Bump actions/checkout from 6 to 7

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
     name: AMD64 Build
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -47,7 +47,7 @@ jobs:
     name: ARM Build
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -82,7 +82,7 @@ jobs:
     name: Jetson Jetpack 6
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -113,7 +113,7 @@ jobs:
       - amd64_build
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -154,7 +154,7 @@ jobs:
       - arm64_build
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -179,7 +179,7 @@ jobs:
       - arm64_build
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx

.github/workflows/pull_request.yml

@@ -16,7 +16,7 @@ jobs:
     name: Web - Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: actions/setup-node@v6
@@ -35,7 +35,7 @@ jobs:
     name: Web - Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: actions/setup-node@v6
@@ -54,7 +54,7 @@ jobs:
     name: Web - E2E Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: actions/setup-node@v6
@@ -86,7 +86,7 @@ jobs:
     name: Python Checks
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.DEFAULT_PYTHON }}
@@ -109,7 +109,7 @@ jobs:
     name: Python Tests
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: actions/setup-node@v6

.github/workflows/release.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - id: lowercaseRepo

frigate/api/auth.py

@@ -12,7 +12,6 @@ import time
 from datetime import datetime
 from pathlib import Path
 from typing import List, Optional
-from urllib.parse import parse_qs, urlparse
 
 from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from fastapi.responses import JSONResponse, RedirectResponse
@@ -27,11 +26,7 @@ from frigate.api.defs.request.app_body import (
     AppPutRoleBody,
 )
 from frigate.api.defs.tags import Tags
-from frigate.api.media_auth import (
-    check_camera_access,
-    deny_response_for_media_uri,
-    is_role_restricted,
-)
+from frigate.api.media_auth import check_camera_access, deny_response_for_media_uri
 from frigate.config import AuthConfig, NetworkingConfig, ProxyConfig
 from frigate.const import CONFIG_DIR, JWT_SECRET_ENV_VAR, PASSWORD_HASH_ALGORITHM
 from frigate.models import User
@@ -663,10 +658,6 @@ def auth(request: Request):
         if deny_status is not None:
             return Response("", status_code=deny_status)
 
-        deny_status = deny_response_for_go2rtc_stream(original_url, role, request)
-        if deny_status is not None:
-            return Response("", status_code=deny_status)
-
         return success_response
 
     # now apply authentication
@@ -766,10 +757,6 @@ def auth(request: Request):
         if deny_status is not None:
             return Response("", status_code=deny_status)
 
-        deny_status = deny_response_for_go2rtc_stream(original_url, role, request)
-        if deny_status is not None:
-            return Response("", status_code=deny_status)
-
         return success_response
     except Exception as e:
         logger.error(f"Error parsing jwt: {e}")
@@ -1125,66 +1112,6 @@ def _get_stream_owner_cameras(request: Request, stream_name: str) -> set[str]:
     return owner_cameras
 
 
-# nginx proxies these paths straight to go2rtc with authentication-only checks
-# (see auth_request.conf). Each names the desired stream via the `src` query
-# param, so the camera-level check must happen here in the `/auth` subrequest —
-# `require_go2rtc_stream_access` only guards the REST `/go2rtc/streams/{name}`
-# endpoint, not these proxied live-stream paths.
-GO2RTC_STREAM_PROXY_PATHS = frozenset(
-    {
-        "/live/mse/api/ws",
-        "/live/webrtc/api/ws",
-        "/api/go2rtc/webrtc",
-    }
-)
-
-
-def deny_response_for_go2rtc_stream(
-    original_url: Optional[str], role: Optional[str], request: Request
-) -> Optional[int]:
-    """Block role-restricted users from go2rtc live streams they cannot access.
-
-    Returns 403 when any `src` stream named in `original_url` resolves to a
-    camera outside the role's allow-list (or when no `src` is provided on a
-    stream-proxy path), otherwise None. Mirrors the resolution logic in
-    `require_go2rtc_stream_access` so substream names map to their owning
-    camera correctly.
-    """
-    if not original_url:
-        return None
-
-    parsed = urlparse(original_url)
-    if parsed.path not in GO2RTC_STREAM_PROXY_PATHS:
-        return None
-
-    frigate_config = request.app.frigate_config
-
-    # admin and full-access roles (no allow-list) bypass the camera check
-    if not role or not is_role_restricted(role, frigate_config):
-        return None
-
-    sources = parse_qs(parsed.query).get("src", [])
-    if not sources:
-        # a stream-proxy request naming no stream has nothing legitimate to
-        # show a restricted user
-        return 403
-
-    allowed_cameras = set(
-        User.get_allowed_cameras(
-            role,
-            frigate_config.auth.roles,
-            set(frigate_config.cameras.keys()),
-        )
-    )
-
-    # deny if any requested source resolves outside the allow-list
-    for src in sources:
-        if not (_get_stream_owner_cameras(request, src) & allowed_cameras):
-            return 403
-
-    return None
-
-
 async def require_go2rtc_stream_access(
     stream_name: Optional[str] = None,
     request: Request = None,

