From 5b00dd0980480c5815c6fea346f0d892f8834d16 Mon Sep 17 00:00:00 2001 From: bassem chagra Date: Thu, 17 Sep 2026 10:45:43 +0200 Subject: [PATCH 1/4] feat(cctv): King County road camera source pack (Washington State) Adds King County DOT Road Services' cameras as a keyless source pack, from the county's public ArcGIS FeatureServer layer ("King County and WSDOT Traffic Cameras"). 59 live cameras against the current feed. - The `outFields` list is explicit on purpose: the layer also carries asset-administration columns (including staff names) that must never be fetched. - Only live, active cameras with frames on the county's own info.kingcounty.gov image handler are registered; the feed writes http:// and the handler serves HTTPS, so URLs are upgraded and pinned before registration. WSDOT-owned rows are skipped so a camera never appears twice when a statewide WSDOT pack is present; the few city-owned cameras the county hosts (Redmond, Sammamish, Newcastle, Snoqualmie) carry their owner as the per-camera credit, DriveBC-style. - The layer publishes no facing: headings use the shared id-hash fallback at low confidence, correctable with the calibration gizmo. - Uniquely among the packs, the county publishes each camera's hardware Manufacturer/Model (Cohu 3950/3965, Bosch AUTODOME IP 5000i, Axis Q6135-LE, Siqura PD910). The model string is whitespace-collapsed (the feed carries stray newlines) and carried on the source as `model`, with an additive passthrough in normalizeSourceItem (same pattern as poseSource) so identified-hardware consumers can use it. All 59 live cameras carry a model value. - Attribution per the KCGIS Center terms, registered in the attribution popover and documented in DATA_SOURCES.md. - Defaults: the whole catalog loads (125 cap); CCTV_KINGCOUNTY_MAX_SOURCES changes the cap, CCTV_KINGCOUNTY_ENABLED=0 turns the pack off. - Tests: filtering (owner/live/status/host/geometry/bbox), HTTPS upgrade, model whitespace-collapse and passthrough, partner-city credit, env cap, upstream-failure fallback, and normalizeSourceItem model semantics. --- DATA_SOURCES.md | 2 + server/providers/cctv/catalog.js | 6 + server/providers/cctv/constants.js | 19 +++ server/providers/cctv/normalize.js | 8 ++ server/providers/cctv/sources.js | 126 ++++++++++++++++++ src/data/cctvKingCountySource.test.mjs | 171 +++++++++++++++++++++++++ src/data/dataCredits.js | 9 ++ 7 files changed, 341 insertions(+) create mode 100644 src/data/cctvKingCountySource.test.mjs diff --git a/DATA_SOURCES.md b/DATA_SOURCES.md index b1439230e..c43ae7728 100644 --- a/DATA_SOURCES.md +++ b/DATA_SOURCES.md @@ -55,6 +55,7 @@ How to read this: | **Fintraffic / Digitraffic (weathercams)** | CCTV camera catalog + frames, Finland | [CC BY 4.0](https://www.digitraffic.fi/en/terms-of-service/) — attribution REQUIRED | "Fintraffic / digitraffic.fi, license CC BY 4.0" | | **DriveBC** (Government of British Columbia) | CCTV camera catalog + frames, British Columbia highways | [Open Government Licence – British Columbia](https://www2.gov.bc.ca/gov/content/data/open-data/open-government-licence-bc) — attribution REQUIRED | "DriveBC. Contains information licensed under the Open Government Licence – British Columbia" | | **Open Calgary** (`data.calgary.ca`) | CCTV camera catalog + frames, Calgary | [Open Government Licence – City of Calgary](https://data.calgary.ca/stories/s/Open-Calgary-Terms-of-Use/u45n-7awa) — attribution REQUIRED | "Contains information licensed under the Open Government Licence – City of Calgary" | +| **King County Road Services** (`services.arcgis.com`, King County GIS) | CCTV camera catalog + frames, unincorporated King County WA road network | [KCGIS Center terms](https://kingcounty.gov/en/dept/kcit/data-information-services/gis-center/about/terms-conditions-copyrights) — attribution required; public ArcGIS layer | "King County Road Services" (partner-city cameras name their owner) | | **GBFS (Lyft / BCycle)** | Bikeshare availability | Per-feed (attribution-only) | Credit the operator (e.g. Austin BCycle) + its `license_url` | | **MBTA / MassDOT** (cdn.mbta.com) | Transit layer live vehicles and up to 15 minutes of recently observed positions, Greater Boston | MBTA / MassDOT open realtime vehicle data, used for the live view and up to fifteen minutes of recently observed positions; published for developer use and not against their use. | Attribution to MBTA / MassDOT (courtesy text) | | **CapMetro** (data.texas.gov) | Transit layer live vehicles, Austin TX | CapMetro open realtime vehicle data, used for the live view; published for developer use and not against their use. | Attribution to CapMetro (courtesy text) | @@ -89,6 +90,7 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei - **Warendorf webcam.** The Stadt Warendorf Marktplatz webcam, registered from the curated `config/cctv_sources.warendorf.json` (the Kreis Warendorf registration-office cameras from the contributing PR are indoor waiting rooms and were left out); only the municipal image host is proxied, frames are fetched at request time and never stored or redistributed. Disable with `CCTV_WARENDORF_ENABLED=0`. - **Live Traffic NSW cameras.** The camera list is the keyless public `data.livetraffic.com/cameras/traffic-cam.json` feed (Transport for NSW open data, CC BY 4.0); frames are stills on `webcams.transport.nsw.gov.au`, and only that host is registered. That image host answers non-browser clients with an HTML placeholder, so the proxy identifies as a browser for that one host and as itself everywhere else. Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_NSW_ENABLED=0`. - **Open Calgary traffic cameras.** Keyless. The camera list is the public Socrata dataset `k7p9-kppz` on `data.calgary.ca`; frames are stills on the city's own `trafficcam.calgary.ca` host, and only that host is registered. Most rows publish an `http://` frame URL and the host redirects those to HTTPS, so URLs are upgraded and pinned to that origin before registration. Frames are fetched at request time and never stored or redistributed. The dataset publishes no camera facing: the `quadrant` field and the quadrant suffix on each camera name are Calgary's address grid, not a bearing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. The licence requires the attribution statement above. Disable with `CCTV_CALGARY_ENABLED=0`. +- **King County road cameras.** Keyless. The camera list is one public ArcGIS FeatureServer GeoJSON query (King County DOT Road Services, "King County and WSDOT Traffic Cameras"). The `outFields` list is explicit on purpose: the layer also carries asset-administration columns — including staff names — that are never fetched. Only live, active cameras with frames on the county's own `info.kingcounty.gov` image handler are registered (the feed writes `http://`; the handler serves HTTPS, so URLs are upgraded and pinned before registration). WSDOT-owned rows in the layer are skipped so a camera never appears twice when a statewide WSDOT pack is present; the few city-owned cameras the county hosts (Redmond, Sammamish, Newcastle, Snoqualmie) carry their owner as the per-camera credit. The layer publishes no facing, so headings use the shared id-hash fallback at low confidence. Uniquely, the county publishes each camera's hardware `Manufacturer`/`Model` (Cohu 3950/3965, Bosch AUTODOME, Axis PTZ domes); the model string is carried on the source as `model` for identified-hardware consumers. Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_KINGCOUNTY_ENABLED=0`. - **Camera frame content.** Public camera frames can contain people, vehicles and license plates, and the camera layer does nothing with them beyond putting them on the map. A successful upstream response is relayed as the provider served it: nothing in the camera pipeline blurs, redacts, enhances or restores it, and nothing there runs face, plate or object detection or otherwise recognises or classifies what is in the picture. (The ALPR layer described below maps where plate-reader cameras are, from locations contributors tagged in OpenStreetMap; it reads nothing from any camera frame.) When an upstream has no frame for a camera, what you see instead is a Google Street View still or the app's own placeholder card; the panel's source badge names which of them you are looking at, and a refresh that fails after a frame has arrived leaves the last good picture on screen rather than replacing it. The browser resamples each frame for display: onto a fixed 1920x1080 surface for the camera's projection plane in the scene, and onto a 192x108 canvas for the small ambient card. That scaling is the only change made to the picture, and the only pixels the camera layer reads back are a 64x36 downscale hashed to tell whether the picture has changed. Live streams are piped through; the still path reads the image into memory to pass it on — TxDOT wraps its JPEG in a JSON envelope, which is decoded there — and no frame is written to disk (the disk cache, `.gev-cache/`, holds feed JSON for other layers and never camera imagery). Outside that pipeline, the voice assistant is the one feature that sends imagery anywhere: when it answers a question about what is in view it may attach a downscaled screenshot of the rendered scene — including any camera plane on screen — to the request it sends to the voice model. Frames are fetched only from server-registered camera URLs — a client cannot hand the proxy a URL (see [SECURITY.md](SECURITY.md)). What the app does stays inside the line README draws: no named-person search, no face recognition, no tracking individuals. - **Transit (GTFS-Realtime).** The proxy requests only registered operator feeds, validates redirects, bounds responses, and uses conditional requests, short snapshot caching and failure backoff. All seven registered regions are live-enabled; each can be disabled independently. Vehicles use delayed playback between reports, with report age and waiting states shown separately. Session-local selected trails are available for every feed. MBTA additionally retains up to 15 minutes of recently observed positions in the running proxy, so available history can survive a browser reload; server restart clears it. History reads never fetch upstream, and other feeds have no proxy retention. Nothing is archived to disk or collected in the background. Operator text credits are included as a courtesy and do not imply endorsement. Heights are aligned to work with Google 3D tiles; subway markers are shown at street level because these feeds do not supply depth. - **Radio Browser.