Matheus
c03c6d4eaa
- extensions table (tenant-scoped, RLS): number, sip_password_enc
(AES-256-GCM via packages/shared/src/crypto.ts), caller_id, context,
sofia_profile, codecs, max_registrations
- apps/api/src/extensions: CRUD (POST/GET/GET:id/DELETE), protected by a
new generic PermissionGuard (@RequirePermission decorator), tenant
resolved only from the JWT (never trusted from the client)
- SIP password is returned in plaintext only once, in the create response;
toPublicExtension() explicitly destructures the encrypted field out
(not a spread) so it can't leak by accident
- b2bcall-fs-config now resolves real directory data: Tenant.telephonyDomain
-> Extension.number, decrypts the password, builds proper directory XML
including a dial-string param (missing it caused originate to fail with
MANDATORY_IE_MISSING instead of the expected USER_NOT_REGISTERED)
- pinned FreeSWITCH's 357737{domain} to a stable value (b2bcall.local) via a
vars.xml patch in the Dockerfile -- it previously used the container's
dynamic IP, which could never match a stored telephony_domain
- added HTTP Basic auth between FreeSWITCH and fs-config
(gateway-credentials, timingSafeEqual comparison) now that the service
returns real secret data, closing the gap flagged as pending in the XML
Curl phase instead of leaving it open
- found and fixed: PermissionGuard's constructor-injected Reflector came
back undefined at runtime under tsx/esbuild (unreliable cross-file
decorator metadata emission) -- fixed with an explicit @Inject(Reflector);
worth watching for in future guards/services run via tsx
- verified end-to-end: create extension -> originate user/<ext> reports
USER_NOT_REGISTERED (found, not registered) -> delete -> back to
SUBSCRIBER_ABSENT (not found); password never reappears in any GET;
unauthenticated fs-config requests get 401
- docs/EXTENSIONS.md
21 lines
813 B
Bash
21 lines
813 B
Bash
#!/bin/sh
|
|
# Aplica secrets de RUNTIME (nunca de build — a imagem nao carrega nenhum
|
|
# valor real) antes de subir o FreeSWITCH. Falha alto se ESL_PASSWORD nao
|
|
# estiver definido: nunca cair silenciosamente na senha padrao "ClueCon"
|
|
# (agente.md secao 22).
|
|
set -eu
|
|
|
|
: "${ESL_PASSWORD:?ESL_PASSWORD precisa estar definido no ambiente do container}"
|
|
: "${FS_CONFIG_USER:?FS_CONFIG_USER precisa estar definido no ambiente do container}"
|
|
: "${FS_CONFIG_PASSWORD:?FS_CONFIG_PASSWORD precisa estar definido no ambiente do container}"
|
|
|
|
sed -i "s/__ESL_PASSWORD__/${ESL_PASSWORD}/" \
|
|
/etc/freeswitch/autoload_configs/event_socket.conf.xml
|
|
|
|
sed -i \
|
|
-e "s/__FS_CONFIG_USER__/${FS_CONFIG_USER}/" \
|
|
-e "s/__FS_CONFIG_PASSWORD__/${FS_CONFIG_PASSWORD}/" \
|
|
/etc/freeswitch/autoload_configs/xml_curl.conf.xml
|
|
|
|
exec "$@"
|