frigate/api/event.py

@@ -389,107 +389,83 @@ def events_explore(
     limit: int = 10,
     allowed_cameras: List[str] = Depends(get_allowed_cameras_for_filter),
 ):
-    if not allowed_cameras:
-        return JSONResponse(content=[])
-
-    explore_columns = (
-        Event.id,
-        Event.camera,
-        Event.label,
-        Event.sub_label,
-        Event.zones,
-        Event.start_time,
-        Event.end_time,
-        Event.has_clip,
-        Event.has_snapshot,
-        Event.plus_id,
-        Event.retain_indefinitely,
-        Event.top_score,
-        Event.false_positive,
-        Event.box,
-        Event.data,
+    # get distinct labels for all events
+    distinct_labels = (
+        Event.select(Event.label)
+        .where(Event.camera << allowed_cameras)
+        .distinct()
+        .order_by(Event.label)
     )
 
-    # Single query: per-label COUNT and top-N ranking by start_time computed
-    # via window functions in a CTE, then filtered to rn <= limit
-    event_count = (
-        fn.COUNT(Event.id).over(partition_by=[Event.label]).alias("event_count")
-    )
-    rn = (
-        fn.ROW_NUMBER()
-        .over(partition_by=[Event.label], order_by=[Event.start_time.desc()])
-        .alias("rn")
-    )
+    label_counts = {}
 
-    base_query = Event.select(
-        *explore_columns,
-        event_count,
-        rn,
-    ).where(Event.camera << allowed_cameras)
-    ranked = base_query.cte("ranked")
-    query = (
-        Event.select(
-            ranked.c.id,
-            ranked.c.camera,
-            ranked.c.label,
-            ranked.c.sub_label,
-            ranked.c.zones,
-            ranked.c.start_time,
-            ranked.c.end_time,
-            ranked.c.has_clip,
-            ranked.c.has_snapshot,
-            ranked.c.plus_id,
-            ranked.c.retain_indefinitely,
-            ranked.c.top_score,
-            ranked.c.false_positive,
-            ranked.c.box,
-            ranked.c.data,
-            ranked.c.event_count,
-        )
-        .from_(ranked)
-        .with_cte(ranked)
-        .where(ranked.c.rn <= limit)
-        .order_by(ranked.c.event_count.desc(), ranked.c.start_time.desc())
-        .objects()
+    def event_generator():
+        for label_obj in distinct_labels.iterator():
+            label = label_obj.label
+
+            # get most recent events for this label
+            label_events = (
+                Event.select()
+                .where((Event.label == label) & (Event.camera << allowed_cameras))
+                .order_by(Event.start_time.desc())
+                .limit(limit)
+                .iterator()
+            )
+
+            # count total events for this label
+            label_counts[label] = (
+                Event.select()
+                .where((Event.label == label) & (Event.camera << allowed_cameras))
+                .count()
+            )
+
+            yield from label_events
+
+    def process_events():
+        for event in event_generator():
+            processed_event = {
+                "id": event.id,
+                "camera": event.camera,
+                "label": event.label,
+                "zones": event.zones,
+                "start_time": event.start_time,
+                "end_time": event.end_time,
+                "has_clip": event.has_clip,
+                "has_snapshot": event.has_snapshot,
+                "plus_id": event.plus_id,
+                "retain_indefinitely": event.retain_indefinitely,
+                "sub_label": event.sub_label,
+                "top_score": event.top_score,
+                "false_positive": event.false_positive,
+                "box": event.box,
+                "data": {
+                    k: v
+                    for k, v in event.data.items()
+                    if k
+                    in [
+                        "type",
+                        "score",
+                        "top_score",
+                        "description",
+                        "sub_label_score",
+                        "average_estimated_speed",
+                        "velocity_angle",
+                        "path_data",
+                        "recognized_license_plate",
+                        "recognized_license_plate_score",
+                    ]
+                },
+                "event_count": label_counts[event.label],
+            }
+            yield processed_event
+
+    # convert iterator to list and sort
+    processed_events = sorted(
+        process_events(),
+        key=lambda x: (x["event_count"], x["start_time"]),
+        reverse=True,
     )
 
