Update api spec

docs/static/frigate-api.yaml

@@ -2308,8 +2308,8 @@ paths:
                 $ref: '#/components/schemas/HTTPValidationError'
       security:
         - frigateUserAuth: []
-      x-required-role: any
+      x-required-role: camera
-      description: '**Access:** Any authenticated user.'
+      description: '**Access:** Authenticated user with access to the referenced camera.'
   /review/summarize/start/{start_ts}/end/{end_ts}:
     post:
       tags:

frigate/api/review.py

@@ -709,6 +709,7 @@ async def get_review(request: Request, review_id: str):
     dependencies=[Depends(allow_any_authenticated())],
 )
 async def set_not_reviewed(
+    request: Request,
     review_id: str,
     current_user: dict = Depends(get_current_user),
 ):
@@ -727,6 +728,8 @@ async def set_not_reviewed(
             status_code=404,
         )
 
+    await require_camera_access(review.camera, request=request)
+
     try:
         user_review = UserReviewStatus.get(
             UserReviewStatus.user_id == user_id,

frigate/test/http_api/test_http_camera_access.py

@@ -166,6 +166,29 @@ class TestCameraAccessEventReview(BaseTestHttp):
                 resp = client.get("/review/rev1")
                 assert resp.status_code == 403
 
+    def test_review_not_reviewed_access(self):
+        super().insert_mock_review_segment("rev1", camera="front_door")
+
+        # Allowed
+        async def mock_require_allowed(camera: str, request: Request = None):
+            if camera == "front_door":
+                return
+            raise HTTPException(status_code=403, detail="Access denied")
+
+        with patch("frigate.api.review.require_camera_access", mock_require_allowed):
+            with AuthTestClient(self.app) as client:
+                resp = client.delete("/review/rev1/viewed")
+                assert resp.status_code == 200
+
+        # Disallowed
+        async def mock_require_disallowed(camera: str, request: Request = None):
+            raise HTTPException(status_code=403, detail="Access denied")
+
+        with patch("frigate.api.review.require_camera_access", mock_require_disallowed):
+            with AuthTestClient(self.app) as client:
+                resp = client.delete("/review/rev1/viewed")
+                assert resp.status_code == 403
+
     def test_event_search_access(self):
         super().insert_mock_event("event1", camera="front_door")
         super().insert_mock_event("event2", camera="back_door")