** `/api/radio/stations` discovers official API mirrors, makes bounded and coalesced healthy/geolocated HTTPS-station queries, caches the normalized public-domain directory for 45 minutes, and may serve the last good catalog for up to seven days during an outage. Refreshes must meet minimum accepted-query and station coverage before replacing a warm catalog; schema-valid responses whose rows all fail the product's health policy do not count as successful queries. A usable partial cold catalog is explicitly `DEGRADED`, and malformed or empty successful payloads are rejected atomically. Every directory and click-count request rejects redirects, validates all resolved addresses as globally routable (including reserved/documentation IPv4 and special/non-global IPv6 exclusions), and pins the TLS connection to a validated address. Only MP3/AAC non-HLS directory rows with public HTTPS stream targets are returned; favicons are intentionally omitted. Pressing play connects one browser audio element directly to the selected broadcaster and calls the directory's click counter through known-ID-only `POST /api/radio/click/:uuid`. GEV never proxies, caches, records, bundles, or redistributes audio. Radio Browser supplies station-level tags, not dependable current-song or upcoming-program metadata, so Radio filtering never claims either. Direct playback exposes the listener's IP address to the broadcaster, whose own stream terms apply. diff --git a/server/providers/cctv/catalog.js b/server/providers/cctv/catalog.js index ae0ab9afa..ec5cf05b5 100644 --- a/server/providers/cctv/catalog.js +++ b/server/providers/cctv/catalog.js @@ -18,6 +18,7 @@ import { loadNswSourcesFromOpenData, loadCalgarySourcesFromOpenData, loadDelDOTSourcesFromOpenData, + loadKingCountySourcesFromOpenData, } from './sources.js'; /** Env kill switch: unset or anything but "0" means enabled. */ @@ -92,6 +93,11 @@ const LIVE_PACKS = [ enabled: () => envEnabled('CCTV_DELDOT_ENABLED'), load: loadDelDOTSourcesFromOpenData, }, + { + name: 'kingcounty', + enabled: () => envEnabled('CCTV_KINGCOUNTY_ENABLED'), + load: loadKingCountySourcesFromOpenData, + }, ]; /** * Load CCTV sources from a local JSON file (CCTV_SOURCES_FILE env or default). diff --git a/server/providers/cctv/constants.js b/server/providers/cctv/constants.js index da0f2fcda..a25dc887f 100644 --- a/server/providers/cctv/constants.js +++ b/server/providers/cctv/constants.js @@ -244,6 +244,25 @@ export const DELDOT_ANCHORS = [ { lat: 39.1582, lon: -75.5244 }, // Dover (Kent) { lat: 38.6906, lon: -75.3877 }, // Georgetown (Sussex) ]; + +/** King County, WA road cameras: keyless public ArcGIS FeatureServer layer + * ("King County and WSDOT Traffic Cameras", King County DOT Road Services). + * GeoJSON with WGS84 point geometry. `outFields` is an explicit list on + * purpose: the layer also carries asset-administration columns (including + * staff names in `ModifiedBy`) that must never be fetched. Uniquely among the + * packs, the county publishes each camera's hardware `Manufacturer`/`Model` + * (Cohu 3950/3965, Bosch AUTODOME, Axis Q6135-LE, …), carried through as the + * source's `model`. */ +export const KING_COUNTY_CAMERAS_URL = + 'https://services.arcgis.com/Ej0PsM5Aw677QF1W/arcgis/rest/services/TRAFFICCAMERA_POINT_2029/FeatureServer/0/query?where=1%3D1&outFields=AssetID,Location,Description,ImageURL,CamRegion,Live,Model,Manufacturer,Owner,CurrentStatus&f=geojson'; +/** Frames come only from the county's own image handler host. */ +export const KING_COUNTY_IMAGE_ORIGIN = 'https://info.kingcounty.gov/'; +/** The whole catalog is ~125 rows (~59 live county cameras); no thinning by + * default. */ +export const DEFAULT_KING_COUNTY_MAX_SOURCES = 125; +/** Prioritization anchor: Renton, roughly central to the county road network. */ +export const KING_COUNTY_ANCHORS = [{ lat: 47.4829, lon: -122.2171 }]; + /** Camera CATALOGS change rarely; 15 min keeps multi-megabyte upstream list refetches (Austin rows.json + 4 Caltrans districts + TfL + Ontario 511) infrequent. Frames are fetched per-request and are unaffected. */ export const CCTV_SOURCE_CACHE_MS = 15 * 60 * 1000; /** Per-provider catalog-fetch timeout. Bounds the worst-case refresh so one diff --git a/server/providers/cctv/normalize.js b/server/providers/cctv/normalize.js index b564ef440..17903335d 100644 --- a/server/providers/cctv/normalize.js +++ b/server/providers/cctv/normalize.js @@ -516,5 +516,13 @@ export function normalizeSourceItem(item) { // badge can distinguish them from raw automated priors (e.g. Austin Open // Data, which never sets this field). Passed through as-is to the client. poseSource: item.poseSource === 'curated' ? 'curated' : undefined, + // Optional hardware-model passthrough (additive, like poseSource): packs + // whose catalog publishes the camera's hardware model — King County's + // layer carries Manufacturer/Model per camera — pass it through so + // identified-hardware consumers can use it. Absent everywhere else. + model: + typeof item.model === 'string' && item.model.trim() + ? item.model.trim() + : undefined, }; } diff --git a/server/providers/cctv/sources.js b/server/providers/cctv/sources.js index ad8a883da..e92a8a265 100644 --- a/server/providers/cctv/sources.js +++ b/server/providers/cctv/sources.js @@ -59,6 +59,10 @@ import { DELDOT_CCTV_URL, DEFAULT_DELDOT_MAX_SOURCES, DELDOT_ANCHORS, + KING_COUNTY_CAMERAS_URL, + KING_COUNTY_IMAGE_ORIGIN, + DEFAULT_KING_COUNTY_MAX_SOURCES, + KING_COUNTY_ANCHORS, } from './constants.js'; import { toFiniteNumber, @@ -1701,3 +1705,125 @@ export async function loadDelDOTSourcesFromOpenData() { return []; } } + +/** Rough King County, WA bounding box. */ +function isLikelyKingCountyCoordinate(lat, lon) { + return ( + Number.isFinite(lat) && + Number.isFinite(lon) && + lat >= 47.0 && + lat <= 48.0 && + lon >= -123.1 && + lon <= -121.0 + ); +} + +/** + * Fetch King County road cameras (Washington State). Keyless: one public + * ArcGIS FeatureServer GeoJSON query (King County DOT Road Services), with an + * explicit `outFields` list so the layer's asset-administration columns are + * never fetched. Only cameras that are live and active (`Live`, + * `CurrentStatus`) with a positive integer id, finite in-county coordinates, + * and a frame on the county's own image handler are kept. WSDOT-owned rows in + * the layer are skipped — the statewide WSDOT pack is their home — while the + * handful of city-owned cameras the county hosts (Redmond, Sammamish, + * Newcastle, Snoqualmie) keep their owner as the per-camera credit, + * DriveBC-style. The layer publishes no facing, so every heading is the id + * hash at low confidence. + * + * Uniquely among the packs, the county publishes each camera's hardware + * `Manufacturer`/`Model`; the model string (whitespace-collapsed — the feed + * carries stray newlines) rides along as the source's `model` for + * identified-hardware consumers. + * + * @returns {Promise>} Normalized camera source objects. + */ +export async function loadKingCountySourcesFromOpenData() { + try { + const resp = await fetch(KING_COUNTY_CAMERAS_URL, { + headers: { Accept: 'application/json' }, + signal: AbortSignal.timeout(CCTV_SOURCE_FETCH_TIMEOUT_MS), + }); + if (!resp.ok) { + console.warn('[CCTV] King County camera download failed:', resp.status); + return []; + } + const payload = await resp.json(); + const rows = Array.isArray(payload?.features) ? payload.features : []; + + const cameras = []; + for (const row of rows) { + const attrs = row?.properties; + const rawId = attrs?.AssetID; + if (!Number.isSafeInteger(rawId) || rawId <= 0) continue; + if (attrs.Live !== 1) continue; + if (String(attrs.CurrentStatus || '').trim() !== 'Active') continue; + const owner = String(attrs.Owner || '').trim(); + // WSDOT-owned rows belong to the statewide WSDOT pack; skipping them + // here keeps one camera from appearing twice on the globe. + if (owner === 'WSDOT') continue; + // The handler is served over HTTPS; the feed still writes http://. + const imageUrl = String(attrs.ImageURL || '') + .trim() + .replace(/^http:\/\/info\.kingcounty\.gov\//, KING_COUNTY_IMAGE_ORIGIN); + if (!imageUrl.startsWith(KING_COUNTY_IMAGE_ORIGIN)) continue; + const [lon, lat] = Array.isArray(row?.geometry?.coordinates) + ? row.geometry.coordinates + : []; + if (!isLikelyKingCountyCoordinate(lat, lon)) continue; + + const cameraId = `kingcounty-${rawId}`; + const model = String(attrs.Model || '') + .replace(/\s+/g, ' ') + .trim(); + const camera = { + id: cameraId, + name: + String(attrs.Location || '').trim() || `King County camera ${rawId}`, + city: 'King County', + cityId: 'king-county', + provider: 'King County Road Services', + lat, + lon, + headingDeg: fallbackHeadingFromId(cameraId), + headingConfidence: 'low', + // The low-confidence pose personality shared by the other packs. + pitchDeg: -18, + fovDeg: 44, + rangeM: 145, + mountHeightM: 8, + feedType: 'image', + url: imageUrl, + snapshotUrl: imageUrl, + sourceKind: 'kingcounty-open-data', + license: 'King County GIS open data (KCGIS Center terms of use)', + credit: owner && owner !