Add WebClient for web interface API with stok authentication

src/tplink_nvr_export/cli.py

@@ -9,6 +9,7 @@ import click
 
 from . import __version__
 from .auth import AuthenticationError
+from .debug import setup_debug_logging
 from .nvr_client import NVRAPIError, NVRClient
 
 
@@ -56,20 +57,35 @@ DATETIME = DateTimeParamType()
 
 @click.group()
 @click.version_option(version=__version__, prog_name="nvr-export")
-def main():
+@click.option("--debug", "-d", is_flag=True, help="Enable debug logging (shows all API requests/responses)")
+@click.option("--debug-file", type=click.Path(), help="Write debug log to file")
+@click.pass_context
+def main(ctx, debug: bool, debug_file: str):
     """TP-Link Vigi NVR Export Tool.
     
     Export video recordings from TP-Link Vigi NVRs via OpenAPI.
     
     Make sure OpenAPI is enabled on your NVR:
     Settings > Network > OpenAPI (default port: 20443)
+    
+    \b
+    Debug mode:
+        nvr-export --debug export ...
+        nvr-export --debug --debug-file debug.log export ...
     """
-    pass
+    ctx.ensure_object(dict)
+    ctx.obj['debug'] = debug
+    
+    # Setup debug logging
+    setup_debug_logging(enabled=debug, log_file=debug_file)
+    
+    if debug:
+        click.echo("🔧 Debug mode enabled - all API requests will be logged", err=True)
 
 
 @main.command()
 @click.option("--host", "-h", required=True, help="NVR IP address or hostname")
-@click.option("--port", "-p", default=20443, help="OpenAPI port (default: 20443)")
+@click.option("--port", "-p", default=443, help="Port (default: 443 for web, 20443 for openapi)")
 @click.option("--user", "-u", required=True, help="Admin username")
 @click.option("--password", "-P", required=True, prompt=True, hide_input=True, help="Admin password")
 @click.option("--channel", "-c", required=True, type=int, help="Camera channel ID (1-based)")
@@ -81,7 +97,9 @@ def main():
               help="Recording type filter")
 @click.option("--no-ssl-verify", is_flag=True, default=True, help="Skip SSL certificate verification")
 @click.option("--quiet", "-q", is_flag=True, help="Suppress progress output")
+@click.pass_context
 def export(
+    ctx,
     host: str,
     port: int,
     user: str,
@@ -96,23 +114,27 @@ def export(
 ):
     """Export recordings from NVR for a time range.
     
+    Uses the web interface API (/stok/ds) for recording access.
+    
     \b
     Examples:
         # Export channel 1 for a specific day
         nvr-export export -h 192.168.1.100 -u admin -c 1 \\
             -s "2024-12-28 00:00" -e "2024-12-28 23:59" -o ./exports
         
-        # Export only motion recordings
-        nvr-export export -h 192.168.1.100 -u admin -c 2 \\
-            -s "2024-12-01" -e "2024-12-31" --type motion -o ./exports
+        # Export with debug logging
+        nvr-export --debug export -h 192.168.1.100 -u admin -c 1 \\
+            -s "2024-12-28" -e "2024-12-29" -o ./exports
     """
+    from .web_client import WebClient, WebClientError
+    
     output_dir = Path(output)
     
     if not quiet:
-        click.echo(f"Connecting to NVR at {host}:{port}...")
+        click.echo(f"Connecting to NVR web interface at {host}:{port}...")
     
     try:
-        with NVRClient(host, user, password, port, verify_ssl=not no_ssl_verify) as client:
+        with WebClient(host, user, password, port, verify_ssl=not no_ssl_verify) as client:
             if not quiet:
                 click.echo(f"Searching recordings: Channel {channel}, {start} to {end}")
             
@@ -120,6 +142,8 @@ def export(
             
             if not recordings:
                 click.echo("No recordings found for the specified time range.")
+                if ctx.obj.get('debug'):
+                    click.echo("💡 Tip: Check debug output above for API responses", err=True)
                 return
             
             # Calculate total size
@@ -136,14 +160,14 @@ def export(
             if not quiet:
                 click.echo(f"\nSuccessfully exported {len(downloaded)} recordings to {output_dir}")
                 
-    except AuthenticationError as e:
-        click.echo(f"Authentication failed: {e}", err=True)
-        sys.exit(1)
-    except NVRAPIError as e:
-        click.echo(f"NVR API error: {e}", err=True)
+    except WebClientError as e:
+        click.echo(f"Web interface error: {e}", err=True)
         sys.exit(1)
     except Exception as e:
         click.echo(f"Unexpected error: {e}", err=True)
+        if ctx.obj.get('debug'):
+            import traceback
+            click.echo(traceback.format_exc(), err=True)
         sys.exit(1)
 
