Tweaks (#24684)

* bound recording snapshot lookups by segment length

Ordering the recording snapshot and Frigate+ lookups by stream_type ahead of start_time broke index order, so SQLite fetched and sorted every older recording for the camera on each request (about 100 ms on a 30 day camera, run on the event loop). A start_time lower bound of the frame time minus MAX_SEGMENT_DURATION keeps the lookup to a few rows.

* bound recording overlap queries by segment length

Clip, export, review and recording deletion, debug replay, motion search, and audio transcription found overlapping recordings with an OR clause that gave SQLite no start_time range, so every call read the camera's whole recording history (30 to 300 ms on a 30 day database). The classification and review description point lookups did the same whenever the timestamp had no recording. A shared recording_overlap helper now adds a start_time lower bound of MAX_SEGMENT_DURATION before the range, which drops no rows because segments are always shorter than that.

* probe webrtc before reporting it as not configured

The WebRTC gate read only the Frigate config, so an install with no go2rtc candidates showed WebRTC as not configured, even though go2rtc fills in default candidates at startup (including the internal one under the HA app) and WebRTC often worked. Unset candidates now run the connectivity probe first, and only a failed probe reports not configured. The not-configured reason shows as a neutral note that names the setting and says WebRTC is optional, rather than as a red error.

* validate trusted_proxies at config load

Malformed trusted_proxies entries were only parsed per request in get_remote_addr, so a typo logged a warning on every proxied request and the entry was skipped, collapsing all clients behind that proxy into one rate-limit bucket. The config now rejects unparseable entries at startup and get_remote_addr no longer needs the fallback. Host bits are accepted (192.168.1.1/24 reads as 192.168.1.0/24) so a common typo doesn't take down safe mode, which copies the auth section verbatim.

* remove path data from thumbnail payloads

The thumbnail data carried a full copy of the object's path, which went out as snapshot.path_data in every events message alongside the top level path_data. Nothing reads the snapshot copy, and the path has no length limit, so it only made events payloads larger.

* hide incompatible frigate+ models behind a toggle

* keep the probe failure detail in the not-configured console message

* use a unique id for each show incompatible models toggle

* pad the bottom of the desktop timeline so zoom buttons don't cover segments

* create the admin row when auth is disabled so notification registrations persist

Installs that never enabled auth had no admin row, so registering for notifications returned 200 but saved nothing. Frigate now creates an admin row with an empty password hash when auth is disabled, and treats that empty hash as first-time setup when auth is enabled later so a password is still generated and printed. Registration returns 404 when no user row was updated, and the success toast only shows after the request succeeds. The Users settings page hides Add User and Reset Password when auth is disabled and notes that accounts only apply once built-in auth is enabled.

docs/docs/configuration/live.md

@@ -38,7 +38,7 @@ Frigate [defaults to MSE](#why-does-frigate-prefer-mse-over-webrtc-for-live-view
 
 - The choices are saved **per device, per camera** in your browser's local storage.
 - **WebRTC is only selectable when it can actually work for that stream.** When it can't, the option is shown disabled with the reason inline, and a more detailed reason (the failing codecs, or why the connectivity check failed) is logged to your browser's console. Common reasons:
-  - **Not configured**: no `candidates` or `ice_servers` are set under `go2rtc.webrtc` (see [WebRTC extra configuration](#webrtc-extra-configuration)).
+  - **Not configured**: no `candidates` or `ice_servers` are set under `go2rtc.webrtc`, and the connectivity check failed with go2rtc's default candidates (see [WebRTC extra configuration](#webrtc-extra-configuration)). This is a setup note rather than an error, since live view works without WebRTC.
   - **Could not connect**: e.g. port `8555` isn't reachable, or a STUN/TURN server is misconfigured. Frigate runs a one-time WebRTC connectivity check when the Live view opens; the option may briefly show as "checking" while it runs.
   - **Unsupported video codec**: the stream's video codec can't be played over WebRTC in your browser, most commonly H.265/HEVC in Firefox or Edge.
   - **Unsupported audio codec**: WebRTC needs opus or G.711 audio, so a stream whose playback audio is only AAC (without an added opus/G.711 track) can't carry audio over WebRTC. See [Audio Support](#audio-support) for how to add one.

frigate/api/auth.py

@@ -316,14 +316,10 @@ def get_remote_addr(request: Request):
 
     route = list(reversed(forwarded_for.split(",")))
     logger.debug(f"IP Route: {[r for r in route]}")
-    trusted_proxies = []
-    for proxy in request.app.frigate_config.auth.trusted_proxies:
-        try:
-            network = ipaddress.ip_network(proxy)
-        except ValueError:
-            logger.warning(f"Unable to parse trusted network: {proxy}")
-            continue
-        trusted_proxies.append(network)
+    trusted_proxies = [
+        ipaddress.ip_network(proxy, strict=False)
+        for proxy in request.app.frigate_config.auth.trusted_proxies
+    ]
 
