feat: isolate households and add explicit ownership succession
This commit is contained in:
Codex
+18
-4
@@ -27,11 +27,11 @@
|
||||
|
||||
当前 RTSP 负责实时视频，ONVIF 负责读取设备身份、媒体配置、独立视频源及主子码流地址。不同品牌使用相同对象结构，路径和能力由设备返回值或对应驱动确定；不按品牌名字保证所有型号兼容。当前品牌驱动只提供路径模板，自动摄像头配置读取支持 ONVIF Media v1。
|
||||
|
||||
主码流用于清晰预览和可选本机录像。界面只显示主码流与子码流两个选项，默认主码流。子码流预览由每路子码流经 FFmpeg 转为 H.264 / AAC；MediaMTX 的 runOnDemand 仅在观看时启动受限分辨率的转码进程，发布权限限定为回环地址的兼容预览路径。高清兼容预览读取原始主码流，经 Intel VAAPI 完成解码、1080p 缩放和 H.264 编码，最高 15 帧/秒；无可用硬件时明确失败，不自动启动多路软件高清转换。原始编码直出不作为网页预览选项，原始主码流继续用于录像及转码输入。系统目前不修改摄像头或录像机设置，不自动导入不存在的通道，不把服务可达当成画面接通。
|
||||
主码流用于清晰预览和可选本机录像。界面只显示主码流与子码流两个选项，默认主码流。子码流预览由每路子码流经 FFmpeg 转为 H.264 / AAC；MediaMTX 的 runOnDemand 仅在观看时启动受限分辨率的转码进程，发布权限限定为回环地址的兼容预览路径。高清兼容预览读取原始主码流，经 Intel VAAPI 完成解码、1080p 缩放和 H.264 编码，最高 15 帧/秒；无可用硬件时明确失败，不自动启动多路软件高清转换。原始编码直出不作为网页预览选项，原始主码流继续用于录像及转码输入。摄像机参数与云台按设备开放的 ONVIF 能力设置，不自动导入不存在的通道，不把服务可达当成画面接通。
|
||||
|
||||
## 管理 API
|
||||
|
||||
所有数据接口（除会话状态与健康检查）需要管理员 Cookie 会话。写接口接受 JSON，检查同源请求。
|
||||
所有数据接口（除会话状态与健康检查）需要账号 Cookie 会话，并依据家庭、角色和空间核验访问权限。写接口接受 JSON，检查同源请求。
|
||||
|
||||
| 接口 | 用途 |
|
||||
| --- | --- |
|
||||
@@ -53,14 +53,14 @@
|
||||
|
||||
本阶段实现独立运行、空间建模、三类视觉对象、实时视频接入和本机可选录像。摄像头真实接入结果由部署记录和主机运行状态说明。
|
||||
|
||||
下一阶段可加入具体录像机的历史回放适配器；随后扩展其他设备类型和联动规则。PTZ、语音对讲、AI 检测目前没有实现，不作为已具备的能力展示。
|
||||
下一阶段可加入具体录像机的历史回放适配器；随后扩展其他设备类型和联动规则。PTZ 已支持方向控制、停止和预置位；语音对讲、AI 检测目前没有实现，不作为已具备的能力展示。
|
||||
|
||||
配置写入 SQLite 并生成运行时媒体配置，录像数据独立存储。当前为单机模式；升级前备份整个数据目录。凭据和录像不包含在公开源码中。
|
||||
|
||||
|
||||
## 身份与家谱
|
||||
|
||||
`identity.py` 管理账号、scrypt 密码散列、旧账户迁移、会话撤销和空间授权。`genealogy.py` 管理独立人物、亲子/配偶边和并发修订号。账号通过 `personId` 可选关联人物；祖先无需账号。家谱目前是同一部署的一份共享家庭档案，按账号授予 read/edit 权限。管理员与家庭成员的角色不由家谱辈分决定。
|
||||
`identity.py` 管理账号、scrypt 密码散列、旧账户迁移、会话撤销和空间授权。`genealogy.py` 管理独立人物、亲子/配偶边和并发修订号。账号通过 `personId` 可选关联人物；祖先无需账号。`households.py` 管理家庭归属、负责人、交接记录与请求范围。每个家庭有独立家谱与修订号，按账号另授予 read/edit 权限。管理员与家庭成员的角色不由家谱辈分决定。
|
||||
|
||||
| API | 权限 |
|
||||
| --- | --- |
|
||||
@@ -72,3 +72,17 @@
|
||||
| GET /media/live/*、/media/playback、/api/recordings | 登录并具备对应空间权限 |
|
||||
|
||||
人物与关系修订在同一数据库事务中保存；修改关系时迭代检查亲子图，拒绝循环。前端 `kinship.js` 通过最短关系路径提供阅读称呼，未知长幼与复杂旁系明确显示不确定性或关系链。家谱页面不启动摄像头播放；返回实时画面时重新建立所需流。
|
||||
|
||||
|
||||
## 家庭边界与管理连续性
|
||||
|
||||
账号 → 一个家庭 → 多个空间 → 设备对象 / 镜头 / 录像机。人物、亲属关系、记事和历史版本也属于一个家庭。
|
||||
|
||||
- `X-Household-Id` 仅供超级管理员选择工作家庭；其余账号只能使用自己的家庭。所有写操作均核验所属家庭与关联对象，不能通过 body 迁移归属。
|
||||
- API 状态与账号列表按家庭过滤。媒体 URL 不依赖前端过滤，每个清单、分片与下载请求均核验摄像头归属和空间授权；超级管理员是明确的特权例外。
|
||||
- 平台级扫描、存储策略、审计只允许超级管理员。重复接入已属于其他家庭的已知设备 IP 会被拒绝。
|
||||
- `/api/households` 供超级管理员创建、家庭管理员修改本家庭名称和备注。`/api/households/leadership` 仅允许当前家主或超级管理员办理家主及备用负责人安排。
|
||||
- 家主、备用负责人必须是本家庭已启用的家庭管理员且不能相同。备用负责人预先持有管理权限，意外发生不影响设备管理；身份交接需要有权限的账号明确操作、填写原因、检查修订号。
|
||||
- 任内负责人不能被直接停用、降级；先交接，再调整账号。交接后原家主保留家庭管理员，必要时由新家主或超级管理员处理其账号。
|
||||
- 家谱人物的去世日期、账号长期未登录、亲属称谓均不触发权限变化。
|
||||
- 首次迁移只回填 `familyId`，不修改凭据或设备路径；旧历史快照也加归属。旧版本没有此隔离能力，多家庭运行后禁止只回退代码。
|
||||
|
||||
@@ -53,7 +53,7 @@ python3 app.py
|
||||
mediamtx ./data/mediamtx.yml
|
||||
```
|
||||
|
||||
回归测试：`python3 -m unittest -v test_app test_ptz test_camera_settings test_ptz_presets` 和 `node --test test_live_player.js test_kinship.js test_calendar.js test_family_graph.js test_ui_logic.js test_recording_tools.js test_theme.js`。测试使用临时数据库和模拟播放器，不连接真实设备。
|
||||
回归测试：`python3 -m unittest -v test_app test_ptz test_camera_settings test_ptz_presets test_households` 和 `node --test test_live_player.js test_kinship.js test_calendar.js test_family_graph.js test_ui_logic.js test_recording_tools.js test_theme.js test_households_ui.js`。测试使用临时数据库和模拟播放器，不连接真实设备。
|
||||
|
||||
访问 `http://127.0.0.1:8790/`。后端配置变量：`VISION_BIND`、`VISION_PORT`、`VISION_DATA`、`VISION_RECORDINGS`；高清转码可用 `VISION_VAAPI_DEVICE` 指定渲染设备（默认 `/dev/dri/renderD128`）。HTTPS 反向代理场景可设 `VISION_SECURE_COOKIE=1`。当前管理 API 使用管理员与个人账号分权。
|
||||
|
||||
@@ -76,10 +76,10 @@ mediamtx ./data/mediamtx.yml
|
||||
|
||||
## 账号与家谱（v0.1.11）
|
||||
|
||||
- 管理员维护设备、空间、账号和权限。个人账号只可观看授权空间内的实时画面与本机回放，设备配置、网络发现和审计接口仅管理员可用。媒体播放请求逐次检查空间权限。
|
||||
- 管理员维护设备、空间、账号和权限。个人账号只可观看授权空间内的实时画面与本机回放，设备配置归属本家庭管理员；网络发现、全局存储与审计仅超级管理员可用。媒体播放请求逐次检查空间权限。
|
||||
- 每个账号具有独立用户名和密码，密码使用 scrypt 散列存储；更新密码、角色、空间范围、家谱权限或停用状态会撤销该账号会话。亲属关系不自动授予权限。
|
||||
- 管理员在“账号与关系”中设置显示名称、相对于哪个账号的称呼，以及关联的家谱人物。支持常用称呼与自定义称呼。默认新个人账号没有空间或家谱权限。
|
||||
- 家谱是本部署内的一份家庭档案，具有独立的不可访问、查看、编辑权限。一个编辑账号可录入任意数量的祖先、亲属与后辈，无需为每位人物开户。未实现跨家庭租户隔离。
|
||||
- 家谱是各家庭独立的家庭档案，具有独立的不可访问、查看、编辑权限。一个编辑账号可录入任意数量的祖先、亲属与后辈，无需为每位人物开户。v0.1.23 起按家庭隔离人物、记事、历史版本与导出。
|
||||
- 人物记录姓名/称呼、别名、性别、生卒日期、在世情况、籍贯、生平和信息来源。日期可按公历或农历录入，并自动换算；不确定日期可留空，在备注中保留原记载。
|
||||
- 亲子关系按“父母一方 → 子女”逐条连接，支持亲生、收养、继亲和未注明；配偶关系为双向。禁止自我关系、重复关系、祖先循环、直系祖先与配偶冲突。关系可以停用后恢复，人物可归档后恢复。
|
||||
- 支持关系参照人物、搜索、全家关系图、人物名册和 JSON 导出。孙辈、曾孙辈、玄孙辈等直系辈分由路径推算；旁系复杂称谓显示明确路径，缺少出生日期时不猜测兄弟姐妹的长幼。称谓用于辅助阅读，以录入关系为准。
|
||||
@@ -183,3 +183,19 @@ JSON 导出升级为格式 version 2，包含人物、关系和当前账号有
|
||||
- 本版不创建新的家庭数据或修改已有账户和录像策略；新增界面及设备操作继续使用既有空间、管理与云台权限。录像机原有历史录像仍未适配，以上续播与片段工具用于小电脑本机录像。
|
||||
|
||||
预置位协议依据：[ONVIF PTZ Service 5.4](https://www.onvif.org/specs/srv/ptz/ONVIF-PTZ-Service-Spec.pdf)。自动回归包含权限、并发、版本冲突、设备拒绝或未确认写入、停止、回放空档、日期边界和退出账号后的异步响应清理；模拟设备测试不代表所有品牌均已实机验证。
|
||||
|
||||
|
||||
## 家庭隔离与权限交接（v0.1.23）
|
||||
|
||||
- **超级管理员**（`admin` 角色）：可建立家庭、切换家庭和管理全部资料；现有 `admin` 账号保持此角色。
|
||||
- **一家之主**：本家庭一位已启用的家庭管理员，由超级管理员首次指定。可管理本家庭设备、成员及其他家庭管理员，并办理家主交接。
|
||||
- **家庭管理员**：管理本家庭设备、空间、家谱与普通成员；有家主后，其他管理员账号的设置由家主或超级管理员办理。
|
||||
- **家庭成员**：仅能查看本家庭已授权空间的画面与录像；家谱、云台另行授权。新账号默认不获得设备和家谱权限。亲属称呼不授予权限。
|
||||
|
||||
在「家庭管理」新建家庭，进入该家庭，在「账号与关系」建立家庭管理员。回到「家庭管理 → 家主与权限交接」，指定一家之主和另一位备用负责人，填写说明并保存。**备用负责人已经拥有本家庭管理权限**，家主意外无法操作时可以继续管理设备和成员；家主身份由原家主或超级管理员正式交接，原家主保留家庭管理员权限。不会依据去世日期或未登录时长自动授权。不允许停用或降级尚在任的家主、备用负责人；须先更换安排。至少保留一位启用的家庭管理员。交接使用修订号防止并发覆盖，并保留最近 50 条记录。普通成员不能读取交接说明。
|
||||
|
||||
家庭隔离由服务器执行：账号、空间、对象、镜头、录像机、家谱人物、关系、事件与历史版本均有家庭归属。HLS 播放清单、分片、回放、下载及设备控制均逐请求核验；修改请求检查每个关联对象的家庭。普通账号伪造家庭请求头或猜测其他家庭的对象编号也不能获得资料。超级管理员具有跨家庭权限。家庭切换先清除播放器、表单和旧请求；各家庭独立计算家谱修订号。
|
||||
|
||||
升级前用 SQLite backup API 备份数据库。首次启动把旧数据归入「赵府」家庭，保留原 ID、密码散列、设备连接和会话；家主与备用负责人须在界面明确指定，不从姓名或辈分猜测。已有 `admin` 角色均保留超级权限，请按实际职责设为家庭管理员。**建立第二个家庭后，不能直接回退到 v0.1.22 或更早版本**，旧版本不执行家庭隔离；应修复前进，或连同升级前数据库及部署版本一起恢复并确保后续数据另有备份。
|
||||
|
||||
这是单台受信主机上的应用权限隔离。各家庭的设备仍共享媒体服务和存储容量，家庭管理员不具有操作系统权限；尚未提供按家庭磁盘配额、独立网络、硬盘加密或无人审批的自动继承。
|
||||
|
||||
@@ -31,6 +31,7 @@ import onvif
|
||||
import playback
|
||||
import identity
|
||||
import genealogy
|
||||
import households
|
||||
import ptz
|
||||
|
||||
ROOT = Path(__file__).resolve().parent
|
||||
@@ -73,6 +74,7 @@ class Problem(Exception):
|
||||
|
||||
ACCOUNTS = identity.Accounts(sys.modules[__name__])
|
||||
FAMILY = genealogy.Family(sys.modules[__name__])
|
||||
HOUSEHOLDS = households.Households(sys.modules[__name__])
|
||||
|
||||
|
||||
def setting(key, default=None):
|
||||
@@ -144,9 +146,9 @@ SITE_FIELDS = ('name', 'province', 'city', 'district', 'street', 'community', 'o
|
||||
|
||||
def serialized_save(function):
|
||||
@functools.wraps(function)
|
||||
def save(body):
|
||||
def save(body, *args, **kwargs):
|
||||
with LOCK:
|
||||
return function(body)
|
||||
return function(body, *args, **kwargs)
|
||||
return save
|
||||
|
||||
|
||||
@@ -162,11 +164,12 @@ def object_key(table, body):
|
||||
|
||||
|
||||
@serialized_save
|
||||
def save_site(body):
|
||||
def save_site(body, actor=None):
|
||||
family = HOUSEHOLDS.prepare(actor, 'sites', body)
|
||||
key = object_key('sites', body)
|
||||
item = {k: clean_text(body.get(k, ''), 240 if k in ('address', 'note') else 100,
|
||||
required=k == 'name') for k in SITE_FIELDS}
|
||||
item.update(id=key, kind=body.get('kind', 'home'))
|
||||
item.update(id=key, kind=body.get('kind', 'home'), familyId=family)
|
||||
if item['kind'] not in ('home', 'company', 'other'):
|
||||
raise Problem('请选择家庭、公司或其他用途')
|
||||
save_object('sites', item)
|
||||
@@ -175,7 +178,8 @@ def save_site(body):
|
||||
|
||||
|
||||
@serialized_save
|
||||
def save_camera(body):
|
||||
def save_camera(body, actor=None):
|
||||
family = HOUSEHOLDS.prepare(actor, 'cameras', body, (('assets', 'assetId'), ('recorders', 'recorderId'), ('recorders', 'archiveRecorderId')))
|
||||
key = object_key('cameras', body)
|
||||
old = get_object('cameras', key) or {}
|
||||
item = {k: clean_text(body.get(k, ''), 120, required=k == 'name')
|
||||
@@ -201,7 +205,8 @@ def save_camera(body):
|
||||
raise Problem('关联的录像存储设备不存在')
|
||||
item['archiveRecorderId'] = archive_recorder
|
||||
item.update(id=key, siteId=site, host=host_address(recorder['host'] if recorder else body.get('host', '')),
|
||||
port=integer(recorder['port'] if recorder else body.get('port', 554), 1, 65535))
|
||||
port=integer(recorder['port'] if recorder else body.get('port', 554), 1, 65535), familyId=family)
|
||||
HOUSEHOLDS.endpoint(actor, item['host'])
|
||||
for k, default in [('mainPath', '/stream1'), ('subPath', '/stream2')]:
|
||||
path = clean_text(body.get(k, default), 500, required=True)
|
||||
if not path.startswith('/') or path.startswith('//') or '#' in path:
|
||||
@@ -224,14 +229,15 @@ def save_camera(body):
|
||||
|
||||
|
||||
@serialized_save
|
||||
def save_asset(body):
|
||||
def save_asset(body, actor=None):
|
||||
family = HOUSEHOLDS.prepare(actor, 'assets', body, (('sites', 'siteId'),))
|
||||
key = object_key('assets', body)
|
||||
site = body.get('siteId')
|
||||
if not get_object('sites', site):
|
||||
raise Problem('请选择所属空间')
|
||||
item = {k: clean_text(body.get(k, ''), 120, required=k == 'name')
|
||||
for k in ('name', 'brand', 'model', 'serial', 'point', 'note')}
|
||||
item.update(id=key, siteId=site, lensCount=integer(body.get('lensCount', 2), 1, 16))
|
||||
item.update(id=key, siteId=site, lensCount=integer(body.get('lensCount', 2), 1, 16), familyId=family)
|
||||
attached = [c for c in objects('cameras') if c.get('assetId') == key]
|
||||
if len(attached) > item['lensCount']:
|
||||
raise Problem('镜头数不能小于已经建立的通道数')
|
||||
@@ -245,7 +251,8 @@ def save_asset(body):
|
||||
|
||||
|
||||
@serialized_save
|
||||
def save_recorder(body):
|
||||
def save_recorder(body, actor=None):
|
||||
family = HOUSEHOLDS.prepare(actor, 'recorders', body, (('sites', 'siteId'),))
|
||||
key = object_key('recorders', body)
|
||||
old = get_object('recorders', key) or {}
|
||||
item = {k: clean_text(body.get(k, ''), 120, required=k == 'name')
|
||||
@@ -254,7 +261,8 @@ def save_recorder(body):
|
||||
if not get_object('sites', site):
|
||||
raise Problem('请选择录像机所属空间')
