@camera.ui/server 0.0.49 → 0.0.50-internal.0

package/src/api/middlewares/pagination.middleware.ts

@@ -0,0 +1,67 @@
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import type { AuthLoginRequest, Pagination, PaginationQuery, PaginationRequest, PaginationResponse } from '../types/index.js';
+
+const PAGINATION_DEFAULTS = {
+  START: 0,
+  PAGE: 1,
+  PAGE_SIZE: -1,
+};
+
+const validateQuery = (query: Required<PaginationQuery>, totalItems: number) => {
+  return {
+    start: Math.max(0, Math.min(query.start, totalItems - 1)),
+    page: Math.max(1, query.page),
+    pageSize: query.pageSize === -1 ? -1 : Math.max(1, query.pageSize),
+  };
+};
+
+export const pages = async (req: FastifyRequest<AuthLoginRequest & PaginationRequest>, reply: FastifyReply, payload: any): Promise<PaginationResponse | void> => {
+  if (reply.statusCode >= 400) {
+    return;
+  }
+
+  const items = payload ?? [];
+  const rawQuery = {
+    start: req.query.start ?? PAGINATION_DEFAULTS.START,
+    page: req.query.page ?? PAGINATION_DEFAULTS.PAGE,
+    pageSize: req.query.pageSize ?? PAGINATION_DEFAULTS.PAGE_SIZE,
+  };
+
+  const query = validateQuery(rawQuery, items.length);
+
+  if (query.pageSize === -1) {
+    return {
+      pagination: {
+        currentPage: 1,
+        pageSize: -1,
+        totalPages: 1,
+        startIndex: query.start,
+        endIndex: items.length - 1,
+        totalItems: items.length,
+      },
+      result: items.slice(query.start),
+    };
+  }
+
+  const totalItems = items.length;
+  const totalPages = Math.ceil(totalItems / query.pageSize);
+  const currentPage = query.start !== PAGINATION_DEFAULTS.START ? Math.ceil((query.start + 1) / query.pageSize) : Math.min(query.page, totalPages);
+  const startIndex = query.start !== PAGINATION_DEFAULTS.START ? query.start : (currentPage - 1) * query.pageSize;
+  const endIndex = Math.min(startIndex + query.pageSize - 1, totalItems - 1);
+
+  const pagination: Pagination = {
+    currentPage,
+    pageSize: query.pageSize,
+    totalPages,
+    startIndex,
+    endIndex,
+    totalItems,
+    nextPageQuery: currentPage < totalPages ? `?page=${currentPage + 1}&start=${startIndex + query.pageSize}` : null,
+    prevPageQuery: currentPage > 1 ? `?page=${currentPage - 1}&start=${Math.max(0, startIndex - query.pageSize)}` : null,
+  };
+
+  return {
+    pagination,
+    result: items.slice(startIndex, endIndex + 1),
+  };
+};

