@fonoster/sipnet 0.27.0 → 0.31.0

package/dist/numbers/repointNumbersCli.js

@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const fs = __importStar(require("fs"));
+const sdk_1 = __importDefault(require("@routr/sdk"));
+const engineRouting_1 = require("./engineRouting");
+const repointNumbers_1 = require("./repointNumbers");
+/**
+ * Moves app-linked Numbers created before the rebuild (pointing at Asterisk's sip:voice@default)
+ * to the roomr peer:
+ *
+ *   node dist/numbers/repointNumbersCli.js <routing.json> [--apply] [--app <ref>]...
+ *
+ * routing.json holds an EngineRoutingConfig ({ roomrNodeAor }); `{}` uses sip:roomr@default.
+ * Without --apply it only prints what would change. ROUTR_API_ENDPOINT (default routr:51907)
+ * points at Routr's API.
+ */
+function main(argv) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const file = argv[0];
+        if (!file) {
+            console.error("usage: repointNumbersCli <routing.json> [--apply] [--app <ref>]...");
+            process.exit(2);
+        }
+        const config = JSON.parse(fs.readFileSync(file, "utf8"));
+        const appRefs = argv
+            .map((a, i) => (a === "--app" ? argv[i + 1] : undefined))
+            .filter((a) => !!a);
+        const client = new sdk_1.default.Numbers({
+            endpoint: (_a = process.env.ROUTR_API_ENDPOINT) !== null && _a !== void 0 ? _a : "routr:51907",
+            insecure: true
+        });
+        const changes = yield (0, repointNumbers_1.repointNumbers)(client, (0, engineRouting_1.createNumberRouting)(config), {
+            dryRun: !argv.includes("--apply"),
+            appRefs: appRefs.length ? appRefs : undefined
+        });
+        console.log(JSON.stringify({ applied: argv.includes("--apply"), changes }, null, 2));
+    });
+}
+main(process.argv.slice(2)).catch((e) => {
+    console.error(e.message);
+    process.exit(1);
+});

package/dist/numbers/updateNumber.d.ts

@@ -16,9 +16,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { GrpcErrorMessage, NumberPreconditionsCheck } from "@fonoster/common";
+import { NumberPreconditionsCheck } from "@fonoster/common";
 import { NumbersApi } from "@fonoster/types";
-declare function updateNumber(api: NumbersApi, checkNumberPreconditions: NumberPreconditionsCheck): (call: {
+import { CheckRefs } from "../resources/checkRefs";
+import { NumberRouting } from "./engineRouting";
+declare function updateNumber(api: NumbersApi, checkNumberPreconditions: NumberPreconditionsCheck, routing?: NumberRouting, checkRefs?: CheckRefs): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { updateNumber };

package/dist/numbers/updateNumber.js

@@ -29,17 +29,30 @@ exports.updateNumber = updateNumber;
  * limitations under the License.
  */
 const common_1 = require("@fonoster/common");
+const identity_1 = require("@fonoster/identity");
 const logger_1 = require("@fonoster/logger");
+const checkRefs_1 = require("../resources/checkRefs");
 const convertToRoutrNumber_1 = require("./convertToRoutrNumber");
 const logger = (0, logger_1.getLogger)({ service: "sipnet", filePath: __filename });
-function updateNumber(api, checkNumberPreconditions) {
-    const fn = (call, callback) => __awaiter(this, void 0, void 0, function* () {
+function updateNumber(api, checkNumberPreconditions, routing, checkRefs) {
+    const fn = (call) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const { request } = call;
-        // Validates that the appRef or agentAor exists in the system
-        yield checkNumberPreconditions(request);
+        // Validates that the appRef exists in the caller's workspace (RV-B4)
+        const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
+        yield checkNumberPreconditions(Object.assign(Object.assign({}, request), { accessKeyId }));
+        // ...and the trunk too (H7)
+        yield (checkRefs === null || checkRefs === void 0 ? void 0 : checkRefs(accessKeyId, (0, checkRefs_1.numberRefs)(request)));
         logger.verbose("call to updateNumber", Object.assign({}, request));
-        const response = yield api.updateNumber((0, convertToRoutrNumber_1.convertToRoutrNumberUpdate)(request));
-        callback(null, response);
+        // The number's telUrl matters only for per-number pins, so it is read only with routing.
+        const appPeerAor = routing && request.appRef
+            ? yield routing.aorFor({
+                appRef: request.appRef,
+                telUrl: (_a = (yield api.getNumber(request.ref))) === null || _a === void 0 ? void 0 : _a.telUrl
+            })
+            : undefined;
+        return yield api.updateNumber((0, convertToRoutrNumber_1.convertToRoutrNumberUpdate)(request, appPeerAor));
     });
-    return (0, common_1.withErrorHandlingAndValidation)(fn, common_1.Validators.updateNumberRequestSchema);
+    // Only the caller's own numbers can be updated, like every other resource.
+    return (0, common_1.withErrorHandlingAndValidation)((0, identity_1.withAccess)(fn, ((ref) => api.getNumber(ref))), common_1.Validators.updateNumberRequestSchema);
 }

