reject users whose role was removed from the config

A user whose role was removed from the config fell back to viewer, which has no camera restrictions, so a restricted role removed from yaml gained access to every camera. /auth now rejects that user's tokens, and login refuses them until an admin assigns a valid role.

docker/main/requirements-ov.txt

@@ -1,2 +1,2 @@
 numpy
-openvino >= 2026.4.1
+openvino >= 2026.2.0

docker/main/requirements-wheels.txt

@@ -23,7 +23,7 @@ pandas == 3.0.*
 peewee == 4.5.*
 peewee_migrate == 2.3.*
 psutil == 7.2.*
-pydantic == 2.14.*
+pydantic == 2.13.*
 git+https://github.com/fbcotter/py3nvml#egg=py3nvml
 tzdata == 2026.5
 pyzmq == 27.2.*
@@ -42,16 +42,16 @@ opencv-python-headless == 4.11.0.*
 opencv-contrib-python == 4.11.0.*
 scipy == 1.17.*
 # OpenVino & ONNX
-openvino == 2026.4.*
+openvino == 2025.4.*
 onnxruntime == 1.30.*
 # Embeddings
 transformers == 5.19.*
 # Generative AI
-google-genai == 2.31.*
+google-genai == 2.29.*
 ollama == 0.6.*
 openai == 3.26.*
 # push notifications
-py-vapid == 1.9.6
+py-vapid == 1.9.4
 pywebpush == 2.5.*
 # alpr
 pyclipper == 1.4.*

docker/main/requirements.txt

@@ -1 +1 @@
-scikit-build == 0.19.*
+scikit-build == 0.18.*

docker/main/rootfs/usr/local/nginx/conf/auth_location.conf

@@ -19,6 +19,7 @@ location /auth {
     # this cannot be spoofed
     proxy_set_header X-Go2rtc-Stream-Proxy $go2rtc_stream_proxy;
     proxy_set_header X-Server-Port $server_port;
+    proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header Content-Length "";
     # Pass along auth related info
     proxy_set_header Authorization $http_authorization;

docker/rocm/Dockerfile

@@ -2,9 +2,32 @@
 
 # https://askubuntu.com/questions/972516/debian-frontend-environment-variable
 ARG DEBIAN_FRONTEND=noninteractive
+ARG ROCM=1
 ARG HSA_OVERRIDE_GFX_VERSION
 ARG HSA_OVERRIDE
 
+#######################################################################
+FROM wget AS rocm
+
+ARG ROCM
+
+RUN apt update -qq && \
+    apt install -y wget gpg && \
+    wget -O rocm.deb https://repo.radeon.com/amdgpu-install/7.2.3/ubuntu/jammy/amdgpu-install_7.2.3.70203-1_all.deb && \
+    apt install -y ./rocm.deb && \
+    apt update && \
+    apt install -qq -y rocm
+
+RUN mkdir -p /opt/rocm-dist/opt/rocm-$ROCM/lib
+RUN cd /opt/rocm-$ROCM/lib && \
+    cp -dpr libMIOpen*.so* libamd*.so* libhip*.so* libhsa*.so* libmigraphx*.so* librocm*.so* librocblas*.so* libroctracer*.so* librocsolver*.so* librocfft*.so* librocprofiler*.so* libroctx*.so*  librocroller.so* /opt/rocm-dist/opt/rocm-$ROCM/lib/ && \
+    mkdir -p /opt/rocm-dist/opt/rocm-$ROCM/lib/migraphx/lib && \
+    cp -dpr migraphx/lib/* /opt/rocm-dist/opt/rocm-$ROCM/lib/migraphx/lib
+RUN cd /opt/rocm-dist/opt/ && ln -s rocm-$ROCM rocm
+
+RUN mkdir -p /opt/rocm-dist/etc/ld.so.conf.d/
+RUN echo /opt/rocm/lib|tee /opt/rocm-dist/etc/ld.so.conf.d/rocm.conf
+
 #######################################################################
 FROM deps AS deps-prelim
 
@@ -19,35 +42,51 @@ RUN echo "deb http://deb.debian.org/debian trixie main" > /etc/apt/sources.list.
     rm -f /etc/apt/sources.list.d/trixie.list && \
     rm -rf /var/lib/apt/lists/*
 
+WORKDIR /opt/frigate
+COPY --from=rootfs / /
+
 RUN wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
     && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
     && python3 get-pip.py "pip" --break-system-packages
 RUN python3 -m pip config set global.break-system-packages true
 
-# ROCm installs from AMD's wheels ahead of Frigate's code so code changes
-# reuse this layer, and is pruned in the same layer so the removed files never
-# reach the image. /opt/rocm links to the runtime for rocminfo and HIP headers.
 COPY docker/rocm/requirements-wheels-rocm.txt /requirements.txt
-RUN --mount=type=bind,source=docker/rocm/prune_rocm.sh,target=/deps/prune_rocm.sh \
-    pip3 uninstall -y onnxruntime \
-    && pip3 install --no-cache-dir -r /requirements.txt \
-    && ROCM_SDK_CORE="$(python3 -c 'import _rocm_sdk_core, os; print(os.path.dirname(_rocm_sdk_core.__file__))')" \
-    && /deps/prune_rocm.sh "$(dirname "${ROCM_SDK_CORE}")" \
-    && ln -s "${ROCM_SDK_CORE}" /opt/rocm
+RUN pip3 uninstall -y onnxruntime \
+    && pip3 install -r /requirements.txt
 
-WORKDIR /opt/frigate
-COPY --from=rootfs / /
+#######################################################################
+FROM scratch AS rocm-dist
+
+ARG ROCM
+
+# Copy HIP headers required for MIOpen JIT (BuildHip) / HIPRTC at runtime
+COPY --from=rocm /opt/rocm-${ROCM}/include/ /opt/rocm-${ROCM}/include/
+COPY --from=rocm /opt/rocm-$ROCM/bin/rocminfo /opt/rocm-$ROCM/bin/migraphx-driver /opt/rocm-$ROCM/bin/
+# Copy MIOpen database files for gfx10xx, gfx11xx, and gfx12xx only (RDNA2/RDNA3/RDNA4)
+COPY --from=rocm /opt/rocm-$ROCM/share/miopen/db/*gfx10* /opt/rocm-$ROCM/share/miopen/db/
+COPY --from=rocm /opt/rocm-$ROCM/share/miopen/db/*gfx11* /opt/rocm-$ROCM/share/miopen/db/
+COPY --from=rocm /opt/rocm-$ROCM/share/miopen/db/*gfx12* /opt/rocm-$ROCM/share/miopen/db/
+# Copy rocBLAS library files for gfx10xx, gfx11xx, and gfx12xx only
+COPY --from=rocm /opt/rocm-$ROCM/lib/rocblas/library/*gfx10* /opt/rocm-$ROCM/lib/rocblas/library/
+COPY --from=rocm /opt/rocm-$ROCM/lib/rocblas/library/*gfx11* /opt/rocm-$ROCM/lib/rocblas/library/
+COPY --from=rocm /opt/rocm-$ROCM/lib/rocblas/library/*gfx12* /opt/rocm-$ROCM/lib/rocblas/library/
+COPY --from=rocm /opt/rocm-dist/ /
 
 #######################################################################
 FROM deps-prelim AS rocm-prelim-hsa-override0
 ENV MIGRAPHX_DISABLE_MIOPEN_FUSION=1
 ENV MIGRAPHX_DISABLE_SCHEDULE_PASS=1
 ENV MIGRAPHX_DISABLE_REDUCE_FUSION=1
+ENV MIGRAPHX_ENABLE_HIPRTC_WORKAROUNDS=1
 ENV MIOPEN_CUSTOM_CACHE_DIR=/config/model_cache/migraphx
 ENV MIOPEN_USER_DB_PATH=/config/model_cache/migraphx
 ENV AMD_COMGR_CACHE=1
 ENV AMD_COMGR_CACHE_DIR=/config/model_cache/migraphx
 
