From 691f643edc96920e5a6652ccd53f78aebedb711a Mon Sep 17 00:00:00 2001 From: PageZ948 Date: Sat, 4 Apr 2026 12:50:24 +0000 Subject: [PATCH] =?UTF-8?q?Initial=20commit=20=E2=80=94=20Alta=20Video=20P?= =?UTF-8?q?layer=20(WebAVP)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Web-based surveillance video player for Alta/Ava Security camera exports with multi-camera sync, timeline, digital zoom, motion analytics, and cryptographic integrity verification. Co-Authored-By: Claude Opus 4.6 (1M context) --- CLAUDE.md | 107 + app.py | 85 + design.md | 322 +++ requirements.txt | 3 + static/jszip.min.js | 13 + templates/index.html | 5038 ++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 5568 insertions(+) create mode 100644 CLAUDE.md create mode 100644 app.py create mode 100644 design.md create mode 100644 requirements.txt create mode 100644 static/jszip.min.js create mode 100644 templates/index.html diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..a857a6d --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,107 @@ +# CLAUDE.md + +This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. + +## Project Overview + +**Alta Video Player (WebAVP)** — a web-based surveillance video player for Alta/Ava Security camera exports. Users drag-drop video files or ZIP archives (including AES-256 encrypted ones) and get a multi-camera synchronized playback experience with timeline, digital zoom, cryptographic integrity verification, and automatic motion analytics. + +## Running the App + +```bash +python3 app.py +# Serves on http://0.0.0.0:5152 +``` + +No build step. No dependencies needed at runtime — `app.py` uses only Python stdlib (`http.server`). The `requirements.txt` (flask, requests, gunicorn) is vestigial; the server was rewritten to pure stdlib. + +## Architecture + +### Backend (`app.py`) + +Minimal HTTP server with three routes: +- `GET /` — serves `templates/index.html` +- `GET /static/*` — serves static files with path traversal protection +- `GET /api/verify-cert?serial=...&certificateHash=...` — proxies certificate verification to `https://aware.avasecurity.com/api/v1/public/verifyServerCertificate` + +### Frontend (`templates/index.html`) + +Single self-contained HTML file (~5000 lines) with inline CSS and JavaScript in an IIFE. This is the entire application — there is no framework, no build system, no separate JS modules. + +**State model:** Global `channels` Map keyed by channel name. Each channel holds segments (video blobs + time ranges), metadata, DOM references, color, and zoom state. Global timeline state (`globalStart`, `globalEnd`, `currentTime`) synchronizes all cameras. Motion analytics state lives in the `motionState` object. + +**Key subsystems:** +- **File ingestion** — drag-drop files/folders, ZIP extraction (JSZip for plain, custom AES-256-CTR for encrypted), metadata pairing by base filename, concurrent import guard (`isImporting` flag) +- **Multi-camera grid** — responsive CSS grid (1–9 cameras), drag-to-reorder, click-to-expand +- **Playback engine** — `requestAnimationFrame` tick loop, per-channel segment visibility management, variable speed (0.25x–8x), frame stepping +- **Timeline** — interactive scrub bar with zoom (mouse wheel), minimap, per-channel segment indicators with color-coded dots, motion heatmap row +- **Digital zoom** — per-camera scroll-to-zoom (up to 10x) with click-drag panning +- **Magnifier tool** — draw rectangle to zoom into region +- **Slideshow mode** — animated grid showing only currently active feeds with transitions +- **Motion analytics** — automatic background motion detection on load (see below) +- **Integrity verification** — offline X.509 certificate parsing, RSASSA-PKCS1-v1_5 and ECDSA signature verification via Web Crypto API, optional cloud verification through `/api/verify-cert` +- **Session persistence** — IndexedDB caching of video blobs and metadata for page refresh survival + +**External dependency:** `/static/jszip.min.js` (vendored, for unencrypted ZIP parsing). + +## Motion Analytics Subsystem + +Zero-dependency canvas-based motion detection that runs automatically when videos are loaded. + +### How it works +1. **Auto-scan on load** — `scheduleAutoScan()` is called from `flushPending()` and `loadSessionData()` after videos finish loading. Debounced 800ms to batch all segments. +2. **Dedicated scan videos** — scan creates temporary offscreen `