|
||||
item.update(id=key, siteId=site, host=host_address(body.get('host', '')),
|
||||
port=integer(body.get('port', 554), 1, 65535), driver=body.get('driver', 'generic-rtsp'))
|
||||
port=integer(body.get('port', 554), 1, 65535), driver=body.get('driver', 'generic-rtsp'), familyId=family)
|
||||
HOUSEHOLDS.endpoint(actor, item['host'])
|
||||
if item['driver'] not in ('generic-rtsp', 'hikvision-rtsp', 'tplink-rtsp', 'dahua-rtsp'):
|
||||
raise Problem('接入驱动不正确')
|
||||
password = body.get('password', '')
|
||||
@@ -514,6 +522,11 @@ class Handler(BaseHTTPRequestHandler):
|
||||
self.user = self.authenticated()
|
||||
if not self.user:
|
||||
raise Problem('请先登录', 401)
|
||||
self.user = HOUSEHOLDS.context(self.user, self.headers.get('X-Household-Id'))
|
||||
|
||||
def require_manager(self):
|
||||
if not HOUSEHOLDS.manager(self.user):
|
||||
raise Problem('此操作需要家庭管理员权限', 403)
|
||||
|
||||
def require_admin(self):
|
||||
if self.user['role'] != 'admin':
|
||||
@@ -598,7 +611,7 @@ class Handler(BaseHTTPRequestHandler):
|
||||
self.require_auth()
|
||||
if path not in ('/api/logout', '/api/account/password', '/api/family/restore',
|
||||
'/api/family/person', '/api/family/link', '/api/family/event', '/api/ptz', '/api/ptz/presets'):
|
||||
self.require_admin()
|
||||
self.require_manager()
|
||||
if path == '/api/logout':
|
||||
with LOCK:
|
||||
DB.execute('DELETE FROM sessions WHERE hash=?', (hashlib.sha256(self.token().encode()).hexdigest(),))
|
||||
@@ -622,7 +635,7 @@ class Handler(BaseHTTPRequestHandler):
|
||||
elif path == '/api/ptz/presets':
|
||||
c = ACCOUNTS.control(self.user, get_object('cameras', data.get('camera')))
|
||||
if data.get('action') != 'goto':
|
||||
self.require_admin()
|
||||
self.require_manager()
|
||||
try:
|
||||
result = ptz.CONTROLLER.preset_command(c, data)
|
||||
except ValueError as e:
|
||||
@@ -643,19 +656,26 @@ class Handler(BaseHTTPRequestHandler):
|
||||
self.answer(result)
|
||||
elif path == '/api/users':
|
||||
self.answer(ACCOUNTS.save(data, self.user))
|
||||
elif path == '/api/households':
|
||||
self.answer(HOUSEHOLDS.save(data, self.user))
|
||||
elif path == '/api/households/leadership':
|
||||
self.answer(HOUSEHOLDS.leadership(data, self.user))
|
||||
elif path in ('/api/family/person', '/api/family/link', '/api/family/event'):
|
||||
self.answer(FAMILY.save(path.rsplit('/', 1)[-1], data, self.user))
|
||||
elif path == '/api/sites':
|
||||
self.answer(save_site(data))
|
||||
self.answer(save_site(data, self.user))
|
||||
elif path == '/api/cameras':
|
||||
self.answer(save_camera(data))
|
||||
self.answer(save_camera(data, self.user))
|
||||
elif path == '/api/assets':
|
||||
self.answer(save_asset(data))
|
||||
self.answer(save_asset(data, self.user))
|
||||
elif path == '/api/recorders':
|
||||
self.answer(save_recorder(data))
|
||||
self.answer(save_recorder(data, self.user))
|
||||
elif path == '/api/onvif':
|
||||
old = get_object('cameras', data.get('id')) or {}
|
||||
if data.get('id'):
|
||||
HOUSEHOLDS.owns(self.user, old)
|
||||
host = host_address(data.get('host', ''))
|
||||
HOUSEHOLDS.endpoint(self.user, host)
|
||||
port = integer(data.get('port', 80), 1, 65535)
|
||||
username = clean_text(data.get('username', ''), 120, required=True)
|
||||
password = data.get('password') or old.get('password', '')
|
||||
@@ -667,6 +687,7 @@ class Handler(BaseHTTPRequestHandler):
|
||||
raise Problem('ONVIF 读取未成功，请检查账号、设备时间、服务端口及 ONVIF 是否启用', 502)
|
||||
self.answer(result)
|
||||
elif path == '/api/storage':
|
||||
self.require_admin()
|
||||
policy = {'retentionDays': integer(data.get('retentionDays'), 1, 365),
|
||||
'maxGB': integer(data.get('maxGB'), 5, 100000),
|
||||
'reserveGB': integer(data.get('reserveGB'), 2, 1000)}
|
||||
@@ -675,6 +696,7 @@ class Handler(BaseHTTPRequestHandler):
|
||||
audit('更新录像保留策略')
|
||||
self.answer({'ok': True})
|
||||
elif path == '/api/discover':
|
||||
self.require_admin()
|
||||
try:
|
||||
network = ipaddress.ip_network(data.get('network', ''), strict=False)
|
||||
if network.version != 4 or network.prefixlen < 24 or network.prefixlen > 30:
|
||||
@@ -777,6 +799,7 @@ class Handler(BaseHTTPRequestHandler):
|
||||
query = {k: v[0] for k, v in url.parse_qs(parsed.query).items()}
|
||||
if path == '/api/session':
|
||||
user = self.authenticated()
|
||||
user = HOUSEHOLDS.context(user, self.headers.get('X-Household-Id'))
|
||||
self.answer({'authenticated': bool(user), 'user': ACCOUNTS.public(user),
|
||||
'setupRequired': not bool(objects('users'))})
|
||||
return
|
||||
@@ -788,8 +811,11 @@ class Handler(BaseHTTPRequestHandler):
|
||||
if path == '/api/state':
|
||||
self.answer(ACCOUNTS.state(self.user, status()))
|
||||
elif path == '/api/users':
|
||||
self.require_admin()
|
||||
self.answer({'users': [ACCOUNTS.public(u) for u in objects('users')]})
|
||||
self.require_manager()
|
||||
self.answer({'users': [ACCOUNTS.public(u) for u in HOUSEHOLDS.objects(self.user, 'users')
|
||||
if self.user['role'] == 'admin' or u['role'] != 'admin']})
|
||||
elif path == '/api/households':
|
||||
self.answer({'households': HOUSEHOLDS.list(self.user), 'activeId': HOUSEHOLDS.scope(self.user)})
|
||||
elif path == '/api/ptz/presets':
|
||||
c = ACCOUNTS.control(self.user, get_object('cameras', query.get('camera')))
|
||||
try:
|
||||
@@ -798,7 +824,7 @@ class Handler(BaseHTTPRequestHandler):
|
||||
raise Problem(str(e), 400)
|
||||
except Exception:
|
||||
raise Problem('未能读取预置位，设备可能未开放该接口；方向微调仍可单独使用', 502)
|
||||
self.answer(dict(result, canManage=self.user['role'] == 'admin'))
|
||||
self.answer(dict(result, canManage=HOUSEHOLDS.manager(self.user)))
|
||||
elif path == '/api/ptz':
|
||||
c = ACCOUNTS.control(self.user, get_object('cameras', query.get('camera')))
|
||||
try:
|
||||
@@ -811,7 +837,7 @@ class Handler(BaseHTTPRequestHandler):
|
||||
elif path == '/api/family':
|
||||
self.answer(FAMILY.snapshot(self.user))
|
||||
elif path == '/api/camera/settings':
|
||||
self.require_admin()
|
||||
self.require_manager()
|
||||
c = ACCOUNTS.camera(self.user, get_object('cameras', query.get('camera')))
|
||||
try:
|
||||
result, _ = camera_settings.CONTROLLER.read(c, query.get('quality', 'main'))
|
||||
@@ -873,7 +899,7 @@ class Handler(BaseHTTPRequestHandler):
|
||||
raise Problem('接口不存在', 404)
|
||||
else:
|
||||
files = {'/': 'index.html', '/app.js': 'app.js', '/live-player.js': 'live-player.js', '/style.css': 'style.css',
|
||||
'/family.js': 'family.js', '/kinship.js': 'kinship.js',
|
||||
'/family.js': 'family.js', '/kinship.js': 'kinship.js', '/households.js': 'households.js',
|
||||
'/family-graph.js': 'family-graph.js', '/family-map.js': 'family-map.js',
|
||||
'/family-map.css': 'family-map.css', '/chinese-theme.css': 'chinese-theme.css',
|
||||
'/family-events.js': 'family-events.js',
|
||||
@@ -911,6 +937,7 @@ def initialize():
|
||||
global MEDIA_AUTH
|
||||
FAMILY.initialize()
|
||||
ACCOUNTS.initialize()
|
||||
HOUSEHOLDS.initialize()
|
||||
if not setting('storage'):
|
||||
set_setting('storage', {'retentionDays': 7, 'maxGB': 40, 'reserveGB': 8})
|
||||
if not setting('mediaSecret'):
|
||||
|
||||
+23
-11
@@ -24,35 +24,44 @@ class Family:
|
||||
self.a.DB.commit()
|
||||
|
||||
def authorize(self, user, edit=False):
|
||||
if user['role'] != 'admin' and user.get('familyAccess', 'none') not in (('edit',) if edit else ('read', 'edit')):
|
||||
self.a.HOUSEHOLDS.scope(user)
|
||||
if not self.a.HOUSEHOLDS.manager(user) and user.get('familyAccess', 'none') not in (('edit',) if edit else ('read', 'edit')):
|
||||
raise self.a.Problem('没有家谱' + ('编辑' if edit else '查看') + '权限', 403)
|
||||
|
||||
def snapshot(self, user):
|
||||
self.authorize(user)
|
||||
with self.a.LOCK:
|
||||
can_edit = user['role'] == 'admin' or user.get('familyAccess') == 'edit'
|
||||
return {'revision': self.a.setting('familyRevision', 0), 'people': self.a.objects('people'),
|
||||
'links': self.a.objects('family_links'),
|
||||
'events': [e for e in self.a.objects('family_events')
|
||||
can_edit = self.a.HOUSEHOLDS.manager(user) or user.get('familyAccess') == 'edit'
|
||||
people = self.a.HOUSEHOLDS.objects(user, 'people')
|
||||
return {'revision': self.a.setting(self.a.HOUSEHOLDS.revision_key(user), 0), 'people': people,
|
||||
'links': self.a.HOUSEHOLDS.objects(user, 'family_links'),
|
||||
'events': [e for e in self.a.HOUSEHOLDS.objects(user, 'family_events')
|
||||
if can_edit or (e.get('status') == 'published' and not e.get('archived'))],
|
||||
'canEdit': can_edit,
|
||||
'selfId': user.get('personId', '')}
|
||||
'selfId': user.get('personId', '') if any(p['id'] == user.get('personId') for p in people) else '',
|
||||
'familyId': self.a.HOUSEHOLDS.scope(user)}
|
||||
|
||||
def save(self, kind, data, user, restored_from=None):
|
||||
self.authorize(user, True)
|
||||
a = self.a
|
||||
with a.LOCK:
|
||||
revision = a.setting('familyRevision', 0)
|
||||
revision_key = a.HOUSEHOLDS.revision_key(user)
|
||||
revision = a.setting(revision_key, 0)
|
||||
if type(data.get('revision')) is not int or data['revision'] != revision:
|
||||
raise a.Problem('家谱已被更新，请重新载入后再编辑', 409)
|
||||
if kind not in ('person', 'link', 'event'):
|
||||
raise a.Problem('家谱记录类型不存在', 404)
|
||||
table = {'person': 'people', 'link': 'family_links', 'event': 'family_events'}[kind]
|
||||
family_id = a.HOUSEHOLDS.prepare(user, table, data,
|
||||
(('people', 'fromId'), ('people', 'toId')) if kind == 'link' else ())
|
||||
if kind == 'event' and isinstance(data.get('personIds', []), list):
|
||||
for person in data.get('personIds', []):
|
||||
a.HOUSEHOLDS.owns(user, a.get_object('people', person))
|
||||
old = a.get_object(table, data.get('id'))
|
||||
if data.get('id') and not old:
|
||||
raise a.Problem('家谱记录不存在', 404)
|
||||
item = {'person': self.person, 'link': self.link, 'event': self.event}[kind](data, old)
|
||||
item.update(updatedAt=dt.datetime.now(dt.timezone.utc).isoformat(), updatedBy=user['username'])
|
||||
item.update(familyId=family_id, updatedAt=dt.datetime.now(dt.timezone.utc).isoformat(), updatedBy=user['username'])
|
||||
if kind == 'event':
|
||||
item.update(createdAt=old.get('createdAt', item['updatedAt']) if old else item['updatedAt'],
|
||||
createdBy=old.get('createdBy', user['username']) if old else user['username'])
|
||||
@@ -63,10 +72,11 @@ class Family:
|
||||
item['publishedAt'] = item['updatedAt']
