If I'm reading your logic right, CmdAssignAuthority written another way works as follows:

• if (current != null && current != connectionToClient) set authority to connectionToClient
• else if ( current == connectionToClient ) set to null (b/c current != null means it must be connection to client due to the first if statement)
• else if ( current == null ) set to connectionToClient

I'm not entirely sure how often your OnInputClicked due to differences between AR devices but I'm going to assume something like this video. The logic in OnInputClicked can be psuedo-coded as:

• if ( click and raycast hit ) it will do the above routine for that object
• if ( click and miss and cached hit object ) it will do the same routine

This logic has a few potential errors:

• Clicking twice with the same raycast outcome (hit or miss) is going to put the authority out of sync with who's actually clicking (a hit would be a release and a miss would set authority).
• Because it only ever assigns authority with connectionToClient, the host client, when clicking, will assign authority to connectionToClient as well which is probably why you can never move it on the host.
• The third case in your CmdAssignAuthority which your first if catches should never happen and makes it harder to read what's going on.

It looks like your logic is tangled up in CmdSetAuthority and potentially can break down in OnInputClicked if the clicker is not the connectionToClient. I suggest rewriting your logic so that it sends some sort of ID for the clicking player to the CmdSetAuthority instead of just toggling between null and connectionToClient

EDIT:

If your objects have the same name I could see GameObject.find(hit.transform.name) giving you issues (use hit.transform.gameObject instead)

Original answer:

If I'm reading your logic right, CmdAssignAuthority written another way works as follows:

• if (current != null && current != connectionToClient) set authority to connectionToClient
• else if ( current == connectionToClient ) set to null (b/c current != null means it must be connection to client due to the first if statement)
• else if ( current == null ) set to connectionToClient

I'm not entirely sure how often your OnInputClicked due to differences between AR devices but I'm going to assume something like this video. The logic in OnInputClicked can be psuedo-coded as:

• if ( click and raycast hit ) it will do the above routine for that object
• if ( click and miss and cached hit object ) it will do the same routine

This logic has a few potential errors:

• Clicking twice with the same raycast outcome (hit or miss) is going to put the authority out of sync with who's actually clicking (a hit would be a release and a miss would set authority).
• Because it only ever assigns authority with connectionToClient, the host client, when clicking, will assign authority to connectionToClient as well which is probably why you can never move it on the host.
• The third case in your CmdAssignAuthority which your first if catches should never happen and makes it harder to read what's going on.

It looks like your logic is tangled up in CmdSetAuthority and potentially can break down in OnInputClicked if the clicker is not the connectionToClient. I suggest rewriting your logic so that it sends some sort of ID for the clicking player to the CmdSetAuthority instead of just toggling between null and connectionToClient