administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-09-26 07:48:57 +03:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Fix review summary report analysis creation to be scoped for users with full camera access only (#24056)

Browse Source 
* Fix review summary analysis

* Add ability to scope based on full camera access
This commit is contained in:
Nicolas Mowen
2026-08-22 11:06:01 -05:00
committed by GitHub
parent b1cdf1f76b
commit fc79aeab5e
5 changed files with 101 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
generate_api_auth_spec.py
+8 -2
View File
@@ -94,6 +94,7 @@ SPEC_SERVERS = [
PUBLIC = "public"
AUTHENTICATED = "any"
CAMERA = "camera"
ALL_CAMERAS = "all_cameras"
ADMIN = "admin"
ADMIN_SCHEME = "frigateAdminAuth"
@@ -128,6 +129,7 @@ ACCESS_NOTES = {
PUBLIC: "**Access:** Public — no authentication required.",
AUTHENTICATED: "**Access:** Any authenticated user.",
CAMERA: "**Access:** Authenticated user with access to the referenced camera.",
ALL_CAMERAS: "**Access:** Authenticated user with access to all cameras.",
ADMIN: "**Access:** Admin role required.",
}
@@ -197,6 +199,8 @@ def _route_markers(route: APIRoute) -> tuple[set[str], list[str] | None]:
pass
elif name in ("require_camera_access", "require_go2rtc_stream_access"):
markers.add(CAMERA)
elif name == "require_full_camera_access":
markers.add(ALL_CAMERAS)
elif "auth_checker" in qualname:
markers.add(AUTHENTICATED)
elif "public_checker" in qualname:
@@ -254,6 +258,8 @@ def _classify_base(
# Explicit route-level markers win, in order of specificity.
if ADMIN in markers:
return ADMIN, admin_roles or ["admin"], None
if ALL_CAMERAS in markers:
return ALL_CAMERAS, None, None
if CAMERA in markers:
return CAMERA, None, None
if AUTHENTICATED in markers:
@@ -337,8 +343,8 @@ def security_for(level: str) -> list:
return []
if level == ADMIN:
return [{ADMIN_SCHEME: []}]
# AUTHENTICATED and CAMERA both require any authenticated session; the
# camera-specific scoping is conveyed in the note and x-required-role.
# AUTHENTICATED, CAMERA and ALL_CAMERAS all require any authenticated
# session; the camera scoping is conveyed in the note and x-required-role.
return [{USER_SCHEME: []}]