local spectators get real video maybe if it works

server/src/services/sessionService.js

@@ -16,6 +16,7 @@ const { loadConfig } = require('../helpers/configLoader');
 const { getCommunityGoal } = require('./communityGoalService');
 const { getAdminReason } = require('./adminReasonService');
 const { subscribe } = require('./eventBus');
+const { getSocketIp, isLocalNetwork } = require('../helpers/ipResolver');
 
 const config = loadConfig();
 const discordInvite = config.discord?.invite || null;
@@ -52,6 +53,7 @@ function buildSession(socket) {
     socketId: socket?.id || null,
     role: getRole(socket),
     mode: getMode(),
+    isLocalNetwork: isLocalNetwork(getSocketIp(socket)),
     roster: roverManager.getRoster(),
     assignment: assignmentService.describeAssignment(socket?.id || ''),
     activeDrivers: getActiveDrivers(),

server/src/services/videoAuthService.js

@@ -6,7 +6,7 @@ const { getMode, MODES } = require('./modeManager');
 const { isAdmin, isLockdownAdmin, getRole } = require('./roleService');
 const roverManager = require('./roverManager');
 const { loadConfig } = require('../helpers/configLoader');
-const { getRequestIp } = require('../helpers/ipResolver');
+const { getRequestIp, getSocketIp, isLocalNetwork } = require('../helpers/ipResolver');
 const { logAdminEvent } = require('./adminLogService');
 
 const config = loadConfig();
@@ -114,6 +114,13 @@ app.post('/mediamtx/auth', (req, res) => {
     return res.status(401).end();
   }
   const role = getRole(socket);
+  const isAudio = streamInfo.id?.endsWith('-audio');
+  if (role === 'spectator' && !isAdmin(socket) && !isAudio) {
+    const socketIp = getSocketIp(socket);
+    if (!isLocalNetwork(socketIp)) {
+      return res.status(401).end();
+    }
+  }
   if (streamInfo.type === 'rover' && role !== 'spectator' && !isAdmin(socket)) {
     const roverId = streamInfo.baseId || streamInfo.id;
     if (!roverManager.isDriver(roverId, socket)) {

server/src/services/videoSocketService.js

@@ -5,6 +5,7 @@ const { isAdmin, isLockdownAdmin, getRole } = require('./roleService');
 const videoSessions = require('./videoSessions');
 const roverManager = require('./roverManager');
 const { loadConfig } = require('../helpers/configLoader');
+const { getSocketIp, isLocalNetwork } = require('../helpers/ipResolver');
 
 const config = loadConfig();
 const mediaConfig = config.media || {};
@@ -86,12 +87,20 @@ io.on('connection', (socket) => {
       }
       if (target.type === 'rover') {
         const baseId = target.id.endsWith('-audio') ? target.id.slice(0, -6) : target.id;
+        const isAudio = target.id.endsWith('-audio');
         if (!roverManager.rovers.has(baseId)) {
           throw new Error('Rover offline');
         }
         if (!canViewRover(socket, baseId)) {
           throw new Error('Not authorized for video');
         }
+        const role = getRole(socket);
+        if (role === 'spectator' && !isAdmin(socket) && !isAudio) {
+          const ip = getSocketIp(socket);
+          if (!isLocalNetwork(ip)) {
+            throw new Error('Not authorized for video');
+          }
+        }
       } else if (target.type === 'room') {
         throw new Error('Room cameras now use the snapshot feed');
       } else {