local spectators get real video maybe if it works

server/src/helpers/ipResolver.js

@@ -1,3 +1,5 @@
+const net = require('net');
+
 function extractForwardedIp(value) {
   if (typeof value === 'string' && value.trim()) {
     return value.split(',')[0].trim();
@@ -8,6 +10,56 @@ function extractForwardedIp(value) {
   return null;
 }
 
+function normalizeIp(value) {
+  if (!value) return null;
+  let ip = String(value).trim();
+  if (!ip) return null;
+  if (ip.startsWith('::ffff:')) {
+    ip = ip.slice(7);
+  }
+  if (ip.includes('%')) {
+    ip = ip.split('%')[0];
+  }
+  return ip.trim() || null;
+}
+
+function isPrivateIpv4(ip) {
+  const parts = ip.split('.').map((part) => Number(part));
+  if (parts.length !== 4 || parts.some((part) => Number.isNaN(part))) {
+    return false;
+  }
+  const [a, b] = parts;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 192 && b === 168) return true;
+  return a === 172 && b >= 16 && b <= 31;
+}
+
+function isPrivateIpv6(ip) {
+  const lower = ip.toLowerCase();
+  if (lower === '::1') return true;
+  if (lower.startsWith('fc') || lower.startsWith('fd')) return true; // fc00::/7
+  return (
+    lower.startsWith('fe8') ||
+    lower.startsWith('fe9') ||
+    lower.startsWith('fea') ||
+    lower.startsWith('feb')
+  ); // fe80::/10
+}
+
+function isLocalNetwork(ip) {
+  const normalized = normalizeIp(ip);
+  if (!normalized) return false;
+  const version = net.isIP(normalized);
+  if (version === 4) {
+    return isPrivateIpv4(normalized);
+  }
+  if (version === 6) {
+    return isPrivateIpv6(normalized);
+  }
+  return false;
+}
+
 function getSocketIp(socket) {
   if (!socket) return null;
   const headers = socket.handshake?.headers || {};
@@ -42,4 +94,6 @@ function getRequestIp(req, override) {
 module.exports = {
   getSocketIp,
   getRequestIp,
+  isLocalNetwork,
+  normalizeIp,
 };

server/src/services/sessionService.js

@@ -16,6 +16,7 @@ const { loadConfig } = require('../helpers/configLoader');
 const { getCommunityGoal } = require('./communityGoalService');
 const { getAdminReason } = require('./adminReasonService');
 const { subscribe } = require('./eventBus');
+const { getSocketIp, isLocalNetwork } = require('../helpers/ipResolver');
 
 const config = loadConfig();
 const discordInvite = config.discord?.invite || null;
@@ -52,6 +53,7 @@ function buildSession(socket) {
     socketId: socket?.id || null,
     role: getRole(socket),
     mode: getMode(),
+    isLocalNetwork: isLocalNetwork(getSocketIp(socket)),
     roster: roverManager.getRoster(),
     assignment: assignmentService.describeAssignment(socket?.id || ''),
     activeDrivers: getActiveDrivers(),

server/src/services/videoAuthService.js

@@ -6,7 +6,7 @@ const { getMode, MODES } = require('./modeManager');
 const { isAdmin, isLockdownAdmin, getRole } = require('./roleService');
 const roverManager = require('./roverManager');
 const { loadConfig } = require('../helpers/configLoader');
-const { getRequestIp } = require('../helpers/ipResolver');
+const { getRequestIp, getSocketIp, isLocalNetwork } = require('../helpers/ipResolver');
 const { logAdminEvent } = require('./adminLogService');
 
 const config = loadConfig();
@@ -114,6 +114,13 @@ app.post('/mediamtx/auth', (req, res) => {
     return res.status(401).end();
   }
   const role = getRole(socket);
+  const isAudio = streamInfo.id?.endsWith('-audio');
+  if (role === 'spectator' && !isAdmin(socket) && !isAudio) {
+    const socketIp = getSocketIp(socket);
+    if (!isLocalNetwork(socketIp)) {
+      return res.status(401).end();
+    }
+  }
   if (streamInfo.type === 'rover' && role !== 'spectator' && !isAdmin(socket)) {
     const roverId = streamInfo.baseId || streamInfo.id;
     if (!roverManager.isDriver(roverId, socket)) {

server/src/services/videoSocketService.js

@@ -5,6 +5,7 @@ const { isAdmin, isLockdownAdmin, getRole } = require('./roleService');
 const videoSessions = require('./videoSessions');
 const roverManager = require('./roverManager');
 const { loadConfig } = require('../helpers/configLoader');
+const { getSocketIp, isLocalNetwork } = require('../helpers/ipResolver');
 
 const config = loadConfig();
 const mediaConfig = config.media || {};
@@ -86,12 +87,20 @@ io.on('connection', (socket) => {
       }
       if (target.type === 'rover') {
         const baseId = target.id.endsWith('-audio') ? target.id.slice(0, -6) : target.id;
+        const isAudio = target.id.endsWith('-audio');
         if (!roverManager.rovers.has(baseId)) {
           throw new Error('Rover offline');
         }
         if (!canViewRover(socket, baseId)) {
           throw new Error('Not authorized for video');
         }
+        const role = getRole(socket);
+        if (role === 'spectator' && !isAdmin(socket) && !isAudio) {
+          const ip = getSocketIp(socket);
+          if (!isLocalNetwork(ip)) {
+            throw new Error('Not authorized for video');
+          }
+        }
       } else if (target.type === 'room') {
         throw new Error('Room cameras now use the snapshot feed');
       } else {