 
@@ -153,7 +177,9 @@ def export(
 @click.option("--user", "-u", required=True, help="Admin username")
 @click.option("--password", "-P", required=True, prompt=True, hide_input=True, help="Admin password")
 @click.option("--no-ssl-verify", is_flag=True, default=True, help="Skip SSL certificate verification")
+@click.pass_context
 def channels(
+    ctx,
     host: str,
     port: int,
     user: str,
@@ -196,7 +222,9 @@ def channels(
 @click.option("--type", "rec_type", default="all",
               type=click.Choice(["all", "continuous", "motion", "alarm"]))
 @click.option("--no-ssl-verify", is_flag=True, default=True)
+@click.pass_context
 def search(
+    ctx,
     host: str,
     port: int,
     user: str,
@@ -214,6 +242,8 @@ def search(
             
             if not recordings:
                 click.echo("No recordings found.")
+                if ctx.obj.get('debug'):
+                    click.echo("💡 Tip: Check debug output above for API responses", err=True)
                 return
             
             total_size = sum(r.size_bytes for r in recordings) / (1024 * 1024)
@@ -238,5 +268,167 @@ def search(
         sys.exit(1)
 
 
+@main.command()
+@click.option("--host", "-h", required=True, help="NVR IP address or hostname")
+@click.option("--port", "-p", default=20443, help="OpenAPI port (default: 20443)")
+@click.option("--user", "-u", required=True, help="Admin username")
+@click.option("--password", "-P", required=True, prompt=True, hide_input=True, help="Admin password")
+@click.option("--no-ssl-verify", is_flag=True, default=True)
+@click.pass_context
+def discover(
+    ctx,
+    host: str,
+    port: int,
+    user: str,
+    password: str,
+    no_ssl_verify: bool,
+):
+    """Discover available API endpoints on the NVR.
+    
+    This command probes many possible API paths to find which ones
+    are available on your NVR. Useful for debugging and development.
+    """
+    import requests
+    
+    # Common endpoints to try
+    endpoints_to_probe = [
+        # Root and info
+        ("GET", "/openapi"),
+        ("GET", "/openapi/"),
+        ("GET", "/openapi/info"),
+        ("GET", "/openapi/version"),
+        ("GET", "/openapi/api"),
+        ("GET", "/openapi/swagger"),
+        ("GET", "/openapi/docs"),
+        
+        # Device/channels
+        ("GET", "/openapi/device"),
+        ("GET", "/openapi/devices"),
+        ("GET", "/openapi/added_devices"),
+        ("GET", "/openapi/channel"),
+        ("GET", "/openapi/channels"),
+        ("GET", "/openapi/channelList"),
+        ("GET", "/openapi/device/info"),
+        ("GET", "/openapi/device/list"),
+        ("GET", "/openapi/device/channels"),
+        ("GET", "/openapi/nvr/info"),
+        ("GET", "/openapi/nvr/channels"),
+        
+        # Recording/playback
+        ("GET", "/openapi/record"),
+        ("GET", "/openapi/records"),
+        ("GET", "/openapi/recording"),
+        ("GET", "/openapi/recordings"),
+        ("GET", "/openapi/playback"),
+        ("GET", "/openapi/video"),
+        ("GET", "/openapi/videos"),
+        ("GET", "/openapi/storage"),
+        ("GET", "/openapi/storage/recordings"),
+        ("GET", "/openapi/hdd"),
+        ("GET", "/openapi/disk"),
+        
+        # Search endpoints
+        ("GET", "/openapi/search"),
+        ("GET", "/openapi/record/list"),
+        ("GET", "/openapi/recording/list"),
+        ("GET", "/openapi/playback/list"),
+        ("GET", "/openapi/video/list"),
+        
+        # Live stream
+        ("GET", "/openapi/live"),
+        ("GET", "/openapi/stream"),
+        ("GET", "/openapi/liveStream"),
+        ("GET", "/openapi/rtsp"),
+        
+        # Events
+        ("GET", "/openapi/event"),
+        ("GET", "/openapi/events"),
+        ("GET", "/openapi/event/list"),
+        ("GET", "/openapi/alarm"),
+        ("GET", "/openapi/alarms"),
+        
+        # Settings
+        ("GET", "/openapi/settings"),
+        ("GET", "/openapi/config"),
+        ("GET", "/openapi/system"),
+        ("GET", "/openapi/sound"),
+        ("GET", "/openapi/network"),
+        
+        # User
+        ("GET", "/openapi/user"),
+        ("GET", "/openapi/users"),
+        ("GET", "/openapi/account"),
+    ]
+    
+    click.echo(f"Connecting to NVR at {host}:{port}...")
+    
+    try:
+        from .auth import NVRAuthenticator
+        
+        auth = NVRAuthenticator(host, user, password, port, verify_ssl=not no_ssl_verify)
+        session = auth.get_authenticated_session()
+        base_url = f"https://{host}:{port}"
+        
+        click.echo(f"Authentication successful!")
+        click.echo(f"\nProbing {len(endpoints_to_probe)} endpoints...\n")
+        
+        found_endpoints = []
+        
+        for method, endpoint in endpoints_to_probe:
+            url = f"{base_url}{endpoint}"
+            try:
+                if method == "GET":
+                    response = session.get(url, timeout=5)
+                else:
+                    response = session.post(url, json={}, timeout=5)
+                
+                status = response.status_code
+                
+                if status == 200:
+                    # Try to get response preview
+                    try:
+                        data = response.json()
+                        preview = str(data)[:100]
+                    except:
+                        preview = response.text[:100] if response.text else "(empty)"
+                    
+                    click.echo(f"✅ {status} {method:4} {endpoint}")
+                    click.echo(f"   Response: {preview}...")
+                    found_endpoints.append((method, endpoint, status))
+                elif status in (400, 401, 403, 405):
+                    # Exists but needs different params/auth
+                    click.echo(f"⚠️  {status} {method:4} {endpoint} (exists but access denied/bad request)")
+                    found_endpoints.append((method, endpoint, status))
+                # 404 = not found, skip silently
+                    
+            except requests.RequestException as e:
+                pass  # Skip connection errors
+        
+        click.echo(f"\n{'='*60}")
+        click.echo(f"Summary: Found {len(found_endpoints)} accessible endpoints")
+        
+        if found_endpoints:
+            click.echo("\nWorking endpoints (200 OK):")
+            for method, endpoint, status in found_endpoints:
+                if status == 200:
+                    click.echo(f"  {method} {endpoint}")
+            
+            click.echo("\nEndpoints that exist but need work:")
+            for method, endpoint, status in found_endpoints:
+                if status != 200:
+                    click.echo(f"  {method} {endpoint} ({status})")
+        else:
+            click.echo("\n⚠️  No working endpoints found!")
+            click.echo("The NVR might use a different API structure.")
+            click.echo("Try checking the NVR web interface with browser DevTools.")
+                
+    except AuthenticationError as e:
+        click.echo(f"Authentication failed: {e}", err=True)
+        sys.exit(1)
+    except Exception as e:
+        click.echo(f"Error: {e}", err=True)
+        sys.exit(1)
+
+
 if __name__ == "__main__":
     main()

