Suriyakumarvijayanayagam
dad04e8cda
Five components that ship as one product:
- behavision/ the recognition engine. RTSP ingest, YuNet detection, IoU
tracking, ArcFace embeddings, a FAISS/SQLite gallery, and a
FastAPI dashboard. Identity is decided once per TRACK from an
average of at least three embeddings, never per frame.
- agent/ the Go edge agent: supervises the engine, holds a durable
spool, and drains it to MQTT. Nothing is acked before the
broker confirms.
- desktop/ the shop PC application (Wails + React + tray).
- server/ the cloud API, MQTT consumer, reports and assistant.
- web/ platform.loyaly.ai, the head-office app, embedded in the
server binary.
The gallery stores 512-float embeddings and timestamps - no images unless
`app.store_faces` is switched on. Those embeddings are biometric personal
data under GDPR and India's DPDP: template inversion reconstructs a
recognisable face from an ArcFace vector, so data/behavision.db is treated
as a biometric database and DELETE /api/visitors/{id} is a real erasure.
CLAUDE.md carries the reasoning behind every non-obvious decision here,
including the ones that were measured and the ones that were wrong first.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HViLj9gYNRtSr7YVZmW5sn
63 lines
2.0 KiB
Go
63 lines
2.0 KiB
Go
package config
|
|
|
|
import (
|
|
"bufio"
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
// EngineCredentials reads the Basic credentials the engine generated for
|
|
// itself, from the file it writes them to.
|
|
//
|
|
// The engine only invents a credential when none is configured and its API
|
|
// listens on a routable address - which is the DEFAULT configuration, so this
|
|
// is the ordinary case and not an edge one. `paths.APICredentials` has existed
|
|
// since the agent was written, with a comment saying the agent reads the file
|
|
// "rather than storing a second copy, so a regenerated credential does not
|
|
// silently break the tray". Nothing read it. On a stock install the agent's
|
|
// api_user was therefore empty and every call it makes to the engine - health,
|
|
// stats, camera sync, embeddings for a visit - came back 401: the tray red, the
|
|
// cameras never reconciled, and no error anywhere saying why.
|
|
//
|
|
// A missing or unreadable file is not an error. A PC where the operator set
|
|
// BEHAVISION_API_USER has no such file and needs none.
|
|
func EngineCredentials(path string) (user, password string) {
|
|
f, err := os.Open(path)
|
|
if err != nil {
|
|
return "", ""
|
|
}
|
|
defer f.Close()
|
|
|
|
sc := bufio.NewScanner(f)
|
|
for sc.Scan() {
|
|
// `key=value`, and `key: value` too: the file is also read by people,
|
|
// and which separator the engine used is not worth a support call.
|
|
line := strings.TrimSpace(sc.Text())
|
|
k, v, ok := strings.Cut(line, "=")
|
|
if !ok {
|
|
k, v, ok = strings.Cut(line, ":")
|
|
}
|
|
if !ok {
|
|
continue
|
|
}
|
|
switch strings.TrimSpace(k) {
|
|
case "username":
|
|
user = strings.TrimSpace(v)
|
|
case "password":
|
|
password = strings.TrimSpace(v)
|
|
}
|
|
}
|
|
return user, password
|
|
}
|
|
|
|
// WithEngineCredentials fills in the engine's Basic credentials from the file
|
|
// when the config carries none. Configured values always win: an operator who
|
|
// set BEHAVISION_API_USER means it.
|
|
func (c Config) WithEngineCredentials(path string) Config {
|
|
if c.APIUser != "" || c.APIPassword != "" {
|
|
return c
|
|
}
|
|
c.APIUser, c.APIPassword = EngineCredentials(path)
|
|
return c
|
|
}
|