@camera.ui/server 0.0.49 → 0.0.50-internal.0

package/src/api/go2rtc/types.ts

@@ -0,0 +1,174 @@
+export interface ApplicationResponse {
+  config_path: string;
+  host: string;
+  rtsp: RTSPInfo;
+  version: string;
+}
+
+export interface RTSPInfo {
+  listen: string;
+  default_query: string;
+  PacketSize: number;
+}
+
+export type DeviceSourceType = 'Google' | 'Ring' | 'Roborock' | 'HomeKit' | 'Onvif' | 'Hass' | 'GoPro' | 'FFmpeg' | 'DVRip' | 'Webtorrent';
+
+export interface BaseDeviceSource {
+  url: string;
+  type: DeviceSourceType;
+}
+
+export interface DeviceSource extends BaseDeviceSource {
+  name?: string;
+  id?: string;
+  location?: string;
+}
+
+export interface HomeKitSource extends BaseDeviceSource {
+  name: string;
+  info: string;
+  url: string;
+  location: string;
+  type: 'HomeKit';
+}
+
+export interface OnvifSource extends BaseDeviceSource {
+  id: string;
+  name: string;
+  url: string;
+  info: string;
+  type: 'Onvif';
+}
+
+export interface HassSource extends BaseDeviceSource {
+  name: string;
+  url: string;
+  location: string;
+  type: 'Hass';
+}
+
+export interface GoProSource extends BaseDeviceSource {
+  name: string;
+  url: string;
+  type: 'GoPro';
+}
+
+export interface FFmpegSource extends BaseDeviceSource {
+  name: string;
+  url: string;
+  type: 'FFmpeg';
+}
+
+export interface DVRipSource extends BaseDeviceSource {
+  name: string;
+  url: string;
+  type: 'DVRip';
+}
+
+export interface WebtorrentSource extends BaseDeviceSource {
+  id: string;
+  url: string;
+  type: 'Webtorrent';
+}
+
+export interface HomeKitPairResponse {
+  source: {
+    name: string;
+    url: string;
+  };
+}
+
+export interface ExitData {
+  code: number;
+}
+
+export interface NameData {
+  name: string;
+}
+
+export interface SourceData {
+  src: string;
+}
+
+export interface HomeKitPairData {
+  id: string;
+  url: string;
+  pin: string;
+}
+
+export interface UnpairData {
+  id: string;
+}
+
+export interface CreateStreamData {
+  name: string;
+  src: string[];
+}
+
+export interface UpdateStreamData {
+  name: string;
+  src: string;
+}
+
+export interface IntercomData {
+  name: string;
+  dst: string;
+}
+
+export interface SourceLoginData {
+  username?: string;
+  password?: string;
+}
+
+export interface Go2RTCCodec {
+  codec_name: string;
+  codec_type: string;
+  sample_rate?: number;
+  level?: number;
+  profile?: string;
+  channels?: number;
+}
+
+export interface Go2RTCReceiver {
+  id: number;
+  codec: Go2RTCCodec;
+  childs: number[];
+}
+
+export interface Go2RTCSender {
+  id: number;
+  codec: Go2RTCCodec;
+  parent: number;
+}
+
+export interface Go2RTCProducer {
+  id?: number;
+  format_name?: string;
+  protocol?: string;
+  source?: string;
+  remote_addr?: string;
+  url?: string;
+  sdp?: string;
+  user_agent?: string;
+  medias?: string[];
+  receivers?: Go2RTCReceiver[];
+  senders?: Go2RTCSender[];
+}
+
+export interface Go2RTCConsumer {
+  id: number;
+  format_name: string;
+  protocol: string;
+  remote_addr: string;
+  user_agent: string;
+  medias: string[];
+  source?: string;
+  sdp?: string;
+  receivers?: Go2RTCReceiver[];
+  senders?: Go2RTCSender[];
+}
+
+export interface Go2RTCProbe {
+  producers: Go2RTCProducer[];
+  consumers: Go2RTCConsumer[];
+}

package/src/api/index.ts

@@ -0,0 +1,286 @@
+import FastifyCors from '@fastify/cors';
+import FastifyFormbody from '@fastify/formbody';
+import FastifyHelmet from '@fastify/helmet';
+import FastifyMultipart from '@fastify/multipart';
+import FastifyStatic from '@fastify/static';
+import { green } from 'ansicolor';
+import Fastify from 'fastify';
+import { serializerCompiler, validatorCompiler } from 'fastify-type-provider-zod';
+import qs from 'qs';
+import { container } from 'tsyringe';
+
+import { API_EVENT } from '../api.js';
+import { ConfigService } from '../services/config/index.js';
+import { RUNTIME_STATUS } from '../services/config/types.js';
+import { HeaderPlugin } from './plugins/header.plugin.js';
