@7365admin1/core 3.32.2-staging.76 → 3.32.2-staging.77

package/.changeset/dahua-spec-defects.md

@@ -0,0 +1,20 @@
+---
+"@7365admin1/core": patch
+---
+
+Fix three Dahua HTTP API defects found by checking our integration against the
+vendor specification (V3.37):
+
+- The ANPR reconnect loop retried authentication ten times at one-second
+  intervals. The device locks the account for 1800 seconds after three failed
+  logins in thirty, so our own recovery could take ANPR down at a site for half
+  an hour. Authentication now backs off well past the device's counting window,
+  and a network fault is distinguished from an authentication failure.
+- 401 and 403 were handled backwards. Per spec §3.4, 401 is the digest
+  challenge (retry) and 403 is a credentials rejection (stop). We treated 403 as
+  an account lock and killed the listener, and counted 401s toward a "wrong
+  password" warning.
+- `updatePlateNumber`, `bulkInsertPlateNumber` and `removePlateNumber`
+  interpolated values into the CGI query string unencoded, against the spec's
+  stated RFC 3986 requirement. A plate or owner name containing a space or "&"
+  broke the request or appended extra parameters to it.

package/dist/index.js

@@ -24777,6 +24777,45 @@ function shouldAlertOnFailure(consecutiveFailures) {
   return (consecutiveFailures - CAMERA_ALERT_EVERY_AFTER) % CAMERA_ALERT_EVERY_AFTER === 0;
 }
 