+COPY --from=rocm-dist / /
+
+RUN ldconfig
+
 #######################################################################
 FROM rocm-prelim-hsa-override0 as rocm-prelim-hsa-override1
 

docker/rocm/prune_rocm.sh

@@ -1,63 +0,0 @@
-#!/bin/bash
-
-# Remove the parts of AMD's ROCm wheels that MIGraphX inference never loads:
-# compilers, debuggers, profilers, management tools, and the math libraries
-# (sparse, solver, FFT, random, RCCL, image processing) outside MIGraphX's
-# dependencies. Runs in the same layer as the install so the files never
-# reach the image.
-
-set -euo pipefail
-
-site_packages="$1"
-core="${site_packages}/_rocm_sdk_core"
-libraries="${site_packages}/_rocm_sdk_libraries"
-
-# rocminfo stays for checking that the GPU is visible in the container
-find "${core}/bin" -mindepth 1 -maxdepth 1 \
-    ! -name rocminfo ! -name rocm_agent_enumerator -exec rm -rf {} +
-
-# hiprtc compiles MIGraphX's kernels through comgr, which needs libLLVM,
-# libclang-cpp, the clang resource headers, and the amdgcn device libraries
-rm -rf "${core}/lib/llvm/bin" "${core}/lib/llvm/include"
-find "${core}/lib/llvm/lib" -mindepth 1 -maxdepth 1 \
-    ! -name 'libLLVM.so*' ! -name 'libclang-cpp.so*' ! -name clang \
-    -exec rm -rf {} +
-rm -rf "${core}"/lib/llvm/lib/clang/*/lib
-
-rm -rf \
-    "${core}/lib/host-math" \
-    "${core}"/lib/python3* \
-    "${core}/lib/rocprofiler-sdk" \
-    "${core}"/lib/librocprofiler-sdk*.so* \
-    "${core}"/lib/librocprof-trace-decoder.so* \
-    "${core}"/lib/librocm-dbgapi.so* \
-    "${core}"/lib/librocm-debug-agent.so* \
-    "${core}"/lib/libamd_smi*.so* \
-    "${core}"/lib/libgoamdsmi_shim64.so* \
-    "${core}"/lib/librocdecode.so* \
-    "${core}"/lib/librocjpeg.so* \
-    "${core}"/lib/librocdxg.so* \
-    "${core}"/lib/librocjitsu_*.so* \
-    "${core}"/lib/libhsa_hotswap_rocjitsu.so* \
-    "${core}"/lib/*.a
-
-rm -rf \
-    "${libraries}"/lib/librpp.so* \
-    "${libraries}"/lib/librocsparse.so* \
-    "${libraries}"/lib/libhipsparse.so* \
-    "${libraries}"/lib/libhipsparselt.so* \
-    "${libraries}/lib/rocsparse" \
-    "${libraries}"/lib/librocsolver.so* \
-    "${libraries}"/lib/libhipsolver.so* \
-    "${libraries}"/lib/libhipblas.so* \
-    "${libraries}"/lib/librocrand.so* \
-    "${libraries}"/lib/libhiprand.so* \
-    "${libraries}"/lib/librocfft.so* \
-    "${libraries}"/lib/libhipfft.so* \
-    "${libraries}"/lib/libhipfftw.so* \
-    "${libraries}"/lib/librccl.so* \
-    "${libraries}"/.kpack/sparse_lib_*.kpack \
-    "${libraries}"/.kpack/solver_lib_*.kpack \
-    "${libraries}"/.kpack/rand_lib_*.kpack \
-    "${libraries}"/.kpack/fft_lib_*.kpack \
-    "${libraries}"/.kpack/rccl_lib_*.kpack

docker/rocm/requirements-wheels-rocm.txt

@@ -1,19 +1 @@
-# ROCm 10.1.0, MIGraphX, and its ONNX Runtime plugin provider from AMD's wheels.
-onnxruntime == 1.29.*
-onnxruntime-ep-migraphx @ https://stable.repo.amd.com/rocm/onnxruntime/whl-next/onnxruntime-ep-migraphx/onnxruntime_ep_migraphx-1.0.0%2Brocm10.1.0-cp311-cp311-manylinux_2_28_x86_64.whl
-migraphx-libs @ https://stable.repo.amd.com/rocm/migraphx/whl-next/migraphx-libs/migraphx_libs-2.18.0%2Brocm10.1.0-py3-none-manylinux_2_28_x86_64.whl
-rocm-sdk-core @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-core/rocm_sdk_core-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-libraries @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-libraries/rocm_sdk_libraries-10.1.0-py3-none-linux_x86_64.whl
-# Kernels for each supported GPU target. MIGraphX has no gfx1031-gfx1036 kernels,
-# so those GPUs run as gfx1030 with HSA_OVERRIDE_GFX_VERSION=10.3.0
-rocm-sdk-device-gfx1030 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1030/rocm_sdk_device_gfx1030-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-device-gfx1100 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1100/rocm_sdk_device_gfx1100-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-device-gfx1101 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1101/rocm_sdk_device_gfx1101-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-device-gfx1102 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1102/rocm_sdk_device_gfx1102-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-device-gfx1103 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1103/rocm_sdk_device_gfx1103-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-device-gfx1150 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1150/rocm_sdk_device_gfx1150-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-device-gfx1151 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1151/rocm_sdk_device_gfx1151-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-device-gfx1152 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1152/rocm_sdk_device_gfx1152-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-device-gfx1153 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1153/rocm_sdk_device_gfx1153-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-device-gfx1200 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1200/rocm_sdk_device_gfx1200-10.1.0-py3-none-linux_x86_64.whl
-rocm-sdk-device-gfx1201 @ https://stable.repo.amd.com/rocm/whl-next/rocm-sdk-device-gfx1201/rocm_sdk_device_gfx1201-10.1.0-py3-none-linux_x86_64.whl
+onnxruntime-migraphx @ https://github.com/NickM-27/frigate-onnxruntime-rocm/releases/download/v7.2.3-1/onnxruntime_migraphx-1.24.4-cp311-cp311-linux_x86_64.whl

docker/rocm/rocm.hcl

@@ -1,3 +1,6 @@
+variable "ROCM" {
+  default = "7.2.3"
+}
 variable "HSA_OVERRIDE_GFX_VERSION" {
   default = ""
 }
@@ -5,6 +8,12 @@ variable "HSA_OVERRIDE" {
   default = "1"
 }
 
+target wget {
+  dockerfile = "docker/main/Dockerfile"
+  platforms = ["linux/amd64"]
+  target = "wget"
+}
+
 target deps {
   dockerfile = "docker/main/Dockerfile"
   platforms = ["linux/amd64"]
@@ -21,10 +30,12 @@ target rocm {
   dockerfile = "docker/rocm/Dockerfile"
   contexts = {
     deps = "target:deps",
+    wget = "target:wget",
     rootfs = "target:rootfs"
   }
   platforms = ["linux/amd64"]
   args = {
+    ROCM = ROCM,
     HSA_OVERRIDE_GFX_VERSION = HSA_OVERRIDE_GFX_VERSION,
     HSA_OVERRIDE = HSA_OVERRIDE
   }

docs/docs/configuration/advanced/reference.md

@@ -117,7 +117,9 @@ auth:
   # Optional: Cookie to store the JWT token for native auth (default: shown below)
   cookie_name: frigate_token
   # Optional: Set secure flag on cookie. (default: shown below)
-  # NOTE: This should be set to True if you are using TLS
+  # NOTE: Frigate sets the flag automatically when serving TLS. Set this to True
+  # when a reverse proxy terminates TLS in front of Frigate. A proxy that connects
+  # to the TLS port must serve Frigate to browsers over HTTPS
   cookie_secure: False
   # Optional: Session length in seconds (default: shown below)
   session_length: 86400 # 24 hours

docs/docs/configuration/object_detectors.md

@@ -394,22 +394,6 @@ Note that the labelmap uses a subset of the complete COCO label set that has onl
 
 Support for AMD GPUs is provided using the [ONNX detector](#onnx). In order to utilize the AMD GPU for object detection use a frigate docker image with `-rocm` suffix, for example `ghcr.io/blakeblackshear/frigate:stable-rocm`.
 
