Bump actions/checkout from 6 to 7

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
     name: AMD64 Build
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -47,7 +47,7 @@ jobs:
     name: ARM Build
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -82,7 +82,7 @@ jobs:
     name: Jetson Jetpack 6
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -113,7 +113,7 @@ jobs:
       - amd64_build
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -154,7 +154,7 @@ jobs:
       - arm64_build
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -179,7 +179,7 @@ jobs:
       - arm64_build
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx

.github/workflows/pull_request.yml

@@ -16,7 +16,7 @@ jobs:
     name: Web - Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: actions/setup-node@v6
@@ -35,7 +35,7 @@ jobs:
     name: Web - Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: actions/setup-node@v6
@@ -54,7 +54,7 @@ jobs:
     name: Web - E2E Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: actions/setup-node@v6
@@ -86,7 +86,7 @@ jobs:
     name: Python Checks
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.DEFAULT_PYTHON }}
@@ -109,7 +109,7 @@ jobs:
     name: Python Tests
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: actions/setup-node@v6

.github/workflows/release.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - id: lowercaseRepo

frigate/api/auth.py

@@ -12,7 +12,6 @@ import time
 from datetime import datetime
 from pathlib import Path
 from typing import List, Optional
-from urllib.parse import parse_qs, urlparse
 
 from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from fastapi.responses import JSONResponse, RedirectResponse
@@ -27,11 +26,7 @@ from frigate.api.defs.request.app_body import (
     AppPutRoleBody,
 )
 from frigate.api.defs.tags import Tags
-from frigate.api.media_auth import (
-    check_camera_access,
-    deny_response_for_media_uri,
-    is_role_restricted,
-)
+from frigate.api.media_auth import check_camera_access, deny_response_for_media_uri
 from frigate.config import AuthConfig, NetworkingConfig, ProxyConfig
 from frigate.const import CONFIG_DIR, JWT_SECRET_ENV_VAR, PASSWORD_HASH_ALGORITHM
 from frigate.models import User
@@ -663,10 +658,6 @@ def auth(request: Request):
         if deny_status is not None:
             return Response("", status_code=deny_status)
 
-        deny_status = deny_response_for_go2rtc_stream(original_url, role, request)
-        if deny_status is not None:
-            return Response("", status_code=deny_status)
-
         return success_response
 
     # now apply authentication
@@ -766,10 +757,6 @@ def auth(request: Request):
         if deny_status is not None:
             return Response("", status_code=deny_status)
 
-        deny_status = deny_response_for_go2rtc_stream(original_url, role, request)
-        if deny_status is not None:
-            return Response("", status_code=deny_status)
-
         return success_response
     except Exception as e:
         logger.error(f"Error parsing jwt: {e}")
@@ -1125,66 +1112,6 @@ def _get_stream_owner_cameras(request: Request, stream_name: str) -> set[str]:
     return owner_cameras
 
 
-# nginx proxies these paths straight to go2rtc with authentication-only checks
-# (see auth_request.conf). Each names the desired stream via the `src` query
-# param, so the camera-level check must happen here in the `/auth` subrequest —
-# `require_go2rtc_stream_access` only guards the REST `/go2rtc/streams/{name}`
-# endpoint, not these proxied live-stream paths.
-GO2RTC_STREAM_PROXY_PATHS = frozenset(
-    {
-        "/live/mse/api/ws",
-        "/live/webrtc/api/ws",
-        "/api/go2rtc/webrtc",
-    }
-)
-
-
-def deny_response_for_go2rtc_stream(
-    original_url: Optional[str], role: Optional[str], request: Request
-) -> Optional[int]:
-    """Block role-restricted users from go2rtc live streams they cannot access.
-
-    Returns 403 when any `src` stream named in `original_url` resolves to a
-    camera outside the role's allow-list (or when no `src` is provided on a
-    stream-proxy path), otherwise None. Mirrors the resolution logic in
-    `require_go2rtc_stream_access` so substream names map to their owning
-    camera correctly.
-    """
-    if not original_url:
-        return None
-
-    parsed = urlparse(original_url)
-    if parsed.path not in GO2RTC_STREAM_PROXY_PATHS:
-        return None
-
-    frigate_config = request.app.frigate_config
-
-    # admin and full-access roles (no allow-list) bypass the camera check
-    if not role or not is_role_restricted(role, frigate_config):
-        return None
-
-    sources = parse_qs(parsed.query).get("src", [])
-    if not sources:
-        # a stream-proxy request naming no stream has nothing legitimate to
-        # show a restricted user
-        return 403
-
-    allowed_cameras = set(
-        User.get_allowed_cameras(
-            role,
-            frigate_config.auth.roles,
-            set(frigate_config.cameras.keys()),
-        )
-    )
-
-    # deny if any requested source resolves outside the allow-list
-    for src in sources:
-        if not (_get_stream_owner_cameras(request, src) & allowed_cameras):
-            return 403
-
-    return None
-
-
 async def require_go2rtc_stream_access(
     stream_name: Optional[str] = None,
     request: Request = None,

frigate/api/event.py

@@ -389,107 +389,83 @@ def events_explore(
     limit: int = 10,
     allowed_cameras: List[str] = Depends(get_allowed_cameras_for_filter),
 ):
-    if not allowed_cameras:
-        return JSONResponse(content=[])
-
-    explore_columns = (
-        Event.id,
-        Event.camera,
-        Event.label,
-        Event.sub_label,
-        Event.zones,
-        Event.start_time,
-        Event.end_time,
-        Event.has_clip,
-        Event.has_snapshot,
-        Event.plus_id,
-        Event.retain_indefinitely,
-        Event.top_score,
-        Event.false_positive,
-        Event.box,
-        Event.data,
+    # get distinct labels for all events
+    distinct_labels = (
+        Event.select(Event.label)
+        .where(Event.camera << allowed_cameras)
+        .distinct()
+        .order_by(Event.label)
     )
 