package/src/api/middlewares/socketAuth.middleware.ts

@@ -0,0 +1,136 @@
+// https://github.com/Thream/socketio-jwt
+import type { Algorithm } from 'jsonwebtoken';
+import jwt from 'jsonwebtoken';
+
+import type { Socket } from 'socket.io';
+
+export class UnauthorizedError extends Error {
+  inner: { message: string };
+  data: { message: string; code: string; type: 'UnauthorizedError' };
+
+  constructor(code: string, error: { message: string }) {
+    super(error.message);
+
+    this.name = 'UnauthorizedError';
+    this.inner = error;
+    this.data = {
+      message: this.message,
+      code,
+      type: 'UnauthorizedError',
+    };
+
+    Object.setPrototypeOf(this, UnauthorizedError.prototype);
+  }
+}
+
+export const isUnauthorizedError = (error: unknown): error is UnauthorizedError => {
+  return (
+    typeof error === 'object' &&
+    error != null &&
+    'data' in error &&
+    typeof error.data === 'object' &&
+    error.data != null &&
+    'type' in error.data &&
+    error.data.type === 'UnauthorizedError'
+  );
+};
+
+declare module 'socket.io' {
+  interface Socket extends ExtendedSocket {}
+}
+
+interface ExtendedSocket {
+  encodedToken?: string;
+  decodedToken?: any;
+  user?: any;
+}
+
+type SocketIOMiddleware = (socket: Socket, next: (error?: UnauthorizedError) => void) => void;
+
+interface CompleteDecodedToken {
+  header: {
+    alg: Algorithm;
+    [key: string]: any;
+  };
+  payload: any;
+}
+
+type SecretCallback = (decodedToken: CompleteDecodedToken) => Promise<string> | string;
+
+export interface AuthorizeOptions {
+  secret: string | SecretCallback;
+  algorithms?: Algorithm[];
+  onAuthentication?: (decodedToken: any) => Promise<any>;
+}
+
+export const authorize = (options: AuthorizeOptions): SocketIOMiddleware => {
+  const { secret, algorithms = ['HS256'], onAuthentication } = options;
+
+  return async (socket, next) => {
+    let encodedToken: string | null = null;
+    let token: string | null = null;
+
+    if (socket.handshake.auth) {
+      token = socket.handshake.auth.token;
+    } else {
+      token = socket.handshake.headers.authorization ?? null;
+    }
+
+    if (token != null) {
+      const tokenSplitted = token.split(' ');
+
+      if (tokenSplitted.length !== 2 || tokenSplitted[0] !== 'Bearer') {
+        return next(
+          new UnauthorizedError('credentials_bad_format', {
+            message: 'Format is Authorization: Bearer [token]',
+          }),
+        );
+      }
+
+      encodedToken = tokenSplitted[1];
+    }
+
+    if (encodedToken == null) {
+      return next(
+        new UnauthorizedError('credentials_required', {
+          message: 'no token provided',
+        }),
+      );
+    }
+
+    socket.encodedToken = encodedToken;
+
+    let keySecret: string | null = null;
+    let decodedToken: any = null;
+
+    if (typeof secret === 'string') {
+      keySecret = secret;
+    } else {
+      const completeDecodedToken = jwt.decode(encodedToken, { complete: true });
+
+      keySecret = await secret(completeDecodedToken as CompleteDecodedToken);
+    }
+
+    try {
+      decodedToken = jwt.verify(encodedToken, keySecret, { algorithms });
+    } catch {
+      return next(
+        new UnauthorizedError('invalid_token', {
+          message: 'Unauthorized: Token is missing or invalid Bearer',
+        }),
+      );
+    }
+
+    socket.decodedToken = decodedToken;
+
+    if (onAuthentication != null) {
+      try {
+        socket.user = await onAuthentication(decodedToken);
+      } catch (error: any) {
+        return next(error);
+      }
+    }
+
+    return next();
+  };
+};

package/src/api/plugins/header.plugin.ts

@@ -0,0 +1,15 @@
+import fp from 'fastify-plugin';
+
+import type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, HookHandlerDoneFunction } from 'fastify';
+
+export const HeaderPlugin: FastifyPluginAsync = fp(async (app: FastifyInstance) => {
+  app.addHook('onRequest', (req: FastifyRequest, reply: FastifyReply, done: HookHandlerDoneFunction) => {
+    reply.headers({
+      'Cache-Control': 'no-store, max-age=0, must-revalidate',
+      Expires: '0',
+      Pragma: 'no-cache',
+      'Surrogate-Control': 'no-store',
+    });
+    done();
+  });
+});