package/dist/resources/checkRefs.d.ts

@@ -0,0 +1,26 @@
+import { ClientOptions } from "../types";
+type RefKind = "Acl" | "Credentials" | "Domain" | "Number" | "Trunk";
+type OwnedResource = {
+    extended?: Record<string, unknown> | null;
+} | null | undefined;
+type RefLookups = Record<RefKind, (ref: string) => Promise<OwnedResource>>;
+/** One reference in a request: the request field, what it names and its value. */
+type RefField = {
+    field: string;
+    kind: RefKind;
+    ref?: string | null;
+};
+type CheckRefs = (accessKeyId: string | undefined, refs: RefField[]) => Promise<void>;
+/** A request's references, checked before it reaches Routr. */
+type CheckRequestRefs<R> = (request: R, accessKeyId: string | undefined) => Promise<void>;
+declare function createCheckRefs(lookups: Partial<RefLookups>): CheckRefs;
+/** The production lookups: Routr's API, one client per kind. */
+declare function createRefLookups(clientOptions: ClientOptions): RefLookups;
+type Refs = Record<string, unknown>;
+declare const agentRefs: (r: Refs) => RefField[];
+declare const trunkRefs: (r: Refs) => RefField[];
+declare const domainRefs: (r: Refs) => RefField[];
+declare const numberRefs: (r: Refs) => RefField[];
+/** The reference check for one resource type's requests. */
+declare function refsChecker<R>(checkRefs: CheckRefs | undefined, refsOf: (request: Refs) => RefField[]): CheckRequestRefs<R> | undefined;
+export { agentRefs, CheckRefs, CheckRequestRefs, createCheckRefs, createRefLookups, domainRefs, numberRefs, RefField, RefKind, RefLookups, refsChecker, trunkRefs };