-    # Single query: per-label COUNT and top-N ranking by start_time computed
-    # via window functions in a CTE, then filtered to rn <= limit
-    event_count = (
-        fn.COUNT(Event.id).over(partition_by=[Event.label]).alias("event_count")
-    )
-    rn = (
-        fn.ROW_NUMBER()
-        .over(partition_by=[Event.label], order_by=[Event.start_time.desc()])
-        .alias("rn")
-    )
+    label_counts = {}
 
-    base_query = Event.select(
-        *explore_columns,
-        event_count,
-        rn,
-    ).where(Event.camera << allowed_cameras)
-    ranked = base_query.cte("ranked")
-    query = (
-        Event.select(
-            ranked.c.id,
-            ranked.c.camera,
-            ranked.c.label,
-            ranked.c.sub_label,
-            ranked.c.zones,
-            ranked.c.start_time,
-            ranked.c.end_time,
-            ranked.c.has_clip,
-            ranked.c.has_snapshot,
-            ranked.c.plus_id,
-            ranked.c.retain_indefinitely,
-            ranked.c.top_score,
-            ranked.c.false_positive,
-            ranked.c.box,
-            ranked.c.data,
-            ranked.c.event_count,
-        )
-        .from_(ranked)
-        .with_cte(ranked)
-        .where(ranked.c.rn <= limit)
-        .order_by(ranked.c.event_count.desc(), ranked.c.start_time.desc())
-        .objects()
+    def event_generator():
+        for label_obj in distinct_labels.iterator():
+            label = label_obj.label
+
+            # get most recent events for this label
+            label_events = (
+                Event.select()
+                .where((Event.label == label) & (Event.camera << allowed_cameras))
+                .order_by(Event.start_time.desc())
+                .limit(limit)
+                .iterator()
+            )
+
+            # count total events for this label
+            label_counts[label] = (
+                Event.select()
+                .where((Event.label == label) & (Event.camera << allowed_cameras))
+                .count()
+            )
+
+            yield from label_events
+
+    def process_events():
+        for event in event_generator():
+            processed_event = {
+                "id": event.id,
+                "camera": event.camera,
+                "label": event.label,
+                "zones": event.zones,
+                "start_time": event.start_time,
+                "end_time": event.end_time,
+                "has_clip": event.has_clip,
+                "has_snapshot": event.has_snapshot,
+                "plus_id": event.plus_id,
+                "retain_indefinitely": event.retain_indefinitely,
+                "sub_label": event.sub_label,
+                "top_score": event.top_score,
+                "false_positive": event.false_positive,
+                "box": event.box,
+                "data": {
+                    k: v
+                    for k, v in event.data.items()
+                    if k
+                    in [
+                        "type",
+                        "score",
+                        "top_score",
+                        "description",
+                        "sub_label_score",
+                        "average_estimated_speed",
+                        "velocity_angle",
+                        "path_data",
+                        "recognized_license_plate",
+                        "recognized_license_plate_score",
+                    ]
+                },
+                "event_count": label_counts[event.label],
+            }
+            yield processed_event
+
+    # convert iterator to list and sort
+    processed_events = sorted(
+        process_events(),
+        key=lambda x: (x["event_count"], x["start_time"]),
+        reverse=True,
     )
 
-    allowed_data_keys = {
-        "type",
-        "score",
-        "top_score",
-        "description",
-        "sub_label_score",
-        "average_estimated_speed",
-        "velocity_angle",
-        "path_data",
-        "recognized_license_plate",
-        "recognized_license_plate_score",
-    }
-
-    processed_events = [
-        {
-            "id": event.id,
-            "camera": event.camera,
-            "label": event.label,
-            "zones": event.zones,
-            "start_time": event.start_time,
-            "end_time": event.end_time,
-            "has_clip": event.has_clip,
-            "has_snapshot": event.has_snapshot,
-            "plus_id": event.plus_id,
-            "retain_indefinitely": event.retain_indefinitely,
-            "sub_label": event.sub_label,
-            "top_score": event.top_score,
-            "false_positive": event.false_positive,
-            "box": event.box,
-            "data": {
-                k: v for k, v in (event.data or {}).items() if k in allowed_data_keys
-            },
-            "event_count": event.event_count,
-        }
-        for event in query
-    ]
-
     return JSONResponse(content=processed_events)
 
 
@@ -511,18 +487,22 @@ async def event_ids(ids: str, request: Request):
             status_code=400,
         )
 
