feat: 重建 ONVIF 与 RTSP 视频接入 (#66)

Sense/server/app/sense/credential/reader.go

@@ -0,0 +1,35 @@
+package credential
+
+import (
+	"errors"
+	"fmt"
+
+	"gorm.io/gorm"
+)
+
+var ErrCredentialNotConfigured = errors.New("摄像头凭据尚未配置")
+
+type Value struct {
+	Username string
+	Password string
+}
+
+// Read is an internal adapter port. HTTP handlers must never expose Value.
+func Read(db *gorm.DB, deviceID, purpose string) (Value, error) {
+	var row DeviceCredential
+	if err := db.First(&row, "device_id = ? AND purpose = ?", deviceID, purpose).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return Value{}, ErrCredentialNotConfigured
+		}
+		return Value{}, fmt.Errorf("read device credential: %w", err)
+	}
+	vault, err := NewVaultFromEnvironment()
+	if err != nil {
+		return Value{}, err
+	}
+	username, password, err := vault.Decrypt(deviceID, purpose, row.Ciphertext)
+	if err != nil {
+		return Value{}, err
+	}
+	return Value{Username: username, Password: password}, nil
+}