== 'King County' ? owner : '', + }; + if (model) camera.model = model; + cameras.push(camera); + } + + const maxRaw = Number( + process.env.CCTV_KINGCOUNTY_MAX_SOURCES || + DEFAULT_KING_COUNTY_MAX_SOURCES, + ); + const maxCount = Number.isFinite(maxRaw) + ? Math.max(8, Math.min(1200, Math.floor(maxRaw))) + : DEFAULT_KING_COUNTY_MAX_SOURCES; + const prioritized = prioritizeSources( + cameras, + maxCount, + KING_COUNTY_ANCHORS, + ); + console.log( + `[CCTV] Loaded King County camera sources: ${cameras.length} published (using nearest ${prioritized.length})`, + ); + return prioritized; + } catch (error) { + console.warn( + '[CCTV] King County camera download error:', + error?.message || error, + ); + return []; + } +} diff --git a/src/data/cctvKingCountySource.test.mjs b/src/data/cctvKingCountySource.test.mjs new file mode 100644 index 000000000..544b4f9ac --- /dev/null +++ b/src/data/cctvKingCountySource.test.mjs @@ -0,0 +1,171 @@ +import { test } from 'node:test'; +import assert from 'node:assert/strict'; +import { + DEFAULT_KING_COUNTY_MAX_SOURCES, + KING_COUNTY_CAMERAS_URL, +} from '../../server/providers/cctv/constants.js'; +import { loadKingCountySourcesFromOpenData } from '../../server/providers/cctv/sources.js'; +import { normalizeSourceItem } from '../../server/providers/cctv/normalize.js'; + +/** Set (or, for `undefined`, delete) environment variables for one test. */ +function withEnv(t, env) { + for (const [name, value] of Object.entries(env)) { + const previous = process.env[name]; + t.after(() => { + if (previous === undefined) delete process.env[name]; + else process.env[name] = previous; + }); + if (value === undefined) delete process.env[name]; + else process.env[name] = value; + } +} + +/** Silence the loaders' progress and failure logging. */ +function quiet(t) { + t.mock.method(console, 'log', () => {}); + t.mock.method(console, 'warn', () => {}); +} + +/** A FeatureServer GeoJSON feature carrying the fields the loader reads. */ +function kingCountyFeature(id, lat, lon, overrides = {}) { + const { properties = {}, geometry } = overrides; + return { + type: 'Feature', + geometry: + geometry === undefined + ? { type: 'Point', coordinates: [lon, lat] } + : geometry, + properties: { + AssetID: id, + Location: `Road ${id} at Test Ave`, + ImageURL: `http://info.kingcounty.gov/transportation/kcdot/Roads/TrafficCameras/ImageHandler/Handler.ashx?id=cam${id}.jpg`, + Live: 1, + Model: '3950', + Manufacturer: 'Cohu', + Owner: 'King County', + CurrentStatus: 'Active', + ...properties, + }, + }; +} + +test('King County loader keeps live county cameras and upgrades frame URLs to HTTPS', async (t) => { + quiet(t); + withEnv(t, { CCTV_KINGCOUNTY_MAX_SOURCES: undefined }); + const requested = []; + t.mock.method(globalThis, 'fetch', async (url) => { + requested.push(String(url)); + return Response.json({ + type: 'FeatureCollection', + features: [ + kingCountyFeature(56, 47.70059, -122.02443, { + properties: { + Location: 'NE Novelty Hill Road at Trilogy Parkway NE', + // The live layer carries stray whitespace in model strings. + Model: 'Q6135-LE\n', + Manufacturer: 'Axis', + }, + }), + // City-owned camera the county hosts: kept, owner becomes the credit. + kingCountyFeature(90, 47.674, -122.119, { + properties: { Owner: 'City of Redmond', Model: null }, + }), + // WSDOT-owned row: the statewide WSDOT pack is its home. + kingCountyFeature(70, 47.6, -122.3, { properties: { Owner: 'WSDOT' } }), + // Off-host frame, not live, retired, bad id, bad geometry, out of county. + kingCountyFeature(71, 47.6, -122.3, { + properties: { ImageURL: 'https://example.com/cam71.jpg' }, + }), + kingCountyFeature(72, 47.6, -122.3, { properties: { Live: 0 } }), + kingCountyFeature(73, 47.6, -122.3, { + properties: { CurrentStatus: 'Retired' }, + }), + kingCountyFeature('74', 47.6, -122.3), + kingCountyFeature(75, 47.6, -122.3, { geometry: null }), + kingCountyFeature(76, 34.05, -118.24), + ], + }); + }); + + const cameras = await loadKingCountySourcesFromOpenData(); + + assert.deepEqual(requested, [KING_COUNTY_CAMERAS_URL]); + assert.deepEqual(cameras.map((camera) => camera.id).sort(), [ + 'kingcounty-56', + 'kingcounty-90', + ]); + + const novelty = cameras.find((camera) => camera.id === 'kingcounty-56'); + assert.equal(novelty.name, 'NE Novelty Hill Road at Trilogy Parkway NE'); + assert.equal(novelty.provider, 'King County Road Services'); + assert.equal( + novelty.url, + 'https://info.kingcounty.gov/transportation/kcdot/Roads/TrafficCameras/ImageHandler/Handler.ashx?id=cam56.jpg', + ); + assert.equal(novelty.snapshotUrl, novelty.url); + assert.equal(novelty.feedType, 'image'); + // Published hardware model rides along, whitespace-collapsed. + assert.equal(novelty.model, 'Q6135-LE'); + assert.equal(novelty.credit, ''); + // No facing in the layer: id-hash fallback at low confidence. + assert.equal(novelty.headingConfidence, 'low'); + assert.equal(novelty.fovDeg, 44); + assert.ok(novelty.headingDeg >= 0 && novelty.headingDeg < 360); + + const redmond = cameras.find((camera) => camera.id === 'kingcounty-90'); + assert.equal(redmond.credit, 'City of Redmond'); + assert.equal(redmond.model, undefined); +}); + +test('normalizeSourceItem passes a hardware model through and omits it otherwise', () => { + const withModel = normalizeSourceItem({ + id: 'kingcounty-56', + lat: 47.7, + lon: -122.0, + model: ' Q6135-LE ', + }); + assert.equal(withModel.model, 'Q6135-LE'); + + const withoutModel = normalizeSourceItem({ + id: 'austin-1', + lat: 30.3, + lon: -97.7, + }); + assert.equal(withoutModel.model, undefined); + assert.equal(normalizeSourceItem({ id: 'x', model: ' ' }).model, undefined); +}); + +test('King County loader honors the max-sources cap', async (t) => { + quiet(t); + withEnv(t, { CCTV_KINGCOUNTY_MAX_SOURCES: '8' }); + const features = []; + for (let i = 0; i < 24; i += 1) { + features.push( + kingCountyFeature(100 + i, 47.2 + i * 0.02, -122.4 + i * 0.02), + ); + } + t.mock.method(globalThis, 'fetch', async () => + Response.json({ type: 'FeatureCollection', features }), + ); + + const cameras = await loadKingCountySourcesFromOpenData(); + assert.equal(cameras.length, 8); +}); + +test('King County loader defaults its cap and survives upstream failure', async (t) => { + quiet(t); + withEnv(t, { CCTV_KINGCOUNTY_MAX_SOURCES: undefined }); + assert.equal(DEFAULT_KING_COUNTY_MAX_SOURCES, 125); + + t.mock.method( + globalThis, + 'fetch', + async () => new Response('', { status: 503 }), + ); + assert.deepEqual(await loadKingCountySourcesFromOpenData(), []); + + t.mock.method(globalThis, 'fetch', async () => { + throw new Error('network down'); + }); + assert.deepEqual(await loadKingCountySourcesFromOpenData(), []); +}); diff --git a/src/data/dataCredits.js b/src/data/dataCredits.js index ab9213c26..6c3a2507e 100644 --- a/src/data/dataCredits.js +++ b/src/data/dataCredits.js @@ -201,6 +201,15 @@ export const DATA_CREDITS = [ 'Traffic cameras (Calgary): contains information licensed under the ' + 'Open Government Licence – City of Calgary', }, + { + key: 'kingcounty-cctv', + html: + 'CCTV cameras & frames (King County, WA): King County Road Services — ' + + 'kingcounty.gov, ' + + 'per the ' + + 'KCGIS Center terms. ' + + 'A few cameras are supplied by partner cities (Redmond, Sammamish, Newcastle, Snoqualmie); each names its owner in the CCTV panel.', + }, { key: 'gbfs', html: 'Bikeshare availability: GBFS operator feeds (e.g. Austin BCycle)', From c3f197823e2b13a1538b4a1c4cd0dada29650752 Mon Sep 17 00:00:00 2001 From: bassem chagra Date: Sun, 27 Sep 2026 12:09:27 +0000 Subject: [PATCH 2/4] fix(cctv): serve King County model/manufacturer through /api/cctv/sources The loader and normalizer carried the hardware model, but the /sources response projection and the browser catalog both whitelist fields and dropped it, so no client consumer ever saw it. Project model and manufacturer (manufacturer disambiguates bare model strings like "3950") at both boundaries, and add a test that drives the real middleware and browser catalog end to end. --- DATA_SOURCES.md | 2 +- server/providers/cctv.js | 2 + server/providers/cctv/normalize.js | 6 ++ server/providers/cctv/sources.js | 4 + src/data/cctvKingCountySource.test.mjs | 106 +++++++++++++++++++++++++ src/layers/cctv/catalog.js | 2 + 6 files changed, 121 insertions(+), 1 deletion(-) diff --git a/DATA_SOURCES.md b/DATA_SOURCES.md index c43ae7728..8e806208d 100644 --- a/DATA_SOURCES.md +++ b/DATA_SOURCES.md @@ -90,7 +90,7 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei - **Warendorf webcam.** The Stadt Warendorf Marktplatz webcam, registered from the curated `config/cctv_sources.warendorf.json` (the Kreis Warendorf registration-office cameras from the contributing PR are indoor waiting rooms and were left out); only the municipal image host is proxied, frames are fetched at request time and never stored or redistributed. Disable with `CCTV_WARENDORF_ENABLED=0`. - **Live Traffic NSW cameras.** The camera list is the keyless public `data.livetraffic.com/cameras/traffic-cam.json` feed (Transport for NSW open data, CC BY 4.0); frames are stills on `webcams.transport.nsw.gov.au`, and only that host is registered. That image host answers non-browser clients with an HTML placeholder, so the proxy identifies as a browser for that one host and as itself everywhere else. Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_NSW_ENABLED=0`. - **Open Calgary traffic cameras.** Keyless. The camera list is the public Socrata dataset `k7p9-kppz` on `data.calgary.ca`; frames are stills on the city's own `trafficcam.calgary.ca` host, and only that host is registered. Most rows publish an `http://` frame URL and the host redirects those to HTTPS, so URLs are upgraded and pinned to that origin before registration. Frames are fetched at request time and never stored or redistributed. The dataset publishes no camera facing: the `quadrant` field and the quadrant suffix on each camera name are Calgary's address grid, not a bearing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. The licence requires the attribution statement above. Disable with `CCTV_CALGARY_ENABLED=0`. -- **King County road cameras.** Keyless. The camera list is one public ArcGIS FeatureServer GeoJSON query (King County DOT Road Services, "King County and WSDOT Traffic Cameras"). The `outFields` list is explicit on purpose: the layer also carries asset-administration columns — including staff names — that are never fetched. Only live, active cameras with frames on the county's own `info.kingcounty.gov` image handler are registered (the feed writes `http://`; the handler serves HTTPS, so URLs are upgraded and pinned before registration). WSDOT-owned rows in the layer are skipped so a camera never appears twice when a statewide WSDOT pack is present; the few city-owned cameras the county hosts (Redmond, Sammamish, Newcastle, Snoqualmie) carry their owner as the per-camera credit. The layer publishes no facing, so headings use the shared id-hash fallback at low confidence. Uniquely, the county publishes each camera's hardware `Manufacturer`/`Model` (Cohu 3950/3965, Bosch AUTODOME, Axis PTZ domes); the model string is carried on the source as `model` for identified-hardware consumers. Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_KINGCOUNTY_ENABLED=0`. +- **King County road cameras.** Keyless. The camera list is one public ArcGIS FeatureServer GeoJSON query (King County DOT Road Services, "King County and WSDOT Traffic Cameras"). The `outFields` list is explicit on purpose: the layer also carries asset-administration columns — including staff names — that are never fetched. Only live, active cameras with frames on the county's own `info.kingcounty.gov` image handler are registered (the feed writes `http://`; the handler serves HTTPS, so URLs are upgraded and pinned before registration). WSDOT-owned rows in the layer are skipped so a camera never appears twice when a statewide WSDOT pack is present; the few city-owned cameras the county hosts (Redmond, Sammamish, Newcastle, Snoqualmie) carry their owner as the per-camera credit. The layer publishes no facing, so headings use the shared id-hash fallback at low confidence. Uniquely, the county publishes each camera's hardware `Manufacturer`/`Model` (Cohu 3950/3965, Bosch AUTODOME, Axis PTZ domes); both are carried on the source (and served by `/api/cctv/sources`) as `model` and `manufacturer` for identified-hardware consumers. Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_KINGCOUNTY_ENABLED=0`. - **Camera frame content.** Public camera frames can contain people, vehicles and license plates, and the camera layer does nothing with them beyond putting them on the map. A successful upstream response is relayed as the provider served it: nothing in the camera pipeline blurs, redacts, enhances or restores it, and nothing there runs face, plate or object detection or otherwise recognises or classifies what is in the picture. (The ALPR layer described below maps where plate-reader cameras are, from locations contributors tagged in OpenStreetMap; it reads nothing from any camera frame.) When an upstream has no frame for a camera, what you see instead is a Google Street View still or the app's own placeholder card; the panel's source badge names which of them you are looking at, and a refresh that fails after a frame has arrived leaves the last good picture on screen rather than replacing it. The browser resamples each frame for display: onto a fixed 1920x1080 surface for the camera's projection plane in the scene, and onto a 192x108 canvas for the small ambient card. That scaling is the only change made to the picture, and the only pixels the camera layer reads back are a 64x36 downscale hashed to tell whether the picture has changed. Live streams are piped through; the still path reads the image into memory to pass it on — TxDOT wraps its JPEG in a JSON envelope, which is decoded there — and no frame is written to disk (the disk cache, `.gev-cache/`, holds feed JSON for other layers and never camera imagery). Outside that pipeline, the voice assistant is the one feature that sends imagery anywhere: when it answers a question about what is in view it may attach a downscaled screenshot of the rendered scene — including any camera plane on screen — to the request it sends to the voice model. Frames are fetched only from server-registered camera URLs — a client cannot hand the proxy a URL (see [SECURITY.md](SECURITY.md)). What the app does stays inside the line README draws: no named-person search, no face recognition, no tracking individuals. - **Transit (GTFS-Realtime).** The proxy requests only registered operator feeds, validates redirects, bounds responses, and uses conditional requests, short snapshot caching and failure backoff. All seven registered regions are live-enabled; each can be disabled independently. Vehicles use delayed playback between reports, with report age and waiting states shown separately. Session-local selected trails are available for every feed. MBTA additionally retains up to 15 minutes of recently observed positions in the running proxy, so available history can survive a browser reload; server restart clears it. History reads never fetch upstream, and other feeds have no proxy retention. Nothing is archived to disk or collected in the background. Operator text credits are included as a courtesy and do not imply endorsement. Heights are aligned to work with Google 3D tiles; subway markers are shown at street level because these feeds do not supply depth. - **Radio Browser.** `/api/radio/stations` discovers official API mirrors, makes bounded and coalesced healthy/geolocated HTTPS-station queries, caches the normalized public-domain directory for 45 minutes, and may serve the last good catalog for up to seven days during an outage. Refreshes must meet minimum accepted-query and station coverage before replacing a warm catalog; schema-valid responses whose rows all fail the product's health policy do not count as successful queries. A usable partial cold catalog is explicitly `DEGRADED`, and malformed or empty successful payloads are rejected atomically. Every directory and click-count request rejects redirects, validates all resolved addresses as globally routable (including reserved/documentation IPv4 and special/non-global IPv6 exclusions), and pins the TLS connection to a validated address. Only MP3/AAC non-HLS directory rows with public HTTPS stream targets are returned; favicons are intentionally omitted. Pressing play connects one browser audio element directly to the selected broadcaster and calls the directory's click counter through known-ID-only `POST /api/radio/click/:uuid`. GEV never proxies, caches, records, bundles, or redistributes audio. Radio Browser supplies station-level tags, not dependable current-song or upcoming-program metadata, so Radio filtering never claims either. Direct playback exposes the listener's IP address to the broadcaster, whose own stream terms apply. diff --git a/server/providers/cctv.js b/server/providers/cctv.js index a71e2af4d..5fb15be03 100644 --- a/server/providers/cctv.js +++ b/server/providers/cctv.js @@ -162,6 +162,8 @@ export function cctvProxy({ sourceRoot = process.cwd() } = {}) { sourceKind: source.sourceKind || (source.url ? 'configured' : 'fallback'), poseSource: source.poseSource, + model: source.model || '', + manufacturer: source.manufacturer || '', license: source.license, credit: source.credit || '', code: source.code || '', diff --git a/server/providers/cctv/normalize.js b/server/providers/cctv/normalize.js index 17903335d..c4020da34 100644 --- a/server/providers/cctv/normalize.js +++ b/server/providers/cctv/normalize.js @@ -524,5 +524,11 @@ export function normalizeSourceItem(item) { typeof item.model === 'string' && item.model.trim() ? item.model.trim() : undefined, + // Bare model strings collide across vendors (e.g. "3950"), so the + // publishing pack's manufacturer rides along for disambiguation. + manufacturer: + typeof item.manufacturer === 'string' && item.manufacturer.trim() + ? item.manufacturer.trim() + : undefined, }; } diff --git a/server/providers/cctv/sources.js b/server/providers/cctv/sources.js index e92a8a265..3996f37f1 100644 --- a/server/providers/cctv/sources.js +++ b/server/providers/cctv/sources.js @@ -1776,6 +1776,9 @@ export async function loadKingCountySourcesFromOpenData() { const model = String(attrs.Model || '') .replace(/\s+/g, ' ') .trim(); + const manufacturer = String(attrs.Manufacturer || '') + .replace(/\s+/g, ' ') + .trim(); const camera = { id: cameraId, name: @@ -1800,6 +1803,7 @@ export async function loadKingCountySourcesFromOpenData() { credit: owner && owner !== 'King County' ? owner : '', }; if (model) camera.model = model; + if (model && manufacturer) camera.manufacturer = manufacturer; cameras.push(camera); } diff --git a/src/data/cctvKingCountySource.test.mjs b/src/data/cctvKingCountySource.test.mjs index 544b4f9ac..a0f765446 100644 --- a/src/data/cctvKingCountySource.test.mjs +++ b/src/data/cctvKingCountySource.test.mjs @@ -1,11 +1,16 @@ import { test } from 'node:test'; import assert from 'node:assert/strict'; +import { mkdtempSync, rmSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import path from 'node:path'; import { DEFAULT_KING_COUNTY_MAX_SOURCES, KING_COUNTY_CAMERAS_URL, } from '../../server/providers/cctv/constants.js'; import { loadKingCountySourcesFromOpenData } from '../../server/providers/cctv/sources.js'; import { normalizeSourceItem } from '../../server/providers/cctv/normalize.js'; +import { cctvProxy } from '../../server/providers/cctv.js'; +import { createCatalog } from '../layers/cctv/catalog.js'; /** Set (or, for `undefined`, delete) environment variables for one test. */ function withEnv(t, env) { @@ -106,6 +111,7 @@ test('King County loader keeps live county cameras and upgrades frame URLs to HT assert.equal(novelty.feedType, 'image'); // Published hardware model rides along, whitespace-collapsed. assert.equal(novelty.model, 'Q6135-LE'); + assert.equal(novelty.manufacturer, 'Axis'); assert.equal(novelty.credit, ''); // No facing in the layer: id-hash fallback at low confidence. assert.equal(novelty.headingConfidence, 'low'); @@ -115,6 +121,8 @@ test('King County loader keeps live county cameras and upgrades frame URLs to HT const redmond = cameras.find((camera) => camera.id === 'kingcounty-90'); assert.equal(redmond.credit, 'City of Redmond'); assert.equal(redmond.model, undefined); + // A manufacturer without a model identifies nothing, so it is dropped too. + assert.equal(redmond.manufacturer, undefined); }); test('normalizeSourceItem passes a hardware model through and omits it otherwise', () => { @@ -123,8 +131,10 @@ test('normalizeSourceItem passes a hardware model through and omits it otherwise lat: 47.7, lon: -122.0, model: ' Q6135-LE ', + manufacturer: ' Axis ', }); assert.equal(withModel.model, 'Q6135-LE'); + assert.equal(withModel.manufacturer, 'Axis'); const withoutModel = normalizeSourceItem({ id: 'austin-1', @@ -132,9 +142,105 @@ test('normalizeSourceItem passes a hardware model through and omits it otherwise lon: -97.7, }); assert.equal(withoutModel.model, undefined); + assert.equal(withoutModel.manufacturer, undefined); assert.equal(normalizeSourceItem({ id: 'x', model: ' ' }).model, undefined); }); +/** Drive the real `/api/cctv/sources` middleware and return its parsed body. */ +async function requestSources(plugin) { + let handler; + plugin.configureServer({ + middlewares: { + use(_route, fn) { + handler = fn; + }, + }, + }); + const res = { + writeHead(status, headers) { + Object.assign(this, { status, headers }); + }, + end(body) { + this.body = body; + }, + }; + await handler({ url: '/sources', method: 'GET' }, res); + assert.equal(res.status, 200); + return JSON.parse(res.body); +} + +/** The browser catalog with the pose math stubbed out: only field + * passthrough is under test here. */ +function browserCatalog() { + const model = { + safeNumber: (value, fallback = NaN) => + Number.isFinite(Number(value)) ? Number(value) : fallback, + normalizeHeading: (deg) => ((deg % 360) + 360) % 360, + clamp: (value, lo, hi) => Math.min(hi, Math.max(lo, value)), + headingFromId: () => 0, + normalizeFeedType: (type) => type, + ensureCameraPose: () => {}, + }; + return createCatalog({ + state: {}, + services: { locations: { CITY_POIS: {} } }, + parts: { model }, + source: {}, + }); +} + +test('King County model and manufacturer survive the /api/cctv/sources boundary into the browser catalog', async (t) => { + quiet(t); + const root = mkdtempSync(path.join(tmpdir(), 'gev-kingcounty-')); + t.after(() => rmSync(root, { recursive: true, force: true })); + // No file/env catalog, so the live packs load; every pack but King County + // sees an upstream failure and contributes nothing. + withEnv(t, { + CCTV_SOURCES_FILE: undefined, + CCTV_SOURCES_JSON: undefined, + CCTV_FORCE_AUSTIN: undefined, + CCTV_PREFER_AUSTIN: undefined, + CCTV_KINGCOUNTY_ENABLED: undefined, + CCTV_KINGCOUNTY_MAX_SOURCES: undefined, + CCTV_MAX_SOURCES: undefined, + }); + t.mock.method(globalThis, 'fetch', async (url) => { + if (String(url) !