@7365admin1/core 3.42.2 → 3.43.0

package/test/camera-view.util.test.mjs

@@ -0,0 +1,892 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  CAMERA_NOT_PATROL_OR_CCTV,
+  CAMERA_VIEW_PERMISSIONS,
+  PATROL_CCTV_CAMERA_FILTER,
+  isPatrolCctvCamera,
+  cameraBaseUrl,
+  cameraHealthSummary,
+  clampPtzSpeed,
+  clockDriftSeconds,
+  hasAnyPermission,
+  isCameraEntitled,
+  cameraGrant,
+  parseDeviceTime,
+  parseSoftwareVersion,
+  ptzEndpoint,
+  publicCameraFields,
+  snapshotEndpoint,
+  mapWithLimit,
+  snapshotRefusalReason,
+  cameraDevices,
+  parseCameraHost,
+  resolveCamera,
+  resolutionRefusalReason,
+  rtspUrl,
+  ffmpegFrameArgs,
+  ffmpegPath,
+  wallConfig,
+  MAX_CAMERA_CHANNEL,
+  parseCameraChannel,
+  relayForRecorder,
+  deriveCameraHost,
+  CAMERA_SETUP_PERMISSIONS,
+  CAMERA_ANPR_PERMISSIONS,
+  cameraManagePermissions,
+  CAMERA_TEST_MIN_INTERVAL_SECONDS,
+  CAMERA_TEST_ROUND_LIMIT,
+} from "./.build/utils/camera-view.util.mjs";
+
+/**
+ * A configured recorder, the way a deployment would supply one. The values are
+ * obvious fakes on purpose — the real address and credential belong in the
+ * server's environment and nowhere else, least of all in a test file.
+ */
+const DEVICES = {
+  "relay.example.net": {
+    host: "recorder.example.net",
+    port: 554,
+    username: "user",
+    password: "secret",
+  },
+};
+
+/**
+ * The camera-view rules.
+ *
+ * These are the parts that decide who may see which camera and exactly what is
+ * sent to a device. They are pure on purpose: a camera on a desk is not needed to
+ * prove that an out-of-scope caller is refused or that a preset command can never
+ * be built.
+ */
+
+test("a caller with no membership at the camera's site is refused", () => {
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: "6923d6664150ca6a69b9f2b2",
+      cameraOrg: "6923d6664150ca6a69b9f000",
+      memberships: [{ siteId: "aaaaaaaaaaaaaaaaaaaaaaaa", org: "bbbbbbbbbbbbbbbbbbbbbbbb" }],
+    }),
+    false,
+  );
+});
+
+test("a caller at the camera's site is allowed, ObjectId or hex string", () => {
+  const asObjectId = { toString: () => "6923d6664150ca6a69b9f2b2" };
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: asObjectId,
+      memberships: [{ siteId: "6923d6664150ca6a69b9f2b2" }],
+    }),
+    true,
+  );
+});
+
+test("an org-level membership reaches the org's cameras, but only its own org", () => {
+  const membership = [{ org: "6923d6664150ca6a69b9f000" }];
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: "6923d6664150ca6a69b9f2b2",
+      cameraOrg: "6923d6664150ca6a69b9f000",
+      memberships: membership,
+    }),
+    true,
+  );
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: "6923d6664150ca6a69b9f2b2",
+      cameraOrg: "6923d6664150ca6a69b9f111",
+      memberships: membership,
+    }),
+    false,
+  );
+});
+
+test("a camera whose org could not be resolved is not reachable org-wide", () => {
+  // Guards the fallback: a missing org must not compare undefined to undefined
+  // and quietly become "everyone".
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: "6923d6664150ca6a69b9f2b2",
+      cameraOrg: undefined,
+      memberships: [{ org: undefined }],
+    }),
+    false,
+  );
+});
+
+/**
+ * Engagement — the third entitlement source.
+ *
+ * The product routes a security agency to a property manager's site through an
+ * ACTIVE `customer.sites` row, and that is the same list the web apps' site
+ * switcher is drawn from. Nothing in the camera path read it, so a guard whose
+ * agency is contracted at a site was refused the camera the switcher had just
+ * offered them. Measured on staging: 11 people reach a site holding a camera by
+ * this route and no other, 7 of them on wildcard owner/admin roles.
+ */
+const SITE = "6923d6664150ca6a69b9f2b2";
+const OWNER_ORG = "6923d6664150ca6a69b9f000";
+const AGENCY_ORG = "6923d6664150ca6a69b9f111";
+const OTHER_ORG = "6923d6664150ca6a69b9f222";
+
+test("an org-level member of an engaged organisation reaches the engaged site", () => {
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: AGENCY_ORG }],
+      engagedOrgs: new Set([AGENCY_ORG]),
+    }),
+    true,
+  );
+});
+
+/**
+ * The owner's decision, 2026-08-10: an agency engaged at several sites gives its
+ * staff access to the site each person is ASSIGNED to, and no other.