-    allowed_data_keys = {
-        "type",
-        "score",
-        "top_score",
-        "description",
-        "sub_label_score",
-        "average_estimated_speed",
-        "velocity_angle",
-        "path_data",
-        "recognized_license_plate",
-        "recognized_license_plate_score",
-    }
-
-    processed_events = [
-        {
-            "id": event.id,
-            "camera": event.camera,
-            "label": event.label,
-            "zones": event.zones,
-            "start_time": event.start_time,
-            "end_time": event.end_time,
-            "has_clip": event.has_clip,
-            "has_snapshot": event.has_snapshot,
-            "plus_id": event.plus_id,
-            "retain_indefinitely": event.retain_indefinitely,
-            "sub_label": event.sub_label,
-            "top_score": event.top_score,
-            "false_positive": event.false_positive,
-            "box": event.box,
-            "data": {
-                k: v for k, v in (event.data or {}).items() if k in allowed_data_keys
-            },
-            "event_count": event.event_count,
-        }
-        for event in query
-    ]
-
     return JSONResponse(content=processed_events)
 
 
@@ -511,18 +487,22 @@ async def event_ids(ids: str, request: Request):
             status_code=400,
         )
 
+    for event_id in ids:
+        try:
+            event = Event.get(Event.id == event_id)
+            await require_camera_access(event.camera, request=request)
+        except DoesNotExist:
+            # we should not fail the entire request if an event is not found
+            continue
+
     try:
-        events = list(Event.select().where(Event.id << ids).dicts().iterator())
+        events = Event.select().where(Event.id << ids).dicts().iterator()
+        return JSONResponse(list(events))
     except Exception:
         return JSONResponse(
             content=({"success": False, "message": "Events not found"}), status_code=400
         )
 
-    for event in events:
-        await require_camera_access(event["camera"], request=request)
-
-    return JSONResponse(events)
-
 
 @router.get(
     "/events/search",

frigate/api/review.py

@@ -10,7 +10,7 @@ import pandas as pd
 from fastapi import APIRouter, Request
 from fastapi.params import Depends
 from fastapi.responses import JSONResponse
-from peewee import Case, DoesNotExist, fn, operator
+from peewee import Case, DoesNotExist, IntegrityError, fn, operator
 from playhouse.shortcuts import model_to_dict
 
 from frigate.api.auth import (
@@ -172,19 +172,11 @@ async def review_ids(request: Request, ids: str):
             status_code=400,
         )
 
-    try:
-        reviews = list(
-            ReviewSegment.select().where(ReviewSegment.id << ids).dicts().iterator()
-        )
-    except Exception:
-        return JSONResponse(
-            content=({"success": False, "message": "Review segments not found"}),
-            status_code=400,
-        )
-
-    found_ids = {r["id"] for r in reviews}
     for review_id in ids:
-        if review_id not in found_ids:
+        try:
+            review = ReviewSegment.get(ReviewSegment.id == review_id)
+            await require_camera_access(review.camera, request=request)
+        except DoesNotExist:
             return JSONResponse(
                 content=(
                     {"success": False, "message": f"Review {review_id} not found"}
@@ -192,10 +184,16 @@ async def review_ids(request: Request, ids: str):
                 status_code=404,
             )
 