|
||||
# Revision and record are committed together, so concurrent forms cannot overwrite silently.
|
||||
with a.DB:
|
||||
change_revision = a.DB.execute('SELECT COALESCE(MAX(revision),0)+1 FROM family_changes').fetchone()[0]
|
||||
a.DB.execute('INSERT OR REPLACE INTO ' + table + ' VALUES (?,?)', (item['id'], json.dumps(item)))
|
||||
a.DB.execute('INSERT OR REPLACE INTO settings VALUES (?,?)', ('familyRevision', json.dumps(revision + 1)))
|
||||
a.DB.execute('INSERT OR REPLACE INTO settings VALUES (?,?)', (revision_key, json.dumps(revision + 1)))
|
||||
a.DB.execute('INSERT INTO family_changes VALUES (?,?,?,?,?,?,?,?)',
|
||||
(revision + 1, kind, item['id'], json.dumps(old) if old else None,
|
||||
(change_revision, kind, item['id'], json.dumps(old) if old else None,
|
||||
json.dumps(item), user['username'], item['updatedAt'], restored_from))
|
||||
a.audit({'person': '更新家谱人物', 'link': '更新家谱关系', 'event': '更新家族记事'}[kind], user['username'])
|
||||
return {'item': item, 'revision': revision + 1}
|
||||
@@ -79,6 +89,7 @@ class Family:
|
||||
with a.LOCK:
|
||||
if not table or not a.get_object(table, target_id):
|
||||
raise a.Problem('家谱记录不存在', 404)
|
||||
a.HOUSEHOLDS.owns(user, a.get_object(table, target_id))
|
||||
if before is not None:
|
||||
a.integer(before, 1, 2**53 - 1)
|
||||
rows = a.DB.execute('SELECT * FROM family_changes WHERE kind=? AND target_id=? AND revision<? '
|
||||
@@ -91,7 +102,7 @@ class Family:
|
||||
items.append(dict(revision=row['revision'], at=row['at'], actor=row['actor'], fields=fields,
|
||||
created=row['before_json'] is None, restoredFrom=row['restored_from']))
|
||||
return dict(items=items, nextBefore=items[-1]['revision'] if len(rows) > 20 else None,
|
||||
revision=a.setting('familyRevision', 0))
|
||||
revision=a.setting(a.HOUSEHOLDS.revision_key(user), 0))
|
||||
|
||||
def change(self, user, change_revision):
|
||||
self.authorize(user, True)
|
||||
@@ -100,6 +111,7 @@ class Family:
|
||||
row = self.a.DB.execute('SELECT * FROM family_changes WHERE revision=?', (change_revision,)).fetchone()
|
||||
if not row:
|
||||
raise self.a.Problem('修改记录不存在', 404)
|
||||
self.a.HOUSEHOLDS.owns(user, json.loads(row['after_json']))
|
||||
return dict(revision=row['revision'], kind=row['kind'], targetId=row['target_id'],
|
||||
before=json.loads(row['before_json']) if row['before_json'] else None,
|
||||
after=json.loads(row['after_json']), at=row['at'], actor=row['actor'])
|
||||
|
||||
+150
@@ -0,0 +1,150 @@
|
||||
"""Household ownership and request scope. A site is a location within one household."""
|
||||
import datetime as dt
|
||||
import json
|
||||
import re
|
||||
import secrets
|
||||
|
||||
|
||||
class Households:
|
||||
TABLES = ('sites', 'assets', 'recorders', 'cameras', 'people', 'family_links', 'family_events', 'users')
|
||||
|
||||
def __init__(self, app):
|
||||
self.a = app
|
||||
|
||||
@staticmethod
|
||||
def manager(user):
|
||||
return bool(user and user.get('role') in ('admin', 'family_admin'))
|
||||
|
||||
def initialize(self):
|
||||
a = self.a
|
||||
with a.LOCK, a.DB:
|
||||
a.DB.execute('CREATE TABLE IF NOT EXISTS households (id TEXT PRIMARY KEY, body TEXT NOT NULL)')
|
||||
default = a.setting('defaultHousehold')
|
||||
if not default:
|
||||
default = secrets.token_hex(8)
|
||||
a.DB.execute('INSERT INTO settings VALUES (?,?)', ('defaultHousehold', json.dumps(default)))
|
||||
item = dict(id=default, name='赵府', note='原有家庭资料', createdAt=dt.datetime.now(dt.timezone.utc).isoformat())
|
||||
a.DB.execute('INSERT INTO households VALUES (?,?)', (default, json.dumps(item)))
|
||||
# One-time ownership backfill preserves identifiers, credentials and device paths.
|
||||
for table in self.TABLES:
|
||||
for row in a.DB.execute('SELECT id,body FROM ' + table).fetchall():
|
||||
item = json.loads(row['body'])
|
||||
if 'familyId' not in item:
|
||||
item['familyId'] = default
|
||||
a.DB.execute('UPDATE ' + table + ' SET body=? WHERE id=?', (json.dumps(item), row['id']))
|
||||
for row in a.DB.execute('SELECT revision,before_json,after_json FROM family_changes').fetchall():
|
||||
for column in ('before_json', 'after_json'):
|
||||
item = json.loads(row[column]) if row[column] else None
|
||||
if item is not None and 'familyId' not in item:
|
||||
item['familyId'] = default
|
||||
a.DB.execute('UPDATE family_changes SET ' + column + '=? WHERE revision=?',
|
||||
(json.dumps(item), row['revision']))
|
||||
|
||||
def family_of(self, item):
|
||||
# Legacy in-process import helpers remain in the migrated default household.
|
||||
return item.get('familyId', self.a.setting('defaultHousehold')) if item is not None else None
|
||||
|
||||
def scope(self, user):
|
||||
family = (user or {}).get('_familyId') or self.family_of(user or {})
|
||||
if not family or not self.a.get_object('households', family):
|
||||
raise self.a.Problem('账号尚未分配有效家庭，请联系平台管理员', 403)
|
||||
return family
|
||||
|
||||
def context(self, user, requested=None):
|
||||
if not user:
|
||||
return None
|
||||
own = self.family_of(user)
|
||||
if requested and user['role'] != 'admin' and requested != own:
|
||||
raise self.a.Problem('没有这个家庭的访问权限', 403)
|
||||
result = dict(user, _familyId=requested or own)
|
||||
self.scope(result)
|
||||
return result
|
||||
|
||||
def owns(self, user, item):
|
||||
if not item or self.family_of(item) != self.scope(user):
|
||||
raise self.a.Problem('记录不存在或不属于当前家庭', 404)
|
||||
return item
|
||||
|
||||
def objects(self, user, table):
|
||||
family = self.scope(user)
|
||||
return [x for x in self.a.objects(table) if self.family_of(x) == family]
|
||||
|
||||
def prepare(self, user, table, body, references=()):
|
||||
family = self.scope(user)
|
||||
if body.get('familyId', family) != family:
|
||||
raise self.a.Problem('不能修改记录的家庭归属', 403)
|
||||
if body.get('id'):
|
||||
if not isinstance(body['id'], str) or not re.fullmatch('[a-f0-9]{16}', body['id']):
|
||||
raise self.a.Problem('对象编号不正确')
|
||||
self.owns(user, self.a.get_object(table, body['id']))
|
||||
for target, key in references:
|
||||
if body.get(key):
|
||||
self.owns(user, self.a.get_object(target, body[key]))
|
||||
return family
|
||||
|
||||
def endpoint(self, user, host):
|
||||
family = self.scope(user)
|
||||
if any(item.get('host') == host and self.family_of(item) != family
|
||||
for table in ('cameras', 'recorders') for item in self.a.objects(table)):
|
||||
raise self.a.Problem('该设备地址已归属其他家庭，不能重复接入', 403)
|
||||
|
||||
def list(self, user):
|
||||
rows = self.a.objects('households') if user['role'] == 'admin' else [self.a.get_object('households', self.scope(user))]
|
||||
def label(uid):
|
||||
account = self.a.get_object('users', uid)
|
||||
return account.get('name', '') if account else ''
|
||||
return [dict({k: v for k, v in row.items() if k != 'leadershipHistory' or self.manager(user)}, ownerName=label(row.get('ownerId')), successorName=label(row.get('successorId')),
|
||||
canAssignOwner=user['role'] == 'admin' or row.get('ownerId') == user['id'],
|
||||
members=sum(self.family_of(u) == row['id'] for u in self.a.objects('users')),
|
||||
sites=sum(self.family_of(s) == row['id'] for s in self.a.objects('sites'))) for row in rows]
|
||||
|
||||
def leadership(self, data, user):
|
||||
"""Explicit handover; a backup already has management access during an emergency."""