+    for event_id in ids:
+        try:
+            event = Event.get(Event.id == event_id)
+            await require_camera_access(event.camera, request=request)
+        except DoesNotExist:
+            # we should not fail the entire request if an event is not found
+            continue
+
     try:
-        events = list(Event.select().where(Event.id << ids).dicts().iterator())
+        events = Event.select().where(Event.id << ids).dicts().iterator()
+        return JSONResponse(list(events))
     except Exception:
         return JSONResponse(
             content=({"success": False, "message": "Events not found"}), status_code=400
         )
 
-    for event in events:
-        await require_camera_access(event["camera"], request=request)
-
-    return JSONResponse(events)
-
 
 @router.get(
     "/events/search",

frigate/api/preview.py

@@ -1,9 +1,7 @@
 """Preview apis."""
 
-import bisect
 import logging
 import os
-import threading
 from datetime import datetime, timedelta, timezone
 
 import pytz
@@ -135,32 +133,6 @@ def preview_hour(
     return preview_ts(camera_name, start_ts, end_ts, allowed_cameras)
 
 
-# cache one sorted listing of the shared preview_frames dir
-_preview_listing_lock = threading.Lock()
-_preview_listing_cache: tuple[float, list[str]] = (-1.0, [])
-
-
-def _get_preview_frame_listing(preview_dir: str) -> list[str]:
-    """Return the sorted preview_frames listing, cached until the dir changes."""
-    global _preview_listing_cache
-
-    # mtime bumps when a frame is added or removed, invalidating the cache
-    mtime = os.stat(preview_dir).st_mtime
-    cached_mtime, files = _preview_listing_cache
-    if mtime == cached_mtime:
-        return files
-
-    with _preview_listing_lock:
-        # another thread may have refreshed the cache while we waited
-        cached_mtime, files = _preview_listing_cache
-        if mtime == cached_mtime:
-            return files
-
-        files = sorted(entry.name for entry in os.scandir(preview_dir))
-        _preview_listing_cache = (mtime, files)
-        return files
-
-
 @router.get(
     "/preview/{camera_name}/start/{start_ts}/end/{end_ts}/frames",
     response_model=PreviewFramesResponse,
@@ -177,15 +149,23 @@ def get_preview_frames_from_cache(camera_name: str, start_ts: float, end_ts: flo
     start_file = f"{file_start}{start_ts}.{PREVIEW_FRAME_TYPE}"
     end_file = f"{file_start}{end_ts}.{PREVIEW_FRAME_TYPE}"
 
-    files = _get_preview_frame_listing(preview_dir)
-
-    # a camera's frames form a contiguous slice of the sorted listing;
-    # bisect locates it without scanning the whole directory
-    left = bisect.bisect_left(files, start_file)
-    right = bisect.bisect_right(files, end_file)
-    selected_previews = [
-        file for file in files[left:right] if file.startswith(file_start)
+    camera_files = [
+        entry.name
+        for entry in os.scandir(preview_dir)
+        if entry.name.startswith(file_start)
     ]
+    camera_files.sort()
+
+    selected_previews = []
+
+    for file in camera_files:
+        if file < start_file:
+            continue
+
+        if file > end_file:
+            break
+
+        selected_previews.append(file)
 
     return JSONResponse(
         content=selected_previews,

frigate/api/review.py

@@ -10,7 +10,7 @@ import pandas as pd
 from fastapi import APIRouter, Request
 from fastapi.params import Depends
 from fastapi.responses import JSONResponse
-from peewee import Case, DoesNotExist, fn, operator
+from peewee import Case, DoesNotExist, IntegrityError, fn, operator
 from playhouse.shortcuts import model_to_dict
 
 from frigate.api.auth import (
@@ -172,19 +172,11 @@ async def review_ids(request: Request, ids: str):
             status_code=400,
         )
 
-    try:
-        reviews = list(
-            ReviewSegment.select().where(ReviewSegment.id << ids).dicts().iterator()
-        )
-    except Exception:
-        return JSONResponse(
-            content=({"success": False, "message": "Review segments not found"}),
-            status_code=400,
-        )
-
-    found_ids = {r["id"] for r in reviews}
     for review_id in ids:
-        if review_id not in found_ids:
+        try:
+            review = ReviewSegment.get(ReviewSegment.id == review_id)
+            await require_camera_access(review.camera, request=request)
+        except DoesNotExist:
             return JSONResponse(
                 content=(
                     {"success": False, "message": f"Review {review_id} not found"}
@@ -192,10 +184,16 @@ async def review_ids(request: Request, ids: str):
                 status_code=404,
             )
 
-    for review in reviews:
-        await require_camera_access(review["camera"], request=request)
-
-    return JSONResponse(reviews)
+    try:
+        reviews = (
+            ReviewSegment.select().where(ReviewSegment.id << ids).dicts().iterator()
+        )
+        return JSONResponse(list(reviews))
+    except Exception:
+        return JSONResponse(
+            content=({"success": False, "message": "Review segments not found"}),
+            status_code=400,
+        )
 
 
 @router.get(
@@ -492,52 +490,27 @@ async def set_multiple_reviewed(
 
     user_id = current_user["username"]
 