-    for review in reviews:
-        await require_camera_access(review["camera"], request=request)
-
-    return JSONResponse(reviews)
+    try:
+        reviews = (
+            ReviewSegment.select().where(ReviewSegment.id << ids).dicts().iterator()
+        )
+        return JSONResponse(list(reviews))
+    except Exception:
+        return JSONResponse(
+            content=({"success": False, "message": "Review segments not found"}),
+            status_code=400,
+        )
 
 
 @router.get(
@@ -492,52 +490,27 @@ async def set_multiple_reviewed(
 
     user_id = current_user["username"]
 
-    reviews = list(
-        ReviewSegment.select(ReviewSegment.id, ReviewSegment.camera).where(
-            ReviewSegment.id << body.ids
-        )
-    )
-
-    for review in reviews:
-        await require_camera_access(review.camera, request=request)
-
-    found_ids = [r.id for r in reviews]
-
-    if found_ids:
-        existing_statuses = list(
-            UserReviewStatus.select().where(
-                (UserReviewStatus.user_id == user_id)
-                & (UserReviewStatus.review_segment << found_ids)
+    for review_id in body.ids:
+        try:
+            review = ReviewSegment.get(ReviewSegment.id == review_id)
+            await require_camera_access(review.camera, request=request)
+            review_status = UserReviewStatus.get(
+                UserReviewStatus.user_id == user_id,
+                UserReviewStatus.review_segment == review_id,
             )
-        )
-
-        status_by_review = {s.review_segment_id: s for s in existing_statuses}
-
-        to_update = []
-        to_create = []
-
-        for review_id in found_ids:
-            if review_id in status_by_review:
-                status = status_by_review[review_id]
-                if status.has_been_reviewed != body.reviewed:
-                    status.has_been_reviewed = body.reviewed
-                    to_update.append(status)
-            else:
-                to_create.append(
-                    {
-                        "user_id": user_id,
-                        "review_segment_id": review_id,
-                        "has_been_reviewed": body.reviewed,
-                    }
+            # Update based on the reviewed parameter
+            if review_status.has_been_reviewed != body.reviewed:
+                review_status.has_been_reviewed = body.reviewed
+                review_status.save()
+        except DoesNotExist:
+            try:
+                UserReviewStatus.create(
+                    user_id=user_id,
+                    review_segment=ReviewSegment.get(id=review_id),
+                    has_been_reviewed=body.reviewed,
                 )
-
-        if to_update:
-            UserReviewStatus.bulk_update(
-                to_update, fields=[UserReviewStatus.has_been_reviewed], batch_size=100
-            )
-
-        if to_create:
-            UserReviewStatus.insert_many(to_create).execute()
+            except (DoesNotExist, IntegrityError):
+                pass
 
