@7365admin1/core 3.32.2-staging.75 → 3.32.2-staging.77

package/.changeset/dahua-credential-logging.md

@@ -0,0 +1,19 @@
+---
+"@7365admin1/core": patch
+---
+
+Stop logging camera and mailer credentials
+
+Six places wrote a secret or a resident's details to stdout on an ordinary code
+path. `getTrafficJunction` dumped the whole `TSiteCamera` object — including the
+camera's `username` and plaintext `password` — on every reconnect, and
+`addPlateNumber` logged its argument, which carries the same password plus a
+resident's plate number and owner name. `checkOutBySiteAndPlate` logged the
+matched visitor transaction. `siteCameraRepo.updateById` logged the re-read
+camera document, and `vehicleService.add` logged the whole array of a site's
+cameras, both with credentials in them. `sendEmail` printed `MAILER_PASSWORD`
+itself on every message sent.
+
+All now log identifiers, counts and outcomes only, through the module's logger
+rather than `console.log`; the mailer line is removed outright because it
+carried nothing but the secret.

package/.changeset/dahua-spec-defects.md

@@ -0,0 +1,20 @@
+---
+"@7365admin1/core": patch
+---
+
+Fix three Dahua HTTP API defects found by checking our integration against the
+vendor specification (V3.37):
+
+- The ANPR reconnect loop retried authentication ten times at one-second
+  intervals. The device locks the account for 1800 seconds after three failed
+  logins in thirty, so our own recovery could take ANPR down at a site for half
+  an hour. Authentication now backs off well past the device's counting window,
+  and a network fault is distinguished from an authentication failure.
+- 401 and 403 were handled backwards. Per spec §3.4, 401 is the digest
+  challenge (retry) and 403 is a credentials rejection (stop). We treated 403 as
+  an account lock and killed the listener, and counted 401s toward a "wrong
+  password" warning.
+- `updatePlateNumber`, `bulkInsertPlateNumber` and `removePlateNumber`
+  interpolated values into the CGI query string unencoded, against the spec's
+  stated RFC 3986 requirement. A plate or owner name containing a space or "&"
+  broke the request or appended extra parameters to it.

package/dist/index.js

@@ -22700,7 +22700,6 @@ async function sendEmail({ to, subject, text, html }) {
       pass: MAILER_PASSWORD
     }
   });
-  console.log(MAILER_EMAIL, MAILER_PASSWORD, MAILER_TRANSPORT_HOST, MAILER_TRANSPORT_PORT);
   const mailOptions = {
     from: `Seven 365 <${MAILER_EMAIL}>`,
     to,
@@ -24778,6 +24777,45 @@ function shouldAlertOnFailure(consecutiveFailures) {
   return (consecutiveFailures - CAMERA_ALERT_EVERY_AFTER) % CAMERA_ALERT_EVERY_AFTER === 0;
 }
 