|
||||
a = self.a
|
||||
with a.LOCK:
|
||||
home = a.get_object('households', data.get('id'))
|
||||
if not home or home['id'] != self.scope(user):
|
||||
raise a.Problem('请先进入要管理的家庭', 404)
|
||||
if user['role'] != 'admin' and user['id'] != home.get('ownerId'):
|
||||
raise a.Problem('只有一家之主或超级管理员可以交接管理权', 403)
|
||||
if data.get('revision') != home.get('leadershipRevision', 0):
|
||||
raise a.Problem('家庭负责人已变更，请重新载入', 409)
|
||||
owner_id = a.clean_text(data.get('ownerId', ''), 32, True)
|
||||
successor_id = a.clean_text(data.get('successorId', ''), 32)
|
||||
reason = a.clean_text(data.get('reason', ''), 300, True)
|
||||
if owner_id == successor_id:
|
||||
raise a.Problem('备用负责人必须是另一位家庭管理员')
|
||||
for uid in filter(None, (owner_id, successor_id)):
|
||||
account = self.owns(user, a.get_object('users', uid))
|
||||
if account['role'] != 'family_admin' or account['disabled']:
|
||||
raise a.Problem('负责人须为本家庭已启用的家庭管理员')
|
||||
record = dict(at=dt.datetime.now(dt.timezone.utc).isoformat(), actor=user['username'], reason=reason,
|
||||
previousOwnerId=home.get('ownerId', ''), ownerId=owner_id, successorId=successor_id)
|
||||
home.update(ownerId=owner_id, successorId=successor_id,
|
||||
leadershipRevision=home.get('leadershipRevision', 0) + 1,
|
||||
leadershipHistory=(home.get('leadershipHistory', []) + [record])[-50:])
|
||||
a.save_object('households', home)
|
||||
a.audit('家庭负责人交接', user['username'] + ' / ' + home['name'])
|
||||
return {'ok': True}
|
||||
|
||||
def save(self, data, user):
|
||||
a = self.a
|
||||
if not self.manager(user):
|
||||
raise a.Problem('需要家庭管理员权限', 403)
|
||||
with a.LOCK:
|
||||
old = a.get_object('households', data.get('id'))
|
||||
if data.get('id') and not old:
|
||||
raise a.Problem('家庭不存在', 404)
|
||||
if user['role'] != 'admin' and (not old or old['id'] != self.scope(user)):
|
||||
raise a.Problem('只能管理自己所属的家庭', 403)
|
||||
item = dict(old or {}, id=old['id'] if old else secrets.token_hex(8),
|
||||
name=a.clean_text(data.get('name', ''), 80, True),
|
||||
note=a.clean_text(data.get('note', ''), 300),
|
||||
createdAt=old['createdAt'] if old else dt.datetime.now(dt.timezone.utc).isoformat())
|
||||
a.save_object('households', item)
|
||||
a.audit('保存家庭', item['name'])
|
||||
return item
|
||||
|
||||
def revision_key(self, user):
|
||||
family = self.scope(user)
|
||||
return 'familyRevision' if family == self.a.setting('defaultHousehold') else 'familyRevision:' + family
|
||||
+41
-7
@@ -30,7 +30,7 @@ class Accounts:
|
||||
|
||||
@staticmethod
|
||||
def public(user):
|
||||
return {k: v for k, v in user.items() if k not in ('salt', 'hash')} if user else None
|
||||
return {k: v for k, v in user.items() if k not in ('salt', 'hash') and not k.startswith('_')} if user else None
|
||||
|
||||
def password(self, password):
|
||||
if not isinstance(password, str) or not 8 <= len(password) <= 128:
|
||||
@@ -50,6 +50,9 @@ class Accounts:
|
||||
def save(self, data, actor):
|
||||
a = self.a
|
||||
with a.LOCK:
|
||||
if actor and not a.HOUSEHOLDS.manager(actor):
|
||||
raise a.Problem('需要家庭管理员权限', 403)
|
||||
family = a.HOUSEHOLDS.prepare(actor, 'users', data)
|
||||
old = a.get_object('users', data.get('id'))
|
||||
if data.get('id') and not old:
|
||||
raise a.Problem('账号不存在', 404)
|
||||
@@ -61,29 +64,47 @@ class Accounts:
|
||||
raise a.Problem('用户名已存在', 409)
|
||||
role = data.get('role', 'member')
|
||||
access = data.get('familyAccess', 'none')
|
||||
if role not in ('admin', 'member') or access not in ('none', 'read', 'edit'):
|
||||
if role not in ('admin', 'family_admin', 'member') or access not in ('none', 'read', 'edit'):
|
||||
raise a.Problem('权限选项不正确')
|
||||
if actor and actor['role'] != 'admin' and (role == 'admin' or (old and old['role'] == 'admin')):
|
||||
raise a.Problem('家庭管理员不能创建或修改超级管理员', 403)
|
||||
home = a.get_object('households', family)
|
||||
if actor and actor['role'] != 'admin' and home.get('ownerId') and actor['id'] != home['ownerId']:
|
||||
if (role == 'family_admin' and not old) or (old and old['id'] != actor['id'] and
|
||||
(role == 'family_admin' or old['role'] == 'family_admin')):
|
||||
raise a.Problem('请由一家之主或超级管理员管理家庭管理员账号', 403)
|
||||
sites = data.get('siteIds', [])
|
||||
if not isinstance(sites, list) or any(not isinstance(s, str) or not a.get_object('sites', s) for s in sites):
|
||||
raise a.Problem('请选择有效空间')
|
||||
for site in sites:
|
||||
a.HOUSEHOLDS.owns(actor, a.get_object('sites', site))
|
||||
ptz_control = data.get('ptzControl', old.get('ptzControl', False) if old else False)
|
||||
if not isinstance(ptz_control, bool):
|
||||
raise a.Problem('云台权限格式不正确')
|
||||
disabled = data.get('disabled', False)
|
||||
if not isinstance(disabled, bool):
|
||||
raise a.Problem('账号状态不正确')
|
||||
if old and uid in (home.get('ownerId'), home.get('successorId')) and (disabled or role != 'family_admin'):
|
||||
raise a.Problem('请先交接家主或更换备用负责人，再停用或调整此账号')
|
||||
if old and old['role'] == 'admin' and (role != 'admin' or disabled):
|
||||
if not any(u['id'] != uid and u['role'] == 'admin' and not u['disabled'] for u in a.objects('users')):
|
||||
raise a.Problem('至少保留一个启用的管理员')
|
||||
if old and old['role'] == 'family_admin' and (role != 'family_admin' or disabled):
|
||||
if not any(u['id'] != uid and u['role'] == 'family_admin' and not u['disabled']
|
||||
for u in a.HOUSEHOLDS.objects(actor, 'users')):
|
||||
raise a.Problem('至少保留一个启用的家庭管理员')
|
||||
if actor and actor['id'] == uid and (disabled or role != actor['role']):
|
||||
raise a.Problem('不能停用或降低当前登录账号的管理权限')
|
||||
related = a.clean_text(data.get('relatedToId', ''), 32)
|
||||
person = a.clean_text(data.get('personId', ''), 32)
|
||||
if related and related != uid and not a.get_object('users', related):
|
||||
raise a.Problem('关系参照账号不存在')
|
||||
if related and related != uid:
|
||||
a.HOUSEHOLDS.owns(actor, a.get_object('users', related))
|
||||
if person:
|
||||
if not a.get_object('people', person):
|
||||
raise a.Problem('家谱人物不存在')
|
||||
a.HOUSEHOLDS.owns(actor, a.get_object('people', person))
|
||||
if any(u.get('personId') == person and u['id'] != uid for u in a.objects('users')):
|
||||
raise a.Problem('这个人物已经关联其他账号')
|
||||
password = data.get('password', '')
|
||||
@@ -91,11 +112,11 @@ class Accounts:
|
||||
raise a.Problem('密码格式不正确')
|
||||
credentials = self.password(password) if password or not old else {k: old[k] for k in ('salt', 'hash')}
|
||||
user = dict(id=uid, username=username, name=a.clean_text(data.get('name', username), 80, True),
|
||||
role=role, disabled=disabled, siteIds=sorted(set(sites)), familyAccess=access, ptzControl=ptz_control,
|
||||
role=role, disabled=disabled, familyId=family, siteIds=sorted(set(sites)), familyAccess=access, ptzControl=ptz_control,
|
||||
personId=person, relatedToId=related,
|
||||
relationship=a.clean_text(data.get('relationship', ''), 40), **credentials)
|
||||
# Revoke sessions when credentials or authorization change, not for label edits.
|
||||
if old and any(old.get(k) != user.get(k) for k in ('hash', 'role', 'siteIds', 'familyAccess', 'disabled', 'username', 'ptzControl')):
|
||||
if old and any(old.get(k) != user.get(k) for k in ('hash', 'role', 'familyId', 'siteIds', 'familyAccess', 'disabled', 'username', 'ptzControl', 'personId')):
|
||||
a.DB.execute('DELETE FROM sessions WHERE user_id=?', (uid,))
|
||||
a.save_object('users', user)
|
||||
a.audit('更新账号' if old else '建立账号', username)
|
||||
@@ -128,13 +149,18 @@ class Accounts:
|
||||
def camera(self, user, camera):
|
||||
if not camera:
|
||||
raise self.a.Problem('摄像头不存在', 404)
|
||||
if user['role'] != 'admin' and camera.get('siteId') not in user['siteIds']:
|
||||
if user['role'] != 'admin':
|
||||
self.a.HOUSEHOLDS.owns(user, camera)
|
||||
site = self.a.get_object('sites', camera.get('siteId'))
|
||||
if site:
|
||||
self.a.HOUSEHOLDS.owns(user, site)
|
||||
if not self.a.HOUSEHOLDS.manager(user) and camera.get('siteId') not in user['siteIds']:
|
||||
raise self.a.Problem('没有这个空间的访问权限', 403)
|
||||
return camera
|
||||
|
||||
def control(self, user, camera):
|
||||
self.camera(user, camera)
|
||||
if user['role'] != 'admin' and not user.get('ptzControl', False):
|
||||
if not self.a.HOUSEHOLDS.manager(user) and not user.get('ptzControl', False):
|
||||
raise self.a.Problem('没有云台控制权限，请联系管理员授权', 403)
|
||||
if not camera.get('enabled'):
|
||||
raise self.a.Problem('摄像头已停用', 409)
|
||||
@@ -142,7 +168,15 @@ class Accounts:
|
||||
|
||||
def state(self, user, state):
|
||||
state['user'] = self.public(user)
|
||||
if user['role'] == 'admin':
|
||||
family = self.a.HOUSEHOLDS.scope(user)
|
||||
state['familyId'] = family
|
||||
state['households'] = self.a.HOUSEHOLDS.list(user)
|
||||
for key in ('sites', 'assets', 'cameras', 'recorders'):
|
||||
state[key] = [x for x in state[key] if self.a.HOUSEHOLDS.family_of(x) == family]
|
||||
if user['role'] != 'admin':
|
||||
state['scan'] = {}
|
||||
state['storage'] = {}
|
||||
if self.a.HOUSEHOLDS.manager(user):
|
||||
return state
|
||||
permitted = set(user['siteIds'])
|
||||
state['sites'] = [s for s in state['sites'] if s['id'] in permitted]
|
||||
|
||||
+1
-1
@@ -105,7 +105,7 @@ class WebTests(unittest.TestCase):
|
||||
self.assertEqual(headers['Cache-Control'], 'no-store')
|
||||
self.assertNotIn(b'__ASSET_VERSION__', body)
|
||||
assets = re.findall(r'(?:src|href)="(/[^"?]+\.(?:js|css)\?v=[^"]+)"', body.decode())
|
||||
self.assertEqual(len(assets), 19)
|
||||
self.assertEqual(len(assets), 20)
|
||||
version = (app.ROOT / 'VERSION').read_text().strip()
|
||||
for asset in assets:
|
||||
self.assertTrue(asset.endswith('?v=' + version))
|
||||
|
||||
@@ -0,0 +1,211 @@
|
||||
"""Two-household HTTP isolation and management succession regressions."""
