Validate preview filename and camera access (#22530)

* validate preview filename and camera access

* correctly handle camera names with dashes

docs/docs/configuration/index.md

@@ -61,7 +61,7 @@ mqtt:
 
 ```yaml
 onvif:
-  host: "{FRIGATE_ONVIF_HOST}"
+  host: "192.168.1.12"
   port: 8000
   user: "{FRIGATE_RTSP_USER}"
   password: "{FRIGATE_RTSP_PASSWORD}"

docs/docs/configuration/reference.md

@@ -908,8 +908,8 @@ cameras:
     onvif:
       # Required: host of the camera being connected to.
       # NOTE: HTTP is assumed by default; HTTPS is supported if you specify the scheme, ex: "https://0.0.0.0".
-      # NOTE: ONVIF host, user, and password can be specified with environment variables or docker secrets
-      #       that must begin with 'FRIGATE_'. e.g. host: '{FRIGATE_ONVIF_HOST}'
+      # NOTE: ONVIF user, and password can be specified with environment variables or docker secrets
+      #       that must begin with 'FRIGATE_'. e.g. host: '{FRIGATE_ONVIF_USERNAME}'
       host: 0.0.0.0
       # Optional: ONVIF port for device (default: shown below).
       port: 8000

docs/docs/development/contributing.md

@@ -89,6 +89,14 @@ After closing VS Code, you may still have containers running. To close everythin
 
 ### Testing
 
+#### Unit Tests
+
+GitHub will execute unit tests on new PRs. You must ensure that all tests pass.
+
+```shell
+python3 -u -m unittest
+```
+
 #### FFMPEG Hardware Acceleration
 
 The following commands are used inside the container to ensure hardware acceleration is working properly.
@@ -125,6 +133,28 @@ ffmpeg -hwaccel vaapi -hwaccel_device /dev/dri/renderD128 -hwaccel_output_format
 ffmpeg -c:v h264_qsv -re -stream_loop -1 -i https://streams.videolan.org/ffmpeg/incoming/720p60.mp4 -f rawvideo -pix_fmt yuv420p pipe: > /dev/null
 ```
 
+### Submitting a pull request
+
+Code must be formatted, linted and type-tested. GitHub will run these checks on pull requests, so it is advised to run them yourself prior to opening.
+
+**Formatting**
+
+```shell
+ruff format frigate migrations docker *.py
+```
+
+**Linting**
+
+```shell
+ruff check frigate migrations docker *.py
+```
+
+**MyPy Static Typing**
+
+```shell
+python3 -u -m mypy --config-file frigate/mypy.ini frigate
+```
+
 ## Web Interface
 
 ### Prerequisites

docs/docs/integrations/third_party_extensions.md

@@ -42,3 +42,7 @@ This is a fork (with fixed errors and new features) of [original Double Take](ht
 ## [Scrypted - Frigate bridge plugin](https://github.com/apocaliss92/scrypted-frigate-bridge)
 
 [Scrypted - Frigate bridge](https://github.com/apocaliss92/scrypted-frigate-bridge) is an plugin that allows to ingest Frigate detections, motion, videoclips on Scrypted as well as provide templates to export rebroadcast configurations on Frigate.
+
+## [Strix](https://github.com/eduard256/Strix)
+
+[Strix](https://github.com/eduard256/Strix) auto-discovers working stream URLs for IP cameras and generates ready-to-use Frigate configs. It tests thousands of URL patterns against your camera and supports cameras without RTSP or ONVIF. 67K+ camera models from 3.6K+ brands.

frigate/api/app.py

@@ -218,7 +218,7 @@ def config_raw_paths(request: Request):
     return JSONResponse(content=raw_paths)
 
 
-@router.get("/config/raw", dependencies=[Depends(allow_any_authenticated())])
+@router.get("/config/raw", dependencies=[Depends(require_role(["admin"]))])
 def config_raw():
     config_file = find_config_file()
 
@@ -732,7 +732,12 @@ def get_recognized_license_plates(
 
 
 @router.get("/timeline", dependencies=[Depends(allow_any_authenticated())])
-def timeline(camera: str = "all", limit: int = 100, source_id: Optional[str] = None):
+def timeline(
+    camera: str = "all",
+    limit: int = 100,
+    source_id: Optional[str] = None,
+    allowed_cameras: List[str] = Depends(get_allowed_cameras_for_filter),
+):
     clauses = []
 
     selected_columns = [
@@ -754,6 +759,9 @@ def timeline(camera: str = "all", limit: int = 100, source_id: Optional[str] = N
         else:
             clauses.append((Timeline.source_id.in_(source_ids)))
 