-    reviews = list(
-        ReviewSegment.select(ReviewSegment.id, ReviewSegment.camera).where(
-            ReviewSegment.id << body.ids
-        )
-    )
-
-    for review in reviews:
-        await require_camera_access(review.camera, request=request)
-
-    found_ids = [r.id for r in reviews]
-
-    if found_ids:
-        existing_statuses = list(
-            UserReviewStatus.select().where(
-                (UserReviewStatus.user_id == user_id)
-                & (UserReviewStatus.review_segment << found_ids)
+    for review_id in body.ids:
+        try:
+            review = ReviewSegment.get(ReviewSegment.id == review_id)
+            await require_camera_access(review.camera, request=request)
+            review_status = UserReviewStatus.get(
+                UserReviewStatus.user_id == user_id,
+                UserReviewStatus.review_segment == review_id,
             )
-        )
-
-        status_by_review = {s.review_segment_id: s for s in existing_statuses}
-
-        to_update = []
-        to_create = []
-
-        for review_id in found_ids:
-            if review_id in status_by_review:
-                status = status_by_review[review_id]
-                if status.has_been_reviewed != body.reviewed:
-                    status.has_been_reviewed = body.reviewed
-                    to_update.append(status)
-            else:
-                to_create.append(
-                    {
-                        "user_id": user_id,
-                        "review_segment_id": review_id,
-                        "has_been_reviewed": body.reviewed,
-                    }
+            # Update based on the reviewed parameter
+            if review_status.has_been_reviewed != body.reviewed:
+                review_status.has_been_reviewed = body.reviewed
+                review_status.save()
+        except DoesNotExist:
+            try:
+                UserReviewStatus.create(
+                    user_id=user_id,
+                    review_segment=ReviewSegment.get(id=review_id),
+                    has_been_reviewed=body.reviewed,
                 )
-
-        if to_update:
-            UserReviewStatus.bulk_update(
-                to_update, fields=[UserReviewStatus.has_been_reviewed], batch_size=100
-            )
-
-        if to_create:
-            UserReviewStatus.insert_many(to_create).execute()
+            except (DoesNotExist, IntegrityError):
+                pass
 
     return JSONResponse(
         content=(

frigate/test/test_builtin.py

@@ -1,41 +0,0 @@
-"""Tests for frigate.util.builtin helpers."""
-
-import unittest
-from unittest.mock import patch
-
-from frigate.util.builtin import EventsPerSecond
-
-
-class TestEventsPerSecond(unittest.TestCase):
-    def test_eps_is_zero_before_any_events(self) -> None:
-        eps = EventsPerSecond()
-        with patch("frigate.util.builtin.time.monotonic", return_value=100.0):
-            self.assertEqual(eps.eps(), 0.0)
-
-    def test_eps_counts_events_in_window(self) -> None:
-        eps = EventsPerSecond(last_n_seconds=10)
-        clock = [1000.0]
-        with patch("frigate.util.builtin.time.monotonic", side_effect=lambda: clock[0]):
-            eps.start()
-            # one event per second for five seconds
-            for _ in range(5):
-                clock[0] += 1.0
-                eps.update()
-            # five events over the five seconds since start
-            self.assertAlmostEqual(eps.eps(), 1.0)
-
-    def test_old_timestamps_expire_from_window(self) -> None:
-        eps = EventsPerSecond(last_n_seconds=10)
-        clock = [0.0]
-        with patch("frigate.util.builtin.time.monotonic", side_effect=lambda: clock[0]):
-            eps.start()
-            for _ in range(10):
-                clock[0] += 1.0
-                eps.update()
-            # jump well past the window so every timestamp ages out
-            clock[0] += 100.0
-            self.assertEqual(eps.eps(), 0.0)
-
-
-if __name__ == "__main__":
-    unittest.main()