|
||||
import hashlib
|
||||
import http.client
|
||||
import json
|
||||
import secrets
|
||||
import sqlite3
|
||||
import tempfile
|
||||
import threading
|
||||
import time
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
from unittest.mock import patch
|
||||
|
||||
# Reuse only module initialization; never inherit the original WebTests.
|
||||
from test_app import app
|
||||
|
||||
|
||||
class HouseholdTests(unittest.TestCase):
|
||||
def setUp(self):
|
||||
self.temp = tempfile.TemporaryDirectory()
|
||||
self.addCleanup(self.temp.cleanup)
|
||||
db = sqlite3.connect(':memory:', check_same_thread=False)
|
||||
db.row_factory = sqlite3.Row
|
||||
self.addCleanup(db.close)
|
||||
db.executescript('''
|
||||
CREATE TABLE settings (key TEXT PRIMARY KEY,value TEXT NOT NULL);
|
||||
CREATE TABLE sessions (hash TEXT PRIMARY KEY,expires REAL NOT NULL);
|
||||
CREATE TABLE audit (id INTEGER PRIMARY KEY,at TEXT,action TEXT,name TEXT);
|
||||
''')
|
||||
for table in ('sites', 'assets', 'recorders', 'cameras'):
|
||||
db.execute('CREATE TABLE '+table+' (id TEXT PRIMARY KEY,body TEXT NOT NULL)')
|
||||
for attr, value in [('DB', db), ('DATA', Path(self.temp.name)),
|
||||
('write_media_config', lambda: None)]:
|
||||
p = patch.object(app, attr, value); p.start(); self.addCleanup(p.stop)
|
||||
app.initialize()
|
||||
self.root = app.ACCOUNTS.save(dict(username='admin', password='fixture-only', role='admin'), None)
|
||||
self.aid = self.root['familyId']
|
||||
self.bid = app.HOUSEHOLDS.save({'name': '乙家庭'}, self.root)['id']
|
||||
self.roots = {h: app.HOUSEHOLDS.context(self.root, h) for h in (self.aid, self.bid)}
|
||||
self.managers, self.members, self.sites, self.cameras, self.assets = {}, {}, {}, {}, {}
|
||||
for i, home in enumerate((self.aid, self.bid)):
|
||||
actor = self.roots[home]
|
||||
self.sites[home] = app.save_site({'name': 'home-'+str(i)}, actor)
|
||||
self.assets[home] = app.save_asset(dict(name='asset-'+str(i), siteId=self.sites[home]['id']), actor)
|
||||
self.cameras[home] = app.save_camera(dict(name='camera-'+str(i), assetId=self.assets[home]['id'],
|
||||
host='192.168.3.'+str(10+i), enabled=True), actor)
|
||||
self.managers[home] = app.ACCOUNTS.save(dict(username='manager'+str(i), password='fixture-only', role='family_admin'), actor)
|
||||
self.members[home] = app.ACCOUNTS.save(dict(username='member'+str(i), password='fixture-only',
|
||||
siteIds=[self.sites[home]['id']], familyAccess='edit', ptzControl=True), actor)
|
||||
self.owner, self.other = self.managers[self.aid], self.managers[self.bid]
|
||||
self.backup = app.ACCOUNTS.save(dict(username='backup', password='fixture-only', role='family_admin'), self.root)
|
||||
self.tokens = {}
|
||||
for user in [self.root, self.backup, *self.managers.values(), *self.members.values()]:
|
||||
token = secrets.token_hex(32); self.tokens[user['id']] = token
|
||||
db.execute('INSERT INTO sessions VALUES (?,?,?)', (hashlib.sha256(token.encode()).hexdigest(), time.time()+600, user['id']))
|
||||
db.commit()
|
||||
def state():
|
||||
return {**{t: app.objects(t) for t in ('sites','assets','recorders','cameras')}, 'scan': {'network':'private'}, 'storage': {'maxGB':40}}
|
||||
p = patch.object(app, 'status', state); p.start(); self.addCleanup(p.stop)
|
||||
self.server = app.ThreadingHTTPServer(('127.0.0.1', 0), app.Handler)
|
||||
self.thread = threading.Thread(target=self.server.serve_forever, daemon=True); self.thread.start()
|
||||
self.addCleanup(self.stop_server)
|
||||
|
||||
def stop_server(self):
|
||||
self.server.shutdown(); self.server.server_close(); self.thread.join()
|
||||
|
||||
def request(self, path, user=None, data=None, home=None):
|
||||
user = user or self.owner
|
||||
c = http.client.HTTPConnection(*self.server.server_address, timeout=3)
|
||||
headers = {'Cookie': 'vision='+self.tokens[user['id']]}
|
||||
if home: headers['X-Household-Id'] = home
|
||||
if data is not None: headers['Content-Type'] = 'application/json'
|
||||
c.request('GET' if data is None else 'POST', path, json.dumps(data) if data is not None else None, headers)
|
||||
response = c.getresponse(); raw = response.read(); code = response.status; c.close()
|
||||
return code, json.loads(raw)
|
||||
|
||||
def leadership(self, user=None, **fields):
|
||||
data = dict(id=self.aid, ownerId=self.owner['id'], successorId=self.backup['id'], revision=0, reason='提前安排备用负责人')
|
||||
return self.request('/api/households/leadership', user or self.root, data=dict(data, **fields))
|
||||
|
||||
def test_state_and_accounts_are_scoped(self):
|
||||
for home in (self.aid, self.bid):
|
||||
for user in (self.managers[home], self.members[home]):
|
||||
code, body = self.request('/api/state', user)
|
||||
self.assertEqual(code, 200)
|
||||
for table in ('sites','assets','cameras'):
|
||||
self.assertEqual(len(body[table]), 1)
|
||||
self.assertEqual(body['cameras'][0]['id'], self.cameras[home]['id'])
|
||||
self.assertEqual([h['id'] for h in body['households']], [home])
|
||||
self.assertEqual(body['storage'], {}); self.assertEqual(body['scan'], {})
|
||||
code, body = self.request('/api/users')
|
||||
self.assertEqual(code, 200)
|
||||
self.assertTrue(all(u['familyId']==self.aid and u['role']!='admin' for u in body['users']))
|
||||
self.assertNotIn('hash', json.dumps(body)); self.assertNotIn('salt', json.dumps(body))
|
||||
|
||||
def test_forged_household_header_denied_root_can_switch(self):
|
||||
for user in (self.owner, self.members[self.aid]):
|
||||
for path in ('/api/session','/api/state','/api/family','/api/households'):
|
||||
self.assertEqual(self.request(path, user, home=self.bid)[0], 403)
|
||||
code, body = self.request('/api/state', self.root, home=self.bid)
|
||||
self.assertEqual(code, 200); self.assertEqual(body['familyId'], self.bid)
|
||||
self.assertEqual(body['cameras'][0]['id'], self.cameras[self.bid]['id'])
|
||||
|
||||
def test_guessed_camera_ids_cannot_access_media_or_controls(self):
|
||||
camera = self.cameras[self.bid]['id']
|
||||
paths = [f'/media/live/cam_{camera}_{quality}/{file}' for quality in ('main','sub','hd','compat')
|
||||
for file in ('index.m3u8','init.mp4','segment1.mp4')]
|
||||
paths += [f'/api/recordings?camera={camera}', f'/media/playback?camera={camera}',
|
||||
f'/media/playback?camera={camera}&download=1', f'/api/ptz?camera={camera}',
|
||||
f'/api/ptz/presets?camera={camera}', f'/api/camera/settings?camera={camera}']
|
||||
with patch.object(app.Handler, 'proxy') as proxy:
|
||||
for user in (self.owner,self.members[self.aid]):
|
||||
for path in paths:
|
||||
with self.subTest(path=path): self.assertIn(self.request(path,user)[0], (403,404))
|
||||
for path in ('/api/ptz','/api/ptz/presets','/api/camera/settings'):
|
||||
self.assertIn(self.request(path,user,dict(camera=camera, action='stop'))[0], (403,404))
|
||||
proxy.assert_not_called()
|
||||
|
||||
def test_own_media_access_and_ungranted_site(self):
|
||||
def proxy(handler,*args,**kwargs): handler.answer({'ok':True})
|
||||
camera = self.cameras[self.aid]['id']; path = f'/media/live/cam_{camera}_hd/index.m3u8'
|
||||
with patch.object(app.Handler,'proxy',proxy):
|
||||
self.assertEqual(self.request(path,self.members[self.aid])[0],200)
|
||||
member=dict(self.members[self.aid],siteIds=[])
|
||||
# Update DB directly to retain token and exercise per-request permission lookup.
|
||||
app.save_object('users',dict(app.get_object('users',member['id']),siteIds=[]))
|
||||
self.assertEqual(self.request(path,member)[0],403)
|
||||
self.assertEqual(self.request(path,self.owner)[0],200)
|
||||
|
||||
def test_cross_household_edits_references_and_ownership_blocked(self):
|
||||
cases=[('/api/sites',dict(self.sites[self.bid],name='stolen')),
|
||||
('/api/assets',dict(name='bad',siteId=self.sites[self.bid]['id'])),
|
||||
('/api/cameras',dict(name='bad',assetId=self.assets[self.bid]['id'])),
|
||||
('/api/recorders',dict(name='bad',siteId=self.sites[self.bid]['id'])),
|
||||
('/api/sites',dict(self.sites[self.aid],familyId=self.bid))]
|
||||
for path,data in cases: self.assertIn(self.request(path,data=data)[0],(403,404))
|
||||
self.assertEqual(self.request('/api/sites',data=dict(self.sites[self.aid],name='own edit'))[0],200)
|
||||
|
||||
def test_other_device_address_and_onvif_credentials_protected(self):
|
||||
with patch.object(app.onvif,'inspect') as inspect:
|
||||
for data in (dict(id=self.cameras[self.bid]['id']),dict(host=self.cameras[self.bid]['host'],username='admin')):
|
||||
self.assertIn(self.request('/api/onvif',data=data)[0],(403,404))
|
||||
inspect.assert_not_called()
|
||||
self.assertEqual(self.request('/api/cameras',data=dict(name='duplicate',assetId=self.assets[self.aid]['id'],host=self.cameras[self.bid]['host']))[0],403)
|
||||
|
||||
def test_manager_cannot_escalate_or_touch_another_family_user(self):
|
||||
for data in (dict(username='root2',password='fixture-only',role='admin'),
|
||||
dict(self.other,name='stolen'), dict(self.root,name='hijack'),
|
||||
dict(username='cross',password='fixture-only',siteIds=[self.sites[self.bid]['id']]),
|
||||
dict(username='cross',password='fixture-only',relatedToId=self.other['id'])):
|
||||
self.assertIn(self.request('/api/users',data=data)[0],(403,404))
|
||||
|
||||
def test_global_operations_require_super_admin(self):
|
||||
for path,data in (('/api/storage',{}),('/api/discover',{}),('/api/households',{'name':'unauthorized'})):
|
||||
self.assertEqual(self.request(path,data=data)[0],403)
|
||||
self.assertEqual(self.request('/api/audit')[0],403)
|
||||
self.assertEqual(self.request('/api/households',self.members[self.aid],{'name':'unauthorized'})[0],403)
|
||||
|
||||
def test_genealogy_revisions_history_restore_and_refs_isolated(self):
|
||||
a = app.FAMILY.save('person',dict(name='A private',revision=0),self.owner)['item']
|
||||
b = app.FAMILY.save('person',dict(name='B private',revision=0),self.other)['item']
|
||||
self.assertEqual(self.request('/api/family')[1]['revision'],1)
|
||||
self.assertEqual([p['name'] for p in self.request('/api/family')[1]['people']],['A private'])
|
||||
revision=app.FAMILY.history(self.other,'person',b['id'])['items'][0]['revision']
|
||||
for path in (f'/api/family/history?kind=person&id={b["id"]}', f'/api/family/change?revision={revision}'):
|
||||
self.assertEqual(self.request(path)[0],404)
|
||||
for path,data in (('/api/family/restore',dict(changeRevision=revision,side='after',revision=1)),
|
||||
('/api/family/person',dict(b,revision=1)),
|
||||
('/api/family/link',dict(fromId=a['id'],toId=b['id'],kind='parent',revision=1)),
|
||||
('/api/family/event',dict(personIds=[b['id']],revision=1))):
|
||||
self.assertIn(self.request(path,data=data)[0],(403,404))
|
||||
self.assertEqual(self.request('/api/users',data=dict(username='crossperson',password='fixture-only',personId=b['id']))[0],404)
|
||||
|
||||
def test_leadership_backup_and_explicit_emergency_handover(self):
|
||||
self.assertEqual(self.leadership()[0],200)
|
||||
# Backup remains operational even if the owner's browser is unavailable.
|
||||
self.assertEqual(self.request('/api/sites',self.backup,dict(name='emergency operation'))[0],200)
|
||||
self.assertEqual(self.leadership(self.backup,revision=1,ownerId=self.backup['id'],successorId='')[0],403)
|
||||
self.assertEqual(self.leadership(self.root,revision=1,ownerId=self.backup['id'],successorId=self.owner['id'],reason='家主无法操作，由超级管理员办理交接')[0],200)
|
||||
home=app.get_object('households',self.aid)
|
||||
self.assertEqual(home['ownerId'],self.backup['id']);self.assertEqual(len(home['leadershipHistory']),2)
|
||||
self.assertEqual(app.get_object('users',self.owner['id'])['role'],'family_admin')
|
||||
self.assertEqual(self.leadership(self.owner,revision=2)[0],403)
|
||||
self.assertEqual(self.request('/api/households',self.members[self.aid])[1]['households'][0].get('leadershipHistory'),None)
|
||||
|
||||
def test_leadership_conflicts_and_account_lockout_prevention(self):
|
||||
self.assertEqual(self.leadership()[0],200)
|
||||
self.assertEqual(self.leadership()[0],409)
|
||||
for uid in (self.owner['id'],self.backup['id']):
|
||||
user=app.get_object('users',uid)
|
||||
for fields in ({'disabled':True},{'role':'member'}):
|
||||
self.assertEqual(self.request('/api/users',self.root,dict(user,**fields))[0],400)
|
||||
self.assertEqual(self.request('/api/users',self.backup,dict(self.owner,password='hijack-password'))[0],403)
|
||||
self.assertEqual(self.leadership(revision=1,successorId=self.other['id'])[0],404)
|
||||
self.assertEqual(self.leadership(revision=1,successorId=self.owner['id'])[0],400)
|
||||
self.assertEqual(self.leadership(revision=1,ownerId=self.members[self.aid]['id'])[0],400)