+// import { LoggerPlugin } from './plugins/logger.plugin.js';
+import { ProxyPlugin } from './plugins/proxy.plugin.js';
+import { SocketIoPlugin } from './plugins/socket.plugin.js';
+import { SystemPlugin } from './plugins/system.plugin.js';
+import { UserAgentPlugin } from './plugins/useragent.plugin.js';
+import { FastifyRoutes } from './routes/index.js';
+
+import type { FastifyCorsOptions } from '@fastify/cors';
+import type { FastifyHelmetOptions } from '@fastify/helmet';
+import type { FastifyMultipartAttachFieldsToBodyOptions } from '@fastify/multipart';
+import type { FastifyStaticOptions } from '@fastify/static';
+import type { FastifyBaseLogger, FastifyHttp2SecureOptions, FastifyInstance } from 'fastify';
+import type { Http2SecureServer } from 'http2';
+import type { ServerOptions } from 'socket.io';
+import type { CameraUiAPI } from '../api.js';
+import type { ProxyServer } from '../rpc/index.js';
+import type { LoggerService } from '../services/logger/index.js';
+import type { ProxyOptions } from './plugins/proxy.plugin.js';
+import type { ServerRuntime } from './websocket/types.js';
+
+export class Server {
+  public isRunning = false;
+  public app?: FastifyInstance<Http2SecureServer>;
+
+  private api: CameraUiAPI;
+  private logger: LoggerService;
+  private configService: ConfigService;
+  private proxyServer: ProxyServer;
+
+  constructor() {
+    this.api = container.resolve<CameraUiAPI>('api');
+    this.logger = container.resolve<LoggerService>('logger');
+    this.configService = container.resolve<ConfigService>('configService');
+    this.proxyServer = container.resolve<ProxyServer>('proxy');
+  }
+
+  public async register(): Promise<void> {
+    this.app = Fastify(this.serverOptions);
+
+    // setup zod validator and serializer
+    this.app.setValidatorCompiler(validatorCompiler);
+    this.app.setSerializerCompiler(serializerCompiler);
+
+    // setup listeners
+    this.setupListeners();
+
+    // register plugins
+    await this.registerPlugins();
+
+    // register routes
+    await this.registerRouters();
+  }
+
+  public async listen(): Promise<void> {
+    if (!this.app) {
+      throw new Error('Fastify instance not initialized');
+    }
+
+    await this.app.listen({
+      host: '::',
+      port: this.configService.config.port,
+    });
+
+    this.isRunning = true;
+  }
+
+  public async close(): Promise<void> {
+    try {
+      await this.app?.close();
+    } catch {
+      // ignore
+    }
+
+    this.app = undefined;
+  }
+
+  private setupListeners(): void {
+    if (this.app) {
+      this.app.addHook('onListen', async () => {
+        this.logger.log(green(`camera.ui v${ConfigService.VERSION} is listening on https://127.0.0.1:${this.configService.config.port}`));
+
+        const runtimeInfo: ServerRuntime = {
+          'camera.ui': { name: 'camera.ui', status: RUNTIME_STATUS.STARTED },
+        };
+
+        this.app!.io.of('/status').emit('process-status', runtimeInfo);
+        this.api.emit(API_EVENT.FINISH_LAUNCHING);
+      });
+
+      this.app.addHook('preClose', async () => {
+        this.logger.debug('camera.ui is shutting down');
+
+        const runtimeInfo: ServerRuntime = {
+          'camera.ui': { name: 'camera.ui', status: RUNTIME_STATUS.STOPPED },
+        };
+
+        this.app!.io.of('/status').emit('process-status', runtimeInfo);
+        this.api.emit(API_EVENT.SHUTDOWN);
+      });
+
+      this.app.addHook('onClose', async () => {
+        this.logger.warn('camera.ui stopped');
+      });
+    }
+  }
+
+  private async registerPlugins(): Promise<void> {
+    await this.app?.register(SocketIoPlugin, this.socketOptions);
+    await this.app?.register(SystemPlugin);
+    // await this.app?.register(LoggerPlugin);
+    await this.app?.register(HeaderPlugin);
+    await this.app?.register(FastifyHelmet, this.helmetOptions);
+    await this.app?.register(FastifyCors, this.corsOptions);
+    await this.app?.register(ProxyPlugin, this.natsProxyOptions);