-### Supported GPUs {#supported-gpus-rocm}
-
-The `-rocm` image includes ROCm support for these GPU chipsets, which work without any chipset override:
-
-| Chipset                                      | Example GPUs                                                             |
-| -------------------------------------------- | ------------------------------------------------------------------------ |
-| gfx1030 (RDNA2)                              | Radeon RX 6800 / 6800 XT / 6900 XT / 6950 XT, Radeon PRO W6800           |
-| gfx1100, gfx1101, gfx1102 (RDNA3)            | Radeon RX 7900 / 7800 / 7700 / 7600 series, Radeon PRO W7000 series      |
-| gfx1103 (RDNA3 integrated)                   | Radeon 780M / 760M in Ryzen 7040, 8040, 8000G, and 200 series processors |
-| gfx1150, gfx1151, gfx1152, gfx1153 (RDNA3.5) | Integrated GPUs in Ryzen AI 300 / 400 series and Ryzen AI Max processors |
-| gfx1200, gfx1201 (RDNA4)                     | Radeon RX 9060 / 9070 series, Radeon AI PRO R9700                        |
-
-Other RDNA2 GPUs (gfx1031 through gfx1036), such as the Radeon RX 6700 / 6600 / 6500 series and the Radeon 680M / 660M integrated GPUs, run on the gfx1030 support by [overriding the chipset](#docker-settings-for-overriding-the-gpu-chipset) to `10.3.0`.
-
-Older GPUs, including RDNA1 (Radeon RX 5000 series) and Vega based dedicated and integrated GPUs, are not supported.
-
 ### Docker settings for GPU access
 
 ROCm needs access to the `/dev/kfd` and `/dev/dri` devices. When docker or frigate is not run under root then also `video` (and possibly `render` and `ssl/_ssl`) groups should be added.
@@ -436,10 +420,19 @@ For reference on recommended settings see [running ROCm/pytorch in Docker](https
 
 ### Docker settings for overriding the GPU chipset
 
-A GPU whose chipset isn't in the [supported GPUs](#supported-gpus-rocm) list can run on the support for a closely related chipset by setting the `HSA_OVERRIDE_GFX_VERSION` environment variable. RDNA2 GPUs other than gfx1030 (gfx1031 through gfx1036) need this, using `10.3.0`:
+Your GPU might work just fine without any special configuration but in many cases they need manual settings. AMD/ROCm software stack comes with a limited set of GPU drivers and for newer or missing models you will have to override the chipset version to an older/generic version to get things working.
+
+Also AMD/ROCm does not "officially" support integrated GPUs. It still does work with most of them just fine but requires special settings. One has to configure the `HSA_OVERRIDE_GFX_VERSION` environment variable. See the [ROCm bug report](https://github.com/ROCm/ROCm/issues/1743) for context and examples.
+
+For the rocm frigate build there is some automatic detection:
+
+- gfx1031 -> 10.3.0
+- gfx1103 -> 11.0.0
+
+If you have something else you might need to override the `HSA_OVERRIDE_GFX_VERSION` at Docker launch. Suppose the version you want is `10.0.0`, then you should configure it from command line as:
 
 ```bash
-$ docker run -e HSA_OVERRIDE_GFX_VERSION=10.3.0 \
+$ docker run -e HSA_OVERRIDE_GFX_VERSION=10.0.0 \
     ...
 ```
 
