@camera.ui/server 0.0.70 → 0.0.71-dev.0

package/dist/server/src/api/services/shares.service.d.ts

@@ -0,0 +1,46 @@
+import type { DBShare } from '../database/types.js';
+interface CreateShareParams {
+    cameraId: string;
+    sourceId: string;
+    createdBy: string;
+    ttlHours: number;
+    maxViewers: number;
+    label?: string;
+}
+interface ShareCreateResult {
+    token: string;
+    code: string;
+    link: string;
+    expiresAt: string;
+}
+type ShareListItem = DBShare & {
+    sourceName: string | null;
+};
+export declare class SharesService {
+    private dbs;
+    private configService;
+    private logger;
+    private authService;
+    private cloudApi;
+    private validateAttempts;
+    constructor();
+    create(params: CreateShareParams): Promise<ShareCreateResult>;
+    list(cameraId?: string): ShareListItem[];
+    revoke(token: string): Promise<boolean>;
+    getShare(token: string): DBShare | null;
+    validate(token: string, code: string): DBShare | null;
+    isValidateRateLimited(key: string): boolean;
+    recordValidateFailure(key: string): void;
+    clearValidateRateLimit(key: string): void;
+    generateShareJWT(share: DBShare): Promise<string>;
+    incrementViewers(token: string): Promise<void>;
+    decrementViewers(token: string): Promise<void>;
+    cleanup(): Promise<void>;
+    getStreamName(cameraId: string, sourceId: string): string | null;
+    private getSourceDisplayName;
+    private generateCode;
+    private registerWithCloud;
+    private deregisterFromCloud;
+    private sha256;
+}
+export {};