|
||||
# Editing household metadata must preserve leadership and its history.
|
||||
self.assertEqual(self.request('/api/households',data=dict(id=self.aid,name='renamed'))[0],200)
|
||||
self.assertEqual(app.get_object('households',self.aid)['ownerId'],self.owner['id'])
|
||||
|
||||
def test_legacy_migration_idempotent_preserves_credentials(self):
|
||||
user=app.get_object('users',self.owner['id']);user.pop('familyId')
|
||||
app.save_object('users',user)
|
||||
before=app.DB.execute('SELECT * FROM sessions ORDER BY hash').fetchall()
|
||||
app.HOUSEHOLDS.initialize();app.HOUSEHOLDS.initialize()
|
||||
saved=app.get_object('users',user['id']);self.assertEqual(saved.pop('familyId'),self.aid)
|
||||
self.assertEqual(saved,user)
|
||||
self.assertEqual([tuple(r) for r in before],[tuple(r) for r in app.DB.execute('SELECT * FROM sessions ORDER BY hash')])
|
||||
|
||||
|
||||
if __name__=='__main__': unittest.main()
|
||||
@@ -0,0 +1,32 @@
|
||||
const test=require('node:test'),assert=require('node:assert/strict'),vm=require('node:vm'),fs=require('node:fs');
|
||||
const app=fs.readFileSync('web/app.js','utf8'),homes=fs.readFileSync('web/households.js','utf8');
|
||||
const part=(s,a,b)=>s.slice(s.indexOf(a),s.indexOf(b,s.indexOf(a)+a.length));
|
||||
test('API uses current household scope for each new request',async()=>{
|
||||
const calls=[];const c=vm.createContext({sessionGeneration:0,householdScope:'house-a',fetch:async(p,o)=>{calls.push(o);return {ok:true,json:async()=>({})};}});
|
||||
vm.runInContext(part(app,'async function api(','function toast('),c);
|
||||
await c.api('/api/state');c.householdScope='house-b';await c.api('/api/users',{});
|
||||
assert.equal(calls[0].headers['X-Household-Id'],'house-a');assert.equal(calls[1].headers['X-Household-Id'],'house-b');
|
||||
});
|
||||
test('switch destroys old private state before requesting another household',async()=>{
|
||||
const events=[];const c=vm.createContext({state:{familyId:'a'},currentUser:{id:'root'},isPlatformAdmin:()=>true,
|
||||
clearPrivateView(){events.push('clear');c.currentUser=null;c.state={};},auth:async()=>{events.push('auth');assert.equal(c.householdScope,'b');assert.equal(c.currentUser.id,'root');}});
|
||||
vm.runInContext(part(homes,'async function switchHousehold(','function openHousehold('),c);await c.switchHousehold('b');
|
||||
assert.deepEqual(events,['clear','auth']);
|
||||
});
|
||||
test('family administrator cannot invoke household switching',async()=>{
|
||||
const c=vm.createContext({state:{familyId:'a'},isPlatformAdmin:()=>false,clearPrivateView:()=>{throw Error('should not switch');}});
|
||||
vm.runInContext(part(homes,'async function switchHousehold(','function openHousehold('),c);await c.switchHousehold('b');
|
||||
});
|
||||
test('household switch invalidates outstanding API data',async()=>{
|
||||
let finish;const c=vm.createContext({sessionGeneration:0,householdScope:'a',fetch:()=>new Promise(r=>finish=r)});
|
||||
vm.runInContext(part(app,'async function api(','function toast('),c);
|
||||
const pending=c.api('/api/users');c.sessionGeneration++;c.householdScope='b';finish({ok:true,json:async()=>({users:['private-a']})});
|
||||
await assert.rejects(pending,e=>e.stale===true);
|
||||
});
|
||||
test('owner is visibly distinct from family and super administrators',()=>{
|
||||
const c=vm.createContext({state:{households:[{ownerId:'owner'}]}});
|
||||
vm.runInContext(part(app,'const roleName =','function applyPermissions(')+';globalThis.label=roleName;',c);
|
||||
assert.equal(c.label({id:'owner',role:'family_admin'}),'一家之主');
|
||||
assert.equal(c.label({id:'backup',role:'family_admin'}),'家庭管理员');
|
||||
assert.equal(c.label({id:'root',role:'admin'}),'超级管理员');
|
||||
});
|
||||
+20
-8
@@ -6,22 +6,32 @@ const kind = (v) => ({home:'家庭',company:'公司',other:'其他'}[v] || '其
|
||||
let state = {cameras:[], assets:[], recorders:[], sites:[], storage:{}, scan:{}}, activePage = 'live', loggedIn = false, setup = false;
|
||||
let players = [], liveKey = '', spans = [], queryStart = null, queryEnd = null, queryCamera = '', toastTimer, playbackGeneration = 0;
|
||||
let currentUser = null, sessionGeneration = 0, refreshGeneration = 0, authGeneration = 0;
|
||||
const isAdmin = () => currentUser?.role === 'admin';
|
||||
let householdScope = '';
|
||||
const isPlatformAdmin = () => currentUser?.role === 'admin';
|
||||
const isAdmin = () => ['admin','family_admin'].includes(currentUser?.role);
|
||||
const roleName = user => user.role==='admin'?'超级管理员':user.role==='family_admin'?((state.households||[]).some(h=>h.ownerId===user.id)?'一家之主':'家庭管理员'):'家庭成员';
|
||||
function applyPermissions(){
|
||||
const admin=isAdmin();
|
||||
$('nav [data-page="storage"]').hidden=!isPlatformAdmin();
|
||||
$('#account-password').hidden=!loggedIn;
|
||||
$$('[data-admin],nav [data-page="objects"],nav [data-page="recorders"],nav [data-page="cameras"],nav [data-page="sites"],nav [data-page="storage"],[data-action],[data-edit-camera],[data-camera-settings]').forEach(el=>el.hidden=!admin);
|
||||
$('nav [data-page="storage"]').hidden=!isPlatformAdmin();
|
||||
$('.discovery').hidden=!isPlatformAdmin();
|
||||
$('#scan-result').hidden=!isPlatformAdmin();
|
||||
$('#new-household').hidden=!isPlatformAdmin();
|
||||
$('#household-context').hidden=!loggedIn;
|
||||
$('#household-filter').disabled=!isPlatformAdmin();
|
||||
$('nav [data-page="family"]').hidden=!admin&&(!currentUser||currentUser.familyAccess==='none');
|
||||
$('#current-user').textContent=currentUser ? currentUser.name+' · '+(admin?'管理员':'个人账号') : '';
|
||||
$('#current-user').textContent=currentUser ? currentUser.name+' · '+roleName(currentUser) : '';
|
||||
}
|
||||
function clearPrivateView(){
|
||||
if(typeof clearSnapshot==='function')clearSnapshot();
|
||||
if(typeof clearCameraSettings==='function')clearCameraSettings();
|
||||
sessionGeneration++;refreshGeneration++;authGeneration++;loggedIn=false;
|
||||
if(typeof closePtz==='function')closePtz();if(document.fullscreenElement)document.exitFullscreen().catch(()=>{});
|
||||
currentUser=null;stopPlayers();resetPlayback();
|
||||
currentUser=null;householdScope='';stopPlayers();resetPlayback();
|
||||
state={cameras:[],assets:[],recorders:[],sites:[],storage:{},scan:{}};
|
||||
for(const id of ['live-grid','asset-list','camera-list','recorder-list','site-list','audit-list','family-people','family-detail','family-tree','user-list'])$('#'+id).replaceChildren();
|
||||
for(const id of ['live-grid','asset-list','camera-list','recorder-list','site-list','audit-list','family-people','family-detail','family-tree','user-list','household-list'])$('#'+id).replaceChildren();
|
||||
if(typeof clearFamilyState==='function')clearFamilyState();
|
||||
$$('dialog[open]').filter(d=>d.id!=='auth-dialog').forEach(d=>d.close());
|
||||
$$('dialog form').forEach(f=>f.reset());
|
||||
@@ -30,7 +40,7 @@ function clearPrivateView(){
|
||||
const pageInfo = {live:['实时画面','从一个空间，看到每一个位置。'],playback:['录像回放','沿着时间，找回需要的画面。'],cameras:['镜头通道','为摄像头的每个镜头配置独立通道。'],objects:['摄像头对象','实体设备、镜头通道与空间，明确关联。'],recorders:['录像机','连接现有录像与各个现场通道。'],sites:['空间档案','地区、场所、楼栋与门牌，清楚关联每一个镜头。'],storage:['录像与存储','让记录持续，也让磁盘留有余地。']};
|
||||
async function api(path, data) {
|
||||
const generation=sessionGeneration;
|
||||
const r = await fetch(path, {method:data === undefined ? 'GET' : 'POST', headers:data === undefined ? {} : {'Content-Type':'application/json'}, body:data === undefined ? undefined : JSON.stringify(data)});
|
||||
const r = await fetch(path, {method:data === undefined ? 'GET' : 'POST', headers:{...(data === undefined ? {} : {'Content-Type':'application/json'}),...(typeof householdScope!=='undefined'&&householdScope?{'X-Household-Id':householdScope}:{})}, body:data === undefined ? undefined : JSON.stringify(data)});
|
||||
let result; try { result = await r.json(); } catch { throw Error('服务返回异常，请稍后重试'); }
|
||||
if(generation!==sessionGeneration)throw Object.assign(Error('登录会话已变化，请重新操作'),{stale:true});
|
||||
if (!r.ok) { if (r.status === 401 && loggedIn) { clearPrivateView(); auth(); } throw Object.assign(Error(result.error || '操作未完成'),{status:r.status}); }
|
||||
@@ -44,11 +54,12 @@ function setOptions(select, html) { const old = select.value; select.innerHTML =
|
||||
function stopPlayers() { players.forEach(p => p.destroy()); players = []; $$('#live-grid video').forEach(v => {v.pause();v.removeAttribute('src');v.load();}); liveKey = ''; }
|
||||
function showPage(page) {
|
||||
if(!isAdmin()&&!['live','playback','family'].includes(page))return;
|
||||
if(page==='storage'&&!isPlatformAdmin())return;
|
||||
if (activePage !== page) {stopPlayers();if(typeof closePtz==='function')closePtz();}
|
||||
if(page!=='family'&&typeof closeFamilyFullscreen==='function')closeFamilyFullscreen();
|
||||
activePage = page;
|
||||
$('.metrics').hidden=['family','users'].includes(page);
|
||||
$('.filter-row').hidden=['family','users'].includes(page);
|
||||
$('.metrics').hidden=['family','users','households'].includes(page);
|
||||
$('.filter-row').hidden=['family','users','households'].includes(page);
|
||||
$$('.page').forEach(el => el.hidden = el.id !== 'page-' + page);
|
||||
$$('nav button').forEach(b => b.classList.toggle('active', b.dataset.page === page));
|
||||
$('#page-title').textContent = pageInfo[page][0]; $('#page-note').textContent = pageInfo[page][1];
|
||||
@@ -79,13 +90,14 @@ function render() {
|
||||
drawTimeline();
|
||||
}
|
||||
if (activePage === 'storage') renderStorage();
|
||||
if(typeof renderHouseholds==='function')renderHouseholds();
|
||||
applyPermissions();
|
||||
if(activePage==='live'&&typeof wallSync==='function')wallSync();
|
||||
}
|
||||
function empty(title, description, button) { return `<div class="empty"><h3>${esc(title)}</h3><p>${esc(description)}</p>${button || ''}</div>`; }
|
||||
function renderLive() {
|
||||
const cameras = filtered(), quality = $('#quality').value;
|
||||
const key = ZhaoLivePlayer.key(cameras, quality);
|
||||
const key = (currentUser?.role||'')+':'+(state.familyId||'')+':'+ZhaoLivePlayer.key(cameras, quality);
|
||||
if (key === liveKey) { updateLiveStatus(cameras); return; }
|
||||
stopPlayers(); liveKey = key;
|
||||
$('#live-grid').innerHTML = cameras.length ? cameras.map(c=>`<article class="camera-card"><div class="wall-reorder"><span draggable="false" data-wall-drag="${c.id}" title="拖动排列">⠿ 拖动</span><button class="quiet" data-wall-before="${c.id}" aria-label="${esc(c.name)}前移">前移</button><button class="quiet" data-wall-after="${c.id}" aria-label="${esc(c.name)}后移">后移</button></div><div class="video-panel"><video data-camera="${c.id}" muted playsinline controls></video><div class="video-empty"><span class="lens">◎</span><span>${c.enabled ? '正在等待画面' : '设备连接已停用'}</span></div><div class="video-error" hidden></div></div><div class="camera-meta"><div><strong>${esc(c.name)}</strong><p>${esc(siteName(c.siteId)+' · '+(c.point || '安装位置待填写'))}</p></div><span class="badge ${c.ready?'':'off'}">${c.recordingActive ? '● 正在录像' : c.ready ? '码流已接通' : c.enabled ? '等待接通' : '已停用'}</span></div><div class="camera-actions"><button class="quiet" data-edit-camera="${c.id}">设备配置</button><button class="quiet" data-camera-settings="${c.id}">摄像机设置</button><button class="quiet" data-play-camera="${c.id}">查看录像</button><button class="quiet" data-snapshot-camera="${c.id}">截图</button><button class="quiet" data-ptz-camera="${c.id}" hidden>云台控制</button></div></article>`).join('') : (isAdmin()?empty('先接入一台摄像头','建立空间档案，再把设备添加到对应位置。','<button data-action="new-camera">＋ 添加摄像头</button>'):empty('当前范围没有可查看的摄像头','请选择已授权空间，或联系管理员配置观看权限。'));
|
||||
|
||||
@@ -76,6 +76,9 @@ header p { color: #686f60; font-size: 12px; letter-spacing: .5px; }
|
||||
.metrics span { color: #6f7260; }
|
||||
.metrics strong { font-family: Georgia, var(--serif); color: #365846; font-size: 29px; }
|
||||
.filter-row { color: #6e6b5f; margin: 24px 0; }
|
||||
.household-context { display: flex; flex-wrap: wrap; align-items: center; gap: 12px 24px; margin: -5px 0 24px; padding: 12px 16px; border-left: 3px solid var(--gold); background: #eae8dc; }
|
||||
.household-context span { font-size: 11px; color: var(--muted); }
|
||||
.household-context select { min-width: 140px; max-width: 240px; }
|
||||
.section-head { margin-top: 25px; }
|
||||
.section-head small { color: #8a7859; font-size: 9px; letter-spacing: 2px; }
|
||||
.wall-toolbar { padding: 12px 15px; background: #eae8dc; border: 1px solid var(--line); border-radius: 5px; gap: 14px; }
|
||||
@@ -243,3 +246,5 @@ footer { color: #716b5b; font-size: 10px; letter-spacing: .5px; }
|
||||
footer { gap: 16px; flex-wrap: wrap; font-size: 9px; }
|
||||
}
|
||||
@media (prefers-reduced-motion: reduce) { *, *::before, *::after { scroll-behavior: auto !important; transition: none !important; } }
|
||||
|
||||