     return JSONResponse(
         content=(

frigate/test/test_go2rtc_stream_auth.py

@@ -1,175 +0,0 @@
-"""Unit tests for `deny_response_for_go2rtc_stream`.
-
-Covers the camera-level authorization enforced in the `/auth` subrequest for
-the nginx-proxied go2rtc live-stream paths (MSE/WebRTC WebSockets and the
-WebRTC signaling endpoint). These paths name the stream via the `src` query
-param, which the static-media auth in `media_auth` does not inspect.
-"""
-
-import types
-import unittest
-
-from frigate.api.auth import deny_response_for_go2rtc_stream
-from frigate.config import FrigateConfig
-
-_CONFIG = {
-    "mqtt": {"host": "mqtt"},
-    "auth": {
-        "roles": {
-            "limited_user": ["front_door"],
-            "dual_user": ["front_door", "back_door"],
-        }
-    },
-    "cameras": {
-        "front_door": {
-            "ffmpeg": {
-                "inputs": [{"path": "rtsp://10.0.0.1:554/video", "roles": ["detect"]}]
-            },
-            "detect": {"height": 1080, "width": 1920, "fps": 5},
-            # go2rtc stream name differs from the camera name (substream)
-            "live": {"streams": {"Main Stream": "front_door_sub"}},
-        },
-        "back_door": {
-            "ffmpeg": {
-                "inputs": [{"path": "rtsp://10.0.0.2:554/video", "roles": ["detect"]}]
-            },
-            "detect": {"height": 1080, "width": 1920, "fps": 5},
-        },
-        "garage": {
-            "ffmpeg": {
-                "inputs": [{"path": "rtsp://10.0.0.3:554/video", "roles": ["detect"]}]
-            },
-            "detect": {"height": 1080, "width": 1920, "fps": 5},
-        },
-    },
-}
-
-
-def _request(config: FrigateConfig) -> types.SimpleNamespace:
-    return types.SimpleNamespace(app=types.SimpleNamespace(frigate_config=config))
-
-
-class TestDenyResponseForGo2rtcStream(unittest.TestCase):
-    def setUp(self) -> None:
-        self.config = FrigateConfig(**_CONFIG)
-        self.request = _request(self.config)
-
-    def _deny(self, url: str, role: str):
-        return deny_response_for_go2rtc_stream(url, role, self.request)
-
-    # --- non-stream paths pass through ---
-
-    def test_non_stream_path_passes_through(self):
-        self.assertIsNone(
-            self._deny("http://host/clips/back_door-1.jpg", "limited_user")
-        )
-
-    def test_empty_url_passes_through(self):
-        self.assertIsNone(self._deny("", "limited_user"))
-
-    def test_jsmpeg_path_not_handled_here(self):
-        # jsmpeg is authorized per-frame in the output pipeline, not here
-        self.assertIsNone(
-            self._deny("http://host/live/jsmpeg/back_door", "limited_user")
-        )
-
-    # --- restricted role: allowed vs forbidden cameras ---
-
-    def test_mse_allowed_camera(self):
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=front_door", "limited_user")
-        )
-
-    def test_mse_forbidden_camera_denied(self):
-        self.assertEqual(
-            self._deny("http://host/live/mse/api/ws?src=back_door", "limited_user"),
-            403,
-        )
-
-    def test_webrtc_ws_forbidden_camera_denied(self):
-        self.assertEqual(
-            self._deny("http://host/live/webrtc/api/ws?src=back_door", "limited_user"),
-            403,
-        )
-
-    def test_webrtc_signaling_forbidden_camera_denied(self):
-        self.assertEqual(
-            self._deny("http://host/api/go2rtc/webrtc?src=back_door", "limited_user"),
-            403,
-        )
-
-    def test_unknown_camera_denied(self):
-        self.assertEqual(
-            self._deny("http://host/live/mse/api/ws?src=nonexistent", "limited_user"),
-            403,
-        )
-
-    def test_missing_src_denied(self):
-        self.assertEqual(self._deny("http://host/live/mse/api/ws", "limited_user"), 403)
-
-    # --- multi-camera role: each assigned camera allowed, others denied ---
-
-    def test_multi_camera_role_allows_first_assigned(self):
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=front_door", "dual_user")
-        )
-
-    def test_multi_camera_role_allows_second_assigned(self):
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=back_door", "dual_user")
-        )
-
-    def test_multi_camera_role_denies_unassigned(self):
-        # garage is configured but not in dual_user's allow-list
-        self.assertEqual(
-            self._deny("http://host/live/mse/api/ws?src=garage", "dual_user"),
-            403,
-        )
-
-    # --- substream names resolve to their owning camera ---
-
-    def test_allowed_substream_resolves_to_owning_camera(self):
-        # front_door_sub is owned by front_door, which limited_user may access
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=front_door_sub", "limited_user")
-        )
-
-    # --- multiple src values: deny if any is forbidden ---
-
-    def test_multiple_src_one_forbidden_denied(self):
-        self.assertEqual(
-            self._deny(
-                "http://host/live/mse/api/ws?src=front_door&src=back_door",
-                "limited_user",
-            ),
-            403,
-        )
-
-    def test_multiple_src_all_allowed(self):
-        self.assertIsNone(
-            self._deny(
-                "http://host/live/mse/api/ws?src=front_door&src=front_door_sub",
-                "limited_user",
-            )
-        )
-
-    # --- privileged roles bypass the check ---
-
-    def test_admin_bypasses(self):
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=back_door", "admin")
-        )
-
-    def test_builtin_viewer_role_bypasses(self):
-        # the built-in viewer role is not in the config allow-list map, so it
-        # is treated as full access
-        self.assertIsNone(
-            self._deny("http://host/live/mse/api/ws?src=back_door", "viewer")
-        )
-
-    def test_missing_role_bypasses(self):
-        self.assertIsNone(self._deny("http://host/live/mse/api/ws?src=back_door", None))
-
-
-if __name__ == "__main__":
-    unittest.main()