+ *
+ * This is the whole of defect 1. The branch used to match on organisation alone,
+ * so one pinned membership opened every site the agency serves — 68 (user, site)
+ * grants at camera sites on staging, 169 estate-wide.
+ */
+test("an agency member pinned to site A passes for A and is refused for site B", () => {
+  const SITE_B = "6923d6664150ca6a69b9f333";
+  const pinnedToA = [{ org: AGENCY_ORG, siteId: SITE }];
+  // Both sites are served by the same agency under the same engagement.
+  const engagedOrgs = new Set([AGENCY_ORG]);
+
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: pinnedToA,
+      engagedOrgs,
+    }),
+    true,
+    "the site they are assigned to must still work",
+  );
+
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: SITE_B,
+      cameraOrg: OWNER_ORG,
+      memberships: pinnedToA,
+      engagedOrgs,
+    }),
+    false,
+    "a sibling site of the same engagement must not be reachable",
+  );
+});
+
+/**
+ * The path the owner's decision was NOT about, pinned so a later tightening
+ * cannot quietly take it with it: somebody with an ORG-LEVEL role in the site's
+ * own organisation keeps exactly what they had.
+ */
+test("an estate-side org-level membership is unaffected by the engagement rule", () => {
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: OWNER_ORG }],
+    }),
+    true,
+  );
+  // …and still unaffected when engagements are in play.
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: OWNER_ORG }],
+      engagedOrgs: new Set([AGENCY_ORG]),
+    }),
+    true,
+  );
+});
+
+test("an engagement held by somebody ELSE'S organisation grants nothing", () => {
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: OTHER_ORG }],
+      engagedOrgs: new Set([AGENCY_ORG]),
+    }),
+    false,
+  );
+});
+
+test("no engagement is exactly the same answer as no engagement set at all", () => {
+  const memberships = [{ org: AGENCY_ORG }];
+  assert.equal(
+    isCameraEntitled({ cameraSite: SITE, cameraOrg: OWNER_ORG, memberships }),
+    false,
+  );
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships,
+      engagedOrgs: new Set(),
+    }),
+    false,
+  );
+});
+
+test("the granting membership is returned, so permissions resolve against the right org", () => {
+  // 22 people on staging belong to more than one organisation. Reading their
+  // permissions off whichever membership Mongo returned first is a coin toss;
+  // the one that granted access is the one that decides.
+  const memberships = [{ org: OTHER_ORG }, { org: AGENCY_ORG }];
+
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships,
+      engagedOrgs: new Set([AGENCY_ORG]),
+    })?.org,
+    AGENCY_ORG,
+  );
+
+  // And the ROLE comes back with it, because that is what decides permissions.
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [
+        { org: OTHER_ORG, role: "wrong-role" },
+        { org: AGENCY_ORG, role: "granting-role" },
+      ],
+      engagedOrgs: new Set([AGENCY_ORG]),
+    })?.role,
+    "granting-role",
+  );
+
+  // Two memberships in the SAME organisation, different roles: the one that
+  // granted access decides, deterministically, whichever order they arrive in.
+  const twoRoles = [
+    { org: AGENCY_ORG, siteId: SITE, role: "role-at-the-site" },
+    { org: AGENCY_ORG, role: "org-wide-role" },
+  ];
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: twoRoles,
+      engagedOrgs: new Set([AGENCY_ORG]),
+    })?.role,
+    "role-at-the-site",
+  );
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [...twoRoles].reverse(),
+      engagedOrgs: new Set([AGENCY_ORG]),
+    })?.role,
+    "role-at-the-site",
+    "the most specific membership must win regardless of document order",
+  );
+
+  // A membership AT the site wins over both of the fallbacks.
