .exe
-endif
-
-# pa_src holds the PortAudio C source the cgo build links against; the submodule
-# init makes this work from a fresh clone (and under CodeQL, whose checkout may
-# skip submodules). ALSA headers (libasound2-dev) come from CodeQL's automatic
-# dependency installation on Linux.
-./bin/lk$(EXE):
-	git submodule update --init --recursive
-	CGO_ENABLED=1 go build -o ./bin/lk$(EXE) ./cmd/lk
-
-install: ./bin/lk$(EXE)
-	cp ./bin/lk$(EXE) "$(GOBIN)/lk$(EXE)"
-	ln -sf "$(GOBIN)/lk$(EXE)" "$(GOBIN)/livekit-cli$(EXE)"
+# The build system is Mage (see ./magefile.go); run targets directly with
+# `go tool mage <target>` (mage is pinned as a go.mod tool dependency).
+#
+# This Makefile is retained ONLY so GitHub's default CodeQL setup keeps working:
+# its C/C++ autobuild detects a Makefile and runs `make`, which is what traces
+# the cgo compilation of the vendored PortAudio + WebRTC APM for extraction.
+# Each target delegates to the corresponding Mage target so there is a single
+# source of truth. `mage build` runs the same CGO_ENABLED=1 `go build`.
+
+MAGE := go tool mage
+
+.PHONY: all build install clean generate test
+
+all: build
+
+build:
+	$(MAGE) build
+
+install:
+	$(MAGE) install
 
 clean:
-	rm -rf ./bin
+	$(MAGE) clean
+
+generate:
+	$(MAGE) generate
+
+test:
+	$(MAGE) test

autocomplete/fish_autocomplete

@@ -302,24 +302,41 @@ complete -x -c lk -n '__fish_seen_subcommand_from docs; and __fish_seen_subcomma
 complete -x -c lk -n '__fish_seen_subcommand_from docs; and not __fish_seen_subcommand_from overview search get-page get-pages code-search changelog list-sdks pricing-info submit-feedback help h' -a 'help' -d 'Shows a list of commands or help for one command'
 complete -x -c lk -n '__fish_lk_no_subcommand' -a 'project' -d 'Add or remove projects and view existing project properties'
 complete -c lk -n '__fish_seen_subcommand_from project' -f -l help -s h -d 'show help'
-complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list remove set-default help h' -a 'add' -d 'Add a new project (for LiveKit Cloud projects, also see `lk cloud auth`)'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list get create update delete remove set-default help h' -a 'add' -d 'Add a new project (for LiveKit Cloud projects, also see `lk cloud auth`)'
 complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from add' -f -l url -r -d '`URL` of the LiveKit server'
 complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from add' -f -l api-key -r -d 'Project `KEY`'
 complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from add' -f -l api-secret -r -d 'Project `SECRET`'
 complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from add' -f -l default -d 'Set this project as the default'
 complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from add' -f -l help -s h -d 'show help'
 complete -x -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from add; and not __fish_seen_subcommand_from help h' -a 'help' -d 'Shows a list of commands or help for one command'
-complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list remove set-default help h' -a 'list' -d 'List all configured projects'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list get create update delete remove set-default help h' -a 'list' -d 'List all configured projects'
 complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from list' -f -l json -s j -d 'Output as JSON'
 complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from list' -f -l help -s h -d 'show help'
 complete -x -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from list; and not __fish_seen_subcommand_from help h' -a 'help' -d 'Shows a list of commands or help for one command'
-complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list remove set-default help h' -a 'remove' -d 'Remove an existing project from config'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list get create update delete remove set-default help h' -a 'get' -d 'Get a LiveKit Cloud project by ID (requires --experimental-auth)'
+complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from get' -f -l json -s j -d 'Output as JSON'
+complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from get' -f -l help -s h -d 'show help'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from get; and not __fish_seen_subcommand_from help h' -a 'help' -d 'Shows a list of commands or help for one command'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list get create update delete remove set-default help h' -a 'create' -d 'Create a new LiveKit Cloud project (requires --experimental-auth)'
+complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from create' -f -l json -s j -d 'Output as JSON'
+complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from create' -f -l help -s h -d 'show help'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from create; and not __fish_seen_subcommand_from help h' -a 'help' -d 'Shows a list of commands or help for one command'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list get create update delete remove set-default help h' -a 'update' -d 'Rename a LiveKit Cloud project (requires --experimental-auth)'
+complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from update' -f -l name -r -d 'New project `NAME`'
+complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from update' -f -l json -s j -d 'Output as JSON'
+complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from update' -f -l help -s h -d 'show help'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from update; and not __fish_seen_subcommand_from help h' -a 'help' -d 'Shows a list of commands or help for one command'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list get create update delete remove set-default help h' -a 'delete' -d 'Delete a LiveKit Cloud project (requires --experimental-auth)'
+complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from delete' -f -l json -s j -d 'Output as JSON'
+complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from delete' -f -l help -s h -d 'show help'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from delete; and not __fish_seen_subcommand_from help h' -a 'help' -d 'Shows a list of commands or help for one command'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list get create update delete remove set-default help h' -a 'remove' -d 'Remove an existing project from config'
 complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from remove' -f -l help -s h -d 'show help'
 complete -x -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from remove; and not __fish_seen_subcommand_from help h' -a 'help' -d 'Shows a list of commands or help for one command'
-complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list remove set-default help h' -a 'set-default' -d 'Set a project as default to use with other commands'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list get create update delete remove set-default help h' -a 'set-default' -d 'Set a project as default to use with other commands'
 complete -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from set-default' -f -l help -s h -d 'show help'
 complete -x -c lk -n '__fish_seen_subcommand_from project; and __fish_seen_subcommand_from set-default; and not __fish_seen_subcommand_from help h' -a 'help' -d 'Shows a list of commands or help for one command'
-complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list remove set-default help h' -a 'help' -d 'Shows a list of commands or help for one command'
+complete -x -c lk -n '__fish_seen_subcommand_from project; and not __fish_seen_subcommand_from add list get create update delete remove set-default help h' -a 'help' -d 'Shows a list of commands or help for one command'
 complete -c lk -n '__fish_seen_subcommand_from set-theme' -f -l help -s h -d 'show help'
 complete -x -c lk -n '__fish_seen_subcommand_from set-theme; and not __fish_seen_subcommand_from help h' -a 'help' -d 'Shows a list of commands or help for one command'
 complete -x -c lk -n '__fish_lk_no_subcommand' -a 'room' -d 'Create or delete rooms and manage existing room properties'

cmd/lk/app.go

@@ -1,4 +1,4 @@
-// Copyright 2024 LiveKit, Inc.
+// Copyright 2024-2026 LiveKit, Inc.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -133,6 +133,9 @@ func requireProject(ctx context.Context, cmd *cli.Command) (context.Context, err
 }
 
 func requireProjectWithOpts(ctx context.Context, cmd *cli.Command, opts ...loadOption) (context.Context, error) {
+	if err := experimentalAuthGate(cmd); err != nil {
+		return ctx, err
+	}
 	if project != nil {
 		// already resolved (and announced) earlier in this command
 		return ctx, nil