package/src/api/plugins/logger.plugin.ts

@@ -0,0 +1,44 @@
+import ac from 'ansicolor';
+import fp from 'fastify-plugin';
+import { container } from 'tsyringe';
+
+import type { FastifyInstance, FastifyPluginAsync } from 'fastify';
+import type { LoggerService } from '../../services/logger/index.js';
+
+declare module 'fastify' {
+  interface FastifyReply {
+    startTime: number;
+  }
+}
+
+export const LoggerPlugin: FastifyPluginAsync = fp(async (app: FastifyInstance) => {
+  const logger = container.resolve<LoggerService>('logger');
+
+  app.addHook('onRequest', (req, reply, done) => {
+    reply.startTime = Date.now();
+    done();
+  });
+
+  app.addHook('onResponse', (req, reply, done) => {
+    const color =
+      reply.statusCode >= 500
+        ? 'lightRed'
+        : reply.statusCode >= 400
+          ? 'lightYellow'
+          : reply.statusCode >= 300
+            ? 'lightCyan'
+            : reply.statusCode >= 200
+              ? 'lightGreen'
+              : 'darkGray';
+
+    const method = ac.blue(req.method);
+    const url = ac.darkGray(req.url);
+    const status = ac[color](reply.statusCode);
+    const durationMs = ac.darkGray(`${Date.now() - reply.startTime}ms`);
+    const contentLength = ac.darkGray((reply.getHeader('content-length') ?? '').toString());
+
+    logger.trace(`${method} ${url} ${status} ${durationMs} - ${contentLength}`);
+
+    done();
+  });
+});