+  assert.equal(
+    cameraGrant({
+      cameraSite: SITE,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: OTHER_ORG, siteId: SITE }, { org: AGENCY_ORG }],
+      engagedOrgs: new Set([AGENCY_ORG]),
+    })?.org,
+    OTHER_ORG,
+  );
+
+  assert.equal(
+    cameraGrant({ cameraSite: SITE, memberships: [{ org: OTHER_ORG }] }),
+    null,
+  );
+});
+
+test("a site with no id entitles nobody, whatever else is passed", () => {
+  assert.equal(
+    isCameraEntitled({
+      cameraSite: undefined,
+      cameraOrg: OWNER_ORG,
+      memberships: [{ org: AGENCY_ORG }],
+      engagedOrgs: new Set([AGENCY_ORG]),
+    }),
+    false,
+  );
+});
+
+test("no permissions means no camera; the wildcard means any", () => {
+  assert.equal(hasAnyPermission([], CAMERA_VIEW_PERMISSIONS), false);
+  assert.equal(hasAnyPermission(undefined, CAMERA_VIEW_PERMISSIONS), false);
+  assert.equal(hasAnyPermission(["feedback:see-all"], CAMERA_VIEW_PERMISSIONS), false);
+  assert.equal(hasAnyPermission(["*"], CAMERA_VIEW_PERMISSIONS), true);
+  assert.equal(
+    hasAnyPermission(
+      ["virtual-patrol:see-all-virtual-patrol-route"],
+      CAMERA_VIEW_PERMISSIONS,
+    ),
+    true,
+  );
+});
+
+test("an ANPR unit is not a Virtual Patrol or CCTV camera at all", () => {
+  // The owner's domain rule, 2026-08-07: ANPR belongs to visitor and vehicle
+  // management. Patrol and CCTV are `ip` only, and this is the gate every
+  // per-camera endpoint goes through before entitlement is even considered.
+  assert.equal(isPatrolCctvCamera({ type: "anpr", status: "active", host: "cam" }), false);
+  assert.equal(isPatrolCctvCamera({ type: "ip", status: "active", host: "cam" }), true);
+  assert.equal(isPatrolCctvCamera(null), false);
+  assert.equal(isPatrolCctvCamera({}), false);
+});
+
+test("the listing filter admits ip cameras only, so no ANPR tile is ever built", () => {
+  assert.deepEqual(PATROL_CCTV_CAMERA_FILTER, { type: "ip" });
+});
+
+test("an ANPR unit is refused a snapshot as a second line of defence", () => {
+  const reason = snapshotRefusalReason(
+    { type: "anpr", status: "active", host: "cam" },
+    DEVICES,
+  );
+  assert.equal(reason, CAMERA_NOT_PATROL_OR_CCTV);
+  assert.match(reason, /visitor and vehicle management/i);
+});
+
+test("inactive, address-less and missing cameras are all refused", () => {
+  assert.match(
+    snapshotRefusalReason({ type: "ip", status: "inactive", host: "cam" }, DEVICES),
+    /not active/,
+  );
+  assert.match(
+    snapshotRefusalReason({ type: "ip", status: "active", host: "  " }, DEVICES),
+    /no address/,
+  );
+  assert.match(snapshotRefusalReason(null, DEVICES), /not found/i);
+  assert.equal(
+    snapshotRefusalReason(
+      { type: "ip", status: "active", host: "https://relay.example.net/7" },
+      DEVICES,
+    ),
+    null,
+  );
+});
+
+/* -------------------------------------------------------------------------- */
+/* Resolving a camera record to a real device                                  */
+/* -------------------------------------------------------------------------- */
+
+test("a stored host resolves to the relay authority and the channel on it", () => {
+  assert.deepEqual(parseCameraHost("https://relay.example.net/7"), {
+    authority: "relay.example.net",
+    channel: 7,
+  });
+  // Double-digit channels are real in the estate; a single-digit assumption
+  // would quietly point tile 10 at tile 1.
+  assert.equal(parseCameraHost("https://relay.example.net/10").channel, 10);
+  // Scheme-less hosts are stored too, and must resolve identically.
+  assert.deepEqual(parseCameraHost("relay.example.net/3"), {
+    authority: "relay.example.net",
+    channel: 3,
+  });
+});
+
+test("a camera resolves to the configured recorder plus its channel", () => {
+  const resolved = resolveCamera("https://relay.example.net/6", DEVICES);
+  assert.equal(resolved.channel, 6);
+  assert.equal(resolved.device.host, "recorder.example.net");
+  assert.equal(resolved.device.port, 554);
+});
+
+test("the three unresolvable cases are distinguishable, not one silent failure", () => {
+  // No channel on the address — one record in the estate is like this. It must
+  // NOT default to channel 1, which would show a different camera entirely.
+  assert.equal(parseCameraHost("https://relay.example.net").channel, null);
+  assert.match(
+    resolutionRefusalReason("https://relay.example.net", DEVICES),
+    /no channel/i,
+  );
+  // A placeholder record: parses fine, but no recorder is configured for it.
+  assert.match(
+    resolutionRefusalReason("http://example.com/1", DEVICES),
+    /no recorder is configured/i,
+  );
+  // Not an address at all.