+    # Enforce per-camera access control
+    clauses.append((Timeline.camera << allowed_cameras))
+
     if len(clauses) == 0:
         clauses.append((True))
 
@@ -769,7 +777,10 @@ def timeline(camera: str = "all", limit: int = 100, source_id: Optional[str] = N
 
 
 @router.get("/timeline/hourly", dependencies=[Depends(allow_any_authenticated())])
-def hourly_timeline(params: AppTimelineHourlyQueryParameters = Depends()):
+def hourly_timeline(
+    params: AppTimelineHourlyQueryParameters = Depends(),
+    allowed_cameras: List[str] = Depends(get_allowed_cameras_for_filter),
+):
     """Get hourly summary for timeline."""
     cameras = params.cameras
     labels = params.labels
@@ -787,6 +798,9 @@ def hourly_timeline(params: AppTimelineHourlyQueryParameters = Depends()):
         camera_list = cameras.split(",")
         clauses.append((Timeline.camera << camera_list))
 
+    # Enforce per-camera access control
+    clauses.append((Timeline.camera << allowed_cameras))
+
     if labels != "all":
         label_list = labels.split(",")
         clauses.append((Timeline.data["label"] << label_list))

frigate/api/auth.py

@@ -67,7 +67,6 @@ def require_admin_by_default():
         "/stats",
         "/stats/history",
         "/config",
-        "/config/raw",
         "/vainfo",
         "/nvinfo",
         "/labels",
@@ -837,6 +836,7 @@ def create_user(
             User.notification_tokens: [],
         }
     ).execute()
+    request.app.config_publisher.publisher.publish("config/auth", None)
     return JSONResponse(content={"username": body.username})
 
 
@@ -854,6 +854,7 @@ def delete_user(request: Request, username: str):
         )
 
     User.delete_by_id(username)
+    request.app.config_publisher.publisher.publish("config/auth", None)
     return JSONResponse(content={"success": True})
 
 
@@ -973,6 +974,7 @@ async def update_role(
         )
 
     User.set_by_id(username, {User.role: body.role})
+    request.app.config_publisher.publisher.publish("config/auth", None)
     return JSONResponse(content={"success": True})
 
 

frigate/api/media.py

@@ -1142,7 +1142,6 @@ async def event_snapshot(
 
 @router.get(
     "/events/{event_id}/thumbnail.{extension}",
-    dependencies=[Depends(require_camera_access)],
 )
 async def event_thumbnail(
     request: Request,
@@ -1344,12 +1343,12 @@ def grid_snapshot(
 
 @router.get(
     "/events/{event_id}/snapshot-clean.webp",
-    dependencies=[Depends(require_camera_access)],
 )
-def event_snapshot_clean(request: Request, event_id: str, download: bool = False):
+async def event_snapshot_clean(request: Request, event_id: str, download: bool = False):
     webp_bytes = None
     try:
         event = Event.get(Event.id == event_id)
+        await require_camera_access(event.camera, request=request)
         snapshot_config = request.app.frigate_config.cameras[event.camera].snapshots
         if not (snapshot_config.enabled and event.has_snapshot):
             return JSONResponse(
@@ -1470,7 +1469,7 @@ def event_snapshot_clean(request: Request, event_id: str, download: bool = False
 
 
 @router.get(
-    "/events/{event_id}/clip.mp4", dependencies=[Depends(require_camera_access)]
+    "/events/{event_id}/clip.mp4",
 )
 async def event_clip(
     request: Request,
@@ -1484,6 +1483,8 @@ async def event_clip(
             content={"success": False, "message": "Event not found"}, status_code=404
         )
 
+    await require_camera_access(event.camera, request=request)
+
     if not event.has_clip:
         return JSONResponse(
             content={"success": False, "message": "Clip not available"}, status_code=404
@@ -1500,9 +1501,9 @@ async def event_clip(
 
 
 @router.get(
-    "/events/{event_id}/preview.gif", dependencies=[Depends(require_camera_access)]
+    "/events/{event_id}/preview.gif",
 )
-def event_preview(request: Request, event_id: str):
+async def event_preview(request: Request, event_id: str):
     try:
         event: Event = Event.get(Event.id == event_id)
     except DoesNotExist:
@@ -1510,6 +1511,8 @@ def event_preview(request: Request, event_id: str):
             content={"success": False, "message": "Event not found"}, status_code=404
         )
 
