Add camera presets snapshots and continuous recording playback

test_app.py

@@ -59,6 +59,33 @@ class WebTests(unittest.TestCase):
             with self.subTest(path=path):
                 self.assertEqual(self.request(path, False)[0], 401)
 
+    def test_presets_api_enforces_control_and_management_roles(self):
+        camera = dict(id='f'*16, name='Preset test', siteId='preset-site', enabled=True)
+        app.save_object('sites', dict(id='preset-site', name='Preset site'))
+        app.save_object('cameras', camera)
+        viewer = app.ACCOUNTS.save(dict(username='preset-viewer', password='test-password', siteIds=['preset-site'], ptzControl=True), self.admin)
+        token = '2'*64
+        with app.LOCK:
+            app.DB.execute('INSERT INTO sessions VALUES (?,?,?)', (hashlib.sha256(token.encode()).hexdigest(), time.time()+3600, viewer['id']))
+            app.DB.commit()
+        path='/api/ptz/presets'
+        payload=dict(camera=camera['id'],action='goto',token='1',revision='v1')
+        with patch.object(app.ptz.CONTROLLER,'read_presets',return_value=({'items':[]},{})),patch.object(app.ptz.CONTROLLER,'preset_command',return_value={'ok':True}) as command:
+            self.assertEqual(self.request(path+'?camera='+camera['id'],False)[0],401)
+            code,_,body=self.request(path+'?camera='+camera['id'],token=token)
+            self.assertEqual(code,200);self.assertFalse(json.loads(body)['canManage'])
+            self.assertEqual(self.request(path,data=payload,token=token)[0],200)
+            for action in ['create','replace','remove']:
+                self.assertEqual(self.request(path,data=dict(payload,action=action),token=token)[0],403)
+            self.assertEqual(command.call_count,1)
+            self.assertEqual(self.request(path,data=dict(payload,action='create'))[0],200)
+            self.assertEqual(self.request(path,data=payload,origin='https://other.example')[0],403)
+        app.ACCOUNTS.save(dict(viewer,ptzControl=False),self.admin)
+        with app.LOCK:
+            app.DB.execute('INSERT INTO sessions VALUES (?,?,?)', (hashlib.sha256(token.encode()).hexdigest(), time.time()+3600, viewer['id']))
+            app.DB.commit()
+        self.assertEqual(self.request(path+'?camera='+camera['id'],token=token)[0],403)
+
     def test_static_security_headers(self):
         code, headers, _ = self.request('/', False)
         self.assertEqual(code, 200)
@@ -78,7 +105,7 @@ class WebTests(unittest.TestCase):
         self.assertEqual(headers['Cache-Control'], 'no-store')
         self.assertNotIn(b'__ASSET_VERSION__', body)
         assets = re.findall(r'(?:src|href)="(/[^"?]+\.(?:js|css)\?v=[^"]+)"', body.decode())
-        self.assertEqual(len(assets), 15)
+        self.assertEqual(len(assets), 18)
         version = (app.ROOT / 'VERSION').read_text().strip()
         for asset in assets:
             self.assertTrue(asset.endswith('?v=' + version))