+  assert.match(resolutionRefusalReason("", DEVICES), /not a valid address/i);
+  assert.equal(resolveCamera("https://relay.example.net", DEVICES), null);
+  assert.equal(resolveCamera("http://example.com/1", DEVICES), null);
+  assert.equal(resolutionRefusalReason("https://relay.example.net/4", DEVICES), null);
+});
+
+test("device configuration is read from one variable, and bad input yields none", () => {
+  const parsed = cameraDevices({
+    CAMERA_RTSP_DEVICES: JSON.stringify({
+      "Relay.Example.NET": { host: "rec", username: "u", password: "p" },
+    }),
+  });
+  // Authorities are matched case-insensitively — a host stored with capitals
+  // must not silently miss its recorder.
+  assert.equal(parsed["relay.example.net"].host, "rec");
+  // 554 unless told otherwise, so a config that omits the port still works.
+  assert.equal(parsed["relay.example.net"].port, 554);
+
+  assert.deepEqual(cameraDevices({}), {});
+  assert.deepEqual(cameraDevices({ CAMERA_RTSP_DEVICES: "not json" }), {});
+  assert.deepEqual(cameraDevices({ CAMERA_RTSP_DEVICES: "[]" }), {});
+  // An entry with no credential is dropped rather than half-built: a device we
+  // cannot authenticate to must refuse with a reason, not fail at request time.
+  assert.deepEqual(
+    cameraDevices({ CAMERA_RTSP_DEVICES: JSON.stringify({ a: { host: "h" } }) }),
+    {},
+  );
+});
+
+test("the RTSP url carries the channel, the subtype and an encoded credential", () => {
+  const url = rtspUrl(DEVICES["relay.example.net"], 6, 1);
+  assert.match(url, /^rtsp:\/\/user:secret@recorder\.example\.net:554\//);
+  assert.match(url, /channel=6&subtype=1$/);
+  // Main stream for an evidence capture, substream for a tile.
+  assert.match(rtspUrl(DEVICES["relay.example.net"], 6, 0), /subtype=0$/);
+  // A credential with URL-significant characters must not rewrite the address.
+  const awkward = rtspUrl(
+    { host: "h", port: 554, username: "a@b", password: "p/w:x" },
+    1,
+    1,
+  );
+  assert.match(awkward, /^rtsp:\/\/a%40b:p%2Fw%3Ax@h:554\//);
+});
+
+test("the ffmpeg call takes one frame, over TCP, and writes no file", () => {
+  const args = ffmpegFrameArgs("rtsp://example");
+  assert.deepEqual(args.slice(-6), ["-frames:v", "1", "-an", "-f", "mjpeg", "-"]);
+  assert.ok(args.includes("-rtsp_transport") && args.includes("tcp"));
+  // Nothing that could write to the device or to disk.
+  assert.equal(args.filter((a) => a === "-y" || a === "-f").length, 1);
+  assert.equal(ffmpegPath({}), "ffmpeg");
+  assert.equal(ffmpegPath({ CAMERA_FFMPEG_PATH: "/usr/bin/ffmpeg" }), "/usr/bin/ffmpeg");
+});
+
+test("a camera record never carries its credential off the server", () => {
+  const shaped = publicCameraFields({
+    _id: "1",
+    name: "Lobby",
+    type: "ip",
+    status: "active",
+    host: "https://relay.example.net/4",
+    username: "operator",
+    password: "s3cret",
+  });
+  const serialised = JSON.stringify(shaped);
+  assert.equal(serialised.includes("s3cret"), false);
+  assert.equal(serialised.includes("operator"), false);
+  assert.equal(shaped.name, "Lobby");
+
+  // `host` IS returned now, for `ip` records only, and it is not a credential:
+  // it is the video relay's player-page URL, which is how the live app shows
+  // motion video, and `GET /site-cameras` already returns it to every
+  // authenticated caller. The credential half of the record still never leaves.
+  assert.equal(shaped.host, "https://relay.example.net/4");
+});
+
+test("a host without a scheme defaults to http, not https", () => {
+  // 9 of 17 hosts in the estate are cleartext; upgrading them silently would
+  // turn a working camera into a TLS failure.