+    await require_camera_access(event.camera, request=request)
+
     start_ts = event.start_time
     end_ts = start_ts + (
         min(event.end_time - event.start_time, 20) if event.end_time else 20
@@ -1854,8 +1857,8 @@ def preview_mp4(
     )
 
 
-@router.get("/review/{event_id}/preview", dependencies=[Depends(require_camera_access)])
-def review_preview(
+@router.get("/review/{event_id}/preview")
+async def review_preview(
     request: Request,
     event_id: str,
     format: str = Query(default="gif", enum=["gif", "mp4"]),
@@ -1868,6 +1871,8 @@ def review_preview(
             status_code=404,
         )
 
+    await require_camera_access(review.camera, request=request)
+
     padding = 8
     start_ts = review.start_time - padding
     end_ts = (
@@ -1881,12 +1886,14 @@ def review_preview(
 
 
 @router.get(
-    "/preview/{file_name}/thumbnail.jpg", dependencies=[Depends(require_camera_access)]
+    "/preview/{file_name}/thumbnail.jpg",
+    dependencies=[Depends(allow_any_authenticated())],
 )
 @router.get(
-    "/preview/{file_name}/thumbnail.webp", dependencies=[Depends(require_camera_access)]
+    "/preview/{file_name}/thumbnail.webp",
+    dependencies=[Depends(allow_any_authenticated())],
 )
-def preview_thumbnail(file_name: str):
+async def preview_thumbnail(request: Request, file_name: str):
     """Get a thumbnail from the cached preview frames."""
     if len(file_name) > 1000:
         return JSONResponse(
@@ -1896,6 +1903,17 @@ def preview_thumbnail(file_name: str):
             status_code=403,
         )
 
+    # Extract camera name from preview filename (format: preview_{camera}-{timestamp}.ext)
+    if not file_name.startswith("preview_"):
+        return JSONResponse(
+            content={"success": False, "message": "Invalid preview filename"},
+            status_code=400,
+        )
+    # Use rsplit to handle camera names containing dashes (e.g. front-door)
+    name_part = file_name[len("preview_") :].rsplit(".", 1)[0]  # strip extension
+    camera_name = name_part.rsplit("-", 1)[0]  # split off timestamp
+    await require_camera_access(camera_name, request=request)
+
     safe_file_name_current = sanitize_filename(file_name)
     preview_dir = os.path.join(CACHE_DIR, "preview_frames")
 

frigate/comms/webpush.py

@@ -17,6 +17,7 @@ from titlecase import titlecase
 from frigate.comms.base_communicator import Communicator
 from frigate.comms.config_updater import ConfigSubscriber
 from frigate.config import FrigateConfig
+from frigate.config.auth import AuthConfig
 from frigate.config.camera.updater import (
     CameraConfigUpdateEnum,
     CameraConfigUpdateSubscriber,
@@ -58,6 +59,7 @@ class WebPushClient(Communicator):
             for c in self.config.cameras.values()
         }
         self.last_notification_time: float = 0
+        self.user_cameras: dict[str, set[str]] = {}
         self.notification_queue: queue.Queue[PushNotification] = queue.Queue()
         self.notification_thread = threading.Thread(
             target=self._process_notifications, daemon=True
@@ -78,13 +80,12 @@ class WebPushClient(Communicator):
             for sub in user["notification_tokens"]:
                 self.web_pushers[user["username"]].append(WebPusher(sub))
 
-        # notification config updater
-        self.global_config_subscriber = ConfigSubscriber(
-            "config/notifications", exact=True
-        )
+        # notification and auth config updater
+        self.global_config_subscriber = ConfigSubscriber("config/")
         self.config_subscriber = CameraConfigUpdateSubscriber(
             self.config, self.config.cameras, [CameraConfigUpdateEnum.notifications]
         )
+        self._refresh_user_cameras()
 
     def subscribe(self, receiver: Callable) -> None:
         """Wrapper for allowing dispatcher to subscribe."""
@@ -164,13 +165,19 @@ class WebPushClient(Communicator):
 
     def publish(self, topic: str, payload: Any, retain: bool = False) -> None:
         """Wrapper for publishing when client is in valid state."""
-        # check for updated notification config
-        _, updated_notification_config = (
-            self.global_config_subscriber.check_for_update()
-        )
-
-        if updated_notification_config:
-            self.config.notifications = updated_notification_config
+        # check for updated global config (notifications, auth)
+        while True:
+            config_topic, config_payload = (
+                self.global_config_subscriber.check_for_update()
+            )
+            if config_topic is None:
+                break
+            if config_topic == "config/notifications" and config_payload:
+                self.config.notifications = config_payload
+            elif config_topic == "config/auth":
+                if isinstance(config_payload, AuthConfig):
+                    self.config.auth = config_payload
+                self._refresh_user_cameras()
 
         updates = self.config_subscriber.check_for_updates()
 