package/dist/server/src/api/services/shares.service.js

@@ -0,0 +1,233 @@
+import jwt from 'jsonwebtoken';
+import { createHash, randomBytes } from 'node:crypto';
+import { container } from 'tsyringe';
+import { SHARE_SERVICE_URL } from '../../services/config/constants.js';
+import { createSourceName } from '../../utils/camera.js';
+import { AuthService } from './auth.service.js';
+const VALIDATE_RL_WINDOW_MS = 60_000;
+const VALIDATE_RL_MAX = 10;
+export class SharesService {
+    dbs;
+    configService;
+    logger;
+    authService;
+    cloudApi;
+    validateAttempts = new Map();
+    constructor() {
+        this.dbs = container.resolve('dbs');
+        this.configService = container.resolve('configService');
+        this.logger = container.resolve('logger');
+        this.cloudApi = container.resolve('cloudApi');
+        this.authService = new AuthService();
+    }
+    async create(params) {
+        const camera = this.dbs.camerasDB.get(params.cameraId);
+        if (!camera) {
+            throw new Error('Camera not found');
+        }
+        const source = camera.sources?.find((s) => s._id === params.sourceId);
+        if (!source) {
+            throw new Error('Source not found for this camera');
+        }
+        if (source.role === 'snapshot') {
+            throw new Error('Snapshot sources cannot be shared');
+        }
+        const token = randomBytes(24).toString('base64url');
+        const code = this.generateCode();
+        const expiresAt = new Date(Date.now() + params.ttlHours * 60 * 60 * 1000).toISOString();
+        const share = {
+            _id: token,
+            code,
+            cameraId: params.cameraId,
+            sourceId: params.sourceId,
+            createdBy: params.createdBy,
+            createdAt: new Date().toISOString(),
+            expiresAt,
+            maxViewers: params.maxViewers,
+            currentViewers: 0,
+            totalViews: 0,
+            revoked: false,
+            label: params.label,
+        };
+        await this.registerWithCloud(token, expiresAt);
+        await this.dbs.sharesDB.put(token, share);
+        const link = `${SHARE_SERVICE_URL}/${token}`;
+        return { token, code, link, expiresAt };
+    }
+    list(cameraId) {
+        const now = new Date().toISOString();
+        const result = [];
+        for (const { value: s } of this.dbs.sharesDB.getRange()) {
+            if (s.revoked)
+                continue;
+            if (s.expiresAt < now)
+                continue;
+            if (cameraId && s.cameraId !== cameraId)
+                continue;
+            result.push({ ...s, code: '****', sourceName: this.getSourceDisplayName(s.cameraId, s.sourceId) });
+        }
+        return result;
+    }
+    async revoke(token) {
+        const share = this.dbs.sharesDB.get(token);
+        if (!share)
+            return false;
+        share.revoked = true;
+        await this.dbs.sharesDB.put(token, share);
+        // De-register from cloud
+        await this.deregisterFromCloud(token);
+        return true;
+    }
+    getShare(token) {
+        const share = this.dbs.sharesDB.get(token);
+        if (!share || share.revoked || new Date(share.expiresAt) < new Date())
+            return null;
+        return share;
+    }
+    validate(token, code) {
+        const share = this.getShare(token);
+        if (!share)
+            return null;
+        if (share.code !== code)
+            return null;
+        if (share.maxViewers > 0 && share.currentViewers >= share.maxViewers)
+            return null;
+        return share;
+    }
+    isValidateRateLimited(key) {
+        const entry = this.validateAttempts.get(key);
+        if (!entry)
+            return false;
+        if (Date.now() - entry.first > VALIDATE_RL_WINDOW_MS) {
+            this.validateAttempts.delete(key);
+            return false;
+        }
+        return entry.count >= VALIDATE_RL_MAX;
+    }
+    recordValidateFailure(key) {
+        const now = Date.now();
+        const entry = this.validateAttempts.get(key);
+        if (!entry || now - entry.first > VALIDATE_RL_WINDOW_MS) {
+            this.validateAttempts.set(key, { count: 1, first: now });
+            return;
+        }
+        entry.count++;
+    }
+    clearValidateRateLimit(key) {
+        this.validateAttempts.delete(key);
+    }
+    async generateShareJWT(share) {
+        const jwtKey = this.configService.SECRETS.jwtAccessKey;
+        const shareId = `share_${share._id}`;
+        const streamScope = this.getStreamName(share.cameraId, share.sourceId) ?? undefined;
+        const token = jwt.sign({
+            _id: shareId,
+            username: 'share_viewer',
+            shareToken: share._id,
+            cameraId: share.cameraId,
+            src: streamScope,
+        }, jwtKey, { expiresIn: '5m' });
+        await this.authService.invalidateById(shareId);
+        const now = Date.now();
+        await this.dbs.tokensDB.put(shareId, {
+            id: shareId,
+            user_id: shareId,
+            access_token: token,
+            refresh_token: '',
+            refresh_token_expires_at: 0,
+            persistent: false,
+            stream_scope: streamScope,
+            device: {
+                id: shareId,
+                name: 'Share viewer',
+                kind: 'web',
+                user_agent: '',
+                ip: '',
+                created_at: now,
+                last_seen_at: now,
+            },
+        });
+        return token;
+    }
+    async incrementViewers(token) {
+        const share = this.dbs.sharesDB.get(token);
+        if (!share)
+            return;
+        share.currentViewers++;
+        share.totalViews++;
+        await this.dbs.sharesDB.put(token, share);
+    }
+    async decrementViewers(token) {
+        const share = this.dbs.sharesDB.get(token);
+        if (share && share.currentViewers > 0) {
+            share.currentViewers--;
+            await this.dbs.sharesDB.put(token, share);
+        }
+        // Remove share JWT
+        await this.authService.invalidateById(`share_${token}`);
+    }
+    async cleanup() {
+        const now = new Date().toISOString();
+        const tasks = [];
+        for (const { key, value } of this.dbs.sharesDB.getRange()) {
+            if (value.revoked || value.expiresAt <= now) {
+                tasks.push(this.dbs.sharesDB.remove(key));
+            }
+        }
+        if (tasks.length)
+            await Promise.all(tasks);
+    }
+    getStreamName(cameraId, sourceId) {
+        const camera = this.dbs.camerasDB.get(cameraId);
+        if (!camera)
+            return null;
+        const source = camera.sources?.find((s) => s._id === sourceId);
+        if (!source)
+            return null;
+        return createSourceName(camera.name, source.name);
+    }
+    getSourceDisplayName(cameraId, sourceId) {
+        const camera = this.dbs.camerasDB.get(cameraId);
+        return camera?.sources?.find((s) => s._id === sourceId)?.name ?? null;
+    }
+    generateCode() {
+        const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+        let part1 = '';
+        let part2 = '';
+        const bytes = randomBytes(8);
+        for (let i = 0; i < 4; i++) {
+            part1 += chars[bytes[i] % chars.length];
+        }
+        for (let i = 4; i < 8; i++) {
+            part2 += chars[bytes[i] % chars.length];
+        }
+        return `${part1}-${part2}`;
+    }
+    async registerWithCloud(token, expiresAt) {
+        if (!(await this.cloudApi.credentialStore.peek())) {
+            throw new Error('Connect your server to the cloud under Settings → Remote before sharing a camera.');
+        }
+        try {
+            await this.cloudApi.serverRoute.registerShare({ token_hash: this.sha256(token), expires_at: expiresAt });
+        }
+        catch (error) {
+            this.logger.warn(`Failed to register share with cloud: ${error}`);
+            throw new Error('Could not register the share with the cloud. Reconnect your server under Settings → Remote, then try again.');
+        }
+    }
+    async deregisterFromCloud(token) {
+        if (!(await this.cloudApi.credentialStore.peek())) {
+            return;
+        }
+        try {
+            await this.cloudApi.serverRoute.deleteShare(this.sha256(token));
+        }
+        catch (error) {
+            this.logger.warn(`Failed to deregister share from cloud: ${error}`);
+        }
+    }
+    sha256(input) {
+        return createHash('sha256').update(input).digest('hex');
+    }
+}
+//# sourceMappingURL=shares.service.js.map