     # return the first remote address that is not trusted
     for addr in route:

frigate/api/export.py

@@ -80,6 +80,7 @@ from frigate.record.export import (
     validate_ffmpeg_args,
 )
 from frigate.util.path import sanitize_contained_path
+from frigate.util.recording_coverage import recording_overlap
 from frigate.util.time import is_current_hour
 
 logger = logging.getLogger(__name__)
@@ -177,15 +178,7 @@ def _validate_export_source(
 ) -> str | None:
     if playback_source == PlaybackSourceEnum.recordings:
         query = Recordings.select().where(
-            (
-                Recordings.start_time.between(start_time, end_time)
-                | Recordings.end_time.between(start_time, end_time)
-                | (
-                    (start_time > Recordings.start_time)
-                    & (end_time < Recordings.end_time)
-                )
-            )
-            & (Recordings.camera == camera_name)
+            recording_overlap(start_time, end_time) & (Recordings.camera == camera_name)
         )
 
         # a pinned export reads only that stream, so the other stream's
@@ -250,9 +243,7 @@ def _get_item_recording_export_errors(
 
         query = Recordings.select(Recordings.start_time, Recordings.end_time).where(
             Recordings.camera == camera_name,
-            Recordings.start_time.between(min_start, max_end)
-            | Recordings.end_time.between(min_start, max_end)
-            | ((min_start > Recordings.start_time) & (max_end < Recordings.end_time)),
+            recording_overlap(min_start, max_end),
         )
 
         # a pinned batch reads only that stream, so the other stream's

frigate/api/media.py

@@ -62,6 +62,7 @@ from frigate.util.recording_coverage import (
     build_spans,
     null_audio_glitches,
     plan_clip,
+    recording_overlap,
     resolve_coverage,
 )
 from frigate.util.time import get_normalized_tz_name
@@ -347,10 +348,7 @@ async def get_snapshot_from_recording(
                 Recordings.path,
                 Recordings.start_time,
             )
-            .where(
-                (frame_time >= Recordings.start_time)
-                & (frame_time <= Recordings.end_time)
-            )
+            .where(recording_overlap(frame_time, frame_time))
             .where(Recordings.camera == camera_name)
             .order_by(Recordings.stream_type.asc(), Recordings.start_time.desc())
             .limit(1)
@@ -366,10 +364,7 @@ async def get_snapshot_from_recording(
                     Recordings.path,
                     Recordings.start_time,
                 )
-                .where(
-                    (frame_time >= Recordings.start_time)
-                    & (frame_time <= Recordings.end_time)
-                )
+                .where(recording_overlap(frame_time, frame_time))
                 .where(Recordings.camera == camera_name)
                 .order_by(Recordings.stream_type.asc(), Recordings.start_time.desc())
                 .limit(1)
@@ -432,9 +427,7 @@ async def submit_recording_snapshot_to_plus(
             Recordings.path,
             Recordings.start_time,
         )
-        .where(
-            (frame_time >= Recordings.start_time) & (frame_time <= Recordings.end_time)
-        )
+        .where(recording_overlap(frame_time, frame_time))
         .where(Recordings.camera == camera_name)
         .order_by(Recordings.stream_type.asc(), Recordings.start_time.desc())
         .limit(1)
@@ -548,11 +541,7 @@ async def recording_clip(
                 Recordings.start_time,
                 Recordings.end_time,
             )
-            .where(
-                (Recordings.start_time.between(start_ts, end_ts))
-                | (Recordings.end_time.between(start_ts, end_ts))
-                | ((start_ts > Recordings.start_time) & (end_ts < Recordings.end_time))
-            )
+            .where(recording_overlap(start_ts, end_ts))
             .where(Recordings.camera == camera_name)
             .where(Recordings.stream_type == stream_type)
             .order_by(Recordings.start_time.asc())

frigate/api/notification.py

@@ -9,7 +9,6 @@ from urllib.parse import urlparse
 from cryptography.hazmat.primitives import serialization
 from fastapi import APIRouter, Depends, Request
 from fastapi.responses import JSONResponse
-from peewee import DoesNotExist
 from py_vapid import Vapid01, utils
 
 from frigate.api.auth import allow_any_authenticated
@@ -173,16 +172,22 @@ def register_notifications(request: Request, body: dict = None):
             status_code=400,
         )
 
-    try:
-        User.update(notification_tokens=User.notification_tokens.append(sub)).where(
-            User.username == username
-        ).execute()
-        return JSONResponse(
-            content=({"success": True, "message": "Successfully saved token."}),
-            status_code=200,
+    updated = (
+        User.update(notification_tokens=User.notification_tokens.append(sub))
+        .where(User.username == username)
+        .execute()
+    )
+
+    if not updated:
+        logger.warning(
+            "Rejected notification registration for unknown user %s", username
         )
-    except DoesNotExist:
         return JSONResponse(
             content=({"success": False, "message": "Could not find user."}),
             status_code=404,
         )
+
+    return JSONResponse(
+        content=({"success": True, "message": "Successfully saved token."}),
+        status_code=200,
+    )

frigate/api/record.py

@@ -36,6 +36,7 @@ from frigate.util.recording_coverage import (
     coverage_spans,
     known_video_codecs,
     realized_timelines,
+    recording_overlap,
     resolve_coverage,
     stream_media_summary,
 )
@@ -537,11 +538,7 @@ async def delete_recordings(
 