@@ -291,6 +298,31 @@ class WebPushClient(Communicator):
             except Exception as e:
                 logger.error(f"Error processing notification: {str(e)}")
 
+    def _refresh_user_cameras(self) -> None:
+        """Rebuild the user-to-cameras access cache from the database."""
+        all_camera_names = set(self.config.cameras.keys())
+        roles_dict = self.config.auth.roles
+        updated: dict[str, set[str]] = {}
+        for user in User.select(User.username, User.role).dicts().iterator():
+            allowed = User.get_allowed_cameras(
+                user["role"], roles_dict, all_camera_names
+            )
+            updated[user["username"]] = set(allowed)
+            logger.debug(
+                "User %s has access to cameras: %s",
+                user["username"],
+                ", ".join(allowed),
+            )
+        self.user_cameras = updated
+
+    def _user_has_camera_access(self, username: str, camera: str) -> bool:
+        """Check if a user has access to a specific camera based on cached roles."""
+        allowed = self.user_cameras.get(username)
+        if allowed is None:
+            logger.debug(f"No camera access information found for user {username}")
+            return False
+        return camera in allowed
+
     def _within_cooldown(self, camera: str) -> bool:
         now = datetime.datetime.now().timestamp()
         if now - self.last_notification_time < self.config.notifications.cooldown:
@@ -418,6 +450,14 @@ class WebPushClient(Communicator):
         logger.debug(f"Sending push notification for {camera}, review ID {reviewId}")
 
         for user in self.web_pushers:
+            if not self._user_has_camera_access(user, camera):
+                logger.debug(
+                    "Skipping notification for user %s - no access to camera %s",
+                    user,
+                    camera,
+                )
+                continue
+
             self.send_push_notification(
                 user=user,
                 payload=payload,
@@ -465,6 +505,14 @@ class WebPushClient(Communicator):
         )
 
         for user in self.web_pushers:
+            if not self._user_has_camera_access(user, camera):
+                logger.debug(
+                    "Skipping notification for user %s - no access to camera %s",
+                    user,
+                    camera,
+                )
+                continue
+
             self.send_push_notification(
                 user=user,
                 payload=payload,

frigate/events/audio.py

@@ -321,6 +321,9 @@ class AudioEventMaintainer(threading.Thread):
             self.start_or_restart_ffmpeg()
 
         while not self.stop_event.is_set():
+            # check if there is an updated config
+            self.config_subscriber.check_for_updates()
+
             enabled = self.camera_config.enabled
             if enabled != self.was_enabled:
                 if enabled:
@@ -347,9 +350,6 @@ class AudioEventMaintainer(threading.Thread):
                 time.sleep(0.1)
                 continue
 
-            # check if there is an updated config
-            self.config_subscriber.check_for_updates()
-
             self.read_audio()
 
         if self.audio_listener:

frigate/events/cleanup.py

@@ -324,6 +324,10 @@ class EventCleanup(threading.Thread):
         return events_to_update
 
     def run(self) -> None:
+        if self.config.safe_mode:
+            logger.info("Safe mode enabled, skipping event cleanup")
+            return
+
         # only expire events every 5 minutes
         while not self.stop_event.wait(300):
             events_with_expired_clips = self.expire_clips()

frigate/record/cleanup.py

@@ -350,6 +350,10 @@ class RecordingCleanup(threading.Thread):
         logger.debug("End expire recordings.")
 
     def run(self) -> None:
+        if self.config.safe_mode:
+            logger.info("Safe mode enabled, skipping recording cleanup")
+            return
+
         # on startup sync recordings with disk if enabled
         if self.config.record.sync_recordings:
             sync_recordings(limited=False)

frigate/storage.py

@@ -272,6 +272,10 @@ class StorageMaintainer(threading.Thread):
 
     def run(self):
         """Check every 5 minutes if storage needs to be cleaned up."""
+        if self.config.safe_mode:
+            logger.info("Safe mode enabled, skipping storage maintenance")
+            return
+
         self.calculate_camera_bandwidth()
         while not self.stop_event.wait(300):
             if not self.camera_storage_stats or True in [

frigate/track/stationary_classifier.py

@@ -55,6 +55,14 @@ DYNAMIC_OBJECT_THRESHOLDS = StationaryThresholds(
     motion_classifier_enabled=True,
 )
 