src/tplink_nvr_export/debug.py

@@ -0,0 +1,111 @@
+"""Debug logging utilities for NVR Export."""
+
+import json
+import logging
+import sys
+from datetime import datetime
+from typing import Any
+
+
+# Create logger
+logger = logging.getLogger("nvr_export")
+
+
+def setup_debug_logging(enabled: bool = False, log_file: str = None) -> None:
+    """
+    Setup debug logging.
+    
+    Args:
+        enabled: Whether to enable debug logging
+        log_file: Optional file path to write logs to
+    """
+    level = logging.DEBUG if enabled else logging.WARNING
+    
+    # Clear existing handlers
+    logger.handlers.clear()
+    logger.setLevel(level)
+    
+    # Console handler
+    console_handler = logging.StreamHandler(sys.stderr)
+    console_handler.setLevel(level)
+    
+    # Formatter with timestamp
+    formatter = logging.Formatter(
+        "[%(asctime)s] %(levelname)s: %(message)s",
+        datefmt="%H:%M:%S"
+    )
+    console_handler.setFormatter(formatter)
+    logger.addHandler(console_handler)
+    
+    # File handler if specified
+    if log_file:
+        file_handler = logging.FileHandler(log_file, mode='w', encoding='utf-8')
+        file_handler.setLevel(logging.DEBUG)
+        file_handler.setFormatter(logging.Formatter(
+            "[%(asctime)s] %(levelname)s: %(message)s",
+            datefmt="%Y-%m-%d %H:%M:%S"
+        ))
+        logger.addHandler(file_handler)
+    
+    if enabled:
+        logger.debug("Debug logging enabled")
+
+
+def log_request(method: str, url: str, headers: dict = None, body: Any = None) -> None:
+    """Log an outgoing HTTP request."""
+    logger.debug(f">>> {method} {url}")
+    if headers:
+        # Filter out sensitive headers
+        safe_headers = {k: v for k, v in headers.items() if 'auth' not in k.lower()}
+        if safe_headers:
+            logger.debug(f"    Headers: {safe_headers}")
+    if body:
+        try:
+            body_str = json.dumps(body, indent=2, default=str)
+            logger.debug(f"    Body: {body_str}")
+        except (TypeError, ValueError):
+            logger.debug(f"    Body: {body}")
+
+
+def log_response(status_code: int, headers: dict = None, body: Any = None, truncate: int = 2000) -> None:
+    """Log an incoming HTTP response."""
+    logger.debug(f"<<< Response: {status_code}")
+    if headers:
+        content_type = headers.get('content-type', 'unknown')
+        content_length = headers.get('content-length', 'unknown')
+        logger.debug(f"    Content-Type: {content_type}, Length: {content_length}")
+    if body:
+        try:
+            if isinstance(body, (dict, list)):
+                body_str = json.dumps(body, indent=2, default=str)
+            else:
+                body_str = str(body)
+            
+            if len(body_str) > truncate:
+                body_str = body_str[:truncate] + f"\n... (truncated, total {len(body_str)} chars)"
+            logger.debug(f"    Body: {body_str}")
+        except (TypeError, ValueError):
+            logger.debug(f"    Body: {body}")
+
+
+def log_error(message: str, exception: Exception = None) -> None:
+    """Log an error."""
+    if exception:
+        logger.error(f"{message}: {type(exception).__name__}: {exception}")
+    else:
+        logger.error(message)
+
+
+def log_info(message: str) -> None:
+    """Log info message."""
+    logger.info(message)
+
+
+def log_debug(message: str) -> None:
+    """Log debug message."""
+    logger.debug(message)
+
+
+def is_debug_enabled() -> bool:
+    """Check if debug logging is enabled."""
+    return logger.level <= logging.DEBUG