     # Build query to find overlapping recordings
     clauses = [
-        (
-            Recordings.start_time.between(start, end)
-            | Recordings.end_time.between(start, end)
-            | ((start > Recordings.start_time) & (end < Recordings.end_time))
-        ),
+        recording_overlap(start, end),
         (Recordings.camera << camera_list),
     ]
 

frigate/api/review.py

@@ -37,6 +37,7 @@ from frigate.const import STREAM_TYPE_MAIN
 from frigate.embeddings import EmbeddingsContext
 from frigate.models import Recordings, ReviewSegment, UserReviewStatus
 from frigate.review.types import SeverityEnum
+from frigate.util.recording_coverage import recording_overlap
 from frigate.util.time import get_dst_transitions
 
 logger = logging.getLogger(__name__)
@@ -585,14 +586,7 @@ def delete_reviews(body: ReviewModifyMultipleBody):
         camera_name = review["camera"]
         recordings = (
             Recordings.select(Recordings.id, Recordings.path)
-            .where(
-                Recordings.start_time.between(start_time, end_time)
-                | Recordings.end_time.between(start_time, end_time)
-                | (
-                    (start_time > Recordings.start_time)
-                    & (end_time < Recordings.end_time)
-                )
-            )
+            .where(recording_overlap(start_time, end_time))
             .where(Recordings.camera == camera_name)
             .dicts()
             .iterator()

frigate/app.py

@@ -581,7 +581,12 @@ class FrigateApp:
 
     def init_auth(self) -> None:
         if self.config.auth.enabled:
-            if User.select().count() == 0:
+            if (
+                User.select().count() == 0
+                or User.select()
+                .where((User.username == "admin") & (User.password_hash == ""))
+                .exists()
+            ):
                 password = secrets.token_hex(16)
                 password_hash = hash_password(
                     password, iterations=self.config.auth.hash_iterations
@@ -593,6 +598,9 @@ class FrigateApp:
                         User.password_hash: password_hash,
                         User.notification_tokens: [],
                     }
+                ).on_conflict(
+                    conflict_target=[User.username],
+                    update={User.password_hash: password_hash},
                 ).execute()
 
                 self.config.auth.admin_first_time_login = True
@@ -623,6 +631,19 @@ class FrigateApp:
                 logger.info(f"***    Password: {password}   ***")
                 logger.info("********************************************************")
                 logger.info("********************************************************")
+        else:
+            # Notification registrations store tokens on the admin row. Its
+            # empty password hash marks it for a generated password if auth
+            # is enabled later.
+            if User.select().count() == 0:
+                User.insert(
+                    {
+                        User.username: "admin",
+                        User.role: "admin",
+                        User.password_hash: "",
+                        User.notification_tokens: [],
+                    }
+                ).execute()
 
     def start(self) -> None:
         logger.info(f"Starting Frigate ({VERSION})")

frigate/camera/state.py

@@ -392,7 +392,6 @@ class CameraState:
                 "attributes": new_obj.obj_data["attributes"],
                 "current_estimated_speed": 0,
                 "velocity_angle": 0,
-                "path_data": [],
                 "recognized_license_plate": None,
                 "recognized_license_plate_score": None,
             }

frigate/config/auth.py

@@ -1,3 +1,5 @@
+import ipaddress
+
 from pydantic import Field, field_validator, model_validator
 
 from .base import FrigateBaseModel
@@ -68,6 +70,14 @@ class AuthConfig(FrigateBaseModel):
         ),
     )
 
+    @field_validator("trusted_proxies")
+    @classmethod
+    def validate_trusted_proxies(cls, v: list[str]) -> list[str]:
+        for proxy in v:
+            ipaddress.ip_network(proxy, strict=False)
+
+        return v
+
     @field_validator("roles")
     @classmethod
     def validate_roles(cls, v: dict[str, list[str]]) -> dict[str, list[str]]:

frigate/data_processing/post/review_descriptions.py

@@ -37,6 +37,7 @@ from frigate.genai.manager import GenAIClientManager
 from frigate.models import Recordings, ReviewSegment
 from frigate.util.builtin import EventsPerSecond, InferenceSpeed
 from frigate.util.image import get_image_from_recording
+from frigate.util.recording_coverage import recording_overlap
 
 from ..post.api import PostProcessorApi
 from ..types import DataProcessorMetrics
@@ -592,7 +593,7 @@ class ReviewDescriptionProcessor(PostProcessorApi):
                         Recordings.path,
                         Recordings.start_time,
                     )
-                    .where((ts >= Recordings.start_time) & (ts <= Recordings.end_time))
+                    .where(recording_overlap(ts, ts))
                     .where(Recordings.camera == camera)
                     .where(Recordings.stream_type == STREAM_TYPE_MAIN)
                     .order_by(Recordings.start_time.desc())

frigate/jobs/debug_replay.py

@@ -27,6 +27,7 @@ from frigate.jobs.manager import job_is_running, set_current_job
 from frigate.models import Export, Recordings
 from frigate.types import JobStatusTypesEnum
 from frigate.util.ffmpeg import run_ffmpeg_with_progress
+from frigate.util.recording_coverage import recording_overlap
 
 if TYPE_CHECKING:
     from frigate.debug_replay import DebugReplayManager
@@ -104,11 +105,7 @@ def query_recordings(source_camera: str, start_ts: float, end_ts: float) -> Mode
             Recordings.start_time,
             Recordings.end_time,
         )
-        .where(
-            Recordings.start_time.between(start_ts, end_ts)
-            | Recordings.end_time.between(start_ts, end_ts)
-            | ((start_ts > Recordings.start_time) & (end_ts < Recordings.end_time))
-        )
+        .where(recording_overlap(start_ts, end_ts))
         .where(Recordings.camera == source_camera)
         .order_by(Recordings.start_time.asc())
     )

frigate/jobs/motion_search.py

@@ -35,6 +35,7 @@ from frigate.jobs.motion_search_decode import (
 )
 from frigate.models import Recordings
 from frigate.types import JobStatusTypesEnum
+from frigate.util.recording_coverage import recording_overlap
 
 logger = logging.getLogger(__name__)
 