+# Thresholds for objects that are not expected to be stationary
+NON_STATIONARY_OBJECT_THRESHOLDS = StationaryThresholds(
+    objects=["license_plate"],
+    known_active_iou=0.9,
+    stationary_check_iou=0.9,
+    max_stationary_history=4,
+)
+
 
 def get_stationary_threshold(label: str) -> StationaryThresholds:
     """Get the stationary thresholds for a given object label."""
@@ -65,6 +73,9 @@ def get_stationary_threshold(label: str) -> StationaryThresholds:
     if label in DYNAMIC_OBJECT_THRESHOLDS.objects:
         return DYNAMIC_OBJECT_THRESHOLDS
 
+    if label in NON_STATIONARY_OBJECT_THRESHOLDS.objects:
+        return NON_STATIONARY_OBJECT_THRESHOLDS
+
     return StationaryThresholds()
 
 

web/src/components/card/AnimatedEventCard.tsx

@@ -213,6 +213,7 @@ export function AnimatedEventCard({
                       playsInline
                       muted
                       disableRemotePlayback
+                      disablePictureInPicture
                       loop
                       onTimeUpdate={() => {
                         if (!isLoaded) {

web/src/components/menu/AccountSettings.tsx

@@ -126,19 +126,21 @@ export default function AccountSettings({ className }: AccountSettingsProps) {
 
           <DropdownMenuSeparator className={isDesktop ? "my-2" : "my-2"} />
 
-          {profile?.username && profile.username !== "anonymous" && (
-            <MenuItem
-              className={cn(
-                "flex w-full items-center gap-2",
-                isDesktop ? "cursor-pointer" : "p-2 text-sm",
-              )}
-              aria-label={t("menu.user.setPassword", { ns: "common" })}
-              onClick={() => setPasswordDialogOpen(true)}
-            >
-              <LuSquarePen className="mr-2 size-4" />
-              <span>{t("menu.user.setPassword", { ns: "common" })}</span>
-            </MenuItem>
-          )}
+          {config?.auth?.enabled !== false &&
+            profile?.username &&
+            profile.username !== "anonymous" && (
+              <MenuItem
+                className={cn(
+                  "flex w-full items-center gap-2",
+                  isDesktop ? "cursor-pointer" : "p-2 text-sm",
+                )}
+                aria-label={t("menu.user.setPassword", { ns: "common" })}
+                onClick={() => setPasswordDialogOpen(true)}
+              >
+                <LuSquarePen className="mr-2 size-4" />
+                <span>{t("menu.user.setPassword", { ns: "common" })}</span>
+              </MenuItem>
+            )}
 
           <MenuItem
             className={cn(

web/src/components/menu/GeneralSettings.tsx

@@ -225,20 +225,24 @@ export default function GeneralSettings({ className }: GeneralSettingsProps) {
                 <DropdownMenuSeparator
                   className={isDesktop ? "mt-3" : "mt-1"}
                 />
-                {profile?.username && profile.username !== "anonymous" && (
-                  <MenuItem
-                    className={
-                      isDesktop
-                        ? "cursor-pointer"
-                        : "flex items-center p-2 text-sm"
-                    }
-                    aria-label={t("menu.user.setPassword", { ns: "common" })}
-                    onClick={() => setPasswordDialogOpen(true)}
-                  >
-                    <LuSquarePen className="mr-2 size-4" />
-                    <span>{t("menu.user.setPassword", { ns: "common" })}</span>
-                  </MenuItem>
-                )}
+                {config?.auth?.enabled !== false &&
+                  profile?.username &&
+                  profile.username !== "anonymous" && (
+                    <MenuItem
+                      className={
+                        isDesktop
+                          ? "cursor-pointer"
+                          : "flex items-center p-2 text-sm"
+                      }
+                      aria-label={t("menu.user.setPassword", { ns: "common" })}
+                      onClick={() => setPasswordDialogOpen(true)}
+                    >
+                      <LuSquarePen className="mr-2 size-4" />
+                      <span>
+                        {t("menu.user.setPassword", { ns: "common" })}
+                      </span>
+                    </MenuItem>
+                  )}
                 <MenuItem
                   className={
                     isDesktop