+// src/utils/dahua-protocol.util.ts
+var DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT = 2;
+var AUTH_BACKOFF_MS = [6e4, 3e5, 9e5];
+function dahuaAuthBackoffMs(consecutiveAuthFailures) {
+  const index = Math.min(
+    Math.max(consecutiveAuthFailures, 1),
+    AUTH_BACKOFF_MS.length
+  );
+  return AUTH_BACKOFF_MS[index - 1];
+}
+function classifyDahuaStatus(statusCode) {
+  if (statusCode === 401)
+    return "challenge";
+  if (statusCode === 403)
+    return "rejected";
+  if (statusCode === 400 || statusCode === 500)
+    return "fatal";
+  return "proceed";
+}
+function classifyDahuaFailure(message) {
+  const text = String(message ?? "");
+  if (/\b403\b|forbidden/i.test(text))
+    return "rejected";
+  if (/\b401\b|unauthorized|invalid authority|digest/i.test(text)) {
+    return "challenge";
+  }
+  return "transient";
+}
+var enc = (value) => encodeURIComponent(String(value));
+function buildPlateUpdateEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=update&name=${enc(value.mode)}&recno=${enc(value.recno)}&PlateNumber=${enc(value.plateNumber)}&BeginTime=${enc(value.start)}&CancelTime=${enc(value.end)}&+OpenGate=${value.openGate}&MasterOfCar=${enc(value.owner)}`;
+}
+function buildPlateInsertEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=insert&name=${enc(value.mode)}&PlateNumber=${enc(value.plateNumber)}&VehicleType=${enc(value.vehicleType)}&VehicleColor=${enc(value.vehicleColor)}&BeginTime=${enc(value.start)}&CancelTime=${enc(value.end)}&+OpenGate=${value.openGate}&MasterOfCar=${enc(value.owner)}`;
+}
+function buildPlateRemoveEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=remove&recno=${enc(value.recno)}&name=${enc(value.mode)}`;
+}
+
 // src/services/dahua.service.ts
 var cameraRegistry = /* @__PURE__ */ new Map();
 var _savedOnDetected;
@@ -24822,7 +24861,8 @@ async function useDahuaDigestWithRetry({
   retryDelayMs = 0
 }) {
   let lastError;
-  for (let attempt = 1; attempt <= retries; attempt++) {
+  const effectiveRetries = Math.min(retries, DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT);
+  for (let attempt = 1; attempt <= effectiveRetries; attempt++) {
     try {
       const effectiveTimeout = streaming ? 0 : timeout;
       const response = await useDahuaDigest({
@@ -24849,9 +24889,9 @@ async function useDahuaDigestWithRetry({
       }
       const errorText = streaming ? `HTTP ${statusCode}` : getDahuaResponseText(response);
       const shouldRetry = isDahuaInvalidAuthority(errorText);
-      if (shouldRetry && attempt < retries) {
+      if (shouldRetry && attempt < effectiveRetries) {
         loggerDahua.warn(
-          `[${host}] Dahua Invalid Authority. Retrying ${attempt}/${retries}`
+          `[${host}] Dahua Invalid Authority. Retrying ${attempt}/${effectiveRetries}`
         );
         if (retryDelayMs > 0) {
           await sleep(retryDelayMs);
@@ -24863,9 +24903,9 @@ async function useDahuaDigestWithRetry({
       lastError = error;
       const message = error?.message || String(error);
       const shouldRetry = isDahuaInvalidAuthority(message);
-      if (shouldRetry && attempt < retries) {
+      if (shouldRetry && attempt < effectiveRetries) {
         loggerDahua.warn(
-          `[${host}] Dahua Invalid Authority error. Retrying ${attempt}/${retries}`
+          `[${host}] Dahua Invalid Authority error. Retrying ${attempt}/${effectiveRetries}`
         );
         if (retryDelayMs > 0) {
           await sleep(retryDelayMs);
@@ -25276,7 +25316,6 @@ function useDahuaService() {
     let authFailureCount = 0;
     let connectionFailureCount = 0;
     let alertedFailureCount = 0;
-    const MAX_AUTH_RETRIES = 10;
     while (!signal.aborted) {
       let bufferQueue = null;
       let response = null;
@@ -25291,23 +25330,26 @@ function useDahuaService() {
           streaming: true
         });
         const statusCode = getDahuaStatusCode(response);
-        if (statusCode === 401) {
-          loggerDahua.error(`[${camera?.siteName}-${camera?.direction}] 401 Unauthorized - Handshake or Wrong Credentials`);
-          console.log(`[${camera?.siteName}-${camera?.direction}] 401 Unauthorized - Handshake or Wrong Credentials`);
-          throw new Error("401 Unauthorized - Handshake or Wrong Credentials");
-        } else if (statusCode === 403) {
+        const verdict = classifyDahuaStatus(statusCode);
+        if (verdict === "challenge") {
+          loggerDahua.warn(`[${camera?.siteName}-${camera?.direction}] 401 - digest challenge not completed; will re-authenticate after backoff.`);
+          throw new Error("401 Unauthorized - digest challenge not completed");
+        } else if (verdict === "rejected") {
           loggerDahua.error(
-            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden. Account locked or invalid permissions.`
+            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden - credentials rejected by the device. Not retrying.`
           );
           if (onDetected) {
             onDetected({
               site: camera?.site,
               direction: camera?.direction,
+              // Superseded #1803's own wording: cameraCredentialsMessage already