@@ -469,20 +470,7 @@ class MotionSearchRunner(threading.Thread):
         recordings = list(
             Recordings.select()
             .where(
-                (
-                    Recordings.start_time.between(
-                        self.job.start_time_range, self.job.end_time_range
-                    )
-                )
-                | (
-                    Recordings.end_time.between(
-                        self.job.start_time_range, self.job.end_time_range
-                    )
-                )
-                | (
-                    (self.job.start_time_range > Recordings.start_time)
-                    & (self.job.end_time_range < Recordings.end_time)
-                )
+                recording_overlap(self.job.start_time_range, self.job.end_time_range)
             )
             .where(Recordings.camera == camera_name)
             .where(Recordings.stream_type == STREAM_TYPE_MAIN)

frigate/record/export.py

@@ -45,6 +45,7 @@ from frigate.util.recording_coverage import (
     known_video_codecs,
     null_audio_glitches,
     realized_timeline,
+    recording_overlap,
     resolve_coverage,
     stream_media_summary,
 )
@@ -773,14 +774,7 @@ class RecordingExporter(threading.Thread):
                 Recordings.start_time,
                 Recordings.end_time,
             )
-            .where(
-                Recordings.start_time.between(self.start_time, self.end_time)
-                | Recordings.end_time.between(self.start_time, self.end_time)
-                | (
-                    (self.start_time > Recordings.start_time)
-                    & (self.end_time < Recordings.end_time)
-                )
-            )
+            .where(recording_overlap(self.start_time, self.end_time))
             .where(
                 (Recordings.camera == self.camera)
                 & (Recordings.stream_type == stream_type)

frigate/test/http_api/test_http_notifications.py

@@ -0,0 +1,59 @@
+"""Tests for notification registration and the admin row it relies on."""
+
+from types import SimpleNamespace
+
+from frigate.app import FrigateApp
+from frigate.config import FrigateConfig
+from frigate.models import User
+from frigate.test.http_api.base_http_test import AuthTestClient, BaseTestHttp
+
+SUBSCRIPTION = {
+    "endpoint": "https://fcm.googleapis.com/fcm/send/dGhpcy1pcy1hLXRva2Vu",
+    "keys": {"p256dh": "cHVibGljLWtleQ", "auth": "YXV0aC1zZWNyZXQ"},
+}
+
+
+class TestNotificationRegistration(BaseTestHttp):
+    def setUp(self):
+        super().setUp([User])
+
+    def _init_auth(self, enabled: bool) -> FrigateConfig:
+        config = FrigateConfig(**{**self.minimal_config, "auth": {"enabled": enabled}})
+        FrigateApp.init_auth(SimpleNamespace(config=config))
+        return config
+
+    def _register(self):
+        self.minimal_config["auth"] = {"enabled": False}
+        with AuthTestClient(self.create_app()) as client:
+            return client.post("/notifications/register", json={"sub": SUBSCRIPTION})
+
+    def test_auth_disabled_fresh_install_persists_token(self):
+        self._init_auth(enabled=False)
+
+        assert self._register().status_code == 200
+        admin = User.get(User.username == "admin")
+        assert admin.password_hash == ""
+        assert admin.notification_tokens == [SUBSCRIPTION]
+
+    def test_auth_disabled_does_not_recreate_deleted_admin(self):
+        User.insert(
+            username="viewer1",
+            role="viewer",
+            password_hash="x$1$y$z",
+            notification_tokens=[],
+        ).execute()
+        self._init_auth(enabled=False)
+
+        assert User.get_or_none(User.username == "admin") is None
+        assert self._register().status_code == 404
+
+    def test_enabling_auth_sets_password_and_keeps_tokens(self):
+        self._init_auth(enabled=False)
+        assert self._register().status_code == 200
+
+        config = self._init_auth(enabled=True)
+
+        admin = User.get(User.username == "admin")
+        assert admin.password_hash.count("$") == 3
+        assert admin.notification_tokens == [SUBSCRIPTION]
+        assert config.auth.admin_first_time_login is True

frigate/test/test_config.py

@@ -75,6 +75,16 @@ class TestConfig(unittest.TestCase):
             DetectorTypeEnum.cpu
         )
 