src/tplink_nvr_export/nvr_client.py

@@ -9,6 +9,7 @@ import requests
 from tqdm import tqdm
 
 from .auth import AuthenticationError, NVRAuthenticator
+from .debug import log_debug, log_error, log_request, log_response, is_debug_enabled
 from .models import Channel, ExportJob, Recording
 
 
@@ -42,6 +43,7 @@ class NVRClient:
         self.base_url = f"https://{host}:{port}"
         self.auth = NVRAuthenticator(host, username, password, port, verify_ssl)
         self._session: Optional[requests.Session] = None
+        log_debug(f"NVRClient initialized for {host}:{port}")
     
     @property
     def session(self) -> requests.Session:
@@ -76,8 +78,20 @@ class NVRClient:
         
         url = f"{self.base_url}{endpoint}"
         
+        # Log request
+        log_request(method, url, kwargs.get('headers'), kwargs.get('json'))
+        
         try:
             response = self.session.request(method, url, timeout=60, **kwargs)
+            
+            # Log response
+            try:
+                response_data = response.json() if response.content else {}
+            except ValueError:
+                response_data = {"raw": response.text[:500] if response.text else "empty"}
+            
+            log_response(response.status_code, dict(response.headers), response_data)
+            
             response.raise_for_status()
             
             # Some endpoints might return empty response
@@ -95,6 +109,7 @@ class NVRClient:
             return data
             
         except requests.RequestException as e:
+            log_error(f"Request to {endpoint} failed", e)
             raise NVRAPIError(f"Request failed: {e}") from e
     
     def get_channels(self) -> list[Channel]:
@@ -114,17 +129,23 @@ class NVRClient:
             ("GET", "device/channels"),
         ]
         
+        log_debug(f"Trying {len(endpoints_to_try)} endpoint patterns for channels")
+        
         for endpoint_info in endpoints_to_try:
             try:
                 method = endpoint_info[0]
                 endpoint = endpoint_info[1]
                 json_data = endpoint_info[2] if len(endpoint_info) > 2 else None
                 
+                log_debug(f"Trying endpoint: {method} {endpoint}")
+                
                 if json_data:
                     data = self._api_request(method, endpoint, json=json_data)
                 else:
                     data = self._api_request(method, endpoint)
                 
+                log_debug(f"Response keys: {list(data.keys()) if data else 'empty'}")
+                
                 # Parse response - try different structures
                 channel_list = (
                     data.get("result", {}).get("channel_list", []) or
@@ -136,6 +157,8 @@ class NVRClient:
                     []
                 )
                 
+                log_debug(f"Found {len(channel_list)} channels in response")
+                
                 if channel_list:
                     for ch_data in channel_list:
                         channels.append(Channel(
@@ -145,10 +168,12 @@ class NVRClient:
                         ))
                     return channels
                     
-            except NVRAPIError:
+            except NVRAPIError as e:
+                log_debug(f"Endpoint {endpoint} failed: {e}")
                 continue
         