package/src/api/plugins/proxy.plugin.ts

@@ -0,0 +1,255 @@
+import fp from 'fastify-plugin';
+import { container } from 'tsyringe';
+import { WebSocket, WebSocketServer } from 'ws';
+
+import { AuthService } from '../services/auth.service.js';
+
+import type { FastifyInstance, FastifyPluginAsync, HookHandlerDoneFunction } from 'fastify';
+import type { IncomingMessage } from 'http';
+import type { Duplex } from 'node:stream';
+import type { ClientOptions, RawData } from 'ws';
+import type { ProxyServer } from '../../rpc/index.js';
+import type { ConfigService } from '../../services/config/index.js';
+import type { Database } from '../database/index.js';
+import type { JwtTokenEncoded } from '../types/index.js';
+
+export interface ProxyTLSOptions {
+  cert: string | Buffer;
+  key: string | Buffer;
+  ca: string | Buffer;
+  rejectUnauthorized?: boolean;
+}
+
+export interface ProxyOptions {
+  upstream: string;
+  prefix: string;
+  target: 'nats' | 'go2rtc';
+  tls?: ProxyTLSOptions;
+}
+
+function isValidCloseCode(code: number): boolean {
+  return (code >= 1000 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006) || (code >= 3000 && code <= 4999);
+}
+
+class WebSocketProxy {
+  private wss: WebSocketServer;
+  private upstream: string;
+  private prefix: string;
+  private target: 'nats' | 'go2rtc';
+  private tlsConfig?: ProxyTLSOptions;
+  private dbs: Database;
+  private proxy: ProxyServer;
+  private configService: ConfigService;
+
+  constructor(fastify: FastifyInstance, options: ProxyOptions) {
+    this.dbs = container.resolve<Database>('dbs');
+    this.proxy = container.resolve<ProxyServer>('proxy');
+    this.configService = container.resolve<ConfigService>('configService');
+
+    this.upstream = options.upstream;
+    this.prefix = options.prefix;
+    this.target = options.target;
+
+    if (options.tls) {
+      this.tlsConfig = {
+        cert: options.tls.cert,
+        key: options.tls.key,
+        ca: options.tls.ca,
+        rejectUnauthorized: options.tls.rejectUnauthorized ?? true,
+      };
+    }
+
+    this.wss = new WebSocketServer({
+      noServer: true,
+      perMessageDeflate: false,
+      maxPayload: 100 * 1024 * 1024, // 100MB
+    });
+
+    fastify.server.on('upgrade', (request, socket, head) => {
+      const pathname = new URL(request.url!, `http://${request.headers.host}`).pathname;
+      if (pathname.startsWith(this.prefix)) {
+        this.handleUpgrade(request, socket, head);
+      }
+    });
+  }
+
+  public close(): void {
+    this.wss.removeAllListeners();
+    this.wss.close();
+  }
+
+  private async handleUpgrade(request: IncomingMessage, socket: Duplex, head: Buffer): Promise<void> {
+    try {
+      const authService = new AuthService();
+      const url = new URL(request.url!, `http://${request.headers.host}`);
+      const token = url.searchParams.get('token') ?? '';
+      const tokenValid = authService.checkToken(token);
+
+      if (!tokenValid) {
+        socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+        socket.destroy();
+        return;
+      }
+
+      let targetUrl = this.upstream;
+      if (this.target === 'go2rtc') {
+        const source = url.searchParams.get('src') ?? '';
+        targetUrl += `?src=${source}`;
+      }
+
+      const wsOptions: ClientOptions = {
+        perMessageDeflate: false,
+        maxPayload: 100 * 1024 * 1024,
+        headers: {
+          ...Object.fromEntries(Object.entries(request.headers).filter(([, value]) => typeof value === 'string')),
+          host: new URL(this.upstream).host,
+        },
+        ca: this.tlsConfig?.ca,
+        cert: this.tlsConfig?.cert,
+        key: this.tlsConfig?.key,
+        rejectUnauthorized: this.tlsConfig?.rejectUnauthorized,
+      };
+
+      // Connect to the server
+      const serverWs = new WebSocket(targetUrl, wsOptions);
+
+      // Wait for the connection to be established
+      await new Promise<void>((resolve, reject) => {
+        serverWs.once('open', () => resolve());
+        serverWs.once('error', reject);
+      });
+
+      // Upgrade the connection
+      this.wss.handleUpgrade(request, socket, head, (clientWs) => {
+        this.proxyWebSockets(clientWs, serverWs);
+      });
+    } catch (error) {
+      socket.write('HTTP/1.1 500 Internal Server Error\r\n\r\n');
+      socket.destroy(error);
+    }
+  }
+
+  private proxyWebSockets(client: WebSocket, server: WebSocket): void {
+    let connectHandled = false;
+
+    // Client -> Server
+    client.on('message', (data, isBinary) => {
+      if (server.readyState === WebSocket.OPEN) {
+        if (!connectHandled && this.target === 'nats') {
+          try {
+            const messageStr = this.extractMessage(data);
+            if (messageStr.startsWith('CONNECT ')) {
+              const jsonStr = messageStr.slice(8);
+              const connectData = JSON.parse(jsonStr);
+
+              connectData.user = this.proxy.auth.server.user;
+              connectData.pass = this.proxy.auth.server.password;
+              connectData.tls = {
+                cert: this.configService.ssl.cert,
+                key: this.configService.ssl.key,
+                ca: this.configService.ssl.ca,
+              };
+
+              server.send(Buffer.from(`CONNECT${JSON.stringify(connectData)}\r\n`), { binary: isBinary });
+              connectHandled = true;
+              return;
+            }
+          } catch (err) {
+            console.error('Error handling CONNECT message:', err);
+          }
+          connectHandled = true;
+        }
+
+        server.send(data, { binary: isBinary });
+      }
+    });
+
+    client.on('ping', (data) => {
+      if (server.readyState === WebSocket.OPEN) {
+        server.ping(data);
+      }
+    });
+
+    client.on('pong', (data) => {
+      if (server.readyState === WebSocket.OPEN) {
+        server.pong(data);
+      }
+    });
+
+    client.on('close', (code, reason) => {
+      if (server.readyState === WebSocket.OPEN) {
+        const safeCode = isValidCloseCode(code) ? code : 1000;
+        server.close(safeCode, reason);
+      }
+    });
+
+    client.on('error', (error) => {
+      if (server.readyState === WebSocket.OPEN) {
+        server.close(1011, `Client error: ${error.message}`);
+      }
+    });
+
+    // Server -> Client
+    server.on('message', (data, isBinary) => {
+      if (client.readyState === WebSocket.OPEN) {
+        client.send(data, { binary: isBinary });
+      }
+    });
+
+    server.on('ping', (data) => {
+      if (client.readyState === WebSocket.OPEN) {
+        client.ping(data);
+      }
+    });
+
+    server.on('pong', (data) => {
+      if (client.readyState === WebSocket.OPEN) {
+        client.pong(data);
+      }
+    });
+
+    server.on('close', (code, reason) => {
+      if (client.readyState === WebSocket.OPEN) {
+        const safeCode = isValidCloseCode(code) ? code : 1000;
+        client.close(safeCode, reason);
+      }
+    });
+
+    server.on('error', (error) => {
+      if (client.readyState === WebSocket.OPEN) {
+        client.close(1011, `Server error: ${error.message}`);
+      }
+    });
+  }
+
+  private extractMessage(data: RawData): string {
+    if (Buffer.isBuffer(data)) {
+      return data.toString('utf-8');
+    }
+    if (Array.isArray(data)) {
+      return Buffer.concat(data).toString('utf-8');
+    }
+    if (data instanceof ArrayBuffer) {
+      return Buffer.from(data).toString('utf-8');
+    }
+    throw new Error('Unsupported data type');
+  }
+
+  private findByToken(access_token: string): JwtTokenEncoded | undefined {
+    const { tokens } = this.dbs.authDB.get('auth') ?? { tokens: [], clients: [] };
+    return tokens.find((jwtToken) => jwtToken.access_token === access_token);
+  }
+}
+
+export const ProxyPlugin: FastifyPluginAsync<ProxyOptions> = fp(async (app: FastifyInstance, options: ProxyOptions) => {
+  if (!options.upstream) {
+    throw new Error('upstream must be specified');
+  }
+
+  const ws = new WebSocketProxy(app, options);
+
+  app.addHook('preClose', (done: HookHandlerDoneFunction) => {
+    ws.close();
+    done();
+  });
+});