package/dist/resources/checkRefs.js

@@ -0,0 +1,138 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trunkRefs = exports.numberRefs = exports.domainRefs = exports.agentRefs = void 0;
+exports.createCheckRefs = createCheckRefs;
+exports.createRefLookups = createRefLookups;
+exports.refsChecker = refsChecker;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const common_1 = require("@fonoster/common");
+const grpc_js_1 = require("@grpc/grpc-js");
+const sdk_1 = __importDefault(require("@routr/sdk"));
+const isNotFound = (e) => (e === null || e === void 0 ? void 0 : e.code) === grpc_js_1.status.NOT_FOUND;
+function createCheckRefs(lookups) {
+    return (accessKeyId, refs) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const given = refs.filter((r) => typeof r.ref === "string" && r.ref !== "");
+        if (given.length === 0)
+            return;
+        if (!accessKeyId) {
+            throw new common_1.GrpcError(grpc_js_1.status.PERMISSION_DENIED, "the caller's workspace is required to reference other resources");
+        }
+        for (const { field, kind, ref } of given) {
+            const lookup = lookups[kind];
+            if (!lookup)
+                throw new Error(`no lookup for ${kind} references`);
+            let resource;
+            try {
+                resource = yield lookup(ref);
+            }
+            catch (e) {
+                if (!isNotFound(e))
+                    throw e;
+                resource = undefined;
+            }
+            // Another workspace's resource is reported like a missing one, so refs of other
+            // workspaces are not confirmed.
+            if (((_a = resource === null || resource === void 0 ? void 0 : resource.extended) === null || _a === void 0 ? void 0 : _a.accessKeyId) !== accessKeyId) {
+                throw new common_1.GrpcError(grpc_js_1.status.INVALID_ARGUMENT, `${field} ${ref} not found`);
+            }
+        }
+    });
+}
+/** The production lookups: Routr's API, one client per kind. */
+function createRefLookups(clientOptions) {
+    const acls = new sdk_1.default.Acls(clientOptions);
+    const credentials = new sdk_1.default.Credentials(clientOptions);
+    const domains = new sdk_1.default.Domains(clientOptions);
+    const numbers = new sdk_1.default.Numbers(clientOptions);
+    const trunks = new sdk_1.default.Trunks(clientOptions);
+    return {
+        Acl: (ref) => acls.getAcl(ref),
+        Credentials: (ref) => credentials.getCredentials(ref),
+        Domain: (ref) => domains.getDomain(ref),
+        Number: (ref) => numbers.getNumber(ref),
+        Trunk: (ref) => trunks.getTrunk(ref)
+    };
+}
+const agentRefs = (r) => [
+    { field: "domainRef", kind: "Domain", ref: r.domainRef },
+    {
+        field: "credentialsRef",
+        kind: "Credentials",
+        ref: r.credentialsRef
+    }
+];
+exports.agentRefs = agentRefs;
+const trunkRefs = (r) => [
+    {
+        field: "accessControlListRef",
+        kind: "Acl",
+        ref: r.accessControlListRef
+    },
+    {
+        field: "inboundCredentialsRef",
+        kind: "Credentials",
+        ref: r.inboundCredentialsRef
+    },
+    {
+        field: "outboundCredentialsRef",
+        kind: "Credentials",
+        ref: r.outboundCredentialsRef
+    }
+];
+exports.trunkRefs = trunkRefs;
+const domainRefs = (r) => {
+    var _a;
+    return [
+        {
+            field: "accessControlListRef",
+            kind: "Acl",
+            ref: r.accessControlListRef
+        },
+        ...((_a = r.egressPolicies) !== null && _a !== void 0 ? _a : []).map((p, i) => ({
+            field: `egressPolicies[${i}].numberRef`,
+            kind: "Number",
+            ref: p === null || p === void 0 ? void 0 : p.numberRef
+        }))
+    ];
+};
+exports.domainRefs = domainRefs;
+const numberRefs = (r) => [
+    { field: "trunkRef", kind: "Trunk", ref: r.trunkRef }
+];
+exports.numberRefs = numberRefs;
+/** The reference check for one resource type's requests. */
+function refsChecker(checkRefs, refsOf) {
+    return checkRefs
+        ? (request, accessKeyId) => checkRefs(accessKeyId, refsOf(request))
+        : undefined;
+}

package/dist/resources/createResource.d.ts

@@ -18,7 +18,8 @@
  */
 import { GrpcErrorMessage } from "@fonoster/common";
 import { z } from "zod";
-declare function createResource<T, R, U>(api: U, resource: string, schema: z.ZodSchema): (call: {
+import { CheckRequestRefs } from "./checkRefs";
+declare function createResource<T, R, U>(api: U, resource: string, schema: z.ZodSchema, checkRefs?: CheckRequestRefs<R>): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { createResource };

package/dist/resources/createResource.js

@@ -31,11 +31,14 @@ exports.createResource = createResource;
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const logger = (0, logger_1.getLogger)({ service: "sipnet", filePath: __filename });
-function createResource(api, resource, schema) {
+function createResource(api, resource, schema, checkRefs) {
     const fn = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
-        logger.verbose(`call to create${resource}`, Object.assign(Object.assign({}, request), { accessKeyId }));
+        // Never the request itself: credentials and trunks carry passwords (M11).
+        logger.verbose(`call to create${resource}`, { accessKeyId });
+        // Referenced credentials, ACLs, domains, numbers and trunks must be the caller's (H7).
+        yield (checkRefs === null || checkRefs === void 0 ? void 0 : checkRefs(request, accessKeyId));
         const response = yield api[`create${resource}`](Object.assign(Object.assign({}, request), { extended: {
                 accessKeyId
             } }));