         # If no channels found via API, return default channels 1-8
+        log_debug("No channels found via API, returning defaults 1-8")
         if not channels:
             for i in range(1, 9):
                 channels.append(Channel(id=i, name=f"Channel {i}", enabled=True))
@@ -182,6 +207,9 @@ class NVRClient:
         start_iso = start_time.strftime("%Y-%m-%dT%H:%M:%S")
         end_iso = end_time.strftime("%Y-%m-%dT%H:%M:%S")
         
+        log_debug(f"Searching recordings: channel={channel_id}, start={start_time}, end={end_time}")
+        log_debug(f"Timestamps: start_ts={start_ts}, end_ts={end_ts}")
+        
         type_map = {
             "all": 0,
             "continuous": 1,
@@ -217,17 +245,28 @@ class NVRClient:
             }),
         ]
         
+        log_debug(f"Trying {len(endpoints_to_try)} endpoint patterns for recordings")
+        
         for endpoint_info in endpoints_to_try:
             try:
                 method = endpoint_info[0]
                 endpoint = endpoint_info[1]
                 json_data = endpoint_info[2] if len(endpoint_info) > 2 and isinstance(endpoint_info[2], dict) else None
                 
+                log_debug(f"Trying endpoint: {method} {endpoint}")
+                
                 if json_data:
                     data = self._api_request(method, endpoint, json=json_data)
                 else:
                     data = self._api_request(method, endpoint)
                 
+                log_debug(f"Response keys: {list(data.keys()) if data else 'empty'}")
+                
+                # Log full response structure for debugging
+                if is_debug_enabled():
+                    import json as json_module
+                    log_debug(f"Full response: {json_module.dumps(data, indent=2, default=str)[:1000]}")
+                
                 # Parse response - try different structures
                 result = data.get("result", data)
                 record_list = (
@@ -235,11 +274,16 @@ class NVRClient:
                     result.get("recordings", []) or
                     result.get("recordList", []) or
                     result.get("items", []) or
+                    result.get("searchResult", []) or
+                    result.get("list", []) or
                     []
                 )
                 
+                log_debug(f"Found {len(record_list)} recordings in response")
+                
                 if record_list:
                     for rec_data in record_list:
+                        log_debug(f"Recording data: {rec_data}")
                         rec_start = self._parse_timestamp(
                             rec_data.get("start_time", rec_data.get("startTime", rec_data.get("start", 0)))
                         )
@@ -258,9 +302,11 @@ class NVRClient:
                         ))
                     return recordings
                     
-            except NVRAPIError:
+            except NVRAPIError as e:
+                log_debug(f"Endpoint {endpoint} failed: {e}")
                 continue
         
+        log_debug("No recordings found with any endpoint pattern")
         return recordings
     
     def _parse_timestamp(self, ts) -> datetime:
@@ -312,6 +358,8 @@ class NVRClient:
             f"{self.base_url}/openapi/download?recordId={recording.id}",
         ])
         
+        log_debug(f"Download URLs to try: {download_urls}")
+        
         # Determine output filename
         if output_path.is_dir():
             filename = self._generate_filename(recording)
@@ -325,13 +373,18 @@ class NVRClient:
         last_error = None
         for download_url in download_urls:
             try:
+                log_debug(f"Trying download from: {download_url}")
                 response = self.session.get(download_url, stream=True, timeout=300)
+                
+                log_debug(f"Download response: {response.status_code}, Content-Type: {response.headers.get('content-type')}")
+                
                 response.raise_for_status()
                 
                 # Check if response is actually video data
                 content_type = response.headers.get("content-type", "")
                 if "json" in content_type or "html" in content_type:
                     # This is an error response, try next URL
+                    log_debug(f"Got non-video response, trying next URL")
                     continue
                 
                 # Get total size from headers or recording metadata
@@ -348,9 +401,11 @@ class NVRClient:
                             if progress_callback:
                                 progress_callback(downloaded, total_size)
                 
+                log_debug(f"Downloaded {downloaded} bytes to {output_file}")
                 return output_file
                 
             except requests.RequestException as e:
+                log_error(f"Download from {download_url} failed", e)
                 last_error = e
                 continue
         