web/src/components/overlay/ClassificationSelectionDialog.tsx

@@ -125,17 +125,23 @@ export default function ClassificationSelectionDialog({
                 isMobile && "gap-2 pb-4",
               )}
             >
-              {classes.sort().map((category) => (
-                <SelectorItem
-                  key={category}
-                  className="flex cursor-pointer gap-2 smart-capitalize"
-                  onClick={() => onCategorizeImage(category)}
-                >
-                  {category === "none"
-                    ? t("details.none")
-                    : category.replaceAll("_", " ")}
-                </SelectorItem>
-              ))}
+              {classes
+                .sort((a, b) => {
+                  if (a === "none") return 1;
+                  if (b === "none") return -1;
+                  return a.localeCompare(b);
+                })
+                .map((category) => (
+                  <SelectorItem
+                    key={category}
+                    className="flex cursor-pointer gap-2 smart-capitalize"
+                    onClick={() => onCategorizeImage(category)}
+                  >
+                    {category === "none"
+                      ? t("details.none")
+                      : category.replaceAll("_", " ")}
+                  </SelectorItem>
+                ))}
               <Separator />
               <SelectorItem
                 className="flex cursor-pointer gap-2 smart-capitalize"

web/src/components/overlay/detail/SearchDetailDialog.tsx

@@ -495,6 +495,15 @@ export default function SearchDetailDialog({
     }
   }, [search]);
 
+  useEffect(() => {
+    if (!isDesktop || !onPrevious || !onNext) {
+      setShowNavigationButtons(false);
+      return;
+    }
+
+    setShowNavigationButtons(isOpen);
+  }, [isOpen, onNext, onPrevious]);
+
   // show/hide annotation settings is handled inside TabsWithActions
 
   const searchTabs = useMemo(() => {

web/src/components/overlay/detail/TrackingDetails.tsx

@@ -40,6 +40,7 @@ import ImageLoadingIndicator from "@/components/indicators/ImageLoadingIndicator
 import ObjectTrackOverlay from "../ObjectTrackOverlay";
 import { useIsAdmin } from "@/hooks/use-is-admin";
 import { VideoResolutionType } from "@/types/live";
+import { VodManifest } from "@/types/playback";
 
 type TrackingDetailsProps = {
   className?: string;
@@ -117,19 +118,64 @@ export function TrackingDetails({
     },
   );
 
+  // Fetch the VOD manifest JSON to get the actual clipFrom after keyframe
+  // snapping. The backend may snap clipFrom backwards to a keyframe, making
+  // the video start earlier than the requested time.
+  const vodManifestUrl = useMemo(() => {
+    if (!event.camera) return null;
+    const startTime =
+      event.start_time + annotationOffset / 1000 - REVIEW_PADDING;
+    const endTime =
+      (event.end_time ?? Date.now() / 1000) +
+      annotationOffset / 1000 +
+      REVIEW_PADDING;
+    return `vod/clip/${event.camera}/start/${startTime}/end/${endTime}`;
+  }, [event, annotationOffset]);
+
+  const { data: vodManifest } = useSWR<VodManifest>(vodManifestUrl, null, {
+    revalidateOnFocus: false,
+    revalidateOnReconnect: false,
+    dedupingInterval: 30000,
+  });
+
+  // Derive the actual video start time from the VOD manifest's first clip.
+  // Without this correction the timeline-to-player-time mapping is off by
+  // the keyframe preroll amount.
+  const actualVideoStart = useMemo(() => {
+    const videoStartTime = eventStartRecord - REVIEW_PADDING;
+
+    if (!vodManifest?.sequences?.[0]?.clips?.[0] || !recordings?.length) {
+      return videoStartTime;
+    }
+
+    const firstClip = vodManifest.sequences[0].clips[0];
+
+    // Guard: clipFrom is only expected when the first recording starts before
+    // the requested start. If this doesn't hold, fall back.
+    if (recordings[0].start_time >= videoStartTime) {
+      return recordings[0].start_time;
+    }
+
+    if (firstClip.clipFrom !== undefined) {
+      // clipFrom is in milliseconds from the start of the first recording
+      return recordings[0].start_time + firstClip.clipFrom / 1000;
+    }
+
+    // clipFrom absent means the full recording is included (keyframe probe failed)
+    return recordings[0].start_time;
+  }, [vodManifest, recordings, eventStartRecord]);
+
   // Convert a timeline timestamp to actual video player time, accounting for
   // motion-only recording gaps. Uses the same algorithm as DynamicVideoController.
   const timestampToVideoTime = useCallback(
     (timestamp: number): number => {
       if (!recordings || recordings.length === 0) {
         // Fallback to simple calculation if no recordings data
-        return timestamp - (eventStartRecord - REVIEW_PADDING);
+        return timestamp - actualVideoStart;
       }
 
