Paste the camera's RTSP address instead of taking it apart by hand

Asked directly: "our cameras have an rtsp url, we can use that to connect them
to this software right". Yes - and that has always been the mechanism, which
is the point. CameraConfig.source() builds exactly that URL from the parts,
and CameraConfig.url has always accepted a whole one and taken priority over
them. No form ever offered it.

So an operator holding the address their camera's own app shows had to split
it into five fields by eye. That is where a password containing @ or / goes
wrong, and this repository has already been bitten once by unencoded @ in RTSP
credentials.

parseRtspUrl lives in shared/cameraMakes.js and is imported by BOTH forms, for
the same reason the make picker is: two copies would be worse than not
offering it, because an operator trusts a filled-in field. A test asserts both
import it.

Decisions worth keeping:

- Split into fields, not stored whole. Everything else on the form - Test, the
  make picker, editing later, and the rule that a password is never returned
  to the browser - works on the parts. A URL kept intact would carry the
  password back out to every screen that reads a camera.
- WHATWG splits user info at the LAST @, which is what makes an unencoded @
  inside a password parse the way a person means it. An operator doing it by
  eye would put "p" in the password box and "ssw0rd@192.168.1.121" in the
  address box.
- Percent-encoded credentials are DECODED, because source() encodes again
  when it rebuilds the URL. Keeping them encoded would double-encode and the
  camera would refuse a password that is correct.
- The scheme is optional, structure is not. Without requiring a slash,
  "nonsense" parses as a perfectly good hostname and silently fills the
  Address field with it - a wrong answer that looks like it worked. A bare
  address is refused too: the Address field already takes one.
- A query string stays with the path. Some cameras carry the channel there,
  and dropping it opens the wrong channel - which looks like a camera pointed
  somewhere unexpected.
- A URL carrying no credentials does not wipe a password already typed.

Tested through node from pytest, the same pattern test_dashboard.py uses, and
skipped when node is absent so the suite stays dependency-light.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGcjxF1cNLcuwc3DAPcnfj

shared/cameraMakes.js

@@ -79,3 +79,48 @@ export const MAKES = [
 ]
 
 export const makeById = (id) => MAKES.find(m => m.id === id) || MAKES[MAKES.length - 1]
+
+// Paste the camera's RTSP URL, rather than taking it apart by hand.
+//
+// The engine has always accepted a whole URL (`CameraConfig.url` wins over the
+// parts) and no form has ever offered one - the same gap as the webcam option,
+// and it costs more here. A URL is how people actually HAVE this information:
+// it is what the camera's own app shows, what an installer writes down and
+// what gets pasted into a message. Splitting it into five fields by eye is
+// where a password containing `@` or `/` goes wrong, and this repository
+// already records a whole class of bug from unencoded `@` in RTSP credentials.
+//
+// Split into fields rather than stored whole, deliberately: everything else on
+// the form - Test, the make picker, editing later, and the rule that a
+// password is never returned to the browser - works on the parts. A URL kept
+// intact would carry the password back out to every screen that reads a
+// camera.
+export function parseRtspUrl(raw) {
+  const text = String(raw || '').trim()
+  if (!text) return null
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(text)
+  // A bare `host/path` is a reasonable thing to paste, so the scheme is
+  // optional - but something has to mark this as a URL rather than a word.
+  // Without the slash test, `nonsense` parses as a perfectly good hostname
+  // and silently fills the Address field with it: a wrong answer that looks
+  // like it worked, which is worse than refusing.
+  if (!hasScheme && !text.includes('/')) return null
+  const withScheme = hasScheme ? text : 'rtsp://' + text
+  let u
+  try {
+    u = new URL(withScheme)
+  } catch {
+    return null
+  }
+  if (!u.hostname) return null
+  // WHATWG splits user info at the LAST `@`, which is what makes an unencoded
+  // `@` inside a password parse the way a person means it.
+  const out = {
+    host: u.hostname,
+    port: Number(u.port) || 554,
+    path: (u.pathname || '') + (u.search || '') || '/',
+    username: decodeURIComponent(u.username || ''),
+    password: decodeURIComponent(u.password || ''),
+  }
+  return out
+}