Tweaks (#24684)

* bound recording snapshot lookups by segment length

Ordering the recording snapshot and Frigate+ lookups by stream_type ahead of start_time broke index order, so SQLite fetched and sorted every older recording for the camera on each request (about 100 ms on a 30 day camera, run on the event loop). A start_time lower bound of the frame time minus MAX_SEGMENT_DURATION keeps the lookup to a few rows.

* bound recording overlap queries by segment length

Clip, export, review and recording deletion, debug replay, motion search, and audio transcription found overlapping recordings with an OR clause that gave SQLite no start_time range, so every call read the camera's whole recording history (30 to 300 ms on a 30 day database). The classification and review description point lookups did the same whenever the timestamp had no recording. A shared recording_overlap helper now adds a start_time lower bound of MAX_SEGMENT_DURATION before the range, which drops no rows because segments are always shorter than that.

* probe webrtc before reporting it as not configured

The WebRTC gate read only the Frigate config, so an install with no go2rtc candidates showed WebRTC as not configured, even though go2rtc fills in default candidates at startup (including the internal one under the HA app) and WebRTC often worked. Unset candidates now run the connectivity probe first, and only a failed probe reports not configured. The not-configured reason shows as a neutral note that names the setting and says WebRTC is optional, rather than as a red error.

* validate trusted_proxies at config load

Malformed trusted_proxies entries were only parsed per request in get_remote_addr, so a typo logged a warning on every proxied request and the entry was skipped, collapsing all clients behind that proxy into one rate-limit bucket. The config now rejects unparseable entries at startup and get_remote_addr no longer needs the fallback. Host bits are accepted (192.168.1.1/24 reads as 192.168.1.0/24) so a common typo doesn't take down safe mode, which copies the auth section verbatim.

* remove path data from thumbnail payloads

The thumbnail data carried a full copy of the object's path, which went out as snapshot.path_data in every events message alongside the top level path_data. Nothing reads the snapshot copy, and the path has no length limit, so it only made events payloads larger.

* hide incompatible frigate+ models behind a toggle

* keep the probe failure detail in the not-configured console message

* use a unique id for each show incompatible models toggle

* pad the bottom of the desktop timeline so zoom buttons don't cover segments

* create the admin row when auth is disabled so notification registrations persist

Installs that never enabled auth had no admin row, so registering for notifications returned 200 but saved nothing. Frigate now creates an admin row with an empty password hash when auth is disabled, and treats that empty hash as first-time setup when auth is enabled later so a password is still generated and printed. Registration returns 404 when no user row was updated, and the success toast only shows after the request succeeds. The Users settings page hides Add User and Reset Password when auth is disabled and notes that accounts only apply once built-in auth is enabled.

frigate/api/auth.py

@@ -316,14 +316,10 @@ def get_remote_addr(request: Request):
 
     route = list(reversed(forwarded_for.split(",")))
     logger.debug(f"IP Route: {[r for r in route]}")
-    trusted_proxies = []
-    for proxy in request.app.frigate_config.auth.trusted_proxies:
-        try:
-            network = ipaddress.ip_network(proxy)
-        except ValueError:
-            logger.warning(f"Unable to parse trusted network: {proxy}")
-            continue
-        trusted_proxies.append(network)
+    trusted_proxies = [
+        ipaddress.ip_network(proxy, strict=False)
+        for proxy in request.app.frigate_config.auth.trusted_proxies
+    ]
 
     # return the first remote address that is not trusted
     for addr in route:

frigate/api/export.py

@@ -80,6 +80,7 @@ from frigate.record.export import (
     validate_ffmpeg_args,
 )
 from frigate.util.path import sanitize_contained_path
+from frigate.util.recording_coverage import recording_overlap
 from frigate.util.time import is_current_hour
 
 logger = logging.getLogger(__name__)
@@ -177,15 +178,7 @@ def _validate_export_source(
 ) -> str | None:
     if playback_source == PlaybackSourceEnum.recordings:
         query = Recordings.select().where(
-            (
-                Recordings.start_time.between(start_time, end_time)
-                | Recordings.end_time.between(start_time, end_time)
-                | (
-                    (start_time > Recordings.start_time)
-                    & (end_time < Recordings.end_time)
-                )
-            )
-            & (Recordings.camera == camera_name)
+            recording_overlap(start_time, end_time) & (Recordings.camera == camera_name)
         )
 