package/src/api/plugins/socket.plugin.ts

@@ -0,0 +1,28 @@
+import fp from 'fastify-plugin';
+
+import { SocketService } from '../websocket/index.js';
+
+import type { FastifyInstance, FastifyPluginAsync, HookHandlerDoneFunction } from 'fastify';
+import type { Server, ServerOptions } from 'socket.io';
+
+declare module 'fastify' {
+  interface FastifyInstance {
+    io: Server;
+  }
+  interface FastifyRequest {
+    io: Server;
+  }
+}
+
+export const SocketIoPlugin: FastifyPluginAsync<Partial<ServerOptions>> = fp(async (app: FastifyInstance, opts: Partial<ServerOptions>) => {
+  const socketService = new SocketService(app, opts);
+
+  app.decorate('io', socketService.io);
+  app.decorateRequest('io', { getter: () => socketService.io });
+
+  app.addHook('preClose', (done: HookHandlerDoneFunction) => {
+    socketService.io.close();
+
+    done();
+  });
+});

package/src/api/plugins/system.plugin.ts

@@ -0,0 +1,48 @@
+import fp from 'fastify-plugin';
+import { container } from 'tsyringe';
+
+import type { FastifyInstance, FastifyPluginAsync } from 'fastify';
+import type { Go2Rtc } from '../../go2rtc/index.js';
+import type { CameraUi } from '../../main.js';
+
+declare module 'fastify' {
+  interface FastifyInstance {
+    system: System;
+  }
+  interface FastifyRequest {
+    system: System;
+  }
+}
+
+class System {
+  private app: FastifyInstance;
+
+  private cameraui: CameraUi;
+  private go2rtc: Go2Rtc;
+
+  constructor(app: FastifyInstance) {
+    this.app = app;
+
+    this.cameraui = container.resolve<CameraUi>('cameraui');
+    this.go2rtc = container.resolve<Go2Rtc>('go2rtc');
+  }
+
+  public close(): void {
+    process.kill(process.pid, 'SIGTERM');
+  }
+
+  public async restart(): Promise<void> {
+    await this.cameraui.restart();
+  }
+
+  public async restartGo2rtc(): Promise<void> {
+    await this.go2rtc.restart();
+  }
+}
+
+export const SystemPlugin: FastifyPluginAsync = fp(async (app: FastifyInstance) => {
+  const systemController = new System(app);
+
+  app.decorate('system', systemController);
+  app.decorateRequest('system', { getter: () => systemController });
+});