.household-actions{display:flex;gap:10px;flex-wrap:wrap;margin:18px 0}.household-context select{max-width:100%}.household-context label{min-width:0}
|
||||
|
||||
+2
-1
@@ -67,13 +67,14 @@ for(const [name,path]of [['person','person'],['relation','link']]){
|
||||
async function loadUsers(){
|
||||
if(!isAdmin())return;const id=currentUser.id;
|
||||
try{const [u,f]=await Promise.all([api('/api/users'),api('/api/family')]);if(!loggedIn||currentUser?.id!==id)return;users=u.users;family=f;
|
||||
$('#user-list').innerHTML=`<div class="table-wrap"><table class="device-table"><thead><tr><th>账号</th><th>角色 / 状态</th><th>人物关系</th><th>家谱权限</th><th>摄像头空间</th><th></th></tr></thead><tbody>${users.map(u=>`<tr><td>${esc(u.name)}<small>${esc(u.username)}</small></td><td>${u.role==='admin'?'管理员':'个人账号'}${u.disabled?' · 已停用':''}</td><td>${u.relationship==='本人'&&u.relatedToId===u.id?'本人':u.relationship?esc(u.name+' 是 '+(users.find(x=>x.id===u.relatedToId)?.name||'（参照待指定）')+' 的 '+u.relationship):'未设置'}<small>家谱：${esc(personName(u.personId))}</small></td><td>${u.role==='admin'?'管理':({none:'不可访问',read:'查看',edit:'录入和维护'}[u.familyAccess])}</td><td>${u.role==='admin'?'全部空间':esc(u.siteIds.map(siteName).join('、')||'未授权')}</td><td><button class="quiet" data-edit-user="${u.id}">编辑账号</button></td></tr>`).join('')}</tbody></table></div>`;
|
||||
$('#user-list').innerHTML=`<div class="table-wrap"><table class="device-table"><thead><tr><th>账号</th><th>角色 / 状态</th><th>人物关系</th><th>家谱权限</th><th>摄像头空间</th><th></th></tr></thead><tbody>${users.map(u=>`<tr><td>${esc(u.name)}<small>${esc(u.username)}</small></td><td>${roleName(u)}${u.disabled?' · 已停用':''}</td><td>${u.relationship==='本人'&&u.relatedToId===u.id?'本人':u.relationship?esc(u.name+' 是 '+(users.find(x=>x.id===u.relatedToId)?.name||'（参照待指定）')+' 的 '+u.relationship):'未设置'}<small>家谱：${esc(personName(u.personId))}</small></td><td>${u.role!=='member'?'管理本家庭':({none:'不可访问',read:'查看',edit:'录入和维护'}[u.familyAccess])}</td><td>${u.role!=='member'?'本家庭全部空间':esc(u.siteIds.map(siteName).join('、')||'未授权')}</td><td><button class="quiet" data-edit-user="${u.id}">编辑账号</button></td></tr>`).join('')}</tbody></table></div>`;
|
||||
}catch(e){toast(e.message);}
|
||||
}
|
||||
function openUser(id){
|
||||
if(!isAdmin())return;const f=$('#user-form'),u=users.find(u=>u.id===id)||{};
|
||||
f.elements.personId.innerHTML=peopleOptions();f.elements.relatedToId.innerHTML='<option value="">尚未指定</option>'+users.map(u=>`<option value="${u.id}">${esc(u.name+' / '+u.username)}</option>`).join('');
|
||||
fillForm(f,u);f.elements.password.required=!u.id;
|
||||
f.elements.role.querySelector('[value=admin]').hidden=!isPlatformAdmin();
|
||||
$('#user-sites').innerHTML=state.sites.map(s=>`<label class="check"><input type="checkbox" name="siteIds" value="${s.id}" ${(u.siteIds||[]).includes(s.id)?'checked':''}>${esc(s.name)}</label>`).join('');$('#user-dialog').showModal();
|
||||
}
|
||||
$('#user-form').addEventListener('submit',async e=>{e.preventDefault();const f=e.currentTarget,b=f.querySelector('[type=submit]');b.disabled=true;try{const d=formValues(f);d.siteIds=[...f.querySelectorAll('[name=siteIds]:checked')].map(el=>el.value);d.disabled=f.elements.disabled.checked;d.ptzControl=f.elements.ptzControl.checked;await api('/api/users',d);f.closest('dialog').close();await auth();if(loggedIn)await loadUsers();toast('账号已保存');}catch(err){f.querySelector('.form-error').textContent=err.message;}finally{b.disabled=false;}});
|
||||
|
||||
@@ -0,0 +1,56 @@
|
||||
'use strict';
|
||||
pageInfo.households=['家庭管理','一户一家园，资料各有归属。'];
|
||||
function renderHouseholds(){
|
||||
const homes=state.households||[];
|
||||
setOptions($('#household-filter'),homes.map(h=>`<option value="${esc(h.id)}">${esc(h.name)}</option>`).join(''));
|
||||
$('#household-filter').value=state.familyId||'';
|
||||
if(activePage!=='households')return;
|
||||
$('#household-list').innerHTML=homes.map(h=>`<article class="site-card"><div class="site-heading"><span class="badge">${h.id===state.familyId?'当前家庭':'独立家庭'}</span><button class="quiet" data-edit-household="${esc(h.id)}">编辑档案</button></div><h3>${esc(h.name)}</h3><p class="description">${esc(h.note||'一户一家园')}</p><dl><div><dt>一家之主</dt><dd>${esc(h.ownerName||'待指定')}</dd></div><div><dt>备用负责人</dt><dd>${esc(h.successorName||'待指定')}</dd></div><div><dt>账号 / 空间</dt><dd>${h.members} 个 / ${h.sites} 处</dd></div></dl>${!h.successorId?'<p class="description">尚未指定备用负责人，建议提前安排家人接管。</p>':''}<div class="household-actions"><button class="secondary" data-enter-household="${esc(h.id)}">${h.id===state.familyId?'管理本家庭成员':'进入该家庭'}</button>${h.canAssignOwner?`<button class="quiet" data-leadership="${esc(h.id)}">家主与权限交接</button>`:''}</div>${h.leadershipHistory?.length?`<details><summary>交接记录</summary>${h.leadershipHistory.slice().reverse().map(r=>`<p class="description">${esc(new Date(r.at).toLocaleString())} · ${esc(r.actor)}<br>${esc(r.reason)}</p>`).join('')}</details>`:''}</article>`).join('');
|
||||
}
|
||||
async function switchHousehold(id){
|
||||
if(!isPlatformAdmin()||!id||id===state.familyId)return;
|
||||
const user=currentUser;
|
||||
// Invalidate outstanding API responses, video players and dialogs before changing scope.
|
||||
clearPrivateView();
|
||||
householdScope=id;currentUser=user;loggedIn=true;
|
||||
await auth();
|
||||
}
|
||||
function openHousehold(id){
|
||||
if(!isAdmin())return;
|
||||
const item=(state.households||[]).find(h=>h.id===id);
|
||||
if(!item&&!isPlatformAdmin())return;
|
||||
fillForm($('#household-form'),item||{});$('#household-dialog').showModal();
|
||||
}
|
||||
async function openLeadership(id){
|
||||
try{
|
||||
if(id!==state.familyId)await switchHousehold(id);
|
||||
const home=(state.households||[]).find(h=>h.id===id);
|
||||
if(!home?.canAssignOwner)return;
|
||||
const result=await api('/api/users');
|
||||
const candidates=result.users.filter(u=>u.role==='family_admin'&&!u.disabled);
|
||||
const f=$('#leadership-form'),options=candidates.map(u=>`<option value="${esc(u.id)}">${esc(u.name+' / '+u.username)}</option>`).join('');
|
||||
f.elements.ownerId.innerHTML='<option value="">请选择一家之主</option>'+options;
|
||||
f.elements.successorId.innerHTML='<option value="">暂未指定</option>'+options;
|
||||
fillForm(f,{id:home.id,revision:home.leadershipRevision||0,ownerId:home.ownerId||'',successorId:home.successorId||''});
|
||||
$('#leadership-dialog').showModal();
|
||||
}catch(error){if(!error.stale)toast(error.message);}
|
||||
}
|
||||
$('#leadership-form').addEventListener('submit',async e=>{
|
||||
e.preventDefault();const f=e.currentTarget,b=f.querySelector('[type=submit]');b.disabled=true;
|
||||
try{const d=formValues(f);d.revision=Number(d.revision);await api('/api/households/leadership',d);f.closest('dialog').close();await refresh();showPage('households');toast('家庭负责人已更新，交接记录已保存');}
|
||||
catch(error){if(!error.stale)f.querySelector('.form-error').textContent=error.message;}finally{b.disabled=false;}
|
||||
});
|
||||
$('#household-filter').onchange=e=>switchHousehold(e.target.value);
|
||||
$('#new-household').onclick=()=>openHousehold();
|
||||
$('#household-form').addEventListener('submit',async e=>{
|
||||
e.preventDefault();const f=e.currentTarget,b=f.querySelector('[type=submit]');b.disabled=true;
|
||||
try{await api('/api/households',formValues(f));f.closest('dialog').close();await refresh();toast('家庭档案已保存');}
|
||||
catch(error){if(!error.stale)f.querySelector('.form-error').textContent=error.message;}
|
||||
finally{b.disabled=false;}
|
||||
});
|
||||
document.addEventListener('click',async e=>{
|
||||
const b=e.target.closest('button');if(!b)return;
|
||||
if(b.dataset.editHousehold)openHousehold(b.dataset.editHousehold);
|
||||
if(b.dataset.leadership)await openLeadership(b.dataset.leadership);
|
||||
if(b.dataset.enterHousehold){await switchHousehold(b.dataset.enterHousehold);if(loggedIn)showPage('users');}
|
||||
});
|
||||
+8
-3
@@ -6,7 +6,7 @@
|
||||
<script defer src="/vendor/hls.min.js?v=__ASSET_VERSION__"></script><script defer src="/live-player.js?v=__ASSET_VERSION__"></script><script defer src="/kinship.js?v=__ASSET_VERSION__"></script><script defer src="/family-graph.js?v=__ASSET_VERSION__"></script><script defer src="/calendar.js?v=__ASSET_VERSION__"></script><script defer src="/app.js?v=__ASSET_VERSION__"></script><script defer src="/monitor.js?v=__ASSET_VERSION__"></script><script defer src="/date-fields.js?v=__ASSET_VERSION__"></script><script defer src="/family-map.js?v=__ASSET_VERSION__"></script><script defer src="/family.js?v=__ASSET_VERSION__"></script><script defer src="/family-events.js?v=__ASSET_VERSION__"></script>
|
||||
<script defer src="/family-history.js?v=__ASSET_VERSION__"></script>
|
||||
<script defer src="/camera-settings.js?v=__ASSET_VERSION__"></script>
|
||||
<script defer src="/recording-ranges.js?v=__ASSET_VERSION__"></script><script defer src="/recording-ui.js?v=__ASSET_VERSION__"></script><script defer src="/snapshot.js?v=__ASSET_VERSION__"></script>
|
||||
<script defer src="/recording-ranges.js?v=__ASSET_VERSION__"></script><script defer src="/recording-ui.js?v=__ASSET_VERSION__"></script><script defer src="/snapshot.js?v=__ASSET_VERSION__"></script><script defer src="/households.js?v=__ASSET_VERSION__"></script>
|
||||
</head>
|
||||
<body>
|
||||
<aside class="sidebar">
|
||||
@@ -16,6 +16,7 @@
|
||||
<button data-page="live" class="active">◫ <span>实时画面</span></button>
|
||||
<button data-page="playback">◷ <span>录像回放</span></button>
|
||||
<button data-page="family">♧ <span>家谱</span></button>
|
||||
<button data-page="households" data-admin>⌂ <span>家庭管理</span></button>
|
||||
<button data-page="users" data-admin>♙ <span>账号与关系</span></button>
|
||||
<button data-page="objects">▣ <span>摄像头对象</span></button><button data-page="recorders">▤ <span>录像机</span></button><button data-page="cameras">◫ <span>镜头通道</span></button>
|
||||
<button data-page="sites">⌂ <span>空间档案</span></button>
|
||||
@@ -26,6 +27,7 @@
|
||||
</aside>
|
||||
<main>
|
||||
<header><svg class="courtyard-landscape" viewBox="0 0 360 130" fill="none" aria-hidden="true"><path d="M0 124 55 86 76 99 134 43 166 78 197 56 247 102 282 81 337 121" fill="#d7dfcd"/><path d="M60 127 128 89 158 107 214 71 273 115 312 96 359 126" fill="#bdcbb6" fill-opacity=".48"/><path d="m12 125 64-40 17 13 42-46 30 37m49-18 29 28 13-5 28 21" stroke="#879b7d" stroke-width=".8"/><circle cx="269" cy="47" r="16" fill="#a25440" fill-opacity=".48"/><path d="M21 126h332" stroke="#81936e" stroke-width=".7"/></svg><div><div class="eyebrow">赵氏家宅 · 起居有序</div><h1 id="page-title">实时画面</h1><p id="page-note">从一个空间，看到每一个位置。</p></div><div class="header-status"><span id="service-status" class="badge">等待连接</span><span id="clock"></span></div></header>
|
||||
<div id="household-context" class="household-context" hidden><label>当前家庭 <select id="household-filter" aria-label="当前家庭"></select></label><span>设备、录像与家谱按家庭隔离</span></div>
|
||||
<div id="banner" class="banner" hidden></div>
|
||||
<section class="metrics"><div><span>摄像头</span><strong id="metric-all">—</strong></div><div><span>已接通码流</span><strong id="metric-ready">—</strong></div><div><span>录像占用</span><strong id="metric-used">—</strong></div><div><span>空间档案</span><strong id="metric-sites">—</strong></div></section>
|
||||
<div class="filter-row"><label>空间范围 <select id="site-filter"><option value="">全部空间</option></select></label><span id="filter-caption">家庭与公司，分别管理</span><button id="refresh" class="quiet">↻ 刷新状态</button></div>
|
||||
@@ -63,7 +65,8 @@
|
||||
<aside id="family-detail" class="panel family-inspector" aria-label="人物档案"></aside>
|
||||
</div>
|
||||
</section>
|
||||
<section id="page-users" class="page" hidden><div class="section-head"><h2>账号与人物关系 <small>ACCOUNTS</small></h2><button id="new-user">＋ 新建账号</button></div><p class="description">亲属称呼用于描述人物关系。摄像头空间权限、家谱权限和管理员身份分别设置。无需为每一位家谱人物创建账号。</p><div id="user-list"></div></section>
|
||||
<section id="page-households" class="page" hidden><div class="section-head"><h2>各有家园 <small>家宅 · 归属</small></h2><button id="new-household">＋ 新建家庭</button></div><p class="description">每个家庭独立管理自己的成员、空间、设备和家谱。家庭管理员只管理本家庭；超级管理员负责建立家庭与分配管理账号。</p><div id="household-list" class="site-grid"></div></section>
|
||||
<section id="page-users" class="page" hidden><div class="section-head"><h2>账号与人物关系 <small>ACCOUNTS</small></h2><button id="new-user">＋ 新建账号</button></div><p class="description">这里只管理当前家庭的账号。新账号默认没有摄像头或家谱访问权限；可按需授权。亲属称呼与管理权限分别设置，无需为每位家谱人物创建账号。</p><div id="user-list"></div></section>
|
||||
<footer><span>赵府智家 · 家庭空间</span><span id="version">独立部署 / 数据自有</span></footer>
|
||||
</main>
|
||||
<dialog id="auth-dialog"><form id="auth-form"><span class="eyebrow">灯火可亲 · 归家有时</span><h2 id="auth-title">欢迎回来</h2><p id="auth-note">使用自己的账号，进入家庭空间。</p><label id="setup-code-label" hidden>初始化码<input name="code" autocomplete="off"></label><label>用户名<input name="username" value="admin" maxlength="32" required autocomplete="username"></label><label>密码<input name="password" type="password" minlength="8" maxlength="128" required autocomplete="current-password"></label><p class="form-error"></p><button type="submit" class="wide">进入系统</button></form></dialog>