package/dist/server/src/api/services/shares.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shares.service.js","sourceRoot":"","sources":["../../../../../src/api/services/shares.service.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA0BhD,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,OAAO,aAAa;IAChB,GAAG,CAAW;IACd,aAAa,CAAgB;IAC7B,MAAM,CAAgB;IACtB,WAAW,CAAc;IACzB,QAAQ,CAAW;IAEnB,gBAAgB,GAAG,IAAI,GAAG,EAA4C,CAAC;IAE/E;QACE,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,OAAO,CAAW,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC,OAAO,CAAgB,eAAe,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,OAAO,CAAgB,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAW,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACvC,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,MAAyB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAExF,MAAM,KAAK,GAAY;YACrB,GAAG,EAAE,KAAK;YACV,IAAI;YACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,cAAc,EAAE,CAAC;YACjB,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;QAEF,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAE/C,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAE1C,MAAM,IAAI,GAAG,GAAG,iBAAiB,IAAI,KAAK,EAAE,CAAC;QAE7C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IAEM,IAAI,CAAC,QAAiB;QAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC,CAAC,OAAO;gBAAE,SAAS;YACxB,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG;gBAAE,SAAS;YAChC,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YAClD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAE1C,yBAAyB;QACzB,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,QAAQ,CAAC,KAAa;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,QAAQ,CAAC,KAAa,EAAE,IAAY;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,qBAAqB,CAAC,GAAW;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACrD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,IAAI,eAAe,CAAC;IACxC,CAAC;IAEM,qBAAqB,CAAC,GAAW;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAEM,sBAAsB,CAAC,GAAW;QACvC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,KAAc;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC;QACvD,MAAM,OAAO,GAAG,SAAS,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;QAEpF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CACpB;YACE,GAAG,EAAE,OAAO;YACZ,QAAQ,EAAE,cAAc;YACxB,UAAU,EAAE,KAAK,CAAC,GAAG;YACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,EAAE,WAAW;SACjB,EACD,MAAM,EACN,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;QAEF,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE;YACnC,EAAE,EAAE,OAAO;YACX,OAAO,EAAE,OAAO;YAChB,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,EAAE;YACjB,wBAAwB,EAAE,CAAC;YAC3B,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,WAAW;YACzB,MAAM,EAAE;gBACN,EAAE,EAAE,OAAO;gBACX,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,EAAE;gBACd,EAAE,EAAE,EAAE;gBACN,UAAU,EAAE,GAAG;gBACf,YAAY,EAAE,GAAG;aAClB;SACF,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,KAAa;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,CAAC,cAAc,EAAE,CAAC;QACvB,KAAK,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,KAAa;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,cAAc,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,mBAAmB;QACnB,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAuB,EAAE,CAAC;QAErC,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAEM,aAAa,CAAC,QAAgB,EAAE,QAAgB;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,OAAO,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAEO,oBAAoB,CAAC,QAAgB,EAAE,QAAgB;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,OAAO,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACxE,CAAC;IAEO,YAAY;QAClB,MAAM,KAAK,GAAG,kCAAkC,CAAC;QACjD,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,SAAiB;QAC9D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;QACjI,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/server/src/api/services/twoFactor.service.d.ts