+    def test_trusted_proxies_reject_invalid_networks(self):
+        config = {
+            "auth": {"trusted_proxies": ["172.18.0.0/16", "192.168.1.1/24", "fd00::/8"]}
+        }
+        FrigateConfig(**deep_merge(config, self.minimal))
+
+        config = {"auth": {"trusted_proxies": ["172.18.0.0/33"]}}
+        with self.assertRaises(ValidationError):
+            FrigateConfig(**deep_merge(config, self.minimal))
+
     @patch("frigate.detectors.detector_config.load_labels")
     def test_model_custom_path(self, mock_labels):
         mock_labels.return_value = {}

frigate/test/test_recording_coverage.py

@@ -16,6 +16,7 @@ from frigate.util.recording_coverage import (
     null_audio_glitches,
     plan_clip,
     realized_timeline,
+    recording_overlap,
     resolve_coverage,
     stream_media_summary,
 )
@@ -276,6 +277,33 @@ class TestRecordingCoverage(CoverageDbTestCase):
         assert plan.duration_ms == 0
 
 
+class TestRecordingOverlap(CoverageDbTestCase):
+    def test_matches_unbounded_overlap(self):
+        spans = [(1000, 1010), (1010, 1020), (1100, 1100 + MAX_SEGMENT_DURATION - 0.5)]
+        for i, (start, end) in enumerate(spans):
+            self._insert(f"r{i}", start, end, "main")
+
+        probes = [995, 1000, 1005, 1010, 1015, 1020, 1050, 1100, 1650, 1699.5, 1700]
+        for after in probes:
+            for before in probes:
+                if before < after:
+                    continue
+
+                with self.subTest(after=after, before=before):
+                    unbounded = Recordings.select(Recordings.id).where(
+                        Recordings.start_time.between(after, before)
+                        | Recordings.end_time.between(after, before)
+                        | (
+                            (after > Recordings.start_time)
+                            & (before < Recordings.end_time)
+                        )
+                    )
+                    bounded = Recordings.select(Recordings.id).where(
+                        recording_overlap(after, before)
+                    )
+                    self.assertEqual({r.id for r in bounded}, {r.id for r in unbounded})
+
+
 class TestVodManifestPolicy(CoverageDbTestCase):
     """Discontinuity policy of the vod mapping builder."""
 

frigate/track/tracked_object.py

@@ -169,7 +169,6 @@ class TrackedObject:
                         "attributes": obj_data["attributes"],
                         "current_estimated_speed": self.current_estimated_speed,
                         "velocity_angle": self.velocity_angle,
-                        "path_data": self.path_data.copy(),
                         "recognized_license_plate": obj_data.get(
                             "recognized_license_plate"
                         ),

frigate/util/audio.py

@@ -19,6 +19,7 @@ from frigate.const import (
     STREAM_TYPE_SUB,
 )
 from frigate.models import Recordings
+from frigate.util.recording_coverage import recording_overlap
 
 logger = logging.getLogger(__name__)
 
@@ -67,11 +68,7 @@ def _get_recordings_for_range(
             Recordings.start_time,
             Recordings.end_time,
         )
-        .where(
-            (Recordings.start_time.between(start_ts, end_ts))
-            | (Recordings.end_time.between(start_ts, end_ts))
-            | ((start_ts > Recordings.start_time) & (end_ts < Recordings.end_time))
-        )
+        .where(recording_overlap(start_ts, end_ts))
         .where(Recordings.camera == camera_name)
         .where(Recordings.stream_type == stream_type)
         .order_by(Recordings.start_time.asc())

frigate/util/classification.py

@@ -32,6 +32,7 @@ from frigate.util.image import (
     relative_box_to_absolute,
 )
 from frigate.util.process import FrigateProcess
+from frigate.util.recording_coverage import recording_overlap
 
 BATCH_SIZE = 16
 EPOCHS = 50
@@ -553,8 +554,7 @@ def _extract_keyframes(
             recording = (
                 Recordings.select()
                 .where(
-                    (timestamp >= Recordings.start_time)
-                    & (timestamp <= Recordings.end_time)
+                    recording_overlap(timestamp, timestamp)
                     & (Recordings.camera == camera)
                     & (Recordings.stream_type == STREAM_TYPE_MAIN)
                 )

frigate/util/recording_coverage.py

@@ -23,6 +23,19 @@ class CoverageInterval:
     sub: Any | None
 
 
+def recording_overlap(after: float, before: float) -> Any:
+    """Match recordings overlapping [after, before] as a bounded index range.
+
+    Segments never reach MAX_SEGMENT_DURATION, so the start_time lower bound
+    drops no rows and keeps SQLite from walking the camera's whole history.
+    """
+    return (
+        (Recordings.start_time <= before)
+        & (Recordings.end_time >= after)
+        & (Recordings.start_time >= after - MAX_SEGMENT_DURATION)
+    )
+
+
 def _rows_query(camera: str, after: float, before: float, stream_type: str) -> Any:
     return (
         Recordings.select(

web/e2e/specs/live-webrtc-availability.spec.ts

@@ -110,6 +110,15 @@ test.describe("WebRTC availability gating @critical", () => {
     // distinguishes enabled from disabled options.
     const mseOption = frigateApp.page.getByRole("option", { name: /MSE/ });
     await expect(mseOption).not.toHaveAttribute("aria-disabled", "true");
+
+    // a missing setting, shown as a neutral note rather than an error
+    await expect(webrtcOption).toContainText(
+      "under go2rtc → webrtc → candidates",
+    );
+    await expect(webrtcOption).toContainText(
+      "Optional: live view works without it.",
+    );
+    await expect(webrtcOption.locator(".text-danger")).toHaveCount(0);
   });
 
   test("the unavailable reason is logged to the console once", async ({
@@ -214,6 +223,62 @@ test.describe("WebRTC availability gating @critical", () => {
     await expect(webrtcOption).toContainText(/Checking WebRTC availability/i);
   });
 
