How I Embed Imou Camera Video in a SaaS App

说明与用途

在 SaaS 中嵌入按租户隔离的 Imou 摄像头视频：架构、端点、访问控制、功能门控和可观测性。

问题

Integrating third‑party camera streams into a multi‑tenant SaaS while ensuring tenant isolation, secure access, and graceful handling of device capabilities.

结果

Implemented a secure, tenant‑aware camera embed that prevents cross‑tenant leaks, gates features by capability, and provides observability and testing coverage.

工作流

• Define camera schema with unique (tenant_id, external_id) mapping.
• Create POST /tenants/:tid/sites/:sid/cameras/:cid/live endpoint that validates tenant and site access.
• Open Cloud Live stream via gateway, return short‑lived handle to browser.
• Mount player with handle; destroy on leaveSite or tenant switch.
• Gate UI controls (PTZ, talk, screenshot, playback) based on camera capabilities.
• Implement revocation logic: heartbeat remint only after ACL, fail on role revoke.
• Add observability events (saas_embed_start|stop|fail) with tenant, site, camera, error class.
• Write cross‑tenant tests: denied access, rebind handling, role revoke, overnight tab resume, capability flags, no public livestream.
• Deploy gateway exposing only listBySite, openLive, command; keep vendor SDKs out of monolith.
• Monitor first‑frame latency distribution per device and subscription.

证据

Cameras map to tenant_id and site_id I already authorize.

来源

I do not ship a public unauthenticated livestream.

来源

I store handles only in page memory. Redis of live handles becomes a second auth system.

来源