+              // says the login was refused and where to correct it, and no longer
+              // claims a ten-minute lockout.
               messagePermanent: cameraCredentialsMessage(camera)
             });
           }
           return;
-        } else if ([400, 500].includes(statusCode)) {
+        } else if (verdict === "fatal") {
           loggerDahua.error(`[${camera?.siteName}-${camera?.direction}] Connection error: ${statusCode}`);
           if (onDetected) {
             onDetected({ site: camera?.site, messagePermanent: cameraNotAuthorisedMessage(camera) });
@@ -25375,9 +25417,10 @@ function useDahuaService() {
           break;
         }
         const errMsg = String(error?.message || error);
-        if (errMsg.includes("403") || errMsg.includes("Forbidden")) {
+        const failure = classifyDahuaFailure(errMsg);
+        if (failure === "rejected") {
           loggerDahua.error(
-            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden thrown by Dahua client. Account locked or invalid credentials.`
+            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden thrown by Dahua client - credentials rejected. Not retrying.`
           );
           if (onDetected) {
             onDetected({
@@ -25388,16 +25431,15 @@ function useDahuaService() {
           }
           return;
         }
-        const isAuthError = errMsg.includes("401") || errMsg.includes("Unauthorized") || errMsg.includes("Invalid Authority");
-        if (isAuthError) {
+        if (failure === "challenge") {
           authFailureCount++;
           isAuthFailure = true;
           loggerDahua.warn(
-            `[${camera?.siteName}-${camera?.direction}] Auth attempt ${authFailureCount}/${MAX_AUTH_RETRIES}`
+            `[${camera?.siteName}-${camera?.direction}] Authentication attempt ${authFailureCount} failed; next attempt in ${dahuaAuthBackoffMs(authFailureCount) / 1e3}s`
           );
-          if (authFailureCount >= MAX_AUTH_RETRIES) {
+          if (authFailureCount === DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT) {
             loggerDahua.error(
-              `[${camera?.siteName}-${camera?.direction}] Max auth failures reached (${MAX_AUTH_RETRIES}). Wrong credentials.`
+              `[${camera?.siteName}-${camera?.direction}] ${authFailureCount} consecutive authentication failures. Slowing down and alerting the operator.`
             );
             if (onDetected) {
               onDetected({
@@ -25406,7 +25448,6 @@ function useDahuaService() {
                 messagePermanent: cameraCredentialsMessage(camera)
               });
             }
-            return;
           }
         } else {
           authFailureCount = 0;
@@ -25446,7 +25487,7 @@ function useDahuaService() {
         }
       }
       if (!signal.aborted) {
-        const waitMs = isAuthFailure ? 1e3 : 1e4;
+        const waitMs = isAuthFailure ? dahuaAuthBackoffMs(authFailureCount) : 1e4;
         await new Promise((res) => setTimeout(res, waitMs));
       }
     }
@@ -25606,7 +25647,15 @@ function useDahuaService() {
       const openGateString = String(value.isOpenGate);
       _isOpenGate = openGateString ? openGateString : "true";
     }
-    const endpoint = `/cgi-bin/recordUpdater.cgi?action=update&name=${value.mode}&recno=${value.recno}&PlateNumber=${value.plateNumber}&BeginTime=${value.start}&CancelTime=${value.end}&+OpenGate=${_isOpenGate}&MasterOfCar=${value.owner}`;
+    const endpoint = buildPlateUpdateEndpoint({
+      mode: value.mode,
+      recno: value.recno,
+      plateNumber: value.plateNumber,
+      start: value.start,
+      end: value.end,
+      owner: value.owner,
+      openGate: _isOpenGate
+    });
     try {
       const response = await useDahuaDigest({
         host: value.host,
@@ -25639,7 +25688,10 @@ function useDahuaService() {
         host: value.host,
         username: value.username,
         password: value.password,
-        endpoint: `/cgi-bin/recordUpdater.cgi?action=remove&recno=${value.recno}&name=${value.mode}`
+        endpoint: buildPlateRemoveEndpoint({
+          recno: value.recno,
+          mode: value.mode
+        })
       });
       return response;
     } catch (error2) {
@@ -25695,7 +25747,16 @@ function useDahuaService() {
     value.vehicleColor = String(value.vehicleColor ?? "").substring(0, 31) || "unknown";
     const _openGate = String(value.isOpenGate);
     const isOpenGateString = _openGate && _openGate !== "undefined" ? _openGate : "true";
-    const endpoint = `/cgi-bin/recordUpdater.cgi?action=insert&name=${value.mode}&PlateNumber=${value.plateNumber}&VehicleType=${value.vehicleType}&VehicleColor=${value.vehicleColor}&BeginTime=${value.start}&CancelTime=${value.end}&+OpenGate=${isOpenGateString}&MasterOfCar=${value.owner}`;
+    const endpoint = buildPlateInsertEndpoint({
+      mode: value.mode,
+      plateNumber: value.plateNumber,
+      vehicleType: value.vehicleType,
+      vehicleColor: value.vehicleColor,
+      start: value.start,
+      end: value.end,
+      owner: value.owner,
+      openGate: isOpenGateString
+    });
     try {
       const response = await useDahuaDigest({
         host: value.host,