feat(sense): implement Control API v1 [T-011]

2026-08-07 20:54:41 +08:00
parent 0d3d7a22ed
commit a0d239811f
45 changed files with 4844 additions and 83 deletions
@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
@@ -19,20 +20,26 @@ const (
 	defaultReconcilePeriod = 5 * time.Second
 	defaultProbePeriod     = 10 * time.Second
 	defaultONVIFMode       = "disabled"
+	defaultControlAuthMode = "static-sha256"
 )

 type Config struct {
-	HTTPAddress       string
-	AllowNonLoopback  bool
-	DatabaseDriver    string
-	DatabaseDSN       string
-	MediaMTXURL       string
-	ReconcileInterval time.Duration
-	ProbeInterval     time.Duration
-	ONVIFMode         string
-	RTSPRewriteHost   string
-	RTSPRewritePort   int
-	RTSPStripQuery    bool
+	HTTPAddress              string
+	AllowNonLoopback         bool
+	DatabaseDriver           string
+	DatabaseDSN              string
+	MediaMTXURL              string
+	ReconcileInterval        time.Duration
+	ProbeInterval            time.Duration
+	ONVIFMode                string
+	RTSPRewriteHost          string
+	RTSPRewritePort          int
+	RTSPStripQuery           bool
+	ControlAPIEnabled        bool
+	ControlAuthMode          string
+	ControlAuthFile          string
+	ControlCursorKeyFile     string
+	ControlAllowInsecureHTTP bool
 }

 func Load() (Config, error) {
@@ -56,19 +63,32 @@ func Load() (Config, error) {
 	if err != nil {
 		return Config{}, err
 	}
+	controlEnabled, err := boolEnv("SENSE_CONTROL_API_ENABLED", false)
+	if err != nil {
+		return Config{}, err
+	}
+	controlAllowInsecure, err := boolEnv("SENSE_CONTROL_ALLOW_INSECURE_HTTP", false)
+	if err != nil {
+		return Config{}, err
+	}

 	cfg := Config{
-		HTTPAddress:       stringEnv("SENSE_HTTP_ADDR", defaultHTTPAddress),
-		AllowNonLoopback:  allow,
-		DatabaseDriver:    stringEnv("SENSE_DB_DRIVER", defaultDatabaseDriver),
-		DatabaseDSN:       stringEnv("SENSE_DB_DSN", defaultDatabaseDSN),
-		MediaMTXURL:       stringEnv("SENSE_MEDIAMTX_URL", defaultMediaMTXURL),
-		ReconcileInterval: reconcilePeriod,
-		ProbeInterval:     probePeriod,
-		ONVIFMode:         stringEnv("SENSE_ONVIF_MODE", defaultONVIFMode),
-		RTSPRewriteHost:   stringEnv("SENSE_ONVIF_RTSP_REWRITE_HOST", ""),
-		RTSPRewritePort:   rewritePort,
-		RTSPStripQuery:    stripQuery,
+		HTTPAddress:              stringEnv("SENSE_HTTP_ADDR", defaultHTTPAddress),
+		AllowNonLoopback:         allow,
+		DatabaseDriver:           stringEnv("SENSE_DB_DRIVER", defaultDatabaseDriver),
+		DatabaseDSN:              stringEnv("SENSE_DB_DSN", defaultDatabaseDSN),
+		MediaMTXURL:              stringEnv("SENSE_MEDIAMTX_URL", defaultMediaMTXURL),
+		ReconcileInterval:        reconcilePeriod,
+		ProbeInterval:            probePeriod,
+		ONVIFMode:                stringEnv("SENSE_ONVIF_MODE", defaultONVIFMode),
+		RTSPRewriteHost:          stringEnv("SENSE_ONVIF_RTSP_REWRITE_HOST", ""),
+		RTSPRewritePort:          rewritePort,
+		RTSPStripQuery:           stripQuery,
+		ControlAPIEnabled:        controlEnabled,
+		ControlAuthMode:          stringEnv("SENSE_CONTROL_AUTH_MODE", defaultControlAuthMode),
+		ControlAuthFile:          stringEnv("SENSE_CONTROL_AUTH_FILE", ""),
+		ControlCursorKeyFile:     stringEnv("SENSE_CONTROL_CURSOR_KEY_FILE", ""),
+		ControlAllowInsecureHTTP: controlAllowInsecure,
 	}
 	if err := cfg.Validate(); err != nil {
 		return Config{}, err
@@ -121,6 +141,23 @@ func (c Config) Validate() error {
 			return fmt.Errorf("invalid SENSE_ONVIF_RTSP_REWRITE_HOST")
 		}
 	}
+	if c.ControlAPIEnabled {
+		if databaseDriver != "postgres" {
+			return fmt.Errorf("Sense Control API requires SENSE_DB_DRIVER=postgres")
+		}
+		if c.ControlAuthMode != defaultControlAuthMode {
+			return fmt.Errorf("SENSE_CONTROL_AUTH_MODE must be static-sha256")
+		}
+		if c.ControlAuthFile == "" || !filepath.IsAbs(c.ControlAuthFile) {
+			return fmt.Errorf("SENSE_CONTROL_AUTH_FILE must be an absolute external path")
+		}
+		if c.ControlCursorKeyFile == "" || !filepath.IsAbs(c.ControlCursorKeyFile) {
+			return fmt.Errorf("SENSE_CONTROL_CURSOR_KEY_FILE must be an absolute external path")
+		}
+		if !isLoopback && !c.ControlAllowInsecureHTTP {
+			return fmt.Errorf("non-loopback Control API requires SENSE_CONTROL_ALLOW_INSECURE_HTTP=true")
+		}
+	}
 	return nil
 }