@7365admin1/core 3.32.2-staging.61 → 3.32.2-staging.63

package/.changeset/camera-functions-for-patrol.md

@@ -0,0 +1,42 @@
+---
+"@7365admin1/core": minor
+---
+
+Camera functions for Virtual Patrol, proxied server-side.
+
+Adds authenticated camera endpoints so the apps can use a site camera without ever
+holding its credential. Dahua devices authenticate with digest and the cleartext
+password on every request (HTTP API V3.37 §3.4) and the specification offers no
+session or usable token, so the only safe shape is a server-side proxy.
+
+- `useCameraViewController` — snapshot, snapshot-to-file for evidence, and
+  per-recorder health.
+- A camera record does not hold a device address: `site.cameras.host` is the CCTV
+  relay's page URL and its numeric last path segment is the stream channel. A
+  camera is therefore resolved as **recorder (from `CAMERA_RTSP_DEVICES`, keyed by
+  relay authority) + channel (from the stored host)**. The address and credential
+  live in deployment configuration only — never in the database, never in a client.
+- Pictures come off the video stream (one `ffmpeg` frame per snapshot, substream
+  for a tile, main stream for an evidence capture). The recorder in use exposes
+  RTSP only; its HTTP CGI ports are not reachable, so `snapshot.cgi`, firmware
+  (§4.6.14), device clock (§4.6.2) and PTZ (§8.1.5) cannot be used against it.
+  Firmware and clock are reported as unavailable with a reason, and PTZ refuses.
+  `GET /site-cameras/capabilities` reports `ptz: false` whatever
+  `CAMERA_PTZ_ENABLED` says, so a client hides the control rather than drawing a
+  pad whose every press fails.
+- A camera whose relay has no configured recorder, or whose address carries no
+  channel, is refused up-front with a reason rather than failing as a blank picture.
+- At most `CAMERA_MAX_CONCURRENT_GRABS` (4) pictures are taken at once across the
+  process, so the endpoint cannot fill the API host with ffmpeg or overpull the
+  recorder; over that, the caller is told the cameras are busy.
+- Access is decided by the caller's site/org membership and their role's
+  permissions, never by the camera id in the URL.
+- ANPR units are refused: ANPR belongs to visitor and vehicle management, not to
+  Virtual Patrol or CCTV.
+- Camera host, username, password and the RTSP URL are never returned and never
+  logged; ffmpeg's stderr is discarded because it echoes the credential.
+- No retry on a camera call: the device locks an account for 1800 s after 3
+  failures in 30 s (§4.7.x).
+
+Requires `ffmpeg` on the API host (or `CAMERA_FFMPEG_PATH`); where it is absent the
+snapshot endpoints answer with "Video tooling is not available on this server."

package/.changeset/camera-monitoring-wall.md

@@ -0,0 +1,32 @@
+---
+"@7365admin1/core": minor
+---
+
+CCTV monitoring wall: a site-scoped camera list and a batched health sweep.
+
+Two additions to the camera proxy so a supervisor can watch a whole site rather
+than one checkpoint at a time.
+
+`getSiteWall` returns the cameras of one site from `site.cameras` - the
+collection the real cameras are in - together with the polling intervals and
+fan-out caps the client should use. No device is contacted, so opening a wall is
+one database read. Entitlement is by site membership, not by the id in the URL,
+and a caller outside the site gets the same answer as one asking for a site that
+does not exist.
+
+`getSiteHealth` probes the cameras currently on screen with at most
+`CAMERA_WALL_MAX_CONCURRENT_PROBES` in flight. Reachability is a **per-recorder**
+answer, cached per recorder: twelve of this estate's cameras are twelve channels
+on one device, so a full wall is one connect rather than one per tile. It never
+throws for a camera that is down; unreachable is the answer, and a camera whose
+relay has no configured recorder is refused with a reason instead.
+
+Firmware version and device clock are reported as unavailable with a reason: they
+are HTTP CGI facts and the recorder in use exposes RTSP only.
+
+Snapshots now record when a camera last returned a picture, so a tile can say
+"last frame 40 minutes ago" instead of "never".
+
+New, all optional and conservative by default: `CAMERA_WALL_POLL_MS` (5000),
+`CAMERA_SINGLE_POLL_MS` (2000), `CAMERA_WALL_MAX_TILES` (9),
+`CAMERA_WALL_MAX_CONCURRENT_PROBES` (4), `CAMERA_HEALTH_CACHE_SECONDS` (20).