== KING_COUNTY_CAMERAS_URL) + return new Response('', { status: 503 }); + return Response.json({ + type: 'FeatureCollection', + features: [ + kingCountyFeature(56, 47.70059, -122.02443, { + properties: { Model: 'Q6135-LE\n', Manufacturer: 'Axis' }, + }), + kingCountyFeature(90, 47.674, -122.119, { + properties: { Model: null, Manufacturer: 'Cohu' }, + }), + ], + }); + }); + + const body = await requestSources(cctvProxy({ sourceRoot: root })); + const served = new Map(body.sources.map((source) => [source.id, source])); + assert.deepEqual([...served.keys()].sort(), [ + 'kingcounty-56', + 'kingcounty-90', + ]); + assert.equal(served.get('kingcounty-56').model, 'Q6135-LE'); + assert.equal(served.get('kingcounty-56').manufacturer, 'Axis'); + // Absent hardware is an explicit empty string on the wire, like + // headingConfidence, so consumers never have to probe for the key. + assert.equal(served.get('kingcounty-90').model, ''); + assert.equal(served.get('kingcounty-90').manufacturer, ''); + + const cameras = browserCatalog().buildCatalogFromSources(body.sources); + const byId = new Map(cameras.map((camera) => [camera.id, camera])); + assert.equal(byId.get('kingcounty-56').model, 'Q6135-LE'); + assert.equal(byId.get('kingcounty-56').manufacturer, 'Axis'); + assert.equal(byId.get('kingcounty-90').model, ''); + assert.equal(byId.get('kingcounty-90').manufacturer, ''); +}); + test('King County loader honors the max-sources cap', async (t) => { quiet(t); withEnv(t, { CCTV_KINGCOUNTY_MAX_SOURCES: '8' }); diff --git a/src/layers/cctv/catalog.js b/src/layers/cctv/catalog.js index 1a6ebe7c6..76d530b11 100644 --- a/src/layers/cctv/catalog.js +++ b/src/layers/cctv/catalog.js @@ -204,6 +204,8 @@ export function createCatalog({ state: layerState, services, parts, source }) { ? source.groundHeights : null, poseSource, + model: String(source.model || ''), + manufacturer: String(source.manufacturer || ''), }; parts.model.ensureCameraPose(camera); catalog.push(camera); From 5dfe3f0525f1c26541829d9da699236df65634df Mon Sep 17 00:00:00 2001 From: bassem chagra Date: Sun, 27 Sep 2026 12:23:23 +0000 Subject: [PATCH 3/4] docs(cctv): add the King County pack to CHANGELOG, CURRENT-STATE, README and .env.example CONTRIBUTING requires runtime-behavior changes to update docs/CURRENT-STATE.md and CHANGELOG.md in the same PR, and new env controls belong in .env.example with the other CCTV pack controls. The README and CURRENT-STATE table diffs are column realignment from the widened source cell. --- .env.example | 2 ++ CHANGELOG.md | 12 ++++++++++++ README.md | 42 +++++++++++++++++++++--------------------- docs/CURRENT-STATE.md | 42 +++++++++++++++++++++--------------------- 4 files changed, 56 insertions(+), 42 deletions(-) diff --git a/.env.example b/.env.example index e16e85a27..f1ff1898f 100644 --- a/.env.example +++ b/.env.example @@ -180,6 +180,8 @@ AISSTREAM_API_KEY= # CCTV_CALGARY_ENABLED=1 # set 0 to disable the Open Calgary (Alberta) cameras # CCTV_CALGARY_MAX_SOURCES=220 # cap cameras loaded from the Open Calgary catalog # CCTV_CALGARY_ROWS_URL= # override the Open Calgary catalog URL +# CCTV_KINGCOUNTY_ENABLED=1 # set 0 to disable the King County (Washington) road cameras +# CCTV_KINGCOUNTY_MAX_SOURCES=125 # cap cameras loaded from the King County catalog # CCTV_MAX_SOURCES=4000 # catalog-wide ceiling, shared round-robin across packs # CCTV_PREFER_AUSTIN=1 # prioritize Austin cameras in the registry # CCTV_FORCE_AUSTIN= # force live default sources when a source-pack JSON is configured diff --git a/CHANGELOG.md b/CHANGELOG.md index 29dbedfaa..810391db3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,16 @@ # Changelog +- Add King County road cameras (Washington State) as a keyless CCTV source + pack: one public King County DOT ArcGIS layer, fetched with an explicit field + list so its staff-name columns are never requested, and frames pinned to the + county's own image host and upgraded to HTTPS. WSDOT-owned rows are skipped, + and city-owned cameras the county hosts credit their owner. The layer + publishes no facing, so headings use the shared id-hash fallback at low + confidence. It does publish each camera's hardware, which is served on + `/api/cctv/sources` as `model` and `manufacturer`. `CCTV_KINGCOUNTY_MAX_SOURCES` + sets the cap and `CCTV_KINGCOUNTY_ENABLED=0` turns the pack off + (bassem chagra, #645). + - CCTV cameras whose bearing is a guess now say so. Packs mark bearings derived from a hash of the camera id as `headingConfidence: 'low'`, but nothing read the flag, so roughly 70% of a default catalog rendered like surveyed facings. The HUD @@ -235,6 +246,7 @@ Add feed provenance to analyst/view answers and HUD context while retaining existing response fields and runner ownership (Matt Van Horn, #347). Analyst records for loaded satellites, datacenters and dams, with explicit bounded count/rank coverage (Matt Van Horn, #351). + - New Fire Perimeters layer (Events group): live NIFC WFIGS interagency wildfire incident perimeters as ground-clamped polygons with a containment-colored fire line, refreshed every 5 minutes from the public diff --git a/README.md b/README.md index 88690d52f..50a86253d 100644 --- a/README.md +++ b/README.md @@ -279,27 +279,27 @@ _Ask for radio near anywhere and the globe starts broadcasting — every station Nineteen layers and map sources. **Seventeen have a keyless path.** Some offer additional capabilities with a provider key. (🟢 no key · 🟡 free key · 🔴 metered.) -| Layer | What you get | Source | Auth | -| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------- | -| 🗺️ **Map Stack** | Esri satellite imagery, Google Photorealistic 3D, OSM, plus additional ion-hosted stacks | Esri / Google / Ion / OSM | 🟢 Esri satellite + OSM · 🟡 ion-hosted Google 3D + world terrain · 🔴 direct Google + place search | -| ✈️ **Live Flights** | 11,000+ live aircraft + route history | OpenSky + adsb.lol | 🟢 (🟡 optional for more polling credits) | -| 🎖️ **Military Flights** | ADS-B military traffic in amber | adsb.lol | 🟢 | -| 🚢 **Live Vessels** | Thousands of ships worldwide | AISStream | 🟡 | -| 🛰️ **Satellites** | 838-object catalog, color-coded by class with a live legend — the **DENSE** chip drops in the whole Starlink shell | CelesTrak | 🟢 | -| 🌍 **Earthquakes** | Global seismic activity, last 24h | USGS | 🟢 | -| 🚗 **Traffic** | Simulated vehicles on OSM roads. With TomTom, live flow speeds drive the simulation and congestion colors below ~8 km; individual vehicle positions are not live observations | TomTom + OSM | 🟢 simulation · 🟡 live flow speeds | -| 📹 **CCTV Mesh** | ~3,600 public cameras projected _into_ the 3D space — Austin · Texas (TxDOT) · California (Caltrans) · London (TfL) · Ontario (511) · Finland (Fintraffic) · British Columbia (DriveBC) · Estonia (Tallinn, Tarktee) · Delaware (DelDOT live video) · New South Wales (Live Traffic NSW) · Calgary. Positions are published; poses are estimated priors **you calibrate by dragging a gizmo on the camera itself** | City APIs | 🟢 | -| 📷 **Mapped ALPR Cameras** | License-plate-reader camera locations tagged by OpenStreetMap contributors, loaded one city-sized view at a time, with **SHOW NEAREST**. Locations and tags only: no plate data, no video | OpenStreetMap (incl. DeFlock mapping) | 🟢 | -| 📻 **Radio** | Geolocated world radio with an **analog tuner** — drag the needle across up to 750 stations and the globe flies to each broadcaster | Radio Browser / broadcasters | 🟢 | -| 🚌 **Transit** | Live buses, trams, metros, trains and ferries with delayed playback between reports, selected-vehicle trails, and mode-coloured DETECT labels — Boston, Austin, Minneapolis, Helsinki, the Netherlands, Norway, South East Queensland | Operator GTFS-Realtime feeds | 🟢 | -| 🚲 **Bikeshare** | Live station availability | GBFS | 🟢 | -| 🧭 **Directions** | Click A and B on the globe for a street-following drive, walk or cycle route draped on the terrain with turn-by-turn steps — then FLY the camera along it. No key, no geocoder, no mic | OSRM on FOSSGIS servers (OpenStreetMap) | 🟢 | -| 🔥 **Active Fires** | Live NASA FIRMS detections, trailing 24h | NASA FIRMS | 🟡 | -| 🚀 **Space Missions** | Rolling 30-day launches with payload, stage, and recovery detail | Launch Library 2 | 🟢 (🟡 optional token raises the allowance) | -| 🎖️ **Mapped Installations** | Viewport-bounded military-site context from community mapping — incomplete by nature, and labeled that way | OpenStreetMap | 🟢 | -| 🌬️ **Wind** | Animated 10 m forecast wind with an optional speed, temperature or pressure color field and a reading at map center | NOAA GFS / ECMWF IFS | 🟢 | -| 🌦️ **Observed Weather** | Rain radar (contiguous US), Satellite clouds (GOES regional or global infrared, Clouds only or Full image) and Lightning density (Americas and Pacific) on one history timeline | NOAA nowCOAST | 🟢 | -| 🌀 **Cyclones** | Advisory positions, forecast tracks and uncertainty cones for the Atlantic and eastern/central North Pacific | NOAA NHC / CPHC | 🟢 | +| Layer | What you get | Source | Auth | +| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------- | +| 🗺️ **Map Stack** | Esri satellite imagery, Google Photorealistic 3D, OSM, plus additional ion-hosted stacks | Esri / Google / Ion / OSM | 🟢 Esri satellite + OSM · 🟡 ion-hosted Google 3D + world terrain · 🔴 direct Google + place search | +| ✈️ **Live Flights** | 11,000+ live aircraft + route history | OpenSky + adsb.lol | 🟢 (🟡 optional for more polling credits) | +| 🎖️ **Military Flights** | ADS-B military traffic in amber | adsb.lol | 🟢 | +| 🚢 **Live Vessels** | Thousands of ships worldwide | AISStream | 🟡 | +| 🛰️ **Satellites** | 838-object catalog, color-coded by class with a live legend — the **DENSE** chip drops in the whole Starlink shell | CelesTrak | 🟢 | +| 🌍 **Earthquakes** | Global seismic activity, last 24h | USGS | 🟢 | +| 🚗 **Traffic** | Simulated vehicles on OSM roads. With TomTom, live flow speeds drive the simulation and congestion colors below ~8 km; individual vehicle