+// src/utils/dahua-protocol.util.ts
+var DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT = 2;
+var AUTH_BACKOFF_MS = [6e4, 3e5, 9e5];
+function dahuaAuthBackoffMs(consecutiveAuthFailures) {
+  const index = Math.min(
+    Math.max(consecutiveAuthFailures, 1),
+    AUTH_BACKOFF_MS.length
+  );
+  return AUTH_BACKOFF_MS[index - 1];
+}
+function classifyDahuaStatus(statusCode) {
+  if (statusCode === 401)
+    return "challenge";
+  if (statusCode === 403)
+    return "rejected";
+  if (statusCode === 400 || statusCode === 500)
+    return "fatal";
+  return "proceed";
+}
+function classifyDahuaFailure(message) {
+  const text = String(message ?? "");
+  if (/\b403\b|forbidden/i.test(text))
+    return "rejected";
+  if (/\b401\b|unauthorized|invalid authority|digest/i.test(text)) {
+    return "challenge";
+  }
+  return "transient";
+}
+var enc = (value) => encodeURIComponent(String(value));
+function buildPlateUpdateEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=update&name=${enc(value.mode)}&recno=${enc(value.recno)}&PlateNumber=${enc(value.plateNumber)}&BeginTime=${enc(value.start)}&CancelTime=${enc(value.end)}&+OpenGate=${value.openGate}&MasterOfCar=${enc(value.owner)}`;
+}
+function buildPlateInsertEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=insert&name=${enc(value.mode)}&PlateNumber=${enc(value.plateNumber)}&VehicleType=${enc(value.vehicleType)}&VehicleColor=${enc(value.vehicleColor)}&BeginTime=${enc(value.start)}&CancelTime=${enc(value.end)}&+OpenGate=${value.openGate}&MasterOfCar=${enc(value.owner)}`;
+}
+function buildPlateRemoveEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=remove&recno=${enc(value.recno)}&name=${enc(value.mode)}`;
+}
+
 // src/services/dahua.service.ts
 var cameraRegistry = /* @__PURE__ */ new Map();
 var _savedOnDetected;
@@ -24823,7 +24861,8 @@ async function useDahuaDigestWithRetry({
   retryDelayMs = 0
 }) {
   let lastError;
-  for (let attempt = 1; attempt <= retries; attempt++) {
+  const effectiveRetries = Math.min(retries, DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT);
+  for (let attempt = 1; attempt <= effectiveRetries; attempt++) {
     try {
       const effectiveTimeout = streaming ? 0 : timeout;
       const response = await useDahuaDigest({
@@ -24850,9 +24889,9 @@ async function useDahuaDigestWithRetry({
       }
       const errorText = streaming ? `HTTP ${statusCode}` : getDahuaResponseText(response);
       const shouldRetry = isDahuaInvalidAuthority(errorText);
-      if (shouldRetry && attempt < retries) {
+      if (shouldRetry && attempt < effectiveRetries) {
         loggerDahua.warn(
-          `[${host}] Dahua Invalid Authority. Retrying ${attempt}/${retries}`
+          `[${host}] Dahua Invalid Authority. Retrying ${attempt}/${effectiveRetries}`
         );
         if (retryDelayMs > 0) {
           await sleep(retryDelayMs);
@@ -24864,9 +24903,9 @@ async function useDahuaDigestWithRetry({
       lastError = error;
       const message = error?.message || String(error);
       const shouldRetry = isDahuaInvalidAuthority(message);
-      if (shouldRetry && attempt < retries) {
+      if (shouldRetry && attempt < effectiveRetries) {
         loggerDahua.warn(
-          `[${host}] Dahua Invalid Authority error. Retrying ${attempt}/${retries}`
+          `[${host}] Dahua Invalid Authority error. Retrying ${attempt}/${effectiveRetries}`
         );
         if (retryDelayMs > 0) {
           await sleep(retryDelayMs);
@@ -24970,7 +25009,9 @@ function useDahuaService() {
         return;
       try {
         const result = await _checkOutBySiteAndPlate(site, plateNumber2);
-        console.log("checkOutBySiteAndPlate result", result);
+        loggerDahua.info(
+          `checkOutBySiteAndPlate matched=${Boolean(result)} type=${result?.type ?? "none"}`
+        );
         if (onDetected2 && result?.type != "resident" && result?.site) {
           onDetected2({ reload: true, site: result?.site?.toString(), siteName: camera?.siteName, cameraDirection: camera?.direction, direction });
         }
@@ -25269,11 +25310,12 @@ function useDahuaService() {
     );
   }
   async function getTrafficJunction(camera, signal, onDetected) {