+  assert.equal(cameraBaseUrl("cam.example.net"), "http://cam.example.net");
+  assert.equal(cameraBaseUrl("https://cam.example.net/"), "https://cam.example.net");
+  assert.equal(cameraBaseUrl(" http://cam.example.net// "), "http://cam.example.net");
+});
+
+test("the snapshot endpoint is the documented one", () => {
+  assert.equal(snapshotEndpoint(), "/cgi-bin/snapshot.cgi?channel=1&type=0");
+});
+
+test("PTZ will not build a preset, a tour or an unknown action", () => {
+  assert.throws(() => ptzEndpoint({ action: "start", code: "GotoPreset" }), /Unsupported PTZ code/);
+  assert.throws(() => ptzEndpoint({ action: "start", code: "StartTour" }), /Unsupported PTZ code/);
+  assert.throws(() => ptzEndpoint({ action: "reboot", code: "Up" }), /Unsupported PTZ action/);
+});
+
+test("PTZ percent-encodes and clamps its speed", () => {
+  assert.equal(
+    ptzEndpoint({ action: "start", code: "ZoomTele", speed: 99 }),
+    "/cgi-bin/ptz.cgi?action=start&channel=1&code=ZoomTele&arg1=0&arg2=8&arg3=0",
+  );
+  assert.equal(clampPtzSpeed("not a number"), 4);
+  assert.equal(clampPtzSpeed(0), 1);
+  assert.equal(clampPtzSpeed(3.4), 3);
+});
+
+test("firmware and device time are read out of the device's key=value body", () => {
+  assert.equal(
+    parseSoftwareVersion("version=3.140.0000000.0\r\nBuildDate=2023-09-04\r\n"),
+    "3.140.0000000.0",
+  );
+  assert.equal(parseSoftwareVersion("nothing useful"), null);
+  assert.equal(parseDeviceTime("result=2026-08-09 21:30:00\r\n"), "2026-08-09 21:30:00");
+  assert.equal(parseDeviceTime(""), null);
+});
+
+test("clock drift is measured against Singapore time, not the host's timezone", () => {
+  // 21:30:00 SGT on 9 Aug 2026 is 13:30:00Z. A camera reading exactly that has
+  // zero drift wherever the API happens to be running.
+  const now = new Date("2026-08-09T13:30:00.000Z");
+  assert.equal(clockDriftSeconds("2026-08-09 21:30:00", now), 0);
+  assert.equal(clockDriftSeconds("2026-08-09 21:32:00", now), 120);
+  assert.equal(clockDriftSeconds("2026-08-09 21:28:00", now), -120);
+});
+
+test("an unreadable clock is null, not zero drift", () => {
+  assert.equal(clockDriftSeconds(null, new Date()), null);
+  assert.equal(clockDriftSeconds("no idea", new Date()), null);
+});
+
+test("health degrades cleanly: unreachable beats drift, drift beats ok", () => {
+  assert.equal(cameraHealthSummary({ reachable: false, driftSeconds: null }), "unreachable");
+  assert.equal(cameraHealthSummary({ reachable: false, driftSeconds: 0 }), "unreachable");
+  assert.equal(cameraHealthSummary({ reachable: true, driftSeconds: 3600 }), "drifted");
+  assert.equal(cameraHealthSummary({ reachable: true, driftSeconds: -3600 }), "drifted");
+  assert.equal(cameraHealthSummary({ reachable: true, driftSeconds: 5 }), "ok");
+  assert.equal(cameraHealthSummary({ reachable: true, driftSeconds: null }), "ok");
+});
+
+/* -------------------------------------------------------------------------- */
+/* The monitoring wall                                                         */
+/* -------------------------------------------------------------------------- */
+
+test("the wall query admits ip cameras only, and cannot be widened by a site id", () => {
+  // The shape the wall and the batched health probe both spread into their
+  // `find`. An ANPR unit is not a monitoring camera, so it must be excluded by
+  // the QUERY — a supervisor should not see a tile for it in any state.
+  const wallQuery = {
+    ...PATROL_CCTV_CAMERA_FILTER,
+    site: "6923d6664150ca6a69b9f2b2",
+    status: { $ne: "deleted" },
+  };
+  assert.equal(wallQuery.type, "ip");
+  assert.equal(Object.keys(wallQuery).length, 3);
+  // A record that is not `ip` fails the same predicate the query encodes, so the
+  // filter and the per-camera gate can never disagree.
+  assert.equal(isPatrolCctvCamera({ type: "anpr" }), false);
+});
+
+test("wall defaults are conservative, and every one is overridable", () => {
+  // The defaults matter: V3.37 documents no concurrent-connection limit for any
+  // unit, so these are a guess and the guess has to be slow.
+  const fallback = wallConfig({});
+  assert.equal(fallback.snapshotPollMs, 5000);
+  assert.equal(fallback.singlePollMs, 2000);
+  assert.equal(fallback.maxTiles, 9);
+  assert.equal(fallback.maxConcurrentProbes, 4);
+  assert.equal(fallback.healthCacheSeconds, 20);
+
+  const tuned = wallConfig({
+    CAMERA_WALL_POLL_MS: "12000",
+    CAMERA_SINGLE_POLL_MS: "3000",
+    CAMERA_WALL_MAX_TILES: "4",
+    CAMERA_WALL_MAX_CONCURRENT_PROBES: "1",
+    CAMERA_HEALTH_CACHE_SECONDS: "60",
+  });
+  assert.equal(tuned.snapshotPollMs, 12000);
+  assert.equal(tuned.singlePollMs, 3000);
+  assert.equal(tuned.maxTiles, 4);
+  assert.equal(tuned.maxConcurrentProbes, 1);
+  assert.equal(tuned.healthCacheSeconds, 60);
+});
+
+test("nonsense tuning falls back rather than disabling the limit", () => {
+  // A typo must never become "poll every 0 ms" or "no concurrency cap".