frigate/test/test_go2rtc_stream_auth.py

@@ -1,175 +0,0 @@
-"""Unit tests for `deny_response_for_go2rtc_stream`.
-
-Covers the camera-level authorization enforced in the `/auth` subrequest for
-the nginx-proxied go2rtc live-stream paths (MSE/WebRTC WebSockets and the
-WebRTC signaling endpoint). These paths name the stream via the `src` query
-param, which the static-media auth in `media_auth` does not inspect.
-"""
-
-import types
-import unittest
-
-from frigate.api.auth import deny_response_for_go2rtc_stream
-from frigate.config import FrigateConfig
-
-_CONFIG = {
-    "mqtt": {"host": "mqtt"},
-    "auth": {
-        "roles": {
-            "limited_user": ["front_door"],
-            "dual_user": ["front_door", "back_door"],
-        }
-    },
-    "cameras": {
-        "front_door": {
-            "ffmpeg": {
-                "inputs": [{"path": "rtsp://10.0.0.1:554/video", "roles": ["detect"]}]
-            },
-            "detect": {"height": 1080, "width": 1920, "fps": 5},
-            # go2rtc stream name differs from the camera name (substream)
-            "live": {"streams": {"Main Stream": "front_door_sub"}},
-        },
-        "back_door": {
-            "ffmpeg": {
-                "inputs": [{"path": "rtsp://10.0.0.2:554/video", "roles": ["detect"]}]
-            },
-            "detect": {"height": 1080, "width": 1920, "fps": 5},
-        },
-        "garage": {
-            "ffmpeg": {
-                "inputs": [{"path": "rtsp://10.0.0.3:554/video", "roles": ["detect"]}]
-            },
-            "detect": {"height": 1080, "width": 1920, "fps": 5},
-        },
-    },
-}
-
-
-def _request(config: FrigateConfig) -> types.SimpleNamespace:
-    return types.SimpleNamespace(app=types.SimpleNamespace(frigate_config=config))
-
-
-class TestDenyResponseForGo2rtcStream(unittest.TestCase):
-    def setUp(self) -> None:
-        self.config = FrigateConfig(**_CONFIG)
-        self.request = _request(self.config)
-
-    def _deny(self, url: str, role: str):
-        return deny_response_for_go2rtc_stream(url, role, self.request)
-
-    # --- non-stream paths pass through ---
-
-    def test_non_stream_path_passes_through(self):
-        self.assertIsNone(
-            self._deny("http://host/clips/back_door-1.jpg", "limited_user")
-        )
-
-    def test_empty_url_passes_through(self):
-        self.assertIsNone(self._deny("", "limited_user"))
-
-    def test_jsmpeg_path_not_handled_here(self):
-        # jsmpeg is authorized per-frame in the output pipeline, not here
-        self.assertIsNone(
-            self._deny("http://host/live/jsmpeg/back_door", "limited_user")
-        )
-
-    # --- restricted role: allowed vs forbidden cameras ---
-
-    def test_mse_allowed_camera(self):
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=front_door", "limited_user")
-        )
-
-    def test_mse_forbidden_camera_denied(self):
-        self.assertEqual(
-            self._deny("http://host/live/mse/api/ws?src=back_door", "limited_user"),
-            403,
-        )
-
-    def test_webrtc_ws_forbidden_camera_denied(self):
-        self.assertEqual(
-            self._deny("http://host/live/webrtc/api/ws?src=back_door", "limited_user"),
-            403,
-        )
-
-    def test_webrtc_signaling_forbidden_camera_denied(self):
-        self.assertEqual(
-            self._deny("http://host/api/go2rtc/webrtc?src=back_door", "limited_user"),
-            403,
-        )
-
-    def test_unknown_camera_denied(self):
-        self.assertEqual(
-            self._deny("http://host/live/mse/api/ws?src=nonexistent", "limited_user"),
-            403,
-        )
-
-    def test_missing_src_denied(self):
-        self.assertEqual(self._deny("http://host/live/mse/api/ws", "limited_user"), 403)
-
-    # --- multi-camera role: each assigned camera allowed, others denied ---
-
-    def test_multi_camera_role_allows_first_assigned(self):
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=front_door", "dual_user")
-        )
-
-    def test_multi_camera_role_allows_second_assigned(self):
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=back_door", "dual_user")
-        )
-
-    def test_multi_camera_role_denies_unassigned(self):
-        # garage is configured but not in dual_user's allow-list
-        self.assertEqual(
-            self._deny("http://host/live/mse/api/ws?src=garage", "dual_user"),
-            403,
-        )
-
-    # --- substream names resolve to their owning camera ---
-
-    def test_allowed_substream_resolves_to_owning_camera(self):
-        # front_door_sub is owned by front_door, which limited_user may access
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=front_door_sub", "limited_user")
-        )
-
-    # --- multiple src values: deny if any is forbidden ---
-
-    def test_multiple_src_one_forbidden_denied(self):
-        self.assertEqual(
-            self._deny(
-                "http://host/live/mse/api/ws?src=front_door&src=back_door",
-                "limited_user",
-            ),
-            403,
-        )
-
-    def test_multiple_src_all_allowed(self):
-        self.assertIsNone(
-            self._deny(
-                "http://host/live/mse/api/ws?src=front_door&src=front_door_sub",
-                "limited_user",
-            )
-        )
-
-    # --- privileged roles bypass the check ---
-
-    def test_admin_bypasses(self):
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=back_door", "admin")
-        )
-
-    def test_builtin_viewer_role_bypasses(self):
-        # the built-in viewer role is not in the config allow-list map, so it
-        # is treated as full access
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=back_door", "viewer")
-        )
-
-    def test_missing_role_bypasses(self):
-        self.assertIsNone(self._deny("http://host/live/mse/api/ws?src=back_door", None))
-
-
-if __name__ == "__main__":
-    unittest.main()

frigate/util/builtin.py

@@ -2,6 +2,7 @@
 
 import ast
 import copy
+import datetime
 import logging
 import math
 import multiprocessing.queues
@@ -9,9 +10,7 @@ import queue
 import re
 import shlex
 import struct
-import time
 import urllib.parse
-from collections import deque
 from collections.abc import Mapping
 from multiprocessing.managers import ValueProxy
 from pathlib import Path
@@ -33,20 +32,23 @@ class EventsPerSecond:
         self._start = None
         self._max_events = max_events
         self._last_n_seconds = last_n_seconds
-        self._timestamps: deque[float] = deque(maxlen=max_events)
+        self._timestamps = []
 