@@ -450,17 +443,16 @@ services:
   frigate:
     ...
     environment:
-      HSA_OVERRIDE_GFX_VERSION: "10.3.0"
+      HSA_OVERRIDE_GFX_VERSION: "10.0.0"
 ```
 
-GPUs in the supported list don't need an override. An override that was set for the Radeon 780M / 760M (gfx1103) on an earlier version of Frigate is no longer needed and can be removed.
+Figuring out what version you need can be complicated as you can't tell the chipset name and driver from the AMD brand name.
 
-You can't tell the chipset from the AMD brand name, so check it in the container:
-
-- first make sure that the ROCm environment is running properly by running `/opt/rocm/bin/rocminfo` in the Frigate container. It should list both the CPU and the GPU with their properties
-- find the chipset version you have (gfxNNN) from the output of `rocminfo` (see below)
-- if the chipset isn't in the supported list, set `HSA_OVERRIDE_GFX_VERSION` to the closest supported chipset, written as major.minor.stepping (for example gfx1030 is `10.3.0`)
-- if things are not working check the Frigate docker logs
+- first make sure that rocm environment is running properly by running `/opt/rocm/bin/rocminfo` in the frigate container -- it should list both the CPU and the GPU with their properties
+- find the chipset version you have (gfxNNN) from the output of the `rocminfo` (see below)
+- use a search engine to query what `HSA_OVERRIDE_GFX_VERSION` you need for the given gfx name ("gfxNNN ROCm HSA_OVERRIDE_GFX_VERSION")
+- override the `HSA_OVERRIDE_GFX_VERSION` with relevant value
+- if things are not working check the frigate docker logs
 
 #### Figuring out if AMD/ROCm is working and found your GPU
 

docs/docs/frigate/hardware.md

@@ -72,7 +72,7 @@ Frigate supports multiple different detectors that work on different types of ha
 
 **AMD**
 
-- [ROCm](#rocm---amd-gpu): ROCm can run on AMD discrete and recent integrated GPUs to provide efficient object detection
+- [ROCm](#rocm---amd-gpu): ROCm can run on AMD Discrete GPUs to provide efficient object detection
   - [Supports limited model architectures](../../configuration/object_detectors#amdrocm-gpu-detector)
   - Runs best on discrete AMD GPUs
 - <CommunityBadge /> [XDNA2 (Ryzen AI)](#amd-xdna2): AMD XDNA2 NPU (sub-watt power AI/ML processor separate to the GPU) inside Strix and other "AI" branded AMD platforms
@@ -240,7 +240,7 @@ Apple Silicon can not run within a container, so a ZMQ proxy is utilized to comm
 
 ### ROCm - AMD GPU
 
-With the [ROCm](../configuration/object_detectors.md#amdrocm-gpu-detector) detector Frigate can take advantage of many AMD discrete and integrated GPUs, see the [supported GPUs](../configuration/object_detectors.md#supported-gpus-rocm).
+With the [ROCm](../configuration/object_detectors.md#amdrocm-gpu-detector) detector Frigate can take advantage of many discrete AMD GPUs.
 
 | Name           | YOLOv9 Inference Time       | YOLO-NAS Inference Time   | RF-DETR Inference Time |
 | -------------- | --------------------------- | ------------------------- | ---------------------- |

frigate/api/auth.py

@@ -5,6 +5,7 @@ import hashlib
 import ipaddress
 import json
 import logging
+import math
 import os
 import re
 import secrets
@@ -463,16 +464,47 @@ def validate_password_strength(password: str) -> tuple[bool, str | None]:
     return True, None
 
 
-def create_encoded_jwt(user, role, expiration, secret):
+def create_encoded_jwt(user, role, expiration, secret, iat: int | None = None):
+    if iat is None:
+        iat = int(time.time())
+
     return jwt.encode(
         {"alg": "HS256"},
-        {"sub": user, "role": role, "exp": expiration, "iat": int(time.time())},
+        {"sub": user, "role": role, "exp": expiration, "iat": iat},
         secret,
     )
 
 
+def _user_session(user: User) -> tuple[str, int | None]:
+    changed_at = user.password_changed_at
+
+    # rounded up so a token issued earlier in the same second is revoked
+    return user.role, math.ceil(changed_at.timestamp()) if changed_at else None
+
+
+def load_user_sessions() -> dict[str, tuple[str, int | None]]:
+    """Map each username to its role and password change time for /auth."""
+    return {user.username: _user_session(user) for user in User.select()}
+
+
+def refresh_user_session(request: Request, username: str) -> None:
+    """Sync the /auth session map after a user is created, changed or deleted."""
+    user = User.get_or_none(User.username == username)
+    if user is None:
+        request.app.user_sessions.pop(username, None)
+    else:
+        request.app.user_sessions[username] = _user_session(user)
+
+
+def is_secure_request(request: Request) -> bool:
+    # nginx sets X-Forwarded-Proto to its own scheme, replacing any client value
+    return (
+        request.app.frigate_config.auth.cookie_secure
+        or request.headers.get("x-forwarded-proto") == "https"
+    )
+
+
 def set_jwt_cookie(response: Response, cookie_name, encoded_jwt, max_age, secure):
-    # TODO: ideally this would set secure as well, but that requires TLS
     # Starlette sets SameSite=Lax by default. The cookie is still sent to
     # same-site iframes (e.g. Home Assistant on the same host or domain), but
     # not to cross-site ones. CSRF is also mitigated by requiring a custom
@@ -750,7 +782,6 @@ def auth(request: Request):
     fail_response.headers["location"] = "/login"
 
     JWT_COOKIE_NAME = request.app.frigate_config.auth.cookie_name
-    JWT_COOKIE_SECURE = request.app.frigate_config.auth.cookie_secure
     JWT_REFRESH = request.app.frigate_config.auth.refresh_time
     JWT_SESSION_LENGTH = request.app.frigate_config.auth.session_length
 
@@ -776,20 +807,27 @@ def auth(request: Request):
         if "sub" not in token.claims:
             logger.debug("user not set in jwt token")
             return fail_response
-        if "role" not in token.claims:
-            logger.debug("role not set in jwt token")
-            return fail_response
         if "exp" not in token.claims:
             logger.debug("exp not set in jwt token")
             return fail_response
 
         user = token.claims.get("sub")
-        role = token.claims.get("role")
+        session = request.app.user_sessions.get(user)
+        if session is None:
+            logger.debug("jwt user %s no longer exists", user)
+            return fail_response
+
+        role, password_changed_at = session
+        if password_changed_at is not None and (
+            int(token.claims.get("iat", 0)) < password_changed_at
+        ):
+            logger.debug("jwt token issued before password change")
+            return fail_response
 
-        # the token keeps the role it was issued with, so a role removed from
-        # the config since then must send the user back through login
         if role not in auth_config.roles:
-            logger.debug("jwt role %s is not in the config", role)
+            logger.debug(
+                "jwt user %s has role %s, which is not in the config", user, role
+            )
             return fail_response
 
         current_time = int(time.time())
@@ -812,25 +850,6 @@ def auth(request: Request):
         # if the jwt cookie is expiring soon
         if jwt_source == "cookie" and expiration - JWT_REFRESH <= current_time:
             logger.debug("jwt token expiring soon, refreshing cookie")
-
-            # Check if password has been changed since token was issued
-            # If so, force re-login by rejecting the refresh
-            try:
-                user_obj = User.get_by_id(user)
-                if user_obj.password_changed_at is not None:
-                    token_iat = int(token.claims.get("iat", 0))
-                    password_changed_timestamp = int(
-                        user_obj.password_changed_at.timestamp()
-                    )
-                    if token_iat < password_changed_timestamp:
-                        logger.debug(
-                            "jwt token issued before password change, rejecting refresh"
-                        )
-                        return fail_response
-            except DoesNotExist:
-                logger.debug("user not found")
-                return fail_response
-
             new_expiration = current_time + JWT_SESSION_LENGTH
             new_encoded_jwt = create_encoded_jwt(
                 user, role, new_expiration, request.app.jwt_token
@@ -840,7 +859,7 @@ def auth(request: Request):
                 JWT_COOKIE_NAME,
                 new_encoded_jwt,
                 JWT_SESSION_LENGTH,
-                JWT_COOKIE_SECURE,
+                is_secure_request(request),
             )
 
         success_response.headers["remote-user"] = user
@@ -929,7 +948,6 @@ def login(request: Request, body: AppPostLoginBody):
         )
 
     JWT_COOKIE_NAME = request.app.frigate_config.auth.cookie_name
-    JWT_COOKIE_SECURE = request.app.frigate_config.auth.cookie_secure
     JWT_SESSION_LENGTH = request.app.frigate_config.auth.session_length