positions are not live observations | TomTom + OSM | 🟢 simulation · 🟡 live flow speeds | +| 📹 **CCTV Mesh** | ~3,600 public cameras projected _into_ the 3D space — Austin · Texas (TxDOT) · California (Caltrans) · London (TfL) · Ontario (511) · Finland (Fintraffic) · British Columbia (DriveBC) · Estonia (Tallinn, Tarktee) · Delaware (DelDOT live video) · New South Wales (Live Traffic NSW) · Calgary · King County (WA). Positions are published; poses are estimated priors **you calibrate by dragging a gizmo on the camera itself** | City APIs | 🟢 | +| 📷 **Mapped ALPR Cameras** | License-plate-reader camera locations tagged by OpenStreetMap contributors, loaded one city-sized view at a time, with **SHOW NEAREST**. Locations and tags only: no plate data, no video | OpenStreetMap (incl. DeFlock mapping) | 🟢 | +| 📻 **Radio** | Geolocated world radio with an **analog tuner** — drag the needle across up to 750 stations and the globe flies to each broadcaster | Radio Browser / broadcasters | 🟢 | +| 🚌 **Transit** | Live buses, trams, metros, trains and ferries with delayed playback between reports, selected-vehicle trails, and mode-coloured DETECT labels — Boston, Austin, Minneapolis, Helsinki, the Netherlands, Norway, South East Queensland | Operator GTFS-Realtime feeds | 🟢 | +| 🚲 **Bikeshare** | Live station availability | GBFS | 🟢 | +| 🧭 **Directions** | Click A and B on the globe for a street-following drive, walk or cycle route draped on the terrain with turn-by-turn steps — then FLY the camera along it. No key, no geocoder, no mic | OSRM on FOSSGIS servers (OpenStreetMap) | 🟢 | +| 🔥 **Active Fires** | Live NASA FIRMS detections, trailing 24h | NASA FIRMS | 🟡 | +| 🚀 **Space Missions** | Rolling 30-day launches with payload, stage, and recovery detail | Launch Library 2 | 🟢 (🟡 optional token raises the allowance) | +| 🎖️ **Mapped Installations** | Viewport-bounded military-site context from community mapping — incomplete by nature, and labeled that way | OpenStreetMap | 🟢 | +| 🌬️ **Wind** | Animated 10 m forecast wind with an optional speed, temperature or pressure color field and a reading at map center | NOAA GFS / ECMWF IFS | 🟢 | +| 🌦️ **Observed Weather** | Rain radar (contiguous US), Satellite clouds (GOES regional or global infrared, Clouds only or Full image) and Lightning density (Americas and Pacific) on one history timeline | NOAA nowCOAST | 🟢 | +| 🌀 **Cyclones** | Advisory positions, forecast tracks and uncertainty cones for the Atlantic and eastern/central North Pacific | NOAA NHC / CPHC | 🟢 | **Weather, keyless.** **Wind** animates 10 m forecast flow from NOAA GFS or ECMWF IFS, with an optional color field and a reading at map center. **Rain radar**, **Satellite clouds** and **Lightning density** are observations on one history timeline in the **WEATHER** panel (step back, **Play**, **Latest**); **Cyclone advisories** draw NHC and CPHC positions, forecast tracks and cones. On Google 3D Tiles the observed layers float above the city as translucent shells, sharpened around your view. diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index fdb42fc0c..2946a26e8 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2747,27 +2747,27 @@ nearby place—always use station selection. Unqualified “turn on/start the ra requests use Play; a qualified Play-shaped tool call is normalized to Select so its criteria cannot be silently ignored. -| Layer | Source | File | Proxy | Update Interval | -| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | -------------------------------------------------------- | --------------------------------------------------------------------------------- | -| Live Flights ✈️ | OpenSky Network; bounded adsb.lol regional fallback | `src/data/flights.js` | `/api/opensky` (OAuth + fallback) | 30s | -| Military Flights 🎖️ | adsb.lol /v2/mil | `src/data/militaryFlights.js` | `/api/adsblol/mil` | 15s | -| Live AIS Vessels 🚢 | AISStream websocket | `src/data/aisLiveVessels.js` | `/api/ais-live` | 60s (+800ms visibility pass) | -| Mapped Installations ⌖ | OpenStreetMap mapped context; on-demand Google Maps Places supplement | `src/data/militaryInstallations.js` | `/api/military-installations`, `/api/google/text-search` | viewport-driven + user search; while unavailable, auto-retry 30 s → 240 s backoff | -| Earthquakes | USGS | `src/data/earthquakes.js` | — | 60s | -| Satellites | CelesTrak | `src/data/satellites.js` | `/api/celestrak` | 120s | -| Space Missions (30d) | Launch Library 2 + CelesTrak | `src/data/rocketLaunches.js` | `/api/launches` + `/api/celestrak/active` | 5 min | -| Traffic | OSM Overpass (+ optional TomTom live flow) | `src/data/traffic.js` | `/api/overpass` + `/api/tomtom` | viewport-driven | -| CCTV | Austin + Caltrans (CA) + TfL London + Ontario 511 + Fintraffic (FI) + DriveBC (BC) + TxDOT (TX) + Estonia (Tallinn, Tarktee) + Live Traffic NSW + Open Calgary Open Data + Street View fallback | `src/data/cctv.js` | `/api/cctv` | 10s (active) | -| Radio | Radio Browser (public-domain station directory) | `src/data/radio.js` | `/api/radio/stations`, `/api/radio/click/:uuid` | 45 min directory refresh | -| Transit 🚌 | Operator GTFS-Realtime VehiclePositions (7 keyless regions, `src/data/transitFeeds.js`) | `src/layers/transit/` via `src/app/layers/transit.js` | `/api/transit` | 15s (poll + delayed playback) | -| Bikeshare 🚲 | GBFS (Lyft + BCycle) | `src/data/bikeshare.js` | `/api/gbfs` | 60s | -| Directions 🧭 | OSRM on FOSSGIS servers (OpenStreetMap) | `src/data/directions.js` | `/api/route` (`steps=1`) | on placement / mode change | -| Datacenters ▣ | OSM extract (bundled) | `src/data/localLayers.js` | — | static | -| Dams ▰ | OpenInfraMap/OSM extract (bundled) | `src/data/localLayers.js` | — | static | -| Submarine Cables ◠ | TeleGeography public map (bundled) | `src/data/telegeographySubmarineCables.js` | — | static | -| FIRMS Active Fires ▲ | NASA FIRMS live (VIIRS ×3 NRT + MODIS NRT, trailing 24h) | `src/data/firmsHeatmap.js` | `/api/firms` (`FIRMS_MAP_KEY`) | 10 min (proxy TTL 30 min) | -| Wind 🌬 | NOAA GFS 10 m wind (keyless, 0.25°→1° grid; animated particles) | `src/data/wind.js` | `/api/wind` | 1 h (forecast cycle) | -| Fire Perimeters 🔥 | NIFC WFIGS current interagency perimeters (keyless, paged past the 2000-record cap); InciWeb catalog + incident page origin and update time checks for verified incident-page links | `src/layers/perimeters/` via `src/app/layers/perimeters.js` | `/api/fire-perimeters` + `/api/fire-perimeters/inciweb/*` | 5 min (server caches: catalog 1 h; publication 30 min) | +| Layer | Source | File | Proxy | Update Interval | +| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------- | +| Live Flights ✈️ | OpenSky Network; bounded adsb.lol regional fallback | `src/data/flights.js` | `/api/opensky` (OAuth + fallback) | 30s | +| Military Flights 🎖️ | adsb.lol /v2/mil | `src/data/militaryFlights.js` | `/api/adsblol/mil` | 15s | +| Live AIS Vessels 🚢 | AISStream websocket | `src/data/aisLiveVessels.js` | `/api/ais-live` | 60s (+800ms visibility pass) | +| Mapped Installations ⌖ | OpenStreetMap mapped context; on-demand Google Maps Places supplement | `src/data/militaryInstallations.js` | `/api/military-installations`, `/api/google/text-search` | viewport-driven + user search; while unavailable, auto-retry 30 s → 240 s backoff | +| Earthquakes | USGS | `src/data/earthquakes.js` | — | 60s | +| Satellites | CelesTrak | `src/data/satellites.js` | `/api/celestrak` | 120s | +| Space Missions (30d) | Launch Library 2 + CelesTrak | `src/data/rocketLaunches.js` | `/api/launches` + `/api/celestrak/active` | 5 min | +| Traffic | OSM Overpass (+ optional TomTom live flow) | `src/data/traffic.js` | `/api/overpass` + `/api/tomtom` | viewport-driven | +| CCTV | Austin + Caltrans (CA) + TfL London + Ontario 511 + Fintraffic (FI) + DriveBC (BC) + TxDOT (TX) + Estonia (Tallinn, Tarktee) + Live Traffic NSW + Open Calgary + King County (WA) Open Data + Street View fallback | `src/data/cctv.js` | `/api/cctv` | 10s (active) | +| Radio | Radio Browser (public-domain station directory) | `src/data/radio.js` | `/api/radio/stations`, `/api/radio/click/:uuid` | 45 min directory refresh | +| Transit 🚌 | Operator GTFS-Realtime VehiclePositions (7 keyless regions, `src/data/transitFeeds.js`) | `src/layers/transit/` via `src/app/layers/transit.js` | `/api/transit` | 15s (poll + delayed playback) | +| Bikeshare 🚲 | GBFS (Lyft + BCycle) | `src/data/bikeshare.js` | `/api/gbfs` | 60s | +| Directions 🧭 | OSRM on FOSSGIS servers (OpenStreetMap) | `src/data/directions.js` | `/api/route` (`steps=1`) | on placement / mode change | +| Datacenters ▣ | OSM extract (bundled) | `src/data/localLayers.js` | — | static | +| Dams ▰ | OpenInfraMap/OSM extract (bundled) | `src/data/localLayers.js` | — | static | +| Submarine Cables ◠ | TeleGeography public map (bundled) | `src/data/telegeographySubmarineCables.js` | — | static | +| FIRMS Active Fires ▲ | NASA FIRMS live (VIIRS ×3 NRT + MODIS NRT, trailing 24h) | `src/data/firmsHeatmap.js` | `/api/firms` (`FIRMS_MAP_KEY`) | 10 min (proxy TTL 30 min) | +| Wind 🌬 | NOAA GFS 10 m wind (keyless, 0.25°→1° grid; animated particles) | `src/data/wind.js` | `/api/wind` | 1 h (forecast cycle) | +| Fire Perimeters 🔥 | NIFC WFIGS current interagency perimeters (keyless, paged past the 2000-record cap); InciWeb catalog + incident page origin and update time checks for verified incident-page links | `src/layers/perimeters/` via `src/app/layers/perimeters.js` | `/api/fire-perimeters` + `/api/fire-perimeters/inciweb/*` | 5 min (server caches: catalog 1 h; publication 30 min) | Fire Perimeters uses capped, timed server reads with stale-on-error caching and a per-client limit. Unchanged snapshots retain geometry; link checks cancel on disable or selection change, and the row legend shows reported containment. From 4887162d761fb47ffbd59eb799165a0b47c422d6 Mon Sep 17 00:00:00 2001 From: Sameh Khamis Date: Thu, 15 Oct 2026 15:17:11 -0700 Subject: [PATCH 4/4] fix(cctv): harden the King County catalog fetch and dedupe before the cap The catalog fetch now refuses redirects, cancels rejected bodies and reads through the shared capped JSON reader. Duplicate ids are dropped before prioritization so they cannot use up the per-pack cap. Vendor-generic model strings (PTZ, PTZ IP, BOSCH/PTZ) are treated as no model. Comments and credits say why WSDOT rows are skipped (their frames are WSDOT-hosted, outside the pinned origin) and name Newcastle as the partner city that appears. --- DATA_SOURCES.md | 2 +- server/providers/cctv/constants.js | 6 +- server/providers/cctv/sources.js | 56 +++++++++++--- src/data/cctvKingCountySource.test.mjs | 102 +++++++++++++++++++++++-- src/data/dataCredits.js | 2 +- 5 files changed, 148 insertions(+), 20 deletions(-) diff --git a/DATA_SOURCES.md b/DATA_SOURCES.md index 1273ddcce..45de1c92a 100644 --- a/DATA_SOURCES.md +++ b/DATA_SOURCES.md @@ -143,7 +143,7 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei - **Warendorf webcam.