@@ -0,0 +1,22 @@
+export declare class TwoFactorService {
+    private readonly ENCRYPTION_KEY;
+    private readonly APP_NAME;
+    private verifyAttempts;
+    private static readonly MAX_ATTEMPTS;
+    private static readonly LOCKOUT_DURATION_MS;
+    constructor();
+    generateSecret(): string;
+    generateQRCode(username: string, secret: string): Promise<string>;
+    verifyToken(token: string, secret: string): Promise<boolean>;
+    generateBackupCodes(count?: number): string[];
+    hashBackupCode(code: string): string;
+    verifyBackupCode(code: string, hashedCodes: string[]): number;
+    encryptSecret(secret: string): string;
+    decryptSecret(encryptedSecret: string): string;
+    checkRateLimit(userId: string): {
+        allowed: boolean;
+        remainingAttempts: number;
+    };
+    recordVerifyAttempt(userId: string): void;
+    resetVerifyAttempts(userId: string): void;
+}

package/dist/server/src/api/services/twoFactor.service.js

@@ -0,0 +1,81 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+import { generateSecret, generateURI, verify } from 'otplib';
+import QRCode from 'qrcode';
+import { container } from 'tsyringe';
+export class TwoFactorService {
+    ENCRYPTION_KEY;
+    APP_NAME = 'camera.ui';
+    verifyAttempts = new Map();
+    static MAX_ATTEMPTS = 5;
+    static LOCKOUT_DURATION_MS = 15 * 60 * 1000;
+    constructor() {
+        const configService = container.resolve('configService');
+        this.ENCRYPTION_KEY = Buffer.from(configService.SECRETS.twoFactorKey, 'hex');
+    }
+    generateSecret() {
+        return generateSecret();
+    }
+    async generateQRCode(username, secret) {
+        const otpauth = generateURI({
+            issuer: this.APP_NAME,
+            label: username,
+            secret,
+        });
+        return QRCode.toDataURL(otpauth);
+    }
+    async verifyToken(token, secret) {
+        const result = await verify({ token, secret });
+        return result.valid;
+    }
+    generateBackupCodes(count = 10) {
+        return Array.from({ length: count }, () => randomBytes(4).toString('hex').toUpperCase());
+    }
+    hashBackupCode(code) {
+        return createHash('sha256').update(code.toUpperCase()).digest('hex');
+    }
+    verifyBackupCode(code, hashedCodes) {
+        const hashedInput = this.hashBackupCode(code);
+        return hashedCodes.findIndex((hashed) => hashed === hashedInput);
+    }
+    encryptSecret(secret) {
+        const iv = randomBytes(16);
+        const cipher = createCipheriv('aes-256-gcm', this.ENCRYPTION_KEY, iv);
+        const encrypted = Buffer.concat([cipher.update(secret, 'utf8'), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        return Buffer.concat([iv, authTag, encrypted]).toString('base64');
+    }
+    decryptSecret(encryptedSecret) {
+        const data = Buffer.from(encryptedSecret, 'base64');
+        const iv = data.subarray(0, 16);
+        const authTag = data.subarray(16, 32);
+        const encrypted = data.subarray(32);
+        const decipher = createDecipheriv('aes-256-gcm', this.ENCRYPTION_KEY, iv);
+        decipher.setAuthTag(authTag);
+        return decipher.update(encrypted, undefined, 'utf8') + decipher.final('utf8');
+    }
+    checkRateLimit(userId) {
+        const attempts = this.verifyAttempts.get(userId);
+        if (attempts) {
+            const timeSinceLastAttempt = Date.now() - attempts.lastAttempt.getTime();
+            if (timeSinceLastAttempt > TwoFactorService.LOCKOUT_DURATION_MS) {
+                this.verifyAttempts.delete(userId);
+                return { allowed: true, remainingAttempts: TwoFactorService.MAX_ATTEMPTS };
+            }
+            if (attempts.count >= TwoFactorService.MAX_ATTEMPTS) {
+                return { allowed: false, remainingAttempts: 0 };
+            }
+            return { allowed: true, remainingAttempts: TwoFactorService.MAX_ATTEMPTS - attempts.count };
+        }
+        return { allowed: true, remainingAttempts: TwoFactorService.MAX_ATTEMPTS };
+    }
+    recordVerifyAttempt(userId) {
+        const attempts = this.verifyAttempts.get(userId) ?? { count: 0, lastAttempt: new Date() };
+        attempts.count++;
+        attempts.lastAttempt = new Date();
+        this.verifyAttempts.set(userId, attempts);
+    }
+    resetVerifyAttempts(userId) {
+        this.verifyAttempts.delete(userId);
+    }
+}
+//# sourceMappingURL=twoFactor.service.js.map