-      const videoStartTime = eventStartRecord - REVIEW_PADDING;
-
-      // If timestamp is before video start, return 0
-      if (timestamp < videoStartTime) return 0;
+      // If timestamp is before actual video start, return 0
+      if (timestamp < actualVideoStart) return 0;
 
       // Check if timestamp is before the first recording or after the last
       if (
@@ -143,10 +189,10 @@ export function TrackingDetails({
       // Calculate the inpoint offset - the HLS video may start partway through the first segment
       let inpointOffset = 0;
       if (
-        videoStartTime > recordings[0].start_time &&
-        videoStartTime < recordings[0].end_time
+        actualVideoStart > recordings[0].start_time &&
+        actualVideoStart < recordings[0].end_time
       ) {
-        inpointOffset = videoStartTime - recordings[0].start_time;
+        inpointOffset = actualVideoStart - recordings[0].start_time;
       }
 
       let seekSeconds = 0;
@@ -164,7 +210,7 @@ export function TrackingDetails({
           if (segment === recordings[0]) {
             // For the first segment, account for the inpoint offset
             seekSeconds +=
-              timestamp - Math.max(segment.start_time, videoStartTime);
+              timestamp - Math.max(segment.start_time, actualVideoStart);
           } else {
             seekSeconds += timestamp - segment.start_time;
           }
@@ -174,7 +220,7 @@ export function TrackingDetails({
 
       return seekSeconds;
     },
-    [recordings, eventStartRecord],
+    [recordings, actualVideoStart],
   );
 
   // Convert video player time back to timeline timestamp, accounting for
@@ -183,19 +229,16 @@ export function TrackingDetails({
     (playerTime: number): number => {
       if (!recordings || recordings.length === 0) {
         // Fallback to simple calculation if no recordings data
-        const videoStartTime = eventStartRecord - REVIEW_PADDING;
-        return playerTime + videoStartTime;
+        return playerTime + actualVideoStart;
       }
 
-      const videoStartTime = eventStartRecord - REVIEW_PADDING;
-
       // Calculate the inpoint offset - the video may start partway through the first segment
       let inpointOffset = 0;
       if (
-        videoStartTime > recordings[0].start_time &&
-        videoStartTime < recordings[0].end_time
+        actualVideoStart > recordings[0].start_time &&
+        actualVideoStart < recordings[0].end_time
       ) {
-        inpointOffset = videoStartTime - recordings[0].start_time;
+        inpointOffset = actualVideoStart - recordings[0].start_time;
       }
 
       let timestamp = 0;
@@ -212,7 +255,7 @@ export function TrackingDetails({
           if (segment === recordings[0]) {
             // For the first segment, add the inpoint offset
             timestamp =
-              Math.max(segment.start_time, videoStartTime) +
+              Math.max(segment.start_time, actualVideoStart) +
               (playerTime - totalTime);
           } else {
             timestamp = segment.start_time + (playerTime - totalTime);
@@ -225,7 +268,7 @@ export function TrackingDetails({
 
       return timestamp;
     },
-    [recordings, eventStartRecord],
+    [recordings, actualVideoStart],
   );
 
   eventSequence?.map((event) => {

web/src/components/player/HlsVideoPlayer.tsx

@@ -352,7 +352,7 @@ export default function HlsVideoPlayer({
       >
         {isDetailMode &&
           camera &&
-          currentTime &&
+          currentTime != null &&
           loadedMetadata &&
           videoDimensions.width > 0 &&
           videoDimensions.height > 0 && (

web/src/pages/FaceLibrary.tsx

@@ -598,18 +598,18 @@ function LibrarySelector({
           {Object.values(faces).map((face) => (
             <DropdownMenuItem
               key={face}
-              className="group flex items-center justify-between"
+              className="group flex items-center justify-between p-0"
             >
               <div
                 className="flex-grow cursor-pointer"
                 onClick={() => setPageToggle(face)}
               >
                 {face}
-                <span className="ml-2 text-muted-foreground">
+                <span className="ml-2 px-2 py-1.5 text-muted-foreground">
                   ({faceData?.[face].length})
                 </span>
               </div>
-              <div className="flex gap-0.5">
+              <div className="flex gap-0.5 px-2">
                 <Tooltip>
                   <TooltipTrigger asChild>
                     <Button

web/src/types/frigateConfig.ts

@@ -346,6 +346,7 @@ export interface FrigateConfig {
   };
 
   auth: {
+    enabled: boolean;
     roles: {
       [roleName: string]: string[];
     };