src/tplink_nvr_export/web_client.py

@@ -0,0 +1,496 @@
+"""Web Interface API client for TP-Link Vigi NVR.
+
+Uses the stok-based authentication for the /ds endpoint,
+which provides access to recordings and playback.
+"""
+
+import hashlib
+import json
+import time
+from dataclasses import dataclass
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Callable, Optional
+
+import requests
+from tqdm import tqdm
+
+from .debug import log_debug, log_error, log_request, log_response, is_debug_enabled
+from .models import Channel, Recording
+
+
+@dataclass
+class StokSession:
+    """Holds stok session data."""
+    
+    stok: str
+    expires_at: float
+    
+    @property
+    def is_expired(self) -> bool:
+        """Check if token has expired (valid ~30 min)."""
+        return time.time() >= self.expires_at
+
+
+class WebClient:
+    """Client for TP-Link Vigi NVR Web Interface API.
+    
+    Uses /stok={token}/ds endpoint for all operations.
+    This provides access to recordings, playback, and other features
+    not available via the OpenAPI.
+    """
+    
+    def __init__(
+        self,
+        host: str,
+        username: str,
+        password: str,
+        port: int = 443,
+        verify_ssl: bool = False,
+    ):
+        """
+        Initialize Web client.
+        
+        Args:
+            host: NVR IP address or hostname
+            username: Admin username
+            password: Admin password
+            port: Web interface port (default: 443)
+            verify_ssl: Whether to verify SSL certificates
+        """
+        self.host = host
+        self.username = username
+        self.password = password
+        self.port = port
+        self.verify_ssl = verify_ssl
+        self.base_url = f"https://{host}" if port == 443 else f"https://{host}:{port}"
+        self._session: Optional[StokSession] = None
+        self._http_session = requests.Session()
+        self._http_session.verify = verify_ssl
+        
+        # Suppress SSL warnings if not verifying
+        if not verify_ssl:
+            import urllib3
+            urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+        
+        log_debug(f"WebClient initialized for {host}:{port}")
+    
+    @property
+    def stok(self) -> str:
+        """Get current stok token, refreshing if expired."""
+        if self._session is None or self._session.is_expired:
+            self._session = self._login()
+        return self._session.stok
+    
+    def _hash_password(self, password: str) -> str:
+        """Hash password for login. TP-Link uses MD5."""
+        return hashlib.md5(password.encode()).hexdigest()
+    
+    def _login(self) -> StokSession:
+        """
+        Login to NVR web interface and obtain stok token.
+        
+        Returns:
+            StokSession with stok token
+            
+        Raises:
+            WebClientError: If login fails
+        """
+        login_url = f"{self.base_url}/"
+        
+        log_debug(f"Logging in to {login_url}")
+        
+        try:
+            # First, try standard TP-Link login format
+            # The login endpoint is usually POST to / with form data
+            login_data = {
+                "method": "do",
+                "login": {
+                    "username": self.username,
+                    "password": self._hash_password(self.password),
+                }
+            }
+            
+            log_request("POST", login_url, body=login_data)
+            
+            response = self._http_session.post(
+                login_url,
+                json=login_data,
+                timeout=30,
+            )
+            
+            log_response(response.status_code, dict(response.headers), 
+                        response.json() if response.content else None)
+            
+            if response.status_code == 200:
+                data = response.json()
+                stok = data.get("stok", "")
+                
+                if stok:
+                    log_debug(f"Got stok token: {stok[:20]}...")
+                    # Token valid for ~25 minutes (refresh before 30)
+                    expires_at = time.time() + (25 * 60)
+                    return StokSession(stok=stok, expires_at=expires_at)
+            
+            # Try alternative login format
+            alt_login_data = {
+                "username": self.username,
+                "password": self._hash_password(self.password),
+            }
+            
+            log_debug("Trying alternative login format")
+            log_request("POST", login_url, body=alt_login_data)
+            
+            response = self._http_session.post(
+                login_url,
+                data=alt_login_data,
+                timeout=30,
+            )
+            
+            log_response(response.status_code, dict(response.headers),
+                        response.text[:500] if response.text else None)
+            
+            # Check for stok in response
+            try:
+                data = response.json()
+                stok = data.get("stok", data.get("result", {}).get("stok", ""))
+                if stok:
+                    expires_at = time.time() + (25 * 60)
+                    return StokSession(stok=stok, expires_at=expires_at)
+            except ValueError:
+                pass
+            
+            raise WebClientError("Could not obtain stok token from login response")
+            
+        except requests.RequestException as e:
+            log_error("Login failed", e)
+            raise WebClientError(f"Login failed: {e}") from e
+    
+    def _ds_request(
+        self,
+        data: dict,
+    ) -> dict:
+        """
+        Make a request to the /ds endpoint.
+        
+        Args:
+            data: Request data (method, params, etc.)
+            
+        Returns:
+            JSON response as dict
+        """
+        url = f"{self.base_url}/stok={self.stok}/ds"
+        
+        log_request("POST", url, body=data)