         # a pinned export reads only that stream, so the other stream's
@@ -250,9 +243,7 @@ def _get_item_recording_export_errors(
 
         query = Recordings.select(Recordings.start_time, Recordings.end_time).where(
             Recordings.camera == camera_name,
-            Recordings.start_time.between(min_start, max_end)
-            | Recordings.end_time.between(min_start, max_end)
-            | ((min_start > Recordings.start_time) & (max_end < Recordings.end_time)),
+            recording_overlap(min_start, max_end),
         )
 
         # a pinned batch reads only that stream, so the other stream's

frigate/api/media.py

@@ -62,6 +62,7 @@ from frigate.util.recording_coverage import (
     build_spans,
     null_audio_glitches,
     plan_clip,
+    recording_overlap,
     resolve_coverage,
 )
 from frigate.util.time import get_normalized_tz_name
@@ -347,10 +348,7 @@ async def get_snapshot_from_recording(
                 Recordings.path,
                 Recordings.start_time,
             )
-            .where(
-                (frame_time >= Recordings.start_time)
-                & (frame_time <= Recordings.end_time)
-            )
+            .where(recording_overlap(frame_time, frame_time))
             .where(Recordings.camera == camera_name)
             .order_by(Recordings.stream_type.asc(), Recordings.start_time.desc())
             .limit(1)
@@ -366,10 +364,7 @@ async def get_snapshot_from_recording(
                     Recordings.path,
                     Recordings.start_time,
                 )
-                .where(
-                    (frame_time >= Recordings.start_time)
-                    & (frame_time <= Recordings.end_time)
-                )
+                .where(recording_overlap(frame_time, frame_time))
                 .where(Recordings.camera == camera_name)
                 .order_by(Recordings.stream_type.asc(), Recordings.start_time.desc())
                 .limit(1)
@@ -432,9 +427,7 @@ async def submit_recording_snapshot_to_plus(
             Recordings.path,
             Recordings.start_time,
         )
-        .where(
-            (frame_time >= Recordings.start_time) & (frame_time <= Recordings.end_time)
-        )
+        .where(recording_overlap(frame_time, frame_time))
         .where(Recordings.camera == camera_name)
         .order_by(Recordings.stream_type.asc(), Recordings.start_time.desc())
         .limit(1)
@@ -548,11 +541,7 @@ async def recording_clip(
                 Recordings.start_time,
                 Recordings.end_time,
             )
-            .where(
-                (Recordings.start_time.between(start_ts, end_ts))
-                | (Recordings.end_time.between(start_ts, end_ts))
-                | ((start_ts > Recordings.start_time) & (end_ts < Recordings.end_time))
-            )
+            .where(recording_overlap(start_ts, end_ts))
             .where(Recordings.camera == camera_name)
             .where(Recordings.stream_type == stream_type)
             .order_by(Recordings.start_time.asc())

frigate/api/notification.py

@@ -9,7 +9,6 @@ from urllib.parse import urlparse
 from cryptography.hazmat.primitives import serialization
 from fastapi import APIRouter, Depends, Request
 from fastapi.responses import JSONResponse
-from peewee import DoesNotExist
 from py_vapid import Vapid01, utils
 
 from frigate.api.auth import allow_any_authenticated
@@ -173,16 +172,22 @@ def register_notifications(request: Request, body: dict = None):
             status_code=400,
         )
 