+  const broken = wallConfig({
+    CAMERA_WALL_POLL_MS: "0",
+    CAMERA_SINGLE_POLL_MS: "-1",
+    CAMERA_WALL_MAX_TILES: "not a number",
+    CAMERA_WALL_MAX_CONCURRENT_PROBES: "",
+  });
+  assert.equal(broken.snapshotPollMs, 5000);
+  assert.equal(broken.singlePollMs, 2000);
+  assert.equal(broken.maxTiles, 9);
+  assert.equal(broken.maxConcurrentProbes, 4);
+});
+
+test("a health sweep never has more probes in flight than the cap", async () => {
+  // The whole reason the wall needed a backend change: nine tiles asking for
+  // health separately is eighteen device requests fired at once.
+  let inFlight = 0;
+  let peak = 0;
+
+  const items = Array.from({ length: 9 }, (_, index) => index);
+  const results = await mapWithLimit(items, 4, async (item) => {
+    inFlight += 1;
+    peak = Math.max(peak, inFlight);
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    inFlight -= 1;
+    return item * 2;
+  });
+
+  assert.equal(peak, 4);
+  assert.deepEqual(results, [0, 2, 4, 6, 8, 10, 12, 14, 16]);
+});
+
+test("a slow camera does not reorder the wall", async () => {
+  // Results are written by index, so tile 1 stays tile 1 even when it answers last.
+  const results = await mapWithLimit([30, 1, 1], 3, async (delay) => {
+    await new Promise((resolve) => setTimeout(resolve, delay));
+    return delay;
+  });
+  assert.deepEqual(results, [30, 1, 1]);
+});
+
+test("an empty wall does no work at all", async () => {
+  let calls = 0;
+  const results = await mapWithLimit([], 4, async () => {
+    calls += 1;
+    return null;
+  });
+  assert.deepEqual(results, []);
+  assert.equal(calls, 0);
+});
+
+test("a tile refuses a camera that cannot serve a picture, before any request", () => {
+  // An ANPR unit is not on the wall at all — the query excludes it. What is left
+  // for this to catch is an `ip` camera that is inactive, has no address, or
+  // whose relay has no configured recorder. Each must show as a reason on the
+  // tile rather than as a broken image.
+  assert.equal(
+    snapshotRefusalReason({ type: "ip", status: "active", host: "  " }, DEVICES),
+    "This camera has no address configured.",
+  );
+  assert.match(
+    snapshotRefusalReason({ type: "ip", status: "active", host: "10.0.0.1" }, DEVICES),
+    /no recorder is configured/i,
+  );
+  assert.equal(
+    snapshotRefusalReason(
+      { type: "ip", status: "active", host: "https://relay.example.net/9" },
+      DEVICES,
+    ),
+    null,
+  );
+});
+
+test("a wall tile carries no credential, whatever the record holds", () => {
+  // The allow-list is the guarantee. A field added to the model later is opted IN,
+  // never remembered about.
+  const tile = publicCameraFields({
+    _id: "abc",
+    name: "Lobby",
+    type: "ip",
+    status: "active",
+    host: "https://relay.example.net/4",
+    username: "admin",
+    password: "hunter2",
+    rtspUrl: "rtsp://admin:hunter2@10.0.0.9/live",
+  });
+
+  const serialised = JSON.stringify(tile);
+  assert.equal(serialised.includes("hunter2"), false);
+  assert.equal(serialised.includes("admin"), false);
+  // A field the model gains later is still opted IN, not remembered about.
+  assert.equal(serialised.includes("rtsp://"), false);
+  assert.equal(tile.name, "Lobby");
+
+  // An ANPR record's host IS a device endpoint with a real credential beside
+  // it, so the allow-list holds on its own rather than trusting a filter
+  // somewhere else to have excluded it.