** The Stadt Warendorf Marktplatz webcam, registered from the curated `config/cctv_sources.warendorf.json` (the Kreis Warendorf registration-office cameras from the contributing PR are indoor waiting rooms and were left out); only the municipal image host is proxied, frames are fetched at request time and never stored or redistributed. Disable with `CCTV_WARENDORF_ENABLED=0`. - **Live Traffic NSW cameras.** The camera list is the keyless public `data.livetraffic.com/cameras/traffic-cam.json` feed (Transport for NSW open data, CC BY 4.0); frames are stills on `webcams.transport.nsw.gov.au`, and only that host is registered. That image host answers non-browser clients with an HTML placeholder, so the proxy identifies as a browser for that one host and as itself everywhere else. Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_NSW_ENABLED=0`. - **Open Calgary traffic cameras.** Keyless. The camera list is the public Socrata dataset `k7p9-kppz` on `data.calgary.ca`; frames are stills on the city's own `trafficcam.calgary.ca` host, and only that host is registered. Most rows publish an `http://` frame URL and the host redirects those to HTTPS, so URLs are upgraded and pinned to that origin before registration. Frames are fetched at request time and never stored or redistributed. The dataset publishes no camera facing: the `quadrant` field and the quadrant suffix on each camera name are Calgary's address grid, not a bearing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. The licence requires the attribution statement above. Disable with `CCTV_CALGARY_ENABLED=0`. -- **King County road cameras.** Keyless. The camera list is one public ArcGIS FeatureServer GeoJSON query (King County DOT Road Services, "King County and WSDOT Traffic Cameras"). The `outFields` list is explicit on purpose: the layer also carries asset-administration columns — including staff names — that are never fetched. Only live, active cameras with frames on the county's own `info.kingcounty.gov` image handler are registered (the feed writes `http://`; the handler serves HTTPS, so URLs are upgraded and pinned before registration). WSDOT-owned rows in the layer are skipped so a camera never appears twice when a statewide WSDOT pack is present; the few city-owned cameras the county hosts (Redmond, Sammamish, Newcastle, Snoqualmie) carry their owner as the per-camera credit. The layer publishes no facing, so headings use the shared id-hash fallback at low confidence. Uniquely, the county publishes each camera's hardware `Manufacturer`/`Model` (Cohu 3950/3965, Bosch AUTODOME, Axis PTZ domes); both are carried on the source (and served by `/api/cctv/sources`) as `model` and `manufacturer` for identified-hardware consumers. Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_KINGCOUNTY_ENABLED=0`. +- **King County road cameras.** Keyless. The camera list is one public ArcGIS FeatureServer GeoJSON query (King County DOT Road Services, "King County and WSDOT Traffic Cameras"). The `outFields` list is explicit on purpose: the layer also carries asset-administration columns — including staff names — that are never fetched. Only live, active cameras with frames on the county's own `info.kingcounty.gov` image handler are registered (the feed writes `http://`; the handler serves HTTPS, so URLs are upgraded and pinned before registration). WSDOT-owned rows in the layer are skipped because their frames are WSDOT-hosted, outside the pinned image origin; partner-city cameras hosted on the county image handler (e.g. Newcastle) name their owner as the per-camera credit. The layer publishes no facing, so headings use the shared id-hash fallback at low confidence. Uniquely, the county publishes each camera's hardware `Manufacturer`/`Model` (Cohu 3950/3965, Bosch AUTODOME, Axis PTZ domes); both are carried on the source (and served by `/api/cctv/sources`) as `model` and `manufacturer` for identified-hardware consumers (vendor-generic strings such as `PTZ` name no model and are omitted). Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_KINGCOUNTY_ENABLED=0`. - **Statens vegvesen road cameras.** Keyless. The camera list is one GeoJSON request to the OGC API Features view of the official DATEX 3.1 CCTV site table (`ogckart-sn1.atlas.vegvesen.no/ogc/features/v1/collections/datex_3_1:CctvSimple/items`), so no DATEX account is needed; frames are stills on `kamera.atlas.vegvesen.no/api/images/`, and only that exact path per camera is registered. Cameras the feed reports as faulty are dropped. About 135 working cameras also publish live HLS (`kamera.vegvesen.no/public//manifest.m3u8`, MPEG-TS); those play as live video through the bounded in-memory HLS relay, with the still as the snapshot fallback, and only that exact manifest path per camera is registered. `CCTV_VEGVESEN_VIDEO=0` keeps every camera on stills. `orientationDescription` names the place a camera faces, not a bearing, so it goes into the label and headings use the id-hash fallback at low confidence. By default every live camera loads (~850); `CCTV_VEGVESEN_MAX_SOURCES` (8–1000) lowers the cap, keeping the cameras nearest Oslo, Bergen, Stavanger, Trondheim, Kristiansand, Bodø and Tromsø and `CCTV_VEGVESEN_ENABLED=0` turns the pack off. Frames are fetched at request time and never stored or redistributed. The NLOD attribution is registered in the Data attribution popover. - **NYC DOT Traffic Management Center cameras.** Off by default. NYC DOT's [developer data feeds page](https://www.nyc.gov/html/dot/html/about/datafeeds.shtml) asks developers who want the camera feed to contact `tmcdot@dot.nyc.gov` and sign a data-sharing agreement. This project does not hold one that covers downstream installations, so the pack loads only when an operator who holds their own agreement sets `CCTV_NYC_ENABLED=1`; with the flag unset, empty or any other value, the server makes no request to NYC DOT. The endpoint needs no key. The camera list is the public `webcams.nyctmc.org/api/cameras` catalog (~980 cameras across the five boroughs); frames are stills at `webcams.nyctmc.org/api/cameras//image`, synthesized from a validated UUID rather than taken from the payload, and only that host is registered. Cameras the feed reports as offline are dropped. The catalog publishes no camera facing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. Once enabled, the 250 cameras nearest the borough cores load; `CCTV_NYC_MAX_SOURCES` (8–400) changes the cap. Frames are fetched at request time and never stored or redistributed. NYC DOT asks every application that uses its data to carry its disclaimer; it is registered verbatim in the Data attribution popover. - **Camera frame content.** Public camera frames can contain people, vehicles and license plates, and the camera layer does nothing with them beyond putting them on the map. A successful upstream response is relayed as the provider served it: nothing in the camera pipeline blurs, redacts, enhances or restores it, and nothing there runs face, plate or object detection or otherwise recognises or classifies what is in the picture. (The ALPR layer described below maps where plate-reader cameras are, from locations contributors tagged in OpenStreetMap; it reads nothing from any camera frame.) When an upstream has no frame for a camera, what you see instead is a Google Street View still or the app's own placeholder card; the panel's source badge names which of them you are looking at, and a refresh that fails after a frame has arrived leaves the last good picture on screen rather than replacing it. The browser resamples each frame for display: onto a fixed 1920x1080 surface for the camera's projection plane in the scene, and onto a 192x108 canvas for the small ambient card. That scaling is the only change made to the picture, and the only pixels the camera layer reads back are a 64x36 downscale hashed to tell whether the picture has changed. Live streams are piped through; the still path reads the image into memory to pass it on — TxDOT wraps its JPEG in a JSON envelope, which is decoded there — and no frame is written to disk (the disk cache, `.gev-cache/`, holds feed JSON for other layers and never camera imagery). Outside that pipeline, the voice assistant is the one feature that sends imagery anywhere: when it answers a question about what is in view it may attach a downscaled screenshot of the rendered scene — including any camera plane on screen — to the request it sends to the voice model. Frames are fetched only from server-registered camera URLs — a client cannot hand the proxy a URL (see [SECURITY.md](SECURITY.md)). What the app does stays inside the line README draws: no named-person search, no face recognition, no tracking individuals. diff --git a/server/providers/cctv/constants.js b/server/providers/cctv/constants.js index 7fd6ef950..313a3338d 100644 --- a/server/providers/cctv/constants.js +++ b/server/providers/cctv/constants.js @@ -315,7 +315,7 @@ export const DELDOT_ANCHORS = [ * (Cohu 3950/3965, Bosch AUTODOME, Axis Q6135-LE, …), carried through as the * source's `model`. */ export const KING_COUNTY_CAMERAS_URL = - 'https://services.arcgis.com/Ej0PsM5Aw677QF1W/arcgis/rest/services/TRAFFICCAMERA_POINT_2029/FeatureServer/0/query?where=1%3D1&outFields=AssetID,Location,Description,ImageURL,CamRegion,Live,Model,Manufacturer,Owner,CurrentStatus&f=geojson'; + 'https://services.arcgis.com/Ej0PsM5Aw677QF1W/arcgis/rest/services/TRAFFICCAMERA_POINT_2029/FeatureServer/0/query?where=1%3D1&outFields=AssetID,Location,ImageURL,Live,Model,Manufacturer,Owner,CurrentStatus&f=geojson'; /** Frames come only from the county's own image handler host. */ export const KING_COUNTY_IMAGE_ORIGIN = 'https://info.kingcounty.gov/'; /** The whole catalog is ~125 rows (~59 live county cameras); no thinning by @@ -323,6 +323,10 @@ export const KING_COUNTY_IMAGE_ORIGIN = 'https://info.kingcounty.gov/'; export const DEFAULT_KING_COUNTY_MAX_SOURCES = 125; /** Prioritization anchor: Renton, roughly central to the county road network. */ export const KING_COUNTY_ANCHORS = [{ lat: 47.4829, lon: -122.2171 }]; +/** Hard ceiling on the King County catalog body. The whole layer is ~125 rows + * and well under 100 KB; this only exists so an upstream that streams an + * unbounded body cannot be buffered without limit. */ +export const KING_COUNTY_MAX_CATALOG_BYTES = 1024 * 1024; /** Camera CATALOGS change rarely; 15 min keeps multi-megabyte upstream list refetches (Austin rows.json + 4 Caltrans districts + TfL + Ontario 511) infrequent. Frames are fetched per-request and are unaffected. */ export const CCTV_SOURCE_CACHE_MS = 15 * 60 * 1000; diff --git a/server/providers/cctv/sources.js b/server/providers/cctv/sources.js index 4955be563..84d694c70 100644 --- a/server/providers/cctv/sources.js +++ b/server/providers/cctv/sources.js @@ -63,6 +63,7 @@ import { KING_COUNTY_IMAGE_ORIGIN, DEFAULT_KING_COUNTY_MAX_SOURCES, KING_COUNTY_ANCHORS, + KING_COUNTY_MAX_CATALOG_BYTES, DEFAULT_VEGVESEN_CCTV_URL, VEGVESEN_IMAGE_ORIGIN, VEGVESEN_VIDEO_URL, @@ -1733,6 +1734,17 @@ function isLikelyKingCountyCoordinate(lat, lon) { ); } +/** + * A King County `Model` value, whitespace-collapsed, or '' when it is a + * vendor-generic string ("PTZ", "PTZ IP", "BOSCH/PTZ") that names no model. + */ +function kingCountyModel(raw) { + const model = String(raw || '') + .replace(/\s+/g, ' ') + .trim(); + return /^(?:[a-z]+\/)?ptz(?: ip)?