-    console.log(`getTrafficJunction camera object`, camera);
+    loggerDahua.info(
+      `getTrafficJunction starting for camera ${camera?._id} [${camera?.siteName}-${camera?.direction}] host ${camera?.host}`
+    );
     let authFailureCount = 0;
     let connectionFailureCount = 0;
     let alertedFailureCount = 0;
-    const MAX_AUTH_RETRIES = 10;
     while (!signal.aborted) {
       let bufferQueue = null;
       let response = null;
@@ -25288,23 +25330,26 @@ function useDahuaService() {
           streaming: true
         });
         const statusCode = getDahuaStatusCode(response);
-        if (statusCode === 401) {
-          loggerDahua.error(`[${camera?.siteName}-${camera?.direction}] 401 Unauthorized - Handshake or Wrong Credentials`);
-          console.log(`[${camera?.siteName}-${camera?.direction}] 401 Unauthorized - Handshake or Wrong Credentials`);
-          throw new Error("401 Unauthorized - Handshake or Wrong Credentials");
-        } else if (statusCode === 403) {
+        const verdict = classifyDahuaStatus(statusCode);
+        if (verdict === "challenge") {
+          loggerDahua.warn(`[${camera?.siteName}-${camera?.direction}] 401 - digest challenge not completed; will re-authenticate after backoff.`);
+          throw new Error("401 Unauthorized - digest challenge not completed");
+        } else if (verdict === "rejected") {
           loggerDahua.error(
-            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden. Account locked or invalid permissions.`
+            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden - credentials rejected by the device. Not retrying.`
           );
           if (onDetected) {
             onDetected({
               site: camera?.site,
               direction: camera?.direction,
+              // Superseded #1803's own wording: cameraCredentialsMessage already
+              // says the login was refused and where to correct it, and no longer
+              // claims a ten-minute lockout.
               messagePermanent: cameraCredentialsMessage(camera)
             });
           }
           return;
-        } else if ([400, 500].includes(statusCode)) {
+        } else if (verdict === "fatal") {
           loggerDahua.error(`[${camera?.siteName}-${camera?.direction}] Connection error: ${statusCode}`);
           if (onDetected) {
             onDetected({ site: camera?.site, messagePermanent: cameraNotAuthorisedMessage(camera) });
@@ -25372,9 +25417,10 @@ function useDahuaService() {
           break;
         }
         const errMsg = String(error?.message || error);
-        if (errMsg.includes("403") || errMsg.includes("Forbidden")) {
+        const failure = classifyDahuaFailure(errMsg);
+        if (failure === "rejected") {
           loggerDahua.error(
-            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden thrown by Dahua client. Account locked or invalid credentials.`
+            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden thrown by Dahua client - credentials rejected. Not retrying.`
           );
           if (onDetected) {
             onDetected({
@@ -25385,16 +25431,15 @@ function useDahuaService() {
           }
           return;
         }
-        const isAuthError = errMsg.includes("401") || errMsg.includes("Unauthorized") || errMsg.includes("Invalid Authority");
-        if (isAuthError) {
+        if (failure === "challenge") {
           authFailureCount++;
           isAuthFailure = true;
           loggerDahua.warn(
-            `[${camera?.siteName}-${camera?.direction}] Auth attempt ${authFailureCount}/${MAX_AUTH_RETRIES}`
+            `[${camera?.siteName}-${camera?.direction}] Authentication attempt ${authFailureCount} failed; next attempt in ${dahuaAuthBackoffMs(authFailureCount) / 1e3}s`
           );
-          if (authFailureCount >= MAX_AUTH_RETRIES) {
+          if (authFailureCount === DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT) {
             loggerDahua.error(
-              `[${camera?.siteName}-${camera?.direction}] Max auth failures reached (${MAX_AUTH_RETRIES}). Wrong credentials.`
+              `[${camera?.siteName}-${camera?.direction}] ${authFailureCount} consecutive authentication failures. Slowing down and alerting the operator.`