+  const anprTile = publicCameraFields({
+    _id: "def",
+    type: "anpr",
+    status: "active",
+    host: "http://device.example.com:8080",
+    username: "admin",
+    password: "hunter2",
+  });
+  assert.equal("host" in anprTile, false);
+  assert.equal(JSON.stringify(anprTile).includes("device.example.com"), false);
+});
+
+/* -------------------------------------------------------------------------- */
+/* Deriving an address from a recorder + channel                              */
+/* -------------------------------------------------------------------------- */
+
+const SETUP_DEVICES = {
+  "relay.example.com": {
+    host: "recorder.example.net",
+    port: 554,
+    username: "reader",
+    password: "hunter2",
+  },
+};
+
+test("parseCameraChannel takes a channel a person could really type", () => {
+  assert.equal(parseCameraChannel(6), 6);
+  assert.equal(parseCameraChannel("6"), 6);
+  assert.equal(parseCameraChannel(" 6 "), 6);
+  assert.equal(parseCameraChannel(MAX_CAMERA_CHANNEL), MAX_CAMERA_CHANNEL);
+
+  for (const bad of [0, -1, 1.5, "", null, undefined, "six", MAX_CAMERA_CHANNEL + 1]) {
+    assert.equal(parseCameraChannel(bad), null, String(bad));
+  }
+});
+
+test("relayForRecorder reads the configured map backwards", () => {
+  assert.equal(relayForRecorder("recorder.example.net", 554, SETUP_DEVICES), "relay.example.com");
+  // Case and stray scheme/path are what a person pastes, not a different device.
+  assert.equal(relayForRecorder("RECORDER.EXAMPLE.NET", 554, SETUP_DEVICES), "relay.example.com");
+  assert.equal(relayForRecorder("http://recorder.example.net/", 554, SETUP_DEVICES), "relay.example.com");
+  // A port is a refinement, never the thing that loses a recognised recorder.
+  assert.equal(relayForRecorder("recorder.example.net", undefined, SETUP_DEVICES), "relay.example.com");
+  assert.equal(relayForRecorder("recorder.example.net", 8000, SETUP_DEVICES), "relay.example.com");
+  // A recorder nobody configured stays unknown.
+  assert.equal(relayForRecorder("someone-elses.example.net", 554, SETUP_DEVICES), null);
+  assert.equal(relayForRecorder("", 554, SETUP_DEVICES), null);
+  assert.equal(relayForRecorder("recorder.example.net", 554, {}), null);
+});
+
+test("deriveCameraHost builds the address the product stores", () => {
+  assert.deepEqual(
+    deriveCameraHost(
+      { recorderHost: "recorder.example.net", recorderPort: 554, channel: 6 },
+      SETUP_DEVICES,
+    ),
+    { host: "https://relay.example.com/6" },
+  );
+});
+
+test("a derived address is one the existing resolution accepts", () => {
+  const derived = deriveCameraHost(
+    { recorderHost: "recorder.example.net", channel: 4 },
+    SETUP_DEVICES,
+  );
+  // The round trip is the whole contract: what setup writes, viewing resolves.
+  assert.equal(resolutionRefusalReason(derived.host, SETUP_DEVICES), null);
+  assert.deepEqual(resolveCamera(derived.host, SETUP_DEVICES), {
+    device: SETUP_DEVICES["relay.example.com"],
+    channel: 4,
+  });
+});
+
+test("each way of getting it wrong gets its own sentence", () => {
+  const missingRecorder = deriveCameraHost({ channel: 6 }, SETUP_DEVICES);
+  assert.match(missingRecorder.refusal, /recorder's address/);
+
+  const missingChannel = deriveCameraHost(
+    { recorderHost: "recorder.example.net" },
+    SETUP_DEVICES,
+  );
+  assert.match(missingChannel.refusal, /channel number/);
+
+  const unknownRecorder = deriveCameraHost(
+    { recorderHost: "someone-elses.example.net", channel: 6 },
+    SETUP_DEVICES,
+  );
+  assert.match(unknownRecorder.refusal, /not connected to the video service/);
+
+  // Three different problems, three different sentences.
+  const said = new Set([
+    missingRecorder.refusal,
+    missingChannel.refusal,
+    unknownRecorder.refusal,
+  ]);
+  assert.equal(said.size, 3);
+});
+
+test("no refusal carries an address, a port or a credential", () => {
+  const refusals = [
+    deriveCameraHost({ channel: 6 }, SETUP_DEVICES).refusal,
+    deriveCameraHost({ recorderHost: "recorder.example.net" }, SETUP_DEVICES).refusal,
+    deriveCameraHost(
+      { recorderHost: "recorder.example.net", channel: 6 },
+      {},
+    ).refusal,
+  ];
+
+  for (const refusal of refusals) {
+    for (const secret of ["recorder.example.net", "relay.example.com", "hunter2", "reader", "554"]) {
+      assert.equal(refusal.includes(secret), false, `${secret} leaked into: ${refusal}`);
+    }
+  }
+});
+
+test("setting a camera up is a narrower right than viewing one", () => {
+  assert.deepEqual(CAMERA_SETUP_PERMISSIONS, ["site-settings:manage-cctv-camera"]);
+  for (const permission of CAMERA_SETUP_PERMISSIONS) {
+    assert.equal(CAMERA_VIEW_PERMISSIONS.includes(permission), false);
+  }
+  // A wildcard still passes, as it does everywhere else in the estate.