+  test("desktop: unset candidates run the probe before reporting not configured", async ({
+    frigateApp,
+  }) => {
+    test.skip(frigateApp.isMobile, "Desktop dropdown only");
+
+    // Count probe connections. The probe fails fast against the preview
+    // server, which with go2rtc's default candidates means setup is missing.
+    let probes = 0;
+    await frigateApp.page.routeWebSocket("**/live/webrtc/api/ws**", (ws) => {
+      probes++;
+      ws.close();
+    });
+
+    await frigateApp.installDefaults({
+      config: {
+        go2rtc: {
+          streams: { front_door: ["rtsp://127.0.0.1:8554/front_door"] },
+        },
+      },
+    });
+
+    await frigateApp.page.route("**/api/go2rtc/streams/front_door**", (route) =>
+      route.fulfill({
+        json: {
+          producers: [{ medias: ["video, recvonly, H264"] }],
+          consumers: [],
+        },
+      }),
+    );
+
+    await frigateApp.goto("/#front_door");
+
+    const live = new LivePage(frigateApp.page, true);
+    await expect(live.backButton).toBeVisible({ timeout: 10_000 });
+
+    await frigateApp.page.locator("button:has(svg)").last().click();
+
+    const menu = frigateApp.page
+      .locator('[role="menu"], [data-radix-menu-content]')
+      .first();
+    await expect(menu).toBeVisible({ timeout: 3_000 });
+    await menu
+      .locator('div:has(> label[for="streaming-mode"]) [role="combobox"]')
+      .first()
+      .click();
+
+    const webrtcOption = frigateApp.page.getByRole("option", {
+      name: /WebRTC/,
+    });
+    await expect(webrtcOption).toBeVisible({ timeout: 3_000 });
+    await expect(webrtcOption).toContainText(
+      "under go2rtc → webrtc → candidates",
+    );
+    expect(probes).toBeGreaterThan(0);
+  });
+
   test("desktop: JSMpeg is no longer offered in the technology selector", async ({
     frigateApp,
   }) => {

web/public/locales/en/views/live.json

@@ -187,7 +187,8 @@
       },
       "unavailable": {
         "browser": "Your browser does not support WebRTC.",
-        "not-configured": "WebRTC is not configured. Set go2rtc webrtc candidates or ice_servers.",
+        "not-configured": "To enable, add this server's IP:8555 under go2rtc → webrtc → candidates.",
+        "notConfiguredOptional": "Optional: live view works without it. WebRTC is mainly needed for two-way talk.",
         "unreachable": "WebRTC could not connect. Check that port 8555 is reachable and any STUN/TURN server is correct.",
         "video-codec": "This stream's video codec is not supported by WebRTC in this browser.",
         "audio-codec": "This stream's audio codec is not supported by WebRTC. Transcode to opus or G.711 with go2rtc.",

web/public/locales/en/views/settings.json

@@ -1041,7 +1041,8 @@
     "title": "Users",
     "management": {
       "title": "User Management",
-      "desc": "Manage this Frigate instance's user accounts."
+      "desc": "Manage this Frigate instance's user accounts.",
+      "authDisabled": "Built-in authentication is disabled. These accounts are only used to log in once it's enabled."
     },
     "addUser": "Add User",
     "updatePassword": "Reset Password",
@@ -1310,6 +1311,7 @@
       "loadingAvailableModels": "Loading available models…",
       "selectModel": "Select a model",
       "noModelsAvailable": "No models available",
+      "showIncompatible": "Show incompatible models",
       "filter": {
         "ariaLabel": "Filter models by type",
         "baseModels": "Base Models",

web/src/components/config-form/sectionExtras/NotificationsSettingsExtras.tsx

@@ -403,6 +403,11 @@ export default function NotificationsSettingsExtras({
             .post("notifications/register", {
               sub: pushSubscription,
             })
+            .then(() => {
+              toast.success(t("notification.toast.success.registered"), {
+                position: "top-center",
+              });
+            })
             .catch(() => {
               toast.error(t("notification.toast.error.registerFailed"), {
                 position: "top-center",
@@ -411,9 +416,6 @@ export default function NotificationsSettingsExtras({
               workerRegistration.unregister();
               setRegistration(null);
             });
-          toast.success(t("notification.toast.success.registered"), {
-            position: "top-center",
-          });
         });
     },
     [addMessage, publicKey, t],

web/src/components/config-form/theme/fields/ModelSourcePicker.tsx

@@ -1,4 +1,4 @@
-import { ReactNode, useMemo, useState } from "react";
+import { ReactNode, useId, useState } from "react";
 import { Trans, useTranslation } from "react-i18next";
 import useSWR from "swr";
 import axios from "axios";
@@ -10,6 +10,7 @@ import {
   SelectItem,
   SelectTrigger,
 } from "@/components/ui/select";
+import { Switch } from "@/components/ui/switch";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import type { FrigateConfig } from "@/types/frigateConfig";
 import { describeSupportedDetectors } from "@/utils/plusModels";
@@ -79,10 +80,8 @@ export function ModelSourcePicker({
     },
   });
 