$/i.test(model) ? '' : model; +} + /** * Fetch King County road cameras (Washington State). Keyless: one public * ArcGIS FeatureServer GeoJSON query (King County DOT Road Services), with an @@ -1740,16 +1752,17 @@ function isLikelyKingCountyCoordinate(lat, lon) { * never fetched. Only cameras that are live and active (`Live`, * `CurrentStatus`) with a positive integer id, finite in-county coordinates, * and a frame on the county's own image handler are kept. WSDOT-owned rows in - * the layer are skipped — the statewide WSDOT pack is their home — while the - * handful of city-owned cameras the county hosts (Redmond, Sammamish, - * Newcastle, Snoqualmie) keep their owner as the per-camera credit, + * the layer are skipped because their frames are WSDOT-hosted, outside the + * pinned image origin, while partner-city cameras hosted on the county image + * handler (e.g. Newcastle) name their owner as the per-camera credit, * DriveBC-style. The layer publishes no facing, so every heading is the id * hash at low confidence. * * Uniquely among the packs, the county publishes each camera's hardware * `Manufacturer`/`Model`; the model string (whitespace-collapsed — the feed * carries stray newlines) rides along as the source's `model` for - * identified-hardware consumers. + * identified-hardware consumers. Vendor-generic strings ("PTZ", "PTZ IP", + * "BOSCH/PTZ") name no model and are treated as absent. * * @returns {Promise>} Normalized camera source objects. */ @@ -1757,16 +1770,37 @@ export async function loadKingCountySourcesFromOpenData() { try { const resp = await fetch(KING_COUNTY_CAMERAS_URL, { headers: { Accept: 'application/json' }, + redirect: 'manual', signal: AbortSignal.timeout(CCTV_SOURCE_FETCH_TIMEOUT_MS), }); + // A response this loader will not read still owns its transport until the + // body is released, so every rejection path cancels before returning. + const discard = async () => { + try { + await resp.body?.cancel(); + } catch { + /* no-op */ + } + return []; + }; + if (resp.status >= 300 && resp.status < 400) { + console.warn( + '[CCTV] King County catalog redirected; redirects are not followed', + ); + return discard(); + } if (!resp.ok) { console.warn('[CCTV] King County camera download failed:', resp.status); - return []; + return discard(); } - const payload = await resp.json(); + const payload = await readResponseJsonCapped( + resp, + KING_COUNTY_MAX_CATALOG_BYTES, + ); const rows = Array.isArray(payload?.features) ? payload.features : []; const cameras = []; + const seen = new Set(); for (const row of rows) { const attrs = row?.properties; const rawId = attrs?.AssetID; @@ -1774,8 +1808,8 @@ export async function loadKingCountySourcesFromOpenData() { if (attrs.Live !== 1) continue; if (String(attrs.CurrentStatus || '').trim() !== 'Active') continue; const owner = String(attrs.Owner || '').trim(); - // WSDOT-owned rows belong to the statewide WSDOT pack; skipping them - // here keeps one camera from appearing twice on the globe. + // WSDOT-owned rows serve WSDOT-hosted frames, outside the pinned + // county image origin, so they are skipped. if (owner === 'WSDOT') continue; // The handler is served over HTTPS; the feed still writes http://. const imageUrl = String(attrs.ImageURL || '') @@ -1788,9 +1822,9 @@ export async function loadKingCountySourcesFromOpenData() { if (!isLikelyKingCountyCoordinate(lat, lon)) continue; const cameraId = `kingcounty-${rawId}`; - const model = String(attrs.Model || '') - .replace(/\s+/g, ' ') - .trim(); + if (seen.has(cameraId)) continue; + seen.add(cameraId); + const model = kingCountyModel(attrs.Model); const manufacturer = String(attrs.Manufacturer || '') .replace(/\s+/g, ' ') .trim(); diff --git a/src/data/cctvKingCountySource.test.mjs b/src/data/cctvKingCountySource.test.mjs index a0f765446..5da0ae708 100644 --- a/src/data/cctvKingCountySource.test.mjs +++ b/src/data/cctvKingCountySource.test.mjs @@ -6,6 +6,7 @@ import path from 'node:path'; import { DEFAULT_KING_COUNTY_MAX_SOURCES, KING_COUNTY_CAMERAS_URL, + KING_COUNTY_MAX_CATALOG_BYTES, } from '../../server/providers/cctv/constants.js'; import { loadKingCountySourcesFromOpenData } from '../../server/providers/cctv/sources.js'; import { normalizeSourceItem } from '../../server/providers/cctv/normalize.js'; @@ -73,9 +74,9 @@ test('King County loader keeps live county cameras and upgrades frame URLs to HT }), // City-owned camera the county hosts: kept, owner becomes the credit. kingCountyFeature(90, 47.674, -122.119, { - properties: { Owner: 'City of Redmond', Model: null }, + properties: { Owner: 'City of Newcastle', Model: null }, }), - // WSDOT-owned row: the statewide WSDOT pack is its home. + // WSDOT-owned row: its frames are WSDOT-hosted, so it is skipped. kingCountyFeature(70, 47.6, -122.3, { properties: { Owner: 'WSDOT' } }), // Off-host frame, not live, retired, bad id, bad geometry, out of county. kingCountyFeature(71, 47.6, -122.3, { @@ -118,11 +119,11 @@ test('King County loader keeps live county cameras and upgrades frame URLs to HT assert.equal(novelty.fovDeg, 44); assert.ok(novelty.headingDeg >= 0 && novelty.headingDeg < 360); - const redmond = cameras.find((camera) => camera.id === 'kingcounty-90'); - assert.equal(redmond.credit, 'City of Redmond'); - assert.equal(redmond.model, undefined); + const newcastle = cameras.find((camera) => camera.id === 'kingcounty-90'); + assert.equal(newcastle.credit, 'City of Newcastle'); + assert.equal(newcastle.model, undefined); // A manufacturer without a model identifies nothing, so it is dropped too. - assert.equal(redmond.manufacturer, undefined); + assert.equal(newcastle.manufacturer, undefined); }); test('normalizeSourceItem passes a hardware model through and omits it otherwise', () => { @@ -275,3 +276,92 @@ test('King County loader defaults its cap and survives upstream failure', async }); assert.deepEqual(await loadKingCountySourcesFromOpenData(), []); }); + +test('King County loader does not follow a redirected catalog', async (t) => { + quiet(t); + let init; + t.mock.method(globalThis, 'fetch', async (_url, options) => { + init = options; + return new Response( + JSON.stringify({ + type: 'FeatureCollection', + features: [kingCountyFeature(56, 47.70059, -122.02443)], + }), + { status: 302, headers: { Location: 'https://example.com/cams' } }, + ); + }); + + assert.deepEqual(await loadKingCountySourcesFromOpenData(), []); + assert.equal(init.redirect, 'manual'); +}); + +test('King County loader rejects an oversized catalog', async (t) => { + quiet(t); + const features = [kingCountyFeature(56, 47.70059, -122.02443)]; + const body = JSON.stringify({ + type: 'FeatureCollection', + features, + padding: 'x'.repeat(KING_COUNTY_MAX_CATALOG_BYTES), + }); + t.mock.method(globalThis, 'fetch', async () => new Response(body)); + + assert.deepEqual(await loadKingCountySourcesFromOpenData(), []); +}); + +test('King County loader drops duplicate ids before the per-pack cap', async (t) => { + quiet(t); + withEnv(t, { CCTV_KINGCOUNTY_MAX_SOURCES: '8' }); + // Repeats of the camera nearest the anchor would fill an 8-camera cap + // before the second, farther camera if duplicates reached prioritization. + const features = []; + for (let i = 0; i < 10; i += 1) { + features.push(kingCountyFeature(56, 47.4829, -122.2171)); + } + features.push(kingCountyFeature(57, 47.70059, -122.02443)); + t.mock.method(globalThis, 'fetch', async () => + Response.json({ type: 'FeatureCollection', features }), + ); + + const cameras = await loadKingCountySourcesFromOpenData(); + assert.deepEqual(cameras.map((camera) => camera.id).sort(), [ + 'kingcounty-56', + 'kingcounty-57', + ]); +}); + +test('King County loader omits vendor-generic model strings', async (t) => { + quiet(t); + withEnv(t, { CCTV_KINGCOUNTY_MAX_SOURCES: undefined }); + t.mock.method(globalThis, 'fetch', async () => + Response.json({ + type: 'FeatureCollection', + features: [ + kingCountyFeature(61, 47.5, -122.2, { + properties: { Model: 'PTZ', Manufacturer: 'Bosch' }, + }), + kingCountyFeature(62, 47.51, -122.2, { + properties: { Model: 'PTZ IP', Manufacturer: 'Cohu' }, + }), + kingCountyFeature(63, 47.52, -122.2, { + properties: { Model: 'BOSCH/PTZ', Manufacturer: 'Bosch' }, + }), + kingCountyFeature(64, 47.53, -122.2, { + properties: { Model: 'AUTODOME IP 5000', Manufacturer: 'Bosch' }, + }), + ], + }), + ); + + const byId = new Map( + (await loadKingCountySourcesFromOpenData()).map((camera) => [ + camera.id, + camera, + ]), + ); + for (const id of ['kingcounty-61', 'kingcounty-62', 'kingcounty-63']) { + assert.equal(byId.get(id).model, undefined, id); + assert.equal(byId.get(id).manufacturer, undefined, id); + } + assert.equal(byId.get('kingcounty-64').model, 'AUTODOME IP 5000'); + assert.equal(byId.get('kingcounty-64').manufacturer, 'Bosch'); +}); diff --git a/src/data/dataCredits.js b/src/data/dataCredits.js index 267e1d6bd..d1bba9a85 100644 --- a/src/data/dataCredits.js +++ b/src/data/dataCredits.js @@ -261,7 +261,7 @@ export const DATA_CREDITS = [ 'kingcounty.gov, ' + 'per the ' + 'KCGIS Center terms. ' + - 'A few cameras are supplied by partner cities (Redmond, Sammamish, Newcastle, Snoqualmie); each names its owner in the CCTV panel.', + 'Partner-city cameras hosted on the county image handler (e.g. Newcastle) name their owner in the CCTV panel.', }, { key: 'vegvesen-cctv',