+  assert.equal(hasAnyPermission(["*"], CAMERA_SETUP_PERMISSIONS), true);
+  assert.equal(
+    hasAnyPermission(CAMERA_VIEW_PERMISSIONS, CAMERA_SETUP_PERMISSIONS),
+    false,
+  );
+});
+
+test("the Test button's ration sits well below the device's own trigger", () => {
+  // V3.37 4.7.x locks at 3 failed logins inside 30 seconds. Both rations must
+  // make that unreachable by pressing a button.
+  assert.ok(CAMERA_TEST_MIN_INTERVAL_SECONDS >= 15);
+  assert.ok(CAMERA_TEST_ROUND_LIMIT < 3 * (300 / CAMERA_TEST_MIN_INTERVAL_SECONDS));
+  // Slowest legal press rate against one recorder: fewer than 3 in any 30 s.
+  assert.ok(30 / CAMERA_TEST_MIN_INTERVAL_SECONDS < 3);
+});
+
+/* ---- writing a camera: the gate on POST / PATCH / DELETE ------------------ */
+
+test("a write asks for the permission the panel that draws it is drawn on", () => {
+  // One endpoint, two panels. Settings draws the ANPR panel on one string and
+  // the CCTV panel on another, so the server must ask the same question the
+  // client asked - not one string for both.
+  assert.deepEqual(cameraManagePermissions("ip"), CAMERA_SETUP_PERMISSIONS);
+  assert.deepEqual(cameraManagePermissions("anpr"), CAMERA_ANPR_PERMISSIONS);
+  assert.deepEqual(CAMERA_ANPR_PERMISSIONS, ["site-settings:manage-anpr-camera"]);
+  assert.notDeepEqual(CAMERA_SETUP_PERMISSIONS, CAMERA_ANPR_PERMISSIONS);
+
+  // Anything unrecognised asks for a permission rather than none.
+  for (const type of [undefined, null, "", "IP", "unknown", 7, {}]) {
+    assert.deepEqual(cameraManagePermissions(type), CAMERA_SETUP_PERMISSIONS);
+  }
+});
+
+test("managing a camera is not implied by being allowed to look at one", () => {
+  // Measured on staging 2026-08-10: of the 107 users entitled to a site that has
+  // a CCTV camera, 12 pass this gate and every one of them passes on "*". The
+  // two roles that hold the string itself carry no members, and no role that
+  // would be refused holds ANY site-settings string - so no account that can see
+  // the panel today is refused by it.
+  assert.equal(hasAnyPermission(CAMERA_VIEW_PERMISSIONS, CAMERA_SETUP_PERMISSIONS), false);
+  assert.equal(hasAnyPermission(CAMERA_VIEW_PERMISSIONS, CAMERA_ANPR_PERMISSIONS), false);
+  assert.equal(hasAnyPermission(["*"], CAMERA_ANPR_PERMISSIONS), true);
+
+  // Holding one panel's string does not hand over the other panel.
+  assert.equal(hasAnyPermission(CAMERA_SETUP_PERMISSIONS, CAMERA_ANPR_PERMISSIONS), false);
+  assert.equal(hasAnyPermission(CAMERA_ANPR_PERMISSIONS, CAMERA_SETUP_PERMISSIONS), false);
+
+  // A permitted caller passes; an unpermitted one does not, and neither does a
+  // caller whose role resolved to nothing (a soft-deleted role reads as []).
+  assert.equal(hasAnyPermission(["site-settings:manage-cctv-camera"], CAMERA_SETUP_PERMISSIONS), true);
+  assert.equal(hasAnyPermission(["members:view-members"], CAMERA_SETUP_PERMISSIONS), false);
+  assert.equal(hasAnyPermission([], CAMERA_SETUP_PERMISSIONS), false);
+  assert.equal(hasAnyPermission(undefined, CAMERA_SETUP_PERMISSIONS), false);
+});
+
+test("a write is scoped to the caller's own sites, not just to any signed-in user", () => {
+  const site = "6923d6664150ca6a69b9f2b2";
+  const otherSite = "68f05fcc0c11062938dadada";
+
+  // A member of the camera's site may reach it.
+  assert.equal(
+    isCameraEntitled({ cameraSite: site, memberships: [{ siteId: site }] }),
+    true,
+  );
+  // A member of a DIFFERENT site may not - this is the cross-organisation case
+  // the write endpoints had no answer for at all.
+  assert.equal(
+    isCameraEntitled({ cameraSite: site, memberships: [{ siteId: otherSite }] }),
+    false,
+  );
+  // Signed in, but a member of nothing.
+  assert.equal(isCameraEntitled({ cameraSite: site, memberships: [] }), false);
+});