-  const entries = useMemo(
-    () => Object.entries(availableModels ?? {}),
-    [availableModels],
-  );
+  const [showIncompatible, setShowIncompatible] = useState(false);
+  const showIncompatibleId = useId();
 
   // the tab cannot be derived from the path alone: switching to Frigate+
   // leaves the path untouched until a model is picked
@@ -102,6 +101,16 @@ export function ModelSourcePicker({
   const isCompatible = (model: FrigatePlusModel) =>
     !detector || model.supportedDetectors.includes(detector);
 
+  const allEntries = Object.entries(availableModels ?? {});
+  const hasIncompatible = allEntries.some(([, model]) => !isCompatible(model));
+
+  // the saved model stays listed even when incompatible
+  const entries = showIncompatible
+    ? allEntries
+    : allEntries.filter(
+        ([id, model]) => isCompatible(model) || id === selectedId,
+      );
+
   if (!plusEnabled) {
     return <div className="space-y-6">{customFields}</div>;
   }
@@ -123,7 +132,21 @@ export function ModelSourcePicker({
       </TabsList>
 
       <TabsContent value="plus" className="space-y-1">
-        <Label>{t("frigatePlus.modelInfo.availableModels")}</Label>
+        <div className="flex max-w-2xl items-center justify-between">
+          <Label>{t("frigatePlus.modelInfo.availableModels")}</Label>
+          {hasIncompatible && (
+            <div className="flex items-center gap-2">
+              <Label htmlFor={showIncompatibleId} className="text-xs">
+                {t("frigatePlus.modelInfo.showIncompatible")}
+              </Label>
+              <Switch
+                id={showIncompatibleId}
+                checked={showIncompatible}
+                onCheckedChange={setShowIncompatible}
+              />
+            </div>
+          )}
+        </div>
         <Select
           value={selectedId ?? ""}
           onValueChange={(id) => onPathChange(`${PLUS_PREFIX}${id}`)}

web/src/components/player/StreamTechnologySelect.tsx

@@ -7,7 +7,7 @@ import {
 } from "@/components/ui/select";
 import { cn } from "@/lib/utils";
 import { LivePlayerMode, WebRTCUnavailableReason } from "@/types/live";
-import { LuX } from "react-icons/lu";
+import { LuInfo, LuX } from "react-icons/lu";
 import { useTranslation } from "react-i18next";
 
 type StreamTechnologySelectProps = {
@@ -28,6 +28,7 @@ export default function StreamTechnologySelect({
   const { t } = useTranslation(["views/live"]);
 
   const isChecking = webRTCUnavailableReason === "checking";
+  const isNotConfigured = webRTCUnavailableReason === "not-configured";
 
   return (
     <Select
@@ -68,7 +69,7 @@ export default function StreamTechnologySelect({
               <span
                 className={cn(
                   "mt-1 flex flex-row items-start gap-1.5 rounded-md border p-2",
-                  isChecking
+                  isChecking || isNotConfigured
                     ? "border-secondary-foreground/20 bg-secondary-foreground/10"
                     : "border-danger/20 bg-danger/10",
                 )}
@@ -78,12 +79,21 @@ export default function StreamTechnologySelect({
                     className="mt-0.5 size-3.5 shrink-0"
                     size={14}
                   />
+                ) : isNotConfigured ? (
+                  <LuInfo className="mt-0.5 size-3.5 shrink-0" />
                 ) : (
                   <LuX className="mt-0.5 size-3.5 shrink-0 text-danger" />
                 )}
-                <span className="text-xs text-secondary-foreground">
-                  {t(
-                    `stream.technology.unavailable.${webRTCUnavailableReason}`,
+                <span className="flex flex-col gap-1 text-xs text-secondary-foreground">
+                  <span>
+                    {t(
+                      `stream.technology.unavailable.${webRTCUnavailableReason}`,
+                    )}
+                  </span>
+                  {isNotConfigured && (
+                    <span className="text-muted-foreground">
+                      {t("stream.technology.unavailable.notConfiguredOptional")}
+                    </span>
                   )}
                 </span>
               </span>

web/src/components/timeline/ReviewTimeline.tsx

@@ -369,6 +369,9 @@ export function ReviewTimeline({
           <div className="pointer-events-none absolute inset-x-0 bottom-0 z-20 h-[30px] w-full bg-gradient-to-t from-secondary to-transparent"></div>
           {children}
         </div>
+        {onZoomChange && currentZoomLevelIndex !== -1 && !isMobile && (
+          <div className="h-14" />
+        )}
         {children && (
           <>
             {showHandlebar && (

web/src/hooks/use-webrtc-availability.ts

@@ -85,7 +85,9 @@ function describeGlobalReason(
     case "browser":
       return "This browser does not expose RTCPeerConnection.";
     case "not-configured":
-      return "No candidates or ice_servers are set under go2rtc.webrtc.";
+      return probeDetail
+        ? `No candidates or ice_servers are set under go2rtc.webrtc, and the probe with go2rtc's defaults failed against ${probeDetail}.`
+        : "No candidates or ice_servers are set under go2rtc.webrtc.";
     case "unreachable":
       return `The connectivity probe failed against ${probeDetail ?? "an unknown stream"}.`;
     default:
@@ -121,6 +123,10 @@ export function useWebRTCGloballyAvailable(
     );
   }, [config]);
 