package/dist/resources/paginationUtils.d.ts

@@ -45,12 +45,13 @@ export declare function filterByAccessKeyId<T extends {
     };
 }>(items: T[], accessKeyId: string): T[];
 /**
- * Handles pagination with filtering, continuing to fetch pages until:
- * - We have enough items (pageSize)
- * - We run out of pages
- * - We hit the max iterations limit
+ * Pages through Routr's items keeping only the caller's, so that following `nextPageToken` returns
+ * every kept item exactly once (management-api, "Lists page through every item once").
  *
- * This handles the case where the first pages contain items from other customers.
+ * Routr's page token is a cursor on the last ref it returned, so a page can end on any item: when
+ * the page fills in the middle of a backend batch, the token is the ref of the last item kept and
+ * the next call resumes right after it. Batches with none of the caller's items are skipped, up to
+ * `maxIterations` of them; the token then points past the last batch read.
  *
  * @template TInput - The type of items returned from the API
  * @template TOutput - The type of items after filtering/transformation (defaults to TInput)

package/dist/resources/paginationUtils.js

@@ -33,71 +33,50 @@ function filterByAccessKeyId(items, accessKeyId) {
     return items.filter((item) => { var _a; return ((_a = item.extended) === null || _a === void 0 ? void 0 : _a.accessKeyId) === accessKeyId; });
 }
 /**
- * Handles pagination with filtering, continuing to fetch pages until:
- * - We have enough items (pageSize)
- * - We run out of pages
- * - We hit the max iterations limit
+ * Pages through Routr's items keeping only the caller's, so that following `nextPageToken` returns
+ * every kept item exactly once (management-api, "Lists page through every item once").
  *
- * This handles the case where the first pages contain items from other customers.
+ * Routr's page token is a cursor on the last ref it returned, so a page can end on any item: when
+ * the page fills in the middle of a backend batch, the token is the ref of the last item kept and
+ * the next call resumes right after it. Batches with none of the caller's items are skipped, up to
+ * `maxIterations` of them; the token then points past the last batch read.
  *
  * @template TInput - The type of items returned from the API
  * @template TOutput - The type of items after filtering/transformation (defaults to TInput)
  */
 function paginateWithFiltering(options) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
         const { pageSize, pageToken, fetchPage, filterItems, maxIterations = 10 } = options;
-        const normalizedPageToken = normalizePageToken(pageToken);
         const items = [];
-        let nextPageToken = "";
-        let currentPageToken = normalizedPageToken;
-        let hasMorePages = true;
-        let iterations = 0;
-        while (items.length < pageSize &&
-            hasMorePages &&
-            iterations < maxIterations) {
-            iterations++;
-            // Request more items to account for filtering
-            const backendRequestedSize = pageSize * 2;
-            const response = yield fetchPage(currentPageToken, backendRequestedSize);
-            if (!response || !response.items) {
-                hasMorePages = false;
-                nextPageToken = "";
-                break;
-            }
-            const filteredItems = filterItems(response.items);
-            items.push(...filteredItems);
-            const backendNextPageToken = normalizeNextPageToken(response.nextPageToken);
-            // If we got no items from backend or no nextPageToken, we're done
-            if (response.items.length === 0 || !backendNextPageToken) {
-                hasMorePages = false;
-                nextPageToken = "";
-                break;
-            }
-            // Check if backend returned fewer items than requested (indicating last page)
-            // If backend returned exactly what we asked for or more, there might be more items
-            const backendHasMoreItems = response.items.length >= backendRequestedSize;
-            // If we've filled the page, we're done
-            if (items.length >= pageSize) {
-                // We filled the page, so there might be more items
-                // Only return nextPageToken if backend indicates there are more items
-                nextPageToken = backendHasMoreItems ? backendNextPageToken : "";
-                break;
-            }
-            // If we got filtered items in this iteration, return them
-            // Only continue if we got 0 filtered items (meaning all items were from other customers)
-            if (filteredItems.length === 0) {
-                // No items matched in this page, continue to next page
-                currentPageToken = backendNextPageToken;
-                nextPageToken = backendNextPageToken;
-            }
-            else {
-                nextPageToken = backendHasMoreItems ? backendNextPageToken : "";
-                break;
+        let cursor = normalizePageToken(pageToken);
+        for (let i = 0; i < maxIterations; i++) {
+            const requested = pageSize * 2;
+            const response = yield fetchPage(cursor, requested);
+            const batch = (_a = response === null || response === void 0 ? void 0 : response.items) !== null && _a !== void 0 ? _a : [];
+            const next = normalizeNextPageToken(response === null || response === void 0 ? void 0 : response.nextPageToken);
+            // Routr may answer a token on its last page too: a short batch that had some of the caller's
+            // items is the end; a short one with none of them is followed, as before.
+            const short = batch.length < requested;
+            let kept = 0;
+            for (const [index, item] of batch.entries()) {
+                const mine = filterItems([item]);
+                if (mine.length === 0)
+                    continue;
+                kept += mine.length;
+                items.push(...mine);
+                if (items.length >= pageSize) {
+                    const lastOfAll = (!next || short) && index === batch.length - 1;
+                    return {
+                        items,
+                        nextPageToken: lastOfAll ? "" : ((_b = item.ref) !== null && _b !== void 0 ? _b : "")
+                    };
+                }
             }
+            if (batch.length === 0 || !next || (short && kept > 0))
+                return { items, nextPageToken: "" };
+            cursor = next;
         }
-        return {
-            items: items.slice(0, pageSize),
-            nextPageToken
-        };
+        return { items, nextPageToken: cursor !== null && cursor !== void 0 ? cursor : "" };
     });
 }