-    try:
-        User.update(notification_tokens=User.notification_tokens.append(sub)).where(
-            User.username == username
-        ).execute()
-        return JSONResponse(
-            content=({"success": True, "message": "Successfully saved token."}),
-            status_code=200,
+    updated = (
+        User.update(notification_tokens=User.notification_tokens.append(sub))
+        .where(User.username == username)
+        .execute()
+    )
+
+    if not updated:
+        logger.warning(
+            "Rejected notification registration for unknown user %s", username
         )
-    except DoesNotExist:
         return JSONResponse(
             content=({"success": False, "message": "Could not find user."}),
             status_code=404,
         )
+
+    return JSONResponse(
+        content=({"success": True, "message": "Successfully saved token."}),
+        status_code=200,
+    )

frigate/api/record.py

@@ -36,6 +36,7 @@ from frigate.util.recording_coverage import (
     coverage_spans,
     known_video_codecs,
     realized_timelines,
+    recording_overlap,
     resolve_coverage,
     stream_media_summary,
 )
@@ -537,11 +538,7 @@ async def delete_recordings(
 
     # Build query to find overlapping recordings
     clauses = [
-        (
-            Recordings.start_time.between(start, end)
-            | Recordings.end_time.between(start, end)
-            | ((start > Recordings.start_time) & (end < Recordings.end_time))
-        ),
+        recording_overlap(start, end),
         (Recordings.camera << camera_list),
     ]
 

frigate/api/review.py

@@ -37,6 +37,7 @@ from frigate.const import STREAM_TYPE_MAIN
 from frigate.embeddings import EmbeddingsContext
 from frigate.models import Recordings, ReviewSegment, UserReviewStatus
 from frigate.review.types import SeverityEnum
+from frigate.util.recording_coverage import recording_overlap
 from frigate.util.time import get_dst_transitions
 
 logger = logging.getLogger(__name__)
@@ -585,14 +586,7 @@ def delete_reviews(body: ReviewModifyMultipleBody):
         camera_name = review["camera"]
         recordings = (
             Recordings.select(Recordings.id, Recordings.path)
-            .where(
-                Recordings.start_time.between(start_time, end_time)
-                | Recordings.end_time.between(start_time, end_time)
-                | (
-                    (start_time > Recordings.start_time)
-                    & (end_time < Recordings.end_time)
-                )
-            )
+            .where(recording_overlap(start_time, end_time))
             .where(Recordings.camera == camera_name)
             .dicts()
             .iterator()

frigate/app.py

@@ -581,7 +581,12 @@ class FrigateApp:
 
     def init_auth(self) -> None:
         if self.config.auth.enabled:
-            if User.select().count() == 0:
+            if (
+                User.select().count() == 0
+                or User.select()
+                .where((User.username == "admin") & (User.password_hash == ""))
+                .exists()
+            ):
                 password = secrets.token_hex(16)
                 password_hash = hash_password(
                     password, iterations=self.config.auth.hash_iterations
@@ -593,6 +598,9 @@ class FrigateApp:
                         User.password_hash: password_hash,
                         User.notification_tokens: [],
                     }
+                ).on_conflict(
+                    conflict_target=[User.username],
+                    update={User.password_hash: password_hash},
                 ).execute()
 
                 self.config.auth.admin_first_time_login = True
@@ -623,6 +631,19 @@ class FrigateApp:
                 logger.info(f"***    Password: {password}   ***")
                 logger.info("********************************************************")
                 logger.info("********************************************************")
+        else:
+            # Notification registrations store tokens on the admin row. Its
+            # empty password hash marks it for a generated password if auth
+            # is enabled later.
+            if User.select().count() == 0:
+                User.insert(
+                    {
+                        User.username: "admin",
+                        User.role: "admin",
+                        User.password_hash: "",
+                        User.notification_tokens: [],
+                    }
+                ).execute()
 
     def start(self) -> None:
         logger.info(f"Starting Frigate ({VERSION})")

frigate/camera/state.py

@@ -392,7 +392,6 @@ class CameraState:
                 "attributes": new_obj.obj_data["attributes"],
                 "current_estimated_speed": 0,
                 "velocity_angle": 0,
-                "path_data": [],
                 "recognized_license_plate": None,
                 "recognized_license_plate_score": None,
             }

frigate/config/auth.py

@@ -1,3 +1,5 @@
+import ipaddress
+
 from pydantic import Field, field_validator, model_validator
 
 from .base import FrigateBaseModel
@@ -68,6 +70,14 @@ class AuthConfig(FrigateBaseModel):
         ),
     )
 