     user = body.user
     password = body.password
@@ -945,13 +963,16 @@ def login(request: Request, body: AppPostLoginBody):
 
     password_hash = db_user.password_hash
     if verify_password(password, password_hash):
-        role = getattr(db_user, "role", "viewer")
-        config_roles_set = set(request.app.frigate_config.auth.roles.keys())
-        if role not in config_roles_set:
+        role = db_user.role
+        if role not in request.app.frigate_config.auth.roles:
             logger.warning(
-                f"User {db_user.username} has an invalid role {role}, falling back to 'viewer'."
+                "Login refused for user '%s' with role '%s', which is not in the config",
+                user,
+                role,
             )
-            role = "viewer"
+            failed_logins.record(user, time.time(), known=True)
+            return JSONResponse(content={"message": "Login failed"}, status_code=401)
+
         expiration = int(time.time()) + JWT_SESSION_LENGTH
         encoded_jwt = create_encoded_jwt(user, role, expiration, request.app.jwt_token)
         response = Response("", 200)
@@ -960,7 +981,7 @@ def login(request: Request, body: AppPostLoginBody):
             JWT_COOKIE_NAME,
             encoded_jwt,
             JWT_SESSION_LENGTH,
-            JWT_COOKIE_SECURE,
+            is_secure_request(request),
         )
         # Clear admin_first_time_login flag after successful admin login so the
         # UI stops showing the first-time login documentation link.
@@ -1029,6 +1050,7 @@ def create_user(
             User.notification_tokens: [],
         }
     ).execute()
+    refresh_user_session(request, body.username)
     request.app.config_publisher.publisher.publish("config/auth", None)
     return JSONResponse(content={"username": body.username})
 
@@ -1047,6 +1069,7 @@ def delete_user(request: Request, username: str):
         )
 
     User.delete_by_id(username)
+    refresh_user_session(request, username)
     request.app.config_publisher.publisher.publish("config/auth", None)
     return JSONResponse(content={"success": True})
 
@@ -1108,24 +1131,29 @@ async def update_password(
         )
 
     password_hash = hash_password(body.password, iterations=HASH_ITERATIONS)
+    changed_at = datetime.now()
     User.update(
         {
             User.password_hash: password_hash,
-            User.password_changed_at: datetime.now(),
+            User.password_changed_at: changed_at,
         }
     ).where(User.username == username).execute()
+    refresh_user_session(request, username)
 
     response = JSONResponse(content={"success": True})
 
     # If user changed their own password, issue a new JWT to keep them logged in
     if current_username == username:
         JWT_COOKIE_NAME = request.app.frigate_config.auth.cookie_name
-        JWT_COOKIE_SECURE = request.app.frigate_config.auth.cookie_secure
         JWT_SESSION_LENGTH = request.app.frigate_config.auth.session_length
 
         expiration = int(time.time()) + JWT_SESSION_LENGTH
         encoded_jwt = create_encoded_jwt(
-            username, current_role, expiration, request.app.jwt_token
+            username,
+            current_role,
+            expiration,
+            request.app.jwt_token,
+            iat=math.ceil(changed_at.timestamp()),
         )
         # Set new JWT cookie on response
         set_jwt_cookie(
@@ -1133,7 +1161,7 @@ async def update_password(
             JWT_COOKIE_NAME,
             encoded_jwt,
             JWT_SESSION_LENGTH,
-            JWT_COOKIE_SECURE,
+            is_secure_request(request),
         )
 
     return response
@@ -1173,6 +1201,7 @@ async def update_role(
         )
 
     User.set_by_id(username, {User.role: body.role})
+    refresh_user_session(request, username)
     request.app.config_publisher.publisher.publish("config/auth", None)
     return JSONResponse(content={"success": True})
 

frigate/api/fastapi_app.py

@@ -196,7 +196,9 @@ def create_fastapi_app(
             key_bytes = str(secret).encode("utf-8")
 
         app.jwt_token = OctKey.import_key(key_bytes)
+        app.user_sessions = auth.load_user_sessions()
     else:
         app.jwt_token = None
+        app.user_sessions = {}
 
     return app

frigate/app.py

@@ -622,6 +622,7 @@ class FrigateApp:
                     username="admin",
                     role="admin",
                     password_hash=password_hash,
+                    password_changed_at=datetime.datetime.now(),
                     notification_tokens=[],
                 ).execute()
 

frigate/config/auth.py

@@ -27,7 +27,7 @@ class AuthConfig(FrigateBaseModel):
     cookie_secure: bool = Field(
         default=False,
         title="Secure cookie flag",
-        description="Set the secure flag on the auth cookie; should be true when using TLS.",
+        description="Always set the secure flag on the auth cookie. Frigate sets it automatically when serving TLS; enable this when a reverse proxy terminates TLS in front of Frigate. A proxy that connects to the TLS port must serve Frigate to browsers over HTTPS.",
     )
     session_length: int = Field(
         default=86400,

frigate/detectors/detection_runners.py

@@ -10,7 +10,6 @@ from typing import Any
 import numpy as np
 import onnxruntime as ort
 
-from frigate.const import MODEL_CACHE_DIR
 from frigate.util.model import get_ort_providers
 from frigate.util.rknn_converter import auto_convert_model, is_rknn_compatible
 
@@ -56,9 +55,6 @@ _PROVIDER_LABELS = {
 LIGHTER_ANE_EP_NAME = "LighterANE"
 LIGHTER_ANE_LIBRARY = "/usr/lib/lighter/liblighter_ane_ep.so"
 
-# AMD's MIGraphX plugin execution provider, installed in the ROCm image
-MIGRAPHX_EP_NAME = "MIGraphXExecutionProvider"
-
 
 def get_lighter_ane_devices() -> list[Any]:
     """Get the Neural Engine devices lighter's provider offers, registering it once.
@@ -87,42 +83,6 @@ def get_lighter_ane_devices() -> list[Any]:
     return devices
 
 
-def get_migraphx_devices() -> list[Any]:
-    """Get the AMD GPU devices the MIGraphX provider offers, registering it once.
-
-    Returns:
-        The provider's ONNX Runtime devices, or an empty list outside the ROCm
-        image or without an AMD GPU
-    """
-    # Import here to avoid circular imports
-    from frigate.detectors.hardware import detect_amd_gpu
-
-    try:
-        import onnxruntime_ep_migraphx
-    except ImportError:
-        return []
-
-    # ONNX Runtime finds the provider's GPUs in the same /sys/class/drm entries,
-    # so an AMD GPU here means the provider lists it once registered
-    if detect_amd_gpu() is None:
-        return []
-
-    devices = [d for d in ort.get_ep_devices() if d.ep_name == MIGRAPHX_EP_NAME]
-
-    if not devices:
-        try:
-            ort.register_execution_provider_library(
-                MIGRAPHX_EP_NAME, onnxruntime_ep_migraphx.get_library_path()
-            )
-        except Exception as e:
-            logger.warning("Failed to load the MIGraphX provider: %s", e)
-            return []
-
-        devices = [d for d in ort.get_ep_devices() if d.ep_name == MIGRAPHX_EP_NAME]
-
-    return devices
-
-
 def is_arm64_platform() -> bool:
     """Check if we're running on an ARM platform."""
     machine = platform.machine().lower()
@@ -796,41 +756,12 @@ def get_optimized_runner(
                 ONNXModelRunner(session, model_type=model_type),
             )
 
-    if (
-        device != "CPU"
-        and not ONNXModelRunner.is_migraphx_complex_model(model_type)
-        and (migraphx_devices := get_migraphx_devices())
-    ):
-        migraphx_cache_dir = os.path.join(MODEL_CACHE_DIR, "migraphx/ort")
-        os.makedirs(migraphx_cache_dir, exist_ok=True)
-        sess_options = get_ort_session_options(model_type) or ort.SessionOptions()
-        # only the first AMD GPU is used, matching detect_amd_gpu
-        sess_options.add_provider_for_devices(
-            migraphx_devices[:1], {"cache_dir": migraphx_cache_dir}
-        )
-
-        try:
-            session = ort.InferenceSession(model_path, sess_options=sess_options)
-        except Exception as e:
-            logger.warning(
-                "Failed to load %s with MIGraphX, using the default providers: %s",
-                model_path,
-                e,
-            )
-        else:
-            return _record_runner(
-                model_path,
-                model_type,
-                ONNXModelRunner(session, model_type=model_type),
-            )
-
     providers, options = get_ort_providers(device == "CPU", device, **kwargs)
 
     if providers[0] == "CPUExecutionProvider":
         # In the default image, ONNXRuntime is used so we will only get CPUExecutionProvider
-        # In other images we will get CUDA which is preferred over OpenVINO, while
-        # MIGraphX in the ROCm image is already handled above
-        # There is currently no way to prioritize OpenVINO over CUDA in these images