package/dist/resources/sipNames.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { GrpcErrorMessage } from "@fonoster/common";
+/**
+ * Whether a SIP name (a trunk's inbound URI, a domain) is one label under `root`
+ * (e.g. `acme.sip.example.com` under `sip.example.com`). Without a root
+ * (features.sip.names: any) every name passes; the request schema still checks
+ * it's a host or an IP.
+ */
+export declare function isSipNameAllowed(name: string, root?: string): boolean;
+type Handler<R> = (call: {
+    request: R;
+}, callback: (error?: GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
+/**
+ * Rejects a create or update whose `field` isn't one label under `root` with
+ * INVALID_ARGUMENT. An update that leaves the field blank keeps the current value.
+ */
+export declare function withSipNameCheck<R>(handler: Handler<R>, field: string, what: string, root?: string): Handler<R>;
+export {};

package/dist/resources/sipNames.js

@@ -0,0 +1,46 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSipNameAllowed = isSipNameAllowed;
+exports.withSipNameCheck = withSipNameCheck;
+const grpc_js_1 = require("@grpc/grpc-js");
+/** One DNS label: lowercase letters, digits and inner dashes. */
+const LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+/**
+ * Whether a SIP name (a trunk's inbound URI, a domain) is one label under `root`
+ * (e.g. `acme.sip.example.com` under `sip.example.com`). Without a root
+ * (features.sip.names: any) every name passes; the request schema still checks
+ * it's a host or an IP.
+ */
+function isSipNameAllowed(name, root) {
+    if (!root)
+        return true;
+    const suffix = `.${root}`;
+    return name.endsWith(suffix) && LABEL.test(name.slice(0, -suffix.length));
+}
+/**
+ * Rejects a create or update whose `field` isn't one label under `root` with
+ * INVALID_ARGUMENT. An update that leaves the field blank keeps the current value.
+ */
+function withSipNameCheck(handler, field, what, root) {
+    return (call, callback) => __awaiter(this, void 0, void 0, function* () {
+        const value = call.request[field];
+        const name = typeof value === "string" ? value : undefined;
+        if (name && !isSipNameAllowed(name, root)) {
+            callback({
+                code: grpc_js_1.status.INVALID_ARGUMENT,
+                message: `The ${what} must be one label under ${root}, such as acme.${root} at "${field}"`
+            });
+            return;
+        }
+        return handler(call, callback);
+    });
+}

