mmainguy/cameras
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vrek: ISAPI stays read-only

Browse Source 
An Operator account can read ISAPI imaging but not write it (403,
lowPrivilege, proven with a no-op PUT that changed nothing). Rather than
give the app an Administrator camera login, the ISAPI-only settings stay
view-only and changes keep going through ONVIF; editing them is deferred.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Michael Mainguy 2026-09-19 18:22:04 -05:00
parent 5cc54036bd
commit a74e737d64
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.vrek/log.ndjson
View File

@ -959,3 +959,11 @@
{"id":"evt-gazexh8y4pwg","type":"node.created","subject":"ver-7t5zt61","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"verification","title":"Availability is probed from the camera's own capabilities rather than inferred: the panel lists only settings the camera advertises, with a line saying how many were found, and the answer (including a refusal) is cached per camera and path for five minutes","body":"","status":"pending","owner":"prn-q80g8mz","attrs":{}},"at":"2026-09-19T23:17:59.576Z","parents":["evt-9f61zmymr0rj"],"hash":"f52843abc56f17622eeb74b62c8bc005f3eaf64e838dbac841458b50b34a032b"}
{"id":"evt-wfexe355p48g","type":"edge.added","subject":"ver-7t5zt61","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"evidence_for","from":"ver-7t5zt61","to":"iss-b41wnpb"},"at":"2026-09-19T23:17:59.579Z","parents":["evt-gazexh8y4pwg"],"hash":"f60a32704101b91a37263e11285de25682f10c4a380d3b86047c23f17344459c"}
{"id":"evt-rrnm0qtbwbn5","type":"verification.recorded","subject":"ver-7t5zt61","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"result":"pass","evidence":"src/lib/isapi-image.test.ts parseImageOptions against test/fixtures/isapi-image-capabilities.xml (a real 4352-byte document from camera …af2e) and readAdvancedImage; src/lib/isapi.test.ts isapiGetCached (one request then memory, expiry, per-camera and per-path separation, refusals cached, resetIsapiCache); settings-sections.test.tsx \"leaves out settings this camera doesn't advertise\". Full suite 890 tests pass, 99.69% lines; tsc, eslint and next build clean."},"at":"2026-09-19T23:17:59.580Z","parents":["evt-wfexe355p48g"],"hash":"cbf1597d8c40c593ef1696c092b095707476214fbeedf59f514db1d168b9fc5d"}
{"id":"evt-rrh6q5yw9axg","type":"node.created","subject":"fnd-vfrgk0m","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"finding","title":"ISAPI imaging is read-only for an Operator account: writes are refused with lowPrivilege","body":"No-op write probe on camera …af2e on 2026-09-19, with the user's go-ahead, using the purpose-made Operator account. Read /ISAPI/Image/channels/1 (4057 bytes), sent exactly those bytes back with PUT, then read again. The PUT answered HTTP 403 ResponseStatus statusCode 4 \"Invalid Operation\", subStatusCode lowPrivilege; the document afterwards was byte-for-byte identical, so nothing on the camera changed. Conclusion: reading ISAPI imaging works at Operator level (fnd-qa5n7s5), writing does not, and a higher level would be needed. Worth noting the asymmetry: the same class of account over ONVIF does write imaging successfully, which is how the app's existing image editing works, so ONVIF remains the way to change the settings both protocols expose. The settings only ISAPI exposes (shutter limits, gain limit, HLC, lens distortion correction, the camera's lights) cannot be changed without raising the account's level. Not tested: whether an Administrator account writes successfully, or whether some ISAPI sub-paths are writable at Operator level.","status":"current","owner":"prn-q80g8mz","attrs":{"sources":[{"node":"iss-n7aa43e","note":"Camera …af2e, address redacted per dec-kgm44qw; read, identical PUT, read again"}],"as_of":"2026-09-19"}},"at":"2026-09-19T23:20:45.984Z","parents":["evt-rrnm0qtbwbn5"],"hash":"dcf60d57b810697a41a890c1c779ac7bb4583f9d81d92f0a7b63543adaf4b390"}
{"id":"evt-pwqpt5ch5xd9","type":"edge.added","subject":"fnd-vfrgk0m","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"informs","from":"fnd-vfrgk0m","to":"iss-n7aa43e"},"at":"2026-09-19T23:20:45.987Z","parents":["evt-rrh6q5yw9axg"],"hash":"9e04d088acf220d8574e88ad32c28f77c89f207564ac7a2fe456949308ccffe0"}