+    @field_validator("trusted_proxies")
+    @classmethod
+    def validate_trusted_proxies(cls, v: list[str]) -> list[str]:
+        for proxy in v:
+            ipaddress.ip_network(proxy, strict=False)
+
+        return v
+
     @field_validator("roles")
     @classmethod
     def validate_roles(cls, v: dict[str, list[str]]) -> dict[str, list[str]]:

frigate/data_processing/post/review_descriptions.py

@@ -37,6 +37,7 @@ from frigate.genai.manager import GenAIClientManager
 from frigate.models import Recordings, ReviewSegment
 from frigate.util.builtin import EventsPerSecond, InferenceSpeed
 from frigate.util.image import get_image_from_recording
+from frigate.util.recording_coverage import recording_overlap
 
 from ..post.api import PostProcessorApi
 from ..types import DataProcessorMetrics
@@ -592,7 +593,7 @@ class ReviewDescriptionProcessor(PostProcessorApi):
                         Recordings.path,
                         Recordings.start_time,
                     )
-                    .where((ts >= Recordings.start_time) & (ts <= Recordings.end_time))
+                    .where(recording_overlap(ts, ts))
                     .where(Recordings.camera == camera)
                     .where(Recordings.stream_type == STREAM_TYPE_MAIN)
                     .order_by(Recordings.start_time.desc())

frigate/jobs/debug_replay.py

@@ -27,6 +27,7 @@ from frigate.jobs.manager import job_is_running, set_current_job
 from frigate.models import Export, Recordings
 from frigate.types import JobStatusTypesEnum
 from frigate.util.ffmpeg import run_ffmpeg_with_progress
+from frigate.util.recording_coverage import recording_overlap
 
 if TYPE_CHECKING:
     from frigate.debug_replay import DebugReplayManager
@@ -104,11 +105,7 @@ def query_recordings(source_camera: str, start_ts: float, end_ts: float) -> Mode
             Recordings.start_time,
             Recordings.end_time,
         )
-        .where(
-            Recordings.start_time.between(start_ts, end_ts)
-            | Recordings.end_time.between(start_ts, end_ts)
-            | ((start_ts > Recordings.start_time) & (end_ts < Recordings.end_time))
-        )
+        .where(recording_overlap(start_ts, end_ts))
         .where(Recordings.camera == source_camera)
         .order_by(Recordings.start_time.asc())
     )

frigate/jobs/motion_search.py

@@ -35,6 +35,7 @@ from frigate.jobs.motion_search_decode import (
 )
 from frigate.models import Recordings
 from frigate.types import JobStatusTypesEnum
+from frigate.util.recording_coverage import recording_overlap
 
 logger = logging.getLogger(__name__)
 
@@ -469,20 +470,7 @@ class MotionSearchRunner(threading.Thread):
         recordings = list(
             Recordings.select()
             .where(
-                (
-                    Recordings.start_time.between(
-                        self.job.start_time_range, self.job.end_time_range
-                    )
-                )
-                | (
-                    Recordings.end_time.between(
-                        self.job.start_time_range, self.job.end_time_range
-                    )
-                )
-                | (
-                    (self.job.start_time_range > Recordings.start_time)
-                    & (self.job.end_time_range < Recordings.end_time)
-                )
+                recording_overlap(self.job.start_time_range, self.job.end_time_range)
             )
             .where(Recordings.camera == camera_name)
             .where(Recordings.stream_type == STREAM_TYPE_MAIN)