package/dist/resources/updateResource.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
-declare function updateResource<T, R, U>(api: U, resource: string, schema: z.ZodSchema): (call: {
+import { CheckRequestRefs } from "./checkRefs";
+declare function updateResource<T, R, U>(api: U, resource: string, schema: z.ZodSchema, checkRefs?: CheckRequestRefs<R>): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { updateResource };

package/dist/resources/updateResource.js

@@ -32,10 +32,15 @@ const common_1 = require("@fonoster/common");
 const identity_1 = require("@fonoster/identity");
 const logger_1 = require("@fonoster/logger");
 const logger = (0, logger_1.getLogger)({ service: "sipnet", filePath: __filename });
-function updateResource(api, resource, schema) {
+function updateResource(api, resource, schema, checkRefs) {
     const fn = (call) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
-        logger.verbose(`call to update${resource}`, Object.assign({}, request));
+        // Never the request itself: credentials and trunks carry passwords (M11).
+        logger.verbose(`call to update${resource}`, {
+            ref: request.ref
+        });
+        // Referenced credentials, ACLs, domains, numbers and trunks must be the caller's (H7).
+        yield (checkRefs === null || checkRefs === void 0 ? void 0 : checkRefs(request, (0, common_1.getAccessKeyIdFromCall)(call)));
         return yield api[`update${resource}`](request);
     });
     return (0, common_1.withErrorHandlingAndValidation)((0, identity_1.withAccess)(fn, (ref) => api[`get${resource}`](ref)), schema);

package/dist/trunks/buildService.d.ts

@@ -1,5 +1,11 @@
 import { ClientOptions } from "../types";
-declare function buildService(clientOptions: ClientOptions): {
+/**
+ * `namesRoot` (e.g. `sip.example.com`) makes every inbound URI one label under
+ * it; leave it out to accept any host or IP.
+ */
+declare function buildService(clientOptions: ClientOptions, options?: {
+    namesRoot?: string;
+}): {
     definition: {
         serviceName: string;
         pckg: string;

package/dist/trunks/buildService.js

@@ -23,9 +23,16 @@ exports.buildService = buildService;
  * limitations under the License.
  */
 const sdk_1 = __importDefault(require("@routr/sdk"));
+const checkRefs_1 = require("../resources/checkRefs");
+const sipNames_1 = require("../resources/sipNames");
 const operations_1 = require("./operations");
-function buildService(clientOptions) {
+/**
+ * `namesRoot` (e.g. `sip.example.com`) makes every inbound URI one label under
+ * it; leave it out to accept any host or IP.
+ */
+function buildService(clientOptions, options = {}) {
     const client = new sdk_1.default.Trunks(clientOptions);
+    const checkRefs = (0, checkRefs_1.createCheckRefs)((0, checkRefs_1.createRefLookups)(clientOptions));
     return {
         definition: {
             serviceName: "Trunks",
@@ -34,8 +41,8 @@ function buildService(clientOptions) {
             proto: "trunks.proto"
         },
         handlers: {
-            createTrunk: (0, operations_1.createTrunk)(client),
-            updateTrunk: (0, operations_1.updateTrunk)(client),
+            createTrunk: (0, sipNames_1.withSipNameCheck)((0, operations_1.createTrunk)(client, checkRefs), "inboundUri", "inbound URI", options.namesRoot),
+            updateTrunk: (0, sipNames_1.withSipNameCheck)((0, operations_1.updateTrunk)(client, checkRefs), "inboundUri", "inbound URI", options.namesRoot),
             getTrunk: (0, operations_1.getTrunk)(client),
             listTrunks: (0, operations_1.listTrunks)(client),
             deleteTrunk: (0, operations_1.deleteTrunk)(client)