+        # In other images we will get CUDA / ROCm which are preferred over OpenVINO
+        # There is currently no way to prioritize OpenVINO over CUDA / ROCm in these images
         if device != "CPU" and is_openvino_gpu_npu_available():
             return _record_runner(
                 model_path,
@@ -859,6 +790,15 @@ def get_optimized_runner(
             ),
         )
 
+    if (
+        providers
+        and providers[0] == "MIGraphXExecutionProvider"
+        and ONNXModelRunner.is_migraphx_complex_model(model_type)
+    ):
+        # Don't use MIGraphX for models that are not supported
+        providers.pop(0)
+        options.pop(0)
+
     return _record_runner(
         model_path,
         model_type,

frigate/test/http_api/test_http_auth_jwt_role.py

@@ -1,22 +1,29 @@
-"""Tests that /auth only accepts a JWT whose role is still in the config."""
+"""Tests that /auth takes the role and revocation state from the user, not the JWT."""
 
 import os
 import time
+from datetime import datetime
+from types import SimpleNamespace
 from unittest.mock import MagicMock, Mock, patch
 
-from frigate.api.auth import create_encoded_jwt
+from joserfc import jwt
+
+from frigate.api.auth import create_encoded_jwt, hash_password
 from frigate.api.fastapi_app import create_fastapi_app
+from frigate.app import FrigateApp
 from frigate.config import FrigateConfig
 from frigate.config.camera.updater import CameraConfigUpdatePublisher
 from frigate.const import JWT_SECRET_ENV_VAR
-from frigate.models import Event, Recordings, ReviewSegment
+from frigate.models import Event, Recordings, ReviewSegment, User
 from frigate.test.http_api.base_http_test import AuthTestClient, BaseTestHttp
 
+PASSWORD = "correct-horse-battery"
+
 
 @patch.dict(os.environ, {JWT_SECRET_ENV_VAR: "test-secret"})
 class TestAuthJwtRole(BaseTestHttp):
     def setUp(self):
-        super().setUp(models=[Event, Recordings, ReviewSegment])
+        super().setUp(models=[Event, Recordings, ReviewSegment, User])
         self.minimal_config = {
             "mqtt": {"host": "mqtt"},
             "auth": {"enabled": True, "roles": {"garage": ["front_door"]}},
@@ -36,6 +43,19 @@ class TestAuthJwtRole(BaseTestHttp):
                 }
             },
         }
+        User.delete().execute()
+        self._insert_user("admin", "admin")
+        self._insert_user("bob", "garage")
+
+    def _insert_user(self, username: str, role: str):
+        User.insert(
+            {
+                User.username: username,
+                User.role: role,
+                User.password_hash: hash_password(PASSWORD, iterations=1),
+                User.notification_tokens: [],
+            }
+        ).execute()
 
     def _create_app(self):
         mock_publisher = Mock(spec=CameraConfigUpdatePublisher)
@@ -55,27 +75,228 @@ class TestAuthJwtRole(BaseTestHttp):
             enforce_default_admin=False,
         )
 
-    def _auth(self, app, role: str):
-        token = create_encoded_jwt("bob", role, int(time.time()) + 3600, app.jwt_token)
-
-        with AuthTestClient(app) as client:
-            return client.get(
-                "/auth",
-                headers={
-                    "x-server-port": "8971",
-                    "authorization": f"Bearer {token}",
-                },
+    def _token(self, app, user: str, role: str, iat: int | None = None) -> str:
+        if iat is None:
+            return create_encoded_jwt(
+                user, role, int(time.time()) + 3600, app.jwt_token
             )
 
+        return jwt.encode(
+            {"alg": "HS256"},
+            {"sub": user, "role": role, "exp": int(time.time()) + 3600, "iat": iat},
+            app.jwt_token,
+        )
+
+    def _auth(self, client, token: str, source: str = "bearer"):
+        headers = {"x-server-port": "8971"}
+        if source == "bearer":
+            headers["authorization"] = f"Bearer {token}"
+        else:
+            client.cookies.set("frigate_token", token)
+
+        resp = client.get("/auth", headers=headers)
+        client.cookies.clear()
+        return resp
+
     def test_configured_role_is_accepted(self):
-        resp = self._auth(self._create_app(), "garage")
+        app = self._create_app()
+        with AuthTestClient(app) as client:
+            resp = self._auth(client, self._token(app, "bob", "garage"))
 
         self.assertEqual(resp.status_code, 202)
         self.assertEqual(resp.headers["remote-user"], "bob")
         self.assertEqual(resp.headers["remote-role"], "garage")
 
+    def test_role_claim_is_ignored(self):
+        app = self._create_app()
+        with AuthTestClient(app) as client:
+            resp = self._auth(client, self._token(app, "bob", "admin"))
+
+        self.assertEqual(resp.status_code, 202)
+        self.assertEqual(resp.headers["remote-role"], "garage")
+
     def test_role_removed_from_config_is_rejected(self):
-        resp = self._auth(self._create_app(), "removed_role")
+        User.update(role="removed_role").where(User.username == "bob").execute()
+        app = self._create_app()
+        with AuthTestClient(app) as client:
+            for source in ("bearer", "cookie"):
+                resp = self._auth(client, self._token(app, "bob", "garage"), source)
+                self.assertEqual(resp.status_code, 401)
+                self.assertNotIn("remote-role", resp.headers)
+
+    def test_login_refused_for_role_removed_from_config(self):
+        User.update(role="removed_role").where(User.username == "bob").execute()
+        with AuthTestClient(self._create_app()) as client:
+            resp = client.post("/login", json={"user": "bob", "password": PASSWORD})
 
         self.assertEqual(resp.status_code, 401)
-        self.assertNotIn("remote-role", resp.headers)
+        self.assertNotIn("set-cookie", resp.headers)
+
+    def test_demoted_user_gets_new_role_on_next_request(self):
+        app = self._create_app()
+        token = self._token(app, "bob", "admin")
+        User.update(role="admin").where(User.username == "bob").execute()
+        app.user_sessions["bob"] = ("admin", None)
+
+        with AuthTestClient(app) as client:
+            self.assertEqual(self._auth(client, token).headers["remote-role"], "admin")
+            resp = client.put("/users/bob/role", json={"role": "viewer"})
+            self.assertEqual(resp.status_code, 200)
+
+            for source in ("bearer", "cookie"):
+                resp = self._auth(client, token, source)
+                self.assertEqual(resp.status_code, 202)
+                self.assertEqual(resp.headers["remote-role"], "viewer")
+
+    def test_deleted_user_is_rejected(self):
+        app = self._create_app()
+        token = self._token(app, "bob", "garage")
+
+        with AuthTestClient(app) as client:
+            self.assertEqual(self._auth(client, token).status_code, 202)
+            self.assertEqual(client.delete("/users/bob").status_code, 200)
+
+            for source in ("bearer", "cookie"):
+                self.assertEqual(self._auth(client, token, source).status_code, 401)
+
+    def test_created_user_is_accepted(self):
+        app = self._create_app()
+        with AuthTestClient(app) as client:
+            resp = client.post(
+                "/users",
+                json={"username": "carol", "password": PASSWORD, "role": "viewer"},
+            )
+            self.assertEqual(resp.status_code, 200)
+            resp = self._auth(client, self._token(app, "carol", "viewer"))
+
+        self.assertEqual(resp.status_code, 202)
+        self.assertEqual(resp.headers["remote-role"], "viewer")
+
+    def test_password_change_revokes_older_tokens(self):
+        app = self._create_app()
+        old_token = self._token(app, "bob", "garage", iat=int(time.time()) - 10)
+
+        with AuthTestClient(app) as client:
+            self.assertEqual(self._auth(client, old_token).status_code, 202)
+            resp = client.put(
+                "/users/bob/password",
+                json={"password": "a-brand-new-password"},
+            )
+            self.assertEqual(resp.status_code, 200)
+
+            for source in ("bearer", "cookie"):
+                self.assertEqual(self._auth(client, old_token, source).status_code, 401)
+
+            changed_at = app.user_sessions["bob"][1]
+            resp = self._auth(client, self._token(app, "bob", "garage", changed_at))
+            self.assertEqual(resp.status_code, 202)
+
+    def test_password_change_revokes_token_from_the_same_second(self):
+        app = self._create_app()
+        changed_at = datetime.now().replace(microsecond=500000)
+        old_token = self._token(app, "bob", "garage", iat=int(changed_at.timestamp()))
+
+        with (
+            patch("frigate.api.auth.datetime") as mock_datetime,
+            AuthTestClient(app) as client,
+        ):
+            mock_datetime.now.return_value = changed_at
+            resp = client.put(
+                "/users/bob/password",