+        
+        try:
+            response = self._http_session.post(
+                url,
+                json=data,
+                timeout=60,
+            )
+            
+            try:
+                response_data = response.json()
+            except ValueError:
+                response_data = {"raw": response.text[:500] if response.text else "empty"}
+            
+            log_response(response.status_code, dict(response.headers), response_data)
+            
+            response.raise_for_status()
+            
+            # Check for error in response
+            error_code = response_data.get("error_code", 0)
+            if error_code != 0:
+                error_msg = response_data.get("error_msg", f"Error code: {error_code}")
+                raise WebClientError(f"API error: {error_msg}")
+            
+            return response_data
+            
+        except requests.RequestException as e:
+            log_error(f"Request to /ds failed", e)
+            raise WebClientError(f"Request failed: {e}") from e
+    
+    def get_channels(self) -> list[Channel]:
+        """Get list of camera channels."""
+        log_debug("Getting channels via /ds")
+        
+        # Try different methods to get channel list
+        methods_to_try = [
+            {"method": "get", "channel": {"table": ["channel"]}},
+            {"method": "get", "device": {"name": ["device_info"]}},
+            {"method": "get", "channel_info": {}},
+            {"method": "do", "channel": {"action": "list"}},
+        ]
+        
+        for method_data in methods_to_try:
+            try:
+                data = self._ds_request(method_data)
+                
+                # Try to find channels in response
+                channels = []
+                
+                # Look for channel data in various places
+                channel_data = (
+                    data.get("channel", {}).get("table", {}).get("channel", []) or
+                    data.get("channel", []) or
+                    data.get("channels", []) or
+                    data.get("result", {}).get("channels", []) or
+                    []
+                )
+                
+                if channel_data:
+                    for i, ch in enumerate(channel_data):
+                        if isinstance(ch, dict):
+                            channels.append(Channel(
+                                id=ch.get("id", ch.get("channel_id", i + 1)),
+                                name=ch.get("name", ch.get("channel_name", f"Channel {i + 1}")),
+                                enabled=ch.get("enabled", True),
+                            ))
+                    
+                    if channels:
+                        return channels
+                        
+            except WebClientError as e:
+                log_debug(f"Method failed: {e}")
+                continue
+        
+        # Return default channels if API doesn't provide them
+        log_debug("Using default channels 1-32")
+        return [Channel(id=i, name=f"Channel {i}", enabled=True) for i in range(1, 33)]
+    
+    def search_recordings(
+        self,
+        channel_id: int,
+        start_time: datetime,
+        end_time: datetime,
+        recording_type: str = "all",
+    ) -> list[Recording]:
+        """
+        Search for recordings in a time range.
+        
+        Args:
+            channel_id: Camera channel ID
+            start_time: Start of time range
+            end_time: End of time range
+            recording_type: Type filter
+            
+        Returns:
+            List of Recording objects
+        """
+        start_str = start_time.strftime("%Y%m%d")
+        end_str = end_time.strftime("%Y%m%d")
+        start_ts = int(start_time.timestamp())
+        end_ts = int(end_time.timestamp())
+        
+        log_debug(f"Searching recordings: ch={channel_id}, {start_time} to {end_time}")
+        
+        # Try different search methods
+        methods_to_try = [
+            {
+                "method": "get",
+                "playback": {
+                    "table": ["search"],
+                    "search": {
+                        "channel": channel_id,
+                        "start_date": start_str,
+                        "end_date": end_str,
+                    }
+                }
+            },
+            {
+                "method": "do",
+                "playback": {
+                    "action": "search",
+                    "channel": channel_id,
+                    "start_time": start_ts,
+                    "end_time": end_ts,
+                }
+            },
+            {
+                "method": "get",
+                "record": {
+                    "table": ["search"],
+                    "search": {
+                        "channel_id": channel_id,
+                        "start": start_ts,
+                        "end": end_ts,
+                    }
+                }
+            },
+            {
+                "method": "do",
+                "record": {
+                    "action": "search",
+                    "channel": channel_id,
+                    "start_date": start_str,
+                    "end_date": end_str,
+                }
+            },
+        ]
+        
+        recordings = []
+        
+        for method_data in methods_to_try:
+            try:
+                log_debug(f"Trying: {json.dumps(method_data)[:100]}")
+                data = self._ds_request(method_data)
+                
+                # Log full response for debugging
+                if is_debug_enabled():
+                    log_debug(f"Full response: {json.dumps(data, indent=2, default=str)[:1500]}")
+                
+                # Look for recordings in various places
+                record_list = (
+                    data.get("playback", {}).get("table", {}).get("search", []) or
+                    data.get("playback", {}).get("search", []) or