frigate/record/export.py

@@ -45,6 +45,7 @@ from frigate.util.recording_coverage import (
     known_video_codecs,
     null_audio_glitches,
     realized_timeline,
+    recording_overlap,
     resolve_coverage,
     stream_media_summary,
 )
@@ -773,14 +774,7 @@ class RecordingExporter(threading.Thread):
                 Recordings.start_time,
                 Recordings.end_time,
             )
-            .where(
-                Recordings.start_time.between(self.start_time, self.end_time)
-                | Recordings.end_time.between(self.start_time, self.end_time)
-                | (
-                    (self.start_time > Recordings.start_time)
-                    & (self.end_time < Recordings.end_time)
-                )
-            )
+            .where(recording_overlap(self.start_time, self.end_time))
             .where(
                 (Recordings.camera == self.camera)
                 & (Recordings.stream_type == stream_type)

frigate/test/http_api/test_http_notifications.py

@@ -0,0 +1,59 @@
+"""Tests for notification registration and the admin row it relies on."""
+
+from types import SimpleNamespace
+
+from frigate.app import FrigateApp
+from frigate.config import FrigateConfig
+from frigate.models import User
+from frigate.test.http_api.base_http_test import AuthTestClient, BaseTestHttp
+
+SUBSCRIPTION = {
+    "endpoint": "https://fcm.googleapis.com/fcm/send/dGhpcy1pcy1hLXRva2Vu",
+    "keys": {"p256dh": "cHVibGljLWtleQ", "auth": "YXV0aC1zZWNyZXQ"},
+}
+
+
+class TestNotificationRegistration(BaseTestHttp):
+    def setUp(self):
+        super().setUp([User])
+
+    def _init_auth(self, enabled: bool) -> FrigateConfig:
+        config = FrigateConfig(**{**self.minimal_config, "auth": {"enabled": enabled}})
+        FrigateApp.init_auth(SimpleNamespace(config=config))
+        return config
+
+    def _register(self):
+        self.minimal_config["auth"] = {"enabled": False}
+        with AuthTestClient(self.create_app()) as client:
+            return client.post("/notifications/register", json={"sub": SUBSCRIPTION})
+
+    def test_auth_disabled_fresh_install_persists_token(self):
+        self._init_auth(enabled=False)
+
+        assert self._register().status_code == 200
+        admin = User.get(User.username == "admin")
+        assert admin.password_hash == ""
+        assert admin.notification_tokens == [SUBSCRIPTION]
+
+    def test_auth_disabled_does_not_recreate_deleted_admin(self):
+        User.insert(
+            username="viewer1",
+            role="viewer",
+            password_hash="x$1$y$z",
+            notification_tokens=[],
+        ).execute()
+        self._init_auth(enabled=False)
+
+        assert User.get_or_none(User.username == "admin") is None
+        assert self._register().status_code == 404
+
+    def test_enabling_auth_sets_password_and_keeps_tokens(self):
+        self._init_auth(enabled=False)
+        assert self._register().status_code == 200
+
+        config = self._init_auth(enabled=True)
+
+        admin = User.get(User.username == "admin")
+        assert admin.password_hash.count("$") == 3
+        assert admin.notification_tokens == [SUBSCRIPTION]
+        assert config.auth.admin_first_time_login is True

frigate/test/test_config.py

@@ -75,6 +75,16 @@ class TestConfig(unittest.TestCase):
             DetectorTypeEnum.cpu
         )
 
+    def test_trusted_proxies_reject_invalid_networks(self):
+        config = {
+            "auth": {"trusted_proxies": ["172.18.0.0/16", "192.168.1.1/24", "fd00::/8"]}
+        }
+        FrigateConfig(**deep_merge(config, self.minimal))
+
+        config = {"auth": {"trusted_proxies": ["172.18.0.0/33"]}}
+        with self.assertRaises(ValidationError):
+            FrigateConfig(**deep_merge(config, self.minimal))
+
     @patch("frigate.detectors.detector_config.load_labels")
     def test_model_custom_path(self, mock_labels):
         mock_labels.return_value = {}

frigate/test/test_recording_coverage.py

@@ -16,6 +16,7 @@ from frigate.util.recording_coverage import (
     null_audio_glitches,
     plan_clip,
     realized_timeline,
+    recording_overlap,
     resolve_coverage,
     stream_media_summary,
 )
@@ -276,6 +277,33 @@ class TestRecordingCoverage(CoverageDbTestCase):
         assert plan.duration_ms == 0
 