{"id":"evt-d9e5m0081d5v","type":"edge.added","subject":"fnd-vfrgk0m","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"informs","from":"fnd-vfrgk0m","to":"gol-7ajfexk"},"at":"2026-09-19T23:20:45.988Z","parents":["evt-pwqpt5ch5xd9"],"hash":"7bf080fd2ce3053442a8b978a6ae9e479263b3a4090d21c291f9e2783e78308d"}
{"id":"evt-vt9fn6dyyz8q","type":"node.updated","subject":"iss-n7aa43e","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"patch":{"body":"Blocked on a decision, not on code: fnd-vfrgk0m shows an Operator account cannot write ISAPI imaging (403, lowPrivilege), though it can read it. So editing the settings only ISAPI exposes (shutter minimum and maximum limits, gain limit, HLC, lens distortion correction, the camera's own lights) needs an account with a higher level, which means this app would hold a more powerful camera login than it does today. The settings both protocols expose keep being written over ONVIF, where an Operator is enough.\n\nOptions for the user: (a) leave ISAPI read-only and accept that these extras are view-only; (b) give the app's camera account Administrator level, gaining the writes and the risk; (c) keep a separate, rarely used Administrator login for changes, kept apart from the everyday Operator one. Once decided, the writer itself is straightforward: PUT the full /ISAPI/Image/channels/1 document with the change merged in, validated with zod against the camera's own capabilities, re-read afterwards, and appended to the audit log, exactly as the ONVIF writers do (dec-84ghhqr). Not yet tested: whether an Administrator account actually succeeds, and whether any sub-path is writable at Operator level."}},"at":"2026-09-19T23:20:55.963Z","parents":["evt-d9e5m0081d5v"],"hash":"fc00811353614cd2a270b3b1dc48ff7cfbeb583b135a9b762db1d4ec2bc4a2c5"}
{"id":"evt-tezhd9kctmce","type":"node.created","subject":"dec-ysy9emf","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"decision","title":"ISAPI stays read-only; changes keep going through ONVIF","body":"User's decision on 2026-09-19, after fnd-vfrgk0m showed an Operator account can read ISAPI imaging but not write it (403, lowPrivilege). The app keeps its Operator-level camera logins and does not gain an Administrator one, so the settings only ISAPI exposes (shutter minimum and maximum limits, gain limit, HLC, lens distortion correction, the camera's own lights) are shown but not editable. Settings both protocols expose continue to be written over ONVIF, where Operator is enough. Rejected for now: raising the app's account to Administrator, and keeping a separate Administrator login for changes; both would give this server a camera login that can change users and firmware, for a modest gain on settings that are rarely changed. Revisit if a need appears, or if a way is found to write these at Operator level.","status":"recorded","owner":"prn-q80g8mz","attrs":{}},"at":"2026-09-19T23:21:50.775Z","parents":["evt-vt9fn6dyyz8q"],"hash":"8a2d5348675319b655af2349ee1f972329454c6d5ec027f2f36009c7359f1b9e"}
{"id":"evt-deqh44zgj97r","type":"edge.added","subject":"dec-ysy9emf","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"kind":"serves","from":"dec-ysy9emf","to":"gol-7ajfexk"},"at":"2026-09-19T23:21:50.777Z","parents":["evt-tezhd9kctmce"],"hash":"b20bc55d1eac7c2de308d965620200e5d1b2f3c9400210ca752539411f2f760a"}
{"id":"evt-s0bqn6fcxn51","type":"node.updated","subject":"iss-n7aa43e","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"patch":{"attrs":{"revisit":null,"deferred_because":"Deferred by the user on 2026-09-19 per dec: ISAPI stays read-only rather than giving the app an Administrator camera login. Revisit if these settings are needed, or if Operator-level writes turn out to be possible."}}},"at":"2026-09-19T23:21:52.847Z","parents":["evt-deqh44zgj97r"],"hash":"9cdcfea6ec9ee00c55e0e9d0976ed619fc9695147ee1761fbf1a5ba9b23d7158"}
{"id":"evt-gk8y7966m8ar","type":"node.status_changed","subject":"iss-n7aa43e","actor":"prn-q80g8mz","actor_kind":"agent","session":null,"payload":{"from":"open","to":"deferred"},"at":"2026-09-19T23:21:52.848Z","parents":["evt-s0bqn6fcxn51"],"hash":"b8bb33ba609edb205ddb492873e23d907ab7e57bb968b58d1c1e9164bb23c486"}