feat(auth): allow non-admin user role to use HTTP sink/IO nodes

apps/skit/src/permissions.rs

@@ -162,6 +162,13 @@ impl Permissions {
                 "containers::*".to_string(),
                 // Transport: allow MoQ, deny HTTP fetcher by default (SSRF risk)
                 "transport::moq::*".to_string(),
+                // Transport HTTP: allow the sink/IO nodes that serve or receive over the
+                // client's own request (no arbitrary-URL fetch), but keep
+                // `transport::http::fetcher` denied (SSRF risk). This lets least-privilege
+                // gateways serve live casts (mse) and run oneshots without admin.
+                "transport::http::mse".to_string(),
+                "streamkit::http_input".to_string(),
+                "streamkit::http_output".to_string(),
                 // Core: explicitly allow safe-ish nodes; deny core::file_writer by default (arbitrary write risk)
                 "core::passthrough".to_string(),
                 "core::file_reader".to_string(),
@@ -511,6 +518,17 @@ mod tests {
         assert!(user.is_node_allowed("plugin::wasm::gain_filter_rust"));
     }
 
+    #[test]
+    fn test_default_user_allows_http_sink_and_io_nodes() {
+        let user = Permissions::user();
+        // Sink/IO HTTP nodes are safe (serve/receive over the client's own request).
+        assert!(user.is_node_allowed("transport::http::mse"));
+        assert!(user.is_node_allowed("streamkit::http_input"));
+        assert!(user.is_node_allowed("streamkit::http_output"));
+        // The HTTP fetcher remains denied (arbitrary-URL fetch / SSRF risk).
+        assert!(!user.is_node_allowed("transport::http::fetcher"));
+    }
+
     #[test]
     fn test_global_session_limits() {
         let config = PermissionsConfig { max_concurrent_sessions: Some(10), ..Default::default() };

docs/src/content/docs/guides/authorization.md

@@ -109,6 +109,35 @@ allowed_assets = ["*"]
 > [!NOTE]
 > Role permissions are deny-by-default. If you define a custom role in `skit.toml`, any permission you omit defaults to `false`.
 
+> [!NOTE]
+> The built-in `user` role allows the safe HTTP sink/IO nodes — `transport::http::mse` (live-cast playback), `streamkit::http_input` and `streamkit::http_output` (oneshot request body/response) — but **not** `transport::http::fetcher`, which can fetch arbitrary URLs (SSRF risk). A trusted gateway that only serves or receives over the caller's own request therefore does not need `admin`.
+
+## Example: Least-privilege gateway role
+
+Trusted intermediaries (e.g. the `web-capture` or `speech-gateway` examples) build a small set of fixed pipelines and should run with a scoped token instead of `admin`. This role can create/destroy sessions and use the HTTP-transport sink/IO nodes plus a specific plugin, but cannot load/delete plugins or touch other users' sessions:
+
+```toml
+[permissions.roles.gateway]
+create_sessions = true
+destroy_sessions = true
+modify_sessions = true
+tune_nodes = true
+list_sessions = true
+list_nodes = true
+access_all_sessions = false  # Only its own sessions
+load_plugins = false
+delete_plugins = false
+upload_assets = false
+delete_assets = false
+allowed_nodes = [
+  "transport::http::mse",   # serve live casts to the browser (MSE)
+  "streamkit::http_input",  # oneshot request body
+  "streamkit::http_output", # oneshot response
+  "core::*",
+]
+allowed_plugins = ["plugin::native::servo"] # only what the gateway needs
+```
+
 ## Permission reference
 
 | Permission | Description |

samples/skit.toml

@@ -483,10 +483,15 @@ allowed_samples = [
     "user/*.yaml",
 ]
 
-# Users can use most nodes except potentially dangerous ones
+# Users can use most nodes except potentially dangerous ones.
+# Note: transport::http::fetcher is intentionally excluded (it fetches arbitrary
+# URLs - SSRF risk). The safe HTTP sink/IO nodes are allowed instead.
 allowed_nodes = [
     "audio::*",
-    "transport::*",
+    "transport::moq::*",
+    "transport::http::mse",   # serve live casts to the browser (MSE)
+    "streamkit::http_input",  # oneshot request body
+    "streamkit::http_output", # oneshot response
     "core::*",
     "containers::*",
 ]
@@ -500,6 +505,37 @@ allowed_assets = [
     "samples/audio/user/*",
 ]
 
+[permissions.roles.gateway]
+# Least-privilege role for trusted intermediaries (e.g. the speech-gateway or
+# web-capture examples) that build a small set of fixed pipelines. Avoids
+# granting admin just to use HTTP-transport nodes.
+create_sessions = true
+destroy_sessions = true
+list_sessions = true
+modify_sessions = true
+tune_nodes = true
+load_plugins = false
+delete_plugins = false
+list_nodes = true
+access_all_sessions = false  # Only its own sessions
+upload_assets = false
+delete_assets = false
+
+allowed_samples = []
+
+# Only the HTTP sink/IO nodes the gateway needs - no fetcher (SSRF risk).
+allowed_nodes = [
+    "transport::http::mse",   # serve live casts to the browser (MSE)
+    "streamkit::http_input",  # oneshot request body
+    "streamkit::http_output", # oneshot response
+    "core::*",
+]
+
+# Only the specific plugin(s) the gateway needs (example: servo for web-capture).
+allowed_plugins = ["plugin::native::servo"]
+
+allowed_assets = []
+
 [permissions.roles.readonly]
 # Read-only role - can only view, not modify
 create_sessions = false