+    await this.app?.register(ProxyPlugin, this.go2rtcProxyOptions);
+    await this.app?.register(FastifyFormbody);
+    await this.app?.register(UserAgentPlugin);
+    await this.app?.register(FastifyMultipart, this.multipartOptions);
+    await this.app?.register(FastifyStatic, this.staticOptions);
+  }
+
+  private async registerRouters(): Promise<void> {
+    if (this.app) {
+      const routes = new FastifyRoutes(this.app);
+      await routes.register();
+    }
+  }
+
+  private get corsOptions(): FastifyCorsOptions {
+    return {
+      origin: [`https://127.0.0.1:${this.configService.config.port}`, `http://127.0.0.1:${this.configService.UI_PORT}`],
+    };
+  }
+
+  private get natsProxyOptions(): ProxyOptions {
+    return {
+      upstream: `wss://localhost:${this.proxyServer.server.wsPort}`,
+      prefix: '/proxy',
+      target: 'nats',
+      tls: {
+        cert: this.configService.ssl.cert,
+        key: this.configService.ssl.key,
+        ca: this.configService.ssl.ca,
+        rejectUnauthorized: false,
+      },
+    };
+  }
+
+  private get go2rtcProxyOptions(): ProxyOptions {
+    const go2rtcAddress = this.configService.go2rtcAddress('ws');
+
+    return {
+      upstream: `${go2rtcAddress}/api/ws`,
+      prefix: '/go2rtc',
+      target: 'go2rtc',
+      tls: {
+        cert: this.configService.ssl.cert,
+        key: this.configService.ssl.key,
+        ca: this.configService.ssl.ca,
+        rejectUnauthorized: false,
+      },
+    };
+  }
+
+  private get helmetOptions(): FastifyHelmetOptions {
+    return {
+      hsts: false,
+      frameguard: false,
+      referrerPolicy: {
+        policy: 'no-referrer',
+      },
+      crossOriginEmbedderPolicy: false,
+      crossOriginOpenerPolicy: false,
+      crossOriginResourcePolicy: false,
+      contentSecurityPolicy: {
+        directives: {
+          defaultSrc: ["'unsafe-eval'", "'unsafe-inline'", "'self'"],
+          styleSrcElem: ["'unsafe-eval'", "'unsafe-inline'", "'self'"],
+          scriptSrc: ["'unsafe-eval'", "'unsafe-inline'", "'self'", 'blob:', 'data:'],
+          childSrc: ["'unsafe-eval'", "'unsafe-inline'", "'self'", 'blob:', 'https:'],
+          // fontSrc: ["'unsafe-eval'", "'unsafe-inline'", "'self'", 'data:'],
+          frameSrc: ["'unsafe-eval'", "'unsafe-inline'", "'self'"],
+          connectSrc: ["'unsafe-eval'", "'unsafe-inline'", "'self'", 'ws:', 'wss:', 'https:', 'blob:', 'data:', 'file:', 'filesystem:', 'mediastream:'],
+          imgSrc: ["'unsafe-eval'", "'unsafe-inline'", "'self'", 'data:', 'blob:'],
+          mediaSrc: ["'unsafe-eval'", "'unsafe-inline'", "'self'", 'data:', 'blob:', 'http:', 'https:'],
+          scriptSrcAttr: null,
+          fontSrc: null,
+          objectSrc: null,
+          frameAncestors: null,
+          formAction: null,
+          baseUri: null,
+          upgradeInsecureRequests: null,
+          blockAllMixedContent: null,
+        },
+      },
+    };
+  }
+
+  // private get rateLimitOptions(): RateLimitPluginOptions {
+  //   return {
+  //     max: 300,
+  //     timeWindow: 30 * 1000,
+  //     hook: 'preHandler',
+  //   };
+  // }
+
+  private get serverOptions(): FastifyHttp2SecureOptions<Http2SecureServer, FastifyBaseLogger> {
+    return {
+      bodyLimit: 1e8,
+      disableRequestLogging: true,
+      forceCloseConnections: true,
+      trustProxy: true,
+      http2: true,
+      https: {
+        rejectUnauthorized: false,
+        allowHTTP1: true,
+        cert: this.configService.ssl.cert,
+        key: this.configService.ssl.key,
+        ca: this.configService.ssl.ca,
+      },
+      querystringParser: this.qsParser.bind(this),
+    };
+  }
+
+  private qsParser(str: string) {
+    return qs.parse(str, {
+      decoder(str: string, defaultDecoder: qs.defaultDecoder, charset: string, type: 'key' | 'value') {
+        if (type === 'value' && /^(?:-(?:[1-9](?:\d{0,2}(?:,\d{3})+|\d*))|(?:0|(?:[1-9](?:\d{0,2}(?:,\d{3})+|\d*))))(?:.\d+|)$/.test(str)) {
+          return parseFloat(str);
+        }