 
+class TestRecordingOverlap(CoverageDbTestCase):
+    def test_matches_unbounded_overlap(self):
+        spans = [(1000, 1010), (1010, 1020), (1100, 1100 + MAX_SEGMENT_DURATION - 0.5)]
+        for i, (start, end) in enumerate(spans):
+            self._insert(f"r{i}", start, end, "main")
+
+        probes = [995, 1000, 1005, 1010, 1015, 1020, 1050, 1100, 1650, 1699.5, 1700]
+        for after in probes:
+            for before in probes:
+                if before < after:
+                    continue
+
+                with self.subTest(after=after, before=before):
+                    unbounded = Recordings.select(Recordings.id).where(
+                        Recordings.start_time.between(after, before)
+                        | Recordings.end_time.between(after, before)
+                        | (
+                            (after > Recordings.start_time)
+                            & (before < Recordings.end_time)
+                        )
+                    )
+                    bounded = Recordings.select(Recordings.id).where(
+                        recording_overlap(after, before)
+                    )
+                    self.assertEqual({r.id for r in bounded}, {r.id for r in unbounded})
+
+
 class TestVodManifestPolicy(CoverageDbTestCase):
     """Discontinuity policy of the vod mapping builder."""
 

frigate/track/tracked_object.py

@@ -169,7 +169,6 @@ class TrackedObject:
                         "attributes": obj_data["attributes"],
                         "current_estimated_speed": self.current_estimated_speed,
                         "velocity_angle": self.velocity_angle,
-                        "path_data": self.path_data.copy(),
                         "recognized_license_plate": obj_data.get(
                             "recognized_license_plate"
                         ),

frigate/util/audio.py

@@ -19,6 +19,7 @@ from frigate.const import (
     STREAM_TYPE_SUB,
 )
 from frigate.models import Recordings
+from frigate.util.recording_coverage import recording_overlap
 
 logger = logging.getLogger(__name__)
 
@@ -67,11 +68,7 @@ def _get_recordings_for_range(
             Recordings.start_time,
             Recordings.end_time,
         )
-        .where(
-            (Recordings.start_time.between(start_ts, end_ts))
-            | (Recordings.end_time.between(start_ts, end_ts))
-            | ((start_ts > Recordings.start_time) & (end_ts < Recordings.end_time))
-        )
+        .where(recording_overlap(start_ts, end_ts))
         .where(Recordings.camera == camera_name)
         .where(Recordings.stream_type == stream_type)
         .order_by(Recordings.start_time.asc())

frigate/util/classification.py

@@ -32,6 +32,7 @@ from frigate.util.image import (
     relative_box_to_absolute,
 )
 from frigate.util.process import FrigateProcess
+from frigate.util.recording_coverage import recording_overlap
 
 BATCH_SIZE = 16
 EPOCHS = 50
@@ -553,8 +554,7 @@ def _extract_keyframes(
             recording = (
                 Recordings.select()
                 .where(
-                    (timestamp >= Recordings.start_time)
-                    & (timestamp <= Recordings.end_time)
+                    recording_overlap(timestamp, timestamp)
                     & (Recordings.camera == camera)
                     & (Recordings.stream_type == STREAM_TYPE_MAIN)
                 )

frigate/util/recording_coverage.py

@@ -23,6 +23,19 @@ class CoverageInterval:
     sub: Any | None
 
 
+def recording_overlap(after: float, before: float) -> Any:
+    """Match recordings overlapping [after, before] as a bounded index range.
+
+    Segments never reach MAX_SEGMENT_DURATION, so the start_time lower bound
+    drops no rows and keeps SQLite from walking the camera's whole history.
+    """
+    return (
+        (Recordings.start_time <= before)
+        & (Recordings.end_time >= after)
+        & (Recordings.start_time >= after - MAX_SEGMENT_DURATION)
+    )
+
+
 def _rows_query(camera: str, after: float, before: float, stream_type: str) -> Any:
     return (
         Recordings.select(