web/src/types/playback.ts

@@ -11,3 +11,7 @@ export type PreviewPlayback = {
   preview: Preview | undefined;
   timeRange: TimeRange;
 };
+
+export type VodManifest = {
+  sequences: { clips: { clipFrom?: number }[] }[];
+};

web/src/views/classification/ModelTrainingView.tsx

@@ -700,66 +700,72 @@ function LibrarySelector({
               </div>
             </>
           )}
-          {Object.keys(dataset).map((id) => (
-            <DropdownMenuItem
-              key={id}
-              className="group flex items-center justify-between"
-            >
-              <div
-                className="flex-grow cursor-pointer capitalize"
-                onClick={() => setPageToggle(id)}
+          {Object.keys(dataset)
+            .sort((a, b) => {
+              if (a === "none") return 1;
+              if (b === "none") return -1;
+              return a.localeCompare(b);
+            })
+            .map((id) => (
+              <DropdownMenuItem
+                key={id}
+                className="group flex items-center justify-between p-0"
               >
-                {id === "none" ? t("details.none") : id.replaceAll("_", " ")}
-                <span className="ml-2 text-muted-foreground">
-                  ({dataset?.[id].length})
-                </span>
-              </div>
-              {id != "none" && (
-                <div className="flex gap-0.5">
-                  <Tooltip>
-                    <TooltipTrigger asChild>
-                      <Button
-                        variant="ghost"
-                        size="icon"
-                        className="size-7 lg:opacity-0 lg:transition-opacity lg:group-hover:opacity-100"
-                        onClick={(e) => {
-                          e.stopPropagation();
-                          setRenameClass(id);
-                        }}
-                      >
-                        <LuPencil className="size-4 text-primary" />
-                      </Button>
-                    </TooltipTrigger>
-                    <TooltipPortal>
-                      <TooltipContent>
-                        {t("button.renameCategory")}
-                      </TooltipContent>
-                    </TooltipPortal>
-                  </Tooltip>
-                  <Tooltip>
-                    <TooltipTrigger asChild>
-                      <Button
-                        variant="ghost"
-                        size="icon"
-                        className="size-7 lg:opacity-0 lg:transition-opacity lg:group-hover:opacity-100"
-                        onClick={(e) => {
-                          e.stopPropagation();
-                          setConfirmDelete(id);
-                        }}
-                      >
-                        <LuTrash2 className="size-4 text-destructive" />
-                      </Button>
-                    </TooltipTrigger>
-                    <TooltipPortal>
-                      <TooltipContent>
-                        {t("button.deleteCategory")}
-                      </TooltipContent>
-                    </TooltipPortal>
-                  </Tooltip>
+                <div
+                  className="flex-grow cursor-pointer px-2 py-1.5 capitalize"
+                  onClick={() => setPageToggle(id)}
+                >
+                  {id === "none" ? t("details.none") : id.replaceAll("_", " ")}
+                  <span className="ml-2 text-muted-foreground">
+                    ({dataset?.[id].length})
+                  </span>
                 </div>
-              )}
-            </DropdownMenuItem>
-          ))}
+                {id != "none" && (
+                  <div className="flex gap-0.5 px-2">
+                    <Tooltip>
+                      <TooltipTrigger asChild>
+                        <Button
+                          variant="ghost"
+                          size="icon"
+                          className="size-7 lg:opacity-0 lg:transition-opacity lg:group-hover:opacity-100"
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            setRenameClass(id);
+                          }}
+                        >
+                          <LuPencil className="size-4 text-primary" />
+                        </Button>
+                      </TooltipTrigger>
+                      <TooltipPortal>
+                        <TooltipContent>
+                          {t("button.renameCategory")}
+                        </TooltipContent>
+                      </TooltipPortal>
+                    </Tooltip>
+                    <Tooltip>
+                      <TooltipTrigger asChild>
+                        <Button
+                          variant="ghost"
+                          size="icon"
+                          className="size-7 lg:opacity-0 lg:transition-opacity lg:group-hover:opacity-100"
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            setConfirmDelete(id);
+                          }}
+                        >
+                          <LuTrash2 className="size-4 text-destructive" />
+                        </Button>
+                      </TooltipTrigger>
+                      <TooltipPortal>
+                        <TooltipContent>
+                          {t("button.deleteCategory")}
+                        </TooltipContent>
+                      </TooltipPortal>
+                    </Tooltip>
+                  </div>
+                )}
+              </DropdownMenuItem>
+            ))}
         </DropdownMenuContent>
       </DropdownMenu>
     </>