|
||||
@@ -71,7 +74,9 @@
|
||||
<dialog id="camera-dialog"><form id="camera-form"><div class="dialog-heading"><h2>镜头通道配置</h2><button type="button" class="quiet" data-close="camera-dialog">关闭</button></div><input name="id" type="hidden"><div class="form-grid"><label class="full">所属摄像头对象 *<select name="assetId" required></select></label><label>接入方式<select name="sourceKind"><option value="recorder">通过录像机</option><option value="direct">直接连接摄像头</option></select></label><label>关联录像机<select name="recorderId"><option value="">请选择</option></select></label><label>录像机通道编号<input name="channelNumber" maxlength="30" placeholder="按录像机实际通道填写"></label><label>录像存储设备<select name="archiveRecorderId"><option value="">尚未绑定</option></select></label><label>历史录像主要保存于<select name="archiveSource"><option value="recorder">录像机</option><option value="local">本机</option></select></label><label>镜头 / 通道名称 *<input name="name" required maxlength="120" placeholder="例如：大门口"></label><label>所属空间 *<select name="siteId" required></select></label><label>安装位置<input name="point" maxlength="120" placeholder="例如：院门外侧"></label><label>品牌 / 型号<input name="model" maxlength="120"></label><label>设备 IP *<input name="host" required placeholder="局域网 IPv4 地址"></label><label>RTSP 端口<input name="port" type="number" value="554" min="1" max="65535" required></label><label>设备用户名<input name="username" maxlength="120" autocomplete="off"></label><label>设备密码<input name="password" type="password" maxlength="256" autocomplete="new-password" placeholder="编辑时留空，保留原密码"></label><div class="full"><button id="onvif-read" type="button" class="secondary">读取 ONVIF 镜头配置</button><p class="description">直接接入摄像头时，可读取设备实际提供的媒体配置。默认 ONVIF HTTP 端口为 80。</p><div id="onvif-result"></div></div><label class="full">常见码流路径<select id="path-preset"><option value="custom">手动填写</option><option value="tplink">TP-Link 单镜头</option><option value="hikvision">海康威视 / 兼容路径 · 通道 1</option><option value="dahua">大华 / 兼容路径 · 通道 1</option></select></label><label class="full">主码流路径 *<input name="mainPath" required maxlength="500" value="/stream1"></label><label class="full">子码流路径 *<input name="subPath" required maxlength="500" value="/stream2"></label><label class="check"><input name="enabled" type="checkbox" checked>启用连接</label><label class="check"><input name="record" type="checkbox">在小电脑额外保存录像（可选）</label></div><p class="description">账号和密码只保存在本机受限数据目录。RTSP 服务响应代表设备可达，实际码流接通后才显示在线。路径预设需要与设备型号、通道一致。</p><p class="form-error"></p><div class="dialog-footer"><button type="submit">保存设备</button></div></form></dialog>
|
||||
<dialog id="asset-dialog"><form id="asset-form"><div class="dialog-heading"><h2>摄像头对象</h2><button type="button" class="quiet" data-close="asset-dialog">关闭</button></div><input name="id" type="hidden"><div class="form-grid"><label>对象名称 *<input name="name" required maxlength="120" placeholder="例如：院门双镜头摄像头"></label><label>所属空间 *<select name="siteId" required></select></label><label>品牌<input name="brand" maxlength="120"></label><label>型号<input name="model" maxlength="120"></label><label>序列号<input name="serial" maxlength="120"></label><label>物理镜头数<input name="lensCount" type="number" value="2" min="1" max="16" required></label><label>安装位置<input name="point" maxlength="120"></label><label>备注<input name="note" maxlength="120"></label></div><p class="form-error"></p><div class="dialog-footer"><button type="submit">保存对象</button></div></form></dialog>
|
||||
<dialog id="recorder-dialog"><form id="recorder-form"><div class="dialog-heading"><h2>录像机配置</h2><button type="button" class="quiet" data-close="recorder-dialog">关闭</button></div><input name="id" type="hidden"><div class="form-grid"><label>录像机名称 *<input name="name" required maxlength="120"></label><label>所属空间 *<select name="siteId" required></select></label><label>品牌<input name="brand" maxlength="120"></label><label>型号<input name="model" maxlength="120"></label><label>录像机 IP *<input name="host" required></label><label>RTSP 端口<input name="port" type="number" value="554" min="1" max="65535" required></label><label>登录用户名<input name="username" maxlength="120" autocomplete="off"></label><label>设备密码<input name="password" type="password" maxlength="256" placeholder="留空保留原密码" autocomplete="new-password"></label><label class="full">接入驱动<select name="driver"><option value="generic-rtsp">通用 RTSP / 手动通道路径</option><option value="hikvision-rtsp">海康 / 兼容型号 RTSP 路径</option><option value="tplink-rtsp">TP-Link RTSP 路径</option><option value="dahua-rtsp">大华 / 兼容型号 RTSP 路径</option></select></label></div><p class="description">驱动在当前版本提供路径模板。录像机历史录像检索、回放及通道自动导入，需要型号确认后接入，当前尚未实现。</p><p class="form-error"></p><div class="dialog-footer"><button type="submit">保存录像机</button></div></form></dialog>
|
||||
<dialog id="user-dialog"><form id="user-form"><div class="dialog-heading"><h2>账号档案</h2><button type="button" class="quiet" data-close="user-dialog">关闭</button></div><input name="id" type="hidden"><div class="form-grid"><label>用户名 *<input name="username" required minlength="3" maxlength="32" autocomplete="off"></label><label>显示名称 *<input name="name" required maxlength="80"></label><label>密码<input name="password" type="password" minlength="8" maxlength="128" autocomplete="new-password" placeholder="编辑时留空保留"></label><label>系统角色<select name="role"><option value="member">个人账号</option><option value="admin">管理员</option></select></label><label>家谱权限<select name="familyAccess"><option value="none">不可访问</option><option value="read">查看家谱</option><option value="edit">录入和维护家谱</option></select></label><label>关联家谱人物<select name="personId"></select></label><label>这个账号是<select name="relatedToId"></select></label><label>的什么关系<input name="relationship" list="relationship-choices" maxlength="40" placeholder="可选择或自行填写"></label><fieldset class="full"><legend>允许查看摄像头的空间</legend><div id="user-sites"></div><p class="description">个人账号仅能观看已选空间的实时画面和回放；管理员可以管理全部空间。</p></fieldset><label class="check"><input name="ptzControl" type="checkbox">允许控制已授权空间的摄像头云台</label><label class="check"><input name="disabled" type="checkbox">停用账号</label></div><p class="form-error"></p><div class="dialog-footer"><button type="submit">保存账号</button></div></form></dialog>
|
||||
<dialog id="leadership-dialog"><form id="leadership-form"><div class="dialog-heading"><h2>家主与权限交接</h2><button type="button" class="quiet" data-close="leadership-dialog">关闭</button></div><input name="id" type="hidden"><input name="revision" type="hidden"><p class="description">先在本家庭建立至少两位家庭管理员，再指定家主和备用负责人。备用负责人现在就能管理本家庭的设备与成员；家主无法操作时可继续管理，并联系超级管理员办理家主身份交接。</p><div class="form-grid"><label>一家之主 *<select name="ownerId" required></select></label><label>备用负责人<select name="successorId"></select></label><label class="full">安排 / 交接说明 *<textarea name="reason" required maxlength="300" rows="3" placeholder="说明负责人安排或本次交接原因"></textarea></label></div><p class="description">交接后原家主仍保留家庭管理员权限。系统不会依据未登录或家谱去世日期自动转移权限；交接记录可追溯。</p><p class="form-error" role="status"></p><div class="dialog-footer"><button type="submit">确认保存负责人安排</button></div></form></dialog>
|
||||
<dialog id="household-dialog"><form id="household-form"><div class="dialog-heading"><h2>家庭档案</h2><button type="button" class="quiet" data-close="household-dialog">关闭</button></div><input name="id" type="hidden"><div class="form-grid"><label class="full">家庭名称 *<input name="name" maxlength="80" required placeholder="例如：赵府、王家"></label><label class="full">备注<textarea name="note" maxlength="300" rows="3"></textarea></label></div><p class="description">创建后，进入该家庭的“账号与关系”，建立家庭管理员，再分配设备和空间。</p><p class="form-error"></p><div class="dialog-footer"><button type="submit">保存家庭</button></div></form></dialog>
|
||||
<dialog id="user-dialog"><form id="user-form"><div class="dialog-heading"><h2>账号档案</h2><button type="button" class="quiet" data-close="user-dialog">关闭</button></div><input name="id" type="hidden"><div class="form-grid"><label>用户名 *<input name="username" required minlength="3" maxlength="32" autocomplete="off"></label><label>显示名称 *<input name="name" required maxlength="80"></label><label>密码<input name="password" type="password" minlength="8" maxlength="128" autocomplete="new-password" placeholder="编辑时留空保留"></label><label>账号角色<select name="role"><option value="member">家庭成员</option><option value="family_admin">家庭管理员</option><option value="admin">超级管理员</option></select></label><label>家谱权限<select name="familyAccess"><option value="none">不可访问</option><option value="read">查看家谱</option><option value="edit">录入和维护家谱</option></select></label><label>关联家谱人物<select name="personId"></select></label><label>这个账号是<select name="relatedToId"></select></label><label>的什么关系<input name="relationship" list="relationship-choices" maxlength="40" placeholder="可选择或自行填写"></label><fieldset class="full"><legend>允许查看摄像头的空间</legend><div id="user-sites"></div><p class="description">家庭成员仅能观看本家庭已选空间的实时画面和回放；家庭管理员可以管理本家庭全部空间。超级管理员负责整个平台。</p></fieldset><label class="check"><input name="ptzControl" type="checkbox">允许控制已授权空间的摄像头云台</label><label class="check"><input name="disabled" type="checkbox">停用账号</label></div><p class="form-error"></p><div class="dialog-footer"><button type="submit">保存账号</button></div></form></dialog>
|
||||
<datalist id="relationship-choices"></datalist>
|
||||
<dialog id="person-dialog"><form id="person-form"><div class="dialog-heading"><h2>家谱人物</h2><button type="button" class="quiet" data-close="person-dialog">关闭</button></div><input name="id" type="hidden"><input name="revision" type="hidden"><div class="form-grid"><label>姓名 / 称呼 *<input name="name" required maxlength="80" placeholder="姓名暂不知时可先填称呼"></label><label>别名 / 字 / 号<input name="alias" maxlength="120"></label><label>性别<select name="gender"><option value="unknown">待确认</option><option value="male">男</option><option value="female">女</option></select></label><label>在世情况<select name="lifeStatus"><option value="alive">在世</option><option value="deceased">不在世</option><option value="unknown">待确认</option></select></label><fieldset class="family-date" data-date-field="birthDate"><legend>出生日期</legend><input name="birthDate" type="hidden"><label>历法<select data-calendar aria-label="出生日期历法"><option value="solar">公历</option><option value="lunar">农历</option></select></label><label>日期<input data-date-value aria-label="出生日期" type="text" inputmode="numeric" placeholder="YYYY-MM-DD" maxlength="10"></label><label data-leap-label class="check" hidden><input data-date-leap type="checkbox">闰月</label><output data-date-hint aria-live="polite">日期不详可留空</output></fieldset><fieldset class="family-date" data-date-field="deathDate" hidden><legend>去世日期</legend><input name="deathDate" type="hidden"><label>历法<select data-calendar aria-label="去世日期历法"><option value="solar">公历</option><option value="lunar">农历</option></select></label><label>日期<input data-date-value aria-label="去世日期" type="text" inputmode="numeric" placeholder="YYYY-MM-DD" maxlength="10"></label><label data-leap-label class="check" hidden><input data-date-leap type="checkbox">闰月</label><output data-date-hint aria-live="polite">日期不详可留空</output></fieldset><label class="full">籍贯 / 出生地<input name="birthplace" maxlength="160"></label><label class="full">生平简介<textarea name="biography" rows="4" maxlength="2000"></textarea></label><label class="full">备注 / 信息来源<textarea name="note" rows="3" maxlength="500" placeholder="例如：长辈口述、族谱记载、待考证信息"></textarea></label><label class="check"><input name="archived" type="checkbox">归档人物（保留关系，可恢复）</label></div><p class="form-error"></p><div class="dialog-footer"><button type="submit">保存人物</button></div></form></dialog>
|
||||
<dialog id="relation-dialog"><form id="relation-form"><div class="dialog-heading"><h2>连接人物关系</h2><button type="button" class="quiet" data-close="relation-dialog">关闭</button></div><input name="id" type="hidden"><input name="revision" type="hidden"><div class="form-grid"><label>关系类型<select name="kind"><option value="parent">父母 → 子女</option><option value="spouse">配偶 ↔ 配偶</option></select></label><label>亲子属性<select name="lineage"><option value="unspecified">未注明</option><option value="biological">亲生</option><option value="adoptive">收养</option><option value="step">继亲</option></select></label><label>父母一方 / 配偶一方<select name="fromId" required></select></label><label>子女 / 另一位配偶<select name="toId" required></select></label><label class="full">关系备注<input name="note" maxlength="300"></label><label class="check"><input name="active" type="checkbox" checked>关系有效（取消后保留记录，可恢复）</label></div><p class="description">每条亲子关系连接一位父母与一位子女。录入另一位父母时，再建立一条关系。</p><p class="form-error"></p><div class="dialog-footer"><button type="submit">保存关系</button></div></form></dialog>
|
||||
|
||||
Reference in New Issue
Block a user