migrations/036_add_perf_indexes.py

@@ -1,27 +0,0 @@
-"""Peewee migrations -- 036_add_perf_indexes.py.
-
-Adds composite/single-column indexes to speed up the most common queries
-issued by the web UI on initial page load:
-
-- event(camera, start_time DESC): /events list filtered by camera + time range
-- reviewsegment(camera, start_time DESC): /api/review filtered by camera + time range
-- reviewsegment(end_time): supports the end_time > after half of /api/review's range
-
-The existing event(label, start_time DESC) index from migration 027 already
-covers /events/explore, so it is intentionally not duplicated here.
-"""
-
-import peewee as pw
-
-SQL = pw.SQL
-
-
-def migrate(migrator, database, fake=False, **kwargs):
-    migrator.sql(
-        'CREATE INDEX IF NOT EXISTS "event_camera_start_time" '
-        'ON "event" ("camera", "start_time" DESC)'
-    )
-
-
-def rollback(migrator, database, fake=False, **kwargs):
-    migrator.sql('DROP INDEX IF EXISTS "event_camera_start_time"')

web/src/components/config-form/sectionExtras/CameraReviewClassification.tsx

@@ -243,7 +243,12 @@ export default function CameraReviewClassification({
                         handleZoneToggle("alerts.required_zones", zone.name)
                       }
                     />
-                    <Label className="font-normal">
+                    <Label
+                      className={cn(
+                        "font-normal",
+                        !zone.friendly_name && "smart-capitalize",
+                      )}
+                    >
                       {zone.friendly_name || zone.name}
                     </Label>
                   </div>

web/src/components/config-form/theme/widgets/ZoneSwitchesWidget.tsx

@@ -29,8 +29,8 @@ function getZoneDisplayName(zoneName: string, context?: FormContext): string {
       }
     }
   }
-  // Fallback to the raw zone id verbatim (no friendly_name available)
-  return String(zoneName);
+  // Fallback to cleaning up the zone name
+  return String(zoneName).replace(/_/g, " ");
 }
 
 export function ZoneSwitchesWidget(props: WidgetProps) {

web/src/components/overlay/detail/TrackingDetails.tsx

@@ -1197,7 +1197,14 @@ function LifecycleIconRow({
                           backgroundColor: `rgb(${color})`,
                         }}
                       />
-                      <span>{item.data?.zones_friendly_names?.[zidx]}</span>
+                      <span
+                        className={cn(
+                          item.data?.zones_friendly_names?.[zidx] === zone &&
+                            "smart-capitalize",
+                        )}
+                      >
+                        {item.data?.zones_friendly_names?.[zidx]}
+                      </span>
                     </Badge>
                   );
                 })}

web/src/hooks/use-zone-friendly-name.ts

@@ -7,12 +7,12 @@ export function resolveZoneName(
   zoneId: string,
   cameraId?: string,
 ) {
-  if (!config) return String(zoneId);
+  if (!config) return String(zoneId).replace(/_/g, " ");
 
   if (cameraId) {
     const camera = config.cameras?.[String(cameraId)];
     const zone = camera?.zones?.[zoneId];
-    return zone?.friendly_name || String(zoneId);
+    return zone?.friendly_name || String(zoneId).replace(/_/g, " ");
   }
 
   for (const camKey in config.cameras) {
@@ -21,12 +21,12 @@ export function resolveZoneName(
     if (!cam?.zones) continue;
     if (Object.prototype.hasOwnProperty.call(cam.zones, zoneId)) {
       const zone = cam.zones[zoneId];
-      return zone?.friendly_name || String(zoneId);
+      return zone?.friendly_name || String(zoneId).replace(/_/g, " ");
     }
   }
 
-  // Fallback: display the raw zone id verbatim (no friendly_name available)
-  return String(zoneId);
+  // Fallback: return a cleaned-up zoneId string
+  return String(zoneId).replace(/_/g, " ");
 }
 
 export function useZoneFriendlyName(zoneId: string, cameraId?: string): string {