     def start(self) -> None:
-        self._start = time.monotonic()
+        self._start = datetime.datetime.now().timestamp()
 
     def update(self) -> None:
-        now = time.monotonic()
+        now = datetime.datetime.now().timestamp()
         if self._start is None:
             self._start = now
         self._timestamps.append(now)
+        # truncate the list when it goes 100 over the max_size
+        if len(self._timestamps) > self._max_events + 100:
+            self._timestamps = self._timestamps[(1 - self._max_events) :]
         self.expire_timestamps(now)
 
     def eps(self) -> float:
-        now = time.monotonic()
+        now = datetime.datetime.now().timestamp()
         if self._start is None:
             self._start = now
         # compute the (approximate) events in the last n seconds
@@ -61,7 +63,7 @@ class EventsPerSecond:
     def expire_timestamps(self, now: float) -> None:
         threshold = now - self._last_n_seconds
         while self._timestamps and self._timestamps[0] < threshold:
-            self._timestamps.popleft()
+            del self._timestamps[0]
 
 
 class InferenceSpeed:

migrations/036_add_perf_indexes.py

@@ -1,27 +0,0 @@
-"""Peewee migrations -- 036_add_perf_indexes.py.
-
-Adds composite/single-column indexes to speed up the most common queries
-issued by the web UI on initial page load:
-
-- event(camera, start_time DESC): /events list filtered by camera + time range
-- reviewsegment(camera, start_time DESC): /api/review filtered by camera + time range
-- reviewsegment(end_time): supports the end_time > after half of /api/review's range
-
-The existing event(label, start_time DESC) index from migration 027 already
-covers /events/explore, so it is intentionally not duplicated here.
-"""
-
-import peewee as pw
-
-SQL = pw.SQL
-
-
-def migrate(migrator, database, fake=False, **kwargs):
-    migrator.sql(
-        'CREATE INDEX IF NOT EXISTS "event_camera_start_time" '
-        'ON "event" ("camera", "start_time" DESC)'
-    )
-
-
-def rollback(migrator, database, fake=False, **kwargs):
-    migrator.sql('DROP INDEX IF EXISTS "event_camera_start_time"')

web/public/locales/en/components/dialog.json

@@ -70,13 +70,6 @@
       "selectFromTimeline": "Select from Timeline",
       "cameraSelection": "Cameras",
       "cameraSelectionHelp": "Cameras with tracked objects in this time range are pre-selected",
-      "searchOrSelectGroup": "Search, or select a camera group...",
-      "selectAll": "Select all cameras",
-      "clearSelection": "Clear selection",
-      "selectWithActivity": "Cameras with tracked objects",
-      "selectGroup": "Select group",
-      "noMatchingCameras": "No cameras match your search",
-      "selectedCount": "{{selected}} / {{total}} selected",
       "checkingActivity": "Checking camera activity...",
       "noCameras": "No cameras available",
       "detectionCount_one": "1 tracked object",

web/src/components/config-form/sectionExtras/CameraReviewClassification.tsx

@@ -243,7 +243,12 @@ export default function CameraReviewClassification({
                         handleZoneToggle("alerts.required_zones", zone.name)
                       }
                     />
-                    <Label className="font-normal">
+                    <Label
+                      className={cn(
+                        "font-normal",
+                        !zone.friendly_name && "smart-capitalize",
+                      )}
+                    >
                       {zone.friendly_name || zone.name}
                     </Label>
                   </div>

web/src/components/config-form/theme/widgets/ZoneSwitchesWidget.tsx

@@ -29,8 +29,8 @@ function getZoneDisplayName(zoneName: string, context?: FormContext): string {
       }
     }
   }
-  // Fallback to the raw zone id verbatim (no friendly_name available)
-  return String(zoneName);
+  // Fallback to cleaning up the zone name
+  return String(zoneName).replace(/_/g, " ");
 }
 
 export function ZoneSwitchesWidget(props: WidgetProps) {

web/src/components/overlay/ExportDialog.tsx

@@ -39,16 +39,6 @@ import {
   TooltipContent,
   TooltipTrigger,
 } from "@/components/ui/tooltip";
-import {
-  Command,
-  CommandGroup,
-  CommandInput,
-  CommandItem,
-  CommandList,
-  CommandSeparator,
-} from "../ui/command";
-import { IconRenderer } from "../icons/IconPicker";
-import * as LuIcons from "react-icons/lu";
 import { isDesktop, isMobile } from "react-device-detect";
 import { Drawer, DrawerContent, DrawerTrigger } from "../ui/drawer";
 import SaveExportOverlay from "./SaveExportOverlay";
@@ -386,9 +376,6 @@ export function ExportContent({
   const [newCaseName, setNewCaseName] = useState("");
   const [newCaseDescription, setNewCaseDescription] = useState("");
   const [isStartingBatchExport, setIsStartingBatchExport] = useState(false);
-  const [cameraSearch, setCameraSearch] = useState("");
-  const [cameraMenuOpen, setCameraMenuOpen] = useState(false);
-  const cameraMenuRef = useRef<HTMLDivElement>(null);
   const multiRangeKey = useMemo(() => {
     if (activeTab !== "multi" || !range) {
       return undefined;
@@ -590,75 +577,6 @@ export function ExportContent({
     );
   }, []);
 
