feat: 收口视频访问与摄像头密钥输出

server-go/internal/handler/video_stream.go

@@ -14,8 +14,9 @@ import (
 	"gorm.io/gorm"
 )
 
-// RegisterVideoStreamRoutes 注册视频流代理路由（公开接口，不需要 JWT）
+// RegisterVideoStreamRoutes 注册视频流代理路由；路由可免 Authorization，但必须校验 videoToken。
 func RegisterVideoStreamRoutes(rg *gin.RouterGroup, transcode *service.TranscodeService, db *gorm.DB, media *service.MediaService, cfg *config.Config) {
+	SetVideoTokenSecret(cfg.JWTSecret)
 	rg.GET("/video/clips/:clipId/stream", streamClip(transcode))
 	rg.GET("/video/cameras/:id/live/stream", streamLive(db, media, cfg))
 	rg.GET("/video/cameras/:id/live/proxy", proxyLive(db, media, cfg))
@@ -25,6 +26,9 @@ func RegisterVideoStreamRoutes(rg *gin.RouterGroup, transcode *service.Transcode
 func streamClip(transcode *service.TranscodeService) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		clipId := c.Param("clipId")
+		if !requireVideoToken(c, "clip", clipId) {
+			return
+		}
 		c.Header("Content-Type", "video/mp4")
 
 		if err := transcode.StreamClip(clipId, c.Writer); err != nil {
@@ -40,6 +44,9 @@ func streamClip(transcode *service.TranscodeService) gin.HandlerFunc {
 func streamLive(db *gorm.DB, media *service.MediaService, cfg *config.Config) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		cameraId := c.Param("id")
+		if !requireVideoToken(c, "camera", cameraId) {
+			return
+		}
 
 		var camera model.Camera
 		if db.Where("id = ?", cameraId).First(&camera).Error != nil {
@@ -101,6 +108,9 @@ func streamLive(db *gorm.DB, media *service.MediaService, cfg *config.Config) gi
 func proxyLive(db *gorm.DB, media *service.MediaService, cfg *config.Config) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		cameraId := c.Param("id")
+		if !requireVideoToken(c, "camera", cameraId) {
+			return
+		}
 
 		// 1. 查摄像头
 		var camera model.Camera