+                json={"password": "a-brand-new-password"},
+            )
+            self.assertEqual(resp.status_code, 200)
+
+            for source in ("bearer", "cookie"):
+                self.assertEqual(self._auth(client, old_token, source).status_code, 401)
+
+    def test_own_password_change_cookie_stays_valid(self):
+        app = self._create_app()
+        with AuthTestClient(app) as client:
+            resp = client.put(
+                "/users/bob/password",
+                json={"password": "a-brand-new-password", "old_password": PASSWORD},
+                headers={"remote-user": "bob", "remote-role": "garage"},
+            )
+            self.assertEqual(resp.status_code, 200)
+            new_token = resp.cookies["frigate_token"]
+
+            resp = self._auth(client, new_token, "cookie")
+
+        self.assertEqual(resp.status_code, 202)
+        self.assertEqual(resp.headers["remote-role"], "garage")
+
+    def test_admin_password_reset_revokes_older_tokens(self):
+        config = FrigateConfig(
+            **{**self.minimal_config, "auth": {"reset_admin_password": True}}
+        )
+        FrigateApp.init_auth(SimpleNamespace(config=config))
+
+        app = self._create_app()
+        old_token = self._token(app, "admin", "admin", iat=int(time.time()) - 10)
+
+        with AuthTestClient(app) as client:
+            for source in ("bearer", "cookie"):
+                self.assertEqual(self._auth(client, old_token, source).status_code, 401)
+
+    def test_auth_does_not_query_users(self):
+        app = self._create_app()
+
+        # expires inside the refresh window so the cookie refresh runs too
+        token = jwt.encode(
+            {"alg": "HS256"},
+            {"sub": "bob", "role": "garage", "exp": int(time.time()) + 60, "iat": 0},
+            app.jwt_token,
+        )
+
+        with (
+            patch.object(User, "select", side_effect=AssertionError("db query")),
+            AuthTestClient(app) as client,
+        ):
+            client.cookies.set("frigate_token", token)
+            resp = client.get("/auth", headers={"x-server-port": "8971"})
+
+        self.assertEqual(resp.status_code, 202)
+        self.assertIn("frigate_token=", resp.headers["set-cookie"])
+
+    def _login_cookie(self, headers: dict | None = None) -> str:
+        with AuthTestClient(self._create_app()) as client:
+            resp = client.post(
+                "/login",
+                json={"user": "bob", "password": PASSWORD},
+                headers=headers or {},
+            )
+
+        self.assertEqual(resp.status_code, 200)
+        return resp.headers["set-cookie"].lower()
+
+    def test_login_cookie_is_secure_over_tls(self):
+        cookie = self._login_cookie({"x-forwarded-proto": "https"})
+        self.assertIn("; secure", cookie)
+
+    def test_login_cookie_is_not_secure_over_http(self):
+        cookie = self._login_cookie({"x-forwarded-proto": "http"})
+        self.assertNotIn("; secure", cookie)
+
+    def test_cookie_secure_config_forces_secure(self):
+        self.minimal_config["auth"]["cookie_secure"] = True
+        cookie = self._login_cookie()
+        self.assertIn("; secure", cookie)
+
+    def test_refreshed_cookie_is_secure_over_tls(self):
+        app = self._create_app()
+        token = jwt.encode(
+            {"alg": "HS256"},
+            {"sub": "bob", "exp": int(time.time()) + 60, "iat": int(time.time())},
+            app.jwt_token,
+        )
+
+        with AuthTestClient(app) as client:
+            client.cookies.set("frigate_token", token)
+            resp = client.get(
+                "/auth",
+                headers={"x-server-port": "8971", "x-forwarded-proto": "https"},
+            )
+
+        self.assertEqual(resp.status_code, 202)
+        self.assertIn("; secure", resp.headers["set-cookie"].lower())

frigate/test/http_api/test_http_go2rtc_proxy_auth.py

@@ -33,6 +33,7 @@ class TestGo2rtcProxyAuth(BaseTestHttp):
         self.minimal_config = _CONFIG
         self.app = super().create_app()
         self.app.jwt_token = OctKey.import_key(b"0" * 32)
+        self.app.user_sessions = {"admin": ("admin", None), "viewer": ("viewer", None)}
 
         get_patch = patch(
             "frigate.api.auth.requests.get",

frigate/test/test_runner_devices.py

@@ -1,13 +1,12 @@
 """Tests for the device each model runner reports after loading."""
 
 import os
-import sys
 import tempfile
 import threading
 import unittest
 from unittest.mock import MagicMock, patch
 
-from frigate.detectors import detection_runners, hardware
+from frigate.detectors import detection_runners
 from frigate.detectors.detection_runners import (
     CudaGraphRunner,
     ONNXModelRunner,
@@ -18,7 +17,6 @@ from frigate.detectors.detection_runners import (
     record_loaded_device,
     snapshot_loaded_devices,
 )
-from frigate.util import model as model_util
 
 
 class TestRunnerDeviceName(unittest.TestCase):
@@ -319,215 +317,3 @@ class TestLighterANE(unittest.TestCase):
             get_optimized_runner("/models/arcface.onnx", "CPU", "arcface")
 
         ane.assert_not_called()
-
-
-class TestMIGraphX(unittest.TestCase):
-    """AMD's MIGraphX plugin provider, selected through its devices in the ROCm image."""
-
-    def setUp(self):
-        loaded_devices.clear()
-        self.root = tempfile.TemporaryDirectory()
-        self.addCleanup(self.root.cleanup)
-
-        for patcher in (
-            patch.object(hardware, "detect_amd_gpu", return_value=MagicMock()),
-            patch.object(detection_runners, "MODEL_CACHE_DIR", self.root.name),
-            patch.object(detection_runners, "is_rknn_compatible", return_value=False),
-            patch.object(detection_runners, "get_lighter_ane_devices", return_value=[]),
-        ):
-            patcher.start()
-            self.addCleanup(patcher.stop)
-
-        self.plugin = MagicMock()
-        self.plugin.get_library_path.return_value = "/site/libmigraphx-ep.so"
-
-    def _device(self) -> MagicMock:
-        device = MagicMock()
-        device.ep_name = "MIGraphXExecutionProvider"
-        return device
-
-    def test_no_devices_outside_the_rocm_image(self):
-        with (
-            patch.dict(sys.modules, {"onnxruntime_ep_migraphx": None}),
-            patch.object(
-                detection_runners.ort, "register_execution_provider_library"
-            ) as register,
-        ):
-            self.assertEqual(detection_runners.get_migraphx_devices(), [])
-            self.assertEqual(detection_runners.get_migraphx_devices(), [])
-
-        register.assert_not_called()
-
-    def test_no_devices_without_an_amd_gpu(self):
-        with (
-            patch.dict(sys.modules, {"onnxruntime_ep_migraphx": self.plugin}),
-            patch.object(hardware, "detect_amd_gpu", return_value=None),
-            patch.object(detection_runners.ort, "get_ep_devices") as get_ep_devices,
-            patch.object(
-                detection_runners.ort, "register_execution_provider_library"
-            ) as register,
-        ):
-            self.assertEqual(detection_runners.get_migraphx_devices(), [])
-
-        get_ep_devices.assert_not_called()
-        register.assert_not_called()
-
-    def test_the_provider_is_registered_once(self):
-        device = self._device()
-        other = MagicMock()
-        other.ep_name = "CPUExecutionProvider"
-
-        with (
-            patch.dict(sys.modules, {"onnxruntime_ep_migraphx": self.plugin}),
-            patch.object(
-                detection_runners.ort,
-                "get_ep_devices",
-                side_effect=[[other], [other, device], [other, device]],
-            ),
-            patch.object(
-                detection_runners.ort, "register_execution_provider_library"
-            ) as register,
-        ):
-            self.assertEqual(detection_runners.get_migraphx_devices(), [device])
-            self.assertEqual(detection_runners.get_migraphx_devices(), [device])
-
-        register.assert_called_once_with(
-            "MIGraphXExecutionProvider", "/site/libmigraphx-ep.so"
-        )
-
-    def test_a_provider_that_will_not_load_is_skipped(self):
-        with (
-            patch.dict(sys.modules, {"onnxruntime_ep_migraphx": self.plugin}),
-            patch.object(detection_runners.ort, "get_ep_devices", return_value=[]),
-            patch.object(
-                detection_runners.ort,
-                "register_execution_provider_library",
-                side_effect=RuntimeError("libamdhip64.so.7: cannot open shared object"),
-            ),
-            self.assertLogs(detection_runners.logger, level="WARNING"),
-        ):
-            self.assertEqual(detection_runners.get_migraphx_devices(), [])
-
-    def test_the_session_runs_on_the_first_gpu(self):
-        device = self._device()
-        session = MagicMock()
-        session.get_providers.return_value = [
-            "MIGraphXExecutionProvider",