+
+        const keywords: any = {
+          true: true,
+          false: false,
+          null: null,
+          undefined: undefined,
+        };
+        if (type === 'value' && str in keywords) {
+          return keywords[str];
+        }
+
+        return defaultDecoder(str, defaultDecoder, charset);
+      },
+    });
+  }
+
+  private get socketOptions(): Partial<ServerOptions> {
+    return {
+      cors: {
+        origin: '*',
+      },
+      pingTimeout: 60000,
+      pingInterval: 25000,
+      transports: ['websocket', 'polling'],
+      path: '/socket.io',
+    };
+  }
+
+  private get multipartOptions(): FastifyMultipartAttachFieldsToBodyOptions {
+    return {
+      attachFieldsToBody: true,
+    };
+  }
+
+  private get staticOptions(): FastifyStaticOptions {
+    return {
+      root: ConfigService.INTERFACE_PATH,
+      prefix: '/',
+    };
+  }
+}

package/src/api/middlewares/authPermission.middleware.ts

@@ -0,0 +1,46 @@
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import type { AuthLoginRequest, AuthParamsRequest } from '../types/index.js';
+
+export const onlyMasterCanDoThisAction = async (req: FastifyRequest<AuthLoginRequest>, reply: FastifyReply): Promise<FastifyReply> => {
+  if (req.locals.user?.role !== 'master') {
+    return reply.code(403).send({
+      statusCode: 403,
+      message: 'Forbidden',
+    });
+  }
+
+  return {} as FastifyReply;
+};
+
+export const onlyAdminCanDoThisAction = async (req: FastifyRequest<AuthLoginRequest>, reply: FastifyReply): Promise<FastifyReply> => {
+  if (req.locals.user?.role !== 'admin' && req.locals.user?.role !== 'master') {
+    return reply.code(403).send({
+      statusCode: 403,
+      message: 'Forbidden',
+    });
+  }
+
+  return {} as FastifyReply;
+};
+
+export const onlySameUserOrAdminCanDoThisAction = async (req: FastifyRequest<AuthLoginRequest & AuthParamsRequest>, reply: FastifyReply): Promise<FastifyReply> => {
+  if (req.locals.user?.username !== req.params?.username && req.locals.user?.role !== 'admin' && req.locals.user?.role !== 'master') {
+    return reply.code(403).send({
+      statusCode: 403,
+      message: 'Forbidden',
+    });
+  }
+
+  return {} as FastifyReply;
+};
+
+export const sameUserCantDoThisAction = async (req: FastifyRequest<AuthLoginRequest & AuthParamsRequest>, reply: FastifyReply): Promise<FastifyReply> => {
+  if (req.params.username === req.locals.user?.username) {
+    return reply.code(403).send({
+      statusCode: 403,
+      message: 'Forbidden',
+    });
+  }
+
+  return {} as FastifyReply;
+};

package/src/api/middlewares/authValidation.middleware.ts

@@ -0,0 +1,160 @@
+import jwt from 'jsonwebtoken';
+import { createHmac } from 'node:crypto';
+import { container } from 'tsyringe';
+
+import { AuthService } from '../services/auth.service.js';
+import { UsersService } from '../services/users.service.js';
+import { REFRESH_TOKEN } from '../types/index.js';
+
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import type { ConfigService } from '../../services/config/index.js';
+import type { DBUser } from '../database/types.js';
+import type { AuthLoginRequest, AuthNewLoginRequest, JwtPayload, JwtRefreshPayload, JwtTokenDecoded, JwtTokenEncoded } from '../types/index.js';
+
+export const isPasswordAndUserMatch = async (req: FastifyRequest<AuthNewLoginRequest>, reply: FastifyReply): Promise<FastifyReply> => {
+  req.locals = {};
+
+  const service = new UsersService();
+  const user = service.findByName(req.body.username);
+
+  if (!user) {
+    return reply.code(403).send({
+      statusCode: 403,
+      message: 'Forbidden',
+    });
+  } else {
+    const passwordFields = user.password.split('$');
+    const salt = passwordFields[0];
+    const hash = createHmac('sha512', salt).update(req.body.password).digest('base64');
+
+    if (hash === passwordFields[1]) {
+      req.locals.user = {
+        _id: user._id,
+        avatar: user.avatar,
+        firstLogin: user.firstLogin,
+        singleSession: user.singleSession,