             );
             if (onDetected) {
               onDetected({
@@ -25403,7 +25448,6 @@ function useDahuaService() {
                 messagePermanent: cameraCredentialsMessage(camera)
               });
             }
-            return;
           }
         } else {
           authFailureCount = 0;
@@ -25443,7 +25487,7 @@ function useDahuaService() {
         }
       }
       if (!signal.aborted) {
-        const waitMs = isAuthFailure ? 1e3 : 1e4;
+        const waitMs = isAuthFailure ? dahuaAuthBackoffMs(authFailureCount) : 1e4;
         await new Promise((res) => setTimeout(res, waitMs));
       }
     }
@@ -25456,7 +25500,9 @@ function useDahuaService() {
     return match ? match[1] : null;
   }
   async function addPlateNumber(value) {
-    console.log("addPlateNumber called with value:", value);
+    loggerDahua.info(
+      `addPlateNumber called for host ${value?.host} mode ${value?.mode}`
+    );
     let recno = null;
     const validation = import_joi40.default.object({
       host: import_joi40.default.string().required(),
@@ -25601,7 +25647,15 @@ function useDahuaService() {
       const openGateString = String(value.isOpenGate);
       _isOpenGate = openGateString ? openGateString : "true";
     }
-    const endpoint = `/cgi-bin/recordUpdater.cgi?action=update&name=${value.mode}&recno=${value.recno}&PlateNumber=${value.plateNumber}&BeginTime=${value.start}&CancelTime=${value.end}&+OpenGate=${_isOpenGate}&MasterOfCar=${value.owner}`;
+    const endpoint = buildPlateUpdateEndpoint({
+      mode: value.mode,
+      recno: value.recno,
+      plateNumber: value.plateNumber,
+      start: value.start,
+      end: value.end,
+      owner: value.owner,
+      openGate: _isOpenGate
+    });
     try {
       const response = await useDahuaDigest({
         host: value.host,
@@ -25634,7 +25688,10 @@ function useDahuaService() {
         host: value.host,
         username: value.username,
         password: value.password,
-        endpoint: `/cgi-bin/recordUpdater.cgi?action=remove&recno=${value.recno}&name=${value.mode}`
+        endpoint: buildPlateRemoveEndpoint({
+          recno: value.recno,
+          mode: value.mode
+        })
       });
       return response;
     } catch (error2) {
@@ -25690,7 +25747,16 @@ function useDahuaService() {
     value.vehicleColor = String(value.vehicleColor ?? "").substring(0, 31) || "unknown";
     const _openGate = String(value.isOpenGate);
     const isOpenGateString = _openGate && _openGate !== "undefined" ? _openGate : "true";
-    const endpoint = `/cgi-bin/recordUpdater.cgi?action=insert&name=${value.mode}&PlateNumber=${value.plateNumber}&VehicleType=${value.vehicleType}&VehicleColor=${value.vehicleColor}&BeginTime=${value.start}&CancelTime=${value.end}&+OpenGate=${isOpenGateString}&MasterOfCar=${value.owner}`;
+    const endpoint = buildPlateInsertEndpoint({
+      mode: value.mode,
+      plateNumber: value.plateNumber,
+      vehicleType: value.vehicleType,
+      vehicleColor: value.vehicleColor,
+      start: value.start,
+      end: value.end,
+      owner: value.owner,
+      openGate: isOpenGateString
+    });
     try {
       const response = await useDahuaDigest({
         host: value.host,
@@ -26116,7 +26182,7 @@ function useSiteCameraRepo() {
       }
       if (result?._id) {
         const result2 = await findOne({ _id: new import_mongodb46.ObjectId(result._id) }, void 0, { session });
-        console.log("updateById result2", result2);
+        import_node_server_utils74.logger.info(`Site camera ${result2?._id} re-read after update; reconnecting listener`);
         if (result2?._id) {
           const { listenToCamera } = useDahuaService();
           await listenToCamera(result2);
@@ -27642,7 +27708,9 @@ function useVehicleService() {
           siteCameras.push(...siteCameraReq.items);
           page++;
         } while (page <= pages);
-        console.log("add vehicle service siteCameras", siteCameras);
+        import_node_server_utils78.logger.info(
+          `addVehicle resolved ${siteCameras.length} site camera(s) for site ${value?.site}`
+        );
       }
       for (const plateNumber of plateNumbers) {
         const vehicleValue = {