package/dist/server/src/api/services/twoFactor.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"twoFactor.service.js","sourceRoot":"","sources":["../../../../../src/api/services/twoFactor.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,MAAM,OAAO,gBAAgB;IACV,cAAc,CAAS;IACvB,QAAQ,GAAG,WAAW,CAAC;IAEhC,cAAc,GAAG,IAAI,GAAG,EAAgD,CAAC;IACzE,MAAM,CAAU,YAAY,GAAG,CAAC,CAAC;IACjC,MAAM,CAAU,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE7D;QACE,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAgB,eAAe,CAAC,CAAC;QACxE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IAEM,cAAc;QACnB,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,MAAc;QAC1D,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,QAAQ;YACrB,KAAK,EAAE,QAAQ;YACf,MAAM;SACP,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,MAAc;QACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAEM,mBAAmB,CAAC,KAAK,GAAG,EAAE;QACnC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3F,CAAC;IAEM,cAAc,CAAC,IAAY;QAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAEM,gBAAgB,CAAC,IAAY,EAAE,WAAqB;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;IACnE,CAAC;IAEM,aAAa,CAAC,MAAc;QACjC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAEM,aAAa,CAAC,eAAuB;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC1E,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IAEM,cAAc,CAAC,MAAc;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzE,IAAI,oBAAoB,GAAG,gBAAgB,CAAC,mBAAmB,EAAE,CAAC;gBAChE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,YAAY,EAAE,CAAC;YAC7E,CAAC;YACD,IAAI,QAAQ,CAAC,KAAK,IAAI,gBAAgB,CAAC,YAAY,EAAE,CAAC;gBACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YAClD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,YAAY,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC9F,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,YAAY,EAAE,CAAC;IAC7E,CAAC;IAEM,mBAAmB,CAAC,MAAc;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1F,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,QAAQ,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEM,mBAAmB,CAAC,MAAc;QACvC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC"}

package/dist/server/src/api/services/users.service.d.ts

@@ -1,4 +1,4 @@
-import type { DBCameraShortcut, DBCamviewLayout, DBUser } from '../database/types.js';
+import type { DBCamviewLayout, DBHiddenDevice, DBShortcut, DBUser } from '../database/types.js';
 export declare class UsersService {
     private dbs;
     private authService;
@@ -10,10 +10,10 @@ export declare class UsersService {
     patchUser(username: string, userData?: Partial<DBUser>): Promise<DBUser | undefined>;
     removeByName(username: string): Promise<void>;
     removeAll(): Promise<void>;
-    createShortcut(username: string, cameraId: string, shortcutData: DBCameraShortcut): Promise<DBCameraShortcut[] | undefined>;
-    patchShortcutById(username: string, cameraId: string, shortcutId: string, shortcutData?: Partial<DBCameraShortcut>): Promise<DBCameraShortcut[] | undefined>;
-    removeShortcutById(username: string, cameraId: string, shortcutId: string): Promise<DBCameraShortcut[] | undefined>;
-    removeAllShortcuts(username: string, cameraId: string): Promise<DBCameraShortcut[] | undefined>;
+    createShortcut(username: string, cameraId: string, shortcutData: DBShortcut): Promise<DBShortcut[] | undefined>;
+    patchShortcutById(username: string, cameraId: string, shortcutId: string, shortcutData?: Partial<DBShortcut>): Promise<DBShortcut[] | undefined>;
+    removeShortcutById(username: string, cameraId: string, shortcutId: string): Promise<DBShortcut[] | undefined>;
+    removeAllShortcuts(username: string, cameraId: string): Promise<DBShortcut[] | undefined>;
     createView(username: string, viewData: DBCamviewLayout): Promise<DBCamviewLayout>;
     patchViewById(username: string, viewid: string, viewData?: Partial<DBCamviewLayout>): Promise<DBCamviewLayout | undefined>;
     removeViewById(username: string, viewid: string): Promise<DBCamviewLayout[] | undefined>;
@@ -23,4 +23,8 @@ export declare class UsersService {
     removeCameraFromPreferences(cameraId: string): Promise<void>;
     removeCameraFromAllShortcuts(cameraId: string): Promise<void>;
     removeCameraFromAllViews(cameraId: string): Promise<void>;
+    getHiddenDevices(username: string): DBHiddenDevice[];
+    hideDevice(username: string, device: DBHiddenDevice): Promise<DBHiddenDevice[]>;
+    unhideDevice(username: string, deviceId: string): Promise<DBHiddenDevice[]>;
+    updateHiddenDevices(username: string, hiddenDevices: DBHiddenDevice[]): Promise<void>;
 }