-            "CPUExecutionProvider",
-        ]
-        options = MagicMock()
-
-        with (
-            patch.object(
-                detection_runners,
-                "get_migraphx_devices",
-                return_value=[device, self._device()],
-            ),
-            patch.object(
-                detection_runners, "get_ort_session_options", return_value=options
-            ),
-            patch.object(
-                detection_runners.ort, "InferenceSession", return_value=session
-            ) as inference_session,
-        ):
-            runner = get_optimized_runner("/models/yolo.onnx", "AUTO", "yolo-generic")
-
-        cache_dir = os.path.join(self.root.name, "migraphx/ort")
-        options.add_provider_for_devices.assert_called_once_with(
-            [device], {"cache_dir": cache_dir}
-        )
-        inference_session.assert_called_once_with(
-            "/models/yolo.onnx", sess_options=options
-        )
-        self.assertTrue(os.path.isdir(cache_dir))
-        self.assertIsInstance(runner, ONNXModelRunner)
-        self.assertEqual(
-            loaded_devices["/models/yolo.onnx"], ("yolo-generic", "MIGraphX")
-        )
-
-    def test_a_model_migraphx_cannot_load_uses_the_default_providers(self):
-        session = MagicMock()
-        session.get_providers.return_value = ["CPUExecutionProvider"]
-
-        with (
-            patch.object(
-                detection_runners,
-                "get_migraphx_devices",
-                return_value=[self._device()],
-            ),
-            patch.object(
-                detection_runners,
-                "get_ort_providers",
-                return_value=(["CPUExecutionProvider"], [{}]),
-            ),
-            patch.object(
-                detection_runners, "is_openvino_gpu_npu_available", return_value=False
-            ),
-            patch.object(
-                detection_runners.ort,
-                "InferenceSession",
-                side_effect=[RuntimeError("compile failed"), session],
-            ) as inference_session,
-            patch.object(
-                detection_runners, "get_ort_session_options", return_value=MagicMock()
-            ),
-            self.assertLogs(detection_runners.logger, level="WARNING"),
-        ):
-            runner = get_optimized_runner("/models/arcface.onnx", "AUTO", "arcface")
-
-        self.assertEqual(inference_session.call_count, 2)
-        self.assertIsInstance(runner, ONNXModelRunner)
-        self.assertEqual(loaded_devices["/models/arcface.onnx"], ("arcface", "CPU"))
-
-    def test_unsupported_models_and_cpu_models_skip_migraphx(self):
-        for model_path, device, model_type in [
-            ("/models/paddleocr.onnx", "AUTO", "paddleocr"),
-            ("/models/dfine.onnx", "AUTO", "dfine"),
-            ("/models/yolo.onnx", "CPU", "yolo-generic"),
-        ]:
-            session = MagicMock()
-            session.get_providers.return_value = ["CPUExecutionProvider"]
-
-            with (
-                self.subTest(model_type=model_type, device=device),
-                patch.object(
-                    detection_runners,
-                    "get_migraphx_devices",
-                    return_value=[self._device()],
-                ) as migraphx,
-                patch.object(
-                    detection_runners,
-                    "get_ort_providers",
-                    return_value=(["CPUExecutionProvider"], [{}]),
-                ),
-                patch.object(
-                    detection_runners,
-                    "is_openvino_gpu_npu_available",
-                    return_value=False,
-                ),
-                patch.object(
-                    detection_runners.ort, "InferenceSession", return_value=session
-                ),
-                patch.object(
-                    detection_runners, "get_ort_session_options", return_value=None
-                ),
-            ):
-                get_optimized_runner(model_path, device, model_type)
-
-            migraphx.assert_not_called()
-            self.assertEqual(loaded_devices[model_path], (model_type, "CPU"))
-
-    def test_migraphx_is_never_requested_by_name(self):
-        with patch.object(
-            model_util.ort,
-            "get_available_providers",
-            return_value=[
-                "AzureExecutionProvider",
-                "CPUExecutionProvider",
-                "MIGraphXExecutionProvider",
-            ],
-        ):
-            providers, options = model_util.get_ort_providers()
-
-        self.assertEqual(providers, ["CPUExecutionProvider"])
-        self.assertEqual(options, [{"enable_cpu_mem_arena": False}])

frigate/util/model.py

@@ -385,9 +385,15 @@ def get_ort_providers(
                     }
                 )
         elif provider == "MIGraphXExecutionProvider":
-            # MIGraphX is a plugin provider, which ONNX Runtime can't create by
-            # name, so get_optimized_runner selects it through its devices
-            continue
+            migraphx_cache_dir = os.path.join(MODEL_CACHE_DIR, "migraphx")
+            os.makedirs(migraphx_cache_dir, exist_ok=True)
+
+            providers.append(provider)
+            options.append(
+                {
+                    "migraphx_model_cache_dir": migraphx_cache_dir,
+                }
+            )
         elif provider == "CPUExecutionProvider":
             providers.append(provider)
             options.append(

web/package.json

@@ -23,28 +23,28 @@
   "dependencies": {
     "@cycjimmy/jsmpeg-player": "^6.1.2",
     "@hookform/resolvers": "^5.9.1",
-    "@radix-ui/react-alert-dialog": "^1.2.1",
-    "@radix-ui/react-aspect-ratio": "^1.2.0",
-    "@radix-ui/react-checkbox": "^1.4.1",
-    "@radix-ui/react-collapsible": "^1.2.1",
-    "@radix-ui/react-context-menu": "^2.4.1",
+    "@radix-ui/react-alert-dialog": "^1.1.24",
+    "@radix-ui/react-aspect-ratio": "^1.1.16",
+    "@radix-ui/react-checkbox": "^1.3.12",
+    "@radix-ui/react-collapsible": "^1.1.21",
+    "@radix-ui/react-context-menu": "^2.3.8",
     "@radix-ui/react-dialog": "^1.2.0",
-    "@radix-ui/react-dropdown-menu": "^2.2.1",
-    "@radix-ui/react-hover-card": "^1.2.1",
-    "@radix-ui/react-label": "^2.1.17",
-    "@radix-ui/react-popover": "^1.3.1",
-    "@radix-ui/react-progress": "^1.2.1",
-    "@radix-ui/react-radio-group": "^1.5.1",
-    "@radix-ui/react-scroll-area": "^1.4.0",
-    "@radix-ui/react-select": "^2.4.1",
-    "@radix-ui/react-separator": "^1.2.0",
-    "@radix-ui/react-slider": "^1.6.1",
-    "@radix-ui/react-slot": "1.5.0",
-    "@radix-ui/react-switch": "^1.4.1",
-    "@radix-ui/react-tabs": "^1.2.1",
-    "@radix-ui/react-toggle": "^1.2.1",
-    "@radix-ui/react-toggle-group": "^1.2.1",
-    "@radix-ui/react-tooltip": "^1.4.1",
+    "@radix-ui/react-dropdown-menu": "^2.1.25",
+    "@radix-ui/react-hover-card": "^1.1.24",
+    "@radix-ui/react-label": "^2.1.16",
+    "@radix-ui/react-popover": "^1.2.0",
+    "@radix-ui/react-progress": "^1.1.17",
+    "@radix-ui/react-radio-group": "^1.4.8",
+    "@radix-ui/react-scroll-area": "^1.3.0",
+    "@radix-ui/react-select": "^2.3.8",
+    "@radix-ui/react-separator": "^1.1.16",
+    "@radix-ui/react-slider": "^1.5.0",
+    "@radix-ui/react-slot": "1.4.0",
+    "@radix-ui/react-switch": "^1.3.8",
+    "@radix-ui/react-tabs": "^1.1.22",
+    "@radix-ui/react-toggle": "^1.1.19",
+    "@radix-ui/react-toggle-group": "^1.1.20",
+    "@radix-ui/react-tooltip": "^1.3.0",
     "@rjsf/core": "^6.10.1",
     "@rjsf/shadcn": "^6.10.1",
     "@rjsf/utils": "^6.10.1",
@@ -127,6 +127,7 @@
   },
   "overrides": {
     "@radix-ui/react-compose-refs": "1.1.2",
-    "@radix-ui/react-slot": "1.5.0"
+    "@radix-ui/react-popper": "1.2.8",
+    "@radix-ui/react-slot": "1.4.0"
   }
 }

web/public/locales/en/config/global.json

@@ -40,7 +40,7 @@
     },
     "cookie_secure": {
       "label": "Secure cookie flag",
-      "description": "Set the secure flag on the auth cookie; should be true when using TLS."
+      "description": "Always set the secure flag on the auth cookie. Frigate sets it automatically when serving TLS; enable this when a reverse proxy terminates TLS in front of Frigate. A proxy that connects to the TLS port must serve Frigate to browsers over HTTPS."
     },
     "session_length": {
       "label": "Session length",

web/src/components/preview/ScrubbablePreview.tsx

@@ -210,7 +210,7 @@ export function VideoPreview({
   }, [playerRef]);
 
   const onProgressHover = useCallback(
-    (event: React.MouseEvent<HTMLElement>) => {
+    (event: React.MouseEvent<HTMLDivElement>) => {
       if (!sliderRef.current) {
         return;
       }
@@ -401,7 +401,7 @@ export function InProgressPreview({
   );
 
   const onProgressHover = useCallback(
-    (event: React.MouseEvent<HTMLElement>) => {
+    (event: React.MouseEvent<HTMLDivElement>) => {
       if (!sliderRef.current || !previewFrames) {
         return;
       }