switchreplay workers to rtsp

server/src/services/videoAuthService/httpRoute.js

@@ -32,13 +32,12 @@ function registerVideoAuthRoute(deps) {
       });
     }
 
-    const isSrtLikeProtocol = protocol === 'srt' || protocol === 'srtconn' || protocol.startsWith('srt');
     const isRtspProtocol = protocol === 'rtsp' || protocol.startsWith('rtsp');
-    const isForwardAudioRead = action === 'read' && streamInfo?.id?.endsWith('-fwd');
-    if ((action === 'read' && isSrtLikeProtocol) || isForwardAudioRead) {
-      return res.status(200).end();
-    }
-    if (action === 'publish' && isSrtLikeProtocol) {
+    const isLoopback = ip === '127.0.0.1' || ip === '::1';
+    // Replay and snapshot workers read MediaMTX through loopback RTSP. They do
+    // not represent a browser session, while non-loopback RTSP readers remain
+    // subject to the normal session authorization below.
+    if (action === 'read' && isRtspProtocol && isLoopback) {
       return res.status(200).end();
     }
     /*

server/src/services/videoAuthService/httpRoute.test.js

@@ -5,7 +5,7 @@ const test = require('node:test');
 const assert = require('node:assert/strict');
 const { registerVideoAuthRoute } = require('./httpRoute');
 
-function createHarness() {
+function createHarness({ requestIp = '127.0.0.1' } = {}) {
   let handler;
   const app = { post: (_path, fn) => { handler = fn; } };
   registerVideoAuthRoute({
@@ -13,7 +13,7 @@ function createHarness() {
     io: { sockets: { sockets: new Map() } },
     logger: { info() {}, warn() {} },
     videoSessions: { getSession: () => null, revokeSession() {} },
-    getRequestIp: () => '127.0.0.1',
+    getRequestIp: () => requestIp,
     logAdminEvent() {},
     extractStreamInfoFromBody: (body) => ({ type: 'rover', id: body.path, baseId: body.path }),
     canAccessStream: () => false,
@@ -42,6 +42,16 @@ test('allows an RTSP rover publisher without a browser session', () => {
   assert.equal(request({ protocol: 'rtsp', action: 'publish', path: 'rover-one' }), 200);
 });
 
+test('allows server-local RTSP replay and snapshot readers without a browser session', () => {
+  const { request } = createHarness();
+  assert.equal(request({ protocol: 'rtsp', action: 'read', path: 'rover-one' }), 200);
+});
+
+test('continues rejecting an unauthenticated remote RTSP reader', () => {
+  const { request } = createHarness({ requestIp: '192.0.2.10' });
+  assert.equal(request({ protocol: 'rtsp', action: 'read', path: 'rover-one' }), 401);
+});
+
 test('continues rejecting an unauthenticated WebRTC read', () => {
   const { request } = createHarness();
   assert.equal(request({ protocol: 'webrtc', action: 'read', path: 'rover-one' }), 401);

server/src/services/videoAuthService/streamParsing.js

@@ -1,6 +1,6 @@
 // Video Auth Stream Parsing
 // Purpose: Parses MediaMTX path/body payloads into normalized stream targets for rover and room media checks.
-// Scope: Handles native MediaMTX WHEP/WHIP paths and SRT streamid extraction without performing auth decisions.
+// Scope: Handles native MediaMTX path forms without performing auth decisions.
 
 const PTZ_STREAM_PATH = 'ptz-camera';
 
@@ -44,42 +44,10 @@ function extractStreamInfo(path) {
   return null;
 }
 
-function extractSrtStreamId(rawValue) {
-  const value = decodeURIComponent(String(rawValue || '').trim());
-  if (!value) return '';
-
-  const match = value.match(/(?:^|[?&]|,|#!::)r=([^,&]+)/);
-  if (match?.[1]) {
-    return match[1];
-  }
-
-  if (!/[?&=,:]/.test(value)) {
-    return value;
-  }
-
-  return '';
-}
-
 function extractStreamInfoFromBody(body = {}) {
-  const fromPath = extractStreamInfo((body.path || '').replace(/^\//, ''));
-  if (fromPath) return fromPath;
-
-  const srtId =
-    extractSrtStreamId(body.streamid) ||
-    extractSrtStreamId(body.streamId) ||
-    extractSrtStreamId(body.query);
-  if (!srtId) return null;
-
-  if (srtId === PTZ_STREAM_PATH) {
-    return { type: 'ptz', id: srtId };
-  }
-
-  if (srtId.endsWith('-fwd')) {
-    return { type: 'rover', id: srtId, baseId: srtId.slice(0, -4) };
-  }
-
-  const baseId = srtId.endsWith('-audio') ? srtId.slice(0, -6) : srtId;
-  return { type: 'rover', id: srtId, baseId };
+  // All enabled MediaMTX protocols now report the canonical path directly;
+  // there is no second SRT stream-id syntax to normalize or authorize.
+  return extractStreamInfo((body.path || '').replace(/^\//, ''));
 }
 
 module.exports = {