+                    data.get("record", {}).get("table", {}).get("search", []) or
+                    data.get("record", {}).get("search", []) or
+                    data.get("result", {}).get("records", []) or
+                    data.get("records", []) or
+                    data.get("list", []) or
+                    []
+                )
+                
+                log_debug(f"Found {len(record_list)} records in response")
+                
+                if record_list:
+                    for rec in record_list:
+                        try:
+                            rec_start = self._parse_time(rec.get("start", rec.get("start_time", 0)))
+                            rec_end = self._parse_time(rec.get("end", rec.get("end_time", 0)))
+                            
+                            recordings.append(Recording(
+                                id=str(rec.get("id", rec.get("record_id", ""))),
+                                channel_id=channel_id,
+                                start_time=rec_start,
+                                end_time=rec_end,
+                                size_bytes=rec.get("size", rec.get("file_size", 0)),
+                                recording_type=str(rec.get("type", "unknown")),
+                                file_path=rec.get("path", rec.get("file_path")),
+                            ))
+                        except Exception as e:
+                            log_debug(f"Error parsing record: {e}")
+                            continue
+                    
+                    if recordings:
+                        return recordings
+                        
+            except WebClientError as e:
+                log_debug(f"Method failed: {e}")
+                continue
+        
+        return recordings
+    
+    def _parse_time(self, t) -> datetime:
+        """Parse time from various formats."""
+        if isinstance(t, (int, float)) and t > 0:
+            return datetime.fromtimestamp(t)
+        if isinstance(t, str):
+            for fmt in ["%Y%m%d%H%M%S", "%Y-%m-%d %H:%M:%S", "%Y-%m-%dT%H:%M:%S"]:
+                try:
+                    return datetime.strptime(t, fmt)
+                except ValueError:
+                    continue
+            try:
+                return datetime.fromtimestamp(int(t))
+            except:
+                pass
+        return datetime.now()
+    
+    def download_recording(
+        self,
+        recording: Recording,
+        output_path: Path,
+        progress_callback: Optional[Callable[[int, int], None]] = None,
+    ) -> Path:
+        """Download a recording to disk."""
+        # Build download URL
+        if recording.file_path:
+            download_url = f"{self.base_url}/stok={self.stok}/ds?download={recording.file_path}"
+        else:
+            download_url = f"{self.base_url}/stok={self.stok}/ds?download&channel={recording.channel_id}&id={recording.id}"
+        
+        log_debug(f"Downloading from: {download_url}")
+        
+        # Determine output filename
+        if output_path.is_dir():
+            start_str = recording.start_time.strftime("%Y%m%d_%H%M%S")
+            end_str = recording.end_time.strftime("%H%M%S")
+            filename = f"ch{recording.channel_id}_{start_str}-{end_str}.mp4"
+            output_file = output_path / filename
+        else:
+            output_file = output_path
+        
+        output_file.parent.mkdir(parents=True, exist_ok=True)
+        
+        try:
+            response = self._http_session.get(download_url, stream=True, timeout=300)
+            response.raise_for_status()
+            
+            total_size = int(response.headers.get("content-length", recording.size_bytes or 0))
+            
+            downloaded = 0
+            with open(output_file, "wb") as f:
+                for chunk in response.iter_content(chunk_size=8192):
+                    if chunk:
+                        f.write(chunk)
+                        downloaded += len(chunk)
+                        if progress_callback:
+                            progress_callback(downloaded, total_size)
+            
+            log_debug(f"Downloaded {downloaded} bytes to {output_file}")
+            return output_file
+            
+        except requests.RequestException as e:
+            log_error(f"Download failed", e)
+            raise WebClientError(f"Download failed: {e}") from e
+    
+    def export_time_range(
+        self,
+        channel_id: int,
+        start_time: datetime,
+        end_time: datetime,
+        output_dir: Path,
+        recording_type: str = "all",
+        show_progress: bool = True,
+    ) -> list[Path]:
+        """Export all recordings in a time range."""
+        recordings = self.search_recordings(channel_id, start_time, end_time, recording_type)
+        
+        if not recordings:
+            return []
+        
+        output_dir = Path(output_dir)
+        output_dir.mkdir(parents=True, exist_ok=True)
+        
+        downloaded_files = []
+        recordings_iter = tqdm(recordings, desc="Downloading", disable=not show_progress)
+        
+        for recording in recordings_iter:
+            if show_progress:
+                recordings_iter.set_postfix_str(f"Ch{recording.channel_id} {recording.start_time:%H:%M}")
+            
+            try:
+                output_file = self.download_recording(recording, output_dir)
+                downloaded_files.append(output_file)
+            except WebClientError as e:
+                if show_progress:
+                    tqdm.write(f"Warning: Failed to download {recording}: {e}")
+        
+        return downloaded_files
+    
+    def close(self) -> None:
+        """Close the HTTP session."""
+        self._http_session.close()
+    
+    def __enter__(self) -> "WebClient":
+        return self
+    
+    def __exit__(self, *args) -> None:
+        self.close()
+
+
+class WebClientError(Exception):
+    """Raised when web interface operations fail."""
+    pass