+        password: user.password,
+        preferences: user.preferences,
+        rememberMe: req.body.rememberMe,
+        role: user.role,
+        sessionTimer: user.sessionTimer,
+        username: user.username,
+      };
+
+      return {} as FastifyReply;
+    } else {
+      return reply.code(401).send({
+        statusCode: 401,
+        message: 'Invalid username or password',
+      });
+    }
+  }
+};
+
+export const validJWTNeeded = async (req: FastifyRequest<AuthLoginRequest>, reply: FastifyReply): Promise<FastifyReply> => {
+  const configService = container.resolve<ConfigService>('configService');
+  const authService = new AuthService();
+  const userService = new UsersService();
+
+  req.locals = {};
+
+  let user: DBUser | undefined;
+  let tokenEncoded: JwtTokenEncoded | undefined;
+
+  if (req.query.username && req.query.password) {
+    user = userService.findByName(req.query.username);
+
+    if (user) {
+      const passwordFields = user.password.split('$');
+      const salt = passwordFields[0];
+      const hash = createHmac('sha512', salt).update(req.query.password).digest('base64');
+
+      if (hash === passwordFields[1]) {
+        const payload: JwtPayload = {
+          _id: user._id,
+          // avatar: user.avatar,
+          username: user.username,
+          // role: user.role,
+          rememberMe: user.rememberMe,
+          // singleSession: user.singleSession,
+          // firstLogin: user.firstLogin,
+          sessionTimer: user.sessionTimer,
+        };
+
+        const payloadRefresh: JwtRefreshPayload = {
+          _id: user._id,
+        };
+
+        const access_token = jwt.sign(payload, configService.SECRETS.jwtAccessKey, {
+          expiresIn: user.rememberMe ? '100y' : user.sessionTimer,
+        });
+
+        const refresh_token = jwt.sign(payloadRefresh, configService.SECRETS.jwtRefreshKey, {
+          expiresIn: user.rememberMe ? '100y' : REFRESH_TOKEN.EXPIRES_IN,
+        });
+
+        tokenEncoded = {
+          _id: user._id,
+          access_token: access_token,
+          refresh_token: refresh_token,
+          token_type: 'Bearer',
+          expires_in: user.rememberMe ? 100 * 365 * 24 * 60 * 60 : user.sessionTimer,
+          expires_at: user.rememberMe ? new Date((Date.now() / 1000 + 100 * 365 * 24 * 60 * 60) * 1000) : new Date((Date.now() / 1000 + user.sessionTimer) * 1000),
+        };
+
+        req.headers.authorization = `Bearer ${access_token}`;
+      }
+    }
+  }
+
+  if (req.headers.authorization || req.query.token) {
+    try {
+      const authHeader = req.headers.authorization ?? `Bearer ${req.query.token}`;
+      const authorization = authHeader.split(/\s+/);
+
+      if (authorization[0] !== 'Bearer') {
+        return reply.code(401).send({
+          statusCode: 401,
+          message: 'Unauthorized',
+        });
+      } else {
+        // check if token exists in database and is still valid
+        const token = tokenEncoded ?? authService.findByToken(authorization[1]);
+        const tokenValid = authService.checkToken(token?.access_token ?? '');
+
+        if (!token || !tokenValid) {
+          return reply.code(401).send({
+            statusCode: 401,
+            message: !token ? 'Unauthorized' : 'Token expired',
+          });
+        }
+
+        const user = userService.findById(token._id);
+
+        if (!user) {
+          return reply.code(403).send({
+            statusCode: 403,
+            message: 'User is not in database!',
+          });
+        }
+
+        req.locals = {
+          user,
+          jwt: jwt.verify(token.access_token, configService.SECRETS.jwtAccessKey) as JwtTokenDecoded,
+        };
+
+        return {} as FastifyReply;
+      }
+    } catch (error: any) {
+      return reply.code(401).send({
+        statusCode: 401,
+        message: error,
+      });
+    }
+  } else {
+    return reply.code(401).send({
+      statusCode: 401,
+      message: 'Unauthorized',
+    });
+  }
+};