-  const availableCameraIds = useMemo(
-    () => cameraActivities.map((activity) => activity.camera),
-    [cameraActivities],
-  );
-
-  const activeCameraIds = useMemo(
-    () =>
-      cameraActivities
-        .filter((activity) => activity.hasDetections)
-        .map((activity) => activity.camera),
-    [cameraActivities],
-  );
-
-  const cameraGroups = useMemo(
-    () =>
-      Object.entries(config?.camera_groups ?? {})
-        .map(([name, group]) => ({
-          name,
-          icon: group.icon,
-          order: group.order,
-          cameras: group.cameras.filter((cameraId) =>
-            availableCameraIds.includes(cameraId),
-          ),
-        }))
-        .filter((group) => group.cameras.length > 0)
-        .sort((a, b) => a.order - b.order),
-    [config?.camera_groups, availableCameraIds],
-  );
-
-  // Filter the rendered camera cards by the search query
-  const filteredCameraActivities = useMemo(() => {
-    const query = cameraSearch.trim().toLowerCase();
-    if (!query) {
-      return cameraActivities;
-    }
-    return cameraActivities.filter((activity) => {
-      const friendlyName = resolveCameraName(config, activity.camera);
-      return (
-        activity.camera.toLowerCase().includes(query) ||
-        friendlyName.toLowerCase().includes(query)
-      );
-    });
-  }, [cameraActivities, cameraSearch, config]);
-
-  // Group/all/activity selection replaces the current selection
-  const applyCameraSelection = useCallback((cameraIds: string[]) => {
-    setHasManualCameraSelection(true);
-    setSelectedCameraIds(cameraIds);
-    setCameraMenuOpen(false);
-  }, []);
-
-  // Close the dropdown when focus leaves the camera selection control entirely
-  const handleCameraInputBlur = useCallback((event: React.FocusEvent) => {
-    if (
-      cameraMenuRef.current &&
-      !cameraMenuRef.current.contains(event.relatedTarget as Node)
-    ) {
-      setCameraMenuOpen(false);
-    }
-  }, []);
-
-  // Reset the search and dropdown when leaving the multi-camera tab
-  useEffect(() => {
-    if (activeTab !== "multi") {
-      setCameraSearch("");
-      setCameraMenuOpen(false);
-    }
-  }, [activeTab]);
-
   const startBatchExport = useCallback(async () => {
     if (isStartingBatchExport) {
       return;
@@ -884,7 +802,7 @@ export function ExportContent({
 
           {isAdmin && (
             <div className="space-y-2">
-              <Label className="text-sm text-primary">
+              <Label className="text-sm text-secondary-foreground">
                 {t("export.case.label")}
               </Label>
               <Select
@@ -941,7 +859,7 @@ export function ExportContent({
           )}
         >
           <div className="space-y-2">
-            <Label className="text-sm text-primary">
+            <Label className="text-sm text-secondary-foreground">
               {t("export.multiCamera.timeRange")}
             </Label>
             <div className="flex items-center gap-2">
@@ -984,109 +902,16 @@ export function ExportContent({
           </div>
 