+  // go2rtc fills in default candidates at startup when none are set, so only
+  // the probe can tell whether WebRTC works
+  const defaultCandidates = config?.go2rtc?.webrtc?.candidates == null;
+
   // the stream being viewed is the one most likely to be online
   const testStreams = useMemo(() => {
     const streams = Object.keys(config?.go2rtc?.streams ?? {});
@@ -182,7 +188,11 @@ export function useWebRTCGloballyAvailable(
   useEffect(() => {
     const streams = testStreamsKey ? testStreamsKey.split("\n") : [];
 
-    if (!browserOk || !configured || streams.length === 0) {
+    if (
+      !browserOk ||
+      (!configured && !defaultCandidates) ||
+      streams.length === 0
+    ) {
       return;
     }
     let cancelled = false;
@@ -197,23 +207,33 @@ export function useWebRTCGloballyAvailable(
     return () => {
       cancelled = true;
     };
-  }, [browserOk, configured, testStreamsKey, iceServers, retryToken]);
+  }, [
+    browserOk,
+    configured,
+    defaultCandidates,
+    testStreamsKey,
+    iceServers,
+    retryToken,
+  ]);
 
   const availability = useMemo<GlobalAvailability>(() => {
     if (!browserOk) {
       return { globallyAvailable: false, globalReason: "browser" };
     }
-    if (!configured) {
+    if (!configured && !defaultCandidates) {
       return { globallyAvailable: false, globalReason: "not-configured" };
     }
     if (probe.state === "pending") {
       return { globallyAvailable: false, globalReason: "checking" };
     }
     if (probe.state === "fail") {
-      return { globallyAvailable: false, globalReason: "unreachable" };
+      return {
+        globallyAvailable: false,
+        globalReason: configured ? "unreachable" : "not-configured",
+      };
     }
     return { globallyAvailable: true, globalReason: null };
-  }, [browserOk, configured, probe]);
+  }, [browserOk, configured, defaultCandidates, probe]);
 
   useEffect(() => {
     const reason = availability.globalReason;

web/src/views/settings/AuthenticationView.tsx

@@ -413,16 +413,23 @@ export default function AuthenticationView({
           <p className="text-sm text-muted-foreground">
             {t("users.management.desc")}
           </p>
+          {config.auth?.enabled === false && (
+            <p className="mt-1 text-sm text-muted-foreground">
+              {t("users.management.authDisabled")}
+            </p>
+          )}
         </div>
-        <Button
-          className="flex items-center gap-2 self-start sm:self-auto"
-          aria-label={t("users.addUser")}
-          variant="default"
-          onClick={() => setShowCreate(true)}
-        >
-          <LuPlus className="size-4" />
-          {t("users.addUser")}
-        </Button>
+        {config.auth?.enabled !== false && (
+          <Button
+            className="flex items-center gap-2 self-start sm:self-auto"
+            aria-label={t("users.addUser")}
+            variant="default"
+            onClick={() => setShowCreate(true)}
+          >
+            <LuPlus className="size-4" />
+            {t("users.addUser")}
+          </Button>
+        )}
       </div>
       <div className="mb-6 flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
         <div className="scrollbar-container flex-1 overflow-hidden rounded-lg border border-border bg-background_alt md:mr-3">
@@ -505,27 +512,29 @@ export default function AuthenticationView({
                               </Tooltip>
                             )}
 
-                            <Tooltip>
-                              <TooltipTrigger asChild>
-                                <Button
-                                  size="sm"
-                                  variant="outline"
-                                  className="h-8 px-2"
-                                  onClick={() => {
-                                    setShowSetPassword(true);
-                                    setSelectedUser(user.username);
-                                  }}
-                                >
-                                  <FaUserEdit className="size-3.5" />
-                                  <span className="ml-1.5 hidden sm:inline-block">
-                                    {t("users.table.password")}
-                                  </span>
-                                </Button>
-                              </TooltipTrigger>
-                              <TooltipContent>
-                                <p>{t("users.updatePassword")}</p>
-                              </TooltipContent>
-                            </Tooltip>
+                            {config.auth?.enabled !== false && (
+                              <Tooltip>
+                                <TooltipTrigger asChild>
+                                  <Button
+                                    size="sm"
+                                    variant="outline"
+                                    className="h-8 px-2"
+                                    onClick={() => {
+                                      setShowSetPassword(true);
+                                      setSelectedUser(user.username);
+                                    }}
+                                  >
+                                    <FaUserEdit className="size-3.5" />
+                                    <span className="ml-1.5 hidden sm:inline-block">
+                                      {t("users.table.password")}
+                                    </span>
+                                  </Button>
+                                </TooltipTrigger>
+                                <TooltipContent>
+                                  <p>{t("users.updatePassword")}</p>
+                                </TooltipContent>
+                              </Tooltip>
+                            )}
 
                             {user.username !== "admin" && (
                               <Tooltip>