package/src/api/plugins/useragent.plugin.ts

@@ -0,0 +1,19 @@
+import useragent from 'express-useragent';
+import fp from 'fastify-plugin';
+
+import type { Details } from 'express-useragent';
+import type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, HookHandlerDoneFunction } from 'fastify';
+
+declare module 'fastify' {
+  interface FastifyRequest {
+    useragent?: Details;
+  }
+}
+
+export const UserAgentPlugin: FastifyPluginAsync = fp(async (app: FastifyInstance) => {
+  app.addHook('onRequest', (req: FastifyRequest, reply: FastifyReply, done: HookHandlerDoneFunction) => {
+    const source = req.headers['user-agent'];
+    req.useragent = source ? useragent.parse(source) : undefined;
+    done();
+  });
+});

package/src/api/routes/api.routes.ts

@@ -0,0 +1,10 @@
+import { ApiController } from '../controllers/api.controller.js';
+
+import type { FastifyInstance, FastifyPluginAsync } from 'fastify';
+
+export const ApiRoute: FastifyPluginAsync = async (app: FastifyInstance): Promise<void> => {
+  const apiController = new ApiController(app);
+
+  app.get('/', apiController.welcome.bind(apiController));
+  app.get('/health', apiController.health.bind(apiController));
+};

package/src/api/routes/auth.routes.ts

@@ -0,0 +1,56 @@
+import { AuthController } from '../controllers/auth.controller.js';
+import { onlyAdminCanDoThisAction } from '../middlewares/authPermission.middleware.js';
+import { isPasswordAndUserMatch, validJWTNeeded } from '../middlewares/authValidation.middleware.js';
+import { pages } from '../middlewares/pagination.middleware.js';
+import { loginUserSchema } from '../schemas/users.schema.js';
+
+import type { FastifyInstance, FastifyPluginAsync } from 'fastify';
+import type { ZodTypeProvider } from 'fastify-type-provider-zod';
+
+export const AuthRoute: FastifyPluginAsync = async (app: FastifyInstance): Promise<void> => {
+  const authController = new AuthController(app);
+
+  app.route({
+    url: '/check',
+    method: 'GET',
+    preValidation: [validJWTNeeded],
+    handler: authController.check.bind(authController),
+  });
+
+  app.route({
+    url: '/tokens',
+    method: 'GET',
+    preValidation: [validJWTNeeded, onlyAdminCanDoThisAction],
+    preSerialization: [pages],
+    handler: authController.list.bind(authController),
+  });
+
+  app.withTypeProvider<ZodTypeProvider>().route({
+    url: '/login',
+    method: 'POST',
+    preValidation: [isPasswordAndUserMatch],
+    handler: authController.login.bind(authController),
+    schema: {
+      body: loginUserSchema,
+    },
+  });
+
+  app.route({
+    url: '/logout',
+    method: 'POST',
+    handler: authController.logout.bind(authController),
+  });
+
+  app.route({
+    url: '/logout/:id',
+    method: 'POST',
+    preValidation: [validJWTNeeded, onlyAdminCanDoThisAction],
+    handler: authController.logoutByToken.bind(authController),
+  });
+
+  app.route({
+    url: '/refresh',
+    method: 'POST',
+    handler: authController.refresh.bind(authController),
+  });
+};