           <div className="space-y-2">
-            <div className="flex items-center justify-between gap-2">
-              <Label className="text-sm text-primary">
-                {t("export.multiCamera.cameraSelection")}
-              </Label>
-              {availableCameraIds.length > 0 && (
-                <span className="text-xs text-muted-foreground">
-                  {t("export.multiCamera.selectedCount", {
-                    selected: selectedCameraCount,
-                    total: availableCameraIds.length,
-                  })}
-                </span>
-              )}
-            </div>
+            <Label className="text-sm text-secondary-foreground">
+              {t("export.multiCamera.cameraSelection")}
+            </Label>
             <div className="text-xs text-muted-foreground">
               {t("export.multiCamera.cameraSelectionHelp")}
             </div>
-            {!isEventsLoading && availableCameraIds.length > 0 && (
-              <div className="relative" ref={cameraMenuRef}>
-                <Command
-                  shouldFilter={false}
-                  className="overflow-visible rounded-md border bg-secondary/40"
-                >
-                  <CommandInput
-                    value={cameraSearch}
-                    onValueChange={setCameraSearch}
-                    onFocus={() => setCameraMenuOpen(true)}
-                    onBlur={handleCameraInputBlur}
-                    placeholder={t("export.multiCamera.searchOrSelectGroup")}
-                  />
-                  {/* Hide the actions/groups menu while a search query is
-                      active so it doesn't cover the filtered camera cards. */}
-                  {cameraMenuOpen && cameraSearch.trim().length === 0 && (
-                    <CommandList className="absolute top-full z-10 mt-1 max-h-72 w-full rounded-md border bg-background shadow-md">
-                      <CommandGroup>
-                        <CommandItem
-                          value="action:select-all"
-                          className="cursor-pointer"
-                          onSelect={() =>
-                            applyCameraSelection(availableCameraIds)
-                          }
-                        >
-                          <span>{t("export.multiCamera.selectAll")}</span>
-                          <span className="ml-auto text-xs text-muted-foreground">
-                            {availableCameraIds.length}
-                          </span>
-                        </CommandItem>
-                        <CommandItem
-                          value="action:clear"
-                          className="cursor-pointer"
-                          onSelect={() => applyCameraSelection([])}
-                        >
-                          {t("export.multiCamera.clearSelection")}
-                        </CommandItem>
-                        <CommandItem
-                          value="action:activity"
-                          className="cursor-pointer"
-                          onSelect={() => applyCameraSelection(activeCameraIds)}
-                        >
-                          <span>
-                            {t("export.multiCamera.selectWithActivity")}
-                          </span>
-                          <span className="ml-auto text-xs text-muted-foreground">
-                            {activeCameraIds.length}
-                          </span>
-                        </CommandItem>
-                      </CommandGroup>
-                      {cameraGroups.length > 0 && (
-                        <>
-                          <CommandSeparator />
-                          <CommandGroup
-                            heading={t("export.multiCamera.selectGroup")}
-                          >
-                            {cameraGroups.map((group) => (
-                              <CommandItem
-                                key={group.name}
-                                value={`group:${group.name}`}
-                                className="cursor-pointer"
-                                onSelect={() =>
-                                  applyCameraSelection(group.cameras)
-                                }
-                              >
-                                <IconRenderer
-                                  icon={LuIcons[group.icon]}
-                                  className="mr-2 size-4 text-secondary-foreground"
-                                />
-                                <span className="truncate">{group.name}</span>
-                                <span className="ml-auto text-xs text-muted-foreground">
-                                  {group.cameras.length}
-                                </span>
-                              </CommandItem>
-                            ))}
-                          </CommandGroup>
-                        </>
-                      )}
-                    </CommandList>
-                  )}
-                </Command>
-              </div>
-            )}
             <div
               className={cn(
                 "scrollbar-container space-y-2",
-                isDesktop && "max-h-64 overflow-y-auto p-0.5 pr-1",
+                isDesktop && "max-h-64 overflow-y-auto pr-1",
               )}
             >
               {isEventsLoading && (
@@ -1099,14 +924,7 @@ export function ExportContent({
                   {t("export.multiCamera.noCameras")}
                 </div>
               )}
-              {!isEventsLoading &&
-                cameraActivities.length > 0 &&
-                filteredCameraActivities.length === 0 && (
-                  <div className="px-2 py-4 text-sm text-muted-foreground">
-                    {t("export.multiCamera.noMatchingCameras")}
-                  </div>
-                )}
-              {filteredCameraActivities.map((activity) => {
+              {cameraActivities.map((activity) => {
                 const isSelected = selectedCameraIds.includes(activity.camera);
 
                 return (
@@ -1163,7 +981,7 @@ export function ExportContent({
           </div>
 
           <div className="space-y-2">
-            <Label className="text-sm text-primary">
+            <Label className="text-sm text-secondary-foreground">
               {t("export.multiCamera.nameLabel")}
             </Label>
             <Input
@@ -1176,7 +994,7 @@ export function ExportContent({
 
           {isAdmin && (
             <div className="space-y-2">
-              <Label className="text-sm text-primary">
+              <Label className="text-sm text-secondary-foreground">
                 {t("export.case.label")}
               </Label>
               <Select

web/src/components/overlay/detail/TrackingDetails.tsx

@@ -1197,7 +1197,14 @@ function LifecycleIconRow({
                           backgroundColor: `rgb(${color})`,
                         }}
                       />
-                      <span>{item.data?.zones_friendly_names?.[zidx]}</span>
+                      <span
+                        className={cn(
+                          item.data?.zones_friendly_names?.[zidx] === zone &&
+                            "smart-capitalize",
+                        )}
+                      >
+                        {item.data?.zones_friendly_names?.[zidx]}
+                      </span>
                     </Badge>
                   );
                 })}

web/src/hooks/use-zone-friendly-name.ts

@@ -7,12 +7,12 @@ export function resolveZoneName(
   zoneId: string,
   cameraId?: string,
 ) {
-  if (!config) return String(zoneId);
+  if (!config) return String(zoneId).replace(/_/g, " ");
 
   if (cameraId) {
     const camera = config.cameras?.[String(cameraId)];
     const zone = camera?.zones?.[zoneId];
-    return zone?.friendly_name || String(zoneId);
+    return zone?.friendly_name || String(zoneId).replace(/_/g, " ");
   }
 
   for (const camKey in config.cameras) {
@@ -21,12 +21,12 @@ export function resolveZoneName(
     if (!cam?.zones) continue;
     if (Object.prototype.hasOwnProperty.call(cam.zones, zoneId)) {
       const zone = cam.zones[zoneId];
-      return zone?.friendly_name || String(zoneId);
+      return zone?.friendly_name || String(zoneId).replace(/_/g, " ");
     }
   }
 
-  // Fallback: display the raw zone id verbatim (no friendly_name available)
-  return String(zoneId);
+  // Fallback: return a cleaned-up zoneId string
+  return String(zoneId).replace(/_/g, " ");
 }
 
 export function useZoneFriendlyName(zoneId: string, cameraId?: string): string {